262 lines
6.1 KiB
Markdown
262 lines
6.1 KiB
Markdown
# Common Cloudflare Issues and Solutions
|
|
|
|
## Redirect Loop Errors (ERR_TOO_MANY_REDIRECTS)
|
|
|
|
### Symptom
|
|
Browser displays "This page isn't working" or "ERR_TOO_MANY_REDIRECTS"
|
|
|
|
### Common Causes
|
|
|
|
#### 1. SSL Mode Mismatch (Most Common)
|
|
**Scenario:** Origin server enforces HTTPS, but Cloudflare SSL mode is "Flexible"
|
|
|
|
**Explanation:**
|
|
- Browser → HTTPS → Cloudflare
|
|
- Cloudflare → HTTP → Origin Server (because of Flexible mode)
|
|
- Origin Server → Redirects to HTTPS (because it enforces HTTPS)
|
|
- Infinite loop
|
|
|
|
**Affected Platforms:**
|
|
- GitHub Pages
|
|
- Netlify
|
|
- Vercel
|
|
- Heroku
|
|
- Most modern hosting platforms
|
|
|
|
**Solution:**
|
|
Change SSL mode from "Flexible" to "Full" or "Full (strict)"
|
|
|
|
```bash
|
|
# Diagnose
|
|
python scripts/check_cloudflare_config.py example.com user@example.com API_KEY
|
|
|
|
# Fix
|
|
python scripts/fix_ssl_mode.py example.com user@example.com API_KEY full --purge-cache
|
|
```
|
|
|
|
#### 2. Conflicting Page Rules
|
|
**Scenario:** Multiple redirect rules that conflict with each other
|
|
|
|
**Solution:**
|
|
- Review Page Rules in Cloudflare Dashboard
|
|
- Remove conflicting "Always Use HTTPS" or "Forwarding URL" rules
|
|
- Ensure redirect rules don't create loops
|
|
|
|
#### 3. Origin Server Misconfiguration
|
|
**Scenario:** Origin server has incorrect redirect rules in .htaccess or nginx config
|
|
|
|
**Solution:**
|
|
- Check origin server configuration
|
|
- Verify redirects don't conflict with Cloudflare settings
|
|
- Test direct origin access (bypass Cloudflare)
|
|
|
|
### Resolution Steps
|
|
|
|
1. **Check SSL mode:**
|
|
```bash
|
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
|
|
-H "X-Auth-Email: email" \
|
|
-H "X-Auth-Key: key"
|
|
```
|
|
|
|
2. **Fix SSL mode if needed:**
|
|
```bash
|
|
python scripts/fix_ssl_mode.py domain.com email API_KEY full
|
|
```
|
|
|
|
3. **Purge cache:**
|
|
```bash
|
|
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
|
|
-H "X-Auth-Email: email" \
|
|
-H "X-Auth-Key: key" \
|
|
-d '{"purge_everything":true}'
|
|
```
|
|
|
|
4. **Clear browser cache or use incognito mode**
|
|
|
|
---
|
|
|
|
## DNS Resolution Issues
|
|
|
|
### Symptom
|
|
Website not accessible or showing old content
|
|
|
|
### Common Causes
|
|
|
|
#### 1. DNS Not Propagated
|
|
**Solution:** Wait 24-48 hours for full DNS propagation
|
|
|
|
Check propagation:
|
|
```bash
|
|
dig domain.com
|
|
nslookup domain.com
|
|
```
|
|
|
|
#### 2. Incorrect DNS Records
|
|
**Solution:**
|
|
- Verify A/AAAA/CNAME records point to correct IPs
|
|
- For GitHub Pages: Use A records to GitHub IPs or CNAME to username.github.io
|
|
- Ensure "Proxied" status matches requirements
|
|
|
|
#### 3. DNSSEC Issues
|
|
**Solution:**
|
|
- Check DNSSEC status in Cloudflare Dashboard
|
|
- Verify DS records at registrar match Cloudflare's DNSSEC settings
|
|
|
|
---
|
|
|
|
## SSL/TLS Certificate Errors
|
|
|
|
### Symptom
|
|
"Your connection is not private" or "NET::ERR_CERT_COMMON_NAME_INVALID"
|
|
|
|
### Common Causes
|
|
|
|
#### 1. Universal SSL Certificate Provisioning Delay
|
|
**Solution:** Wait 15-30 minutes for Cloudflare to provision certificate
|
|
|
|
#### 2. CAA Records Blocking Certificate Issuance
|
|
**Solution:**
|
|
- Check CAA records
|
|
- Ensure CAA allows Let's Encrypt: `letsencrypt.org` or Cloudflare CAs
|
|
|
|
#### 3. Full (Strict) Mode with Invalid Origin Certificate
|
|
**Solution:**
|
