Cloudflare sits between visitors and your hosting. Visitors connect to Cloudflare with Cloudflare's certificate, and Cloudflare connects to MdmHost with yours. Both legs must be encrypted and trusted, which is what the Full (strict) SSL mode ensures. The wrong mode is the most common cause of redirect loops and security gaps.
Before you start
- A Cloudflare account with your domain added and Cloudflare's nameservers active at your registrar.
- A valid certificate on MdmHost for the domain. Check cPanel → Security → SSL/TLS Status.
SSL modes compared
| Mode | Visitor → Cloudflare | Cloudflare → MdmHost | Use? |
|---|---|---|---|
| Off | HTTP | HTTP | No |
| Flexible | HTTPS | HTTP (unencrypted) | No; causes loops and insecure traffic |
| Full | HTTPS | HTTPS, certificate not checked | Only temporarily |
| Full (strict) | HTTPS | HTTPS, valid certificate required | Yes |
Set Full (strict)
- In Cloudflare open your domain and go to SSL/TLS → Overview.
- Choose Full (strict).
- Open the site in a private window and check it loads without errors.
Keep AutoSSL renewing behind Cloudflare
AutoSSL validates domains over HTTP or DNS. With the orange-cloud proxy on, HTTP validation requests pass through Cloudflare to your server, which usually works as long as nothing blocks /.well-known/acme-challenge/ or /.well-known/pki-validation/. Avoid Cloudflare rules that redirect or challenge those paths. If AutoSSL fails, check its log in SSL/TLS Status.
Alternatively install a free Cloudflare Origin Certificate (Cloudflare → SSL/TLS → Origin Server) in cPanel → Security → SSL/TLS → Manage SSL sites. It is trusted only by Cloudflare, lasts many years and needs no renewal, but the site will show certificate errors if you ever turn the proxy off.
Redirects: pick one place
- Enable Always Use HTTPS in Cloudflare (SSL/TLS → Edge Certificates), or Force HTTPS Redirect in cPanel. Either is fine with Full (strict); avoid Flexible with any server redirect.
- In WordPress, keep Settings → General on
https://.
Caching and LiteSpeed
Let LiteSpeed Cache handle HTML caching and Cloudflare cache static files, unless you deliberately use a single CDN cache for everything. Purge both after design changes. LiteSpeed Cache can also connect to Cloudflare's API for purging under LiteSpeed Cache → CDN.
Cloudflare error codes
| Error | Meaning | Fix |
|---|---|---|
| 525 SSL handshake failed | Cloudflare could not complete TLS with the server | Ensure a certificate is installed for the domain on MdmHost |
| 526 Invalid SSL certificate | Server certificate expired, self-signed or wrong name | Run AutoSSL or install an Origin Certificate |
| Too many redirects | Flexible mode plus server redirect | Switch to Full (strict) |
| 521 / 522 | Server down or blocking Cloudflare | Check site status; contact support if firewall blocks Cloudflare IPs |
Visitor IPs
Behind Cloudflare, logs may show Cloudflare's IPs instead of visitors'. LiteSpeed on MdmHost servers supports restoring the real visitor IP from Cloudflare headers; if your statistics or security plugin shows only Cloudflare addresses, contact support.
Email and other subdomains
Only proxy web traffic through Cloudflare. Records such as mail, cpanel, webmail and MX targets should stay DNS only (grey cloud), because Cloudflare's proxy does not carry IMAP or SMTP and would hide the server that AutoSSL needs to reach for those names.