sellPerformance

shield_moon

Smart Shield

Put your site behind Cloudflare and get smart traffic management, delivery, and origin protection by default.

330+Cities defending the edge

348 TbpsNetwork capacity to absorb attacks

FreeSSL/TLS included

AutoSensible defaults on by default

lightbulb

What is Smart Shield?

Smart Shield is Cloudflare's umbrella for the automatic protections that work the moment your site is proxied through the network. It intelligently manages traffic, optimizes how content is delivered, and safeguards your origin infrastructure — combining performance and security so a beginner gets sensible, safe defaults without configuring each feature by hand.

info

A bundle, not a single switch

Smart Shield is best understood as Cloudflare's bundle of automatic edge behaviours — free SSL, default caching, DDoS mitigation, smart routing, and compression. The exact features included depend on your plan; this page describes the protections honestly and generally.

security

Think of it like a smart building lobby

Before anyone reaches your office (origin server), they pass through a staffed lobby. It checks IDs, turns away troublemakers, hands visitors what they came for from a nearby shelf, and guides them in by the quickest hallway — all automatically.

help

What does it do for you?

Setting up performance and security separately is hard and easy to get wrong. Smart Shield gives you battle-tested defaults so the common protections are simply on.

https

Free HTTPS everywhere

A free SSL/TLS certificate encrypts traffic between visitors and Cloudflare automatically, so your site shows the padlock without buying a certificate.

gpp_good

DDoS protection

Cloudflare's huge network absorbs and filters denial-of-service attacks before they can reach and overwhelm your server.

visibility_off

Hidden origin

Proxying hides your server's real IP address, so attackers see Cloudflare instead of your machine.

smart_toy

Bot mitigation

Automatic checks separate real visitors from abusive bots and scrapers, reducing junk traffic.

route

Smart traffic management

Traffic is steered over efficient paths and served from cache where possible, easing load on your origin.

compress

Automatic compression

Modern compression like Brotli and protocols like HTTP/3 are applied at the edge to shrink and speed up responses.

target

Who is it for?

person

Beginners & small teams

If you don't have a security or performance expert, sensible automatic defaults are exactly what you want.

rocket_launch

New sites & launches

Get protection and speed from day one without a long configuration checklist.

savings

Budget-conscious owners

Free SSL, caching, and DDoS protection mean fewer separate tools and bills to manage.

trending_up

Growing traffic

As you scale, the same defaults keep absorbing spikes and attacks without re-architecting.

rocket_launch

How to turn it on

Most Smart Shield protections activate simply by routing your domain through Cloudflare. The key step is proxying your DNS records.

Proxy your DNS records
In DNS > Records, make sure your A/AAAA/CNAME records show the orange cloud. That single toggle routes traffic through Cloudflare and switches on the edge protections.
Set SSL/TLS to a secure mode
Under SSL/TLS, choose Full (strict) so traffic is encrypted end to end between visitors, Cloudflare, and your origin.
Enable Always Use HTTPS
Turn on 'Always Use HTTPS' so any http:// request is automatically upgraded to the secure https:// version.
Confirm protection is active
Check the response headers — a 'server: cloudflare' header confirms your traffic is now flowing through and protected by the edge.
bash
```
curl -sI https://example.com | grep -iE 'server|cf-ray'
# server: cloudflare
# cf-ray: 8a1b2c3d4e5f6789-LAX
```

tips_and_updates

Tips & pricing

tune

Defaults first, then tune

The automatic defaults are safe for almost everyone. Once you're comfortable, layer on WAF rules, finer cache rules, and Argo Smart Routing to go further.

Core protections like free SSL, default caching, and unmetered DDoS mitigation are available on the Free plan.
Advanced pieces (like Argo Smart Routing or higher-tier WAF) are paid upgrades.
Always pick Full (strict) SSL so the connection to your origin is also encrypted.
Don't proxy mail records — keep MX and email-auth records DNS-only (grey cloud).