Why static sites on Cloudflare have less to patch (and what still needs watching)
A static website served from Cloudflare has no PHP, database or plugins running on a server of yours, so most of the patching a WordPress site needs simply doesn't apply. It still needs watching: the enquiry form and any Worker code behind it, the tools used to build it, your domain and Cloudflare account, and any third-party scripts on the page.
By Jarek Piotrowski · Last updated
What there is to patch on a typical WordPress site
WordPress runs on PHP with a database, plus every plugin and theme you install. Each is code on a server that needs updating when a flaw is found. On 21 Oct 2026, for example, the PHP project fixed two critical flaws that can allow unauthenticated remote code execution (what to check). Plugins and themes add more every month: this month's WordPress vulnerability counts.
A static site is a set of finished pages. There's no PHP, no database and no plugin code running for each visitor, so those patches don't apply to it.
What Cloudflare provides on every plan
- DDoS protection. Cloudflare says it "provides unmetered and unlimited distributed denial-of-service (DDoS) protection at layers 3, 4, and 7 to all customers on all plans and services" (Cloudflare docs).
- A basic managed WAF ruleset. The Cloudflare Free Managed Ruleset is "Available on all Cloudflare plans" and "Provides protection against high-impact and widely exploited vulnerabilities". The broader Cloudflare Managed Ruleset is on Pro plans and above (Cloudflare docs).
- HTTPS certificates. Cloudflare "issues — and renews — free, unshared, publicly trusted SSL certificates to all domains added to and activated on Cloudflare" (Universal SSL).
- The runtime is Cloudflare's to patch. For Workers, "Cloudflare directly controls the machines on which the Workers runtime operates", tenants "are isolated from each other using V8 isolates", and Cloudflare says "the Workers patch gap is now under 24 hours" (security model).
Bot Fight Mode is free too, with limits: it "Cannot be customized, adjusted, or reconfigured via WAF custom rules", and it may challenge API or mobile app traffic (Cloudflare docs).
What still needs watching
- Forms and Worker code. An enquiry form needs code behind it. That code is yours: it needs input checks, spam protection and testing after every change.
- Build tools and dependencies. The site is built with open-source tools before it's published. They need updating, even though they don't run for visitors.
- Your domain and Cloudflare account. Someone who takes over your registrar or Cloudflare login can change everything. Use strong, unique passwords and two-factor authentication on both.
- Third-party scripts. Analytics, chat widgets and embeds run code from someone else on your pages. Fewer is safer.
- Is it still working? Check the site loads and the form still delivers.
How I look after it
The sites I build are static sites on Cloudflare. Website management ($99 a month) covers monitoring, a daily check that the enquiry form still delivers, up to 30 minutes of edits a month and a reply within 1 business day. You own the domain and every account.
See how a website build works, or what website management covers.
Jarek Piotrowski runs LayerOps from Canberra: fast, lead-ready websites, and SEO and AI-answer visibility for professional and service businesses Australia-wide.