Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Run Drupal 11.x from its Composer-managed web directory, serve that directory with Apache, and put Cloudflare in front using Full (strict) TLS. The reliable sequence is: verify the exact Drupal release requirements, install Apache/PHP/Composer and a supported database, configure Apache rewrite rules and overrides, finish Drupal’s installer, then add Cloudflare DNS, a valid origin certificate, trusted-host patterns, and tightly scoped reverse-proxy settings. Avoid Flexible SSL when Apache redirects HTTP to HTTPS; that combination causes redirect loops. This guide covers the installation, proxy configuration, verification checks, and recovery paths for common 525, 526, host, scheme, and permission errors.
What does a correct Drupal, Apache, and Cloudflare layout look like?
A browser connects to the public hostname at Cloudflare. Cloudflare terminates the visitor’s TLS connection, forwards the request to Apache over HTTPS, and Apache serves Drupal from the project’s web directory. Drupal then uses the proxy’s trusted forwarding headers to reconstruct the original HTTPS scheme, host, and client address.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Public DNS: the site’s hostname is an A or AAAA record proxied by Cloudflare.
- Edge TLS: Cloudflare presents a certificate to visitors and can redirect HTTP requests to HTTPS.
- Origin TLS: Apache listens on port 443 and presents a certificate whose name matches the requested hostname.
- Application root: Apache’s
DocumentRootis Drupal’s Composer-createdwebdirectory, not the project parent containingcomposer.json. - Application trust: Drupal accepts only the intended hostnames and only forwarding headers received through declared proxy addresses.
Keep the origin reachable for administration and troubleshooting, but do not assume that a certificate intended only for Cloudflare will be trusted by a browser when proxying is disabled.
Which versions and database engines does Drupal 11.x require?
The current Drupal 11.x installation document lists these minimums. They are branch requirements, not a promise that every future point release will keep the same floor; check the exact core release before installing.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Component | Minimum stated for Drupal 11.x | Qualification |
|---|---|---|
| Apache | 2.4.7 | Use a release that supports the PHP integration and modules you need. |
| PHP | 8.3.0 | Install the extensions required by the selected Drupal release as well as the interpreter. |
| Composer | 2.9.3 | Verify the executable’s version; an older distribution package may not satisfy this requirement. |
| MySQL | 8.0 or newer | Use a dedicated Drupal database and account. |
| MariaDB | 10.6 or newer | Confirm the server reports the expected MariaDB version. |
| PostgreSQL | 16 or newer | Install the PostgreSQL PHP driver required by Drupal. |
| SQLite | 3.45 or newer | Suitable only when the application’s scale and operational needs fit SQLite. |
The authoritative requirements are in Drupal core’s INSTALL.txt for the 11.x branch. Ubuntu’s package names and repository versions vary by LTS release, so select the Ubuntu release first and then choose packages or an approved repository that meet these figures.
What should be prepared before installing?
- An Ubuntu server with administrative access and a documented LTS release.
- A DNS name, such as
example.com, and a decision about whetherwww.example.comis also a valid public hostname. - Firewall rules permitting SSH administration and web traffic on ports 80 and 443 as appropriate for your origin design.
- A database engine supported by the selected Drupal release.
- A plan for certificate issuance and renewal. Use a publicly trusted certificate or a Cloudflare Origin CA certificate on the Apache origin.
- A backup location for the database, Drupal files, and configuration before changing proxy or TLS settings.
Do not proxy the DNS record until Apache answers correctly at the origin. Establishing a known-good origin first makes Cloudflare errors distinguishable from local Apache or Drupal errors.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do I install Apache, PHP, Composer, and a supported database on Ubuntu?
