Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To run Drupal 11 reliably on Ubuntu, install it with Composer, serve its web directory through Nginx and PHP-FPM, place the site behind a correctly configured Cloudflare proxy, and explicitly define trusted hosts and trusted proxy addresses. Use HTTPS from the browser to Cloudflare and from Cloudflare to the origin; in Cloudflare, choose Full (strict) once the origin certificate is valid and matches the hostname.
The sequence below covers a maintainable Drupal codebase, a least-privilege database, Nginx routing, Drupal’s installer, real visitor-IP handling, and checks for the failures that most often affect proxied installations.
As an Amazon Associate I earn from qualifying purchases.
What does a Drupal 11, Nginx and Cloudflare deployment require?
Drupal 11’s current requirements set the minimum versions you should verify before changing configuration. The 2026 branch documentation lists Nginx 1.1 or newer, PHP 8.3 or newer, Composer 2.9.3, and one supported database engine.
| Component | Required floor | Practical note |
|---|---|---|
| Nginx | 1.1 or newer | Ubuntu’s supported package is normally newer; confirm with nginx -v. |
| PHP | 8.3 or newer | Use the same major/minor version for the CLI and PHP-FPM where possible. |
| Composer | 2.9.3 | Verify the executable used by the deployment account, not only a system-wide binary. |
| MySQL | 8.0 or newer | A common production choice when the team already operates MySQL. |
| MariaDB | 10.6 or newer | Use the matching PHP database extension. |
| PostgreSQL | 16 or newer | Suitable when PostgreSQL is your established operational standard. |
| SQLite | 3.45 or newer | Useful for small or temporary sites, but usually not the first choice for a busy production service. |
Keep the Composer project outside the public web root and point Nginx at its web directory. That arrangement prevents project metadata, vendor files and configuration outside web from being directly requested. A dedicated database and a deployment account that can update code without making the entire tree writable are safer than copying a release into a web-writable directory.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Which architecture should you choose?
The choices below affect maintenance, rollback and exposure more than Drupal’s installer does.
| Decision | Recommended choice | Why | Trade-off |
|---|---|---|---|
| Drupal files | Composer-managed project | Dependencies are recorded, updates are repeatable and releases can be rolled back. | Requires Composer and a release process. |
| Document root | /var/www/drupal/web |
Only public assets and the front controller are exposed. | Nginx must be configured with the extra directory level. |
| Database | Dedicated MySQL or MariaDB database and user | Permissions can be limited to the Drupal schema. | Another credential and backup target to manage. |
| Cloudflare DNS | Proxied record for public hostnames | Hides the origin address and adds edge filtering. | The origin must trust only the proxy chain and allow Cloudflare traffic. |
| Cloudflare encryption | Full (strict) | Encrypts both connections and validates the origin certificate. | Requires a current, hostname-matching certificate on port 443. |
How do you prepare the Ubuntu host and DNS?
Start with a hostname you control and an Ubuntu server whose security updates are current. Create DNS records that point to the server, but leave Cloudflare proxying disabled until the origin answers correctly; this separates an origin problem from an edge configuration problem.
Install the operating-system packages
On a supported Ubuntu release, install Nginx, PHP-FPM, the PHP command-line tools and extensions Drupal commonly needs, a database server, and utilities used by Composer and certificate management:
sudo apt update
sudo apt full-upgrade
sudo apt install nginx mariadb-server curl unzip git
php8.3-cli php8.3-fpm php8.3-mysql php8.3-xml php8.3-gd
php8.3-curl php8.3-mbstring php8.3-intl php8.3-zip php8.3-opcache
certbot python3-certbot-nginx
Package names depend on the Ubuntu release. If that release does not provide PHP 8.3, use a supported package source or a newer Ubuntu release rather than silently deploying an older PHP version. Confirm the versions and services before continuing:
php -v
php-fpm8.3 -v
nginx -v
composer --version
sudo systemctl enable --now nginx php8.3-fpm mariadb
The PHP-FPM service name and socket can differ. List the available sockets now; you will use the exact path in the Nginx server block:
ls -l /run/php/
Set the basic firewall policy
Keep SSH available to your administration network and open HTTP and HTTPS. If you later restrict the origin to Cloudflare address ranges, retain an appropriate path for certificate renewal and emergency administration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
How do you create a Composer-managed Drupal project?
