We have a WP multisite with many mapped domains. We have added only the main domain to cloudflare. We are still attacked via all the other domains. Do we need to add all domains? Do we need to pay for all domains?
Cloudflare Free plans will do a pretty good job of protecting your server. All those other sites will need to use Cloudflare.
Are the mapped domains subdomains, or are they separate domains?
They are separate domains. At least most of them. There might be some subdomains, I will have to check. But the multisite uses the subfolder type. So default subsites are subfolders, and they are protected. But we have a domain mapping plugin and many separate domains mapped too.
We have the PRO plan on the main domain. So we can add the other domains as free plan? I guess that sounds good. There is no way we can pay for each domain.
I would definitely add everything not under your main domain to free plan(s). They can all be on the same Cloudflare account. Plans are charged (or free) on a domain-by-domain basis.
The only catch is those other domains need to change their name servers to Cloudflare. If all those other domains are under your control, then it’s easy.
Hmm… I see. Thank you sdayman for your help. We will see what we will decide. Sounds like a big dns mess to me. I don’t even think we have control over all the domains.