To host a site with Cloudflare and Nginx, run Nginx on an Ubuntu VPS as the origin server, point your domain’s DNS records to the VPS, then change the domain’s registrar nameservers to the two Cloudflare assigns. Cloudflare becomes the authoritative DNS provider and, when the web records are Proxied, the reverse proxy between visitors and Nginx.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reliable order is: install and test Nginx, create the correct server block, onboard the domain in Cloudflare, install an origin certificate, select Full (strict), and verify both DNS and HTTPS. The steps below cover a static site and the changes needed for an application server.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How the Cloudflare–Nginx–VPS arrangement works
Your VPS remains the origin. Nginx listens for HTTP and HTTPS requests, serves files from disk, or forwards requests to an application running on a local port. Cloudflare supplies DNS and an optional HTTP/HTTPS reverse-proxy layer. Cloudflare describes this role as acting as “the reverse proxy and DNS provider for your site.”
Two Cloudflare controls are easy to confuse:
- DNS records tell clients where a hostname resolves. An A record points to an IPv4 address; an AAAA record points to an IPv6 address.
- Proxy status decides whether web requests pass through Cloudflare (orange cloud, Proxied) or go directly to the VPS (gray cloud, DNS only).
Proxying is useful for Cloudflare’s edge features and hides the origin address from ordinary visitors, but it applies only to supported HTTP/HTTPS traffic. Mail, SSH, database connections and other services should normally remain DNS-only unless the service is specifically supported by Cloudflare’s proxy.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and decisions
Have these items ready before changing DNS:
- A registered domain, including access to the registrar’s nameserver settings.
- A VPS with Ubuntu installed and a public IPv4 address, IPv6 address, or both.
- SSH access with an account that can run
sudo. - Permission to edit DNS records in Cloudflare.
- The hostname you will publish, such as
example.comand optionallywww.example.com.
Decide whether Nginx will serve static files or reverse-proxy an application. The DNS and TLS process is the same, but the Nginx server block differs. Also decide which certificate model fits your traffic:
| Certificate | What it secures | Works when visitors bypass Cloudflare? | Operational responsibility |
|---|---|---|---|
| Let’s Encrypt installed with Certbot | Browser-to-Cloudflare and Cloudflare-to-origin connections, provided the certificate is installed on the relevant endpoint | Yes, because it is publicly trusted | Automate and monitor renewal |
| Cloudflare Origin CA | Cloudflare-to-origin traffic | No guarantee; browsers can show certificate-authority errors if proxying is disabled | Track expiration yourself; Cloudflare does not send Origin CA expiration notifications |
1. Install Nginx on Ubuntu
Connect to the VPS over SSH and install Ubuntu’s distribution package:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo apt update
sudo apt install nginx
sudo systemctl status nginxThe status command should show an active service. If it is not running, inspect the recent service messages before continuing:
sudo systemctl --no-pager -l status nginx
sudo journalctl -u nginx --no-pager -n 50Ubuntu identifies Nginx as a high-performance web server and reverse proxy. The distribution package is the simplest starting point. NGINX also publishes signed packages and lists Ubuntu 22.04, 24.04 and 26.04 among supported versions; if you use that repository instead, select the package source for your exact Ubuntu release and verify its signing keys.
Allow the web ports in the VPS provider’s network firewall and the operating-system firewall before testing from the internet. Keep SSH access available on your administrative port. Do not expose an application port publicly when Nginx is intended to be its public gateway.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Create a static-site server block
Create the document root
Make a directory owned by the account that will deploy the site. This example uses /var/www/example.com:
sudo mkdir -p /var/www/example.com
sudo chown -R "$USER":"$USER" /var/www/example.com
printf '%sn' '<h1>It works</h1>' > /var/www/example.com/index.htmlUse your real domain in every path and hostname below. If a separate deployment user owns the files, replace the ownership command with that user’s account.
Write the Nginx configuration
Create /etc/nginx/sites-available/example.com:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example.com;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}The server_name values must match the hostnames visitors request. Including both the apex and www names prevents an otherwise correct site from falling into another server block.