|
- Use "Full" mode instead of "Full (strict)" if origin cert is self-signed
|
|
- Or install valid certificate on origin server
|
|
|
|
---
|
|
|
|
## Performance Issues
|
|
|
|
### Symptom
|
|
Slow page load times despite using Cloudflare
|
|
|
|
### Common Causes
|
|
|
|
#### 1. Cache Not Configured
|
|
**Solution:**
|
|
- Enable Auto Minify (JS, CSS, HTML)
|
|
- Set up Page Rules for cache levels
|
|
- Configure Browser Cache TTL
|
|
|
|
#### 2. Large Assets Not Optimized
|
|
**Solution:**
|
|
- Enable Cloudflare Image Optimization
|
|
- Use WebP format
|
|
- Implement lazy loading
|
|
|
|
#### 3. Too Many Uncached Requests
|
|
**Solution:**
|
|
- Review cache analytics
|
|
- Add cache rules for static assets
|
|
- Use Cloudflare Workers for dynamic caching
|
|
|
|
---
|
|
|
|
## Access Denied / 403 Errors
|
|
|
|
### Symptom
|
|
"Error 1020: Access Denied" or generic 403
|
|
|
|
### Common Causes
|
|
|
|
#### 1. Firewall Rules Blocking Traffic
|
|
**Solution:**
|
|
- Review Firewall Rules in Security → WAF
|
|
- Check IP Access Rules
|
|
- Verify Managed Rulesets aren't too strict
|
|
|
|
#### 2. Rate Limiting
|
|
**Solution:**
|
|
- Check Rate Limiting rules
|
|
- Adjust thresholds if legitimate traffic is blocked
|
|
|
|
#### 3. Browser Integrity Check
|
|
**Solution:**
|
|
- Disable "Browser Integrity Check" if needed
|
|
- Found in: Security → Settings
|
|
|
|
---
|
|
|
|
## Origin Server Errors (502/503/504)
|
|
|
|
### Symptom
|
|
"502 Bad Gateway" or "504 Gateway Timeout"
|
|
|
|
### Common Causes
|
|
|
|
#### 1. Origin Server Down
|
|
**Solution:**
|
|
- Verify origin server is running
|
|
- Check origin server logs
|
|
- Test direct IP access
|
|
|
|
#### 2. Origin SSL Certificate Invalid (Full Strict mode)
|
|
**Solution:**
|
|
- Switch to "Full" mode temporarily
|
|
- Fix origin certificate
|
|
- Or use Cloudflare Origin Certificate
|
|
|
|
#### 3. Timeout Issues
|
|
**Solution:**
|
|
- Increase origin server timeout settings
|
|
- Optimize slow queries/code
|
|
- Consider using Cloudflare Workers for timeouts
|
|
|
|
---
|
|
|
|
## Page Rules Not Working
|
|
|
|
### Symptom
|
|
Page Rules don't seem to apply
|
|
|
|
### Common Causes
|
|
|
|
#### 1. Rule Order
|
|
**Solution:** Page Rules are executed top-to-bottom; reorder if needed
|
|
|
|
#### 2. Pattern Matching Issues
|
|
**Solution:**
|
|
- Use `*` for wildcards correctly
|
|
- Test patterns: `example.com/*` vs `*example.com/*`
|
|
|
|
#### 3. Cache Already Set
|
|
**Solution:** Purge cache after creating/modifying Page Rules
|
|
|
|
---
|
|
|
|
## Troubleshooting Workflow
|
|
|
|
### Step 1: Identify the Issue
|
|
- Collect error messages and codes
|
|
- Note when issue started
|
|
- Check if issue is intermittent or consistent
|
|
|
|
### Step 2: Check Cloudflare Status
|
|
- Visit https://www.cloudflarestatus.com
|
|
- Verify no ongoing incidents
|
|
|
|
### Step 3: Run Diagnostics
|
|
```bash
|
|
python scripts/check_cloudflare_config.py domain.com email API_KEY
|
|
```
|
|
|
|
### Step 4: Review Recent Changes
|
|
- Check Cloudflare Audit Log
|
|
- Review recent DNS/SSL/Page Rule changes
|
|
|
|
### Step 5: Test Bypass
|
|
- Temporarily set DNS to "DNS Only" (grey cloud)
|
|
- Test if issue persists without Cloudflare
|
|
|
|
### Step 6: Apply Fixes
|
|
- Implement specific solutions based on diagnosis
|
|
- Purge cache after changes
|
|
- Test in incognito/private mode
|
|
|
|
### Step 7: Monitor
|
|
- Verify fix works consistently
|
|
- Check analytics for any anomalies
|
|
- Document solution for future reference
|