In short
- Your website and email stay on your hosting and your domain stays where it’s registered. You only change the domain’s nameservers.
- Set your website records to Proxied and everything to do with email and cPanel to DNS only.
- Use the Full (strict) encryption mode. Never use Flexible.
- Leave Cloudflare’s Always Use HTTPS off, and turn on cPanel Domains › Force HTTPS Redirect instead, so your free certificate keeps renewing.
Allow about 30 minutes, plus up to a day for the change to take effect. Your site and email keep working while you wait.
What Cloudflare does
Normally a visitor’s browser connects straight to the server your site is hosted on. With Cloudflare, the browser connects to Cloudflare’s network instead, which has data centres in hundreds of cities, including several in the UK. Cloudflare answers with copies of your images, stylesheets and scripts it has already saved, and asks your hosting only for what it doesn’t have.
To do that, Cloudflare has to look after your domain’s DNS: the records that say where your website and email live. That’s why the main step is changing your nameservers.
Why use it?
- Faster pages. Files come from a server close to each visitor, so pages load faster, especially for visitors abroad. Speed is part of how Google ranks pages.
- Protection from attacks. Cloudflare absorbs denial-of-service attacks and filters out a lot of junk and bot traffic before it reaches your site.
- Less load on your hosting. Files Cloudflare serves from its own copies don’t use your hosting’s resources, which helps on a busy day.
- Copes with short outages. Cloudflare can keep showing saved pages if your site is briefly unavailable.
- Free traffic stats. Visits, bandwidth and blocked threats, including visitors who block analytics scripts.
Before you start
Have your logins ready: cPanel, and wherever your domain is registered. If you bought your domain with your hosting from OnPoint Hosts, that’s your OnPoint Client Area.
Make a note of your DNS records. Open cPanel Domains Zone Editor, select Manage next to your domain, and take a screenshot or copy the list. You’ll use it to check Cloudflare has copied everything.
Turn off DNSSEC if it’s on. It’s a setting where your domain is registered. Changing nameservers while DNSSEC is on can make your domain unreachable. You can switch it back on through Cloudflare at the end.
Step 1: Create a Cloudflare account
Go to dash.cloudflare.com/sign-up, enter your email address and a strong password, and select Sign up.
Confirm your address from the email Cloudflare sends you.
Step 2: Add your domain
In the Cloudflare dashboard, go to Domains and select Onboard a domain (sometimes shown as Add a domain).
Type your domain without
wwworhttps://— for exampleyourbusiness.co.uk.Choose to scan for existing DNS records and select Continue.
Choose the Free plan and select Continue.
Nothing changes for your visitors yet. Your site and email carry on exactly as before until you change the nameservers in step 4.
Step 3: Check your DNS records carefully
This is the step that decides whether your email keeps working. Compare the records Cloudflare found with your notes from the Zone Editor and add anything that’s missing.
Each record has a proxy status. Proxied (orange cloud) sends traffic through Cloudflare: use it for your website. DNS only (grey cloud) just points people at your hosting: use it for everything else.
| Record | Type | Set to | What it’s for |
|---|---|---|---|
| yourbusiness.co.uk | A | Proxied (orange cloud) | Your website |
| www | CNAME | Proxied (orange cloud) | Your website |
| A or CNAME | DNS only (grey cloud) | Email — proxying this stops your email working | |
| webmail, cpanel, whm, webdisk, ftp | A or CNAME | DNS only (grey cloud) | cPanel services |
| autodiscover, autoconfig, cpcalendars, cpcontacts | A or CNAME | DNS only (grey cloud) | Email apps and calendars set themselves up with these |
| MX records | MX | Must be there | Where your email is delivered (never proxied) |
| SPF, DKIM and DMARC | TXT | Must be there | Prove your email is genuine, so it stays out of spam |
When everything matches, select Continue.
Step 4: Change your nameservers
Cloudflare shows you two nameservers with names like anna.ns.cloudflare.com and bob.ns.cloudflare.com. Yours will be different, so copy the exact ones it gives you.
If your domain is registered with OnPoint Hosts:
Log in to the OnPoint Client Area.
Go to Domains › My Domains and select Manage next to the domain.
