How to Use Cloudflare: The Beginner's Guide
CodexFuse Team · 2026-10-29T17:45:58.792Z · 14 min read
How to use Cloudflare for the first time: add your site, fix DNS records, switch nameservers safely, pick the right SSL mode, and stay on the free plan.
Learning how to use Cloudflare for the first time feels harder than it is, because Cloudflare does three jobs at once: it is a DNS service, a security shield, and a speed layer that sits between your visitors and your web server. This beginner's guide walks you through the whole first setup in order — creating your account, adding your site, cleaning up the DNS records Cloudflare imports, switching your nameservers without taking your site down, choosing the orange-cloud proxy setting, picking the right SSL mode, and knowing exactly where the free plan ends.
Every price, mode name, and step below was checked against Cloudflare's own documentation on October 29, 2026, so nothing here is copied from a stale tutorial. If your site runs on a virtual server and you have never touched DNS before, read our guide on what VPS hosting actually is first — you will need your server's public IP address before step one.
What is Cloudflare, and what does it actually do for your site?
Cloudflare is a free-to-start network service that sits between your visitors and your web server, handling your domain's DNS, blocking attacks before they reach you, and serving cached content from 335+ cities worldwide. It is not a web host and not a domain registrar: your domain stays registered where it is, and your site keeps running on your current server — Cloudflare just becomes the front door.
That front-door position is what makes the three jobs possible. As a DNS provider it answers "where is this site?" queries fast, from Cloudflare's own edge network instead of your registrar's basic nameservers. As a security layer it absorbs DDoS attacks and filters malicious requests with its Web Application Firewall before they touch your origin server.
As a CDN it caches static assets close to visitors, so repeat page loads skip the trip to your server entirely. Cloudflare says it powers 1 in 5 sites on the Internet (cloudflare.com/plans, checked October 29, 2026) — which is why the setup below is worth doing once and doing right.
What do you need before you touch Cloudflare?
You need four things ready before you create the account, because the smoothest setups do all the homework up front. First, your domain and access to the registrar account where it is registered — that is where you will change nameservers later. Second, your server's public IPv4 address (and IPv6 too, if your server publishes AAAA records).
Third, a clear answer to "where does my email live?" — Google Workspace, Microsoft 365, or mail on your own server — because mail records are the number-one thing people break during this move. Fourth, a site that already works on the server: test it by IP first, before any DNS change, so you never debug hosting problems and DNS problems at the same time.
A free DNS lookup tool is handy from the very start: run your domain through it now and save the current records, so you have a before-and-after reference for everything Cloudflare imports.
How do you use Cloudflare? The 7 steps, in order
Here is the complete first-site sequence, the same order Cloudflare's own "Add a site" documentation uses:
- Create a free account at dash.cloudflare.com/sign-up and confirm the verification email. No credit card is required to start building on the free plan.
- Add your site: in the dashboard choose "Onboard a domain" (or "Add site") and enter your apex domain — example.com, not www.example.com. Subdomains are managed inside the same zone afterwards.
- Pick the Free plan for this website. Everything a first site needs is on it; you can upgrade later without redoing the setup.
- Review the imported DNS records. Cloudflare scans your domain and pulls in the records it finds — but the scan is explicitly a starting point, not a finished import. Compare every record against your current DNS, add anything missing (mail records especially), and fix anything wrong. Do not change nameservers yet.
- Lower the TTL on the A, AAAA, and CNAME records you will change to 300 seconds, ideally 24 hours before the cutover, so your next change propagates quickly.
- Switch nameservers at your registrar to the two Cloudflare nameservers the dashboard gives you (they look like ada.ns.cloudflare.com and nick.ns.cloudflare.com). Turn DNSSEC off at your registrar first. Registrars can take up to 24 hours to process the change; Cloudflare emails you when the zone goes active.
- Turn on the proxy and set SSL mode: flip the website records to the orange cloud and set SSL/TLS to Full (strict) — the two settings that actually deliver the protection and the padlock.
Which DNS records does a first site actually need?
