Cloudflare: set up CDN, security and DNS for your website

Cloudflare can sit between visitors and your hosting to serve content from its CDN, filter traffic and apply security rules. The website and its data are still hosted on the hosting. The benefit depends on what content can be cached, where the visitors are and the features you turn on.

It is a service external to Hostsuar: its account, configuration and billing are managed directly with Cloudflare. The old integration inside cPanel is no longer available.

Before activating Cloudflare

Check that the website works over HTTPS on the hosting and save a copy of the current DNS zone. Include domains and subdomains, MX, mail servers, SPF, DKIM, DMARC, CAA and verification records.

Also check whether the domain has DNSSEC. The change of DNS provider must be coordinated with the DS records at the registrar; do not leave signatures from a previous zone associated with the new one.

Cloudflare offers free and paid tiers. Check the current features and conditions when you sign up; you do not need to order a higher plan just to follow this explanation.

Set up the domain

1. Create or open your Cloudflare account and add the domain.
2. Choose the right tier and review the detected records. Compare them with the original zone: detection may be incomplete.
3. Decide which web hostnames will use the proxy. Keep email services and other protocols in the appropriate DNS configuration; the web proxy does not carry their connections.
4. For the usual full delegation setup, change the DNS servers to the ones Cloudflare assigns to that domain.
5. Wait for Cloudflare to confirm the zone and check the website, email and subdomains while the change propagates.

The setup variants and DNSSEC requirements are described in the official delegation procedure. Keep the previous zone during the transition.

Adjust HTTPS and check the website

Set Full (strict) if the origin has a valid certificate for the requested hostname. Check both the hosting's certificate and the one Cloudflare presents. Avoid Flexible: it can cause redirect loops and does not encrypt the connection to the origin.

Test a public page, login, a form and, if you have a shop, cart and checkout in a test environment. Page caching must respect private and personalised content. Cloudflare does not replace updates, backups or the application's protection.

Then see the Cloudflare management guide to find rules, statistics and purges.

Turn off the proxy or remove Cloudflare

If you only want a website to reach the hosting directly, check whether setting its record to DNS only is enough. The zone will still be managed in Cloudflare. First check that the origin is reachable and presents a certificate trusted by browsers; a certificate intended only for Cloudflare's origin leg may not work for direct access.

To stop using its DNS, first reproduce the whole zone at the destination provider. If you are coming back to Hostsuar, see our DNS servers, check the records and coordinate DNSSEC before changing the delegation.

Keep the previous service and zone during propagation. Deleting the domain in Cloudflare before preparing the destination can interrupt the website and email. After the transition, also check the less-used subdomains and any external systems that depend on verification records.