Automatically updating Cloudflare IPs in WHM/cPanel

If your WHM/cPanel server sits behind Cloudflare, Apache needs to know which IPs are actually Cloudflare’s proxies so it can trust the CF-Connecting-IP header and log real visitor IPs instead of Cloudflare’s. The problem: Cloudflare’s IP ranges change occasionally. Here’s a small script that keeps things current automatically.

more update-cloudflare-ips.sh 
#!/bin/bash

OUT="/etc/apache2/conf.d/cloudflare-remoteip.conf"
TMP=$(mktemp)

echo "# Cloudflare RemoteIP - AUTO GENERATED (DO NOT EDIT)" > "$TMP"
echo "RemoteIPHeader CF-Connecting-IP" >> "$TMP"
echo "" >> "$TMP"

curl -s https://www.cloudflare.com/ips-v4 | while read ip; do
    echo "RemoteIPTrustedProxy $ip" >> "$TMP"
done

curl -s https://www.cloudflare.com/ips-v6 | while read ip; do
    echo "RemoteIPTrustedProxy $ip" >> "$TMP"
done

mv "$TMP" "$OUT"

/scripts/restartsrv_httpd


Add this to the root crontab

How it works

1. Fetch the latest ranges. It pulls Cloudflare’s current IPv4 and IPv6 ranges straight from their official endpoints.
2. Build a config file. Each IP range gets written as a RemoteIPTrustedProxy line, along with the RemoteIPHeader directive so Apache knows to read the real visitor IP from Cloudflare’s header.
3. Write safely. It builds the file in a temp location first, then moves it into place — so Apache never reads a half-written config.
4. Restart Apache. The last line restarts the web server so the new config takes effect.

Automating Cloudflare IP Range Updates

Drop this in a cron job to run weekly (or monthly) so the IP list never goes stale:

0 3 * * 1 /root/update-cloudflare-remoteip.sh >/dev/null 2>&1

That’s it — a tiny script, but it saves you from ever having to manually track Cloudflare’s IP changes.