Cloudflare Proxy Configuration for cPanel Subdomains

Putting Cloudflare in front of a cPanel site is mostly a DNS exercise. What catches people out is that not every hostname carries web traffic: mail, FTP and SSH cannot pass through Cloudflare's proxy, and one wrong toggle can stop email arriving. This guide sets up a custom subdomain, such as shop.yourdomain.com, behind the proxy and keeps everything else working.

It assumes your domain's nameservers already point to Cloudflare (a "full" setup). If they still point at your host, the records below belong in cPanel's Zone Editor instead and the proxy settings do not apply.

Before you start

You need three things:

• The server's IP address. cPanel shows it in the General Information panel on the home screen, usually labelled "Shared IP Address" or "Dedicated IP Address".
• The subdomain created in cPanel. Go to Domains (Subdomains on older cPanel versions), choose Create A New Domain, enter shop.yourdomain.com and pick its document root. This tells the web server to answer for that name; it does not publish any DNS.
• Access to the domain in your Cloudflare dashboard.

Once the nameservers are Cloudflare's, cPanel's own DNS zone is no longer what the internet sees, so every public record has to exist in Cloudflare.

Add the DNS record

In Cloudflare, open DNS, then Records, and add:

If your server also has an IPv6 address, add a matching AAAA record. You can instead use a CNAME pointing shop at yourdomain.com when the subdomain lives on the same server as the main site; both work.

Proxied (the orange cloud) means visitors connect to Cloudflare, which forwards the request to your server. You get Cloudflare's caching, TLS certificate and protection, and your server's IP address is not published in DNS. DNS only (the grey cloud) means Cloudflare simply answers the DNS query and visitors connect straight to your server.

Decide which records stay DNS-only

Cloudflare's proxy handles HTTP and HTTPS. Anything else has to bypass it, so these records must be DNS only:

• Mail hostnames, such as mail.yourdomain.com, and whatever hostname your MX record points at. Mail servers connect on SMTP and IMAP ports the proxy does not carry. If the MX target is proxied, incoming mail fails.
• FTP and SSH, such as ftp.yourdomain.com. FTP on port 21 and SSH on port 22 are not proxied.
• Mail client discovery, autodiscover and autoconfig, which mail apps use to find server settings.
• Anything on a non-web port. The proxy only forwards a fixed list of ports: 80, 8080, 8880, 2052, 2082, 2086 and 2095 for HTTP, and 443, 2053, 2083, 2087, 2096 and 8443 for HTTPS.

TXT records for SPF, DKIM and DMARC are never proxied, so they need no attention; just make sure they were copied across when you moved the nameservers.

Keeping mail. and ftp. DNS-only publishes your server's IP address. That is unavoidable for mail, so leave nothing else DNS-only without a reason.

cPanel's own subdomains

cPanel can answer on friendly hostnames that forward to its interfaces: cpanel.yourdomain.com for the control panel and webmail.yourdomain.com for webmail, among others. These are served over standard HTTPS, so they work through the proxy. If you see login loops or session errors on them, switch those two records to DNS-only; nothing else depends on them being proxied.

Choose Full (strict) SSL

Under SSL/TLS, choose the encryption mode Full (strict). Cloudflare then encrypts the connection to your server and checks that the server's certificate is valid for the hostname.

That needs a valid certificate on the server for shop.yourdomain.com. Two common ways to get one:

1. AutoSSL in cPanel. Open SSL/TLS Status, check the subdomain is listed, and run AutoSSL. It issues a publicly trusted certificate that also works for DNS-only visitors.
2. A Cloudflare Origin CA certificate. Create one under SSL/TLS, then Origin Server, and install it in cPanel under SSL/TLS, then Manage SSL sites. It is trusted only by Cloudflare, so use it only on hostnames that are always proxied.

Avoid Flexible: Cloudflare would talk to your server over plain HTTP, and if WordPress or an .htaccess rule redirects HTTP to HTTPS, the browser loops until it gives up. Once Full (strict) works, turn on Always Use HTTPS under SSL/TLS, then Edge Certificates.

Check it works

• Run dig +short shop.yourdomain.com. A proxied record returns Cloudflare addresses, not your server's.
• Load the page and look for a cf-ray response header in the browser's network panel.
• Send a test email to an address on the domain to confirm mail still arrives.

Troubleshooting

Finally, visitor IP addresses: with the proxy on, requests reach the server from Cloudflare's addresses. Server logs and some security plugins need to read the CF-Connecting-IP header to see the real visitor. If your logs or a plugin only show Cloudflare addresses, open a support ticket and include one log line.