The toggles that look free
Cloudflare's Speed tab is a row of switches that promise faster pages with no work. On a decade-old WordPress site with unoptimised images and render-blocking scripts, several of them deliver. On a site built properly, with a framework that already handles scripts, images and CSS, some of them do nothing and a few make things worse in ways that are hard to trace back to a switch in a dashboard.
Here is what each does, and the honest verdict for a modern site.
Rocket Loader
What it does: rewrites every <script> tag on the page so scripts load asynchronously after the page has rendered, via Cloudflare's own loader, regardless of what the HTML said.
When it helps: a legacy site with synchronous scripts in the head that block rendering and cannot be changed. Rocket Loader defers them and first paint improves.
When it hurts: any site where script order or timing matters, which is every modern site. It breaks inline scripts that expect a library to be present, delays scripts that were correctly marked to run early (an anti-flash theme script, a consent script that must run before tags), and interferes with framework hydration by changing when bundles execute. It has caused blank pages on React sites, double-initialised widgets, and INP regressions from bundles all executing in one burst after load. It also makes debugging miserable because the scripts in the page are not the scripts in your source.
Verdict: off for any framework site, any site with a build step, and any site whose scripts already use defer, async or type="module". If you must keep it for a legacy site, exclude specific scripts with data-cfasync="false".
Polish
What it does: compresses images at the edge, losslessly or lossily, and optionally converts to WebP (and AVIF on higher plans) for supporting browsers.
When it helps: a site serving unoptimised originals. Polish shrinks them without touching the origin.
When it hurts: a site that already serves optimised, correctly sized images in modern formats. Polish either does nothing (already small) or recompresses an already-compressed image, adding artefacts for negligible saving. If your framework's image pipeline (Next.js Image, WordPress with a good pipeline) serves WebP or AVIF at the right size, Polish is redundant, and a double conversion can produce worse output than either alone.
Verdict: on for sites with no image pipeline; off, or lossless only, for sites with one. Never both Polish and a framework optimiser doing lossy work on the same image.
Mirage
What it does: on slow connections and mobile devices, serves low-resolution placeholders first and loads full images as they enter the viewport, via a Cloudflare script.
When it helps: the same legacy site: large images, no srcset, no lazy loading.
When it hurts: modern sites already have native lazy loading and srcset. Mirage adds a script, replaces images with placeholders that then swap (a visible flash and, on some layouts, a shift), and interferes with images that must load eagerly, including the LCP image, which it can delay. It also breaks with some responsive image setups, showing the wrong size.
Verdict: off. Native loading="lazy" and srcset do the job without a script.
Auto Minify
What it does: strips whitespace and comments from HTML, CSS and JavaScript at the edge.
When it helps: a site serving unminified assets.
When it hurts: a site whose build already minifies. Gains are near zero. Occasionally the HTML minifier breaks inline scripts or <pre> content that depended on whitespace. Cloudflare deprecated Auto Minify for JS and CSS in 2024 for exactly these reasons.
Verdict: off. Minify in the build.
Early Hints
What it does: sends a 103 Early Hints response with preload and preconnect headers before the origin has finished generating the page, so the browser starts fetching critical assets sooner.
When it helps: any site with a measurable TTFB where critical assets (fonts, the main stylesheet, the LCP image) can be named before the page is ready. Genuinely useful, especially on dynamic pages.
When it hurts: rarely. It requires the origin to send Link headers for what to hint, or Cloudflare to learn them from the page. Mis-hinting non-critical assets competes with critical ones.
Verdict: on, with the origin sending Link: <...>; rel=preload for the two or three assets that gate first paint.
Brotli, HTTP/3, 0-RTT
What they do: better compression than gzip; a faster transport protocol; faster resumption of TLS sessions.
Verdict: on. These are protocol improvements with no downside for content.
Cache Everything and APO
What they do: cache full HTML at the edge ("Cache Everything" page rules, or Automatic Platform Optimization for WordPress), so pages are served without hitting the origin.
When it helps: enormously, for any site whose HTML can be cached. This is the single most effective Cloudflare feature for TTFB.
When it hurts: when HTML is personalised (logged-in users, carts, dynamic pricing) and the cache does not bypass correctly, serving one user's page to another. APO for WordPress handles the common cases; a hand-written Cache Everything rule needs bypass rules for cookies and paths. For framework sites on Vercel or similar, the platform already caches at its own edge; a second HTML cache in front adds staleness without adding speed.
Verdict: on for WordPress via APO with the bypass rules checked; off for framework sites already served from an edge.
How to find out what a toggle did
Turn one thing on or off, purge the cache, and compare a Lighthouse run and a DevTools trace on a throttled mobile profile before and after. Look specifically at whether the LCP element changed, whether new scripts appeared (Rocket Loader and Mirage inject their own), and whether the console gained errors. Field data confirms over weeks; the trace tells you in minutes.
The short version for a modern site
On: Brotli, HTTP/3, Early Hints, edge HTML caching where the platform does not already do it. Off: Rocket Loader, Mirage, Auto Minify, and Polish unless there is no image pipeline. Checking the Cloudflare Speed tab is a standard step in a Core Web Vitals audit, because a well-built site with Rocket Loader on is a well-built site with a mystery INP problem, and the mystery is a switch.