Install Composer 2.9.3 or newer for the account that will perform deployments, then create Drupal from the recommended project template. The command below creates a project whose public files are under web:
sudo mkdir -p /var/www
sudo chown "$USER":"$USER" /var/www
composer create-project drupal/recommended-project:^11 /var/www/drupal
cd /var/www/drupal
composer check-platform-reqs
Do not make the complete project writable by Nginx. Let the deployment account own the code and grant the web user write access only to Drupal’s files directories. Create the directories used for public and private uploads, then apply conservative permissions:
sudo mkdir -p /var/www/drupal/web/sites/default/files
sudo mkdir -p /var/www/drupal/private
sudo chown -R "$USER":www-data /var/www/drupal
sudo find /var/www/drupal -type d -exec chmod 755 {} ;
sudo find /var/www/drupal -type f -exec chmod 644 {} ;
sudo chown -R www-data:www-data /var/www/drupal/web/sites/default/files /var/www/drupal/private
sudo chmod -R 770 /var/www/drupal/web/sites/default/files /var/www/drupal/private
For a release workflow, build dependencies in a separate release directory, make the new release readable by the web user, and switch the Nginx root only after checks pass. Never grant write permission to vendor, composer.json or the whole document root merely to get the installer past a permission warning.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do you create a least-privilege Drupal database?
Use one database and one application user for this site. The following example generates a random password locally, creates a MariaDB database, and grants that user access only to the Drupal schema. Save the printed credentials in a password manager; do not place them in shell history or source control.
DB_NAME=drupal
DB_USER=drupal_app
DB_PASS=$(openssl rand -base64 32)
sudo mysql <<SQL
CREATE DATABASE `$DB_NAME` CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';
GRANT ALL PRIVILEGES ON `$DB_NAME`.* TO '$DB_USER'@'localhost';
FLUSH PRIVILEGES;
SQL
printf 'Database: %snUser: %snPassword: %sn' "$DB_NAME" "$DB_USER" "$DB_PASS"
If you choose PostgreSQL, SQLite or a remote database, select that driver in the installer and apply the equivalent principle: a dedicated schema or file, a dedicated credential, encrypted transport where the database is remote, and backups tested independently of the web server. Record the database host and port because the installer needs them even when they are not localhost.
What Nginx configuration does Drupal need?
Nginx must serve static files directly, send clean URLs to Drupal’s front controller, block sensitive files, and pass only real PHP scripts to PHP-FPM. Create a site file such as /etc/nginx/sites-available/drupal:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/drupal/web;
index index.php;
location / {
try_files $uri /index.php?$query_string;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTP_PROXY "";
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
location ~* .(?:bak|conf|dist|fla|inc|ini|install|log|make|module|profile|psd|sh|sql|sql.gz|swp|theme|tpl|twig|yml|yaml)$ {
deny all;
}
location ~ (^|/)(?:.git|.env|composer.(?:json|lock)|web.config|settings.php) {
deny all;
}
location ~ /.ht {
deny all;
}
}
Replace the example hostnames with every public name you will actually use and replace the socket with the path shown under /run/php. The try_files $uri =404 check prevents Nginx from sending a request for a nonexistent PHP file to the interpreter. Keep /.well-known reachable if your certificate process uses HTTP validation.
Enable the site, disable the default site if it would answer the same address, test syntax, and reload:
sudo ln -s /etc/nginx/sites-available/drupal /etc/nginx/sites-enabled/drupal
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx
Before involving Cloudflare, request the HTTP URL directly or inspect the origin with a hosts-file override. You should receive Drupal’s installer rather than an Nginx 404, a PHP download, or a 502 response. A 502 almost always means PHP-FPM is stopped or the configured socket does not exist.
How do you run Drupal’s web installer?
Open the origin hostname in a browser and follow the installer. Select the database driver that matches the server, then enter the database name, user, password, host and port created earlier. Choose a site name, an administrator account with a unique password, the site email address and the desired regional settings.
- Choose the installation profile offered by your Drupal project.
- Enter the database credentials and expand the advanced fields if the database is remote or uses a non-default port.
- Let Drupal create the schema and wait for the completion page; do not refresh while database tables are being created.
- Sign in with the administrator account and open the Status report to address missing extensions, writable-directory warnings or pending security tasks.
During installation, Drupal may need temporary write access to web/sites/default in order to create settings.php. After the installer finishes, remove unnecessary write access from that directory while leaving the files directories writable by the web user.
sudo chmod 755 /var/www/drupal/web/sites/default
sudo chmod 644 /var/www/drupal/web/sites/default/settings.php
If Drupal reports that a directory is not writable, fix ownership on that specific directory rather than changing the permissions of the entire project.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How do you configure Drupal trusted hosts?
Trusted hosts protect against Host-header spoofing. Drupal returns HTTP 400 when the request host does not match one of the configured patterns, so include every legitimate public hostname and no wildcard that could accept an attacker-controlled name.