A first site needs fewer records than the import screen suggests, and the critical skill is knowing which ones must stay un-proxied. This table is the baseline worth copying for a typical small site:
| Type | Name | Value | Proxy |
|---|---|---|---|
| A | @ | Your server's IPv4 address | DNS only at first, orange cloud after verified |
| CNAME | www | example.com | DNS only at first, orange cloud after verified |
| A | Your server's IPv4 address | DNS only — always | |
| MX | @ | mail.example.com (priority 10), or your provider's MX set | DNS only — always |
| TXT | @ | v=spf1 a mx ip4:YOUR-IP -all | DNS only — always |
| TXT/CNAME | selector (DKIM) | Your mail provider's DKIM value | DNS only — always |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] | DNS only — always |
The rule that saves inboxes: never proxy mail records. Cloudflare's proxy handles HTTP and HTTPS (plus a few services on paid plans) — it does not proxy SMTP or IMAP. Your MX record, the mail host's A record, and every mail authentication TXT record must stay on the grey cloud (DNS only).
Proxy the mail host and you have effectively scheduled a mail outage, because mail clients will try to talk SMTP to a Cloudflare edge IP that does not speak it.
If you use Google Workspace or Microsoft 365, do not improvise the MX set — copy their official records exactly. And keep SPF to a single TXT record per hostname; multiple SPF records on one name is one of the most common self-inflicted deliverability wounds.
When should you change the nameservers — and what is the safe order?
Change the nameservers last, after everything else is verified — the nameserver change is the point of no return, so the safe cutover order is test by IP first, low TTL second, nameservers last, never the reverse. This is the single most valuable sentence in this guide: almost every "Cloudflare broke my site" story is really "I changed nameservers before the records were right."
Testing by IP means proving the server answers for your domain before DNS points at it. From any terminal: curl -I -H 'Host: example.com' http://YOUR-SERVER-IP/ should return your site's headers.
If you already have a certificate on the server, test HTTPS too with curl -Ik --resolve example.com:443:YOUR-SERVER-IP https://example.com/. Only when that works do you touch the registrar.
At the registrar, switch the domain from default to custom nameservers and paste Cloudflare's two nameservers exactly. Cloudflare detects the change itself and activates the zone; the documentation notes registrars can take up to 24 hours to process it, though it is often minutes to a few hours.
Verify with dig NS example.com +short — you should see the Cloudflare nameservers — and check the A records resolve to the right place from a second network (a phone hotspot works) in case your main connection is looking at a cached answer.
After the cutover, keep an eye on the site with a website uptime monitor for the first 48 hours. If something does wobble, your rollback is the old nameservers — which is another reason the TTL went down before the switch, not after.
Orange cloud or grey cloud — what does the proxy toggle actually change?
The orange cloud routes visitor traffic through Cloudflare's network, so requests get the protection, caching, and Universal SSL; the grey cloud (DNS only) publishes the record as plain DNS with no proxying at all. The toggle is per-record, and the right choice follows what the record is for:
| Record | Setting | Why |
|---|---|---|
| @ and www (your website) | Orange cloud | This is the whole point: DDoS protection, CDN caching, free Universal SSL |
| mail hostname and MX target | Grey cloud | SMTP/IMAP cannot go through the proxy — mail breaks |
| SPF, DKIM, DMARC records | Grey cloud | TXT records are not HTTP; proxying is meaningless for them |
| FTP, SSH, or control-panel hostnames | Grey cloud | The proxy only handles HTTP(S) traffic |
Two consequences of the orange cloud are worth knowing on day one. First, your server will start seeing Cloudflare's IP addresses instead of your visitors' real ones in its logs — restore the real address from the CF-Connecting-IP header (Nginx: set_real_ip_from with Cloudflare's IP ranges plus real_ip_header CF-Connecting-IP). Second, once you are proxied, lock the origin down: firewall ports 80/443 so they only accept Cloudflare's IP ranges, otherwise attackers can bypass every Cloudflare protection by hitting your server's raw IP directly.
