When the host already runs Cloudflare
Kinsta includes a Cloudflare integration on every site, and WP Engine's Global Edge Security and Advanced Network are built on Cloudflare. Putting your own Cloudflare zone in front means two Cloudflare layers. Cloudflare's documentation for this two-zone routing, which it calls O2O, says your zone's settings are applied to traffic first, then the provider's. Its documentation says this only applies when the two zones belong to different Cloudflare accounts, relies on a proxied CNAME rather than an apex A record, and needs Cloudflare to be your authoritative DNS.
The practical consequence: your page rules, cache rules and firewall run before the host's, so a rule that caches or blocks the wrong thing breaks the site before the host ever sees the request. Logged-in members and checkout pages are the usual casualties.
What each host documents
| Topic | Kinsta | WP Engine | SiteGround |
|---|---|---|---|
| Built-in Cloudflare layer | Free Cloudflare integration on all sites | Global Edge Security (an extension that can be purchased on any plan and is included with Secure Hosting plans); Advanced Network certificates are also installed through Cloudflare | Own SiteGround CDN offered as an alternative to Cloudflare |
| Own Cloudflare account | Documented: switch the site to your own account alongside Kinsta's integration | Not documented for GES; the reverse proxy guide calls reverse proxies complex and typically not recommended, and support will not troubleshoot beyond it | Documented: activate through your own Cloudflare account |
| DNS records | Nameservers to Cloudflare; remove A records; proxied CNAMEs for apex and www to yoursite.hosting.kinsta.cloud | GES uses a CNAME containing wpeproxy.com (CNAME flattening preferred) or two A records | Follow Cloudflare's activation steps |
| SSL mode named in docs | Full | GES connects to the origin with Full | Strict instead of Flexible |
| Known conflicts | APO incompatible with Edge Caching; your page rules apply first; Pause Cloudflare not supported; Argo Tunnel, Pages, Railgun and WebSocket not supported | Second WAF not recommended with GES; GES rules are managed by WP Engine and not customisable | Flexible SSL causes a redirect loop |
Cloudflare SSL modes, and which one to pick
Cloudflare strongly recommends Full or Full (strict). The loop happens because Flexible sends plain HTTP to the host, the host or WordPress redirects it to HTTPS, and Cloudflare sends it back as HTTP again.
| Mode | Visitor to Cloudflare | Cloudflare to host | Use with a managed host? |
|---|---|---|---|
| Off | HTTP | HTTP | No |
| Flexible | HTTPS possible | HTTP, unencrypted | No: Kinsta and SiteGround both name it as the cause of redirect loops |
| Full | HTTP or HTTPS | Matches the visitor: HTTPS without validating the host certificate, or HTTP for HTTP visitors | Yes: the mode Kinsta specifies and GES uses |
| Full (strict) | HTTP or HTTPS | Like Full, but the host certificate is validated | Yes, once the host certificate is valid for the hostname |
| Strict (SSL-only origin pull) | HTTP or HTTPS | Always HTTPS with validation | Rarely needed: it uses HTTPS to the host even for plain HTTP visitor requests |
A setup order that avoids certificate and redirect loops
- 1. Add the domain at the host and confirm the site loads over HTTPS with DNS only (grey cloud), so the host certificate exists first
- 2. Create the Cloudflare zone and check every imported record, especially MX and TXT records for email
- 3. Set SSL/TLS to Full (or Full strict once the host certificate validates) before turning the proxy on
- 4. At Kinsta, replace A records with CNAMEs to yoursite.hosting.kinsta.cloud as the docs describe
- 5. Switch nameservers to Cloudflare, then enable the orange cloud on the web records
- 6. Test as a logged-out visitor, a logged-in member and a buyer reaching checkout
- 7. Purge cache at every layer (Cloudflare, host, plugin) after any change
- 8. On WP Engine, agree the plan with support first, because GES and its Advanced Network already sit on Cloudflare
What changes for a membership or course site
Caching rules are the main risk. Kinsta says page rules in your Cloudflare account take priority and cache-related ones may behave unexpectedly, and that APO cannot be used together with Kinsta's Edge Caching. A rule that caches lesson pages for everyone can show one member's progress to another, so exclude logged-in sessions and checkout.
Firewall rules run in your account first. Kinsta says you can tighten them but cannot override IPs Kinsta has blocked. If you proxy through Cloudflare Free or Pro, uploads over 100MB fail with a 413 error, which matters for course packages.
When you need to pause Cloudflare to diagnose a fault, Kinsta says its Pause feature is not supported and suggests switching the CNAMEs to DNS only instead.
Who should not add their own Cloudflare layer
If the reason is only a free CDN or SSL, skip it: Kinsta's integration already provides Cloudflare and free wildcard SSL, WP Engine's GES provides a Cloudflare WAF and CDN, and SiteGround offers its own CDN. Add your own account when you need something specific, such as your own WAF rules, Cloudflare products on other subdomains, or one dashboard across several hosts, and when someone will maintain the rules.
Questions before you decide
Which Cloudflare SSL mode should I use with Kinsta?
Kinsta's Cloudflare documentation says to set the SSL/TLS encryption mode to Full. Flexible is the usual cause of ERR_TOO_MANY_REDIRECTS, and Cloudflare itself recommends Full or Full (strict).
Can I put my own Cloudflare account in front of WP Engine Global Edge Security?
WP Engine's GES documentation does not describe that setup, says it does not recommend a secondary WAF with GES, and its reverse proxy guide calls reverse proxies typically not recommended. Confirm with WP Engine before changing DNS.
Why does my SiteGround site loop after enabling Cloudflare?
SiteGround's knowledge base says Cloudflare defaults to Flexible SSL, which fetches the site over plain HTTP and loops when the site forces HTTPS. Change the mode from Flexible to Strict.
Can I use Cloudflare APO on Kinsta?
Only without Kinsta's Edge Caching. Kinsta's Cloudflare documentation says the two caching methods are incompatible.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Kinsta docs: Cloudflare Accessed 30 Oct 2026
- WP Engine support: Global Edge Security Accessed 30 Oct 2026
- WP Engine support: Using a reverse proxy Accessed 30 Oct 2026
- WP Engine support: SSL certificates Accessed 30 Oct 2026
- SiteGround KB: Redirect loop after enabling Cloudflare Accessed 30 Oct 2026
- SiteGround KB: Activate Cloudflare CDN Accessed 30 Oct 2026
- Cloudflare docs: Encryption modes Accessed 30 Oct 2026
- Cloudflare docs: How Cloudflare for SaaS works (O2O) Accessed 30 Oct 2026
- Cloudflare docs: Request limits by plan Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.