Edit /var/www/drupal/web/sites/default/settings.php and add patterns near the other security settings:
$settings['trusted_host_patterns'] = [
'^example\.com$',
'^www\.example\.com$',
];
The dots are escaped because these are regular expressions, and the dollar signs anchor the complete hostname. If you use an administration hostname, a temporary migration hostname or a separate regional name, add each one deliberately and remove names that are no longer routed to the site. Test both accepted hosts and an unlisted host; the latter should receive Drupal’s invalid-host response rather than the site.
How do you tell Drupal and Nginx that Cloudflare is a trusted reverse proxy?
Cloudflare creates two connections: the visitor-to-Cloudflare connection and the Cloudflare-to-origin connection. Drupal must know that the second connection is a proxy hop, but it must not trust arbitrary clients to send forwarding headers.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →In settings.php, enable reverse-proxy handling and list every proxy network that can reach this origin. Obtain Cloudflare’s current IPv4 and IPv6 CIDR ranges from its published network information, and include any private load balancer or ingress proxy that sits between Cloudflare and Nginx. Do not copy a stale list or trust the entire internet.
$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [
// Add every current Cloudflare CIDR and each internal proxy CIDR here.
];
$settings['reverse_proxy_trusted_headers'] =
SymfonyComponentHttpFoundationRequest::HEADER_X_FORWARDED_FOR |
SymfonyComponentHttpFoundationRequest::HEADER_X_FORWARDED_HOST |
SymfonyComponentHttpFoundationRequest::HEADER_X_FORWARDED_PROTO;
Populate the array with real CIDRs before enabling this in production. The trusted-header mask must match the headers your proxy chain actually sets; accepting headers that are not controlled by a known proxy lets a client forge its scheme, host or address. If your chain uses a different header arrangement, configure that arrangement explicitly instead of enabling every forwarded-header flag.
At the Nginx layer, preserve the original address for logs and rate controls only when requests come from those same trusted proxy ranges. Cloudflare supplies the visitor address in CF-Connecting-IP and also uses X-Forwarded-For. Configure Nginx’s real-IP module with the exact trusted ranges and the header you have chosen; otherwise logs and Drupal flood protection will record Cloudflare edge addresses rather than visitors. Never accept CF-Connecting-IP as authoritative from a direct, unproxied client.
How do you enable HTTPS on the Ubuntu origin?
Cloudflare encryption does not replace encryption between Cloudflare and your server. Obtain a certificate for every hostname that Nginx serves, configure port 443, and redirect HTTP only after HTTPS works directly.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →For a public certificate, Certbot can request and install a certificate through the Nginx plugin:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
sudo certbot --nginx -d example.com -d www.example.com
sudo nginx -t
sudo systemctl reload nginx
Verify that the certificate is unexpired, issued by a trusted public authority or an appropriate Cloudflare Origin CA certificate, and whose subject or SAN matches the hostname. Full (strict) will reject an invalid, expired or mismatched certificate. Keep automatic renewal enabled and test renewal before the certificate’s expiry window.
How do you configure Cloudflare DNS and TLS?
In Cloudflare DNS, create proxied A and AAAA records for the public hostnames when the origin supports both address families. The orange-cloud state sends browser traffic through Cloudflare and helps conceal the origin address. Audit DNS-only records, old subdomains and mail-related records so an unused record does not reveal the server’s address.
Choose the encryption mode
| Mode | Cloudflare-to-origin connection | Certificate validation | Use |
|---|---|---|---|
| Flexible | HTTP | None | Avoid for Drupal login and administration; it commonly causes HTTPS redirect loops when the origin redirects HTTP. |
| Full | HTTPS | Certificate is not validated | Temporary compatibility when the origin has HTTPS but its certificate is not yet publicly trusted. |
| Full (strict) | HTTPS | Certificate must be valid, unexpired and hostname-matched | Preferred production mode when the origin certificate is correctly installed. |
Set Cloudflare’s SSL/TLS mode to Full (strict) after confirming port 443 and the origin certificate. Cloudflare can return error 526 when strict validation fails. Full mode may appear to work with a broken certificate, but it leaves certificate validation incomplete. Flexible keeps the edge-to-origin hop on HTTP and can produce a loop when Nginx or Drupal insists on HTTPS.
Allow Cloudflare’s published network ranges through the origin firewall for ports 80 and 443, while keeping administrative ports restricted. If the origin remains reachable through a DNS-only name or an exposed IP, an attacker can bypass Cloudflare’s controls; remove unnecessary records and restrict direct access where practical.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you test after the installation?
Run these checks from an external network and from the server. They catch configuration errors that a successful installer page cannot.
