Cloudflare and Hosting: Free CDN and SSL Explained

Cloudflare sits in front of a large share of the web, and many hosts now include it with their plans. But "Cloudflare included" can mean very different things, and the setup choices affect your speed, your SSL and how much control you have. This guide explains what Cloudflare does, how it works alongside your hosting, and how to decide between your host's Cloudflare and your own account.

What Cloudflare actually does

When Cloudflare is active for a domain, visitors connect to Cloudflare first instead of directly to your server. Cloudflare then fetches what it needs from your server (called the origin) and passes it on. That position in the middle gives you three main benefits.

A content delivery network

Cloudflare runs data centres in many cities around the world. Static files such as images, stylesheets and scripts are cached in those locations, so visitors download them from somewhere near them rather than from your server. Pages feel faster, and your server handles fewer requests.

Protection from common attacks

Because traffic passes through Cloudflare, it can absorb floods of junk traffic and block many automated attacks before they reach your hosting. Your server's address is also less exposed when the website records are proxied.

SSL at the edge

Cloudflare serves your site over HTTPS to visitors with its own certificate. That part is free and automatic. The important question is what happens between Cloudflare and your server, which is where SSL modes come in.

Proxied or DNS only: the orange and grey clouds

In Cloudflare's DNS settings, each record has a proxy status:

• Proxied (orange cloud): traffic goes through Cloudflare, with caching, protection and edge SSL. Use this for your website records, usually the bare domain and www.
• DNS only (grey cloud): Cloudflare just answers the DNS lookup and visitors connect straight to the server. Use this for mail records. Email cannot pass through Cloudflare's web proxy.

SSL modes in one minute

• Flexible: encrypted between visitor and Cloudflare, but not between Cloudflare and your server. Avoid it. It leaves part of the path unencrypted, and with servers that already redirect to HTTPS it causes redirect loops.
• Full: encrypted all the way, but Cloudflare does not check the server's certificate. Fine as a temporary step.
• Full (strict): encrypted all the way, and Cloudflare checks that the server has a valid certificate for your domain. This is the setting to aim for.

For a deeper look at certificates and modes, see our guide to Cloudflare SSL modes.

Option 1: your host manages Cloudflare

With this option the host adds your domain to its own Cloudflare setup. You change your domain's nameservers at your registrar to the two the host gives you, and the host creates the records and configures SSL.

At Zebra, choosing Zebra's Cloudflare gives you:

• Website and mail records created for you.
• Full (strict) SSL using a Cloudflare Origin CA certificate on the server.
• A DNS editor in your client area for adding or changing records.
• Visitor stats for the last 7 days.
• A clear cache button for when you have updated files and want visitors to see the new version straight away.

This is the easiest option, and the one we recommend if you do not already use Cloudflare. You do not need a Cloudflare account at all.

Option 2: you keep your own Cloudflare account

Many people already run their domains in their own Cloudflare account, often with page rules, firewall rules, workers or other services set up. Moving the domain to a host's Cloudflare would mean giving that up.

In that case, keep your nameservers where they are and point the records at the hosting server instead. At Zebra, the client area shows you exactly which records to create. The usual setup is:

1. Create the records shown in the client area. Keep the bare domain and www proxied, and set the mail record to DNS only.
2. In Cloudflare's SSL/TLS settings, choose Full for now.
3. In the Zebra client area, click to issue the free Let's Encrypt certificate. Let's Encrypt can verify your domain through Cloudflare's proxy.
4. Once the certificate is issued, switch Cloudflare to Full (strict).

The client area also has a DNS check that looks the domain up in public DNS and tells you whether each record points to our server.

Which option should you choose?

Choose your host's Cloudflare if:

• You do not have a Cloudflare account, or do not want to manage one.
• You want SSL, records and caching set up for you.
• You like having DNS, stats and cache clearing in the same place as your hosting.

Keep your own Cloudflare if:

• You already rely on Cloudflare features configured in your account.
• Several services share the domain and you want one place to manage all of them.
• Company policy says DNS must stay in an account you control.

Your own DNS without Cloudflare works too. Your site then connects directly to the server, still protected by a free Let's Encrypt certificate.

Switching later

The choice is not permanent. At Zebra you can switch a domain between Zebra's Cloudflare and your own DNS from the client area. Before switching away, copy any extra records you added, such as verification TXT records, because the zone is removed from our Cloudflare. Before switching to us, do the same with records at your current DNS provider.

Hosting with Cloudflare included

Every Zebra hosting plan comes with Cloudflare and free SSL, plus the Plesk control panel:

• Shared hosting from €2.99 a month, billed yearly.
• WordPress hosting from €3.99 a month, billed yearly.

You choose who runs the DNS at checkout, and your account is set up automatically in about two minutes.