A CDN (content delivery network) keeps copies of your static files on servers around the world, so visitors download them from a nearby location instead of your origin server. Cloudflare adds a free CDN, DDoS protection and DNS in one step. This guide covers the setup for a site on MdmHost cPanel hosting.
Before you start
- Access to your domain registrar (to change nameservers) and to cPanel.
- A working SSL certificate on the origin. AutoSSL issues it for free; issue it before switching.
- A list of your current DNS records from cPanel → Domains → Zone Editor (Zone Editor guide).
How a CDN works
With Cloudflare, your domain's DNS answers with Cloudflare IPs instead of your server IP. Visitors connect to the nearest Cloudflare data centre, which serves cached files (images, CSS, JS) itself and fetches everything else from your server. Benefits: lower latency for distant visitors, less load and bandwidth on the origin, and filtering of attack traffic. HTML pages are not cached by default, so dynamic sites still need good server-side caching like LiteSpeed Cache.
Add the site to Cloudflare
- Create a Cloudflare account and choose Add a domain. Enter the root domain (
example.com). - Pick the Free plan. Cloudflare scans and imports existing DNS records.
- Compare the imported records with your Zone Editor list. Make sure
Arecords for@andwwwpoint to your hosting IP, and thatMX, SPF/DKIM/DMARCTXTrecords are present.
Set the proxy status correctly
| Record | Proxy |
|---|---|
@, www (website) | Proxied (orange cloud) |
mail, webmail, cpanel, ftp | DNS only (grey cloud) |
MX and TXT | Always DNS only |
Warning: Cloudflare only proxies web traffic. If the record your mail client or FTP uses is orange, email and FTP stop working. Keep them grey.
Change the nameservers
- Cloudflare shows two nameservers, for example
ada.ns.cloudflare.com. - At your registrar, replace the current nameservers with these two. For a domain registered with MdmHost, do this from your dashboard.
- Wait for Cloudflare to show the site as Active (usually minutes, up to 24 hours; see nameservers vs DNS records).
Note: From now on, DNS changes are made in Cloudflare, not in cPanel Zone Editor. Edits in cPanel no longer have any effect while Cloudflare's nameservers are active.
Set SSL to Full (strict)
In SSL/TLS → Overview choose Full (strict). Never use Flexible with a site that already redirects to HTTPS: it causes redirect loops. Full details in Cloudflare Full (strict) on MdmHost.
Check afterwards
dig +short example.com
curl -sI https://example.com | grep -i -E "server|cf-cache-status"You should see Cloudflare IPs, server: cloudflare and a cf-cache-status header. Send a test email in both directions.
Troubleshooting
- Too many redirects: SSL mode is Flexible. Switch to Full (strict).
- Error 521/522: Cloudflare cannot reach the origin. Check the A record IP and that the server is up.
- Logs show only Cloudflare IPs: LiteSpeed restores visitor IPs automatically; on Nginx see real visitor IPs behind Cloudflare.
- AutoSSL renewal fails: keep a valid origin certificate or use a Cloudflare Origin Certificate.