Enable and test it
- Create the Ubuntu sites-enabled link:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com - If the default site would answer an unmatched hostname, disable it:
sudo rm -f /etc/nginx/sites-enabled/default - Check syntax and the complete configuration:
sudo nginx -t - Only after a successful test, reload without dropping connections:
sudo systemctl reload nginx
Ubuntu’s documented convention is to keep editable files in /etc/nginx/sites-available/<your-domain> and enable them through sites-enabled. Run nginx -t before every reload, including changes made by certificate tools.
3. Configure Nginx as an application reverse proxy
For an application, keep the app bound to a local address such as 127.0.0.1:3000 and let Nginx handle the public connection. Replace the static root and try_files location with a proxy location:
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Start the application independently, confirm that it responds on the local port, then test and reload Nginx. For PHP or another FastCGI application, use a FastCGI location instead of proxy_pass. The Nginx Beginner’s Guide covers static content, proxy servers and FastCGI patterns; adapt its socket or port details to your application rather than exposing the runtime directly.
4. Add the domain to Cloudflare and change nameservers
Add the zone and review imported records
- Sign in to Cloudflare and add the apex domain, such as
example.com. - Review the records Cloudflare imports. Remove stale web records and add the records that represent the VPS.
- Create an A record for
@pointing to the VPS IPv4 address. - If the VPS has working IPv6, create an AAAA record for
@pointing to that address. Do not publish an AAAA record that the server or firewall cannot actually serve. - Add
wwwas an A/AAAA record or a CNAME to the apex, according to your preferred canonical hostname. - Set the web records to Proxied when requests should pass through Cloudflare. Leave mail records and unrelated services DNS only.
An incorrect or missing record can result in DNS_PROBE_FINISHED_NXDOMAIN. Check every hostname that appears in the Nginx server_name directive.
Change the registrar nameservers
Cloudflare displays two assigned nameservers for the zone. At the domain registrar, replace the existing nameservers with exactly those two values, then save the change. The registrar, not the VPS, controls this delegation. DNS propagation timing varies, so continue testing from more than one network while the delegation updates.
Cloudflare DNS can be active before every resolver has refreshed the delegation. Do not repeatedly change records or nameservers during this interval; first confirm that the registrar shows the requested nameservers and that the Cloudflare zone is marked active.
5. Choose and install origin TLS
Option A: publicly trusted Let’s Encrypt certificate with Certbot
Use this option when the origin may ever be reached directly, or when you want a browser-trusted certificate independent of Cloudflare. Install Certbot and its Nginx integration:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo apt update
sudo apt install certbot python3-certbot-nginxAfter the DNS names resolve to the VPS and ports required for validation are reachable, request the certificate:
sudo certbot --nginx -d example.com -d www.example.comCertbot’s Nginx plugin finds the matching server block, obtains the certificate from Let’s Encrypt and can edit the configuration before reloading Nginx. Read each redirect and renewal prompt rather than accepting a hostname that is not configured. Verify the resulting configuration:
sudo nginx -t
sudo systemctl reload nginx
sudo certbot certificatesKeep the renewal timer installed by the package and perform a renewal test in a maintenance window. The certificate’s names must include every hostname served over HTTPS. A certificate for the apex alone does not cover www.
Option B: Cloudflare Origin CA certificate
Origin CA is designed for the encrypted leg between Cloudflare and your VPS. In Cloudflare’s dashboard, create an Origin CA certificate covering the hostnames you will proxy, download the certificate and private key, and store them on the VPS with permissions that allow Nginx to read the key but not ordinary users.
Reference the PEM files in the HTTPS server block, enable port 443, and include the same hostnames:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/example.com/origin.crt;
ssl_certificate_key /etc/ssl/example.com/origin.key;
root /var/www/example.com;
index index.html;
location / { try_files $uri $uri/ =404; }
}
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Test and reload:
sudo nginx -t
sudo systemctl reload nginxOrigin CA certificates are not intended to be presented directly to browsers. If you pause or disable Cloudflare proxying, a visitor connecting straight to the VPS can receive a certificate-authority error. Track the Origin CA expiration date in your own maintenance system because Cloudflare does not send expiration notifications for these certificates.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhich Cloudflare SSL mode should you use?
