Does it have to be Cloudflare specifically, or would another CDN work?

It doesn't have to be, but Cloudflare is the most common free option with a convenient cf-ipcountry header and simple setup, which is why it's become the unofficial standard in PWA arbitrage.

Is cf-ipcountry alone enough for cloaking, with no other checks?

No — the geo header filters out obviously off-target traffic but doesn't catch datacenter IPs, proxies/VPNs or bots operating from within the target country, so it should be one filter among several, not the only one.

How long does connecting a domain through Cloudflare take?

The nameserver change at the registrar usually propagates anywhere from a few minutes to a couple of hours, after which the domain is already running through Cloudflare with HTTPS active.

Which SSL mode should a PWA use in Cloudflare?

"Full" or "Full (strict)" is usually the recommended choice — both encrypt the entire path from visitor to server, unlike "Flexible," which only protects part of the route.

Does Cloudflare still need manual setup if domains are bought and connected through APEX?

No — in APEX, HTTPS issuance and domain connection are already built into the platform, so a separate manual Cloudflare setup isn't needed.

Cloudflare for PWA: Setup Guide

Putting Cloudflare between a domain and a PWA solves three problems at once: free HTTPS, faster loading through its CDN, and a handy cf-ipcountry header that simplifies geo-based cloaking. Here's why that matters specifically in PWA arbitrage and how to connect a domain through Cloudflare step by step.

Why put Cloudflare between the domain and the PWA

Pointing a domain straight at PWA hosting works, but it gives up a few things: no proxy layer means it's harder to hide the server's real IP, there's no free CDN acceleration for static assets, and there's no convenient access to visitor geo-data at the header level. Cloudflare as a proxy handles all three at once and stays free on the basic plan, which covers most setups.

HTTPS without a separate certificate

Cloudflare issues and renews the SSL certificate automatically once the proxy is on — no need to manually obtain and renew a certificate on the server the way direct hosting requires. That's especially useful with frequent domain rotation: a new domain connects to Cloudflare and is serving HTTPS within minutes, with no manual steps.

Faster loading through the CDN

A PWA loads faster when static files (icons, styles, cacheable assets) get served from the CDN edge closest to the user instead of one server halfway around the world. First-screen speed directly affects bounce rate and cost per click on sources like TikTok and Google Ads, so the CDN isn't a technical footnote — it's a campaign-economics factor.

cf-ipcountry and other headers for cloaking

Cloudflare adds a cf-ipcountry header to each request with the visitor's geo, resolved at the network level rather than through less reliable client-side methods — that simplifies the first cloaking filter: reject traffic outside the target countries before running finer checks on user agent and IP intelligence. In an APEX setup it's just one signal the cloak weighs alongside datacenter/proxy/VPN filters and behavioral patterns, not the only criterion.

Connecting a domain step by step

Add the domain to a Cloudflare account, then update the nameserver records at the registrar to the ones Cloudflare assigns — that's the only step that touches the registrar's own settings. From there, set an A/CNAME DNS record pointing to the PWA host in the Cloudflare dashboard, turn on the proxy (the orange cloud), and set SSL mode to "Full" or "Full (strict)" — once the nameserver change propagates (usually anywhere from a few minutes to a couple of hours), the domain is already serving HTTPS through Cloudflare.

What not to forget after connecting

Check the SSL mode specifically — "Flexible" only encrypts the leg between the visitor and Cloudflare, not between Cloudflare and the server, which can cause mismatches with some PWA hosting setups; "Full" or "Full (strict)" is more reliable end to end. Set caching so the cloaked HTML landing page itself doesn't get cached — otherwise different visitors can end up served a cached version meant for someone else.

How this speeds up domain rotation in APEX

Domain rotation in PWA arbitrage lives or dies on how fast a new domain gets HTTPS and starts serving content at acceptable speed — pairing with Cloudflare handles both automatically. In APEX, domain connection (HTTPS issuance included) is already built into the platform interface, so there's no need to configure Cloudflare separately — a domain gets added and switched within the pool in one click.

FAQ

Does it have to be Cloudflare specifically, or would another CDN work?: It doesn't have to be, but Cloudflare is the most common free option with a convenient cf-ipcountry header and simple setup, which is why it's become the unofficial standard in PWA arbitrage.
Is cf-ipcountry alone enough for cloaking, with no other checks?: No — the geo header filters out obviously off-target traffic but doesn't catch datacenter IPs, proxies/VPNs or bots operating from within the target country, so it should be one filter among several, not the only one.
How long does connecting a domain through Cloudflare take?: The nameserver change at the registrar usually propagates anywhere from a few minutes to a couple of hours, after which the domain is already running through Cloudflare with HTTPS active.
Which SSL mode should a PWA use in Cloudflare?: "Full" or "Full (strict)" is usually the recommended choice — both encrypt the entire path from visitor to server, unlike "Flexible," which only protects part of the route.
Does Cloudflare still need manual setup if domains are bought and connected through APEX?: No — in APEX, HTTPS issuance and domain connection are already built into the platform, so a separate manual Cloudflare setup isn't needed.

Build your PWA in APEX in minutes

Cloaking, anti-bot, push, split tests and your own domains — in one service.

Get started free