ZeroSpams

Cloudflare setup and security configuration

Cloudflare can make a website faster and safer in minutes. Set up carelessly, it can also break email, block payment and webhook calls, and hide visitors’ real addresses from your own spam protection.

Updated · 2 min read · By the ZeroSpams team

The short answer

We set up Cloudflare for your domain: move DNS without downtime, choose which records to proxy (and keep email records on DNS only), configure Full (strict) SSL, write WAF rules and bot settings that block attacks but let payment providers, Mailgun and other webhooks through, and set caching that doesn’t break dynamic pages. Our own website runs behind Cloudflare.

What’s included

  • DNS migration to Cloudflare without downtime.
  • Proxy settings: website records proxied, email and verification records on DNS only.
  • SSL in Full (strict) mode with a valid certificate on your server.
  • WAF custom rules, rate limiting and bot protection, with exceptions for webhooks and payment callbacks.
  • Caching rules that speed up the site without caching private pages.
  • Real visitor IPs passed correctly to your server and applications.

How we do it

  1. Review your current DNS and website.
  2. Move DNS and choose proxy settings record by record.
  3. Configure SSL, security and caching.
  4. Test the site, email, forms, payments and webhooks.
  5. Document the rules.

What we’ve learned running behind Cloudflare

  • Mail records must be DNS-only (grey cloud), or email and domain verification fail.
  • Bot protection can block legitimate webhooks, such as Mailgun and payment providers, unless an exception is added.
  • Your server and applications must read the real visitor IP from Cloudflare’s headers, or every visitor looks the same to rate limits and spam checks.
  • Cloudflare can tell your server each visitor’s country, which saves lookups.

Common questions

Is Cloudflare free?

Cloudflare has a free plan that suits many small businesses; paid plans add features. We recommend what you need.

Will Cloudflare affect our email?

Not if set up correctly: email records stay unproxied, and email continues to flow directly.

Can you add Cloudflare to a WHM/cPanel server?

Yes, including the server-side settings for real visitor IPs.