Install the Ubuntu packages appropriate to the chosen LTS release, then verify every version against the table above. The package names below illustrate the roles; use the PHP version and extension names supplied by your Ubuntu repositories.
sudo apt update
sudo apt install apache2 php php-cli php-common php-mysql composer mariadb-serverDrupal also needs the PHP extensions required by its release, commonly including XML, multibyte-string, cURL, ZIP, and image support. Add the matching Ubuntu packages for those extensions, restart Apache after changing PHP modules, and check the command-line versions:
apache2ctl -v
php -v
composer --version
mysql --versionIf composer --version reports less than 2.9.3, install or update Composer using a method that supplies the required release rather than proceeding with an older binary. Likewise, do not force an unsupported PHP package merely because it is the default in an older Ubuntu repository; change the repository or Ubuntu LTS choice instead.
How do I create the Drupal project with Composer?
Use Drupal’s recommended-project workflow so application code and third-party dependencies are managed outside the web root while Apache exposes only web. Choose a controlled location and a project directory that matches your deployment conventions.
sudo mkdir -p /var/www/example
sudo chown $USER:$USER /var/www/example
composer create-project drupal/recommended-project /var/www/exampleThe command above intentionally leaves the package constraint to Composer’s current recommendation. To pin a specific Drupal 11.x release, append the exact constraint selected after checking that release’s requirements, for example drupal/recommended-project:^11. Do not copy a constraint blindly between major or minor releases.
After Composer finishes, the web-served path is /var/www/example/web. Keep composer.json, composer.lock, and the vendor directory outside that document root. Record the project path because the same path must be used in every Apache VirtualHost and deployment script.
How do I create a dedicated database and application account?
Create a database and a user used only by this Drupal installation. Store the credentials in a password manager and enter them in Drupal’s browser installer; do not reuse an administrative database account.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
sudo mariadb
CREATE DATABASE drupal_db CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'drupal_app'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT ALL PRIVILEGES ON drupal_db.* TO 'drupal_app'@'localhost';
FLUSH PRIVILEGES;
EXIT;The exact character-set and authentication syntax can differ between MySQL and MariaDB versions. If you choose PostgreSQL or SQLite, use that engine’s connection details and follow the database-specific requirements for the selected Drupal release. Keep the database host, name, username, and password together for the installer, but never publish the password in a configuration example.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How should Apache be configured for Drupal’s clean URLs?
Enable the modules Drupal relies on, point the VirtualHost at the web directory, and permit Drupal’s .htaccess to operate. Clean URLs fail when mod_rewrite is missing or Apache ignores overrides.
sudo a2enmod rewrite headers
sudo systemctl restart apache2Create a dedicated HTTP VirtualHost similar to this, replacing the hostnames and path with your values:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/example/web
<Directory /var/www/example/web>
AllowOverride All
Options -MultiViews
Require all granted
</Directory>
</VirtualHost>AllowOverride All lets Drupal’s shipped .htaccess control front-controller routing. Options -MultiViews prevents Apache’s content negotiation from selecting an unexpected file before Drupal handles the request. The headers module is needed when Apache must process the headers involved in the proxy and HTTPS arrangement.
Enable the site, disable an unwanted default site if it captures the hostname, and test the configuration:
Recommended Free Tools
sudo a2ensite example.conf
sudo apachectl configtest
sudo systemctl reload apache2apachectl configtest must report a successful syntax check before you continue. If the intended VirtualHost is not selected, inspect the enabled-site links and the output of Apache’s virtual-host listing rather than changing Drupal settings.
How do I add HTTPS at the Apache origin?
Obtain either a publicly trusted certificate or a Cloudflare Origin CA certificate whose subject or SAN covers every hostname that Cloudflare will request. Install the certificate and private key, enable Apache’s SSL support, and create a port 443 VirtualHost with the same Drupal document root.
sudo a2enmod ssl
sudo systemctl reload apache2The certificate file paths and PHP handler names depend on the Ubuntu package set, so do not copy a path that does not exist on your server. Check that Apache listens on 443, that the certificate is unexpired, and that its hostname matches the request. Initially leave the HTTP VirtualHost able to answer while you validate origin TLS; add the HTTP-to-HTTPS redirect only after the HTTPS path works.
