Cloudflare and Joomla Recommended First Steps

Overview

These basic steps will help reduce common areas of confusion for Joomla users that are new to the Cloudflare services. In addition, these steps are very quick and will generally take you only a few minutes of your time to help you make your experience using Cloudflare better.

---

Restore visitor IP

Restore visitor IP by following the directions in this article. Since Cloudflare acts as a proxy for sites using our network, Cloudflare's IPs are going to show in your logs, including comments, unless you install something to restore the original visitor IP.

Why should you restore visitor IP?

If you receive a lot of comments or spam on your blog, you may mistakenly believe that Cloudflare is spamming you. Some other Joomla plugins or extensions may also rely on the original visitor IP for the services to work properly and reduce false alerts.

Note

You don't need to worry about this if you activated through a hosting partner, since they already restore visitor IP addresses on their servers by default.

---

Create a Page Rule to exclude Joomla

Create a Page Rule to exclude the Joomla admin or Joomla login sections from Cloudflare's caching and performance features.

Why do this?

While there is not always an issue, we have seen instances where optional performance features like Rocket Loader may inadvertently break certain functions (editors, etc.) in your Joomla back end.

---

Allow IP addresses via Cloudflare Threat Control panel

Log in to your Cloudflare Threat Control panel and allow IP addresses you want traffic from or expect traffic from. Some common services you probably want to allow include:

• APIs you are pulling from
• Monitoring services you use to monitor your site's uptime
• Security services
• IP addresses you frequently login from

Why do this?

If Cloudflare has an IP address with a high threat score going to your site, or if you have Cloudflare's Web Application Firewall ↗ turned on, you may get challenged working in your back end and/or services you want to access your site may get challenged. Taking the steps to allow in the beginning will help prevent future surprises on your site.

Note

We allow all known search engine and social media crawlers in our macro list. If you decide to block specific countries, you must use care because you may end up inadvertently blocking their crawlers (blocking the USA, for example, could mean that their crawler gets challenged).

---

Ensure requests from Cloudflare's IP ranges aren't blocked or limited

If you are using services like .htaccess, firewalls or server mods to manage access to your site from visitors, it is vitally important to make sure requests from Cloudflare’s IP ranges are not being blocked or limited in any way. The number one cause of site offline issues in our support channel is something blocking or restricting requests from our IPs, so please take the time to make sure that all of Cloudflare’s IPs are allowed on your server.

Why do this?

Prevent false offline messages from appearing on your site to you or visitors.