Open Nameservers and choose Use custom nameservers.
Replace OnPoint’s nameservers (ns0.thundercloud.uk and ns1.thundercloud.uk) with Cloudflare’s two, clear any other boxes, and select Change Nameservers.
If your domain is registered somewhere else, change the nameservers in that company’s control panel the same way. Cloudflare links to instructions for the larger registrars.
Step 5: Wait for Cloudflare to confirm
Back in Cloudflare, select the button to check your nameservers. Most changes go through within an hour, but some take 24 to 48 hours. Cloudflare emails you when your domain is Active. Your website and email keep working throughout, because both the old and the new DNS point to the same hosting.
Step 6: Set up HTTPS the right way
HTTPS on Cloudflare has two connections: visitor to Cloudflare, and Cloudflare to your hosting. Both should be encrypted. cPanel hosting already has a free certificate (AutoSSL), so you can use Cloudflare’s most secure mode.
In Cloudflare, go to SSL/TLS › Overview.
If it shows Automatic SSL/TLS, Cloudflare tests your hosting and picks the most secure mode that works. It should choose Full (strict).
If you can choose, select Custom SSL/TLS and then Full (strict).
Go to SSL/TLS › Edge Certificates and make sure Always Use HTTPS is off.
In cPanel, open cPanel Domains and turn on Force HTTPS Redirect for your domain.
| Mode | What it does | Our advice |
|---|---|---|
| Off | No HTTPS at all | Never |
| Flexible | Encrypts visitor to Cloudflare only; Cloudflare to your hosting is unencrypted | Don’t use — insecure, and the usual cause of “too many redirects” |
| Full | Encrypts both connections but doesn’t check your hosting’s certificate | Only as a stopgap while a certificate is fixed |
| Full (strict) | Encrypts both connections and checks your hosting’s certificate is valid | Use this |
Step 7: Test everything
- Open your site in a private browser window. The padlock shows and pages load properly.
http://, and addresses with and withoutwww, all end up at your normalhttps://address.- Email yourself from another account, then reply to it.
- Your phone and Outlook still connect to your mailbox.
- cPanel and webmail still open from your hosting account.
- If you turned DNSSEC off, switch it back on in Cloudflare under DNS › Settings and add the record it gives you where your domain is registered.
What changes once you’re on Cloudflare
- DNS lives in Cloudflare now. When a service asks you to add a record — Google Search Console verification, Microsoft 365, a mailing service — add it in Cloudflare under DNS › Records. Changes in cPanel’s Zone Editor no longer do anything.
- Clear the cache after changes. Updated your stylesheet or images and can’t see it? In Cloudflare go to Caching › Configuration and select Purge Everything, or turn on Development Mode while you work.
- Email Deliverability warnings. cPanel can’t update your DNS any more, so it may show warnings. If it suggests an SPF or DKIM record, copy the value into Cloudflare. See the email guide for what each record does.
Troubleshooting
| You see | What to do |
|---|---|
| “Too many redirects” | Your encryption mode is probably Flexible. Change it to Full (strict). |
| Error 526: Invalid SSL certificate | The certificate on your hosting has expired or hasn’t been issued yet. Open cPanel Security SSL/TLS Status and select Run AutoSSL. If it fails, check Always Use HTTPS is off in Cloudflare and try again. To bring the site back meanwhile, switch to Full, then back to Full (strict) once the certificate is fixed. |
| Error 521 or 522 | Cloudflare can’t reach your hosting. Check the records for your domain and www point to the same IP address as in your Zone Editor notes. |
| Email has stopped working | Check mail and the other mail records are DNS only, and your MX records are there. |
| Emails going to spam | Your SPF or DKIM records are missing. Copy them from Email Deliverability into Cloudflare as TXT records. |
| Your changes aren’t showing | Purge the cache in Cloudflare, then refresh your browser. |
Changing your mind
To stop using Cloudflare, first add any records you created in Cloudflare to cPanel’s Zone Editor, then change your nameservers back to your host’s. For OnPoint those are ns0.thundercloud.uk and ns1.thundercloud.uk. Once the change goes through, your hosting serves your site and email directly again.
Stuck at any step? Open a ticket with OnPoint support with your domain name and the step you’re on.