Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To install Drupal 11 on Ubuntu with Nginx and Cloudflare, build the site on a Composer-managed codebase, expose Drupal’s web directory through Nginx, connect it to a dedicated supported database, and configure Cloudflare only after the origin works over HTTPS. The secure production pattern is an origin certificate on port 443, Cloudflare Full (strict) encryption, Drupal trusted-host patterns, and a tightly controlled list of trusted proxy addresses. This guide takes you from a new Ubuntu server through the installer, reverse-proxy settings, DNS, and post-install verification.
What do you need before installing Drupal 11?
Drupal 11 has explicit minimum versions. Confirm these on the Ubuntu host before creating the project; an older package can leave the installer unavailable or produce unsupported runtime errors.
| Component | Minimum supported version |
|---|---|
| Nginx | 1.1 or newer |
| PHP | 8.3 or newer |
| Composer | 2.9.3 |
| MySQL | 8.0 or newer |
| MariaDB | 10.6 or newer |
| PostgreSQL | 16 or newer |
| SQLite | 3.45 or newer |
You also need a domain name, administrative access to Ubuntu, permission to change its DNS, and a plan for TLS certificates. Keep the public DNS record pointed at the server while you test the origin. Enable Cloudflare proxying after Nginx serves the site correctly, so a Cloudflare setting cannot hide an origin configuration problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the database deliberately
Use one dedicated database and one database user for this Drupal installation. MySQL or MariaDB is familiar to many Ubuntu administrators and is a common operational choice; PostgreSQL is also supported when your team already runs it. SQLite meets the stated version floor and is useful where a file database fits the deployment, but it requires a different backup and file-permission model. Whichever engine you select, record the database name, user, password, host, and port for the web installer.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How should Ubuntu and DNS be prepared?
Point the domain’s A or AAAA record to the server, but leave the record DNS-only while you validate the origin. On Ubuntu, update the package index and install Nginx, PHP-FPM, the PHP extensions Drupal needs, Composer, and your chosen database server.
sudo apt update
sudo apt upgrade
sudo apt install nginx mariadb-server php8.3-fpm php8.3-cli php8.3-mysql php8.3-xml php8.3-gd php8.3-curl php8.3-mbstring php8.3-intl php8.3-zip unzip git
Package names vary with the Ubuntu release. If the distribution supplies a later PHP 8.3-compatible package name, use that package’s matching FPM service and socket. Verify the actual versions instead of assuming a socket path:
nginx -v
php -v
composer --version
systemctl status php8.3-fpm
Install and secure MariaDB (or install PostgreSQL instead). Create a database that is not shared with another application. A least-privilege account should have access to this Drupal database, not global administrative privileges.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow do you create a Composer-managed Drupal project?
Composer-managed Drupal keeps core and contributed dependencies declared, updateable, and easier to roll back. The recommended project layout places the public files in web while Composer metadata and vendor code remain outside the document root.
- Create a deployment directory and move into it:
sudo mkdir -p /var/www/drupal sudo chown "$USER":"$USER" /var/www/drupal cd /var/www/drupal - Create the Drupal 11 project:
composer create-project drupal/recommended-project:^11 .Composer downloads Drupal into the project and creates the
webdirectory that Nginx will publish. - Set ownership so your deployment account can update code while the web server can write only Drupal’s required files. One practical arrangement is to keep the project owned by your deployment user and grant the web user access to the files directory:
sudo chown -R deploy:www-data /var/www/drupal
sudo mkdir -p /var/www/drupal/web/sites/default/files
sudo chown -R www-data:www-data /var/www/drupal/web/sites/default/files
sudo chmod 755 /var/www/drupal
sudo find /var/www/drupal -type d -exec chmod 755 {} ;
sudo find /var/www/drupal -type f -exec chmod 644 {} ;
Replace deploy with the real deployment account. Do not make the whole project writable by www-data; that would let a compromised PHP process alter executable code and Composer files. During installation, Drupal may need temporary write access to sites/default/settings.php. Restore restrictive ownership and permissions after the installer finishes.
How do you create the Drupal database and user?
Log in to the database server as an administrator and create a database with a dedicated account. Use a long, unique password and choose a UTF-8 character set supported by your selected engine.
sudo mariadbCREATE DATABASE drupal CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'drupal_app'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT ALL PRIVILEGES ON drupal.* TO 'drupal_app'@'localhost';
FLUSH PRIVILEGES;
EXIT;
The example uses MariaDB and a local socket. If the database is on another host, use that host in the account definition, restrict access with its firewall, and note the correct port for the installer. Never paste the database password into a publicly served file or commit it to a repository.
What Nginx configuration does Drupal need?
