Cloudflare review

Often yes; we still put it in front of nearly everything we launch. A host's bundled CDN generally handles caching, while Cloudflare also runs DNS, absorbs DDoS and brute-force traffic, and acts as a firewall between your domain and your origin. The caching overlaps, and on premium managed hosting with a strong web-application firewall the case is weaker. But for most sites, the protection and DNS alone justify it.

For most sites, yes, and it's not a trial-tier tease. The global CDN, fast DNS, free SSL, and serious DDoS and bot protection are all free, which is remarkable for infrastructure that would have been expensive not long ago. You move to paid tiers when you need specific things, not because the free plan stops working. Very few tools on this shelf give away this much.

The attacks every site gets and most owners never see: DDoS attempts that would take you offline, and constant brute-force traffic hammering login pages for a weak password. Because it sits in front of your origin, that traffic is absorbed before it reaches your server, so your hosting isn't paying for it either. For a WordPress site especially, that login-page filtering is one of the highest-value things you can put in place.

That it's real infrastructure, sitting in front of everything. A caching rule or DNS record set wrong can take a site down in ways that are hard to trace, because the fault isn't on your server, so you'll be looking in the wrong place. It rewards careful setup, and it's a good job for someone who's done it before to do once, properly, rather than learning on your live domain.