Wrangler CLI reference, DNS/proxy/Workers/R2 core concepts, and a safe domain-migration walkthrough.
| Category | Command | Description |
|---|---|---|
| Auth | wrangler login | Opens a browser OAuth flow to authenticate the CLI with a Cloudflare account. |
| Workers | wrangler init my-worker | Scaffolds a new Workers project with a default entry file and config. |
| Workers | wrangler dev | Runs a Worker locally with live reload for development. |
| Workers | wrangler deploy | Publishes the Worker to Cloudflare's edge network. |
| Storage | wrangler kv namespace create NAME | Creates a KV (key-value) namespace bindable to a Worker. |
| Storage | wrangler r2 bucket create NAME | Creates an R2 object storage bucket (S3-compatible, no egress fees). |
| Storage | wrangler d1 create NAME | Creates a D1 database — SQLite at the edge, queryable from a Worker. |
| Debugging | wrangler tail | Streams live logs from a deployed Worker in real time. |
| Pages | wrangler pages deploy ./dist | Deploys a static site build to Cloudflare Pages. |
Platform Building Blocks
DNS & Proxy
The core service — pointing a domain's nameservers at Cloudflare enables both DNS resolution and the orange-cloud proxy for any record.
Workers
Serverless JavaScript/WASM that runs at edge locations worldwide — near-zero cold start, billed per request/CPU time.
Pages
Static site hosting with Git-based deploys — pairs naturally with Workers/Functions for dynamic edges on an otherwise static site.
R2
S3-API-compatible object storage with no egress bandwidth fees — a common cost-driven replacement for S3 when egress dominates the bill.
WAF & Rate Limiting
Rules that block/challenge malicious traffic before it reaches the origin — configurable per-route without touching origin server config.
Page Rules / Rulesets
URL-pattern-matched behavior overrides (caching, redirects, security level) — evaluated in order, first match applies for legacy Page Rules.
The Orange Cloud
Proxied (orange)
DNS Only (grey)
SSL/TLS Mode
Under Attack Mode
Let Cloudflare scan existing DNS records first
Adding the site imports the current records automatically — verify every record (especially MX for email) is present before proceeding.
Set SSL/TLS mode to Full (Strict) before switching nameservers
Requires a valid certificate on the origin — avoids the "Flexible" mode trap where Cloudflare-to-origin traffic goes unencrypted.
Update nameservers at the registrar
Propagation can take up to 24 hours — the domain keeps working on the old nameservers until it fully cuts over.
Layer on WAF/firewall rules once live
Start with Cloudflare's Managed Ruleset before writing custom rules — covers common attack patterns without hand-tuning.