Demystifying Client Operation Modes (In Plain English)

Table of Contents

1. Why Modes Matter: The Foundation
2. Mode 1: DNS-Only Mode — “The Private Address Book”
3. Mode 2: WARP Mode — “The Secure Express Lane”
4. Mode 3: Secure Web Gateway (SWG) Mode — “The Corporate Security Inspector”
5. Mode 4: Posture-Only Mode — “The Digital Badge”
6. Mode 5: Local Proxy Mode — “The Selective Bodyguard”
7. Mode 6: Traffic Only Mode — “The Tunnel Without the Filter”
8. The Complete Comparison Matrix
9. How to Switch Modes: Step-by-Step
10. Use Cases: When to Use Which Mode
11. Common Mode Confusion: FAQ
12. Next Steps

1. Why Modes Matter: The Foundation

If you’ve installed WARP (covered in Article 2), you’ve hit the first question most users ask: “What mode should I use?”

The WARP client is a Swiss Army knife with multiple blades for different security and networking scenarios. Understanding these modes makes the difference between:

• A home user who thinks they’re “protected” but is only encrypting DNS queries
• A corporate employee who accidentally routes all personal traffic through their employer’s inspection gateway
• A developer who breaks their local environment because they didn’t know about split tunneling
• An IT admin who deploys the wrong mode and floods the helpdesk with “the internet is slow” tickets

This article breaks down six operational modes as of July 2026. Five are officially documented by Cloudflare; one (Traffic Only) is a specialized variant available on desktop clients. We’ll explain each with plain-English analogies, technical under-the-hood details, and real-world guidance on when to use them.

2. Mode 1: DNS-Only Mode — “The Private Address Book”

The Analogy

Imagine you’re at a library looking up a friend’s phone number. Normally, anyone nearby can see which page you’re on. DNS-Only Mode is like using a private reading room — nobody sees which numbers you look up, but once you make the call, it’s no more private than before.

What It Actually Does

In DNS-Only mode (formerly “1.1.1.1 mode”), WARP routes only your DNS queries through Cloudflare’s 1.1.1.1 resolver. Your actual internet traffic travels directly through your ISP or local network, completely un-tunneled.

The DNS queries are always encrypted. You have two sub-flavors:

• DNS only (HTTPS): Uses DNS-over-HTTPS (DoH) — your DNS queries are wrapped inside standard HTTPS traffic, making them indistinguishable from regular web browsing to network observers.
• DNS only (TLS): Uses DNS-over-TLS (DoT) — your DNS queries travel over an encrypted TLS channel on a dedicated port (853).

What It Does NOT Do

• It does not encrypt your web traffic. If you visit an HTTP (not HTTPS) website, that traffic is still visible to your ISP and anyone on your local network.
• It does not mask your IP address. Websites still see your real public IP.
• It does not protect you from man-in-the-middle attacks on unencrypted connections.
• It does not route traffic through Cloudflare’s network for optimization.

Technical Under the Hood

When in DNS-Only mode, the WARP client creates a local DNS proxy that intercepts all DNS requests from your operating system. These requests are forwarded to 1.1.1.1 or 1.1.1.2 (for malware blocking) or 1.1.1.3 (for malware + adult content blocking) via an encrypted channel. No virtual network interface (tunnel) is created. Your routing table remains unchanged.citeweb_search:7#1

When to Use It

• At home on a trusted network where you just want to prevent your ISP from logging your DNS queries
• When you need maximum speed and don’t want the overhead of a full VPN tunnel
• When WARP full-tunnel breaks something (like a local printer, NAS, or smart home device) and you still want encrypted DNS
• On low-bandwidth connections (satellite, rural DSL) where tunnel overhead would be noticeable
• As a stepping stone for users new to WARP who want to start with the lightest touch

When NOT to Use It

• On public Wi-Fi where you need full traffic encryption
• When your employer requires full traffic inspection
• When you need to hide your IP address from websites
• When you need protection from network-level attacks beyond DNS snooping

CLI Configuration

# Set to DNS-Only mode (DoH)
warp-cli mode doh

# Or explicitly
warp-cli mode dns-over-https

# Verify
warp-cli settings | grep "Service mode"
# Expected: DnsOverHttps

3. Mode 2: WARP Mode — “The Secure Express Lane”

The Analogy

Imagine you’re driving on a highway. Normally, you take the public roads — anyone can see your license plate, and traffic cops (your ISP) can see where you’re going. WARP Mode is like entering a private toll road with tinted windows. The toll road operator (Cloudflare) knows you’re on the road, but nobody on the public highway can see you. The toll road also has better pavement and smarter routing, so you might actually get to your destination faster.

