Cloudflare with VPS hosting: SSL, DNS and real visitor IPs done right

Using Cloudflare with VPS hosting comes down to five things: move the domain's nameservers to Cloudflare, proxy (orange cloud) the records that serve websites, set the SSL mode to Full (strict) with a valid certificate on the server, keep mail and control panel hostnames DNS only, and configure the server to read the real visitor IP from the CF-Connecting-IP header. Get those right and you have a free CDN, DDoS protection and edge SSL without breaking email or certificates.

This guide covers what Cloudflare does and does not do for a hosting VPS, the setup step by step, the classic mistakes (redirect loops, leaked origin IPs, Fail2ban banning Cloudflare) and how the same setup works on a server running ZoPanel.

What does Cloudflare do for a VPS, and what doesn't it do?

When a record is proxied, Cloudflare answers DNS queries with its own anycast IPs instead of your server's. Visitors connect to Cloudflare, and Cloudflare connects to your server. From that position it can:

• Absorb DDoS attacks and filter bots before they reach the VPS. According to Cloudflare's plans page, the Free plan includes unmetered DDoS protection, a Universal SSL certificate and the free managed WAF ruleset (at the time of writing, October 2026; check their current plans).
• Cache static files (images, CSS, JavaScript, fonts) close to visitors.
• Hide your server's IP, as long as you do not leak it elsewhere.

What Cloudflare does not do, and is often assumed to:

Assumption	Reality
"Cloudflare caches my whole site"	Per Cloudflare's cache documentation, HTML and JSON are not cached by default; only static file extensions are. WordPress still runs PHP on your server for every page view.
"Turning on Cloudflare protects my mail too"	Only A, AAAA and CNAME records can be proxied. MX and TXT records are always DNS only, and SMTP, IMAP and SSH go straight to the server.
"My panel on port 8888 goes through Cloudflare"	Cloudflare proxies a fixed list of ports (HTTPS: 443, 2053, 2083, 2087, 2096, 8443). 8888 is not on it, so the panel hostname must stay DNS only.
"With Cloudflare I don't need SSL on the server"	Flexible mode encrypts visitor-to-Cloudflare but sends Cloudflare-to-server over plain HTTP. That is not real end-to-end HTTPS.

How to set up Cloudflare with VPS hosting

Step 1: Add the domain and audit the imported records

Create a Cloudflare account and add the domain. Cloudflare scans and imports existing DNS records. Do not trust the scan blindly: compare every record with your old DNS provider, especially MX, SPF, DKIM (usually <selector>._domainkey), DMARC and rarely used subdomains. A missing DKIM record means mail quietly starts landing in spam.

Step 2: Decide which records to proxy

Record	Proxy	Why
@, www (website)	On (orange)	Web traffic benefits from CDN and DDoS protection
Other website subdomains	On	Same
mail, the mail server hostname	DNS only (grey)	SMTP and IMAP cannot be proxied
Panel hostname (port 8888)	DNS only	Port not supported by Cloudflare
ftp, ssh or any non-HTTP service	DNS only	Same
MX, TXT	Always DNS only	Cloudflare does not proxy these types

Step 3: Change nameservers at the registrar

Cloudflare gives you two nameservers. Replace the old ones at your registrar. The change can take minutes to hours to propagate. If DNSSEC is on with your old provider, turn it off (remove the DS record at the registrar) before switching and enable it again in Cloudflare afterwards; otherwise resolvers treat the domain as broken.

Step 4: Pick the right SSL mode

Cloudflare offers Off, Flexible, Full, Full (strict) and Strict, plus an automatic mode. According to Cloudflare's SSL documentation, Full (strict) validates the server's certificate and is the mode they recommend. It needs one of these on the VPS:

• A Let's Encrypt certificate, as usual. Browsers trust it, so if you ever turn the proxy off, the site still works over HTTPS.
• A Cloudflare Origin CA certificate, created in the Cloudflare dashboard with a validity you choose. Only Cloudflare trusts it, browsers do not, so visitors see a warning if the proxy is turned off. Cloudflare does not send expiry reminders for it, so note the date yourself.

Avoid Flexible. Besides leaving the server leg unencrypted, it is the number one cause of ERR_TOO_MANY_REDIRECTS: Cloudflare calls the server over HTTP, the server redirects to HTTPS, Cloudflare calls over HTTP again, forever.

Step 5: Restore the real visitor IP

Once proxied, every request reaches the server from a Cloudflare IP. Access logs become useless, rate limits apply to everyone at once, and worst of all Fail2ban may ban Cloudflare's own IPs, taking the site down for a large share of visitors.

On a hand-built nginx server, use the realip module with the ranges published at cloudflare.com/ips (plain-text lists at https://www.cloudflare.com/ips-v4 and ips-v6):

# /etc/nginx/conf.d/cloudflare-realip.conf
# One line per Cloudflare range, from cloudflare.com/ips
set_real_ip_from 173.245.48.0/20;
# ... the remaining IPv4 and IPv6 ranges ...
real_ip_header CF-Connecting-IP;

Trust the header only from Cloudflare's ranges. Trust it from anywhere and anyone can fake their IP by sending it. The ranges change occasionally, so recheck them on a schedule.

