Two settings cause most of the errors people blame on Cloudflare.
Cloudflare is several products sharing a dashboard. For a developer running their own servers, three of them matter: DNS with the proxy in front, Workers for code at the edge, and Tunnel for reaching a host with no open ports.
Reach for the proxy when you want a public origin protected — caching, TLS termination, WAF rules and an origin IP that is not in public DNS. Reach for Workers when there is no origin server worth running. Reach for Tunnel when the origin must exist but should not be reachable from the internet at all.
Almost every “Cloudflare is broken” report traces to two settings. The proxy status on the DNS record decides whether traffic goes through Cloudflare or straight to your IP. The zone’s SSL/TLS encryption mode decides how Cloudflare talks to your origin. Flexible mode plus an HTTPS redirect on the server is an infinite loop, and it is the single most common misconfiguration.
The second cluster of problems is the 5xx error codes. They are specific and worth learning: 521 means the connection was refused, 522 means it timed out — which is nearly always a firewall — 525 means the TLS handshake failed, and 526 means the origin certificate did not validate under Full (strict).
The third is forwarded headers. Once traffic arrives through a proxy, your application sees the proxy unless you tell it which addresses to trust. Getting that wrong produces access logs full of Cloudflare IPs and applications that think every request is plain HTTP.
Start here
Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.
A reading order that builds Cloudflare knowledge in the sequence it is actually needed.
Failure modes that come up repeatedly with Cloudflare, and where each one is solved.
Give every tenant its own subdomain with automatic DNS and SSL — and the 526 → 404 → 403 debugging trail behind it, including an SSR fetch that quietly hairpins out through your CDN.
Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.
Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy.
Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy.
It routes the hostname through Cloudflare's network rather than answering with your server's address. You get caching, the WAF and a hidden origin IP, and you lose the ability to use non-HTTP protocols on that hostname.
Full (strict), with either a publicly trusted certificate or a Cloudflare Origin CA certificate on the origin. Flexible causes redirect loops and Full without strict accepts any certificate, including expired ones.
Not strictly, but the tunnel is a stronger position. An IP allowlist still requires an open inbound port and a correct firewall; a tunnel needs neither, because all connections are outbound from your host.