Record the existing configuration

Export or record current A, AAAA, CNAME, MX, TXT, SPF, DKIM and DMARC records before changing nameservers. Email records must be handled separately from web proxying.

Configure web DNS

Set web-facing A/AAAA or CNAME records to the actual origin specified by your hosting provider. Choose proxy status intentionally rather than switching every record on.

Use origin HTTPS

For a proxied site with a valid origin certificate, prefer a properly configured secure mode such as Full (strict). Avoid relying on Flexible SSL as a workaround for missing origin HTTPS.

Test

  • Confirm both apex and www hostnames resolve as expected.
  • Verify HTTP redirects to HTTPS without loops.
  • Confirm login, payments, callbacks and file uploads work through the proxy.
  • Recheck DNS email records and inbound/outbound mail.

Sources

Consult Cloudflare's current DNS documentation and SSL/TLS modes.

Editorial note

Examples are starting points, not production security audits. Confirm dependencies, versions and pricing using linked vendor documentation.