Cloudflare’s proxy sits between visitors and your VPS. It caches static files close to users, filters many attacks, and hides your server’s IP address. The free plan is enough for most sites — but a few settings must be right, or you’ll get redirect loops, wrong visitor IPs or an origin that can still be attacked directly.

1. Add the site and switch nameservers

  1. Add your domain in the Cloudflare dashboard; it imports existing DNS records.
  2. Check the records — especially A records for your site and MX records for mail.
  3. Change the nameservers at your registrar to the two Cloudflare gives you.

2. Decide what to proxy

In the DNS list, an orange cloud means proxied through Cloudflare; grey means DNS only.

  • Proxy: example.com, www — web traffic on ports 80/443.
  • Don’t proxy: mail (mail.example.com), SSH, FTP, game servers and other non-HTTP services. Cloudflare’s free proxy only handles HTTP(S).

Note that a grey-cloud record for the same server reveals its IP. Where possible, use a separate IP or host for those services.

3. Use Full (strict) SSL

Under SSL/TLS → Overview, choose Full (strict):

Mode Visitor ↔ Cloudflare Cloudflare ↔ VPS
Flexible HTTPS HTTP — unencrypted, causes redirect loops with HTTPS-forcing apps
Full HTTPS HTTPS, certificate not validated
Full (strict) HTTPS HTTPS with a valid certificate

On the VPS you need a valid certificate. Two options:

  • Let’s Encrypt (works as usual; use the DNS challenge or keep port 80 reachable for renewal).
  • Cloudflare Origin Certificate (SSL/TLS → Origin Server): free, valid up to 15 years, trusted only by Cloudflare. Install it in Nginx:
ssl_certificate     /etc/ssl/cloudflare/origin.pem;
ssl_certificate_key /etc/ssl/cloudflare/origin.key;

Also enable Always Use HTTPS in Cloudflare.

4. Restore real visitor IPs

Behind Cloudflare, every request appears to come from Cloudflare IPs. Your logs, rate limits and Fail2ban need the real IP from the CF-Connecting-IP header:

# /etc/nginx/conf.d/cloudflare-realip.conf
# add one set_real_ip_from line per range from https://www.cloudflare.com/ips/
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
# … remaining IPv4 and IPv6 ranges …
real_ip_header CF-Connecting-IP;

Generate the full list with a small script and refresh it occasionally:

{ for ip in $(curl -s https://www.cloudflare.com/ips-v4) $(curl -s https://www.cloudflare.com/ips-v6); do
    echo "set_real_ip_from $ip;"; done
  echo "real_ip_header CF-Connecting-IP;"; } > /etc/nginx/conf.d/cloudflare-realip.conf
nginx -t && systemctl reload nginx

5. Lock the origin to Cloudflare

If attackers find your VPS IP (old DNS history, mail headers), they can bypass Cloudflare. Allow web ports only from Cloudflare’s ranges:

for ip in $(curl -s https://www.cloudflare.com/ips-v4); do ufw allow from "$ip" to any port 443 proto tcp; done
ufw delete allow 443/tcp   # remove any open rule

Changing the server IP after moving behind Cloudflare helps too. See custom firewall rules.

6. Caching

By default Cloudflare caches static files (images, CSS, JS) based on extension and respects your Cache-Control headers. HTML isn’t cached unless you add a rule.

  • Send long cache headers for versioned assets from Nginx: expires 1y; add_header Cache-Control "public, immutable";.
  • For static or mostly-static sites, a Cache Rule to cache HTML (bypassing on cookies like wordpress_logged_in) can dramatically reduce origin load.
  • Purge the cache after deployments (dashboard, API, or a CMS plugin).

7. Useful extras

  • Brotli and HTTP/3 — enable in Speed / Network settings.
  • WAF managed rules and bot protection — available depending on plan.
  • Under Attack mode — a temporary challenge page during an attack.

Troubleshooting

Problem Likely cause
ERR_TOO_MANY_REDIRECTS SSL mode Flexible while the server forces HTTPS → use Full (strict)
Error 521 / 522 Origin down, or firewall blocking Cloudflare IPs
Error 525 / 526 Origin TLS handshake fails / invalid certificate in strict mode
All visitors have the same IP in logs Real IP module not configured

Summary

Proxy only web records, use Full (strict) SSL, restore real IPs, firewall the origin to Cloudflare, and set good cache headers. A CDN complements a well-placed server — choose a USA, Hong Kong or Tokyo VPS near your main audience. Note that Cloudflare’s network has limited reach inside mainland China; for China-first sites see CN2 + BGP routing.

  • Cloudflare
  • CDN
  • Nginx