How to Set Up Cloudflare with Your Hosting

Cloudflare sits between visitors and your server, caching static files at edge locations worldwide and filtering malicious traffic. It is free and genuinely useful — and it introduces two ways to break your site that are worth knowing before you start.

Should you?

Every NexzaHost plan already includes Cloudflare protection at the network level, so this is about running your own Cloudflare account for the extra control.

Worth it if you have international visitors, want more caching control, need firewall rules, or want detailed analytics.

Skip it if your audience is entirely within Pakistan and your site is already fast. You would be adding a moving part for little gain.

Step 1 — Add the site

1. Create a free Cloudflare account 2. Add a site, enter your domain 3. Choose the Free plan 4. Cloudflare scans your existing DNS records

Check that scan carefully before continuing. It usually finds everything, but occasionally misses a record — and anything missing simply stops working when you switch. Compare against Zone Editor in cPanel and add anything absent.

Step 2 — Get the proxy settings right

Each record shows an orange or grey cloud:

• Orange (Proxied) — traffic goes through Cloudflare
• Grey (DNS only) — Cloudflare just answers the lookup

These must be grey:

• MX records — Cloudflare cannot proxy SMTP. Orange-clouding mail breaks email delivery entirely
• `mail` subdomain — same reason
• `ftp` subdomain — FTP is not HTTP
• `cpanel` / `webmail` — these use non-standard ports Cloudflare does not proxy

These should be orange:

• @ (root domain)
• www

Getting this wrong is the number one cause of "we added Cloudflare and email stopped".

Step 3 — Change nameservers at your registrar

Cloudflare gives you two nameservers. Set them at your registrar, replacing the existing ones — do not add alongside.

Note that DNS management now lives in Cloudflare, not cPanel. Changing a record in cPanel's Zone Editor will have no effect. This trips up people months later.

Step 4 — SSL: the setting that causes redirect loops

SSL/TLS → Overview, and set the mode to Full (strict).

This matters more than anything else on this page:

• Flexible — Cloudflare talks HTTPS to visitors and HTTP to your server. If your server also redirects HTTP to HTTPS — which it should — you get an infinite redirect loop and the site becomes unreachable. Never use Flexible.
• Full — encrypted both ways, but the origin certificate is not validated
• Full (strict) — encrypted and validated. Correct, and works because AutoSSL gives you a valid certificate

Run AutoSSL in cPanel before switching to Full (strict). If your origin has no valid certificate, strict mode fails.

Then enable Always Use HTTPS and Automatic HTTPS Rewrites under Edge Certificates.

Step 5 — Sensible starting settings

Speed → Optimization: enable Auto Minify for CSS, JS and HTML, and Brotli.

Caching → Configuration: Caching Level Standard, Browser Cache TTL 4 hours.

Leave Rocket Loader off initially. It changes JavaScript execution order and breaks sliders, forms and page builders. Enable it later, alone, and test.

Two caches now

With Cloudflare in front of LiteSpeed Cache you have two layers. When you change the site and still see the old version, purge both:

• Cloudflare → Caching → Purge Everything
• WordPress → LiteSpeed Cache → Toolbox → Purge All

People routinely purge one, see no change, and conclude the fix did not work.

While actively developing, turn on Development Mode in Cloudflare. It bypasses the edge cache for three hours.

Real visitor IPs

Proxied through Cloudflare, your server sees Cloudflare's IPs rather than your visitors'. Analytics and security plugins then report every visitor from the same handful of addresses.

Install the Cloudflare WordPress plugin, which restores the real IP from the CF-Connecting-IP header.

Common problems

• Redirect loop / "too many redirects" — SSL mode is Flexible. Set Full (strict)
• Email stopped — MX or mail records are orange. Set them to DNS only
• Changes not appearing — purge both caches
• cPanel unreachable — the cpanel record is proxied. Set it grey
• Site broken after enabling optimisation — Rocket Loader. Turn it off
• DNS edits in cPanel doing nothing — DNS lives at Cloudflare now