Fondoo
GitHubStart your 7-day trial for $0Start trial
Docs

Connect Cloudflare for SaaS (Fondoo Site Proxy) to Fondoo

Live6 min readUpdated

The Fondoo Site Proxy lets you keep your current website, hosting and CMS, and still add Fondoo features to it. You point one public hostname (for example www.yourdomain.com) at Fondoo with DNS records. Fondoo then sits in front of your existing host and adds managed SEO, analytics, redirects and other features. Your AI agent can manage these settings for you.

Fondoo runs this on its own Cloudflare for SaaS account. You never create a Cloudflare account, API token or key for this. All you do is add a few DNS records at your DNS provider.

What Fondoo can do with it

Once your hostname is connected, Fondoo can:

  • Set per-page SEO (title, description, canonical, robots, Open Graph, Twitter, hreflang, JSON-LD) without editing your site.
  • Add 301/302 redirects for GET and HEAD requests.
  • Inject Fondoo analytics, support chat, checkout links and forms. You turn each one on.
  • Serve Fondoo-published pages on paths you pick (for example /blog/*). Everything else still comes from your host.
  • Add /fondoo-sitemap.xml, add lines to robots.txt, and serve /llms.txt.
  • Optionally add security headers, cache rules and a bot rate limit.

What needs your approval:

  • disconnect_site_proxy is destructive. When an agent calls it, Fondoo returns pending_approval with an approval link for you.
  • update_site_proxy is normally a regular write. If one update changes SEO on more than 20 page paths, it counts as destructive and needs your approval.
  • Only the workspace owner can approve. Team members who are not owners cannot run destructive actions.

Before you start

  • A Fondoo workspace and site. Your agent needs an API key with sites:write and seo:write. get_site_proxy_status only needs sites:read.
  • Access to the authoritative DNS provider for your domain. This is where DNS records are edited. It may not be your registrar.
  • A separate origin hostname that still points straight at your current host and has a valid HTTPS certificate. Examples are origin.yourdomain.com or a host-provided name such as a Vercel deployment hostname. Fondoo only accepts origins that:
    • use https:// on the normal port, with no path, query or login details;
    • resolve only to public IP addresses (no private networks, localhost or IP literals);
    • are not the same as the public hostname, and do not loop back through Fondoo.
  • A note of your current DNS records for the public hostname, so you can restore them later.
  • No Cloudflare costs fall on you. Proxied HTML visitors count toward your Fondoo plan's monthly visitor usage.

The Fondoo operator has to turn on the Cloudflare for SaaS side. If they have not, connect_site_proxy returns connection_required with the message "The operator must configure Cloudflare for SaaS." Contact Fondoo support in that case. You can also use middleware mode (see below).

Step by step: point your domain

  1. Choose the public hostname. We recommend www.yourdomain.com. Apex domains (yourdomain.com) are harder; see Troubleshooting.
  2. Set up the origin hostname. Make sure https://origin.yourdomain.com (or your host's hostname) loads your site with a valid certificate. Configure your host so it serves the site on that name.
  3. Connect in Fondoo (see the next section). The result includes records: the exact DNS records to add. They are usually:
    • a CNAME from your hostname to Fondoo's target (normally fallback.getfondoo.com);
    • a TXT record named _cf-custom-hostname.<your hostname>. Cloudflare uses it to prove you own the hostname (Cloudflare docs);
    • one or more TXT records named _acme-challenge.<your hostname>. These are used to issue the HTTPS certificate (Cloudflare docs). Sometimes Cloudflare returns a CNAME for this instead. If so, use that CNAME exactly.
  4. Add the records at your DNS provider. Copy the names and values exactly, and never make up certificate values. Don't remove MX records or TXT records you don't recognise. Many panels add your domain automatically, so type only the label (for example _acme-challenge.www). Where to add records:
    • Cloudflare: DNS, then Records, then Add record (guide). Set verification records to DNS only, and start the website CNAME as DNS only too.
    • Namecheap: Domain List, Manage, Advanced DNS. GoDaddy: Domain Portfolio, your domain, DNS. Squarespace: Domains, your domain, DNS, Custom Records. Name.com: My Domains, your domain, Manage DNS Records. Labels can change. If you can't find them, check your provider's help pages.
  5. Tip for less downtime: Cloudflare lets ownership and the certificate validate through TXT records before traffic moves. You can add the TXT records first, wait for status to show active, and then switch the website CNAME.
  6. Wait and check. Call get_site_proxy_status until verification and ssl both show active and originHealth.healthy is true. Validation records can appear late, so call status again if records is not complete yet.

