{
  "schemaVersion": "1.0",
  "entity": "BlogPosting",
  "title": "Demystifying Client Operation Modes (In Plain English)",
  "description": "A comprehensive guide to Cloudflare WARP client operation modes: DNS-Only, WARP, Secure Web Gateway, Posture-Only, and Local Proxy.",
  "author": "vd",
  "datePublished": "2026-07-19T00:00:00.000Z",
  "dateModified": "2026-07-19T00:00:00.000Z",
  "tags": [
    "Cloudflare",
    "WARP",
    "Networking",
    "Privacy",
    "Security"
  ],
  "aeoDirectAnswers": [
    {
      "question": "What It Actually Does",
      "answer": "In **DNS-Only mode** (formerly \"1.1.1.1 mode\"), WARP routes only your DNS queries through Cloudflare's 1.1.1.1 resolver. Your actual internet traffic travels directly through your ISP or local network, completely un-tunneled. The DNS queries are always encrypted. You have two sub-flavors: **DNS only (HTTPS):** Uses DNS-over-HTTPS (DoH) — your DNS queries are wrapped inside standard HTTPS traffic, making them indistinguishable from regular web browsing to network observers."
    },
    {
      "question": "What It Does NOT Do",
      "answer": "It does **not** encrypt your web traffic. If you visit an HTTP (not HTTPS) website, that traffic is still visible to your ISP and anyone on your local network. It does **not** mask your IP address. Websites still see your real public IP. It does **not** protect you from man-in-the-middle attacks on unencrypted connections."
    },
    {
      "question": "When to Use It",
      "answer": "**At home on a trusted network** where you just want to prevent your ISP from logging your DNS queries **When you need maximum speed** and don't want the overhead of a full VPN tunnel **When WARP full-tunnel breaks something** (like a local printer, NAS, or smart home device) and you still want encrypted DNS"
    },
    {
      "question": "When NOT to Use It",
      "answer": "On public Wi-Fi where you need full traffic encryption When your employer requires full traffic inspection When you need to hide your IP address from websites"
    },
    {
      "question": "What It Actually Does",
      "answer": "**WARP Mode** (formerly \"1.1.1.1 with WARP\") is the full-tunnel experience. It encrypts **all device traffic** and routes it through Cloudflare's global network using either the MASQUE protocol (over HTTP/3 and QUIC) or WireGuard. Your DNS queries are also encrypted, either via UDP inside the tunnel, DNS-over-TLS (DoT), or DNS-over-HTTPS (DoH).citeweb_search:7#0 This is the mode most people think of when they hear \"WARP.\" It provides: **Full traffic encryption** from your device to Cloudflare's edge"
    },
    {
      "question": "When to Use It",
      "answer": "**On public Wi-Fi** (coffee shops, airports, hotels) — full encryption of all traffic **When your ISP throttles specific services** — WARP can bypass throttling by obfuscating destination **For general privacy** — prevents local network snooping and ISP traffic analysis"
    },
    {
      "question": "When NOT to Use It",
      "answer": "When you need to access local network devices (printers, NAS, smart home hubs) without split tunnel configuration When your corporate policy requires SWG inspection (you need SWG mode instead) When you're on a metered connection and want to minimize data overhead"
    },
    {
      "question": "What It Actually Does",
      "answer": "**Secure Web Gateway (SWG) mode** is the enterprise evolution of WARP mode. It routes business traffic through Cloudflare's Secure Web Gateway — a cloud-based security service that inspects traffic for malware, phishing, data loss, and policy violations. It is the backbone of Cloudflare Zero Trust.citeweb_search:7#2 SWG mode enables: **DNS filtering** — block malicious domains, categories (gambling, social media), and custom lists"
    },
    {
      "question": "How SWG Differs from Consumer WARP",
      "answer": "| Aspect | Consumer WARP | SWG Mode (Zero Trust) | |--------|--------------|----------------------| | **Account** | Personal (free) | Organizational (managed) |"
    },
    {
      "question": "When to Use It",
      "answer": "**As a corporate employee** when your IT department mandates Zero Trust access **When accessing sensitive corporate resources** that require device posture verification **When your organization needs compliance logging** (HIPAA, SOC 2, GDPR)"
    },
    {
      "question": "When NOT to Use It",
      "answer": "For personal use (you need a Zero Trust organization to use SWG mode) When you want to avoid organizational traffic inspection On personal devices not managed by your employer (unless explicitly allowed)"
    },
    {
      "question": "What It Actually Does",
      "answer": "**Posture-Only mode** is the most specialized and least understood WARP mode. In this mode, the WARP client **does not route traffic or forward DNS queries**. It does one thing and one thing only: **collects device health information and reports it to Cloudflare Zero Trust.**citeweb_search:7#2 Think of it as a silent health monitor. It checks things like: **Operating system version** — is the device patched and up to date?"