Cloudflare Origin CA certificates are designed for the Cloudflare-to-origin leg. They are not trusted by browsers when someone disables proxying and connects directly to the origin, so a direct browser test can show a certificate warning even when Cloudflare’s Full (strict) validation is correct.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How do I set Drupal’s file permissions safely?
Drupal needs a writable sites/default/files directory for uploads and generated assets, while application code and settings.php should remain protected from ordinary web writes.
- Create the files directory if the installer has not already done so.
- Give the Apache/PHP account ownership or group write access to that directory only.
- Keep the project code readable by Apache but writable only by the deployment or administration account.
- Protect
sites/default/settings.phpafter installation and verify that it is not writable by the web process.
sudo mkdir -p /var/www/example/web/sites/default/files
sudo chown -R www-data:www-data /var/www/example/web/sites/default/files
sudo chmod 750 /var/www/example/web/sites/default/filesThe correct web account may differ from www-data on a customized Ubuntu installation. Confirm the account used by Apache and PHP before applying ownership changes. Overly broad recursive write permissions can expose configuration and code; repair only the directories that need runtime writes.
How do I complete Drupal’s browser installer?
With Apache serving the origin and the database ready, browse to the hostname and follow Drupal’s installer. Select the database type, enter the database name, account, password, and host, then create the first maintenance account.
- Open the site at the intended hostname and choose the installation profile offered by the selected Drupal release.
- Enter the dedicated database credentials and allow the installer to create the schema.
- Set the site name, regional options, and the first maintenance account.
- After the installer finishes, review the Drupal Status report immediately and resolve every error before enabling Cloudflare proxying.
If the installer cannot write files, return to the permissions step. If it reports a database connection failure, verify the engine, host, account authentication method, and firewall before changing Drupal code.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I configure trusted hosts and Cloudflare’s reverse proxy in Drupal?
Set trusted hosts to the exact public names users may request, then enable reverse-proxy handling only when Cloudflare is actually in the request path. Restrict proxy addresses and forwarded headers so a client cannot spoof its scheme or IP.
In web/sites/default/settings.php, define patterns for each legitimate hostname:
$settings['trusted_host_patterns'] = [
'^example\.com$',
'^www\.example\.com$',
];Drupal returns HTTP 400 for a request whose host does not match these patterns. Include every name that is intentionally public, including a www alias if you serve it, and omit parked or administrative names.
When Cloudflare is in the path, add reverse-proxy settings:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [
'CLOUDFLARE_PROXY_ADDRESS_1',
'CLOUDFLARE_PROXY_ADDRESS_2',
];
$settings['reverse_proxy_trusted_headers'] = /* bitmask matching headers your proxy supplies */;Replace the address entries with the complete, current Cloudflare proxy ranges and any additional intermediary proxy addresses used by your architecture. Configure the trusted-header bitmask for the forwarded headers your proxies actually send, such as the original host, scheme, port, and client address. Do not trust arbitrary forwarding headers from the public internet, and do not enable these settings on an installation that receives traffic directly without the declared proxies.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
After editing settings.php, clear Drupal caches through the administrative interface or the cache-rebuild method appropriate to your installation, then test both an ordinary page and an authenticated request.
What is the correct Cloudflare SSL/TLS sequence?
Cloudflare should be added only after the origin answers correctly. The safest general configuration is Full (strict) with a valid, unexpired, hostname-matching certificate on Apache.
- Add the site’s DNS record in Cloudflare and leave proxying disabled while you test the origin, if your change window allows.
- Install a public-CA certificate or Cloudflare Origin CA certificate on Apache. Confirm that the certificate covers the exact hostname Cloudflare will use.
- Enable Apache TLS on port 443 and verify the HTTPS VirtualHost locally or through a controlled origin test.
- In Cloudflare’s SSL/TLS settings, select Full (strict). Cloudflare validates the origin certificate’s expiry, issuer trust, and hostname.