| Mode | Origin connection | Use when |
|---|---|---|
| Flexible | HTTP from Cloudflare to the origin | Avoid for a production login or any site requiring end-to-end encryption. |
| Full | HTTPS from Cloudflare to the origin, without strict certificate validation | Short-term compatibility while correcting an origin certificate. |
| Full (strict) | HTTPS with validation of a valid origin certificate | The normal production choice after installing a valid Let’s Encrypt or Cloudflare Origin CA certificate. |
Select Full (strict) in Cloudflare’s SSL/TLS settings after the HTTPS server block works. Strict mode requires a valid certificate for the requested hostname, a matching certificate chain, and a reachable origin on port 443. If strict mode reports an origin error, fix the certificate or Nginx configuration instead of permanently weakening the mode.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Verify DNS, proxying and HTTPS
Use a resolver outside the VPS to check that both names resolve:
dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A
dig +short www.example.com AAAAWith proxying enabled, the returned addresses may be Cloudflare edge addresses rather than the VPS address. That is expected. Confirm the record’s proxy icon in Cloudflare rather than judging proxying from DNS output alone.
Request both protocols and inspect redirects and status codes:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
curl -I http://example.com
curl -I https://example.com
curl -I https://www.example.comCheck that HTTP redirects to the intended HTTPS hostname, HTTPS returns the expected site, and no hostname produces a default Nginx page. For certificate details, inspect the served certificate from a client:
openssl s_client -connect example.com:443 -servername example.com </dev/nullFinally, test the origin locally or from an administrative network when troubleshooting, while preserving the requested host header. This distinguishes an Nginx problem from a Cloudflare DNS or proxy problem.
Quick Recap
Common failures and precise fixes
| Symptom | Likely cause | Fix |
|---|---|---|
DNS_PROBE_FINISHED_NXDOMAIN |
The zone is not delegated to Cloudflare, or the hostname has no record. | Confirm the registrar uses Cloudflare’s two assigned nameservers, then add the required A/AAAA or www record. |
| Cloudflare reports an origin connection error | Nginx is stopped, the VPS firewall blocks the selected port, or the DNS address is wrong. | Run systemctl status nginx, verify the A/AAAA values, and permit ports 80 and/or 443 in every firewall layer. |
| The wrong site or Nginx welcome page appears | The request hostname does not match the intended server_name, or the default site remains enabled. |
Correct the hostname, remove the default enabled link, run nginx -t, and reload. |
| HTTP works but HTTPS fails | No port-443 server block, invalid certificate paths, or blocked port 443. | Check the certificate files and permissions, add the 443 listener, test the configuration, and open 443. |
| Full (strict) fails while Full works | The origin certificate is expired, self-signed without an accepted chain, issued for another hostname, or not served by Nginx. | Install a valid Let’s Encrypt or Origin CA certificate covering the requested name, then reload Nginx and retry strict mode. |
| Only IPv6 visitors fail | An AAAA record points to an address that is not configured or permitted by the VPS. | Configure IPv6 routing and firewall rules, or remove the AAAA record until IPv6 is ready. |
| The application returns 502 Bad Gateway | Nginx cannot reach the local application port or socket. | Check the app service, listening address and port, then compare them with proxy_pass. Inspect Nginx’s error log. |
Security and ongoing maintenance
- Keep Ubuntu and Nginx packages updated. Re-run
sudo nginx -tbefore every reload. - Use a non-root SSH account with
sudo, protect private keys, and retain a separate recovery path before changing firewall rules. - Expose only the services the site needs. An application behind Nginx should normally listen on localhost rather than a public interface.
- Maintain an inventory of certificate names, file locations, expiry dates and renewal ownership. This is essential for Origin CA certificates.
- Review Cloudflare records after migrations. A stale A or AAAA record can send some visitors to an old VPS even when the current server is healthy.
- Back up the site files, Nginx configuration and application data separately. A DNS provider change does not create a backup of the origin.
A practical launch checklist
- SSH works and the VPS has the intended public IPv4/IPv6 addresses.
- Nginx is installed, active and serving a test page.
- The enabled server block names the apex and any
wwwhostname. sudo nginx -tsucceeds before each reload.- Cloudflare has correct A/AAAA records and the desired proxy status.
- The registrar delegates the domain to Cloudflare’s assigned nameservers.
- An origin certificate covers every HTTPS hostname.
- Nginx listens on 443 and the VPS/provider firewalls permit required traffic.
- Cloudflare SSL/TLS mode is Full (strict) after certificate validation succeeds.
- HTTP, HTTPS, apex and
wwwrequests have been tested, and certificate renewal is monitored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
