> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastcat.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare & Proxied Domains

> Using Cloudflare's proxy in front of a FastCat WordPress site— and the one setting that breaks it.

Cloudflare's proxy (the orange cloud) works fine in front of FastCat WordPress. One setting decides whether it works or not: **SSL/TLS encryption mode**.

<Warning>
  Set SSL/TLS mode to **Full** while your domain is being set up, then switch to **Full (strict)** once your panel shows **Live · SSL active**.
</Warning>

## Setup order

<Steps>
  <Step title="Point the record at us">
    Add the A record from [Connect your domain](/wordpress/connect-your-domain), using the IP shown in your panel. The proxy can be on (orange cloud) or off.
  </Step>

  <Step title="Set SSL/TLS mode to Full">
    In Cloudflare: **SSL/TLS → Overview → Full**. Not Off, not Flexible, and not Full (strict) yet.
  </Step>

  <Step title="Let us verify and issue">
    Because the proxy hides your origin, we verify your domain by fetching a token from your site at `/.well-known/fastcat-domain-check`. Leave `/.well-known/` paths unblocked by any firewall or page rule.
  </Step>

  <Step title="Switch to Full (strict)">
    Once the panel shows **Live · SSL active**, your origin has a valid Let's Encrypt certificate. Move Cloudflare to **Full (strict)** for end-to-end verified encryption.
  </Step>
</Steps>

## Which mode does what

| Mode              | Result                                                                                                                                          |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **Full**          | ✅ Correct during setup. Cloudflare talks HTTPS to us and accepts the certificate we have at the time.                                           |
| **Full (strict)** | ✅ Correct after SSL is active. Set it too early and Cloudflare rejects the origin before our certificate exists.                                |
| Flexible          | ❌ Redirect loops and mixed-content problems— WordPress on FastCat always expects HTTPS.                                                         |
| Off               | ❌ Breaks verification entirely. Cloudflare won't use the HTTPS path to us, and our check lands on a Cloudflare error page instead of your site. |

<Note>
  Symptom of leaving SSL/TLS mode on **Off**: your domain never leaves *Awaiting DNS setup*, even though the DNS record is correct.
</Note>

## Other proxies and CDNs

The same rules apply to any proxy or CDN in front of your site:

* The proxy's origin must be the IP shown in your panel, reached over HTTPS.
* Requests to `/.well-known/` must reach the origin so verification and certificate issuance can complete.
* Don't force a plain-HTTP connection to the origin.

Stuck? [Open a ticket](https://my.fastcat.co) with your domain name and we'll look at what the edge is seeing.