Which SSL mode should you choose?
Choose Full (strict) — it is the mode Cloudflare itself recommends, and it encrypts the connection end to end with a validated certificate on your origin server. Cloudflare's encryption mode controls two separate connections (visitor-to-Cloudflare and Cloudflare-to-origin), and the names describe the second one:
| Mode | Cloudflare to origin | Use it when |
|---|---|---|
| Automatic SSL/TLS (default) | Recommender picks the safest mode | New zones: Cloudflare probes your origin and upgrades gradually (1% of traffic, then 10% increments), with a weekly digest email to Super Admins |
| Off | Plain HTTP | Never for a public site |
| Flexible | Plain HTTP | Your origin has no TLS at all — avoid; the classic cause of redirect loops |
| Full | HTTPS, certificate not validated | Origin uses a self-signed or otherwise invalid certificate |
| Full (strict) | HTTPS with certificate validation | Always, once your origin has a valid certificate (Let's Encrypt or Cloudflare Origin CA) |
| Strict (SSL-Only Origin Pull) | Always HTTPS with validation | Origins that must never receive plain HTTP |
Mode names and behavior verified at developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ (documentation updated 2026-04-16, checked October 29, 2026). The two failures every beginner meets map directly onto this table.
"Too many redirects" almost always means Flexible mode combined with forced HTTPS at the origin — fix it by moving to Full (strict) and keeping exactly one redirect source of truth. Errors 525/526 mean the origin TLS handshake failed — check the certificate chain and confirm port 443 is open on the server, testing past Cloudflare with the curl --resolve trick from the nameserver section.
What does the Cloudflare free plan include — and when should you pay?
The free plan costs $0 with no credit card required to start, and it includes fast easy-to-use DNS, unmetered DDoS protection, the CDN, a Universal SSL certificate, and the free Managed Ruleset firewall — genuinely everything a first site needs. Cloudflare positions it for "personal or hobby projects that aren't business-critical," which covers most first-time setups.
The paid tiers, checked October 29, 2026 at cloudflare.com/plans: Pro is $20/month billed annually ($25 billed monthly), for professional websites; Business is $200/month billed annually ($250 billed monthly), for small businesses operating online.
What the free plan does not include is the honest upgrade trigger list: no image optimization, no uptime SLA or service credits, no PCI DSS compliance, and no single-sign-on. If you need advanced WAF rules, an uptime SLA, or PCI compliance for card payments, that is when the paid plan conversation starts — not before.
If the server bill itself is what you are optimizing, our web hosting deals calendar tracks when hosting is actually cheapest through the year. And if you are still deciding what kind of server to run all this on, the shared vs VPS vs dedicated hosting guide lays out the decision with the exact signals it is time to move up.
Is 1.1.1.1 the same thing as Cloudflare?
No — 1.1.1.1 is Cloudflare's free public DNS resolver for your own devices, a completely separate product from the Cloudflare dashboard that protects your website. Mixing the two up is the most common beginner confusion, and this section exists to end it.
1.1.1.1 lives on your side of the screen: instead of using your ISP's DNS resolver, you point your computer or phone at 1.1.1.1, and it translates domain names to IP addresses for you. Cloudflare's case for switching is privacy plus speed — unlike most resolvers it does not sell user data to advertisers, keeps logs for 24 hours for debugging then purges them, and the independent monitor DNSPerf ranks it the fastest DNS service in the world, served from 335+ cities. Setup takes minutes: on a desktop you replace the DNS IP with 1.1.1.1 in your Internet preferences (no special software), on a phone you install the 1.1.1.1 app.
WARP is the optional app built on top of 1.1.1.1: where 1.1.1.1 only secures DNS queries, WARP routes all of the device's traffic over Cloudflare's network with encryption — some of a VPN's security benefits without the performance penalties and data-privacy concerns of many for-profit VPNs. The one-line distinction to remember: 1.1.1.1 protects you while you browse; the Cloudflare dashboard protects your site's visitors.
