Getting started

Going live takes one DNS record. Everything else — the certificate, the routing, the policy — is handled for you. Expect a few minutes end to end, most of it spent waiting for DNS.

Before you begin

You need two things:

  • The hostname you want protected, such as www.yourstore.com or shop.yourstore.com. Bare root domains need an extra step — see Root domains.
  • Your server's address, so we know where to fetch the real content from. An IP address is the simplest answer.

Steps

  1. Add the domain

    In the dashboard, choose Add Domain and enter the hostname. Each hostname is configured separately — protecting www.yourstore.com does not cover shop.yourstore.com, which needs its own entry.

  2. Give us your server's address

    On the domain's Edge tab, fill in Server address. Your server's IP is the simplest answer. If your site sits behind a load balancer, enter the balancer's hostname instead — we resolve it on every request, so its addresses can rotate freely.

    We register that address privately on our side. This is why none of your own hostnames has to stay outside the edge to be fetched from.

  3. Enable the edge

    Press Enable edge. We register the hostname, set up routing and request a TLS certificate for it. The status will read pending until your DNS points at us.

  4. Point one DNS record at us

    With your DNS provider, add the record shown in step 2 of the Edge tab:

    CNAME www → edge.proxiedguardians.com

    That is the entire installation. Nothing is downloaded, no daemon runs on your server, and no one needs access to it.

  5. Wait for the certificate

    Once DNS resolves to us, the certificate is issued automatically and the status turns active. Your own server's certificate is never touched or replaced.

Mind the order. Between pointing DNS at us and the certificate being issued there is a short window where visitors can get a TLS error. On a live site, make the DNS change at a quiet hour and keep the old record handy — lowering that record's TTL to 300 a day beforehand makes a rollback take minutes instead of hours.

Check that it worked

Load your site and look at the response headers. You should see:

content-security-policy-report-only: ... server: cloudflare

View the page source and you will find a nonce attribute on the script tags — a different value on every reload. That is the edge rewriting your HTML as it streams.

No content-security-policy header? That is expected until you build a policy. With the CSP master switch off we leave your headers alone entirely — including any policy your own web server already sends. See Content Security Policy.

What to do next

Build a policy in Report-Only first so you can see what would be blocked before anything actually is. Turn on script integrity monitoring at the same time — it only observes, so it carries no risk of breaking the page.

Next: Content Security Policy →