A›ANGLEMODULES

Cloudflare Manager for WHMCS

Documented release: 2.2.0
Licence product slug: cloudflare-module
Addon directory: modules/addons/cloudflare_manager
Server module directory: modules/servers/cloudflare

1. Overview

Cloudflare Manager combines a WHMCS addon and provisioning server module. The addon stores configuration, tracks zones, provides administration pages and handles authenticated customer actions. The server module connects WHMCS service lifecycle events to Cloudflare and displays the customer zone dashboard.

Both components are required.

2. Compatibility and requirements

  • WHMCS 8.10 or 9.x
  • PHP 8.1–8.3
  • MySQL 5.7+ or MariaDB 10.3+
  • PHP cURL and OpenSSL extensions
  • HTTPS-enabled WHMCS installation
  • Correct WHMCS System URL
  • Cloudflare account ID
  • Scoped Cloudflare API token
  • At least one domain/zone reserved for staging tests
  • Active AngleModules licence

Cloudflare feature availability depends on the zone’s Cloudflare plan, account status and current API permissions.

3. Before installation

  1. Back up WHMCS files and database.
  2. Create a least-privilege Cloudflare API token rather than using a broad global key.
  3. Prepare a non-production domain for lifecycle testing.
  4. Confirm whether termination should really delete the external Cloudflare zone.
  5. Do not enable paid-plan changes until Cloudflare billing behavior is verified for your account.

4. Installation

  1. Extract the release archive.

  2. Upload the included modules directory into the WHMCS root, preserving paths:

    /path/to/whmcs/modules/addons/cloudflare_manager/
/path/to/whmcs/modules/servers/cloudflare/

  3. Open WHMCS Admin → System Settings → Addon Modules.

  4. Activate Cloudflare DNS & CDN Manager.

  5. Grant addon access only to appropriate administrator roles.

  6. Open the addon and activate the AngleModules licence.

  7. Configure the Cloudflare account ID and API token.

  8. Test the API connection before creating a product.

5. Licence activation

  1. Open Addons → Cloudflare Manager → Licence.
  2. Enter the customer licence key.
  3. Activate or refresh the licence.
  4. Verify that the product is cloudflare-module and the hostname matches the WHMCS System URL.

Only the licence key is entered by the customer. The RSA public key and licensing endpoint are embedded. Never upload or distribute the private signing key.

6. Cloudflare API token

Create a scoped token in the Cloudflare dashboard. Permissions must match the features you allow. Broadly, the module may require access to:

  • Zone read/edit
  • DNS read/edit
  • Zone settings read/edit
  • Cache purge
  • Analytics read
  • Firewall/IP access rules read/edit
  • Page Rules read/edit when used and still available for the account

Limit token resources to the intended Cloudflare account or zones wherever possible. Cloudflare permission names and product availability can change; confirm them in the current official Cloudflare API documentation when creating the token.

Do not place the token in screenshots, tickets, browser-side code or public logs.

7. Creating a WHMCS product

  1. Open System Settings → Products/Services.
  2. Create or edit the intended product.
  3. Open Module Settings.
  4. Select the cloudflare provisioning module.
  5. Configure:
    • Cloudflare plan
    • Default SSL mode
    • Always Use HTTPS
    • DNS scan/import option where applicable
  6. Choose the WHMCS automatic setup behavior.
  7. Save the product.
  8. Place an order for the staging domain.

The service domain is used as the Cloudflare zone name. Confirm it is correct before accepting the order.

8. Provisioning lifecycle

Create

On CreateAccount, the module searches for an existing zone with the service domain. If found, it tracks that zone. Otherwise, it creates a new zone, stores its ID, applies the default SSL/HTTPS settings where possible, and records returned nameservers.

Suspend

On SuspendAccount, the module requests that Cloudflare pause the zone and marks the local record paused.

Unsuspend

On UnsuspendAccount, the module unpauses the zone and marks the local record active.

Terminate

On TerminateAccount, the module deletes the Cloudflare zone and clears the generated nameserver display data from the WHMCS service.

Termination is destructive. It can remove DNS configuration and interrupt the customer’s website, mail and other services. Require staff confirmation and maintain Cloudflare-side backups/change records appropriate to your operations.

Change Package

The module attempts to change the Cloudflare plan to the product’s selected plan. Paid Cloudflare plans can require Cloudflare billing/subscription support that is not supplied by WHMCS. Test the exact upgrade/downgrade flow before selling it.

9. Zone tracking and synchronization

The authoritative local association is stored in the module’s zone table. If a matching product custom field containing zone_id exists, the module can also store the ID there. Legacy dedicated-IP values may be read for migration compatibility, but current releases do not repurpose the dedicated-IP field for new data.

Use Sync Zone Status to refresh status, plan and nameserver information from Cloudflare. Synchronization does not guarantee that every external setting is copied into WHMCS.

10. Customer dashboard

An authenticated customer can access only a zone associated with a WHMCS service they own. Customer actions require a session-specific CSRF token.

The interface exposes supported controls for:

  • Zone information and nameservers
  • DNS records
  • Cloudflare proxy status
  • SSL mode
  • Always Use HTTPS and supported zone settings
  • Cache level and browser-cache TTL
  • Full and selective cache purge
  • Development mode
  • Selected CDN/performance controls
  • Page Rules
  • Firewall/IP rules
  • Zone analytics

Controls unavailable on the customer’s Cloudflare plan may return an API error. The module cannot bypass Cloudflare plan limits.

11. DNS management

The underlying API client supports creating, updating and deleting common DNS records and changing proxy status. Common types include A, AAAA, CNAME, MX, TXT, SRV and NS.

