Domain
Every MagicWP site comes with a free default domain and can also serve your own custom domain - with HTTPS handled automatically. You manage domains in the dashboard: your site → Domain.
Your default domain
When a site is created, MagicWP gives it a default subdomain like
your-site.magicwp.net (the exact one is shown at the top of the Domain
page). It's live immediately, always connected, and served over HTTPS - useful
for building and testing before you point a custom domain at the site.
Two ways to connect a domain
The Domain page offers two routes, and you pick one:
| Connect Cloudflare | Point a domain manually | |
|---|---|---|
| Where your DNS lives | Cloudflare | Any registrar |
| Who writes the records | MagicWP | You |
| Setup time | A few minutes, once | However long DNS takes to propagate |
| You also get | Proxy, WAF, edge cache purge, SSL mode and dev mode from the dashboard | SSL and platform caching |
A domain can only be set up one way at a time. Once you start on one route the other is disabled until you remove the domain - two sets of records pointing at the same name is a problem, not a fallback.
Connect Cloudflare (API token)
If your domain's DNS is already on Cloudflare, this is the shorter path. You create one scoped API token, paste it once, and it does not expire.
1. Create the token in Cloudflare
Open My Profile → API Tokens in Cloudflare and click Create Token, then Create Custom Token (the "Get started" button at the bottom, not one of the templates above it).
Give it a name you will recognise later - MagicWP - example.com - and add
these four permissions:
| Section | Permission | Level | What it is for |
|---|---|---|---|
| Zone | Zone | Read | Find the zone your domain lives in |
| Zone | DNS | Edit | Write the CNAME and the verification TXT |
| Zone | Cache Purge | Purge | Purge the edge cache from the MagicWP dashboard |
| Zone | Zone Settings | Edit | Set SSL mode, Always Use HTTPS and Under Attack mode |
One more is optional:
| Section | Permission | Level | What it is for |
|---|---|---|---|
| Zone | Zone WAF | Edit | Block XML-RPC at Cloudflare's edge |
Leave it out and everything else still works - the XML-RPC control simply says it needs the permission. You can add it to the same token later without creating a new one.
Then, under Zone Resources, choose:
Include → Specific zone → example.comScope it to one zone
Picking Specific zone is the step worth not skipping. It limits the token to the single domain you are connecting - MagicWP cannot see or change anything else in your Cloudflare account. All zones works, but it hands over far more access than this needs.
Leave Client IP Address Filtering and TTL empty unless you have a reason to set them. A TTL means the token stops working on that date and your Cloudflare settings in MagicWP stop with it.
Click Continue to summary, check it reads like the table above, then Create Token.
Copy it now
Cloudflare shows the token once. Copy it before leaving the page. If you lose it, you cannot look it up - create another one and delete the old one.
2. Paste it into MagicWP
On Domain, choose Connect Cloudflare, paste the token and click Connect. MagicWP checks it against Cloudflare before saving anything, so a token with a missing permission or the wrong zone is rejected here rather than failing later. It is stored encrypted and never shown again.
3. Enter the domain
Type the domain you want to use - the apex (example.com) or a subdomain
(blog.example.com). It must already be in the Cloudflare account you just
connected, and inside the zone the token was scoped to.
MagicWP writes two records into your zone: a CNAME pointing the name at your default domain, and a TXT record that proves ownership.
If the name already has records
If something is already at that name - an old A record from a previous host,
for example - MagicWP will tell you and offer to replace it. That deletes
the existing A, AAAA or CNAME record at that name, so only accept if you
no longer need it.
4. Connect it
Click Connect. MagicWP points the web server at the domain and issues its certificate.
The record is written grey-cloud (proxy off) to begin with, and the proxy becomes available once the certificate exists. That order matters: turning the Cloudflare proxy on before the certificate is issued puts Cloudflare's default Flexible SSL in front of a server that redirects to HTTPS, which is a redirect loop.
Cloudflare settings
Once connected, the Domain page also gives you:
- Cloudflare proxy - serve the site through Cloudflare's cache and WAF.
- SSL mode - use Full (strict). It's the only mode that won't fight this server's HTTPS redirect while the proxy is on.
- Always Use HTTPS - redirect HTTP at the edge, before it reaches the site.
- Development mode - bypass the Cloudflare cache while you work. Cloudflare turns it off again after three hours.
- Under Attack mode - challenges every visitor for about five seconds before letting them through. For an active attack, not everyday use: it slows real visitors down too. Turning it off puts the zone back to the security level it had before.
- Purge cache - clear everything Cloudflare is holding for the zone.
