[JAY]

How to set up Cloudflare with CloudPanel (DNS, SSL and real visitor IPs)

Cloudflare sits between your visitors and your server. It hides your server's IP address, blocks a lot of bad traffic and caches files close to your visitors, all on the free plan. CloudPanel works well with it, but a few settings have to match, or you get errors like "too many redirects" or SSL warnings.

This guide explains each setting in plain words and tells you exactly what to choose.

How it works, in one picture

Code:Copy

Visitor → Cloudflare (orange cloud) → your CloudPanel server

Both connections should be encrypted: visitor to Cloudflare, and Cloudflare to your server. That's why you still need an SSL certificate on CloudPanel, even with Cloudflare in front.

Step 1: Add your domain to Cloudflare

1. Create a free Cloudflare account and click Add a domain.
   
2. Cloudflare scans your existing DNS records. Check that they look right.
   
3. Cloudflare gives you two nameservers. Set them at your domain registrar (where you bought the domain). This can take a few hours to go live.
   

Step 2: Point the domain to your server
In Cloudflare, go to DNS > Records and make sure you have:

• An A record for
  Code:Copy

  example.com
  (shown as
  Code:Copy

  @
  ) with your server's IP.
  
• An A record or CNAME for
  Code:Copy

  www
  .
  

The cloud icon next to each record matters:

• Orange cloud (Proxied): traffic goes through Cloudflare. Use this for your website.
  
• Grey cloud (DNS only): traffic goes straight to your server. Use this for mail records, SSH and anything that isn't a website.
  

Step 3: Get an SSL certificate on CloudPanel
You have two good options. Pick one.

Option A: Let's Encrypt (easiest)
In CloudPanel, open the site, go to SSL/TLS > Actions > New Let's Encrypt Certificate and create it. It renews by itself. If it fails while the orange cloud is on, switch the records to grey for a minute, create the certificate, then switch back to orange.

Option B: Cloudflare Origin Certificate (lasts up to 15 years)

1. In Cloudflare, go to SSL/TLS > Origin Server > Create Certificate. Keep the default hostnames (
   Code:Copy

   example.com
   and
   Code:Copy

   *.example.com
   ).
   
2. Copy the certificate and the private key. Cloudflare shows the key only once.
   
3. In CloudPanel, open the site, go to SSL/TLS > Actions > Import Certificate, paste both and save.
   

An Origin Certificate is only trusted by Cloudflare. If you ever switch the orange cloud off, browsers will show a warning. That's normal for this option.

Step 4: Choose the right SSL mode in Cloudflare
Go to SSL/TLS > Overview and choose Full (strict).

• Full (strict): encrypted all the way, and Cloudflare checks your server's certificate. Use this.
  
• Full: encrypted, but Cloudflare doesn't check the certificate. Only as a short-term fallback.
  
• Flexible: the link from Cloudflare to your server isn't encrypted. Avoid it. It's also the usual cause of the "too many redirects" loop once your site forces HTTPS.
  

Also turn on SSL/TLS > Edge Certificates > Always Use HTTPS.

Step 5: Lock the site to Cloudflare (optional, recommended)
Now that everything goes through Cloudflare, you can stop people from skipping it by hitting your server's IP directly. In CloudPanel, open the site's Security tab and turn on Allow traffic from Cloudflare only. Only do this when all the site's web records are orange.

Details: CloudPanel site security.

What about visitor IP addresses?
Behind Cloudflare, every request arrives from a Cloudflare address, which would make your logs and WordPress plugins think all visitors are Cloudflare. CloudPanel already handles this: it keeps a list of Cloudflare's IP ranges and restores the real visitor IP in Nginx. The list updates automatically every day. To refresh it by hand, run as root:

Code:Copy

clpctl cloudflare:update:ips

Things that go wrong, and the fix

• "Too many redirects" (ERR_TOO_MANY_REDIRECTS): SSL mode is Flexible. Change it to Full (strict).
  
• Error 526 "Invalid SSL certificate": Full (strict) is on, but the server has no valid certificate yet. Do Step 3.
  
• Error 521 "Web server is down": Cloudflare can't reach your server. Check the server is running, the A record IP is right, and ports 80 and 443 are open in the CloudPanel firewall.
  
• Error 522 "Connection timed out": usually a firewall blocking Cloudflare, or a wrong IP in the A record.
  
• Let's Encrypt fails to renew: check that nothing in Cloudflare (like a firewall rule) blocks
  Code:Copy

  /.well-known/acme-challenge/
  . Or use an Origin Certificate instead.
  
• Email stopped working: the A record your MX record points to (for example
  Code:Copy

  mail.example.com
  ) must be grey, not orange. Cloudflare doesn't pass mail traffic.
  

Sources (checked October 2026): Cloudflare: SSL/TLS encryption modes · Cloudflare: Origin CA certificates · CloudPanel CLI

Related: Free SSL in CloudPanel · SSL renewal failed