Hello everyone! There was another tutorial on here, but it did not explain how they can secure themself 100% or make it comptiable with IP.Board. That's why i decided to remake a tutorial here.
So let's get started!
1. Register & Install cloudflare FREE On your domain. To do this, visit http://cloudflare.com/.
2. It will now as you to enter all the DNS, you have to do this to make sure the attacker can not reach your website real IP Address. So please add all your dns etc to it! This is really important. Make sure to put the orange cloud on all of your dns..
3. Now change the name servers on the domain you decided to install cloudflare on, to cloudflare's dns/nameserver.
4. You might have to wait untill cloudflare DNS Has successfully been added to your domain, when it is added you can head over to https://www.cloudflare.com/my-websites.html , where you select the wrench icon then you select "Cloudflare Settings".
5. Click the "Security settings" tab. Then make sure that "Basic Protection level" are set to "I'm under attack". This will prevent the attackers to hit your website with attacks such as "Header attack" - "Post attack" - "Get atack"!
6. Please change/select these settings:
E-mail address obfuscation: ON
Server side exclude (SSE): ON
Browser integrity check: ON
Right, that's basically it! However, there is one last step before you can procceed. You have to allow X_FORWARDED_FOR IP matching! To do this, head over to: System Settings > System > Security and Privacy. Then select "Yes" And hit the save button.
When you have cloudflare installed over the "Mail" DNS you might want to use phpsendmail, or a remote mail server / API.
The cloudflare free version will protect you against all kind of attacks, as you have "I'm under attack" mode on. However, if the attack is bigger than 5Gbps it will automaticly send all connections straight to your server. You'll have to upgrade to the enterprise package to protect you against attacks huger than 5Gbps.
Your site should now be fully protected by cloudflare, the reason we decided to put "Orange" cloud on all of your dns is so they can't get the IP Address out of your server. If you left the "ftp" dns open, they could easily ping ftp.domain.com then get your server IP And attack it from there
You can always try to leave the basic protection at "High" instead of "I'm under attack" but that will let the attackers to use Header/Get/Post attacks against your site.
I have never had any problems with cloudflare by using this method, no attacks or anything! With cloudflare you can also block countries, such as China if you're reciving heavy ammounts of spam or botnet attacks from China etc.