What It Actually Does

WARP Mode (formerly “1.1.1.1 with WARP”) is the full-tunnel experience. It encrypts all device traffic and routes it through Cloudflare’s global network using either the MASQUE protocol (over HTTP/3 and QUIC) or WireGuard. Your DNS queries are also encrypted, either via UDP inside the tunnel, DNS-over-TLS (DoT), or DNS-over-HTTPS (DoH).citeweb_search:7#0

This is the mode most people think of when they hear “WARP.” It provides:

• Full traffic encryption from your device to Cloudflare’s edge
• IP address masking — websites see a Cloudflare IP, not your real one
• Post-quantum cryptography protection against future “harvest now, decrypt later” attacksciteweb_search:7#0
• Optimized routing through Cloudflare’s Anycast network

The Three Flavors of WARP Mode

As of 2026, WARP mode comes in three DNS sub-variants:citeweb_search:7#0

Technical Under the Hood

When WARP mode activates, the client creates a virtual network interface (a “tunnel adapter”) on your device. All traffic is redirected through this interface, encrypted, and sent to the nearest Cloudflare PoP. The client maintains three connections to Cloudflare:citeweb_search:7#1

1. WARP tunnel (MASQUE or WireGuard over UDP) — for all IP packet routing
2. DoH connection (HTTPS inside the tunnel) — for DNS resolution to Gateway
3. Device orchestration (HTTPS outside the tunnel) — for registration, posture checks, and profile updates

When to Use It

• On public Wi-Fi (coffee shops, airports, hotels) — full encryption of all traffic
• When your ISP throttles specific services — WARP can bypass throttling by obfuscating destination
• For general privacy — prevents local network snooping and ISP traffic analysis
• For WARP+ subscribers — Argo Smart Routing only works in full WARP mode
• As the default mode for most users who want “set it and forget it” protection

When NOT to Use It

• When you need to access local network devices (printers, NAS, smart home hubs) without split tunnel configuration
• When your corporate policy requires SWG inspection (you need SWG mode instead)
• When you’re on a metered connection and want to minimize data overhead
• When you’re gaming competitively and every millisecond of latency matters (though WARP+ can help)

CLI Configuration

# Set to full WARP mode with DoH (recommended)
warp-cli mode warp+doh

# Or with DoT
warp-cli mode warp+dot

# Or with UDP DNS inside tunnel (default)
warp-cli mode warp

# Verify
warp-cli settings | grep "Service mode"
# Expected: WarpWithDnsOverHttps

4. Mode 3: Secure Web Gateway (SWG) Mode — “The Corporate Security Inspector”

The Analogy

Imagine you work at a high-security facility. Every package you send or receive goes through a security checkpoint. Guards inspect the contents, scan for threats, and block anything dangerous. They also log everything for compliance. You can’t bypass this checkpoint — it’s mandatory. The guards don’t read your personal diary (HTTPS encryption prevents that), but they can see the envelope, check the sender, and block known bad addresses.

What It Actually Does

Secure Web Gateway (SWG) mode is the enterprise evolution of WARP mode. It routes business traffic through Cloudflare’s Secure Web Gateway — a cloud-based security service that inspects traffic for malware, phishing, data loss, and policy violations. It is the backbone of Cloudflare Zero Trust.citeweb_search:7#2

SWG mode enables:

• DNS filtering — block malicious domains, categories (gambling, social media), and custom lists
• Network firewall policies — L3/L4 filtering based on IP, port, protocol
• HTTP inspection — deep inspection of web traffic for threats and data leakage
• Browser Isolation — render risky websites in a remote sandbox
• Identity-based policies — different rules for different users/groups
• Data Loss Prevention (DLP) — prevent sensitive data from leaving the organization
• Antivirus scanning — real-time malware detection in downloads
• Device posture checks — verify device health before granting access

