Point Cloudflare at LogicWeb without breaking mail

To point Cloudflare at LogicWeb without breaking mail, proxy only the website records, leave MX and related mail records unproxied, and set SSL/TLS to Full (strict) so Cloudflare talks to a real certificate on your origin. Cloudflare sits in front as a reverse proxy; your LogicWeb account remains the origin that still serves the site and handles email. AutoSSL on cPanel hosting already issues that origin certificate when the hostname can validate correctly.

What to orange-cloud and what to leave grey

Create the zone in the Cloudflare dashboard and add the A record for your site, plus AAAA if you use IPv6 on the account. Set the cloud to orange on the apex and on www so web traffic goes through the proxy. Leave MX, SPF TXT, DKIM, and the mail hostname grey so mail still reaches LogicWeb directly. Keep FTP, cPanel, and WHM hostnames grey as well, because proxying ports like 2083 can lock you out of the control panel.

Once you point nameservers at Cloudflare, Cloudflare becomes authoritative for the zone while the origin IP stays on our side. Confirm that IP with an IP lookup and a hosts-file preview before you rely on the change in production. How nameservers work explains the same handoff in more detail if you need the background.

Set SSL/TLS mode to Full (strict)

Flexible mode often causes redirect loops because the browser sees HTTPS while the origin still receives plain HTTP in a way the site did not expect. Full (strict) requires a valid certificate on the origin that covers the hostname visitors use. AutoSSL issues that certificate when the name can still reach us for HTTP-01 validation, which is why many people grey-cloud first, run AutoSSL, then orange-cloud—or install a Cloudflare origin certificate on the account instead.

curl -sI https://example.com | head -n 20
curl -sI https://203.0.113.10 -H ‘Host: example.com’ –insecure | head

The first command shows what the public path through Cloudflare returns. The second checks the origin directly by IP with the correct Host header. Both should return 200 or a redirect you intentionally configured. A 525 usually means Full (strict) is on without a usable certificate on the box; run AutoSSL and test again.

After the orange cloud is on

1. Purge the Cloudflare cache once from the dashboard so you are not staring at an old copy while LiteSpeed still caches at the origin.
2. If you already force HTTPS in .htaccess, turn on “HTTPS only” at Cloudflare or keep the origin rule—not both fighting each other.
3. Avoid running Rocket Loader together with LiteSpeed Cache JavaScript combine; that pairing often breaks scripts and shows errors like “jQuery is not defined.”
4. Add Page Rules or Cache Rules that bypass cache for wp-admin and wp-login.php so logged-in WordPress sessions stay dynamic.

If the zone publishes AAAA but the origin has no working IPv6 path, visitors on IPv6 can hit a dead end. Either add the AAAA address we issued for the account, or do not publish AAAA at Cloudflare. A vs AAAA vs CNAME covers how those records differ.

Cloudflare is the front door and LogicWeb is still the house: orange-cloud the site, grey-cloud mail, and use Full (strict) against a real origin certificate. If you care more about the transport layer next, see HTTP/3 and QUIC.