Nginx must publish Drupal’s web directory, send unknown paths to index.php for clean URLs, execute only intended PHP scripts through PHP-FPM, and deny sensitive project files.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Create a site configuration such as /etc/nginx/sites-available/example.com:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/drupal/web;
index index.php;
location / {
try_files $uri /index.php?$query_string;
}
location ~ .(?:css|js|jpg|jpeg|gif|png|svg|ico|webp|avif|woff|woff2|ttf)$ {
try_files $uri /index.php?$query_string;
access_log off;
expires 7d;
}
location ~ ^/sites/.*/files/.*.php$ {
deny all;
}
location ~* .(?:engine|inc|install|make|module|profile|po|sh|sql|theme|twig|tpl|yml|yaml|ini|log|conf)$ {
deny all;
}
location ~* /(?:.git|vendor|composer.(?:json|lock)|web.config) {
deny all;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}
Change server_name, the document root, and the FPM socket to match your host. Ubuntu package updates can change the socket from php8.3-fpm.sock to another installed PHP version, so inspect /run/php/ or the FPM service configuration rather than copying an old path.
Enable the site and validate the configuration before reloading:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo nginx -t
sudo systemctl reload nginx
The first HTTP response should come from your origin. A 404 generally means the root is not Drupal’s web directory or the try_files rule is missing; a 502 usually indicates a wrong or stopped PHP-FPM socket.
How do you run the Drupal web installer?
Open the domain in a browser while DNS still reaches the origin. Select the database driver, enter the database name, user, password, host, and port, then create the administrator account and site name.
- Choose the standard installation profile unless you have a documented reason to use another profile.
- Enter the database credentials created for this site. For a local MariaDB socket, the host is commonly
localhost; use the actual hostname and port for a remote database. - Let Drupal create its tables and configuration.
- Create an administrator account with a unique password and an email address you can monitor.
- Wait for the final report and correct any permission warning before signing in.
After completion, make settings.php non-writable by the web user and ensure the files directory remains writable only where Drupal needs to create uploads. Do not delete Composer’s metadata; it is required for controlled updates.
How do you configure Drupal trusted hosts?
Trusted hosts protect Drupal from Host-header spoofing. In web/sites/default/settings.php, add a regular-expression pattern for every hostname that is legitimately served, including the canonical and alternate public names.
$settings['trusted_host_patterns'] = [
'^example\.com$',
'^www\.example\.com$',
];
The backslash is doubled because it is inside a PHP string. Keep the pattern anchored with ^ and $; do not use a broad wildcard that accepts arbitrary hostnames. If a request’s Host header does not match, Drupal returns HTTP 400 with “The provided host name is not valid for this server.” Add a staging hostname only when that hostname is intentionally served by this installation, and remove temporary names before production.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How do you tell Drupal it is behind Cloudflare?
Cloudflare terminates one connection from the visitor and creates another connection to your origin. Drupal must be told which proxy addresses are trusted and which forwarded headers should influence scheme, host, and client-IP detection.
Add settings similar to these in settings.php, replacing the example proxy list with the complete, current addresses of the proxies that can reach this origin:
$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [
'203.0.113.10',
'203.0.113.11',
];
$settings['reverse_proxy_header'] = 'HTTP_CF_CONNECTING_IP';
Do not copy the example addresses into production. Populate the array with Cloudflare’s published ranges and any local load balancer addresses that are actually in your request path. If you operate a private proxy in front of Nginx, list that proxy as well and document the order of the chain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Only trust headers that your known proxies set. Cloudflare provides the original visitor address in CF-Connecting-IP and also supplies X-Forwarded-For. Accepting either header from arbitrary Internet clients lets an attacker forge the address used for logs, rate limits, and Drupal flood protection.
How do you enable HTTPS on the origin?
Full (strict) Cloudflare encryption requires the origin to answer on port 443 with an unexpired certificate whose name matches the requested hostname. Obtain a certificate from a public certificate authority such as Let’s Encrypt, or use a Cloudflare Origin CA certificate when the origin is reached only through Cloudflare. Configure Nginx for 443 before switching Cloudflare to strict validation.
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com www.example.com;
root /var/www/drupal/web;
index index.php;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location / {
try_files $uri /index.php?$query_string;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}
Keep the same deny rules from the HTTP server block. Add a separate port-80 server block that redirects each HTTP hostname to its HTTPS equivalent once HTTPS works:
return 301 https://$host$request_uri;Test the redirect once from a private browser window and with a command-line request. Avoid redirecting indiscriminately before the proxy mode is correct; a Cloudflare-to-origin HTTP hop combined with an origin HTTPS redirect creates a loop.
Which Cloudflare SSL mode should you choose?
Use a mode that matches the certificate and protocol on the origin. Cloudflare recommends Full (strict) whenever possible.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
| Mode | Cloudflare-to-origin connection | Certificate validation | Operational consequence |
|---|---|---|---|
| Full (strict) | HTTPS | Certificate is valid, unexpired, and hostname-matched; public CA or Cloudflare Origin CA | Preferred production setting; a failed validation can produce error 526 |
| Full | HTTPS | Certificate is not validated | Encrypts the hop but does not prove the origin identity |
| Flexible | HTTP | No origin HTTPS requirement | Leaves the origin hop unencrypted and can cause redirect loops when the origin forces HTTPS |
Set Cloudflare’s public DNS record to Proxied after the origin is ready. This hides the origin address from ordinary DNS lookups, but it also means the origin normally sees Cloudflare addresses rather than visitor addresses. Permit Cloudflare traffic at the origin firewall, restrict administration to your own management sources, and review every DNS-only record for an accidental origin leak.
