Solving the "410 Gone" & Cloudflare Loop Issue on Shared Hosting (Case Study)

#webdev #php #cloudflare #devops

Hello devs! 👋

I’m Jamal Pinang, a Fullstack Developer and the founder of InstaIndo.

Today, I want to share a quick "battle story" I faced while deploying my PHP automation platform. If you are using Cloudflare with a shared hosting provider (cPanel/Imunify360), you might have faced the dreaded "Verification Loop" or the "410 Gone" error.

Here is how I fixed it.

The Problem
My project, InstaIndo, uses Cloudflare for CDN and security. Suddenly, my users reported that they couldn't access the site. They were stuck in an infinite "Imunify360 Verification" loop.

When I tried to disable ModSecurity in cPanel to fix it, it got worse: the site threw a 410 Gone error with a weird wsidchk parameter in the URL.

The Root Cause
It turns out, the firewall on my hosting server (Imunify360) was detecting all traffic as coming from Cloudflare's IP addresses, not the real visitor's IP. Seeing thousands of requests from the same IP, the firewall blocked it as a DDoS attack.

The Solution that Worked
If you face this, don't just disable your security settings.

Check Cloudflare SSL: Ensure it is set to Full (not Flexible) to avoid redirect loops.
ModRemoteIP is Key: The hosting provider MUST enable mod_remoteip (Apache) or properly configure the Real IP header on their LiteSpeed server.
Whitelist Cloudflare IPs: I had to contact my hosting support to manually whitelist Cloudflare's IPv4 and IPv6 ranges in their Imunify360 firewall settings.

After the whitelist was applied and I hit "Purge Everything" on Cloudflare, my site InstaIndo is finally back online and faster than ever.

Tech Stack
For those asking, my platform is built using: