Use Cloudflare with a Plesk-hosted website

Cloudflare adds a global CDN, DDoS protection and a web application firewall in front of your site. It works well with Plesk once DNS, SSL and visitor IPs are configured correctly. Most problems people hit – redirect loops, failing certificates, all visitors showing one IP – come from skipping one of these steps.

Before you start

• Your site working on Plesk with a valid certificate; see SSL It!.
• A Cloudflare account and access to your domain registrar to change nameservers.

Move DNS to Cloudflare

1. Add the domain in Cloudflare; it imports existing records.
2. Compare them with Plesk's zone (Hosting & DNS → DNS) and add anything missing: A for the root and www, mail, MX, SPF, DKIM (default._domainkey) and DMARC.
3. Set web records (root, www) to Proxied (orange cloud). Keep mail, webmail and FTP records DNS only (grey cloud) – Cloudflare does not proxy mail.
4. Change the nameservers at your registrar to the two Cloudflare provides.
5. In Plesk, disable the local DNS zone or leave it unused, to avoid confusion; see DNS in Plesk.

SSL mode

In Cloudflare, go to SSL/TLS and choose Full (strict). Plesk already has a valid Let's Encrypt certificate, so traffic is encrypted end to end. Avoid Flexible – it causes redirect loops with Plesk's HTTPS redirect and leaves the server connection unencrypted.

Keep Let's Encrypt renewing

HTTP validation usually works through Cloudflare's proxy as long as /.well-known/acme-challenge/ is not blocked by a Cloudflare rule or forced redirect page. Alternatively, use a Cloudflare Origin Certificate installed in Plesk (valid only behind Cloudflare). If renewals fail, temporarily switch the record to DNS only and reissue.

Restore real visitor IPs

Behind Cloudflare, the server sees Cloudflare's IPs. Plesk can restore visitors' real IPs: on recent versions use the Cloudflare ServerShield extension or configure nginx's real_ip module with Cloudflare's IP ranges and the CF-Connecting-IP header (administrators, in nginx settings). Without this, Fail2Ban and logs see only Cloudflare addresses – and Fail2Ban could ban Cloudflare itself.

Caching

Cloudflare caches static files by default. For dynamic sites, avoid "Cache Everything" rules on admin and cart pages. Combined with Plesk's nginx settings, this gives fast pages; see nginx caching.

Troubleshooting

• ERR_TOO_MANY_REDIRECTS: SSL mode is Flexible while Plesk redirects to HTTPS. Use Full (strict).
• Error 525 / 526: the origin certificate is invalid or missing; reissue Let's Encrypt in Plesk.
• Email stopped: mail was proxied or MX records were not copied.
• Changes do not show: purge the Cloudflare cache.

Next steps

• Redirects in Plesk.
• Fail2Ban.
• Email authentication.