Laravel behind Cloudflare

Behind Cloudflare, your Laravel application receives requests from Cloudflare, not directly from visitors. Laravel needs to know this, so that it builds HTTPS links and reads the real visitor IP.

Before you begin

• The application works on your hosting. See Host a Laravel application.
• The domain is active in Cloudflare with the settings from Cloudflare settings for APNCloud hosting.
• Access to the application files. If you have no SSH access, read Laravel on shared hosting without SSH.

Steps

1. Open the .env file and set the public HTTPS address of your site:

   APP_ENV=production
   APP_URL=https://example.com

2. Trust the proxy. In Laravel 11 and newer, open bootstrap/app.php and add this inside withMiddleware:

   $middleware->trustProxies(at: '*');

   In Laravel 10 and older, open app/Http/Middleware/TrustProxies.php and set $proxies to '*'.

3. Force HTTPS links. Open app/Providers/AppServiceProvider.php and add this to the boot method:

   use Illuminate\Support\Facades\URL;
   
   if (app()->environment('production')) {
       URL::forceScheme('https');
   }

4. Read the visitor IP. After step 2, $request->ip() returns the visitor IP. You can also read the Cloudflare header directly:

   $ip = $request->header('CF-Connecting-IP', $request->ip());

5. Clear the cached configuration so that the changes are used. With SSH, run php artisan config:clear. Without SSH, delete the file bootstrap/cache/config.php in the File Manager. Laravel then builds the configuration again.

6. Do not cache the admin area. Add a Cache Rule in Cloudflare that bypasses the cache for /admin, as shown in Secure your site behind Cloudflare.

Trust only proxied traffic

'*' tells Laravel to trust the forwarded headers from every sender. This is safe only when all visitors come through Cloudflare. Anyone who reaches your server directly could send fake headers.

Common mistakes

• APP_URL still set to http:// or to a different domain name.
• Forgetting to clear the configuration cache after changing .env.
• Redirect loops because Cloudflare is set to Flexible mode. See Cloudflare redirect loop.
• Logging the Cloudflare address instead of the visitor in your application logs.

Need help?

Open a support ticket in the Client Area or contact [SUPPORT_CONTACT]. Tell us the Laravel version and the part of the code you changed.

Related articles

• Host a Laravel application
• Laravel on shared hosting without SSH
• Cloudflare settings for APNCloud hosting
• Cloudflare redirect loop

Last reviewed

2026-10-29