Cloudflare for FiveM: Website, DNS and Game Traffic

Cloudflare's normal DNS and orange-cloud HTTP proxy can protect a FiveM community website, API or store, but it does not proxy the actual FXServer TCP/UDP game endpoint. Proxying arbitrary TCP or UDP services requires Cloudflare Spectrum and an eligible paid plan. For most FiveM servers, game-traffic DDoS protection must therefore come from the game host or network provider.

Do not orange-cloud a game hostname and assume the FiveM port is protected. Standard Cloudflare proxying covers supported HTTP/HTTPS ports. Spectrum is a separate Layer 4 product with plan and protocol limits.

Separate the three traffic paths

Surface	Normal Cloudflare proxy?	Owner
Website, documentation, status page or web API over supported HTTP/HTTPS	Yes, when configured as a proxied DNS record	Cloudflare HTTP proxy plus the origin configuration
DNS lookup for the FXServer hostname	DNS can be hosted by Cloudflare; a DNS-only record reveals the target IP	Cloudflare authoritative DNS
FXServer TCP/UDP connection	Not through the standard HTTP proxy	Hosting/network protection, or Spectrum when the plan and configuration support it

What Spectrum changes

Cloudflare Spectrum is the product that proxies TCP and UDP applications. Cloudflare's current protocols-per-plan documentation says arbitrary TCP/UDP applications require Enterprise with the appropriate paid add-on; plan support can change, so verify the matrix and contract rather than relying on a tutorial screenshot.

Spectrum is not enabled by toggling the orange cloud on a DNS record. It requires a Spectrum application with the intended protocol, edge port and origin. Confirm with Cloudflare and the FiveM host that the required ports and connection behaviour are supported before changing a production endpoint.

A safe setup for the web surface

1. Put the website on a separate hostname from the game endpoint where practical.
2. Add the web origin to Cloudflare DNS and enable the proxy only for supported web traffic.
3. Use a valid origin certificate and an end-to-end TLS mode; do not use a mode that leaves the Cloudflare-to-origin connection unencrypted.
4. Exclude login, account, cart, checkout, personalized sessions and authenticated APIs from public caching.
5. Rate-limit only routes whose legitimate behaviour you understand. Test launchers, webhooks and API clients before enforcing a challenge.
6. Keep the origin firewall and application updated; a CDN does not repair a vulnerable WordPress plugin or exposed admin account.

DNS-only game endpoint

If Spectrum is not configured, use a DNS-only record for the game endpoint and rely on the hosting provider's network-level mitigation. Ask the provider what TCP/UDP protection is included, which ports are filtered, how attacks are handled and whether the advertised protection applies to the actual FiveM service rather than only to a control panel.

Common mistakes

• Confusing DNS with proxying: Cloudflare can answer DNS while the connection still goes directly to the origin.
• Publishing the origin elsewhere: old DNS records, mail services and direct links can reveal an address even when the website is proxied.
• Caching personalized commerce pages: this can leak or mix user-specific state.
• Changing several network layers at once: preserve the last known DNS and firewall configuration and define a rollback before cutover.
• Calling a successful DNS lookup proof of DDoS protection: test the intended protocol and port from a real FiveM client.

Verification checklist

• The website hostname resolves to Cloudflare and serves the correct certificate.
• Login, account and commerce paths bypass shared cache.
• The game hostname and port are documented as DNS-only, provider-protected or explicitly handled by Spectrum.
• A real client can connect after the change.
• The rollback records contain the previous DNS values, TTLs and firewall state.

Use Cloudflare's current Spectrum configuration reference for fields and limitations. Dashboard names and plan availability may change after this review.