Put Cloudflare in front of your VPS
Free CDN, DDoS layer, and DNS — Cloudflare proxying makes your VPS faster and harder to attack.
Cloudflare's free tier is a no-brainer for any internet-facing VPS. It absorbs DDoS, caches static assets, and adds TLS without extra config. Setup takes 10 minutes.
1. Create a free Cloudflare account
Sign up at cloudflare.com. The free tier covers most of what a VPS needs.
2. Add your domain
In the dashboard: Add a Site → enter example.com. Cloudflare scans your existing DNS records.
3. Update nameservers
Cloudflare gives you 2 nameservers (e.g. lin.ns.cloudflare.com, ben.ns.cloudflare.com). Set these in your registrar's nameserver panel. Propagation takes 5-30 minutes.
4. Enable proxy on A/AAAA records
In Cloudflare's DNS panel, click the gray cloud next to your A and AAAA records to turn them orange. Orange = proxied through Cloudflare. Now your VPS IP is hidden from public DNS, and Cloudflare absorbs DDoS at the edge.
5. SSL/TLS mode
Cloudflare → SSL/TLS → set mode to 'Full (strict)'. This requires your VPS to serve a valid TLS certificate (use Let's Encrypt — see /kb/lets-encrypt-ssl). Anything less than 'Full (strict)' is downgrade-attack-vulnerable.
Tighten your VPS firewall
After Cloudflare is in front, only Cloudflare IPs should reach your origin. Restrict ports 80/443 in ufw to Cloudflare IP ranges (https://www.cloudflare.com/ips/). This stops attackers from finding and bypassing Cloudflare.
Related articles
Deploy your first offshore server in 60 seconds.
Anonymous signup. Bitcoin & Monero accepted. Provisioned across 8 jurisdictions.
No credit card required · 7-day money-back guarantee