Step 6 (optional): Only let Cloudflare reach the web ports

Once the origin IP is known (it often is, see below), attackers can bypass Cloudflare and hit the server directly. You can restrict ports 80 and 443 to Cloudflare's ranges:

for ip in $(curl -fsS https://www.cloudflare.com/ips-v4); do
  sudo ufw allow from "$ip" to any port 80,443 proto tcp
done
# after checking carefully, delete the rule that opens 80/443 to everyone:
sudo ufw status numbered

Be careful: this breaks every site on the server that is not behind Cloudflare, and the rules need updating when Cloudflare's ranges change. Only do it when every website on the server is proxied.

Step 7: Caching

Cloudflare already caches static files by default, which is enough for most sites. Do not rush into a "Cache Everything" rule for WordPress: misconfigured, it can cache a logged-in user's page or a cart and show it to someone else. A page cache on the server, which purges when content changes and skips logged-in users, is the safer way to cut load. In our measurements, the page cache took a 4 GB VPS from about 100 to about 250 WordPress sites (details).

The common mistake: leaking the origin IP

Hiding the IP only helps if it is not exposed somewhere else. The usual leaks:

• A mail record on the same IP as the website. Anyone who looks up the MX sees the server's IP. If hiding the origin truly matters, mail has to live on a different server or service.
• Headers of outgoing email usually include the sending server's IP.
• DNS-only subdomains such as panel, ftp or dev on the same IP.
• DNS history: lookup services keep the IPs your domain used before Cloudflare.

If the IP is already public, Cloudflare still protects traffic that goes through the domain, but do not treat it as an absolute shield. The firewall from step 6 and basic VPS hardening still matter.

Using Cloudflare with a ZoPanel server

ZoPanel does not manage Cloudflare DNS, but it has what you need to run correctly behind Cloudflare:

1. Turn on "Websites behind Cloudflare" in Security. ZoPanel then takes the visitor IP from CF-Connecting-IP, trusted only from Cloudflare's address ranges, so logs, statistics, rate limits and Fail2ban see real visitors without any hand-written realip config.
2. Certificates. ZoPanel's automatic SSL waits until a domain resolves only to the server, so a proxied domain is not picked up automatically. You have three options: issue the Let's Encrypt certificate before turning on the orange cloud; click Issue certificate on the website's SSL tab; or paste a Cloudflare Origin certificate into Custom certificate. A custom certificate turns Auto renew off, and ZoPanel reminds you 14 days before it expires. See the SSL docs.
3. Mail records. With DNS at Cloudflare, copy the MX, SPF, DKIM and DMARC records from the DNS records card on the Email page into Cloudflare as DNS only, then click Run check in Mail delivery check to compare them with public DNS.
4. The panel hostname (port 8888) stays DNS only. To limit who can reach the panel, use Settings → General → Restrict panel access by IP rather than relying on Cloudflare.
5. Two WAF layers. Cloudflare's rules filter at the edge; ZoPanel's ModSecurity WAF with the OWASP Core Rule Set filters on the server, including requests that bypass Cloudflare. They complement each other.

One thing to know: wildcard certificates through ZoPanel require the domain's DNS to be hosted on the ZoPanel server (DNS docs). If your DNS lives at Cloudflare, use an Origin certificate for the wildcard.

Conclusion

Cloudflare is a worthwhile layer for most hosting VPSs: it is free, offloads static traffic and soaks up DDoS. It is only safe when you use Full (strict), keep mail and the panel out of the proxy, and let the server see real visitor IPs. Real WordPress performance still lives on the server: page cache, PHP and the database.

If you want a panel that already handles running behind Cloudflare, automatic SSL and page caching, try ZoPanel's Free plan (3 hosting accounts, 10 websites and 10 databases, no time limit; everything in this article works on Free) and see pricing.

Frequently asked questions

Which Cloudflare SSL mode should I use?

Full (strict), with a Let's Encrypt or Cloudflare Origin certificate on the server. Flexible leaves the Cloudflare-to-server leg unencrypted and easily causes redirect loops; Full does not validate the server certificate, so it is weaker.

Why does my site show "too many redirects" after enabling Cloudflare?

Almost always it is Flexible mode combined with an HTTP-to-HTTPS redirect on the server: Cloudflare requests HTTP, the server redirects to HTTPS, and the loop repeats. Install a certificate on the server and switch to Full (strict).

Does Cloudflare cache WordPress pages?

Not by default. Cloudflare caches static files such as images, CSS and JavaScript, but not HTML. Every page view still runs PHP on your server, so a server-side page cache is what really reduces load.

Can I proxy my mail records through Cloudflare?

No. Cloudflare only proxies HTTP and HTTPS traffic for A, AAAA and CNAME records; MX and TXT records are always DNS only. Your mail hostname must be DNS only, which means the mail server's IP is always public.

Do I still need a firewall on the VPS with Cloudflare?

Yes. Cloudflare only protects traffic that goes through proxied hostnames; SSH, mail, the panel and anything hitting the origin IP directly reach the server untouched. A firewall, Fail2ban and security updates remain essential.