Setting up Cloudflare for your website

If your website is loading slowly or DDoS attacks are disrupting your peace, you've probably considered using Cloudflare. Cloudflare is a CDN and security service that sits between your visitors and your origin server, optimizing traffic. However, setting up Cloudflare for your site, if not done properly, can lead to errors like 521, 522, or even complete loss of access to your site. In this article, you'll learn exactly how to set up Cloudflare without hassle, choose the right SSL mode, and avoid the most common mistakes that break websites.

1. Prerequisites and Preparation Before You Start

Before you log into the Cloudflare dashboard, do a few preparatory tasks to ensure the setup process goes smoothly:

• Know your server's IP address: If your site is on shared hosting, find the IP from your hosting panel or by using ping yourdomain.com in your terminal. For a dedicated server or VPS, you'll have the IP from your provider.
• Access to DNS management panel: You need to be able to modify the domain's DNS records where the domain is registered (e.g., IranNIC or a foreign registrar).
• Backup of DNS settings: Before making any changes, save the complete list of current DNS records (A, AAAA, CNAME, MX, TXT) in a file. This can be a lifesaver in case of errors.

Also, if your site is on shared hosting and you don't know the exact IP, use the following command on your operating system:

dig +short yourdomain.com A

The output is your current server IP, which you need to register in Cloudflare.

2. Creating an Account and Adding Your Domain to Cloudflare

Go to dash.cloudflare.com and create a free account. Then click on Add a site and enter your domain name (e.g., example.com). Cloudflare will automatically detect existing DNS records, but this detection isn't always complete.

Reviewing and Correcting DNS Records

After adding your domain, a page with the list of detected records will be displayed. This is the most critical step:

• The A record for the root domain and www should point to your server's IP.
• If you use subdomains like mail or ftp, add them as well.
• Don't tamper with MX records (for email); if Cloudflare misidentifies them, correct them using your previous backup.
• For A and CNAME records, keep the cloud icon (Proxy) enabled so traffic passes through Cloudflare. For MX and TXT records, make sure they are in DNS only mode (gray cloud).

A common mistake is users leaving the MX record with Proxy mode enabled. The result is that your site's emails stop working, and you get message delivery delay errors. Always keep email records without Proxy.

3. Changing Nameservers at Your Registrar

After confirming the records, Cloudflare will give you two nameservers, usually looking like this:

aria.ns.cloudflare.com
bob.ns.cloudflare.com

Now, go to your domain registrar's panel and replace the previous nameservers with these two values. This change typically takes between 5 minutes and 24 hours to propagate across the internet.

Common Mistake: Changing Nameservers at the Host, Not the Registrar

Many users mistakenly change the nameservers in their hosting panel. This has no effect; nameservers must be changed where the domain is registered. If you bought your domain from an Iranian company, log into that company's panel and find the Nameserver or DNS Management option.

After the change, check the status in Cloudflare. If after 24 hours the status still shows Pending Nameserver Update, you've likely entered the nameservers incorrectly, or your registrar is experiencing delays.

4. Choosing the Right SSL Mode; The Most Important Decision

After your domain is active, go to the SSL/TLS section in the Cloudflare dashboard. There are four modes: Off, Flexible, Full, and Full (strict). Choosing incorrectly is the most common reason for a site breaking after Cloudflare setup.

Flexible Mode; When Is It Appropriate?

In this mode, the connection between the visitor and Cloudflare is HTTPS, but between Cloudflare and your server, it's HTTP. If your server doesn't have an SSL certificate, this is the default choice. However, if your site previously had SSL and you now disable it, you'll encounter a Too Many Redirects error.

Full and Full (strict) Modes

If you have an SSL certificate installed on your server (even a self-signed one), choose Full mode. The connection between Cloudflare and your server uses HTTPS, but the certificate isn't validated. If your certificate is from a trusted authority like Let's Encrypt, the best option is Full (strict), which provides complete security.

Important note: If you use Flexible mode with a site that has SSL enabled, Cloudflare sends the request to your server via HTTP, and your server responds with a redirect to HTTPS. This loop continues indefinitely, and the user sees an ERR_TOO_MANY_REDIRECTS error.

Testing SSL After Changing Modes

After selecting a mode, be sure to open your site in an Incognito window and verify that the green padlock appears next to the address. If you see an error, use the curl tool to check:

curl -I https://yourdomain.com

If the output includes HTTP/2 200 or 301, SSL is working correctly. If you see a 525 SSL Handshake Failed error, it means Cloudflare can't establish an SSL connection with your server; the issue is with your certificate or port 443 on your server.

5. Cache Settings and Optimization

Cloudflare caches static files (CSS, JS, images) by default. But for dynamic sites like WordPress, you need to configure caching intelligently so fresh content is shown to users.

Page Rules

Go to Rules → Page Rules and create a rule for the default WordPress path:

example.com/wp-admin/*
Cache Level: Bypass
Security Level: Medium

This rule ensures your admin panel is never cached and changes take effect immediately. Also, create a separate rule for example.com/wp-login.php with the Disable Security option to prevent accidental lockouts.

Enabling Brotli and HTTP/2

In the Speed section, enable Brotli so text files are sent with better compression. Also, in the Network section, turn on HTTP/2 and 0-RTT Connection Resumption. These settings noticeably increase loading speed without requiring any code changes.

6. Fixing the Most Common Errors After Setup

Even if you follow all the tips, errors can still occur. Here are three common errors and their solutions:

Error 521: Web Server is Down

This error means Cloudflare can't reach your server. First, make sure the IP registered in the A record is correct. Then, check ports 80 and 443 on your server:

sudo netstat -tulpn | grep -E ':80|:443'

If the output is empty, your web server isn't running. Start the service with sudo systemctl restart nginx or sudo systemctl restart apache2.

Error 522: Connection Timed Out

This error is usually due to a firewall. If you're using ufw, you need to whitelist Cloudflare's IPs. The full list of IPs is available at https://www.cloudflare.com/ips/. Here's an example for nginx:

sudo ufw allow from 173.245.48.0/20 to any port 80
sudo ufw allow from 173.245.48.0/20 to any port 443

Repeat this for all Cloudflare IP ranges so real user traffic isn't blocked.

Error 526: Invalid SSL Certificate

This error occurs in Full (strict) mode when your server's certificate isn't valid. If you have a self-signed certificate, switch back to Full mode. If you have a valid certificate but still see the error, make sure the certificate includes your domain name and hasn't expired.

7. Final Tips for Site Stability

After successfully setting up Cloudflare, don't forget these tasks:

• Enable Always Use HTTPS: Turn on this option in the SSL/TLS section to redirect all visits to HTTPS.
• Configure Automatic HTTPS Rewrites: This option converts HTTP links within your site's content to HTTPS, preventing mixed content errors.
• Periodically Review Records: If your server's IP changes (e.g., on a VPS), be sure to update the A record in Cloudflare; otherwise, your site will become inaccessible.

If you encounter a problem during the Cloudflare setup process, remember that you can always revert your site to its previous state by disabling Proxy on the A record (graying out the cloud), and then re-enable Proxy after fixing the issue. This acts as a quick rescue method.

Finally, if you're looking for a stable infrastructure to host your website, ServerNet offers hosting and cloud server services with technical support that can be a great complement to Cloudflare. But the key point is to always perform DNS and SSL configurations carefully and according to the principles we've outlined in this article so your site continues to operate without interruption.