🌐 Cloudflare Integration with NGINX

📋 Table of Contents

1. Cloudflare Overview & Benefits
2. The IP Address Problem
3. Server-Side Configuration
4. Dashboard Configuration
5. Automatic Platform Optimization

1. Cloudflare Overview & Benefits

Cloudflare is a content delivery network (CDN) and security service that acts as a reverse proxy between your visitors and your server. The free plan provides substantial benefits for WordPress hosting:

2. The IP Address Problem

The Solution: HTTP Real IP Module

Ubuntu's NGINX includes the http_realip_module by default. This module allows NGINX to recognize the original visitor IP address from HTTP headers when requests come from trusted sources (Cloudflare's IP ranges).

3. Server-Side Configuration

1Create the Cloudflare IP List File

First, obtain the latest Cloudflare IP addresses from the official sources:

• IPv4: https://www.cloudflare.com/ips-v4
• IPv6: https://www.cloudflare.com/ips-v6

Navigate to the NGINX includes directory and create the configuration file:

2Configure the IP List File

Add the following content to the file. Each Cloudflare IP range must be prefixed with set_real_ip_from:

# Last updated: Check https://www.cloudflare.com/ips-v4 and /ips-v6 for current list
# IPv4 Ranges
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

# IPv6 Ranges
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

# Specify which header contains the real IP
real_ip_header CF-Connecting-IP;

3Verify the File Path

Confirm the complete file path for reference:

Expected output: /etc/nginx/includes/cloudflare_ip_list.conf

4Include File in Server Block

Navigate to your site's configuration directory:

Add the include directive in your server block, preferably after other security includes:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # Other directives...
    
    include /etc/nginx/includes/nginx_security_directives.conf;
    include /etc/nginx/includes/cloudflare_ip_list.conf;
    
    # Rest of configuration...
}

5Test and Apply Configuration

Always test the NGINX configuration before applying changes:

If the test is successful, reload NGINX to apply the configuration:

6Verify IP Logging

After enabling Cloudflare proxy and completing the configuration, test that your logs show real visitor IPs:

Visit your site and check that the logged IP addresses are visitor IPs, not Cloudflare IPs.

4. Cloudflare Dashboard Configuration

1DNS Configuration

Log into your Cloudflare account and select your domain. Navigate to DNS settings.

Enable Proxy Status

This is the most critical setting. You must change the proxy status for your domain records:

2SSL/TLS Configuration

Navigate to SSL/TLS in your Cloudflare dashboard.

Encryption Mode

Set encryption mode to Full (Strict). This is critical for security:

Edge Certificates

Navigate to SSL/TLS → Edge Certificates:

• Always Use HTTPS: ✅ Enable (automatically redirects HTTP to HTTPS)
• HTTP Strict Transport Security (HSTS): ❌ Do NOT enable (already configured on server)
• Minimum TLS Version: Set to TLS 1.2 (never use TLS 1.0 or 1.1)
• TLS 1.3: ✅ Enable (latest, fastest, most secure)

3Speed Optimization

Navigate to Speed → Optimization → Content Optimization:

4Caching Configuration

Navigate to Caching → Configuration:

Cache Purging

If changes to your site aren't reflecting, you may need to purge the cache:

• Purge Everything: Clears all cached content (use sparingly)
• Custom Purge: Clear specific URLs, prefixes, or hosts

Caching Level

• Standard: ✅ Recommended (caches static resources)
• Aggressive: ⚠️ May cache too much, breaking dynamic content

Browser Cache TTL

Set to 1 month minimum for optimal performance. This tells browsers how long to cache static resources locally.

Development Mode

Temporarily bypass caching when making significant site changes. Automatically disables after 3 hours.

Smart Tiered Cache Topology

Navigate to Caching → Tiered Cache:

5Network Configuration

Navigate to Network:

• IPv6 Compatibility: ✅ Ensure enabled (enabled by default, provides IPv6 support)
• Other settings can remain at defaults

6Scrape Shield

Navigate to Scrape Shield:

5. Automatic Platform Optimization (APO)

What is APO?

Cloudflare's Automatic Platform Optimization (APO) for WordPress is designed to significantly enhance WordPress performance by optimizing content delivery through intelligent caching strategies.

Key Features:

How APO Works

APO Implementation

1Enable APO in Dashboard

Navigate to Speed → Optimization → Automatic Platform Optimization:

• Click Subscribe to APO ($5/month)
• Enable the APO feature

2Install WordPress Plugin

APO requires the official Cloudflare WordPress plugin for optimal functionality:

1. Log into WordPress admin dashboard
2. Navigate to Plugins → Add New
3. Search for "Cloudflare"
4. Install and activate the Cloudflare plugin
5. Configure the plugin with your Cloudflare API token

3Plugin Benefits

The Cloudflare WordPress plugin provides:

• Automatic Cache Purging: Clears Cloudflare cache when you publish/update content
• Smart Cache Invalidation: Only purges affected pages, not entire cache
• WooCommerce Integration: Properly handles e-commerce caching
• Dashboard Integration: Manage Cloudflare settings from WordPress

APO Performance Benefits

📝 Maintenance & Best Practices

Regular Maintenance Tasks

Troubleshooting Common Issues

Testing Checklist

🎯 Summary

Implementing Cloudflare with proper NGINX configuration provides substantial benefits for WordPress hosting: