How to Connect Cloudflare to cPanel Hosting: DNS, SSL, and Performance Setup

Cloudflare is one of the most effective free tools you can add to a cPanel shared hosting setup. It acts as a reverse proxy between your visitors and your server — caching static assets, absorbing traffic spikes, blocking malicious requests, and adding a free SSL layer on top. This guide covers the complete setup: DNS migration, SSL mode configuration, caching, and performance settings that make a real difference on shared hosting.

What Cloudflare Actually Does for Shared Hosting

Before diving into setup, it is worth understanding what Cloudflare adds to a shared hosting environment specifically:

• CDN (Content Delivery Network). Cloudflare caches your static assets (images, CSS, JS, fonts) at edge servers in 300+ cities globally. Visitors download these files from a server geographically close to them — not from your shared hosting server in a single data centre.
• DDoS protection. Cloudflare absorbs volumetric attacks before they reach your hosting server. On shared hosting, even a moderate traffic spike can cause resource limits to be hit — Cloudflare's free plan provides basic but effective protection.
• SSL termination. Cloudflare can handle SSL for your domain even before you set it up on your hosting server, and provides flexible SSL configuration options.
• IP masking. Visitors and scanners see Cloudflare's IP addresses instead of your hosting server's IP. This makes targeted attacks on your server harder.
• Performance rules. Minification, image optimisation, and HTTP/2 are all available free through Cloudflare, even if your shared hosting plan does not support them natively.

Step 1: Create a Cloudflare Account and Add Your Domain

1. Go to cloudflare.com and create a free account.
2. From the dashboard, click Add a Site and enter your domain name.
3. Select the Free plan and click Continue.
4. Cloudflare will scan your existing DNS records and import them automatically. This is the most important step — review every record carefully.
5. Verify that all critical DNS records from your cPanel account are present:
   • A record pointing your root domain to your hosting server IP
   • A record for www subdomain
   • MX records for email (if you use cPanel email)
   • TXT records (SPF, DKIM, verification records)

Important: If you use cPanel email (SMTP, IMAP), set the MX records and the mail subdomain A record to DNS only (grey cloud) — not proxied. Running email through Cloudflare's proxy breaks SMTP/IMAP connections.

Step 2: Update Your Nameservers at Your Domain Registrar

After Cloudflare imports your DNS records, it will show you two Cloudflare nameservers (for example, ada.ns.cloudflare.com and norm.ns.cloudflare.com). You need to replace your domain's existing nameservers with these.

1. Log in to your domain registrar (Namecheap, GoDaddy, Niagahoster, IDwebhost, or wherever you registered your domain).
2. Find the Nameservers or DNS Settings section for your domain.
3. Replace the existing nameservers with the two Cloudflare nameservers shown in your Cloudflare dashboard.
4. Save the change. DNS propagation for nameserver changes typically takes 15 minutes to 2 hours, though it can occasionally take up to 24 hours.
5. Cloudflare will send an email confirmation when it detects that your nameservers have updated successfully.

Step 3: Configure SSL Mode Correctly

SSL configuration is the step where most cPanel + Cloudflare setups go wrong. There are four SSL modes in Cloudflare, and choosing the wrong one causes redirect loops or insecure connections.

Cloudflare SSL Mode Options:
─────────────────────────────────────────────────────────────────
Off              Cloudflare does not use SSL at all.
                 Never use this.

Flexible         Cloudflare uses SSL between visitor and
                 Cloudflare, but connects to your hosting
                 server via HTTP. Works without server SSL but
                 is not truly end-to-end encrypted.

Full             Uses SSL between Cloudflare and your server,
                 but does not validate the server certificate.
                 Works with self-signed certificates.

Full (Strict)    Uses SSL between Cloudflare and your server
                 AND validates the certificate. Requires a valid
                 certificate on your hosting server (AutoSSL,
                 Let's Encrypt, or paid cert). RECOMMENDED.

Recommended setup for cPanel shared hosting:

• First, make sure AutoSSL is active on your cPanel account (green padlock in SSL/TLS Status)
• In Cloudflare: SSL/TLS → Overview → Full (Strict)

Common mistake to avoid: Never use Flexible mode if you have HTTPS redirect rules in .htaccess. This creates an infinite redirect loop: Cloudflare sends an HTTP request to your server, which redirects to HTTPS, which Cloudflare serves as HTTP again, and so on.

