Cloudflare is commonly used with WordPress to manage DNS, security, caching, and content delivery. Pantheon also uses Cloudflare to power its next-generation Global CDN. What happens when you want to use your own Cloudflare account in front of Pantheon’s Cloudflare infrastructure? Is that possible? Yes.
This configuration is known as Cloudflare Orange-to-Orange (O2O). It allows organizations to maintain their own Cloudflare proxy, security rules, and edge services while continuing to use Pantheon’s managed CDN.
At Knihter, we’ve worked with this configuration while managing WordPress installations on Pantheon. One of the less obvious requirements is enabling O2O within Pantheon itself.
Simply pointing an orange-clouded CNAME at Pantheon isn’t necessarily sufficient. Pantheon also needs to recognize that the hostname is intentionally operating behind another Cloudflare proxy.
Fortunately, Pantheon provides a Terminus command for this purpose.
This guide covers the DNS configuration, SSL settings, Terminus commands, and verification steps needed to configure Cloudflare Orange-to-Orange with Pantheon.
What Is Cloudflare Orange-to-Orange?
A typical WordPress website using Cloudflare follows this request path:
Visitor → Cloudflare → WordPress Hosting
Pantheon’s next-generation Global CDN already uses Cloudflare infrastructure.
When an organization places its own Cloudflare account in front of Pantheon, the request path becomes:
Visitor → Customer Cloudflare → Pantheon Cloudflare CDN → WordPress
Both Cloudflare configurations process traffic, but they are managed independently.
The customer-managed Cloudflare account can provide:
- DNS management
- Web Application Firewall (WAF) rules
- Bot protection
- Rate limiting
- Redirect rules
- Cloudflare Workers
- Traffic analytics
Pantheon’s CDN remains responsible for its managed edge delivery, caching, and integration with the WordPress application.
O2O provides a supported way for these services to operate together.
Step 1: Configure Cloudflare DNS
Start by adding the domain to the Pantheon environment and obtaining the assigned Global CDN hostname.
Pantheon’s next-generation Global CDN uses CNAME targets following this format:
fe.<zone>.edge.pantheon.io
For example:
fe.cfp2c.edge.pantheon.io
In Cloudflare, configure the application hostnames to point to the target supplied by Pantheon.
| Type | Name | Target | Proxy |
|---|---|---|---|
| CNAME | @ | fe.cfp2c.edge.pantheon.io | Proxied |
| CNAME | www | fe.cfp2c.edge.pantheon.io | Proxied |
Cloudflare supports CNAME flattening at the zone apex, allowing the root domain to use a CNAME configuration.
The important setting is Proxy Status: Proxied, represented by the orange cloud.
With proxying enabled, Cloudflare processes incoming HTTP requests rather than returning the underlying Pantheon hostname directly to visitors.
However, this introduces a complication with Pantheon’s DNS validation.
Why Pantheon May Not Detect the CNAME
When Cloudflare proxies a hostname, public DNS queries generally return Cloudflare IP addresses rather than the configured CNAME target.
For example, a record configured as:
www.example.com → fe.cfp2c.edge.pantheon.io
may resolve publicly to Cloudflare IP addresses.
A DNS validation system expecting to see the Pantheon CNAME may therefore report that the record is missing.
This behavior is normal for proxied Cloudflare records, but it doesn’t establish that O2O has been enabled within Pantheon.
That requires an additional step.
Step 2: Enable Orange-to-Orange Using Pantheon Terminus
Pantheon provides the following Terminus command for configuring Orange-to-Orange:
terminus gcdn:o2o <site>.<environment> <domain>For example:
terminus gcdn:o2o example-site.live example.comThis command configures Pantheon’s Global CDN to recognize the specified hostname as using Orange-to-Orange.
It is an important distinction from simply enabling the orange cloud in Cloudflare.
The Cloudflare DNS setting controls whether the customer’s Cloudflare account proxies traffic.
The Terminus command configures Pantheon’s handling of the O2O hostname.
Configure Each Hostname
If the website uses both the apex domain and www, configure each hostname separately:
terminus gcdn:o2o example-site.live example.comterminus gcdn:o2o example-site.live www.example.comReplace the site name and domain with the values for your Pantheon installation.
Why This Command Matters
Without the appropriate O2O configuration, Pantheon may continue evaluating the hostname as though it were using a conventional DNS setup.
Because Cloudflare proxying conceals the underlying CNAME, this can produce confusing DNS validation warnings.
The gcdn:o2o command establishes the intended configuration within Pantheon.
After running the command successfully, return to the Pantheon dashboard and review the domain status.
This should be part of the initial O2O setup, not merely a troubleshooting step after DNS warnings appear.
The command does not replace the need for correct DNS records, certificate validation, or HTTP testing.
It addresses the Pantheon-specific configuration required for the proxy arrangement.
Step 3: Configure Cloudflare SSL/TLS
Navigate to: Cloudflare → SSL/TLS → Overview and then set the encryption mode to: Full (strict)
This requires Cloudflare to establish an encrypted connection to the next HTTPS endpoint and validate its certificate.
Full (strict) is preferable to Flexible SSL, which permits an unencrypted connection between Cloudflare and the upstream service.
Flexible SSL can create problems with WordPress HTTPS detection and redirect handling. For example, WordPress may enforce HTTPS while an upstream service communicates over HTTP. Depending on the configuration, this can result in redirect loops.