The Critical Distinction: Consumer vs. Enterprise

Consumer WARP (free or WARP+) connects you to Cloudflare’s general network. SWG mode connects you to your organization’s specific Zero Trust dashboard, where your IT team has configured custom security policies. This requires:

• A Cloudflare Zero Trust account
• Device enrollment via warp-cli teams-enroll <org-name>
• Organization-specific configuration profiles

How SWG Differs from Consumer WARP

Technical Under the Hood

In SWG mode, the WARP client maintains the same three connections as consumer WARP, but with critical differences:citeweb_search:7#1

1. The WARP tunnel routes to your organization’s Gateway instance, not the general consumer network
2. The DoH connection resolves against your organization’s custom DNS resolver with policy enforcement
3. The device orchestration connection authenticates against your org’s identity provider (Okta, Azure AD, Google Workspace, etc.)

Your IT admin configures Split Tunnel rules to determine what traffic goes through the tunnel (corporate resources) and what bypasses it (personal streaming, local network). Local Domain Fallback determines which DNS requests go to your private DNS resolver vs. Cloudflare Gateway.citeweb_search:7#1

When to Use It

• As a corporate employee when your IT department mandates Zero Trust access
• When accessing sensitive corporate resources that require device posture verification
• When your organization needs compliance logging (HIPAA, SOC 2, GDPR)
• When you need granular web filtering beyond basic malware blocking
• For remote workers accessing internal applications without a traditional VPN

When NOT to Use It

• For personal use (you need a Zero Trust organization to use SWG mode)
• When you want to avoid organizational traffic inspection
• On personal devices not managed by your employer (unless explicitly allowed)
• When you need to bypass corporate policies (which would violate your employment agreement)

CLI Configuration

# Enroll into a Zero Trust organization
warp-cli teams-enroll your-org-name

# After enrollment, the mode is controlled by your admin's device profile
# You can check current enforced mode:
warp-cli settings | grep "Service mode"
# Expected: WarpWithDnsOverHttps (or admin-defined variant)

# Force a refresh of MDM/org configuration (new in 2026)
warp-cli mdm refresh

5. Mode 4: Posture-Only Mode — “The Digital Badge”

The Analogy

Imagine you work at a building with keycard access. The keycard reader at the door doesn’t care about the contents of your backpack — it only checks that your badge is valid, your photo matches, and your security clearance is current. Once verified, the door opens, and you walk through the public hallway like anyone else. The badge check is invisible to everyone except the security system.

What It Actually Does

Posture-Only mode is the most specialized and least understood WARP mode. In this mode, the WARP client does not route traffic or forward DNS queries. It does one thing and one thing only: **collects device health information and reports it to Cloudflare Zero Trust.**citeweb_search:7#2

Think of it as a silent health monitor. It checks things like:

• Operating system version — is the device patched and up to date?
• Antivirus status — is AV installed, running, and up to date?citeweb_search:8#4
• Disk encryption — are all physical disks encrypted?
• Firewall status — is the host firewall enabled?citeweb_search:8#2
• Domain join — is the Windows device joined to the corporate Active Directory?
• File presence — is a specific file present (e.g., a corporate certificate or patch marker)?citeweb_search:8#2
• Application running — is a required security agent (CrowdStrike, SentinelOne, Carbon Black) active?citeweb_search:8#2
• Serial number — is the device in the approved inventory?citeweb_search:8#2

These “posture signals” are then used by your organization’s Access policies to determine whether to let you into applications. For example: “Only allow access to the payroll system if the device has disk encryption AND antivirus AND is running the latest OS patch.”

What It Does NOT Do

• It does not encrypt your traffic
• It does not route your DNS through Cloudflare
• It does not create a tunnel
• It does not inspect your web browsing
• It does not slow down your internet connection

Technical Under the Hood

In Posture-Only mode, the WARP client maintains only the device orchestration connection to Cloudflare. It periodically runs checks against the local operating system (querying Windows Security Center API for AV status, checking OS version strings, verifying disk encryption via BitLocker/FileVault status) and uploads the results.citeweb_search:8#4

The client service mode is reported as PostureOnly in warp-cli settings.citeweb_search:7#2

