# Put your site behind Cloudflare
Source: https://docs.webgee.com/en/domains-dns/how-do-i-enable-cloudflare-for-my-websites



Route your site through Cloudflare for caching, DDoS protection and a global
CDN. Applies to any domain, on any WebGee plan.

Cloudflare works by becoming your domain's DNS provider, so traffic reaches
Cloudflare first and Cloudflare fetches from WebGee.

## Add your domain [#add-your-domain]

1. Create an account at [cloudflare.com](https://www.cloudflare.com) and verify
   your email address.
2. Select **Add a Site** and enter your domain.
3. Cloudflare scans your existing DNS records. **Check this list carefully
   before continuing** — anything it misses stops working when you switch.

<Callout type="warn">
  Pay particular attention to **MX records**. If your email is hosted with
  WebGee and the MX records do not carry across, mail stops being delivered the
  moment the nameservers change. Compare the imported list against
  **cPanel → Zone Editor** before you proceed.
</Callout>

## Change your nameservers [#change-your-nameservers]

1. Note the two nameservers Cloudflare gives you.
2. Sign in wherever your domain is registered.
3. Replace the existing nameservers with Cloudflare's.

If the domain is registered with WebGee, see
[Update your domain's nameservers](/en/domains-dns).

Propagation typically takes a few hours, though it can take up to 24.

## Set the SSL mode correctly [#set-the-ssl-mode-correctly]

This is the step that causes the most problems, and Cloudflare's default is not
the right answer.

1. In Cloudflare, go to **SSL/TLS**.
2. Set the encryption mode to &#x2A;*Full (strict)**.

<Callout type="warn">
  Do not use **Flexible**. It makes Cloudflare fetch your site over plain HTTP
  while telling visitors the connection is secure. If you have also forced HTTPS
  on the server, the result is an infinite redirect loop — see
  [Force HTTPS on your site](/en/security-ssl/force-https).
</Callout>

**Full (strict)** requires a valid certificate on the WebGee side, which AutoSSL
gives you: [Install a free SSL certificate](/en/security-ssl/free-ssl-certificate).

## Check it worked [#check-it-worked]

```bash
dig +short NS example.com
```

The response should list Cloudflare's nameservers. Then confirm traffic is
actually passing through:

```bash
curl -sI https://example.com | grep -i "server\|cf-ray"
```

A `cf-ray` header means the request went through Cloudflare.

## Things that change once you are behind Cloudflare [#things-that-change-once-you-are-behind-cloudflare]

* **Visitor IPs in your logs become Cloudflare's**, unless you restore the
  original — Cloudflare sends it in the `CF-Connecting-IP` header.
* **AutoSSL validation can fail** while a record is proxied, because Cloudflare
  intercepts the validation request. Set the record to **DNS only** (grey cloud)
  temporarily if a certificate will not issue.
* **Mail records must stay unproxied.** Cloudflare cannot proxy SMTP, so `MX`
  records and the `mail.` hostname must be set to **DNS only** (grey cloud).
  Proxying them stops mail delivery. See
  [Spam and virus filtering](/en/email/spam-and-virus-filtering).

## Related [#related]

* [Check what nameservers your domain is using](/en/domains-dns/how-do-i-check-what-nameservers-my-domain-is-using)
* [Force HTTPS on your site](/en/security-ssl/force-https)
* [Invite WebGee support to your Cloudflare account](/en/account-billing/how-to-invite-webgee-support-to-your-cloudflare-account)