WordPress behind Cloudflare

A WordPress site works well behind Cloudflare when its address uses HTTPS, when plugins see the real visitor IP, and when only one tool caches each page. Follow these steps after your site works through Cloudflare.

Before you begin

• The WordPress site works on your hosting. See Install or move a WordPress website.
• The domain is active in Cloudflare with the settings from Cloudflare settings for APNCloud hosting.
• A backup of your site and database. Use Website backups.

Steps

1. In WordPress open Settings, then General. Make sure WordPress Address (URL) and Site Address (URL) both start with https://. Use the same name that visitors use, with or without www.

2. Redirect to HTTPS in one place only. Use the Cloudflare setting Always Use HTTPS, or one WordPress plugin, not both.

3. If the browser shows mixed content warnings, change the old http:// addresses in your content to https://. See Mixed content warnings.

4. Show the real visitor IP. Behind Cloudflare, WordPress sees a Cloudflare address instead of the visitor. Add this code to wp-config.php, above the line that says to stop editing:

   if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
       $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
   }

5. If you use a security plugin, open its settings and choose the option that reads the visitor IP from the CF-Connecting-IP header. The name of the option is different in each plugin. Without this, the plugin may block a Cloudflare address instead of the attacker.

6. Use one page cache. If a cache plugin is active, keep its settings and do not turn on "Cache Everything" in Cloudflare for dynamic pages. Exclude /wp-admin, /wp-login.php and shop pages such as cart and checkout from every cache.

7. After you change cache settings, clear the plugin cache and use Purge Cache in Cloudflare.

8. Install only the security plugins you need, and keep WordPress, themes and plugins updated. If your site does not use xmlrpc.php, rate limit it as shown in Secure your site behind Cloudflare.

Use the visitor IP code only with the proxy on

Anyone who reaches your server directly can send a fake CF-Connecting-IP header. Use the code in step 4 only for sites that are proxied by Cloudflare (orange cloud).

Common mistakes

• One address with http:// and the other with https:// in Settings, then General. This causes redirect loops.
• Two plugins that both redirect to HTTPS.
• Caching /wp-admin or the login page.
• A security plugin that shows only Cloudflare addresses in its logs.

Need help?

Open a support ticket in the Client Area or contact [SUPPORT_CONTACT]. Tell us the plugin names and the exact error message.

Related articles

• Install or move a WordPress website
• Cloudflare settings for APNCloud hosting
• Secure your site behind Cloudflare
• Mixed content warnings

Last reviewed

2026-10-29