You do not need to change DNS to use Bedrock. The default path is the WordPress plugin plus this Hub: a request firewall, login lockouts, two-factor, a malware scan, and (on Pro) virtual patches. Most sites stop there.

Bedrock is not Cloudflare and it is not a DNS or CDN firewall. An edge CDN or WAF can absorb volumetric floods and other traffic that never reaches PHP. That layer inherently needs a nameserver change or a CNAME. We will not pretend otherwise, and we will not ship a fake edge in PHP.

Treat Cloudflare (or a similar CDN) as optional and advanced. Add it later only if you are comfortable changing DNS and you are seeing floods that hit the server before WordPress runs. For extra filtering with no DNS change, ask your host about ModSecurity or Imunify. We do not partner with a host.

If you later choose Cloudflare, use their current docs (labels change):

1. Create an account and add the domain as a zone. Official overview: Add a site.
2. At your registrar, point nameservers to the pair Cloudflare shows, or add the CNAME they document. Wait until the zone is active. This is the DNS change.
3. Proxy the website hostname (orange cloud). See proxy status.
4. Set SSL/TLS to Full (strict) when the origin already has a valid certificate. Full is the fallback if the origin cert is self-signed. Avoid Flexible if you can. See SSL modes.
5. On the free plan you can usually enable Always Use HTTPS and Bot Fight Mode. Managed WAF rule sets are typically a paid Cloudflare plan. Check Bot Fight Mode (free).

If you already have a Cloudflare zone, skip the nameserver steps. Open Hub Cloud, paste a scoped token, pick the zone, and turn Cloud firewall on. That path does not change DNS. Connect Cloudflare.

If the site sits behind Cloudflare, set Bedrock trust_proxy to Cloudflare so lockouts see the visitor, not the edge. Stay on the no-DNS path.