What it does
Cloudflare WARP offers several consumer connection modes, including DNS-only encryption, device traffic tunneling and a desktop local proxy.
WARP's mode determines what is protected. DNS-only mode sends encrypted resolver queries but does not tunnel device traffic. Traffic modes route the device connection through Cloudflare, while the desktop local-proxy mode covers only applications configured to use that proxy.
WARP does not let you choose a different country as the apparent browsing location. Choose the mode around the task instead of assuming every WARP setting is a full-device VPN. The consumer client documentation explicitly points business administrators to the separate Cloudflare One Client, so enterprise enrollment and consumer WARP should not be mixed up.
Strengths
- Clear DNS-only versus traffic modes
- Selective desktop local proxy
Watch out for
- DNS-only mode does not tunnel device traffic
- Does not offer country selection for changing apparent browsing location
Best for
- Users choosing between encrypted DNS and broader traffic routing
Sources
- Overview · Cloudflare WARP client docs (Oct 26, 2026)
- WARP modes · Cloudflare WARP client docs (Oct 26, 2026)