What usually breaks after the switch — and how do you fix it?
Almost every post-cutover problem is one of five known issues, each with a known fix:
| Symptom | Likely cause | Fix |
|---|---|---|
| "Too many redirects" in the browser | Flexible SSL mode plus forced HTTPS at the origin | Set SSL/TLS to Full (strict); keep exactly one redirect source of truth |
| Error 525 or 526 | Origin TLS handshake failed or certificate invalid | Check the certificate chain and confirm port 443 is open on the server |
| Site loads but email stops arriving | MX or mail-host records missing after import, or proxied | Mirror all mail DNS before the cutover; keep every mail record on the grey cloud |
| DNS_PROBE_FINISHED_NXDOMAIN | Zone activated without the correct records | Add the missing records (root A, www, mail) — Cloudflare's own docs flag this exact error |
| Visitors still see the old IP | Cached old record, or the old TTL had not expired | Wait out the old TTL; verify with dig from a second network |
Sources
- Cloudflare, "Encryption modes" — developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ (documentation updated 2026-04-16; SSL mode names, Automatic SSL/TLS behavior, and the Full/Full (strict) recommendation checked October 29, 2026)
- Cloudflare, "Add a site" — developers.cloudflare.com/learning-paths/clientless-access/initial-setup/add-site/ (add-site steps, DNSSEC note, "registrars can take up to 24 hours" checked October 29, 2026)
- Cloudflare, "Pricing" — cloudflare.com/plans/ (Free $0 scope, Pro $20/mo annual / $25 monthly, Business $200/mo annual / $250 monthly, "powers 1 in 5 sites," no-credit-card start checked October 29, 2026)
- Cloudflare, "What is 1.1.1.1?" — cloudflare.com/learning/dns/what-is-1.1.1.1/ (resolver privacy claims, 24-hour log purge, DNSPerf ranking, 335+ cities, WARP description checked October 29, 2026)
- HostMyCode, "Cloudflare DNS setup guide tutorial (2026)" — hostmycode.com (DNS-scan-as-starting-point, never-proxy-mail-records rule, TTL-300 cutover plan, test-by-IP curl commands, Full (strict) as the target default, 525/526 and redirect-loop fixes; fetched in full October 29, 2026)
Frequently asked questions
Is Cloudflare really free?
Yes — the Free plan is $0 with no credit card required to start, and it covers fast DNS, unmetered DDoS protection, the CDN, a Universal SSL certificate, and the free Managed Ruleset firewall. Most first sites never need to leave it; the paid Pro plan ($20/month billed annually) starts to matter when you want advanced WAF rules or image optimization.
Will switching my nameservers take my site down?
Not if you change them last. The safe order is: prove the site works by testing the server IP directly, lower the TTL to 300 a day before, review every DNS record Cloudflare imported (mail records especially), and only then switch nameservers at your registrar. With correct records in place, visitors see no downtime — just a propagation wait of minutes to hours.
Why does my site show "too many redirects" after adding Cloudflare?
This is almost always Flexible SSL mode fighting a forced-HTTPS setting on your origin: Cloudflare talks HTTP to your server, your server redirects to HTTPS, and the loop never ends. Fix it by setting SSL/TLS to Full (strict) so the origin connection is encrypted too, and keep exactly one place that issues the HTTP-to-HTTPS redirect.
Should I turn on the orange cloud for my email records?
No — keep every mail-related record on the grey cloud (DNS only). Cloudflare's proxy handles HTTP and HTTPS, not SMTP or IMAP, so proxying your mail hostname or MX target breaks sending and receiving. Mirror your MX, SPF, DKIM, and DMARC records into Cloudflare's DNS before the nameserver switch, and leave them un-proxied permanently.
Is 1.1.1.1 the same as using Cloudflare for my website?
No. 1.1.1.1 is Cloudflare's free public DNS resolver that you set on your own computer or phone to browse faster and more privately. The Cloudflare dashboard is the separate product that protects and speeds up your website for its visitors — one protects you while browsing, the other protects your site's audience.