The short list.
FLEXIBLE SSL
Causes redirect loops and is insecure. Use Full (strict).
The single most common Cloudflare fault.
PROXIED MAIL RECORDS
Breaks sending and receiving. Mail hostnames must be DNS only.
The second most common.
ROCKET LOADER
Changes when scripts run and breaks interactive elements.
MINIFICATION
Occasionally breaks scripts, particularly when a caching plugin is also minifying.
UNDER ATTACK MODE LEFT ON
Presents an interstitial to every visitor indefinitely.
DEVELOPMENT MODE LEFT ON
Bypasses cache, making the site slower. Expires after three hours, and people forget it was enabled.
AGGRESSIVE SECURITY LEVEL
Challenges legitimate visitors, including search engine crawlers.
FIREWALL RULES BLOCKING CALLBACKS
Payment gateway confirmations blocked, so orders stay unpaid.
CACHING HTML WITHOUT EXCLUSIONS
Serves personalised pages to the wrong people.
IGNORE QUERY STRING CACHING
Breaks anything using URL parameters meaningfully.
THE PATTERN
Most Cloudflare problems are two or three settings. Check those before anything else.