When to Use It

• When your organization uses Cloudflare Access (not Gateway) and only needs device health verification
• On high-performance workstations where any tunnel overhead is unacceptable
• On devices that already have a separate VPN for traffic routing but need to prove health to Cloudflare
• For compliance-only scenarios where the goal is “prove the device is secure” rather than “inspect all traffic”
• When IT wants minimal user friction — users won’t notice any network changes

When NOT to Use It

• When you need traffic encryption or DNS filtering
• When your organization requires HTTP inspection or DLP
• When you’re on an untrusted network and need full tunnel protection
• When your admin hasn’t configured Access policies that use posture checks

CLI Configuration

# Posture-Only mode is typically set by your admin via MDM or device profile
# You can verify if you're in this mode:
warp-cli settings | grep "Service mode"
# Expected: PostureOnly

# Check what posture attributes are being evaluated
# (Results depend on your org's configured checks)

6. Mode 5: Local Proxy Mode — “The Selective Bodyguard”

The Analogy

Imagine you have a personal bodyguard, but you don’t want them following you everywhere — that would be overkill. Instead, you give them a list: “Follow me to the bank, the embassy, and when I meet with clients. But when I go to the gym, the grocery store, or visit friends, stay home.” The bodyguard only protects you during high-risk activities, leaving your personal life unobstructed.

What It Actually Does

Local Proxy mode (also called “Proxy mode”) allows you to route only specific applications through WARP, while everything else uses your regular internet connection. It creates a local HTTP or SOCKS5 proxy on your device (by default on port 40000) that applications can be configured to use.citeweb_search:7#2

This mode is available only on desktop clients (Windows, macOS, Linux) and is hidden in the Advanced settings because it leaves most traffic unencrypted by default.citeweb_search:7#0

How It Works

1. You enable Local Proxy mode in WARP settings
2. WARP creates a local proxy listener (e.g., 127.0.0.1:40000)
3. You configure specific applications (web browser, curl, Git, specific IDEs) to use this proxy
4. Only traffic from those applications goes through WARP; everything else bypasses the tunnel

The 2026 Enhancement: Transparent HTTP Proxying

As of 2025, Local Proxy mode received a significant upgrade. It now supports transparent HTTP proxying in addition to traditional CONNECT-based proxying. Additionally, proxy mode switched from an L3 tunnel to an L4 tunnel with custom congestion control optimizations, more than doubling throughput in lab testing. MASQUE is now the only supported protocol for proxy mode.citeweb_search:7#3

Technical Under the Hood

In Local Proxy mode, the WARP client does not create a system-wide virtual network interface. Instead, it opens a local TCP port and acts as a standard HTTP/SOCKS5 proxy. Applications must be explicitly configured to use localhost:40000 (or your chosen port). The client service mode is reported as WarpProxy on port 40000.citeweb_search:7#2

When to Use It

• When you only need to secure specific applications (e.g., corporate browser for work, while personal browser stays direct)
• When running development tools that need WARP for API access but you want local servers un-tunneled
• When full-tunnel WARP breaks local network services and you don’t want to configure split tunnels
• For CI/CD pipelines where only specific build steps need secure egress
• When you need to preserve your real IP for most traffic but want WARP protection for sensitive operations

When NOT to Use It

• When you need system-wide protection (use full WARP mode instead)
• When you might forget to configure an application to use the proxy
• When your organization requires all traffic to be inspected
• On mobile devices (not supported)

Configuration Steps

# 1. Enable proxy mode in WARP settings (GUI: Preferences > Advanced > Configure Proxy)
# Or via MDM/device profile for enterprise deployment

# 2. Configure your application to use the proxy
# Example: curl
curl --proxy http://127.0.0.1:40000 https://api.example.com

# Example: Git
git config --global http.proxy http://127.0.0.1:40000
git config --global https.proxy http://127.0.0.1:40000

# Example: Environment variables for CLI tools
export HTTP_PROXY=http://127.0.0.1:40000
export HTTPS_PROXY=http://127.0.0.1:40000

# 3. Verify only proxied traffic goes through WARP
curl --proxy http://127.0.0.1:40000 https://www.cloudflare.com/cdn-cgi/trace | grep warp
# Expected: warp=on

curl https://www.cloudflare.com/cdn-cgi/trace | grep warp
# Expected: warp=off (direct connection)

7. Mode 6: Traffic Only Mode — “The Tunnel Without the Filter”

The Analogy

Imagine you’re driving through a foreign country. You want to use the toll road for better roads and less traffic, but you have your own GPS and don’t want the toll road company’s navigation overriding your directions. Traffic Only mode is the toll road without the built-in navigation — you get the infrastructure (the tunnel) but keep your own DNS resolver.