How do you verify the real visitor IP?
Check three layers: Cloudflare’s request headers, Nginx’s real-IP handling, and Drupal’s reverse-proxy settings. Configure Nginx to replace the remote address only when the request comes from a known Cloudflare range; never accept CF-Connecting-IP from an unrestricted source.
Then make a test request and inspect the Nginx access log. The recorded address should be your test client’s address, not a Cloudflare edge address. In Drupal, review logs and flood-protection behavior while performing several requests from a controlled client. If every visitor appears to share one address, rate limits can block unrelated users and incident investigations will lose useful evidence.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What should you check immediately after installation?
Use a short acceptance checklist before treating the deployment as complete:
- Drupal’s Status report shows no missing PHP extension, file-permission, database, or security warning.
- HTTP redirects to the chosen HTTPS hostname exactly once.
- The canonical hostname is consistent; the alternate hostname redirects rather than creating duplicate public URLs.
- Cloudflare is set to Full (strict), and the origin certificate is valid for every served hostname.
- Generated absolute URLs use HTTPS and the expected hostname.
- You can sign in, sign out, and start a new session without a redirect loop.
- An authenticated user can upload an allowed file, and the file appears under the intended public or private files path.
- Clearing Drupal caches completes successfully.
- Direct requests for
settings.php, Composer files,vendor, private files, and configuration files are denied rather than downloaded. - The firewall allows web traffic and required Cloudflare ranges while leaving database administration unavailable from the public Internet.
How do you troubleshoot common Nginx, Drupal, and Cloudflare failures?
Cloudflare error 526
Error 526 means Full (strict) could not validate the origin certificate. Confirm that Nginx is listening on 443, the certificate is unexpired, the complete chain is installed, and its names include the hostname Cloudflare requests. Correct the certificate rather than switching permanently to Flexible.
Redirect loop between HTTP and HTTPS
Check the connection mode first. Flexible sends HTTP to the origin, while an origin redirect sends it back to HTTPS, so Cloudflare repeats the request. Install origin HTTPS and select Full (strict), then clear browser and Drupal caches before testing again.
Drupal reports an invalid host
The requested hostname is absent from trusted_host_patterns or its regular expression is malformed. Add the exact canonical and alternate names, escape dots, anchor each expression, and reload PHP-FPM if your deployment caches PHP configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Every request has the same client IP
Nginx or Drupal is recording the proxy address because real-IP handling is missing, or the forwarded header is not trusted from the correct proxy range. Conversely, trusting the header from every source is unsafe. Restrict trust to known Cloudflare and local proxy addresses and test from a controlled client.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Clean URLs return 404 while the front page works
Confirm that the Nginx document root ends in /web and that the main location contains try_files $uri /index.php?$query_string;. Validate the configuration with nginx -t, reload Nginx, and check that PHP-FPM is running with the socket named in fastcgi_pass.
Uploads fail with a permission warning
Ensure web/sites/default/files exists and is writable by the web user, while the rest of the codebase remains non-writable. Check disk space and the Status report, then retry with a small permitted file before changing broader permissions.
How should this Drupal installation be maintained?
Keep application code, database data, uploaded files, and secrets in separate backup plans. Update the Composer lock file in a controlled deployment, test the resulting code, and retain a rollback copy. Back up the database before core or module updates and verify that a restore is possible rather than assuming a successful backup command is sufficient.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Renew the origin certificate before it expires, monitor Nginx and PHP-FPM logs, and review Cloudflare DNS records for newly exposed origin addresses. Recheck trusted hosts and trusted proxy addresses whenever you add a domain, load balancer, staging environment, or CDN path. Security settings that are correct for one request chain can become unsafe after infrastructure changes.
Frequently Asked Questions
Can I use a DNS-only Cloudflare record while setting up Drupal?
Yes. DNS-only access is useful for proving that Nginx, PHP-FPM, and Drupal work at the origin before proxying traffic. Treat the origin address as exposed during that period, restrict the firewall accordingly, and switch to a proxied record after HTTPS and hostname redirects pass your checks.
Does Full (strict) work with a Cloudflare Origin CA certificate?
Yes, provided the certificate is current and its names match the hostname Cloudflare requests. An Origin CA certificate is intended for the Cloudflare-to-origin leg, so visitors should continue to use the proxied hostname rather than connecting directly to the origin.
Should every hostname point to the same Drupal installation?
Only names deliberately served by that installation should resolve there. Add each legitimate name to Drupal’s trusted-host patterns and Nginx’s server name, and use a separate configuration or environment for staging when it must not share production behavior.
Why does Drupal show Cloudflare addresses in its logs after proxying is enabled?
That is the normal result when the web server has not been configured to trust Cloudflare’s client-IP header from known proxy ranges. Configure real-IP handling and Drupal’s reverse-proxy settings together; trusting the header without restricting its source would allow address spoofing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