Connect it in Fondoo

(a) Dashboard. The Connections page does not list the Site Proxy, and Fondoo has no dedicated Site Proxy page. The owner link that connect_site_proxy returns opens a short "Keep your site, add Fondoo" page. It tells you to check get_site_proxy_status for your records. Use your agent or REST for setup.

(b) Ask your agent. Example prompt:

Connect www.mybakery.com to Fondoo using the Site Proxy. My origin is https://origin.mybakery.com. Do a dry run first, then connect and give me the exact DNS records.

The agent runs:

  • connect_site_proxy({siteId, hostname: "www.mybakery.com", originUrl: "https://origin.mybakery.com", dryRun: true}) for a preview. The preview makes no Cloudflare call and changes no routing.
  • connect_site_proxy({siteId, hostname, originUrl}) for the real run. It returns status: "connection_required" with records, connectUrl, qrPayload, qrSvg, feedUrl and publicKey. connection_required means DNS work remains. It is not an error.
  • get_site_proxy_status({siteId}) to check progress.

connect_service({provider: "cloudflare_saas", siteId}) returns only instructions and a signed 15-minute link. It does not connect anything.

REST equivalent:

curl -X POST https://api.getfondoo.com/v1/ops/connect_site_proxy \
  -H "Authorization: Bearer $FONDOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"siteId":"YOUR-SITE-UUID","hostname":"www.mybakery.com","originUrl":"https://origin.mybakery.com"}'

Changing settings. update_site_proxy({siteId, settings}) replaces the whole settings object, and missing fields go back to their defaults. Always read settings from get_site_proxy_status first, change what you need, and send back the full object. The defaults are analytics and SEO on, and support, checkout and forms off. originUrl and paused can be updated on their own. To undo an SEO change, use undo_seo_fix.

No DNS access? Use connect_site_proxy with mode: "middleware" and install the Fondoo adapter for Next.js, Astro, Express or WordPress. This mode doesn't need Cloudflare.

Test that it works

  1. get_site_proxy_status shows verification: "active", ssl: "active" and originHealth.healthy: true.
  2. Open https://www.yourdomain.com and check the padlock.
  3. Test logins, carts, forms, API calls and file downloads. Paths in bypass (by default /wp-admin/*, /wp-login.php and /api/*) pass straight through.
  4. View the page source and check that your managed title or analytics tag is there.

Troubleshooting

  • connection_required with "The operator must configure Cloudflare for SaaS". Fondoo has not enabled this feature on your platform. Contact Fondoo support or use middleware mode.
  • SSL stuck pending. Call status again for late TXT records. Check for doubled names such as _acme-challenge.www.yourdomain.com.yourdomain.com, and for conflicting records. Keep the verification records in place while you stay connected. Cloudflare says ownership TXT records can go after activation, but Fondoo advises keeping them.
  • CAA records block the certificate. If your domain or its parent has CAA records, they must allow the certificate authority Cloudflare picks. For SaaS certificates, Cloudflare lists Let's Encrypt (letsencrypt.org), Google Trust Services (pki.goog; cansignhttpexchanges=yes) and SSL.com (ssl.com). See CA reference and CAA records. Fondoo does not pick a specific CA, so this may differ for your account. Don't delete unrelated CAA policy.
  • Apex domain. Most providers don't allow a normal CNAME at @. Use your provider's CNAME flattening, ALIAS or ANAME if it has one (Cloudflare CNAME flattening). Otherwise use www and redirect the apex to it. Name.com does not allow bare CNAMEs. Never paste Cloudflare IP addresses as A records.
  • Redirect loop or wrong host. The origin must be separate from the public hostname and keep a valid certificate. Your app receives its own Host header plus X-Forwarded-Host and X-Forwarded-Proto for the public name. Check your canonical URL, trusted-proxy and cookie-domain settings.
  • "Hostname is already connected" or an existing Cloudflare hostname. Fondoo will not take over a custom hostname that already exists. Contact Fondoo support so they can clean it up.

Limits, data and security

  • Request budget: 1,000,000 proxied requests per site per UTC month by default (requestBudget). Over budget, visitors get your plain origin pages and you get one alert that month.
  • HTML changes are limited to 1 MiB and 500 ms per page. Anything larger passes through unchanged. Settings changes show up within about two minutes. Pausing works on the next request check.
  • What Fondoo stores: your hostname, origin URL, settings and the Cloudflare custom hostname ID. You give Fondoo no credentials. Raw visitor identifiers are not stored.
  • Pause: pause_site_proxy({siteId}). Resume with update_site_proxy({siteId, paused: false}). Pause and disconnect still work if your Fondoo billing is paused.
  • Disconnect: first restore your original DNS records and wait for traffic to reach your host. Then run disconnect_site_proxy({siteId}). It removes the Cloudflare hostname and routing. Your domain, hosting, MX records and content are not touched.