Cloudflare sits in front of your website, filtering attacks and serving cached files from its global network. It works well with a Web7 VPS, as long as you set up SSL and email correctly. This guide shows you how.
Two ways to use Cloudflare with Web7 #
- Web7’s Cloudflare protection. Point your domain at a dedicated hostname we give you with a single
CNAMErecord, and your traffic passes through our Cloudflare firewall before it reaches the four firewalls on our network. Ask support to set it up. - Your own Cloudflare account. You keep full control of your Cloudflare settings. The rest of this guide covers this option.
Before you start #
- Your VPS’s IP address, which is shown in the control panel.
- A login for your domain registrar (where you bought the domain).
- A list of your current DNS records, especially email (
MX) records. Take a screenshot before you change anything.
1. Add your site to Cloudflare #
Create a free Cloudflare account, choose Add a domain, and enter your domain. The Free plan covers everything in this guide. Cloudflare scans your existing DNS and imports the records it finds.
2. Check the DNS records #
Compare what Cloudflare imported with your screenshot and fix anything missing. A typical WordPress site with email on Web7 looks like this:
| Type | Name | Content | Proxy status |
|---|---|---|---|
A |
@ |
Your VPS IP address | Proxied |
CNAME |
www |
example.com |
Proxied |
A |
mail |
Your VPS IP address | DNS only |
MX |
@ |
mail.example.com |
DNS only |
TXT |
@ |
Your SPF record | DNS only |
Cloudflare only proxies web traffic. Anything used for email, FTP or SSH must stay DNS only (grey cloud), or it will stop working.
3. Let your SSL certificate issue first #
Web7 issues a free Let’s Encrypt certificate for your site automatically. If this is a brand-new site, set the website records to DNS only at first, wait until https:// loads with a padlock, then switch them to Proxied. This avoids a gap where Cloudflare expects a valid certificate that doesn’t exist yet.
4. Change your nameservers #
Cloudflare shows you two nameservers. At your registrar, replace the existing nameservers with these two. Most domains switch over within an hour, but it can take up to 24 hours. Cloudflare emails you when the domain is active.
5. Set SSL/TLS to Full (strict) #
In Cloudflare, go to SSL/TLS → Overview and choose Full (strict). Your traffic is then encrypted all the way to your VPS, and Cloudflare checks that the certificate is valid.
Never use Flexible. It leaves traffic between Cloudflare and your server unencrypted, and it causes the “too many redirects” error on WordPress sites that force HTTPS.
Then, under SSL/TLS → Edge Certificates, turn on Always Use HTTPS and set Minimum TLS Version to 1.2.
Troubleshooting #
| Symptom | Likely cause | Fix |
|---|---|---|
| Error 526: Invalid SSL certificate | The certificate on your VPS hasn’t been issued yet. | Set the records to DNS only until HTTPS works, then proxy them again. |
| Too many redirects | SSL mode is set to Flexible. | Switch to Full (strict). |
| Email stopped arriving | MX or mail records are missing or proxied. |
Re-add them as DNS only. |
| Error 521 or 522 | Cloudflare can’t reach your server. | Open a ticket and we’ll check the server and firewall. |
Next: lock things down with our recommended Cloudflare security settings for WordPress.