Use Full (strict) when the upstream certificate configuration supports it.
SSL with Two Cloudflare Layers
The O2O architecture involves multiple HTTPS connections.
- The visitor connects to the customer-managed Cloudflare configuration.
- Cloudflare processes the request through the supported O2O arrangement with Pantheon’s Cloudflare infrastructure.
- Pantheon’s CDN handles delivery to the WordPress application.
The certificates and TLS settings involved in these connections are not necessarily managed from the same account.
Pantheon manages the certificates associated with its CDN, while the customer manages the public-facing Cloudflare configuration.
Step 4: Configure ACME Challenge Records
HTTPS certificate issuance and renewal require domain ownership validation.
Pantheon may provide DNS records for ACME validation, including hostnames such as:
_acme-challenge
_acme-challenge.www
These records commonly point to Cloudflare-managed domain control validation endpoints and a typical configuration looks like this:
| Type | Name | Target | Proxy |
|---|---|---|---|
| CNAME | _acme-challenge | Pantheon-provided validation hostname | DNS Only |
| CNAME | _acme-challenge.www | Pantheon-provided validation hostname | DNS Only |
Use the exact destination values provided for your domain.
Why DNS Only?
ACME DNS validation depends on DNS responses rather than ordinary HTTP requests. The validation service must be able to resolve the expected DNS records. Consequently, these CNAME records should remain DNS only.
Do not enable the orange-cloud proxy for ACME challenge records. Also, do not assume every installation requires identical records. Follow Pantheon’s domain-specific certificate validation instructions.
Step 5: Verify the Configuration in Pantheon
Once DNS, O2O, and SSL settings are configured, open the Pantheon dashboard.
Navigate to:
Site → Live → Domains / HTTPS
Review the status of each hostname.
Check that:
- The domain is associated with the correct Pantheon environment.
- HTTPS certificates have been deployed.
- Certificate renewal is configured.
- The domain is recognized under the intended O2O configuration.
- DNS validation no longer reports an unexpected configuration problem.
What If Pantheon Still Reports a DNS Warning?
First, confirm that the O2O command completed successfully for the affected hostname.
Then verify that Cloudflare contains the correct Pantheon CNAME target and that proxying is enabled.
Remember that public DNS lookups generally cannot expose the underlying CNAME when Cloudflare proxying is active.
If the warning persists, review Pantheon’s current O2O documentation and contact Pantheon support rather than assuming the warning is harmless.
A deployed certificate and functioning website are useful indicators, but they do not independently establish that every part of the O2O configuration is correct.
Step 6: Verify DNS from the Command Line
The dig utility can help verify how the domain resolves publicly.
Start with:
dig www.example.com CNAMEFor a proxied Cloudflare hostname, this query may return no CNAME record.
Next, inspect the address records:
dig www.example.com A +shortIf Cloudflare is proxying the hostname, the returned addresses will generally belong to Cloudflare.
You can also inspect IPv6:
dig www.example.com AAAA +shortThese commands establish how the hostname resolves publicly.
They do not independently verify the complete O2O routing path.
Verify ACME Records
Check the certificate validation records:
dig _acme-challenge.example.com CNAME +shortdig _acme-challenge.www.example.com CNAME +shortCompare the results with the values supplied by Pantheon.
Incorrect or missing validation records can prevent certificate issuance or renewal.
Troubleshooting Cloudflare Orange-to-Orange
Pantheon Reports an Incorrect CNAME
Symptoms: Pantheon reports that the expected CNAME is missing even though the record exists in Cloudflare.
Resolution: Confirm that the hostname has been configured for O2O using Terminus.
terminus gcdn:o2o example-site.live example.comVerify the CNAME target and proxy setting in Cloudflare.
Do not disable proxying simply to make a DNS warning disappear.
SSL Certificate Validation Fails
Symptoms: Pantheon cannot issue or renew a certificate, or visitors encounter TLS errors.
Resolution: Verify the required ACME challenge records and confirm that they are DNS only.
Check the certificate status in Pantheon and review Cloudflare’s SSL/TLS settings.
The O2O command does not eliminate the need for valid certificates and correct domain validation.
What We Learned
The most important detail in our Pantheon O2O configuration was that Cloudflare proxying and Pantheon’s O2O configuration are separate steps.
Enabling the orange cloud in Cloudflare establishes proxying within the customer’s account.
Running the Pantheon Terminus command configures the corresponding hostname for O2O within Pantheon’s infrastructure.
terminus gcdn:o2o <site>.<environment> <domain>Without that distinction, Pantheon’s DNS warnings can be confusing, particularly when HTTPS works and the underlying CNAME is configured correctly.
For developers managing WordPress infrastructure across Cloudflare and Pantheon, the Terminus command belongs in the initial configuration process.
It is also worth documenting the resulting DNS, TLS, and caching behavior so future changes can be evaluated against a known working configuration.
Need Help with Pantheon or Cloudflare?
We help organizations with Pantheon hosting architecture, WordPress migrations, Cloudflare integrations, CDN configuration, application security, and performance troubleshooting.
Our work extends beyond WordPress development to the infrastructure supporting it, including DNS, SSL certificates, reverse proxies, caching, and hosting migrations.
If you’re planning a Pantheon implementation, troubleshooting a Cloudflare configuration, or evaluating a WordPress hosting migration, contact us to discuss your project.
Technical References
Pantheon: Orange-to-Orange Configuration