CloudFlare review: The Real Thing or Marketing Bullshit?

CloudFlare is a relatively new service that aims to improve performance and security of any site. This is my personal experience and review of their service.

Problems and solutions

CloudFlare aims to solve two things:

• improving performance by acting as a CDN and a DNS accelerator (amongst other things)
• improving security by filtering bad clients and bad requests (such as malicious bots and XSS/CSRF exploits)

How they do these improvements is very unclear. They have an overview page, but it does not have many details of how their technology actually works (for me it's mostly marketing fluff).

By reading this Hacker News thread I got a better idea of how CloudFlare actually works, but the details are again very sparse:

• CloudFlare: A website security product accidentally makes sites 60% faster

Of what I could understand they improve performance and security by proxying all traffic to a globally distributed system. Sounds like a decent solution.

They have a free and pro service. The pro service is rather inexpensive, only $20 pr. month!

After some speculation I had to try them out since I care a lot about performance and security - and for me CloudFlare sounds like a cheap way to improve both!

CloudFlare's sign up experience

To start using CloudFlare you must change your name servers to CloudFlares. This might sound alarming and complex, but the process is very easy and non painful (at least if you are storing your domains on GoDaddy).

I first moved Wedoist and after a successful move I moved Todoist as well.

This wasn't all, especially if you use SSL! The SSL setup step was buggy, slow and painful - I had to contact their support staff a lot of times and I was very close to give up. Eventually, the SSL issues got resolved and I could finally test their full service (this step took about 1 week of back and forth communication). Hopefully, I was just unlucky with my SSL setup.

Does CloudFlare improve performance?

I have Pingdom for both Todoist and Wedoist. Pingdom is a monitoring service that pings your website from multiple locations around the world and keeps a track of downtime and speed.

To my big surprise CloudFlare's accelerator made my site slower, from ~500ms to ~650ms (at least according to Pingdom):

I contacted them and their reasoning for the decreased performance was increased traffic:

You went from 12,000 hits to over 128,000 on wedoist.com alone.
Anytime you have a significant jump in traffic your site performance will be compromised slightly.

Now, 128.000 hits is nothing in terms of traffic and should not decrease performance. Also, from my internal stats I did not have a 10x increase in traffic.

So the bottom line is: according to my stats they don't actually improve performance and their reasoning isn't sound why my performance was decreased. This was a show stopper for me.

Does CloudFlare improve security?

It's hard to tell and I did not test this. After the decreased performance I pretty much gave up on CloudFlare.

Improved security sounds awesome thought, but I am very unsure how they actually improve security. There's very little information on how their system works.

In general I think any developer should be very careful with security and protect against XSS and CSRF exploits directly in their own code. This is at least what I try to do with sensitive requests.

My conclusion

I stopped using CloudFlare after I observed degraded performance. Degraded performance is a huge setback for a service that claims to improve performance by 60%.

They are still a new service and I wish them good luck in the future. It could be I was unlucky and I will definitely try them out again if others report an observable performance gain by using them.

Currently thought, I think it's too much marketing speak, too many unknowns and too few real results. Like an old quote says:

If something sounds too good to be true, it probably is.

If you have any experience with CloudFlare please leave a comment. I had done some research, but I found very few reports.