---
title: Connect your domain to Cloudflare
description: Put your own Cloudflare account in front of your Web7 VPS without breaking SSL or email.
url: "https://staging-learn.web7tech.com/docs/connect-your-domain-to-cloudflare/"
updated: "2026-10-19"
category: "Cloudflare & DNS"
tags:
  - Cloudflare
  - DNS
  - SSL
---

# Connect your domain to Cloudflare

Cloudflare sits in front of your website, filtering attacks and serving cached files from its global network. It works well with a Web7 VPS, as long as you set up SSL and email correctly. This guide shows you how.

## Two ways to use Cloudflare with Web7

1. **Web7's Cloudflare protection.** Point your domain at a dedicated hostname we give you with a single `CNAME` record, and your traffic passes through our Cloudflare firewall before it reaches the four firewalls on our network. [Ask support](https://my.web7tech.com/submitticket.php) to set it up.
2. **Your own Cloudflare account.** You keep full control of your Cloudflare settings. The rest of this guide covers this option.

## Before you start

- Your VPS's IP address, which is shown in the control panel.
- A login for your domain registrar (where you bought the domain).
- A list of your current DNS records, especially email (`MX`) records. Take a screenshot before you change anything.

## 1. Add your site to Cloudflare

Create a free Cloudflare account, choose **Add a domain**, and enter your domain. The Free plan covers everything in this guide. Cloudflare scans your existing DNS and imports the records it finds.

## 2. Check the DNS records

Compare what Cloudflare imported with your screenshot and fix anything missing. A typical WordPress site with email on Web7 looks like this:

| Type | Name | Content | Proxy status |
| --- | --- | --- | --- |
| `A` | `@` | Your VPS IP address | Proxied |
| `CNAME` | `www` | `example.com` | Proxied |
| `A` | `mail` | Your VPS IP address | **DNS only** |
| `MX` | `@` | `mail.example.com` | **DNS only** |
| `TXT` | `@` | Your SPF record | **DNS only** |

Cloudflare only proxies web traffic. Anything used for email, FTP or SSH must stay **DNS only** (grey cloud), or it will stop working.

## 3. Let your SSL certificate issue first

Web7 issues a free Let's Encrypt certificate for your site automatically. If this is a brand-new site, set the website records to **DNS only** at first, wait until `https://` loads with a padlock, then switch them to **Proxied**. This avoids a gap where Cloudflare expects a valid certificate that doesn't exist yet.

## 4. Change your nameservers

Cloudflare shows you two nameservers. At your registrar, replace the existing nameservers with these two. Most domains switch over within an hour, but it can take up to 24 hours. Cloudflare emails you when the domain is active.

## 5. Set SSL/TLS to Full (strict)

In Cloudflare, go to **SSL/TLS → Overview** and choose **Full (strict)**. Your traffic is then encrypted all the way to your VPS, and Cloudflare checks that the certificate is valid.

> **Never use Flexible.** It leaves traffic between Cloudflare and your server unencrypted, and it causes the "too many redirects" error on WordPress sites that force HTTPS.

Then, under **SSL/TLS → Edge Certificates**, turn on **Always Use HTTPS** and set **Minimum TLS Version** to 1.2.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| **Error 526: Invalid SSL certificate** | The certificate on your VPS hasn't been issued yet. | Set the records to **DNS only** until HTTPS works, then proxy them again. |
| **Too many redirects** | SSL mode is set to Flexible. | Switch to **Full (strict)**. |
| **Email stopped arriving** | `MX` or `mail` records are missing or proxied. | Re-add them as **DNS only**. |
| **Error 521 or 522** | Cloudflare can't reach your server. | [Open a ticket](https://my.web7tech.com/submitticket.php) and we'll check the server and firewall. |

Next: lock things down with our [recommended Cloudflare security settings for WordPress](/docs/recommended-cloudflare-security-settings-for-wordpress/).