Guides
Plain-language guides to the Cloudflare settings people actually search for: the orange cloud, proxy status, SSL/TLS encryption modes, and caching.
What Does the Orange Cloud Mean in Cloudflare?
Proxied vs DNS only, in plain terms: what the orange and grey cloud each change, which record types and ports qualify, and how to read the errors the toggle causes.
8 min read
Cloudflare Orange-to-Orange (O2O), Explained
Two Cloudflare zones, one request: how O2O routing works with Cloudflare for SaaS, which zone each setting applies in, and what breaks.
7 min read
Which Cloudflare SSL/TLS Encryption Mode Should You Use?
Off, Flexible, Full, Full (strict): what each does to the second hop, which error each one produces, and why Cloudflare may now pick for you.
8 min read
What Does cf-cache-status DYNAMIC, BYPASS, or MISS Mean?
One header names the decision Cloudflare made. DYNAMIC, BYPASS and a MISS that never becomes a HIT are three different failures with three different fixes.
8 min read
Why Isn’t My Cloudflare DNS Change Working Yet?
Nothing propagates — caches expire. Which of the four layers is holding your old answer, and why lowering the TTL cannot fix a cached NXDOMAIN.
8 min read
Why Isn’t My Cloudflare Cache Purge Working?
Instant Purge really is instant, so a stale file means the purge matched nothing — or the copy you are looking at was never Cloudflare’s to delete.
7 min read
What Is CNAME Flattening in Cloudflare?
Why a root domain cannot hold a real CNAME, what Cloudflare returns instead, and the three setups flattening quietly breaks.
8 min read
Why Am I Seeing Cloudflare Error 1000: DNS Points to Prohibited IP?
The proxy refuses to forward a request to itself. Which records, reverse proxies, and request headers trigger it — and how 1000 differs from 1002, 1003, and 1014.
8 min read
Why Am I Getting Cloudflare Error 522: Connection Timed Out?
Two deadlines produce the same error code, and a 522 is silence rather than refusal — which is what separates it from 521, 523 and 524.
8 min read
Why Do My Server Logs Show Cloudflare’s IP, Not the Visitor’s?
Every entry is a Cloudflare address, so the rate limiter, the ban list and the geo rules all quietly stopped meaning anything — and a firewall that reacts on its own can take the site down.
9 min read
Why Am I Getting Cloudflare Error 521: Web Server Is Down?
A refusal, not a timeout — which is why it appears instantly. The four causes, and the one that starts the moment you change an encryption mode.
7 min read
Why Am I Getting Cloudflare Error 526: Invalid SSL Certificate?
Two conditions have to hold at once — which is why 526 differs from 525, and why a site nobody touched starts failing the day an origin certificate quietly expires.
8 min read
Why Am I Getting Cloudflare Error 524: A Timeout Occurred?
The connection succeeded — that is what makes 524 different from every other 52x code. The two clocks behind it, and what to do when your plan cannot raise either one.
8 min read
Why Am I Seeing Cloudflare Error 1020: Access Denied?
Someone wrote a rule and you matched it. Which Cloudflare feature emits 1020 rather than 1015 or 1106, and the one log that names the rule that did it.
8 min read
Can Someone Still Find My Origin IP Behind Cloudflare?
The orange cloud hides an address; it does not defend one. The five ways an origin IP gets out, and why only a rule at the origin itself actually closes the door.
9 min read
Why Am I Getting Cloudflare Error 525: SSL Handshake Failed?
The connection got as far as TLS and died there. Four things have to hold for the handshake to finish — and unlike a 526, relaxing the encryption mode fixes none of them.
8 min read
What Do Cloudflare’s Error Codes Mean?
The range tells you who has to fix it. Why a 1xxx number never reaches your monitoring, which four codes could come from either side, and how one Ray ID becomes one log line.
8 min read
How Do You Block AI Crawlers on Cloudflare?
Stating a preference, enforcing it, and wasting a crawler's time are three different tools. Which one actually stops a crawler, and what changes on September 15.
9 min read