Operational warnings:

  • Proxying is not available for every record type.
  • Incorrect MX, TXT or SRV records can break mail or verification.
  • Deleting the last valid origin record can take a site offline.
  • DNS changes can require propagation time outside the module’s control.

For sensitive customers, restrict access or maintain a documented recovery process.

12. SSL, HTTPS, CDN and cache

Supported API operations include SSL mode changes, Always Use HTTPS, cache level, browser-cache TTL, development mode, cache purge and selected optimization/protocol settings.

Choosing the wrong SSL mode can cause redirect loops or origin certificate errors. Use Full (strict) only when the origin presents a valid certificate suitable for the hostname.

Selective cache purge requires valid URLs belonging to the zone. Full purge can temporarily increase origin traffic.

13. Security and firewall controls

Supported actions include security-level changes, browser integrity checks and IP firewall/access rules. Availability depends on Cloudflare account and plan behavior.

A mistaken block rule can lock out staff or customers. Test new rules against a staging zone and keep direct Cloudflare dashboard access for recovery.

14. Page Rules warning

The module contains Page Rules API operations. Cloudflare has been moving rule functionality toward newer Rules products, and Page Rules availability/limits can vary. Treat this feature as compatibility functionality, test it on the intended account and do not promise unlimited or future-guaranteed Page Rules support.

15. Analytics

The customer dashboard can request zone analytics for supported time ranges. Analytics availability, delay and granularity are controlled by Cloudflare. Values should not be presented as billing-grade measurements.

16. Administration interface

Administrators can use the addon to:

  • Review connection/API status
  • Review locally tracked zones
  • Synchronize zone information
  • Inspect API/module errors
  • Clear appropriate module logs using a CSRF-protected action
  • Review licence and installation information

Credentials are excluded from the module’s safe provisioning log context. Still redact logs before sharing because domains, customer IDs and service IDs can remain sensitive.

17. Upgrade

  1. Back up WHMCS files and database.
  2. Record the installed addon and server-module versions.
  3. Upload both updated component directories over the existing directories.
  4. Do not delete module database tables.
  5. Open the addon and confirm licence/API status.
  6. Confirm an existing customer zone loads.
  7. Test DNS add/edit/delete, proxy toggle and cache purge on staging.
  8. Test create, suspend, unsuspend and terminate using a disposable zone.

Do not upgrade only one of the two components. Mixed versions can produce incompatible behavior.

18. Deactivation and removal

Addon deactivation preserves local settings and zone records. It does not delete Cloudflare zones.

Deleting WHMCS module files also does not remove external Cloudflare resources. Review zones directly in Cloudflare before permanent removal.

Do not delete the module tables until required mappings and audit information have been exported and backed up.

19. Security guidance

  • Use a least-privilege API token restricted to required resources.
  • Use HTTPS and an accurate WHMCS System URL.
  • Limit addon access by administrator role.
  • Preserve customer ownership and CSRF checks.
  • Rotate the Cloudflare token if it appears in logs or screenshots.
  • Keep emergency direct access to the Cloudflare dashboard.
  • Do not enable destructive lifecycle actions without operational review.
  • Review Cloudflare audit logs after unexpected changes.

20. Common problems

API connection fails

Confirm token validity, account ID, token resource scope, required permissions, server outbound HTTPS, DNS resolution and system time.

“No domain specified”

Enter a valid domain on the WHMCS service. The module needs it as the zone name.

“No zone ID found”

Use Sync Zone Status, verify the local zone mapping and confirm that the zone still exists in Cloudflare.

Zone exists but is not visible to the customer

Confirm the zone’s local record contains the correct WHMCS service ID and client ID, the service belongs to the signed-in customer, and the addon licence is valid.

DNS or setting action returns forbidden

The API token lacks a required permission, its resource scope excludes the zone, or the customer’s Cloudflare plan does not provide the setting.

SSL change causes a redirect/origin error

Restore the previous SSL mode in Cloudflare and verify the origin certificate and redirect configuration.

Check Cloudflare billing/subscription eligibility and API response details. Do not repeatedly retry a paid change without understanding its billing effect.

Client dashboard never finishes loading

Check browser console/network errors, session authentication, CSRF token, ownership mapping, addon URL and restrictive content-security policy.

Licence rejected

Confirm the licence is active for cloudflare-module, the hostname is authorized and the licensing server is reachable over HTTPS.

21. Known limitations

  • Cloudflare features and permissions vary by plan/account and can change independently of the module.
  • Paid-plan changes require Cloudflare billing compatibility and have not been guaranteed for every account type.
  • Page Rules are a legacy/transitioning Cloudflare feature.
  • The customer service dashboard contains external JavaScript dependencies; restrictive CSP or unavailable CDN assets can affect parts of the interface.
  • Zone analytics are Cloudflare-provided operational data, not billing-grade data.
  • The module does not register domains or automatically update registrar nameservers.
  • Terminating a WHMCS service can delete the external Cloudflare zone.

22. Support checklist

  • Addon and server-module versions
  • WHMCS and PHP versions
  • Service ID, redacted domain and zone ID
  • Requested operation
  • Cloudflare plan
  • Token permission/resource scope without revealing the token
  • Exact Cloudflare API error
  • Redacted WHMCS module/activity logs
  • Confirmation that the action was tested on a non-production zone

23. Official references

  • Cloudflare API documentation: https://developers.cloudflare.com/api/
  • Cloudflare API token creation: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/
  • Cloudflare Page Rules documentation: https://developers.cloudflare.com/rules/page-rules/
ESC
⌕

Search across all three product manuals.