Using Cloudflare
Putting Cloudflare in front of your own domain, in the order that works, and the two settings that break it.
You can run your domain through Cloudflare. Plenty of shops do, for the caching and the protection, and the shop works normally behind it.
There is an order to it, though, and doing it the other way round leaves you with a domain that will not verify and a certificate that will not issue.
Do it in this order
1. Add the domain here first, with Cloudflare's proxy turned off. In Cloudflare, the record for your domain should show a grey cloud, not an orange one. Grey means Cloudflare answers with our address instead of its own.
2. Verify it in your admin, under Settings, Domains. We check that the domain really points at us, which is what stops somebody pointing a domain they do not own at your shop.
3. Load the site once over https. The certificate is issued the first time somebody asks for it, which takes a few seconds. After that it renews itself forever and you never think about it again.
4. Now turn the orange cloud on. From here Cloudflare sits in front, and everything carries on working.
Turning the proxy on first is the usual mistake
With the orange cloud on, your domain resolves to Cloudflare rather than to us, so our check cannot see that it points here and verification fails. Nothing is broken, it just will not finish. Set the cloud to grey, verify, then set it back.
The one setting that matters
In Cloudflare, under SSL/TLS, the encryption mode must be Full or Full (strict).
Flexible will break your shop. It talks to us without encryption, we send the visitor to the encrypted address, Cloudflare sends them back again, and the browser gives up with a redirect loop. It is the single most common Cloudflare problem and it looks like a fault at our end.
Use Full while you are setting up. Full (strict) also works, but only once your certificate has been issued here, so it is the safer choice afterwards rather than during.
What Cloudflare will and will not cache
Pages are not cached, deliberately. A cart, a logged-in account and a checkout are different for every visitor, and we tell Cloudflare so on every page. Styling, scripts and images are cached hard, because they carry a fingerprint in the filename and can never change without changing their address.
That means a Cloudflare cache purge is almost never the answer to something looking wrong on your shop. If a change is not showing, it is worth checking here first.
Your customers' addresses still reach us
Cloudflare stands between your shoppers and us, so without care every order would record a Cloudflare data centre instead of the customer. We read the real address from Cloudflare and use that, so order records, fraud screening and anything else that cares about where a visitor came from keep working normally.
Nothing to configure. It happens only for requests that genuinely arrive from Cloudflare, so it cannot be spoofed by somebody claiming to be one of your customers.