- Proxy the public hostname through Cloudflare and test the browser connection.
- Enable edge HTTP-to-HTTPS redirection, such as Always Use HTTPS, and enable Automatic HTTPS Rewrites only when they fit the site’s content and application behavior.
Full mode encrypts the Cloudflare-to-origin connection but is less strict about certificate validation. Full (strict) is preferred when the origin certificate meets the validation rules. Flexible mode leaves the Cloudflare-to-origin leg on HTTP and must not be combined with an origin that redirects every HTTP request to HTTPS.
Why does Cloudflare Flexible SSL create a redirect loop?
In Flexible mode, a visitor uses HTTPS to Cloudflare, but Cloudflare uses HTTP to Apache. If Apache redirects that HTTP request to HTTPS, Cloudflare repeats the HTTP request and the cycle never reaches Drupal.
- Change Cloudflare’s mode to Full or, preferably, Full (strict).
- Confirm Apache accepts HTTPS on 443 and presents a valid matching certificate.
- Ensure Drupal trusts the proxy and the forwarded HTTPS scheme so it generates HTTPS URLs instead of redirecting inconsistently.
- Clear caches and retest in a private browser window.
Do not try to hide the loop by adding random redirect rules to Drupal or Apache. Fix the mismatch between the edge mode and the origin protocol first.
How do I verify the finished deployment?
Verification should cover infrastructure, TLS, Drupal’s understanding of the request, and write operations. Record the results rather than assuming a green browser page proves the whole stack is correct.
- Run
sudo apachectl configtestand confirm the intended VirtualHost is enabled. - Check that the public hostname resolves to Cloudflare and that the origin firewall permits the required Cloudflare-to-origin traffic.
- Open the site over HTTPS and inspect that the certificate hostname matches the public name and is not expired.
- Confirm Drupal generates absolute HTTPS URLs, accepts login, and does not show a trusted-host or proxy warning.
- Upload a file and verify that it appears in
sites/default/files. - Check CSS and JavaScript aggregation, since write failures often appear there before they are obvious elsewhere.
- Review Drupal’s Status report and assign an owner and remediation for every remaining warning or error.
- Inspect Apache access and error logs plus Drupal logs for the expected proxy information, scheme, and client address. Do not describe a test as successful until it has actually been run.
How do I diagnose the common Cloudflare, Apache, and Drupal failures?
Cloudflare error 525
A 525 means Cloudflare could not establish the required TLS connection to the origin. Check that Apache is listening on port 443, the HTTPS VirtualHost is enabled, the firewall allows the connection, and the certificate and private key can be loaded.
Cloudflare error 526
A 526 means Full (strict) rejected the origin certificate. Check expiry, issuer trust, and hostname coverage. Replace the certificate or correct the requested hostname before changing the SSL mode.
Too many redirects
Look first for Flexible mode paired with an Apache HTTP-to-HTTPS redirect. Then verify that Drupal’s reverse-proxy settings trust the actual Cloudflare addresses and forwarded HTTPS scheme. Remove duplicate redirect rules only after the protocol chain is coherent.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Drupal says the host name is not valid
Add the exact public hostname to trusted_host_patterns, including a separate pattern for a legitimate www name. Check for spelling, unexpected aliases, and whether a proxy is passing a host different from the browser’s address.
Wrong scheme, client IP, or login and flood behavior
Drupal is probably not receiving trustworthy proxy information. Confirm that reverse-proxy mode is enabled only for proxied traffic, every Cloudflare or intermediary address is listed, and the trusted-header bitmask corresponds to the headers actually supplied. Never solve this by accepting forwarding headers from every address.
Clean URLs return 404 or routing errors
Enable mod_rewrite, confirm that AllowOverride All applies to Drupal’s web directory, and make sure Apache is serving that directory rather than the project parent. Check that Drupal’s .htaccess has not been removed or overridden by a higher-level configuration.
