How to Connect Cloudflare, and What Agents Can Change There
Updated
Before You Start#
- Your domain is on Cloudflare and active there.
- The DNS record of your site is Proxied (the orange cloud in Cloudflare > DNS). A record set to DNS only does not go through Cloudflare, so nothing can be changed there.
- You can create API tokens on that Cloudflare account (the account owner, or a member allowed to).
Use this when no CMS connection reaches your site
On WordPress, Shopify, Webflow, Wix and the other platforms SEOmatic connects to, connect that platform instead: it can also rewrite page text and publish new articles.
Connect Cloudflare#
- In SEOmatic, on the Cloudflare row in Connections, click Add Connection, then open How to create the token and click token form in Cloudflare. Cloudflare opens Create Custom Token already filled in.
- Keep the four permissions: Workers Scripts Write, Workers KV Storage Write, Workers Routes Write and Zone Read.
- Under Zone Resources, pick your site (or keep All zones). Click Continue to summary, then Create Token, and copy the token. Cloudflare shows it once.
- Back in SEOmatic, paste it in Cloudflare API token and click Connect. Leave Your website empty to use your workspace's site.
SEOmatic checks the token, finds your site's zone, checks each permission and that your site goes through Cloudflare, then adds one Worker to your account (named seo-edge- and your domain) with its storage. It runs on no page yet: a page gets it only when a change goes live there.
What Your Agents Can Change Through Cloudflare#
| Change | What happens | Notes |
|---|---|---|
| SEO title and meta description | Live | The page's <title> and meta description, added if the page has none |
| Canonical and noindex | Live | The canonical link and the robots meta tag. Your page's other robots settings are kept |
| Structured data | Live | One JSON-LD block added to the page head. Your site's own structured data stays as it is |
| Internal links | Live | Around words already on the page. Text inside menus, buttons, existing links and scripts is never linked |
| Image alt text | Live | On the image with that exact address |
| Page text rewrites, new sections, FAQs | Can't do yet | Cloudflare adds to the page your server sends; writing new text needs a CMS or your code |
| New articles and pages | Can't do yet | Cloudflare changes pages that exist |
| Redirects, robots.txt, page addresses | Can't do yet | Not made through Cloudflare yet |
Each change counts only once SEOmatic sees it in your live page's HTML, read as a browser and as Googlebot. A change that does not show is put back and tried again.
How Your Site Stays Safe
- Your files never change. The change is added to the page as Cloudflare serves it. Undo a change in SEOmatic and the page is served exactly as your server sends it.
- Only changed pages. The Worker runs on the exact addresses of the pages that have a change, never on images, scripts, your API, sign-in, account, cart or checkout pages. A visit with extra parameters in the address (such as ?utm_source=) gets the page as your server sends it.
- Fail open. If anything goes wrong in the Worker, or its storage cannot be read, your page is served as your server sends it.
- Your own Workers come first. A page that already runs a Cloudflare Worker of yours is left alone.
- Disconnect removes everything: the Worker, its routes and its storage. Then delete the token in Cloudflare, under My Profile > API Tokens.
Sites whose JavaScript sets the title
If your app sets its own title or description after the page loads, browsers show that one. AI assistants and most crawlers read the page's HTML, which carries SEOmatic's. Google also runs your JavaScript, so on such a site Google may use the title your app sets.
Cloudflare's Free Plan and Busy Sites#
The Worker runs on Cloudflare's free Workers plan. SEOmatic never moves you to a paid plan. The free plan allows 100,000 Worker requests a day (reset at midnight UTC) and 100,000 storage reads a day, across your whole Cloudflare account. Only visits to pages that have a change count.
Past the daily limit, your pages show as your server sends them, without the changes, until the limit resets. SEOmatic asks Cloudflare for this (fail open) on every route it adds: in Cloudflare, open your domain, then Workers Routes, and if a route shows Fail closed, switch it to Fail open. If your changed pages get more than about 100,000 visits a day, bots included, Cloudflare's Workers Paid plan ($5 a month, 10 million requests included) keeps the changes on all day.
Fix Connection Errors#
| You see | What to do |
|---|---|
| This token does not see your site on Cloudflare | Check that the site is on this Cloudflare account, and that the token's Zone Resources include it (or All zones). |
| This token is missing... | Create the token again from the link with all four permissions: Workers Scripts Write, Workers KV Storage Write, Workers Routes Write and Zone Read. |
| ...its traffic does not go through Cloudflare | In Cloudflare > DNS, set the record of your site to Proxied (orange cloud), then connect again. |
| ...is on Cloudflare but not active there yet | Finish adding the domain in Cloudflare (its nameservers), then connect again. |
| Your Cloudflare account has reached its Workers limit | The free plan allows 100 Workers. Remove one you no longer use, then connect again. |
| That does not look like a Cloudflare API token | Paste the token Cloudflare showed after Create Token, not the Global API Key. |
Was This Article Helpful?
Still need help?Email contact@seomatic.ai with your site address and a screenshot. A person replies, usually within one business day.