Adding a Domain to Cloudflare

Sign in at dash.cloudflare.com
Add a Site → enter your domain
Choose a plan (the Free plan is sufficient)
Cloudflare automatically scans existing DNS records
At your domain registrar, change the nameservers:

CODE

Before: ns1.yourprovider.com
After:  aria.ns.cloudflare.com
        ben.ns.cloudflare.com

Nameserver changes can take up to 24 hours to propagate.

DNS Record Configuration

Bash

# Cloudflare API
ZONE_ID="your_zone_id"
API_TOKEN="your_api_token"

# A
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "A",
    "name": "example.com",
    "content": "1.2.3.4",
    "proxied": true,
    "ttl": 1
  }'

# CNAME
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "CNAME",
    "name": "www",
    "content": "example.com",
    "proxied": true
  }'

Common Record Examples

Type	Name	Value	Proxy
A	@ (root)	Server IP	On
A	www	Server IP	On
CNAME	api	api-server.example.com	On
MX	@	mail.example.com	Off
TXT	@	v=spf1 ...	Off

Orange Cloud (Proxy) Mode

Orange cloud ON: Cloudflare CDN + DDoS protection + origin server IP is hidden
Gray cloud OFF: DNS only; the origin IP is exposed

Always leave proxy OFF for email, FTP, and SSH records

SSL/TLS Settings

Dashboard → SSL/TLS → choose a mode:

Mode	Description	Recommended
Off	HTTP only	✗
Flexible	Encrypted between Cloudflare and the visitor only; Cloudflare ↔ origin is HTTP	✗
Full	Encrypted between Cloudflare and origin as well; certificate is not verified	Conditional
Full (Strict)	Requires a valid certificate	✓

CODE

: Full (Strict) + Let's Encrypt

Page Rules

Dashboard → Rules → Page Rules (3 on the Free plan):

HTTP → HTTPS Redirect

CODE

URL: http://example.com/*
Setting: Always Use HTTPS

Cache Settings

CODE

URL: example.com/static/*
Setting: Cache Level = Cache Everything
         Edge Cache TTL = 1 month

Bypass Cache for Specific Paths

CODE

URL: example.com/api/*
Setting: Cache Level = Bypass

Basic WAF Settings (Free)

Dashboard → Security → WAF:

Security Level: Medium (default)
Bot Fight Mode: ON (blocks bots)
Challenge Passage: 30 minutes

IP Blocking

Dashboard → Security → WAF → Tools → IP Access Rules:

CODE

Value: 203.0.113.0/24
Action: Block

Cloudflare Tunnel (Exposing an Internal Server)

Expose a service over HTTPS without opening ports on the server firewall:

Bash

# cloudflared 
curl -L --output cloudflared.deb \https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# 
cloudflared tunnel login
cloudflared tunnel create my-tunnel
cloudflared tunnel route dns my-tunnel app.example.com

# settings file
# ~/.cloudflared/config.yml
tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json
ingress:
 - hostname: app.example.com
 service:http://localhost:3000
  - service: http_status:404

cloudflared service install

#cloudflare#dns#cdn#waf#ssl

Editorial note

AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us

Topic-related official docs (auto-linked · not per-claim sources)OpenSSL documentation ↗

How we write and review →Editorial policy →

Questions & answers

Ask a question about this guide. We'll review and reply.

Cloudflare DNS · Proxy · Page Rules Setup Guide

Adding a Domain to Cloudflare

DNS Record Configuration

Common Record Examples

Orange Cloud (Proxy) Mode

SSL/TLS Settings

Page Rules

HTTP → HTTPS Redirect

Cache Settings

Bypass Cache for Specific Paths

Basic WAF Settings (Free)

IP Blocking

Cloudflare Tunnel (Exposing an Internal Server)

Questions & answers