- Block XML-RPC at the edge - Cloudflare rejects requests for
/xmlrpc.phpbefore they reach your site, so brute-force and pingback traffic never uses a PHP worker. Needs the optional Zone WAF:Edit permission on your token. Leave it off if you use the WordPress mobile app or Jetpack, which both talk to WordPress over XML-RPC. - Purge by URL - clear specific pages instead, one path per line, up to 30. Use this after editing a post: purging the whole zone throws away every cached image and asset on the site as well, and the next few hundred visitors wait while it fills again.
Point a domain manually
Use this if your DNS is anywhere else, or if you'd rather not grant access to your Cloudflare account.
1. Add the domain
Enter it on the Domain page and click Add.
2. Add two records at your registrar
MagicWP shows you exactly what to add. Both are required - the CNAME points the name at your site, the TXT proves you own it:
| Type | Name | Value |
|---|---|---|
CNAME | @ for the root domain, or the subdomain (e.g. www, blog) | your default domain, e.g. your-site.magicwp.net |
TXT | _magicwp (or _magicwp.<subdomain>) | the verification string shown on the page |
Click any name or value to copy it.
Root domains
Many registrars can't put a CNAME on a root/apex domain (example.com) -
use their CNAME flattening / ALIAS / ANAME feature, or point a subdomain
like www instead.
3. Wait for verification, then connect
MagicWP re-checks DNS automatically while the page is open, and Check now forces a check. When both records are found the domain becomes Verified and Connect becomes available.
DNS takes time to propagate
DNS changes can take anywhere from a few minutes up to 24-48 hours to propagate worldwide. Leave the page open, or come back later - nothing is lost while you wait.
Managing your domain
Each domain shows its state:
- Waiting for DNS: added, but the records haven't been found yet.
- Verified: DNS is correct; ready to connect.
- Connected: active; your site is served on this domain.
The actions, in the order they have to happen:
- Connect - make the domain the site's live address.
- Disconnect - stop serving it; the site falls back to its default
*.magicwp.netaddress. Everything else stays set up, so you can connect again whenever you like. - Remove - take the domain off the site. On the Cloudflare route this also deletes the two records MagicWP wrote; on the manual route your registrar records are left alone for you to delete. Disconnect first.
- Remove token (Cloudflare only) - MagicWP forgets the API token. Remove the domain first, or its records would be left in a zone MagicWP can no longer reach to tidy up. The token itself stays valid in Cloudflare, so delete it there too if you are finished with it.
SSL certificates
HTTPS is automatic. When you connect a domain, MagicWP issues and installs a
free Let's Encrypt certificate and renews it for you - there's nothing to
buy, upload, or configure. Your default *.magicwp.net domain is always HTTPS
too.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| "is not in the Cloudflare account you connected" | The domain is in a different Cloudflare account, or not on Cloudflare at all | Add it to that account, connect a different one, or use the manual route |
| "already has DNS records in this zone" | An old A or CNAME is still at that name | Accept the offer to replace it, or delete it in Cloudflare first |
| "already registered to another site" | The domain is connected to a different MagicWP site | Remove it there first |
| Added but still Waiting for DNS | Still propagating, or a record is wrong | Check both the CNAME and the TXT match exactly; use Check now after propagation |
| Root domain won't verify | Registrar can't CNAME the apex | Use CNAME flattening / ALIAS / ANAME, or connect a www subdomain |
| Redirect loop after turning the proxy on | Cloudflare SSL mode is Flexible | Set SSL mode to Full (strict) |
| Can't remove the domain | It's still connected | Disconnect it first |
| Can't remove the Cloudflare token | A domain is still set up through it | Disconnect, then remove the domain, then remove the token |
| "This token cannot see any active zones" | The token has no Zone:Read, or is scoped to a different zone | Edit the token in Cloudflare, or create one scoped to the right domain |
| SSL mode or Always Use HTTPS will not save | The token is missing Zone Settings:Edit | Add that permission to the token in Cloudflare |
| Purge cache fails | The token is missing Cache Purge | Add that permission to the token in Cloudflare |
| XML-RPC toggle is greyed out | The token is missing the optional Zone WAF:Edit | Add it to the token in Cloudflare, then reload the page |
| WordPress app or Jetpack stopped working | XML-RPC is blocked at the edge | Turn Block XML-RPC off - both use XML-RPC to reach the site |
| Cloudflare settings stopped working after a while | The token had a TTL and has expired | Create a token with no TTL and paste it again |
| Certificate warning in the browser | Cert still being issued right after connecting | Give it a minute after connecting, then reload |