- Canonical host: decide whether the apex name or the
wwwname is canonical and make the other redirect exactly once. - HTTPS: request HTTP and HTTPS, confirm one clean redirect, and ensure the final URL remains HTTPS after login.
- Cloudflare mode: inspect the edge response and confirm the origin receives HTTPS when strict mode is enabled.
- Absolute URLs: inspect generated links, image URLs, CSS and JavaScript for accidental
http://references. - Authentication: log in, log out, submit a form and verify that session cookies are secure and persistent across the canonical hostname.
- Files: upload an image, download it while authenticated, and verify that private files are not publicly readable.
- Cache: clear Drupal caches and confirm a changed page is served after the cache rebuild.
- Protected paths: request
/sites/default/settings.php, Composer files and hidden files; they should not disclose source or credentials. - Logs: review
/var/log/nginx/error.log, PHP-FPM logs and Drupal’s Status report for 404, 403, 502 and permission errors. - Real IP: compare Nginx logs with a known test address and confirm Drupal’s flood controls do not treat every visitor as one Cloudflare edge address.
How do you fix common Drupal, Nginx and Cloudflare failures?
Cloudflare error 526 or an origin TLS failure
Check that Nginx is listening on 443, the certificate includes the requested hostname, the certificate is not expired, and the full certificate chain is installed. Confirm that the firewall allows Cloudflare traffic and that the server block selected by SNI is the Drupal site rather than a default virtual host.
Redirect loop between HTTP and HTTPS
Use Full or Full (strict), not Flexible, when the origin redirects HTTP to HTTPS. Confirm that Nginx receives the forwarded protocol and that Drupal’s reverse-proxy settings trust only the proxy addresses that can set it. Remove duplicate HTTP-to-HTTPS rules in Nginx, Cloudflare Redirect Rules and Drupal modules; one authoritative redirect is enough.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMixed-content warnings
Inspect the browser’s blocked-resource URL and Drupal’s generated configuration. Correct hard-coded HTTP URLs in themes, modules and content, then clear Drupal caches. A valid edge certificate cannot rewrite an HTTP URL embedded in a stylesheet, image field or custom script.
Every visitor appears to have the same IP
Cloudflare normally reaches the origin from its own addresses. Configure Nginx’s real-IP handling and Drupal’s trusted reverse-proxy addresses using the current Cloudflare ranges. If a direct client can send the same forwarding header and be trusted, the configuration is unsafe; restrict the trusted source networks first.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Clean URLs return 404 or PHP source downloads
Confirm that Nginx’s root is the Drupal web directory, that the try_files rule falls back to /index.php, and that the PHP location uses the existing FPM socket. A source download indicates that Nginx is not passing PHP to FPM; a 404 for every alias usually indicates the wrong document root or a missing rewrite fallback.
Drupal reports unwritable files or cannot upload
Check ownership and permissions on web/sites/default/files and the configured private-files directory. Keep code and settings.php non-writable by the web user, and grant write access only to directories Drupal must change. After correcting permissions, clear caches and repeat a small upload rather than making the entire project writable.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHost-name HTTP 400 after enabling trusted hosts
The requested host is not in trusted_host_patterns. Add the exact legitimate hostname, including a separate pattern for www when it is served, then test through both the origin and Cloudflare. Do not solve the error with a catch-all pattern; that defeats Host-header protection.
Frequently Asked Questions
Can I install Drupal without Composer on Ubuntu?
You can copy a prepared Drupal codebase, but a Composer-managed project records dependencies and makes repeatable updates and rollbacks practical. If you inherit a manually copied tree, plan a controlled migration to Composer before the first major update.
Should the Cloudflare DNS record for the origin be proxied immediately?
No. First make the origin work directly, including Nginx routing and HTTPS, then enable the proxy and verify the same hostname again. This staged change makes it clear whether a failure is at the server or at the Cloudflare edge.
What happens if Cloudflare IPv6 reaches an origin that only supports IPv4?
An AAAA record can direct some visitors to an IPv6 path that is not listening or is blocked by the firewall. Either configure IPv6 end to end or remove the AAAA record until the origin and firewall support it consistently.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where should Drupal private files be stored?
Use a directory outside the public document root, such as a dedicated path under the project or a separate protected volume, and configure Drupal’s private-file setting to use it. Verify with an unauthenticated request that a private asset cannot be fetched by guessing its URL.
Do Cloudflare cache settings replace Drupal caching?
No. Drupal still needs its own render and dynamic-page caches, while Cloudflare can cache eligible static responses at the edge. Exclude authenticated, administrative and other session-sensitive responses from any custom edge rule and purge both layers when changing cache policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