    },
    {
      "question": "What It Does NOT Do",
      "answer": "It does **not** encrypt your traffic It does **not** route your DNS through Cloudflare It does **not** create a tunnel"
    },
    {
      "question": "When to Use It",
      "answer": "**When your organization uses Cloudflare Access** (not Gateway) and only needs device health verification **On high-performance workstations** where any tunnel overhead is unacceptable **On devices that already have a separate VPN** for traffic routing but need to prove health to Cloudflare"
    },
    {
      "question": "When NOT to Use It",
      "answer": "When you need traffic encryption or DNS filtering When your organization requires HTTP inspection or DLP When you're on an untrusted network and need full tunnel protection"
    },
    {
      "question": "What It Actually Does",
      "answer": "**Local Proxy mode** (also called \"Proxy mode\") allows you to route **only specific applications** through WARP, while everything else uses your regular internet connection. It creates a local HTTP or SOCKS5 proxy on your device (by default on port 40000) that applications can be configured to use.citeweb_search:7#2 This mode is available **only on desktop clients** (Windows, macOS, Linux) and is hidden in the Advanced settings because it leaves most traffic unencrypted by default.citeweb_search:7#0"
    },
    {
      "question": "How It Works",
      "answer": "You enable Local Proxy mode in WARP settings WARP creates a local proxy listener (e.g., 127.0.0.1:40000) You configure specific applications (web browser, curl, Git, specific IDEs) to use this proxy"
    },
    {
      "question": "When to Use It",
      "answer": "**When you only need to secure specific applications** (e.g., corporate browser for work, while personal browser stays direct) **When running development tools** that need WARP for API access but you want local servers un-tunneled **When full-tunnel WARP breaks local network services** and you don't want to configure split tunnels"
    },
    {
      "question": "When NOT to Use It",
      "answer": "When you need system-wide protection (use full WARP mode instead) When you might forget to configure an application to use the proxy When your organization requires all traffic to be inspected"
    },
    {
      "question": "What It Actually Does",
      "answer": "**Traffic Only mode** routes all device traffic through the WARP tunnel but **leaves DNS resolution managed by the device's operating system**. Your DNS queries do not go to Cloudflare Gateway or 1.1.1.1 — they go wherever your OS is configured to send them (your ISP's resolver, a Pi-hole, a corporate DNS server, etc.).citeweb_search:7#2 This mode is available **only on desktop clients**."
    },
    {
      "question": "Why It Exists",
      "answer": "Some organizations have robust DNS infrastructure — internal DNS servers, Active Directory-integrated DNS, or third-party DNS filtering like Cisco Umbrella. They want WARP's traffic encryption and network firewall capabilities but don't want Cloudflare to take over DNS resolution. Traffic Only mode accommodates this."
