You've decided to put Cloudflare in front of your site. Smart move—you get a CDN, DDoS protection, and free SSL certificates with minimal configuration. But the dashboard can feel like a maze the first time, and one wrong DNS record will break email or a subdomain you forgot about.
This walkthrough takes you from zero to a working Cloudflare setup. No fluff. Just the ten steps I run through when onboarding a new domain, with the settings that matter and the ones you can ignore for now.
Step 1: Create a Cloudflare account
Head to the Cloudflare homepage and click the sign-up button. Use a working email address—you'll need to verify it before you can add a domain. Pick a strong password; this account will control your DNS and security rules.
Once you confirm your email, log in. The dashboard opens to the "Add a site" screen automatically. If you already have an account, click "Add site" in the top navigation.
Step 2: Add your domain
Type your root domain into the input field. Use the bare domain without www or https://—just example.com. Cloudflare will scan your existing DNS records in the background while you pick a plan.
If you're running this on a client site, double-check the spelling. I've seen tickets where someone typo'd the domain and didn't notice until nameservers were already changed.
Step 3: Choose a plan
Cloudflare shows you four plan tiers. The Free plan gives you:
- Global CDN with unmetered traffic
- DDoS protection
- Shared SSL certificate
- Basic firewall rules
- Caching for static assets
That covers 90% of small-to-medium sites. Pro adds image optimization and better WAF rules; Business gives you custom SSL and uptime guarantees. For a new setup, Free is fine. You can upgrade later without downtime.
Click "Continue" after selecting Free.
Step 4: Review DNS records
Cloudflare scans your current DNS zone and imports what it finds. Check this list carefully. You'll see A records, CNAME records, MX records for mail, TXT records for SPF or verification—anything public in your old zone.
Each record has an orange cloud icon or a gray cloud. Orange means "proxied"—traffic flows through Cloudflare's network. Gray means "DNS only"—Cloudflare resolves the name but doesn't cache or protect that subdomain.
What to proxy and what to leave gray
Proxy these (orange cloud):
- Your root domain A record
wwwCNAME or A record- Any subdomain serving HTTP/HTTPS traffic you want to cache or protect
Leave these gray:
- MX records (mail servers must connect directly)
- TXT records (SPF, DKIM, DMARC)
- Subdomains running non-HTTP services like FTP, SSH, or game servers
- Any API subdomain that uses client IP whitelisting (Cloudflare IPs will appear instead)
If Cloudflare missed a record—like a subdomain you added recently—click "Add record" and enter it manually. Record type, name, and value must match your old zone exactly.
A quick sanity check
Before you click "Continue," ask yourself: does this list match what's in my current DNS zone? Open your registrar or cPanel DNS editor in another tab and compare. Missing records mean broken services after you switch nameservers.
Step 5: Change your nameservers
Cloudflare gives you two nameservers, something like:
amy.ns.cloudflare.com
reza.ns.cloudflare.com
Copy both. Now log into your domain registrar—Namecheap, GoDaddy, Porkbun, wherever you bought the domain. Find the nameserver settings. They're usually under "Domain Management" or "DNS Settings."
Replace the existing nameservers with the two Cloudflare gave you. Order doesn't matter. Remove any old nameservers; leaving extras behind causes random resolution failures.
Save the change. Propagation starts immediately, but full global propagation takes anywhere from five minutes to forty-eight hours. In practice, most resolvers pick up the change within an hour.
What if your domain is registered through a reseller?
Some hosts (like cPanel providers) let you register domains through their system. You'll still change nameservers in their control panel—look for "Nameserver Management" or similar. If you can't find it, open a ticket. Support can usually point you to the right screen or make the change for you.
Step 6: Wait for nameserver activation
Cloudflare checks your nameservers every few minutes. When it sees them active globally, it sends you an email and marks the site "Active" in the dashboard. This usually happens within an hour, but can take longer if you have a stubborn ISP or corporate DNS resolver cached.
While you wait, you can configure settings in the dashboard. Changes won't take effect until nameservers are active, but you're not locked out.
You can force a recheck by clicking "Re-check now" on the overview page. Don't spam it—Cloudflare throttles repeated checks.
Step 7: Set SSL/TLS mode
Once your site is active, click the "SSL/TLS" tab in the left sidebar. You'll see a dropdown for encryption mode. Four options:
- Off: No encryption between Cloudflare and your origin. Don't use this unless you have a very specific reason.
- Flexible: Cloudflare serves HTTPS to visitors, but connects to your origin over HTTP. Fast setup, but the origin-to-Cloudflare leg is unencrypted.
- Full: Cloudflare connects to your origin over HTTPS, but doesn't validate the certificate. Works with self-signed certs.
- Full (strict): Cloudflare connects over HTTPS and validates your origin certificate against a trusted CA.
If your origin server already has a valid SSL certificate (Let's Encrypt, commercial CA, or cPanel AutoSSL), choose Full (strict). If you have a self-signed cert or no cert at all, choose Full and install a Cloudflare Origin CA certificate on your server (more on that in a second). Never choose Flexible for anything handling logins or sensitive data.
