Using Cloudflare with your Magento 1 online store

---

Overview

The following steps will help you to activate Cloudflare for your Magento store:

1. Login to your Cloudflare account. If you don’t yet have a Cloudflare account, you can sign up here.

2. Add your domain and follow the steps for full configuration by using your domain registrar interface and pointing your Name Servers to the Cloudflare Name Servers provided.

We suggest you read the following article that explains the Cloudflare setup process in detail: https://support.cloudflare.com/hc/en-us/articles/201720164-How-do-I-sign-up-for-Cloudflare-

Once the required DNS changes are implemented by your domain registrar, you can start with Cloudflare configuration for your Magento store by performing these steps.

3. Allow Cloudflare IPs.

4. Restore visitor IPs.

5. Turn on Magento WAF managed rules (requires a paid subscription).

• On the dashboard, select Security > WAF > Managed rules.
• Make sure that WAF managed rules are enabled.
• Under “Package: Cloudflare Rule Set” select “Rule Details”. Here you can toggle the “Cloudflare Magento” Ruleset on.

6. Page Rules

HTTPS Redirects

Add a page rule for http://*<domain>/* with the setting “Always use HTTPS” where is your site’s domain name.

Admin Page Rule

Create a Page Rule for your administrative section e.g. *domain.com/admin* (Replace with your admin area URL) and disable the following features:

• Caching
• Performance
• Rocket Loader
• Mirage Also set ‘Security’ to ‘High’

Follow the following article to get this step configured correctly:

Problem logging into Magento Admin area

Save bandwidth by caching anonymous page views with Bypass Cache by Cookie

See Caching Static HTML with Magento for enabling this.

Cache and protect your Magento chron jobs

Add a page rule for /pub/chron.php* and disable the following features:

• Caching
• Performance
• Rocket Loader
• Mirage Also set ‘Security’ to ‘High’

Social Media Redirects

Add a Forwarding URL of status 302 from a URL under your domain to your social media page.

You can read more about page rules in our tutorial article.

For all eCommerce sites that have SSL directly on their server, we highly recommend that you enable “Full SSL” or “Full SSL Strict” within the Overview tab of the Cloudflare SSL/TLS app. Full SSL means your origin has to support an SSL connection, and it ensures that the traffic between Cloudflare and the Origin is also encrypted. Use a paid Cloudflare plan in order to get the most compatible SSL option for your site visitors.

Useful links:

• What do the SSL options (Off, Flexible SSL, Full SSL, Full SSL Strict) mean?
• Getting Started with Cloudflare: Recommended First Steps for all Cloudflare users
• How do I exclude a specific URL from Cloudflare Page Rules