Cloudflare can sit between your visitors and our server: it receives the requests, keeps static files (images, CSS, JavaScript) on its servers around the world and filters out some of the bad traffic. The free plan is enough for a small website. But it isn't required and it isn't always a gain: if your visitors are in Romania and the website is already fast, the difference is small, and a wrong setting can take down your website or your email.
What you'll achieve
- decide whether Cloudflare is useful for you;
- move your domain's DNS to Cloudflare without losing your website or email;
- choose the right SSL setting and clear the cache after changes.
When it helps and when it doesn't
| Helps | Doesn't help or gets in the way |
|---|---|
| visitors from many countries, far from the EU server | a website with visitors almost only from Romania, already fast |
| lots of images and static files | a store with a cart and customer accounts, if you also cache the dynamic pages |
| attacks or bot traffic on the website | if you don't want to manage yet another panel |
Two things to know up front:
- With your DNS at Cloudflare, the DNS zone in Enhance no longer counts. From then on, you add every record (for email, for verifications, for subdomains) at Cloudflare (see DNS zone editor: A, CNAME, MX and TXT).
- With the proxy turned on (the orange cloud), issuing and renewing our Let's Encrypt certificate may fail. That's why you should write to us before turning on the proxy: we check the domain's certificate and tell you which option works for your website.
Before you start
- You have a Cloudflare account (https://dash.cloudflare.com) and access to your domain registrar (or your domain is with us and you ask us to change the nameservers).
- The website already runs on
https://, with the Let's Encrypt certificate issued (see The free SSL certificate (Let's Encrypt)). - You've noted down your current DNS records: in Enhance, “Websites” » the website » “Domains” » “Manage” » “DNS records”.
The steps
A. Add the domain to Cloudflare
- In Cloudflare, click Add a domain and choose the Free plan.
- Cloudflare reads the existing records on its own. Compare the list with the one in Enhance and add whatever is missing. The ones most often forgotten:
mail(A), the MX record,hostingcp._domainkey(DKIM),_dmarcand the SPF record;- the subdomains you use.
- For SPF, use the server's IP address, as described in Why my emails go to spam: SPF, DKIM, DMARC (step 1):
v=spf1 a mx ip4:185.230.138.193 ~all. - All email records (
mail, MX, DKIM, SPF, DMARC) stay DNS only (the gray cloud). Email doesn't go through the Cloudflare proxy. - Delete the AAAA records from your previous provider, if there are any: our zone doesn't use IPv6 for the website.
- For now, also leave the website records (
@andwww) on DNS only.
B. Change the nameservers
- Cloudflare gives you two nameservers, like
nume.ns.cloudflare.com. Set them at your domain registrar in place of the current ones (the steps for registrars are in How to point your domain to NBT Host). For a domain registered through NBT Host, write to us and we'll change them. - Wait until Cloudflare shows the domain as Active. It usually takes a few hours (see DNS propagation and TTL: how to plan a change).
- Check the website and send a test email to and from an address on the domain.
C. Set SSL correctly
- In Cloudflare, under SSL/TLS, choose Full (strict) mode. Not Flexible: with Flexible, Cloudflare requests the website from us over
http://, “Force https” in Enhance sends it back tohttps://and the website gets stuck in a loop (see “Too many redirects”: how to stop the loop).
D. Turn on the proxy, after we talk
- Once you've written to us and we've checked the certificate, switch
@andwwwto Proxied (the orange cloud). - Check the website from a private window, plus the forms and, if you have a store, the cart.
E. Clear the cache after changes
- Cloudflare keeps your images, CSS and JavaScript. After you change them on the website, go to Caching » Configuration in Cloudflare and use Purge Cache (purge everything or only the changed addresses).
- If you also have a cache plugin in WordPress, clear it first, then Cloudflare (see WordPress caching: what it is and how to use it).
If you want to stop using it
Set the nameservers back to ns1.nbt-host.ro and ns2.nbt-host.ro at your registrar. The zone in Enhance is still there; just check that it has the records you added at Cloudflare in the meantime.
If something doesn't work
- “Too many redirects” (ERR_TOO_MANY_REDIRECTS). The SSL mode is Flexible. Switch to Full (strict) (step 10).
- Email stops arriving or sending. An email record is missing at Cloudflare or
mailis set to Proxied. Compare with the list in Enhance and switch the email records to DNS only. - The certificate no longer renews. The proxy interferes with the Let's Encrypt check. Temporarily switch
@andwwwto DNS only and write to us. - Cloudflare shows error 521 or 522. Cloudflare can't reach our server: the A record points to a different IP or your IP address is blocked. Check the IP in Enhance (the website's page, “IPv4 address”) and write to us.
- Uptime monitoring says the domain doesn't point to the server. On a VPS, the proxy hides the server's IP; the address can only be checked on DNS only (see How to add a tool or an add-on).
- Your domain was bought through Cloudflare Registrar. You can't set other nameservers there: your DNS stays at Cloudflare (see How to point your domain to NBT Host).