What Cloudflare adds to a cPanel site

• Faster static files: images, CSS and JavaScript are served from Cloudflare locations near your visitors.
• Less load on the server: cached files no longer reach Apache or PHP.
• Protection: DDoS protection, bot controls and firewall rules in front of the server.
• Free certificates at the edge, in addition to the certificate on your server.

Cloudflare does not replace server security, updates or backups. It is a layer in front of the server.

Step 1: add the domain and check the DNS records

1. Create a Cloudflare account and add your domain. Cloudflare imports the existing DNS records.
2. Compare the imported records with the DNS zone in cPanel (Domains > Zone Editor). Add anything that is missing.
3. Change the nameservers at your domain registrar to the two Cloudflare nameservers.

After the change, DNS is managed at Cloudflare, so future DNS changes must be made there, not in cPanel.

Step 2: set up SSL correctly

1. Keep AutoSSL enabled on the server, so the site has a valid certificate. See our free SSL guide.
2. In Cloudflare, open SSL/TLS > Overview and choose Full (strict).
3. Turn on Always Use HTTPS in SSL/TLS > Edge Certificates.

Step 3: restore real visitor IP addresses

Behind Cloudflare, every request seems to come from a Cloudflare IP address. That breaks access logs, cPHulk, login limits and the IP checks in your applications. Apache’s mod_remoteip fixes this.

1. In WHM, open EasyApache 4, customise the current profile, and install mod_remoteip.
2. Open Service Configuration > Apache Configuration > Include Editor and edit the Pre Main Include for all versions.
3. Add the lines below, with every range from Cloudflare’s published lists at cloudflare.com/ips. The two ranges shown are only examples.

RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
# ...add every IPv4 and IPv6 range from cloudflare.com/ips-v4 and cloudflare.com/ips-v6

Save and restart Apache. Cloudflare adds ranges from time to time, so check the list every few months.

Step 4: keep the firewall from blocking Cloudflare

If your firewall blocks a Cloudflare IP address, every visitor routed through that Cloudflare location loses access. Add Cloudflare’s ranges to the allow list. With CSF, add each range to /etc/csf/csf.allow and run csf -r. See our CSF firewall guide. Block abusive visitors in Cloudflare’s security rules instead, where the real IP address is known.

Step 5: set up caching

By default, Cloudflare caches static files such as images, CSS and JavaScript, but not HTML pages. That default is safe for every site. To cache HTML as well, create a Cache Rule in Caching > Cache Rules:

• Set cache eligibility to Eligible for cache for your public pages.
• Add a separate rule that bypasses the cache for /wp-admin, /wp-login.php, /cart, /checkout, /my-account, and any request with a login or cart cookie.
• Set an Edge TTL, for example a few hours, so updates appear without manual purges.

Test while logged in and logged out, and place a test order on stores, before you rely on HTML caching. Purge the cache in Caching > Configuration after large changes.

Step 6: security settings worth turning on

• ✓ The free managed WAF rules in Security, plus the full managed rulesets on paid plans.
• ✓ Bot Fight Mode, if bots load your site. Test it, because it can block legitimate tools and API clients.
• ✓ A rate limiting rule for /wp-login.php or other login pages.
• ✓ Under Attack Mode only during an attack. It adds a browser check for every visitor.

Troubleshooting