Cloudflare for Shopware: protection and speed without side effects

What makes Shopware different from a website

A company website delivers the same page to every visitor. Shopware does not: as soon as a visitor puts something in the basket, logs in or belongs to a customer group with its own prices, the page is personal. Shopware marks this with cookies and works with its own HTTP cache that handles exactly this distinction. Cloudflare has to adopt it, not override it.

Then there are the machines: the administration with its API, the Store API for headless frontends and apps, the callbacks of the payment providers, the synchronisation with ERP and PIM. None of them has a browser, all of them look suspicious to blanket bot protection. A Cloudflare setup for Shopware is therefore first of all a list of exceptions that fit the shop — and only then a set of rules against attackers.

Cache rules that understand the shop

Static files — theme, scripts, media, product images — can be held by Cloudflare for a long time. This is where the biggest gain in load time and server load lies, especially during promotions. Page content is cached at the edge only while the visitor has no session; as soon as Shopware sets a session cookie, the request bypasses the cache and goes to the shop. Basket, checkout, customer account and administration are never cached.

Shopware’s own HTTP cache stays active — both layers have to fit together, otherwise they show different states. And we tie cache clearing to the shop: when a product is changed or a price updated, the old version disappears at the edge too, not only after it expires. Convenience features that rewrite or lazy-load scripts we switch off; they silently break storefront and administration.

Firewall and bot protection with the right exceptions

Only those who need the administration can reach it: by network, country or with a challenge in front. The API stays open for the interfaces you actually use, and for nobody else. The callback addresses of your payment providers are explicitly on the allow list, as are monitoring and ERP. Requests for files that do not exist in a Shopware shop — foreign admin paths, configuration backups — are dropped immediately.

For bot protection the plan decides: the simple Bot Fight Mode has no exceptions and is practically unusable for a shop with a payment provider. Super Bot Fight Mode allows verified bots and custom rules that exclude certain paths — so the scanner sees the challenge page and the payment provider does not. Rate limiting caps login attempts, search queries and account registrations per sender; Turnstile protects registration and contact form without picture puzzles.

Rules are never finished. After going live we read the security events and check whether anything was blocked that should have passed. False positives become exceptions, new patterns become rules.

Encryption, and a server that only Cloudflare can reach

The connection between Cloudflare and your server stays encrypted all the way — with a valid certificate on the server, not in the “flexible” mode that lets traffic behind Cloudflare run in plain text. The server itself accepts web requests only from Cloudflare’s networks; on request Cloudflare additionally identifies itself to the server with a certificate.

And so that Shopware still sees real visitors: logs, the shop’s own login throttle and statistics receive the original visitor address from the Cloudflare header instead of the address of the Cloudflare network. Without this detail every server-side throttle runs into nothing — and every visitor looks the same to the shop.

Operation and your account

The Cloudflare account belongs to you; we work as a member with the necessary rights. Every setting is documented and justified. Because attack patterns, your interfaces and Cloudflare’s features change, the zone is part of the regular review cycle of our Shopware maintenance.

For context: Cloudflare is a US provider, and your customers’ traffic passes through its network. Using it belongs in the shop’s privacy policy and requires a data processing agreement, which Cloudflare provides. We supply the technical details.