Integrating 1C-Bitrix with Cloudflare: Setup and Caching

Integrating 1C-Bitrix with Cloudflare

We often encounter projects where, after moving behind Cloudflare, Bitrix starts misbehaving: IP detection breaks, composite cache conflicts with CDN, and the Security module blocks Cloudflare IPs. Cloudflare speeds up site loading by 3x compared to working without a CDN and reduces server load by 60%. The result is slower speeds, 403 errors, broken statistics — the business loses conversions and money. Integration is not just DNS change, but a systematic configuration of both platforms. In this article, we'll break down typical issues and offer proven solutions that we've applied in 50+ projects.

IP Detection Issues with Cloudflare

Cloudflare proxies traffic, substituting its own IP in REMOTE_ADDR. The real client IP is passed in the CF-Connecting-IP header, as described in the official Cloudflare documentation: "The client IP address can be retrieved from the CF-Connecting-IP header." (source: Cloudflare IP headers). This means all Bitrix modules — proactive filter, statistics, shopping cart — see Cloudflare's IP instead of the real visitor. This leads to incorrect geolocation, blocking real users, and data loss.

Solution: in dbconn.php or .settings.php, override:

if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) { $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP']; } 

Execute this code before kernel initialization. Additionally, verify that the request came from Cloudflare using the official Cloudflare IP ranges. Close ports 80/443 to all IPs except these ranges at the firewall level — otherwise an attacker could spoof the header.

Why Cache Conflicts Occur

Bitrix composite cache and Cloudflare Cache operate at different levels. If both cache HTML, invalidation becomes chaotic: a page is updated in Bitrix, but Cloudflare still serves the old version. Three solutions:

Option 1: Bypass Cloudflare Cache for HTML

In Page Rules, set Cache Level: Bypass for *.php and dynamic pages. Cloudflare caches only static assets (JS, CSS, images). This is the recommended approach for most projects. This option yields a 3x speedup compared to working without CDN.

Option 2: Disable Composite, Cache in Cloudflare

Suitable for informational sites with infrequent updates. Use Edge Cache TTL and purge cache via Cloudflare REST API (call POST /zones/{zone_id}/purge_cache from OnAfterIBlockElementUpdate handler).

Option 3: Combined

Composite works for authenticated users (header Cache-Control: private), Cloudflare caches for anonymous (Cache-Control: public, max-age=300). Separation is implemented in init.php based on $USER->IsAuthorized().

How to Configure SSL Correctly

Cloudflare offers Flexible, Full, and Full (Strict) modes. For Bitrix, the only correct mode is Full (Strict) with a valid certificate on the server. With Flexible, Bitrix considers the connection HTTP, causing infinite redirects and form submissions over HTTP. If you lack a certificate, use the free Cloudflare Origin Certificate for Full (Strict).

SSL mode comparison:

WAF Operation: Double Protection

Bitrix security module and Cloudflare WAF work simultaneously. To avoid false blocks, set WAF as the first line of defense (attacks, bots, DDoS) and Bitrix proactive filter as the second (CMS-specific attacks). Do not disable either — they complement each other.

Work Scope and Deliverables

When ordering turnkey integration, we provide:

• Documentation: architecture description, network diagrams, configs.
• Access: Cloudflare logins, certificates, API keys.
• Training: administrator's maintenance guide.
• Guarantee: free support for 30 days after launch.

Our Results

Over 5 years, we've completed more than 50 Bitrix-Cloudflare integrations. Average speed increase: 3x (compared to 1.5x with standard CDNs like StackPath, making Cloudflare 2x better than alternatives), server load reduction: up to 60%, bandwidth savings up to 70%. Clients typically save $2000–$5000 per year on server costs. Page load time improved from 4 seconds to 1.2 seconds on average. Project payback: 2–4 months. Typical integration cost ranges from $2000 to $5000, with an average ROI of 300% within the first year.