XenForo Cloudflare Setup: What to Turn On and Leave Off
A plain checklist for putting Cloudflare in front of XenForo 2.2 or 2.3: real visitor IPs, safe caching, and what to do when changes don't show.
On this page
A xenforo cloudflare setup works when you do three things: pass the real visitor IP to your server, keep logged-in pages out of the cache, and test every change. This checklist covers each step and links to our guides for the details.
Cloudflare is a service that sits between your visitors and your server. It can take some load off your forum and filter junk traffic. It can also hide your visitors' IP addresses and show stale pages if you set it up carelessly.
The short answer: the Cloudflare settings that are safe for XenForo
- Point your DNS at Cloudflare and keep HTTPS working from visitor to server.
- Make your web server read the real visitor IP from Cloudflare.
- Cache static files only. Keep logged-in pages out of the cache.
- Leave script-changing features off until you have tested them.
- Check logins, IPs and fresh posts after every change.
Change one thing at a time. If something breaks, you will know which change did it.
Point your DNS at Cloudflare and keep SSL working
Add your site to Cloudflare and let it import your DNS records. Then switch your domain's nameservers to the ones Cloudflare gives you. The record for your forum is set to proxied, shown as an orange cloud. That is what puts Cloudflare in front of XenForo.
Before you switch, make sure your forum already works over HTTPS, and that your XenForo board URL uses https. A mismatch between Cloudflare's SSL mode and what your server really serves is a common cause of redirect loops. If you see one, check that the two agree.
Mail records such as SPF and DKIM are plain DNS records. Don't put mail hostnames behind the proxy. Our XenForo email setup guide covers those records.
Make XenForo see real visitor IP addresses
Once Cloudflare proxies your forum, your server sees Cloudflare's addresses instead of your members' addresses. That affects IP logs, IP bans, spam checks and the tools moderators use to compare accounts. Getting a xenforo real visitor ip is the most important step in this checklist.
Cloudflare passes the visitor address in a header called CF-Connecting-IP. Your server should trust that header only when the request comes from Cloudflare. Cloudflare publishes its address ranges at cloudflare.com/ips.
Apache with mod_remoteip
Cloudflare's support article on restoring original visitor IPs describes this route. You create /etc/apache2/conf-available/remoteip.conf. It holds the header line plus one trusted-proxy line for each Cloudflare range:
RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy <Cloudflare range>Repeat the second line for every range on the Cloudflare list, then enable the config. The same article covers Apache servers without mod_remoteip, and other setups such as EasyApache and cPanel. Follow it for your server type rather than relying on a summary here.
Other servers and XenForo's own settings
I could not confirm XenForo's own trusted-proxy options for 2.2 and 2.3, so I won't give you a config.php line to paste. Check XenForo's documentation for your version, or ask your host to set this at the server level.
Cache static files, not logged-in pages
Cloudflare's cache keeps copies of files and serves them without bothering your server. For a forum, the safe aim is to cache static files such as images, style files and scripts. Check Cloudflare's docs for what it caches by default on your plan.
The risk comes from a rule that caches everything. A forum page looks different for each member. If Cloudflare caches a logged-in page, the next visitor could see an old version, or someone else's view.
If you want to use cloudflare xenforo cache rules for guest pages, keep them narrow:
- Apply them to guest traffic only.
- Bypass the cache for the admin area and for any request that carries a login cookie.
- Keep cache times short for anything that changes often.
I could not confirm the exact XenForo cookie names to match. Look at them in your browser's developer tools on your own forum before you write a rule.
When changes are not showing
The classic trap: you edit a style or upload a file and nothing changes. The cause is often a cached copy in your browser, in Cloudflare or in a page cache. Our related guide, Changes not showing? Browser cache, Cloudflare and page caching, is the place to start before you purge everything.
Settings that cause trouble: Rocket Loader, aggressive minify and Always Online
Some Cloudflare speed features change how pages and scripts load. I found no source that confirms how each one behaves with XenForo, so treat them with care.
Rocket Loader
Rocket Loader is Cloudflare's feature for delaying JavaScript so a page can show sooner. A forum leans on JavaScript for posting, quoting and editing. If you want to try it, turn it on, then test posting, editing, quoting and login in a private window. If anything misbehaves, turn it off.
Minify and Always Online
Minifying shrinks files by removing spaces and comments. I couldn't verify whether Cloudflare's Auto Minify is still available, so look at your dashboard. If you see it, leave it off until you have tested it.
Always Online serves a saved copy of your site when your server is down. A forum is mostly changing, logged-in content, so I can't recommend it. If you're unsure, leave it off.
Use Cloudflare to cut bot traffic
Cloudflare can challenge or block bad traffic before it reaches your server. Be gentle with rules at first. A rule that is too strict can lock out real members and search engines. Try a challenge before a hard block, and watch what gets caught.
For AI crawlers, you can also set policy inside XenForo. Our free AI Crawler Blocklist add-on needs XenForo 2.2 or later. It starts in Monitor mode, so nothing is blocked until you have reviewed the traffic. It protects Google and Bing through their crawler feeds and cached forward-confirmed reverse DNS. It does not replace Cloudflare. It gives you a log of what would be blocked and why. The guide Choose a crawler policy in AI Crawler Blocklist helps you pick a starting policy.
Count real thread views behind Cloudflare
XenForo's built-in thread counter counts page loads. It can't tell a person from a bot. Behind Cloudflare, that makes it a rough guide at best.
Real Views adds a separate qualified-view counter and leaves XenForo's original counts alone. By default, a visit counts after the thread has been visible for five seconds, once per member or browser per thread in a rolling 24 hours. Both settings are adjustable. It also offers an optional guided Cloudflare setup. It needs XenForo 2.3 or later and costs $39.00, which includes 12 months of updates and support. The install steps are in How to install Real Views for XenForo.
Check that it works
After each change, run through this list:
- Post a test reply from a normal member account.
- Open the IP view for that post. It should show your own address, not a Cloudflare one.
- Log in and out in a private window.
- Edit a style or upload a file, then check that the change appears.
- Check that your confirmation emails still send.
If the IP shows a Cloudflare address, the trusted-proxy step is not working. Recheck the ranges, since Cloudflare can update them.
What to do next
Set up the real visitor IP first. Then cache static files only, and test one speed feature at a time. For more how-to guides, browse our Tutorials.