Installing a Cloudflare Origin Certificate
Still in the SSL/TLS tab, click "Origin Server" in the submenu. Click "Create Certificate." Cloudflare generates a certificate and private key valid for fifteen years. Copy both.
On your server, save the certificate as /etc/ssl/certs/cloudflare-origin.crt and the key as /etc/ssl/private/cloudflare-origin.key. Update your web server config to use them:
Apache (in your VirtualHost block):
SSLCertificateFile /etc/ssl/certs/cloudflare-origin.crt
SSLCertificateKeyFile /etc/ssl/private/cloudflare-origin.key
Nginx:
ssl_certificate /etc/ssl/certs/cloudflare-origin.crt;
ssl_certificate_key /etc/ssl/private/cloudflare-origin.key;
Reload your web server. Now you can use Full (strict) mode safely.
Step 8: Enable Always Use HTTPS
In the SSL/TLS tab, click "Edge Certificates." Scroll down to "Always Use HTTPS" and toggle it on. This redirects all http:// requests to https:// at the edge, before they ever hit your origin. Faster than doing it with .htaccess rules, and it works even if your origin is unreachable.
While you're here, enable "Automatic HTTPS Rewrites." Cloudflare rewrites mixed-content URLs in your HTML (like http:// image sources) to https:// on the fly. Not a substitute for fixing your code, but it prevents browser warnings in the short term.
Step 9: Configure caching rules
Click "Caching" in the sidebar, then "Configuration." Two settings matter most:
Browser Cache TTL: How long browsers cache static assets before rechecking Cloudflare. Default is four hours. I usually set it to one day for stable sites, one hour for sites that update frequently.
Caching Level: Choose "Standard." Cloudflare caches static files (CSS, JS, images) but ignores query strings on HTML by default. "Aggressive" caches HTML too, which can break dynamic sites. "No Query String" ignores query strings entirely, which breaks paginated URLs and tracking parameters.
If your site uses query strings for legitimate purposes (like ?page=2 or ?product_id=123), leave Caching Level at Standard and create a Page Rule later to handle edge cases.
Purge the cache after setup
Still in the Caching tab, click "Purge Everything." This clears any stale content Cloudflare grabbed during the DNS import. Do this once now, then use selective purging (by URL or tag) for ongoing cache management.
Step 10: Test your site
Open your site in an incognito window. Check:
- Does it load over HTTPS?
- Does the certificate show Cloudflare as the issuer?
- Do all subdomains resolve correctly?
- Does email still work? (Send a test message to an external address.)
- Do forms submit? (Cloudflare's bot protection can sometimes block legitimate POST requests if your form doesn't include browser headers.)
Check the response headers in your browser's developer tools. Look for cf-ray and cf-cache-status. If you see those, traffic is flowing through Cloudflare. cf-cache-status: HIT means the response came from cache; MISS means Cloudflare fetched it from your origin.
What if something breaks?
If your site is down or a subdomain stopped resolving, log into Cloudflare and check the DNS tab. Look for:
- Missing records
- Records with the wrong IP address
- Records that should be gray but are orange (or vice versa)
If you need to roll back immediately, log into your registrar and switch the nameservers back to your old DNS provider. Changes take effect within an hour. Your site will work exactly as it did before you added Cloudflare.
Bonus settings you'll want later
Once the basics are working, come back and configure these:
Firewall Rules: Block traffic by country, IP, user agent, or ASN. Free plan gives you five active rules.
Page Rules: Override caching, security, or SSL settings for specific URLs. Free plan gives you three rules. Use them to cache HTML on a blog, bypass cache on an admin panel, or redirect old URLs.
Workers: Run JavaScript at the edge to modify requests or responses. Free plan gives you 100,000 requests per day. Useful for A/B testing, geolocation redirects, or custom authentication.
Brotli Compression: Enabled by default. Compresses text assets (HTML, CSS, JS) better than gzip, reducing transfer size by 15-20%.
Automatic Platform Optimization for WordPress: If you're running WordPress, enable this under the Speed tab. It caches HTML at the edge and purges automatically when you publish or update a post. Requires a plugin on your WordPress install.
What to check if your site acts strange after switching
If pages load but images are broken, check your Cloudflare caching rules and cf-cache-status headers. A MISS on every request means nothing is caching; check your Cache-Control headers on the origin.
If forms stop working or you see "Error 1020: Access Denied," check the Firewall Events log under Security. Cloudflare might be blocking your form submissions as bot traffic. Add a firewall rule to allow your origin IP or disable Bot Fight Mode temporarily.
If a subdomain resolves to the wrong IP, open the DNS tab and verify the record. Compare it against your old zone. A typo during the DNS import is the usual culprit.
DNS changes are live immediately in Cloudflare's network, but your local resolver might cache the old answer for a few minutes. Flush your local DNS cache (ipconfig /flushdns on Windows, sudo dscacheutil -flushcache on macOS) and test again.