    },
    {
      "question": "What It Enables vs. Disables",
      "answer": "| Feature | Enabled? | |---------|----------| | Network firewall policies | ✅ Yes |"
    },
    {
      "question": "When to Use It",
      "answer": "**When your organization has existing DNS infrastructure** that must remain in control **When you run a local DNS resolver** (Pi-hole, AdGuard Home, BIND) that you don't want WARP to bypass **When you need WARP's network security features** but your compliance requires specific DNS logging"
    },
    {
      "question": "When NOT to Use It",
      "answer": "When you want Cloudflare's DNS filtering (malware blocking, category filtering) When you're a consumer user who just wants simple protection (use full WARP mode) When your admin hasn't explicitly configured this mode for your device profile"
    },
    {
      "question": "Q: I turned on WARP, but `warp=off` on 1.1.1.1/help. Am I protected?",
      "answer": "**A:** You're likely in **DNS-Only mode**. The 1.1.1.1/help page checks for the WARP tunnel, not DNS encryption. If you want full protection, switch to WARP mode:"
    },
    {
      "question": "Q: Can I use WARP and a commercial VPN at the same time?",
      "answer": "**A:** No. WARP and other VPNs compete for the same system network extension/tunnel interface. Only one can be active. If you need location spoofing (e.g., for streaming), disable WARP and use your commercial VPN. If you need WARP's security, disable the commercial VPN."
    },
    {
      "question": "Q: What's the difference between WARP and WARP+?",
      "answer": "**A:** WARP+ is a paid subscription ($5–$10/month) that adds **Argo Smart Routing** — Cloudflare's private backbone network that finds faster paths than the public internet. The security model is identical to free WARP. WARP+ does not change modes or add new features beyond routing optimization.citeweb_search:7#0"
    },
    {
      "question": "Q: I'm in SWG mode, but some sites load slowly. Why?",
      "answer": "**A:** SWG mode routes all traffic to your organization's Gateway for inspection. This adds a processing hop. Additionally, if your admin has enabled **Browser Isolation** for certain sites, those sites are rendered remotely and streamed to you as video — which can feel slower. Contact your IT admin to review policy settings."
    },
    {
      "question": "Q: Can I use Posture-Only mode as a personal user?",
      "answer": "**A:** No. Posture-Only mode requires enrollment in a Cloudflare Zero Trust organization. It is exclusively an enterprise feature. Personal users should use DNS-Only or WARP mode."
    },
    {
      "question": "Q: Why is Local Proxy mode hidden in Advanced settings?",
      "answer": "**A:** Because it leaves most traffic unencrypted by default. Cloudflare considers this a power-user feature that requires explicit understanding of proxy configuration. If you forget to configure an application to use the proxy, that application's traffic is direct and unprotected.citeweb_search:7#0 ---"
    }
  ],
  "semanticFactualBody": "* **Target Audience:** Beginner-to-intermediate users transitioning into corporate environments, IT generalists, and anyone confused by the four (actually five) ways WARP can behave.   * **Tone:** Concept-focused, structured, and heavy on everyday analogies.   * **Reading Time:** ~30 minutes   --- Table of Contents 1. Why Modes Matter: The Foundation 2. Mode 1: DNS-Only Mode — \"The Private Address Book\" 3. Mode 2: WARP Mode — \"The Secure Express Lane\" 4. Mode 3: Secure Web Gateway (SWG) Mode — \"The Corporate Security Inspector\" 5. Mode 4: Posture-Only Mode — \"The Digital Badge\" 6. Mode 5: Local Proxy Mode — \"The Selective Bodyguard\" 7. Mode 6: Traffic Only Mode — \"The Tunnel Without the Filter\" 8. The Complete Comparison Matrix 9. How to Switch Modes: Step-by-Step 10. Use Cases: When to Use Which Mode 11. Common Mode Confusion: FAQ 12. Next Steps --- 1. Why Modes Matter: The Foundation If you've installed WARP (covered in Article 2), you've hit the first question most users ask: \"What mode should I use?\" The WARP client is a Swiss Army knife with multiple blades for different security and networking scenarios. Understanding these modes makes the difference between: A home user who thinks they're \"protected\" but is only encrypting DNS queries A corporate employee who accidentally routes all personal traffic through their employer's inspection gateway A developer who breaks their local environment because they didn't know about split tunneling An IT admin who deploys the wrong "
}