Cloudflare for websites and self-hosted apps: what to set up

We use Cloudflare for DNS, proxying and tunnels. We host nothing on Cloudflare’s own infrastructure, so the sites and apps we build run on Railway or a managed server instead.

Cloudflare runs a global network that sits in front of websites and apps. It hosts DNS, proxies traffic to filter attacks and cache content, and through Cloudflare Tunnel it can publish a private server without opening inbound ports.

Start with ownership: whose Cloudflare account holds the domain, and who has admin access. Then look at which records are proxied and why, and which SSL mode sits between Cloudflare and your server. Confirm how the app gets the visitor’s real IP address for rate limits and logs, and that the CF-Connecting-IP header is trusted only on requests that came through Cloudflare. Last, check that bot settings don’t block search engine or AI assistant crawlers you want to allow.

Each DNS record is either proxied through Cloudflare or DNS-only, which just points to your server.

• Proxy when you want attack filtering, caching and your server’s address hidden.
• Keep DNS-only when the host advises against a proxy in front. Vercel is one example, so its records usually stay DNS-only.
• Mind the timeout. Proxied requests on standard plans time out after about 100 seconds, so an endpoint that runs longer needs the queue pattern instead.
• Check your rules. If your compliance rules limit which third parties see traffic, remember that proxied requests pass through Cloudflare.

• Localhost trust behind a tunnel. Rules like “requests from localhost are admin” become open doors when the tunnel delivers public traffic from localhost. Remove those shortcuts before opening a tunnel.
• Flexible SSL. This mode encrypts the visitor’s connection but not the leg to your server. Use Full (strict) with a valid origin certificate.
• Records edited in the wrong panel. Once nameservers move to Cloudflare, DNS edits at the old registrar do nothing.

A tunnel connects a server behind a home or office connection, or a private network, to a public address without opening firewall ports. It suits internal tools and self-hosted software that shouldn’t sit on an open port.