What It Actually Does

Traffic Only mode routes all device traffic through the WARP tunnel but leaves DNS resolution managed by the device’s operating system. Your DNS queries do not go to Cloudflare Gateway or 1.1.1.1 — they go wherever your OS is configured to send them (your ISP’s resolver, a Pi-hole, a corporate DNS server, etc.).citeweb_search:7#2

This mode is available only on desktop clients.

Why It Exists

Some organizations have robust DNS infrastructure — internal DNS servers, Active Directory-integrated DNS, or third-party DNS filtering like Cisco Umbrella. They want WARP’s traffic encryption and network firewall capabilities but don’t want Cloudflare to take over DNS resolution. Traffic Only mode accommodates this.

What It Enables vs. Disables

Technical Under the Hood

In Traffic Only mode, the WARP client creates the tunnel interface and routes IP traffic through it, but it does not create the local DNS proxy on 127.0.2.2/127.0.2.3. The OS continues using its configured DNS servers. The client service mode is reported as TunnelOnly.citeweb_search:7#2

Known Issue (as of July 2026): If you use Traffic Only mode with a custom DNS server on your primary network adapter, and you change that DNS address while WARP is connected, DNS resolution may break. The workaround is to disconnect and reconnect WARP.citeweb_search:7#3

When to Use It

• When your organization has existing DNS infrastructure that must remain in control
• When you run a local DNS resolver (Pi-hole, AdGuard Home, BIND) that you don’t want WARP to bypass
• When you need WARP’s network security features but your compliance requires specific DNS logging
• For hybrid deployments where some users need full WARP+DNS and others need WARP without DNS

When NOT to Use It

• When you want Cloudflare’s DNS filtering (malware blocking, category filtering)
• When you’re a consumer user who just wants simple protection (use full WARP mode)
• When your admin hasn’t explicitly configured this mode for your device profile

CLI Configuration

# Traffic Only mode is set by your admin via device profile
# Verify current mode:
warp-cli settings | grep "Service mode"
# Expected: TunnelOnly

8. The Complete Comparison Matrix

Zero Trust Feature Availability by Mode

9. How to Switch Modes: Step-by-Step

On Desktop (Windows/macOS/Linux)

Via GUI:

1. Click the WARP icon in the system tray/menu bar
2. Click the cog icon → Preferences
3. Under Connection, select your mode:
   • WARP = Full tunnel (Traffic and DNS)
   • 1.1.1.1 = DNS-Only
   • Local Proxy = Proxy mode (if enabled in Advanced)

Via CLI:

# List available modes
warp-cli mode --help

# Consumer modes
warp-cli mode warp          # Full tunnel, UDP DNS
warp-cli mode warp+doh      # Full tunnel, DoH DNS
warp-cli mode warp+dot      # Full tunnel, DoT DNS
warp-cli mode doh           # DNS-Only, DoH
warp-cli mode dot           # DNS-Only, DoT

# Enterprise modes (set by admin profile, but can be verified)
warp-cli mode warp-with-dns-proxy  # SWG equivalent

# Check current mode
warp-cli settings | grep "Service mode"

# Check connection status
warp-cli status

On Mobile (iOS/Android)

1. Open the 1.1.1.1 or Cloudflare One Agent app
2. Tap the menu icon (≡)
3. Go to Settings → WARP
4. Toggle between:
   • 1.1.1.1 (DNS-Only)
   • WARP (Full tunnel)
   • WARP+ (Full tunnel with Argo Smart Routing, if subscribed)

Important Notes on Mode Switching

• Mode changes are instant — no restart required
• Consumer modes can be changed freely by the user
• Enterprise modes are enforced by device profile — users cannot override admin settings
• Switching from WARP to DNS-Only will drop the tunnel interface immediately
• Switching from DNS-Only to WARP may briefly interrupt connectivity while the tunnel initializes

10. Use Cases: When to Use Which Mode

Use Case 1: The Privacy-Conscious Home User

Profile: Browses from home, occasionally uses coffee shop Wi-Fi, wants basic privacy without complexity.

