The level of response is overwhelming 

Hi Cathal,

I was actually waiting for someone to comment from the moodle.org's as you mentioned asking for site admins putting their experiences, I have used CloudFlare together with Incapsula and Google Page Speed (Now retired), not for the reasons of security as since I have started using Moodle back in 2009, I havent heard one case of security breach in Moodle, but for performance reasons and have found CloudFlare working very well even with beta features (Rocket Loader) turned on, where they did mentioned if it shows issues can be turned off.

I was just thinking a day before your post arrived, Moodle may will not be able to make full use of CloudFlare in terms of caching as CloudFlare's servers does only cache files that are in public_html/wwwroot, anything outside may will not be cached and essentially all files that are uploaded in moodle goes to moodledata folder that is effectively outside of public_html folder.

In terms of security, I had always kept it essentially turned off for I have seen sometimes Ukranian search engine bots (yandex) are blocked plus a few around, but they didnt and never imposed any threat to website, and regards to that I have already mentioned no case heard of moodle being hacked (Kudos to weekly updates to Moodle)

I can say, the use of CF's security where your core server isn't hardened properly, plus those web scripts that are highly used as per statistics (Like WordPress), so putting tight security using CF on a wordpress site makes more sense to me.

Rest if you want to use CF for performance purposes, then surely its recommended.

I don't speak for them but Moodle HQ tend not to comment on such things.

Hi Cathal,

Though I wasn't involved in deciding to use Cloudfare on Moodle.org, I do know a little bit about our use of it here and have dealt with some problems relating to it.

In response to your request for us to write up our experiences - I'd say you are over-estimating the interesting things we have to say about it. My brief comments would be:

• Moodle.org, as a public site used worldwide can benefit from the cloudflare CDN to lower latency to various places around the world and offload some requests. We are not using complex configuration to achieve this, Moodle comes out the box with cacheable resources served with the correct headers so cloudflare does this like any reverse proxy would.
• In general, the various 'security features' have tended not to protect against spam onslaughts and created many false positives. My sense is that it particularly negatively impacts our users from the developing world so we usually have the security level turned off
• I do not think you can really draw from experiences of moodle.org for other Moodle sites. Moodle.org is a bit of an unusual case (lots of non-logged in use which is not really a good fit for an LMS).

cheers,

Dan

Hi Cathal,

Moodle.org uses CloudFlare to primarily provide CDN and DDoS mitigation services,

As security is only as strong as it's weakest link, I'd prefer not to disclose in detail the functions we use on the CloudFlare nor our hosting environments.

I will, however, note that CF does save us a considerable amount of bandwidth in normal HTTP requests alone (last month saving ~ 2.8TB).

Like in real life, in the world of technology, there's really no such thing as bullet-proof, just resistant.

There certainly are some pitfalls to using CF, such as dependence on their infrastructure being available, having no control during upstream outages, and Caching can cause a problem at times.

Caching issues in particular can generally be worked around by sending the right headers, however some times you just need to clear the cache manually - so with this I'd advise only setting standard level caching, with a lower browser cache, and rely on the headers being sent from your hosting environment.

Utilise tools like mod_remoteip to fix the incoming IP addresses on your local instance, restrict access to the CF IP's as required, ensure SSL is not offloaded at the CF end.

Hope that helps,

Kind Regards,

Matt
ICT Manager
Moodle HQ