Hey folks! I'm helping a new SaaS client set up their security on Cloudflare and this question came up. They're already using the proxy (the orange cloud) for DNS and basic protection.
My take: the proxy is like a basic shield—it hides your origin IP and handles simple threats. But the WAF is your active security guard, checking every request against known attack patterns (SQLi, XSS, etc.). So if you're handling any user data or have a public login, you probably want both layers.
What's the community's experience? Have you found the WAF essential even with the proxy on, or is it overkill for simple brochure sites? Would love your real-world insights!
xo
Happy customers, happy life.
Great analogy with the shield and guard! That really clarifies the layers for someone like me who's just starting to figure this out.
Your point about public logins hits home. I set up a simple contact form on a client site last month without the WAF, thinking the proxy was enough. We got hit with some basic SQL injection attempts that Cloudflare's basic threat detection didn't catch. It was a wake-up call that even "brochure" sites can have an attack surface if there's any form for input.
Do you find the default WAF rulesets are sufficient to start, or is there a lot of tuning needed to avoid blocking legitimate traffic? That's my next big worry before flipping the switch.