Recommended Mode: WARP (Full Tunnel)

Why: Provides complete protection on public Wi-Fi while remaining transparent at home. The “set it and forget it” approach means you don’t have to think about modes — just leave it on WARP and go about your day. Use DNS-Only only if you notice specific local services breaking.

Configuration:

warp-cli mode warp+doh
warp-cli connect
warp-cli enable-always-on

Use Case 2: The Corporate Remote Worker

Profile: Works from home, accesses sensitive company data, must comply with IT security policies.

Recommended Mode: SWG Mode (Traffic and DNS)

Why: Your IT department needs to enforce malware blocking, DLP, and compliance logging. SWG mode is non-negotiable in most corporate Zero Trust deployments. The device profile is pushed by your admin; you typically cannot change it.

Configuration:

# Enroll into your org
warp-cli teams-enroll your-company

# Mode is enforced by admin — verify with:
warp-cli settings | grep "Service mode"
# Expected: WarpWithDnsOverHttps

What to Expect:

• Some websites may be blocked by corporate policy
• File uploads/downloads may be scanned for malware
• Your browsing may be logged for compliance
• Personal traffic may be split-tunneled (bypasses inspection) depending on admin configuration

Use Case 3: The Developer with Local Infrastructure

Profile: Runs local Kubernetes clusters, Docker containers, home NAS, and smart home devices. Full WARP breaks local DNS resolution.

Recommended Mode: DNS-Only or WARP with Split Tunneling

Why: Full WARP redirects all DNS to Cloudflare, which breaks local .local domains, mDNS, and internal services. DNS-Only preserves your local network while still encrypting DNS queries to the internet. Alternatively, configure split tunnel exclusions for your local subnets (covered in Article 4).

Configuration:

# Quick fix: switch to DNS-Only
warp-cli mode doh

# Better fix: stay in WARP but exclude local domains
warp-cli tunnel host exclude "*.local"
warp-cli tunnel ip exclude "192.168.0.0/16"
warp-cli tunnel ip exclude "10.0.0.0/8"

Use Case 4: The High-Performance Workstation User

Profile: Video editor, 3D artist, or data scientist who needs every bit of bandwidth and can’t tolerate tunnel overhead.

Recommended Mode: Posture-Only (if corporate) or DNS-Only (if personal)

Why: Posture-Only adds zero network overhead — it only runs health checks in the background. Your traffic is direct and unfiltered. If you’re personal (not corporate), DNS-Only gives you DNS privacy without the tunnel latency.

Important Caveat: Posture-Only only works if your organization uses Cloudflare Access with posture-based policies. If your org requires Gateway inspection, you cannot use this mode.

Use Case 5: The Multi-Environment Consultant

Profile: Works with multiple client environments, each with different security requirements. Needs to switch between personal browsing, Client A’s Zero Trust, and Client B’s Zero Trust.

Recommended Mode: Multiple registrations with mode switching

Why: WARP supports switching between organizations. You can register with Client A’s Zero Trust (SWG mode), disconnect, register with Client B, or switch back to personal WARP.

Configuration:

# Switch from personal to Client A
warp-cli disconnect
warp-cli registration delete
warp-cli teams-enroll client-a-org

# Later, switch to Client B
warp-cli disconnect
warp-cli registration delete
warp-cli teams-enroll client-b-org

# Return to personal
warp-cli disconnect
warp-cli registration delete
warp-cli registration new
warp-cli mode warp+doh
warp-cli connect

Note: You cannot be connected to two organizations simultaneously. You must disconnect and re-register to switch.

Use Case 6: The CI/CD Pipeline Engineer

Profile: Needs to run automated tests that access Cloudflare-protected internal APIs, but doesn’t want to route all build traffic through WARP.

Recommended Mode: Local Proxy

Why: Configure only the specific test runner or API client to use localhost:40000. The rest of the build pipeline (package downloads, artifact uploads, external API calls) uses direct connections, avoiding unnecessary tunnel overhead.

Configuration:

# In your CI script
export HTTP_PROXY=http://127.0.0.1:40000
export HTTPS_PROXY=http://127.0.0.1:40000

# Only these commands go through WARP
curl https://internal-api.company.com/health
python -m pytest tests/integration/

# Unset proxy for external traffic
unset HTTP_PROXY HTTPS_PROXY
pip install -r requirements.txt  # Direct connection

11. Common Mode Confusion: FAQ

Q: I turned on WARP, but warp=off on 1.1.1.1/help. Am I protected?

