1. Prepare a Cloudflare API token with the permissions required by the integration and the intended account scope. Store it through the protected Cloudflare API token field.
2. Open Global CDN and use Connect Cloudflare. Verify the account selected for managed zones.
3. Choose a test domain whose DNS and registrar access you control. Export or record the existing DNS zone and nameservers.
4. Review website, mail, verification, subdomain and other records before activating CDN.
5. Activate the integration and inspect the created zone and proposed nameservers. Verify each required DNS record rather than assuming every existing arrangement copied correctly.

For a domain registered through WHMCS with a suitable registrar integration, the module can request the nameserver change. For an externally registered domain, the customer must make the change at their registrar. Waiting for nameservers means delegation still needs to become correct and detectable.

Review DNSSEC before changing authoritative DNS. A stale DS record at the registrar can make a newly delegated zone fail validation. Coordinate the transition with the actual DNSSEC configuration and verify resolution afterward.

The integration proxies the website's apex and www records while leaving other copied records DNS-only. Verify mail and non-web services independently. The module does not automatically take over zones created outside this integration.

The supplied implementation configures Cloudflare's Full SSL mode. Full encrypts an HTTPS origin connection without the certificate validation provided by Full (strict). Keep a valid origin certificate and assess any stricter configuration through Cloudflare's supported controls. Do not advertise strict origin validation merely because the CDN is active.

Clear the CDN copy refreshes cached content, while Development mode helps during changes that should bypass normal caching behaviour. Test the actual page and cache response when a customer reports stale content.

The supplied Hosting Suite setup requests the following permissions. Cloudflare may label a write permission Edit or Write in its current interface.

Restrict the token to the intended account. The installed setup recommends access to all zones of that account so it can create new managed zones. A token restricted only to one existing zone cannot cover that onboarding workflow. After connecting, check the account name and test a controlled new zone: the initial connection reads account and zone lists, so it does not establish every write permission.

Turning CDN off may require restoring nameservers. Automatically managed registered domains and external domains need different handling, so verify the final delegation instead of assuming it changed. Disconnecting the global Cloudflare integration does not itself remove every working zone; it can leave sites active while removing module management access. Record the zone and DNS state before making that change.

Record the previous and new nameservers, the approved DNS records and the time activation began. Include externally hosted email and verification records in the acceptance checklist. Test authoritative answers and ordinary recursive resolution, because cached answers can temporarily show the old route.

If a website fails after activation, identify whether the failure is DNS delegation, origin connectivity, TLS or application behaviour before reversing several settings at once. A cached page loading successfully does not prove the origin is healthy, and an origin working directly does not prove public delegation is correct. Use the recorded pre-change configuration when a controlled reversal is needed, then verify both website and mail operation again.

• Configure and interpret Hosting Suite site-health monitoring
• Verify and link existing hosting accounts
• Configure Hosting Suite access rules and verify effective permissions
• Collect useful Hosting Suite diagnostics without exposing credentials

• Cloudflare SSL/TLS encryption modes

• Cloudflare: API token permissions