No. The default product is the WordPress plugin plus this Hub. You do not change DNS. Install, connect once, leave Protect on. That covers the WordPress request: a firewall, login lockouts, two-factor, a malware scan, and (on Pro) virtual patches.

Cloudflare (or another CDN) is optional and advanced. It sits in front of the hostname and can absorb floods that never reach PHP. That layer needs a nameserver change or a CNAME. Skip it unless you are comfortable changing DNS and you are seeing traffic that hits the server before WordPress runs.

For extra filtering with no DNS change, ask your host about ModSecurity or Imunify. We do not partner with a host. Bedrock is not Cloudflare and it is not a DNS firewall.

If you already use Cloudflare, Hub Cloud firewall can push our rules to your zone with a scoped API token. That does not move nameservers. It is optional. How to make the token.

No DNS change or Cloudflare later (optional).