Securing your custom domain with HTTPS and ensuring fast global DNS resolution are essential steps for website performance, user trust, and search engine optimization. Cloudflare provides one of the world's most resilient Anycast DNS networks, alongside free SSL encryption, a global Content Delivery Network (CDN), and Web Application Firewall (WAF) security.
Whether you host your website on Blogger, WordPress, or a cloud server, routing your domain through Cloudflare reduces latency, protects against DDoS attacks, and eliminates SSL configuration errors. In this step-by-step tutorial, we walk through the entire setup process from account creation to advanced speed and security rules.
1. Why Route Your Domain Through Cloudflare?
Cloudflare acts as a reverse proxy sitting between your website's origin server and your visitors. This architecture provides several immediate technical benefits:
- Ultra-Fast DNS Propagation: Cloudflare’s global Anycast DNS resolves queries in under 15 milliseconds, significantly faster than standard domain registrar DNS servers.
- Free Managed SSL/TLS Certificates: Automatic certificate renewal with support for modern TLS 1.3 encryption.
- Global Edge Caching: Static assets (CSS, JS, images) are served from edge servers closest to your visitors, reducing origin server bandwidth consumption by up to 60%.
- DDoS & Bot Protection: Automatic mitigation of malicious scraping and volumetric traffic attacks before they reach your hosting server.
2. Step-by-Step Setup Guide
Step 1: Create a Cloudflare Account & Add Your Domain
- Go to the Cloudflare dashboard and sign up for a free account.
- Click Add a Site and enter your root apex domain (e.g.,
yourdomain.com). - Select the Free Plan and click Continue.
- Cloudflare will automatically scan your existing registrar records and import your DNS zone.
Step 2: Review and Verify DNS Records
Review the scanned records to ensure your root domain and subdomains point to the correct destination servers. For a standard website, verify the primary records:
| Type | Name | Content / Destination | Proxy Status |
|---|---|---|---|
| A | @ (root) | Origin Server IP (e.g., 192.0.2.1) | Proxied (Orange Cloud) |
| CNAME | www | yourdomain.com / ghs.google.com | Proxied (Orange Cloud) |
| MX | @ | Mail Server Hostname | DNS Only (Grey Cloud) |
Note: Email routing (MX) records must always be set to DNS Only (Grey Cloud) because Cloudflare proxying only supports HTTP/HTTPS traffic.
Step 3: Update Nameservers at Your Domain Registrar
- Cloudflare will assign you two custom nameservers (e.g.,
ns1.cloudflare.comandns2.cloudflare.com). - Log in to your domain registrar (Namecheap, GoDaddy, Google Domains, etc.).
- Locate your domain's DNS management section and change the nameserver mode from Default to Custom Nameservers.
- Paste the two Cloudflare nameservers and save changes. DNS propagation typically completes within 10 to 60 minutes.
3. Configuring SSL/TLS Encryption Modes
Navigate to the SSL/TLS tab in your Cloudflare dashboard to select your encryption mode:
- Flexible: Encrypts traffic between the browser and Cloudflare, but sends unencrypted plain HTTP to your origin server. (Avoid this mode if your server already has an active SSL certificate to prevent redirect loops).
- Full: Encrypts the entire connection from visitor to Cloudflare and from Cloudflare to your origin server, supporting self-signed certificates.
- Full (Strict) — Recommended: Requires a valid, trusted SSL certificate installed on your origin server, providing end-to-end cryptographic verification.
Enable Automatic HTTPS Rewrites & Always Use HTTPS
Under SSL/TLS > Edge Certificates, turn ON the following two settings:
- Always Use HTTPS: Automatically redirects all insecure
http://traffic to securehttps://with a 301 redirect. - Automatic HTTPS Rewrites: Prevents mixed-content warnings by dynamically rewriting insecure HTTP resource URLs (images, scripts, stylesheets) to secure HTTPS.
4. Performance & Caching Optimizations
A. Enable Auto Minification & Brotli Compression
Go to the Speed > Optimization tab:
- Brotli Compression: Enable Brotli to compress text assets more efficiently than standard Gzip, saving 15–20% bandwidth.
- Early Hints (103): Turn ON Early Hints to allow browsers to preload critical stylesheets and fonts while the server prepares the HTML document.
B. Configure Page Rules / Cache Rules
Create a Cache Rule to cache static assets for extended periods:
- Match Condition:
URI Path ends_with ".jpg" or URI Path ends_with ".png" or URI Path ends_with ".webp" or URI Path ends_with ".css" or URI Path ends_with ".js" - Cache Status: Eligible for Cache
- Edge TTL: 1 Month
- Browser TTL: 1 Month
5. Troubleshooting Common Cloudflare Errors
Error 521: Web Server Is Down
Cause: Cloudflare edge servers cannot establish a TCP connection with your origin hosting server.
Solution: Verify that your hosting server is online and that your firewall is not blocking Cloudflare's published IP ranges.
Error 522: Connection Timed Out
Cause: Your origin server took too long to complete the initial TCP handshake.
Solution: Check server CPU/RAM utilization and ensure port 443 (HTTPS) is listening properly.
ERR_TOO_MANY_REDIRECTS (Redirect Loop)
Cause: Your Cloudflare SSL mode is set to Flexible while your origin server is configured to force HTTPS redirects.
Solution: Change your Cloudflare SSL/TLS setting from Flexible to Full or Full (Strict).
Summary: Final Verification Checklist
- Confirm that both root domain and
wwwrecords have active orange proxy status. - Verify that SSL/TLS is set to Full or Full (Strict).
- Ensure Always Use HTTPS is enabled under Edge Certificates.
- Test your site using an SSL checker to verify that the TLS certificate is valid and free of mixed content warnings.