Uploads or CSS aggregation fail
Check ownership and write permissions on sites/default/files, then read the Drupal Status report and Apache error log. Keep code and settings.php protected instead of granting recursive write access to the entire project.
Which certificate, TLS, and proxy architecture should I choose?
The right choice depends on who must trust the origin certificate, where TLS terminates, and how many proxy layers you operate.
| Decision | Option | Use it when | Operational consequence |
|---|---|---|---|
| Origin certificate | Public CA | The origin may be accessed directly by browsers or other clients when Cloudflare is bypassed. | Renewal must be managed at Apache; browsers can validate the certificate directly. |
| Origin certificate | Cloudflare Origin CA | Apache is intended to receive traffic from Cloudflare’s proxied edge. | Full (strict) can validate it, but direct browser access with proxying disabled is not browser-trusted. |
| Cloudflare mode | Full | You need encryption to the origin but cannot yet satisfy strict certificate validation. | Certificate validation is less stringent; plan a move to Full (strict). |
| Cloudflare mode | Full (strict) | The origin certificate is valid, unexpired, trusted, and hostname-matching. | Cloudflare validates expiry, issuer, and hostname; certificate renewal must be reliable. |
| Cloudflare mode | Flexible | Only when the origin intentionally serves HTTP and does not force HTTPS. | Cloudflare-to-origin traffic is HTTP; combining it with an origin HTTPS redirect causes a loop. |
| TLS termination | Apache | You want the Ubuntu host to own the origin certificate and HTTPS VirtualHost. | Apache must listen on 443 and remain correctly configured during renewals. |
| TLS termination | Another trusted proxy | An internal load balancer or gateway terminates TLS before Apache. | Declare every intermediary address and align each layer’s forwarded-header policy. |
A single Apache origin is the simplest trust model. Additional proxies are workable, but Drupal’s address list and header bitmask must represent every trusted hop, not just Cloudflare.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should this installation be maintained after launch?
Keep the deployment reproducible and review the trust boundary whenever infrastructure changes.
- Run Composer updates deliberately, review the lock-file changes, and test the selected Drupal release against its stated PHP and database requirements before production deployment.
- Renew the Apache certificate before expiry and verify that the renewed certificate still covers every public hostname.
- Keep Cloudflare proxy ranges and any intermediary addresses current; remove addresses that are no longer in the request path.
- Retest login, uploads, absolute HTTPS URL generation, clean URLs, and CSS/JavaScript aggregation after Apache, PHP, certificate, or Cloudflare changes.
- Monitor Apache and Drupal logs for unexpected hosts, schemes, or client addresses that could indicate a proxy or trust configuration error.
- Back up the database, uploaded files, and protected settings before upgrades, and test restoration rather than relying on the existence of backup files.
When a change introduces a 525, 526, redirect loop, host rejection, or write failure, return to the verification sequence: origin first, then TLS, then Cloudflare mode, then Drupal host and proxy trust.
Frequently Asked Questions
Can I use a Cloudflare Origin CA certificate if I sometimes disable proxying?
Only if direct visitors do not need the origin certificate to be browser-trusted. When proxying is disabled, use a public-CA certificate for direct browser access or expect certificate warnings from the Origin CA certificate.
Do I need both the bare domain and the www hostname in Drupal settings?
Add both only when both names are intentionally accepted by the site. Each accepted name needs its own exact trusted-host pattern and must be covered by the Apache VirtualHost and origin certificate.
What should I check before changing Drupal code to fix a 525 or 526?
Test Apache independently: confirm the 443 listener, enabled HTTPS VirtualHost, certificate file readability, expiry, and hostname coverage. Those Cloudflare errors occur before Drupal handles the request, so application edits cannot repair them.
Why does a direct origin test show a different client IP than Drupal logs?
Cloudflare places its address in the network connection and conveys the visitor address in forwarding headers. Drupal reports the original address only when the connecting proxy is listed in the reverse-proxy address setting and the corresponding headers are trusted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
