Reselling Cloudflare Zones via WHMCS at 60–80% Margin

Cloudflare sells direct at $0/month (Free), $20/month (Pro), $200/month (Business), and enterprise pricing for Enterprise. Most hosting customers do not buy direct because Cloudflare's dashboard is overwhelming. Resellers who package Cloudflare Pro at $7-9/month with a friendly setup wizard and white-labelled controls clear 60-80% margin on every zone.

Why Cloudflare is a good resell

Three reasons:

1. Real value. A site behind Cloudflare actually goes faster (cached HTML, edge SSL, image optimisation) and survives DDoS attempts that would otherwise take it offline. Customers can tell the difference.
2. Sticky. Once DNS is on Cloudflare, customers don't switch. Renewal rate on Cloudflare zones is well over 90%.
3. Pricing tolerates markup. Customers don't know Cloudflare Pro is $20 direct. They know "speed + security" is worth $7-9 a month.

The reseller model

You sell zones at retail. Cloudflare bills you wholesale on a Pay-As-You-Go partner plan. You pocket the difference.

Cloudflare's partner programs include the "Domain Partner" pricing for resellers, with significant discounts above 500 zones. Below that volume, the standard API works fine; profits are just a little tighter.

What customers actually use

You don't need to expose every Cloudflare feature. Customers want, in order of importance:

• DNS record management (the 90% case)
• Cache purge ("flush my cache" support tickets disappear)
• SSL settings (Flexible vs Full vs Strict)
• Page rules (redirects, cache bypasses)
• Basic firewall rules (block a country, block a path)

Anything beyond this - Workers, Stream, R2 storage - is power-user territory. Build it later if you have demand; don't try to ship everything in v1.

Setup walkthrough

1. Create an API token. Cloudflare dashboard → My Profile → API Tokens → Create. Scope it to Zone:Edit, DNS:Edit, Cache:Purge, Page Rules:Edit. Avoid the global API key (too broad).

2. Wire the provisioning hook in WHMCS. When a customer orders a Cloudflare product, your hook creates a zone via Cloudflare's API, gets back the two assigned name servers, and tells the customer "point your domain at ns1.cf-foo.cloudflare.com and ns2.cf-bar.cloudflare.com".

3. Optional - white-label name servers. Instead of customers pointing at Cloudflare's name servers, point them at your own - ns1.yourbrand.com and ns2.yourbrand.com - with glue records that resolve to Cloudflare's IPs. Cloudflare calls this "Custom Name Servers" and it's available on partner plans. Much more polished from the customer's perspective.

4. Build the client-area UI. DNS records as a table with inline add/edit/delete. Cache purge as a button. Page rules as a list. SSL setting as a dropdown. Every action calls Cloudflare's API and shows live status.

Cache purge - the support-killer feature

Around 30% of hosting support tickets relate to "I updated my site but it still shows the old version". A cache purge button in the customer's client area kills most of these tickets dead. Customer hits purge, Cloudflare's edge flushes within seconds, customer sees their update, ticket never opens.

Three modes worth exposing:

• Purge all. Nuclear option - flushes the entire zone. One click, with a confirmation modal.
• Purge by URL. Customer pastes a list of URLs, only those flush. Faster, doesn't lose cached content for the rest of the site.
• Purge by cache tag. Pro/Business feature - flush by tag (e.g. all product pages). Useful for e-commerce customers.

WAF - selling security as a tier upgrade

Cloudflare's Free plan includes basic WAF rules. Pro adds more, Business adds custom rule creation. Your tiered pricing should mirror this:

• Starter ($5/mo). DNS only, no WAF customisation. Sub-resold Free or Pro.
• Pro ($9/mo). Adds the "managed WAF rulesets" UI - toggle OWASP rules, custom path-based rules.
• Business ($35-50/mo). Adds custom firewall rules, advanced rate limiting, custom WAF rules.

Tier-pricing maps naturally to Cloudflare's own internal tiers, and customers expect to pay more for advanced security features.

SSL mode - pick the right default

Cloudflare offers four SSL modes:

• Off. Never use this.
• Flexible. HTTPS to visitor, HTTP from Cloudflare to origin. Discouraged - it lies to the visitor about whether the origin is secure, breaks pages that mix HTTP and HTTPS, fails when origin redirects.
• Full. HTTPS end-to-end, but Cloudflare doesn't validate the origin certificate. Fine for self-signed origin certs.
• Full (strict). HTTPS end-to-end with origin cert validation. The right answer for any customer with a real cert (including Let's Encrypt).

Default to Full (strict). Only step down if a customer specifically needs Flexible because their origin truly can't speak HTTPS - and warn them.

Billing and renewal mechanics

Cloudflare bills you monthly for every active zone. WHMCS bills your customers on the same cycle. Two gotchas:

• Cancellation lag. When a customer cancels, suspend the zone in Cloudflare immediately. Otherwise you keep being billed for a zone you're not earning revenue on.
• Failed payments. Don't auto-suspend the zone on the first failed renewal - the site goes down and the customer panics. Send three reminders over a week, then suspend.

Wrap-up

Cloudflare reselling is one of the highest-margin, highest-stickiness products in the hosting bundle. The integration is well-documented, Cloudflare's API is rock-solid, and the customer experience speaks for itself once it's live.

If you want to ship this in a day instead of a week, our Cloudflare Integration Module bundles every feature in this guide: zone provisioning, DNS CRUD, cache purge, page rules, WAF editor, plan-tier mapping.