A: You’re likely in DNS-Only mode. The 1.1.1.1/help page checks for the WARP tunnel, not DNS encryption. If you want full protection, switch to WARP mode:

warp-cli mode warp+doh
warp-cli connect

Q: My company says I must use WARP, but I don’t want them seeing my personal browsing.

A: This depends on your organization’s Split Tunnel configuration. Many companies configure “exclude” split tunnels for popular personal sites (Netflix, Spotify, personal email) or entire categories. Ask your IT admin about the split tunnel policy. If no split tunnel is configured, all traffic is inspected. Do not attempt to bypass corporate policy — this can violate your employment agreement.

Q: Can I use WARP and a commercial VPN at the same time?

A: No. WARP and other VPNs compete for the same system network extension/tunnel interface. Only one can be active. If you need location spoofing (e.g., for streaming), disable WARP and use your commercial VPN. If you need WARP’s security, disable the commercial VPN.

Q: What’s the difference between WARP and WARP+?

A: WARP+ is a paid subscription ($5–$10/month) that adds Argo Smart Routing — Cloudflare’s private backbone network that finds faster paths than the public internet. The security model is identical to free WARP. WARP+ does not change modes or add new features beyond routing optimization.citeweb_search:7#0

Q: I’m in SWG mode, but some sites load slowly. Why?

A: SWG mode routes all traffic to your organization’s Gateway for inspection. This adds a processing hop. Additionally, if your admin has enabled Browser Isolation for certain sites, those sites are rendered remotely and streamed to you as video — which can feel slower. Contact your IT admin to review policy settings.

Q: Can I use Posture-Only mode as a personal user?

A: No. Posture-Only mode requires enrollment in a Cloudflare Zero Trust organization. It is exclusively an enterprise feature. Personal users should use DNS-Only or WARP mode.

Q: I switched to DNS-Only, but my ISP still seems to know what I’m visiting.

A: DNS-Only encrypts your DNS queries, but if websites use Encrypted Client Hello (ECH) or if your browser has other telemetry, your ISP may still infer destinations. For complete traffic privacy, use full WARP mode. Also verify you’re actually in DNS-Only mode:

warp-cli settings | grep "Service mode"
# Should show: DnsOverHttps

Q: Why is Local Proxy mode hidden in Advanced settings?

A: Because it leaves most traffic unencrypted by default. Cloudflare considers this a power-user feature that requires explicit understanding of proxy configuration. If you forget to configure an application to use the proxy, that application’s traffic is direct and unprotected.citeweb_search:7#0

12. Next Steps

You now understand the six ways WARP can operate. In Article 4, we’ll dive into power-user settings and the CLI — covering WARP+ and Argo Smart Routing, protocol selection (MASQUE vs. WireGuard), split tunneling, trusted networks, and latency optimization for gamers and remote workers.

Quick Reference: Mode Selection Cheat Sheet

Series Navigation:
Article 1: Beginner’s Guide → Article 2: Mac & Linux Install → Article 3: Client Modes Explained → Article 4: Power-User Settings → Article 5: Enterprise Zero Trust → Article 6: Pro Troubleshooting → Article 7: WARP vs. Alternatives

Next: Part 4: Unlocking Performance — Power-User Settings and the CLI

Related Articles

Deepen your understanding with these curated continuations.

View All Articles

Cloudflare5 min read

Unlocking Internet Freedom — The Complete Beginner's Guide

An introductory guide to Cloudflare WARP. Learn how it works, how it differs from traditional VPNs, and why you should use it.

VishnuJul 03, 2026

Cloudflare5 min read

Cloudflare WARP Masterclass: From Beginner to Pro

Master Cloudflare WARP. Learn the fundamentals, client modes, installation, advanced performance optimization, and troubleshooting.

VishnuJul 01, 2026

Cloudflare5 min read

The Multi-OS Installation Guide — macOS & Linux

Step-by-step installation guide for Cloudflare WARP client on macOS and Linux, including command-line setup (warp-cli) and graphical interfaces.

VishnuJul 18, 2026