Connects the panel to a Cloudflare account with an API token and manages zones, DNS records and a few zone settings from there.

An admin saves a token (stored encrypted and verified against Cloudflare before it is accepted); the page then lists zones, reads DNS records live from Cloudflare, and creates, updates and deletes them, alongside the zone's SSL mode, the Always Use HTTPS toggle, and a purge-everything cache purge. A domain owner can instead attach their own zone-scoped token from the domain's DNS Sync tab, which takes precedence over the shared admin token for that domain only. Publishing mirrors the panel's own DNS records into the matching Cloudflare zone and stores the returned record ids back on the panel rows, so re-running updates records in place rather than duplicating them; it also runs automatically when the panel's dns_records_changed event fires.

An optional auto-DNS setting creates an A record pointing at the server's IP when a website is created and removes the matching records when it is deleted. Both hooks are best-effort and swallow their errors, so a Cloudflare problem never blocks website provisioning. The plugin registers itself as a DNS provider, which lets the domains section list it and offer "publish now" without knowing anything Cloudflare-specific. Non-admin users get only three things: whether Cloudflare is configured, their own domains and how each would publish, and publishing one of their own domains. Uninstalling deletes every stored credential. Admins also get the zone's security level with an I'm Under Attack switch, Development Mode, IP Access Rules (IP, CIDR, ASN or country), minimum TLS version, HSTS, caching level and Browser Cache TTL, plus 24-hour, 7-day and 30-day traffic analytics from Cloudflare's GraphQL Analytics API; each needs the matching permission on the token (Zone Settings, Firewall Services, Analytics). Note the scope: it detects whether cloudflared is present but does not configure tunnels, and it does not manage page rules or WAF custom rules.

Availability: Free on every plan, including the Free plan.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Free — no key needed

Hooks

website_created website_deleted

Permissions

websites.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.2.3 — New Help tab (administrators and domain owners): setting up a Cloudflare token step by step, the permissions each feature needs (Zone Settings: Edit for I'm Under Attack mode and SSL), how several domains and per-domain tokens behave, and fixes for common messages. Every table (DNS records, IP access rules, top countries, My Domains) shows 15 rows a page with filters. Verify checks the token typed in the field before it is saved (and Account API Tokens), and a failed request now shows an error instead of doing nothing. A domain owner's Publish button works again. The TLS & HSTS card is laid out as one setting per row, with the HSTS options greyed out while HSTS is off. 1.2.2 — New Security and Analytics tabs. Security: the I'm Under Attack switch (turning it off restores the previous security level), the security level, Development Mode, and zone IP Access Rules (block, challenge or allow an IP, a CIDR range, an ASN or a country; inputs are checked before they reach Cloudflare). SSL & Cache now shows and edits the minimum TLS version, HSTS, the caching level and the Browser Cache TTL. Analytics shows requests, bandwidth, the cached share, threats and the top countries for the last 24 hours, 7 days or 30 days, and says so when the zone's plan does not keep data that far back. A token without the permission an action needs gets a message naming that permission (e.g. Zone Settings: Edit, Firewall Services: Edit, Analytics: Read). 1.2.1 — Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. 1.2.0 — Automatic publishing to Cloudflare is now opt-in (new "Publish panel DNS changes to Cloudflare automatically" switch, off by default): saving a token no longer makes every panel DNS edit or Panel Settings save copy the whole local zone over Cloudflare, which could repoint records the panel does not serve (e.g. mail). "Publish now" is unchanged. 1.1.1 — Auto-DNS never creates an A record with a private address: behind NAT the panel's configured IP is the private one, so the server's public IP is looked up instead. Real visitor IP: one switch makes Apache (mod_remoteip) or Nginx (real_ip) trust CF-Connecting-IP from Cloudflare's published ranges only, so logs, fail2ban, rate limits and apps see the visitor instead of Cloudflare. The config is validated before reload and rolled back if the web server rejects it.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/cloudflare/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "cloudflare",
  "version": "1.2.3",
  "download_url": "..."
}