If your website is behind Cloudflare and showing “ERR_TOO_MANY_REDIRECTS,” the fix is almost always to switch SSL mode from Flexible to Full or Full (Strict).

Step 4: Enable “Always Use HTTPS”

Even with Full (Strict) SSL mode, you should tell Cloudflare to always redirect HTTP requests to HTTPS at the edge — before they even reach your server:

1. Go to SSL/TLS → Edge Certificates
2. Toggle on Always Use HTTPS
3. Optionally, enable HTTP Strict Transport Security (HSTS) if your site is fully on HTTPS and you want to prevent any HTTP access at the browser level. Note: HSTS is difficult to undo once enabled — only turn it on when you are sure your entire site runs on HTTPS.

Step 5: Configure Caching for Shared Hosting Performance

Cloudflare's caching significantly reduces the number of requests that hit your shared hosting server, improving both speed and reliability under traffic spikes.

Basic caching setup

1. Go to Caching → Configuration
2. Set Caching Level to Standard
3. Set Browser Cache TTL to 4 hours or longer. This controls how long browsers cache static assets from Cloudflare.

Page Rules for cache exclusions (WordPress)

If you run WordPress, you need to ensure admin pages and the login page are not cached by Cloudflare. Create these Page Rules under Rules → Page Rules:

# Bypass cache for WordPress admin and login
URL pattern: yourdomain.com/wp-admin/*
Setting: Cache Level = Bypass

URL pattern: yourdomain.com/wp-login.php
Setting: Cache Level = Bypass

Without these exclusions, you may find that WordPress admin settings do not update immediately, or that logging out does not work reliably.

Step 6: Enable Performance Features

Cloudflare free plan includes several performance features worth enabling:

• Auto Minify: Speed → Optimisation → enable minification for JavaScript, CSS, and HTML. Reduces file sizes by removing unnecessary whitespace and comments.
• Brotli compression: Speed → Optimisation → Brotli. More efficient compression than gzip for text-based assets.
• Rocket Loader: Asynchronously loads JavaScript to prevent render blocking. Test this carefully — it occasionally causes issues with custom scripts. Enable it and monitor for broken functionality.

Step 7: Configure DNS Records for cPanel Email

Email is the most common issue when adding Cloudflare to a cPanel hosting setup. Cloudflare's proxy does not support email protocols (SMTP, IMAP, POP3). All email-related DNS records must use DNS only mode (grey cloud icon), not proxied (orange cloud).

DNS records that must be grey cloud (DNS only):

• mail.yourdomain.com A record — used for webmail and IMAP/SMTP
• All MX records
• SPF TXT record
• DKIM TXT record
• DMARC TXT record

In Cloudflare DNS settings, click on any record that has an orange cloud icon and toggle it to grey (DNS only) if it is related to email.

Verifying Your Cloudflare + cPanel Setup

After completing setup, verify everything is working:

1. Check Cloudflare proxy is active: Visit whatismyipaddress.com from your browser — your site's IP address should now be a Cloudflare IP, not your hosting server's IP.
2. Check SSL: Visit your site on HTTPS and confirm the padlock shows. Run SSL Labs test to confirm Full (Strict) mode is working with a valid cert chain.
3. Check email: Send a test email from and to your cPanel email address to confirm mail flow is unaffected.
4. Check for redirect loops: Visit http://yourdomain.com — it should redirect cleanly to https://yourdomain.com without loops.
5. Check cache headers: Open browser DevTools → Network tab, reload the page, and check the response headers for static assets. You should see cf-cache-status: HIT on subsequent loads after the first.

Conclusion

Cloudflare free plan combined with cPanel shared hosting is one of the best performance and security upgrades available at zero cost. The key points: use Full (Strict) SSL mode, keep email DNS records as grey cloud (DNS only), set up cache bypass rules for WordPress admin, and verify your setup by checking the Cloudflare IP and SSL certificate after propagation. Once configured, Cloudflare runs silently in the background — improving performance for every visitor while reducing load on your shared hosting server.