Cloudflare works well in front of a Gen2 server. The server already knows Cloudflare's addresses and reads the visitor's real IP address, so limits, blocks and logs keep working per visitor.
- DNS
Create the A records for
@andwwwwith the server's IPv4 address. Proxy (orange cloud) can be on. - SSL/TLS modeFull (strict). Never Flexible: it causes redirect loops and sends traffic unencrypted to the server.
- Always Use HTTPS
On.
- Caching
Leave HTML to the server (Varnish or Magento's page cache). Let Cloudflare cache images, CSS and JavaScript.
- Under Attack mode
Only during a real attack; the server's own browser check usually handles bot waves without bothering customers.
If you restrict access to the server to Cloudflare only, keep our platform and your SSH addresses allowed, or you lose console actions that reach the site.
Purge after changes
After a design change, flush the store's caches first, then purge Cloudflare's cache for CSS and JavaScript.
Did this solve it? If not, tell us what you see and we look at your server.
Open a ticket