Where each part does its work.
THE PATH OF A REQUEST
Visitor asks DNS where your site is Cloudflare answers with its own address, if the record is proxied Visitor connects to Cloudflare Cloudflare serves a cached copy, or asks us for the page We generate the page and send it to Cloudflare Cloudflare sends it to the visitor
WHAT THIS MEANS
Visitors never connect to us directly when a record is proxied. Our server sees Cloudflare's addresses, not theirs.
That has consequences: visitor IP addresses in your logs, firewall rules, and anything depending on the visitor's address.
WHAT WE STILL DO
Generate every page that is not cached Serve mail, which must never be proxied Hold your files and database Provide the origin certificate Cloudflare connects to
WHAT YOU CONFIGURE WHERE
- DNS records: at Cloudflare, once its nameservers are in use
- Caching rules: at Cloudflare
- Certificates: both, and they must be compatible
- Application settings: on your hosting as usual
THE COMMON CONFUSION
Changing DNS in cPanel after moving to Cloudflare's nameservers. Those records are no longer consulted.
