Follow the steps in order. Flare53 will show the exact DNS records and tell you when each action is safe to complete.
How it works
Six steps, in order
1Prepare the origin
Create a separate address that still reaches your current hosting.
2Add your website
Enter the origin first, then the public website domain.
3Add SSL DNS
Copy the validation record shown by Flare53.
4Wait for SSL
Flare53 checks the record and prepares HTTPS automatically.
5Go live and test
Move the public website DNS only when Flare53 says it is ready.
6Protect the origin
After testing, stop visitors from reaching the origin directly.
Important: prepare and test the separate origin first. Keep your current public website DNS unchanged until Flare53 says the final connection is ready. Protect the origin only after the public website is active and tested.
Step 1 of 6
Create a separate origin address first
Before adding your website to Flare53, make sure there is a separate public address that still reaches your current hosting. This gives Flare53 a stable way to retrieve your website after the public domain is moved.
Your current public websiteKeep this unchanged for now. Visitors continue using it during preparation.https://www.example.com
Create or identify the originPoint this address to the same current hosting server.https://origin.example.com
1. Create the origin address. Use a hostname such as origin.example.com, or use the public hosting address supplied by your provider.
2. Point it to the current hosting. Use the same server IP address or hosting target that serves the website today.
3. Test it before continuing. Open the origin address and confirm that it loads the same website correctly.
Do not move the public website yet: keep www.example.com pointing to the current hosting until Flare53 provides the final DNS instruction.
If you are not sure: ask your hosting provider, “Please give me a separate public hostname that reaches my current website, or help me point origin.example.com to the same hosting server.”
Step 2 of 6
Add the origin and public website to Flare53
Open your dashboard. Enter the working origin address first, then enter the public website domain that visitors already use.
1. Origin URLThe separate address that already reaches your current hosting.https://origin.example.com
2. Public website domainThe address visitors will continue using after Flare53 is activated.www.example.com
They must be different: do not use www.example.com as both the origin and the public website. Flare53 checks that the origin works before the setup can continue.
This record proves you control the domain, so we can issue your SSL certificate. Your real values appear on your Setup Status page after you add your domain. The values below are examples of what it looks like.
Type
CNAME
Host / Name
_abc123.www
Value / Target
_xyz789.validation.example.net
TTL
Auto or 300
Example values Copy your real values from the Setup Status page — these are only to show the format.
Step 4 of 6
SSL verification happens automatically
After you add the record, there is nothing else to do. Flare53 checks for it automatically and issues the certificate. This usually takes minutes, sometimes up to a few hours if DNS is slow to update.
You add one CNAME record.
We detect it and issue SSL for free.
You get an email when it is ready.
Step 5 of 6
The final DNS change
Once SSL is ready, Flare53 will show the final DNS target. Replace the existing public website DNS record only at this stage. The origin address stays unchanged. After the public DNS change, open the website and test several pages before continuing to origin protection.
Type
CNAME
Host / Name
www
Value / Target
your-flare53-target.example.net
TTL
Auto or 300
Example values Your real target appears on the Setup Status page when it is safe to change. Do not change the origin DNS record during this step.
Step 6 of 6
Secure the origin after your website is live
Your setup is not fully protected while visitors can still open the origin address directly. Complete this step only after the public website works correctly through Flare53.
Should workVisitor → www.example.com → Flare53 → origin
Should be blockedVisitor or bot → origin.example.com directly
Before protectionBoth addresses may still open.www.example.com → worksorigin.example.com → works
After protectionOnly the public website should be available to visitors.www.example.com → worksorigin.example.com → access denied
How it works: Flare53 sends a private origin header. Configure your server or hosting provider to allow the request only when that private header is present and correct.
🧩
WordPress or web server
Use the rule provided on your Origin Protection page for cPanel, Apache, Nginx, IIS, or your application.
💬
Managed or shared hosting
Send the provider message below and ask your host to apply the rule for you.
🔒
S3 or static storage
Keep the storage private and allow website files to be retrieved only through the Flare53 delivery path.
Example message for your hosting provider
Please configure origin.example.com to reject direct public requests. Allow requests only when the private X-Flare53-Origin-Secret header contains the value shown on my Flare53 Origin Protection page. Please confirm that www.example.com still works after the rule is applied.
Do this last: first confirm that the setup status is active and test the public website. Applying the rule too early can make the website unavailable.