Cloudflare
Put any domain on your Cloudflare account and keep it there: the panel's DNS stays the place you edit, and every change reaches Cloudflare by itself.
- Everyone - administrator, reseller and customer: DNS › Cloudflare (a reseller also sees its customers' state under Selling › Cloudflare)
Make the token
Use a User API Token made as a Custom Token — never the Global API Key (the panel refuses it), and not an Account API Token (the panel cannot check those).
- On Cloudflare: My Profile › API Tokens › Create Token › Create Custom Token.
- Give it these permissions:
| Permission | Access | What it is for |
|---|---|---|
| Zone › Zone | Edit | adding a domain to Cloudflare, and removing it |
| Zone › DNS | Edit | keeping the records in step, the orange cloud |
| Zone › Zone Settings | Edit | SSL mode, Development mode, Under attack mode |
| Zone › Cache Purge | Purge | the Clear cache button |
| Account › Account Settings | Read | knowing which account new domains go into |
- Zone Resources: Include › All zones (or all zones from one account). Account Resources: Include › your account.
- Client IP filtering: leave it empty — or, if you limit addresses, include this server's.
- Create it, copy the token (Cloudflare shows it once), paste it in API token and press Connect.
A missing permission does not stop the rest: the page says which buttons need it. The token is stored encrypted and never shown again. Disconnect leaves your domains on Cloudflare exactly as they are; the panel just stops copying changes there.
Add or link a domain
- Add a domain (a domain not yet on Cloudflare): the panel copies all of its records to Cloudflare — every name grey (DNS only) to start with — and shows the two Cloudflare nameservers to set at your registrar. Nothing changes for visitors until you switch them.
- Link (a domain already on Cloudflare): the panel shows its records next to Cloudflare's and you choose, record by record, which to keep. Nothing on Cloudflare changes before you do.
After that
- Edit DNS in the panel. A new record, a new subdomain, mail switched on — it reaches Cloudflare within seconds, and every domain is checked again every six hours. Records made on Cloudflare itself are left alone.
- Orange cloud per record. Mail names always stay grey: Cloudflare cannot carry mail.
- SSL mode: use Full (strict). Flexible is refused for a site with Force HTTPS, because that loops forever.
- Under attack mode, Development mode (switches itself off after three hours) and Clear cache (everything, or up to 30 addresses).
- Stop managing — optionally deleting the domain from Cloudflare too.
Who manages what
The administrator can manage every domain on the server with one token, without connecting each account. An account that connects its own Cloudflare manages its own domains. A domain is looked after by one Cloudflare account at a time; the other side sees it as managed elsewhere.
Real visitor addresses
A site behind Cloudflare is reached from Cloudflare's addresses. The panel finds such sites by itself (every six hours) and, for them only, takes the visitor's real address from Cloudflare's header — and only when the request really comes from Cloudflare's address ranges. Your logs, the firewall and the WAF then see the real visitor. This is on by default under Security › Firewall › Cloudflare, on the Nginx + Apache web stack.
Cloudflare's addresses are never blocked by the firewall's automatic blocking, so a site behind Cloudflare keeps its visitors.