Enhance your Webflow site with Cloudflare security and performance features.
Orange-to-Orange (O2O) allows you to use Cloudflare’s performance and security features alongside Webflow hosting. When O2O is enabled, traffic to your site goes to Cloudflare first — where your chosen features are applied — and then to Webflow, which serves your site to visitors.
What you can do with O2O
With O2O enabled, you can layer Cloudflare’s features on top of Webflow hosting — adding more ways to protect your site and manage traffic. For example:
For the full list of supported features, check out Cloudflare’s product compatibility guide.
Enable O2O for your domain
To use O2O, you need to add and configure your domain in Cloudflare, then connect it to your Webflow.
Before you get started
Before setting up O2O, you’ll need:
Add and configure your domain in Cloudflare
Pro tip
You can add a domain and enable O2O on any Cloudflare zone plan,
including the Free plan.
If you already manage your domain in Cloudflare, you can skip to Configure your DNS records.
Add your domain
In the Cloudflare dashboard, click Onboard a domain
Enter your root (apex) domain (e.g., yourdomain.com) and complete the setup steps
Update your domain’s nameservers with your registrar, following Cloudflare’s instructions
Important
After you update your domain’s nameservers (NS records), it can take
up to 48 hours for the change to take effect.
You can use a free DNS checker, such as
whatsmydns.net, to confirm
when your nameservers have updated:
- Enter your domain
-
Choose NS from the dropdown
-
Click Search
Wait until your domain’s nameservers show as updated in all locations
before you configure your DNS records in Cloudflare.
Configure your DNS records
In your domain’s DNS settings in Cloudflare, create a proxied CNAME record for each version of your domain you want to use with O2O.
Cloudflare uses @ to represent your root domain (e.g., yourdomain.com). For subdomains, enter the domain prefix — for example, for www.yourdomain.com, enter www.
|
Name |
Target (value) |
Proxy status |
| CNAME |
@ |
cdn.webflow.com |
Proxied (orange cloud enabled) |
| CNAME |
www |
cdn.webflow.com |
Proxied (orange cloud enabled) |
Most sites use both the root domain (@) and the www subdomain — we recommend adding records for both so all traffic is covered. If you use additional subdomains (e.g., blog.yourdomain.com), add a record for each one as well.
Note
If you’ve previously connected your domain to Webflow using Cloudflare
DNS (for example, with two A records or
proxy-ssl.webflow.com), you’ll need to
update your DNS records before enabling the Cloudflare proxy.
Note
If your domain uses CAA (Certification Authority Authorization) records,
make sure they allow
Let’s Encrypt and Google Trust Services. Otherwise, SSL certificates
for your site may fail to provision or renew.
Learn how to configure CAA records for Webflow SSL.
Connect, verify, and publish your custom domain in Webflow
Go to Site settings > Publishing > Production
Quick connect your custom domain (recommended), or manually connect your custom domain if quick connect isn’t available
Click Verify domain to confirm the connection
Set a default domain
Publish your site to your custom domain
Note
When the Cloudflare proxy is enabled, your domain may still show
“Update needed” in
Site settings > Publishing > Production.
This is expected, as the proxy hides your DNS records from Webflow’s verification check.
If your site is published and loading correctly, no action is needed.
Troubleshooting O2O
Once you’ve added your domain to Cloudflare and created the CNAME record, your domain is set up to use O2O. You can now turn on Cloudflare features like WAF, Bot protection, and Waiting Room, or explore other compatible features in Cloudflare’s product compatibility guide.
If you encounter issues with any Cloudflare features you’ve enabled, contact Cloudflare Support for help.
525 Handshake Error
If you see a “525 Handshake Error,” the Cloudflare proxy (orange cloud) may be enabled for your Webflow DNS records. For standard Webflow hosting, set the proxy status to DNS only (grey cloud).
If you want to use Cloudflare’s performance and security features alongside Webflow hosting, set up Orange-to-Orange (O2O) instead.
Important
If your domain uses Cloudflare’s Zone Hold feature, SSL certificate generation may fail during connection or migration. This can prevent your site from going live or cause downtime if it was previously published.
This happens because Cloudflare blocks Webflow from issuing SSL certificates for held zones. To resolve the issue, release the Zone Hold in your Cloudflare account.
After your SSL certificate has been successfully generated, you can safely re-enable Zone Hold.