Point the domain at your home connection, proxy the public website through Cloudflare, and keep origin-management details separate from public DNS.
The public hostname should resolve through Cloudflare and eventually reach the web server, while CloudPanel and SSH remain private.
Step-by-step
Add the domain to Cloudflare
If the zone is not already on Cloudflare, add it and change the authoritative nameservers at the registrar to the pair Cloudflare assigns.
Create DNS records
Create an A record for the root domain and a record or CNAME for www that resolves to the public IPv4 address used by your router.
Enable the proxy for the website
Use the orange-cloud proxy for public web hostnames so browser traffic reaches Cloudflare before the origin.
Keep non-web services out of proxied web records
Do not assume Cloudflare proxying makes SSH, database, or control-panel ports safe. Treat those as separate management services.
Plan for a changing home IP
If your ISP changes your public IP, use an authenticated dynamic-DNS update method or Cloudflare API script so the A record stays current. Store API tokens outside the web root.
Verify DNS resolution
Use dig or nslookup to confirm the hostname returns Cloudflare proxy addresses when proxied.
dig +short www.example.com
nslookup www.example.comThe public hostname should resolve through Cloudflare and eventually reach the web server, while CloudPanel and SSH remain private.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.