Cloudflare can make your Zen Cart store faster and keep bots away from it, but a few settings matter a lot for a store. This article covers the essentials. For the complete walkthrough (the security rules, card-testing protection, payment callbacks, testing and troubleshooting), see our Cloudflare Setup Guide, or let us do it for you with Cloudflare Setup.
Before you start
- Take a full backup of your files and database.
- Export your DNS records from cPanel’s Zone Editor, or take a screenshot of every record. Cloudflare’s import scan misses records.
- Have your domain registrar login ready.
1. Add your site and check your DNS
Sign up at cloudflare.com, click Add a Domain and enter your bare domain (without www). When Cloudflare has scanned your DNS, compare its list line by line with the records you exported and add anything it missed.
| Record | Proxy status |
|---|---|
Your domain and www |
Proxied (orange cloud) |
mail, smtp, imap, pop, webmail, cpanel, whm, webdisk, autodiscover, autoconfig, ftp |
DNS only (gray cloud). Cloudflare doesn’t carry email or control panel traffic. |
| MX, TXT (SPF, DKIM, DMARC) and CAA records | Copy them exactly. |
2. Switch your nameservers
- If DNSSEC is on at your registrar, turn it off first and wait 24 to 48 hours. Switching with DNSSEC on takes your whole domain offline.
- At your registrar, replace your nameservers with the two Cloudflare gives you.
- Once Cloudflare says your site is active, you can turn DNSSEC back on under DNS > Settings and add the DS record it shows you at your registrar.
3. SSL: Full (strict), never Flexible
Under SSL/TLS, set the encryption mode to Full (strict) and turn on Always Use HTTPS. Keep the free AutoSSL certificate on your hosting account; it works through Cloudflare.
Never use Flexible. In Flexible mode Cloudflare talks to your server over plain HTTP, which gives shoppers an endless redirect loop (ERR_TOO_MANY_REDIRECTS) and sends your checkout pages unencrypted between Cloudflare and your server.
Your Zen Cart configure.php files should already use https:// addresses. If they don’t, open a ticket and we’ll help.
4. Three settings that break stores
- Rocket Loader: Off. It breaks attribute prices, checkout and on-page payment forms.
- Never cache your pages. Leave Cloudflare’s default caching alone and never add a “cache everything” rule: carts, accounts and checkout are built for each shopper.
- Payment callbacks must get through. PayPal’s IPN and webhooks call your store server to server and can’t solve Cloudflare’s challenges. After you switch, check PayPal’s IPN History and your gateways’ webhook logs. If anything fails, turn off Bot Fight Mode on the Free plan.
5. Your shoppers’ real IP addresses
Behind Cloudflare, Zen Cart 1.5.8 through 2.2.x takes the shopper’s IP address from a header that anyone can fake, and that address goes on every order and into your payment gateway’s fraud checks. The Cloudflare Setup Guide shows how to close that hole. If you’d like us to check it on your account, open a ticket.
Need more?
The Cloudflare Setup Guide covers everything else step by step: safe caching rules, locking down your server, bot settings, custom security rules, rate limits against card testing, protecting your admin, testing everything and what to do when you’re under attack. Prefer we set it up for you? See Cloudflare Setup. My Zen Cart Host customers get 10% off with code MZHOST10.
