The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To set up Moodle behind Nginx and Cloudflare, use one canonical public HTTPS address, such as https://moodle.example.com, and make that address consistent in Cloudflare DNS, Nginx, the TLS certificate, and Moodle’s $CFG->wwwroot. Configure Nginx to pass the HTTPS scheme to Moodle, set Moodle’s proxy-SSL setting when TLS ends before the application, and use Cloudflare Full (strict) with a valid origin certificate. This combination avoids common redirect loops, broken CSS or JavaScript, and certificate errors.
How does Moodle traffic flow through Cloudflare and Nginx?
Cloudflare sits in front of your server, Nginx accepts the request at the origin, and Nginx proxies it to the Moodle application. With this arrangement, a browser connects to Cloudflare over HTTPS, and Cloudflare connects to Nginx over HTTPS when the encryption mode is configured accordingly. Nginx then forwards the request to Moodle.
Choose a dedicated public hostname such as moodle.example.com and treat its hostname and HTTPS scheme as a single canonical address. Moodle generates links from its configured public root. If Moodle believes the site is HTTP or uses a different hostname from the one in the browser, generated asset URLs can be wrong, resulting in missing styles or scripts and potentially confusing redirects.
Keep the same public hostname in Cloudflare DNS, Nginx’s server_name, the certificate’s subject alternative name (SAN) or common name (CN), and Moodle’s $CFG->wwwroot. Keep the scheme HTTPS in Moodle and in the forwarded protocol header. A mismatch at any of these points can make the site behave as though it is hosted at a different address.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What each layer is responsible for
- Cloudflare DNS and proxy: publishes the Moodle hostname, accepts visitor connections, and establishes the Cloudflare-to-origin connection according to the selected TLS mode.
- Nginx: listens on ports 80 and 443, presents the origin certificate, redirects plain HTTP, and forwards the request and proxy headers to the Moodle service.
- Moodle: uses
wwwrootto generate links, interprets the forwarded HTTPS scheme, serves files and courses, and makes its own outbound connections for updates and integrations. - PHP and the application service: enforce their own request-size and execution limits. A request accepted by Cloudflare and Nginx can still be rejected here if those limits are lower.
Keeping these responsibilities separate makes diagnosis easier. A browser-to-Cloudflare problem is different from an origin certificate problem, and neither is fixed by changing Moodle’s URL. Check the layer that owns the failing behavior.
Which Cloudflare TLS mode should Moodle use?
For a production Moodle site, use Full (strict) when the origin has a valid certificate that covers the hostname. This mode encrypts the Cloudflare-to-origin connection and validates the origin certificate; it is a better fit than a mode that encrypts without verifying that certificate.
| Cloudflare mode | Cloudflare-to-origin connection | Certificate validation | What it means for this setup |
|---|---|---|---|
| Flexible | Plaintext HTTP | Not applicable to the origin leg | Avoid it if Nginx redirects HTTP to HTTPS: Cloudflare can keep sending HTTP to the origin, which redirects back and creates a loop. |
| Full | Encrypted HTTPS | The origin certificate is not validated | Encrypts the origin leg, but does not provide the origin-certificate validation of Full (strict). |
| Full (strict) | Encrypted HTTPS | Cloudflare validates the origin certificate | Recommended when the certificate is unexpired and matches the requested hostname. |
Cloudflare’s HTTPS arrangement has two separate connections to configure: visitor-to-Cloudflare and Cloudflare-to-origin. A certificate at the origin does not by itself tell Moodle that the original browser request was HTTPS. Nginx must forward the HTTPS scheme, and Moodle must be configured to recognize it when TLS terminates before the application.
Full (strict) requires an unexpired origin certificate issued either by a publicly trusted certificate authority or by Cloudflare Origin CA, with the requested hostname present in the certificate’s CN or SAN. A Let’s Encrypt certificate on Nginx is one way to meet the public-CA requirement. Do not select strict mode until the origin is reachable over port 443 and its certificate passes those checks.
Choosing the certificate and checking its name
The hostname in the browser is the name Cloudflare uses when validating the origin. If visitors use moodle.example.com, that exact name must appear in the certificate SAN or CN; a certificate for a different subdomain is not a substitute. Check the expiration date and issuer before enabling strict mode, then renew the certificate before it expires. If you use Cloudflare Origin CA, install the issued certificate and private key on Nginx and keep the origin reachable only through the intended proxy path.
What should the Nginx reverse-proxy configuration contain?
The following representative configuration terminates TLS at Nginx, proxies requests to a Moodle service at moodle:8080, and redirects HTTP requests to HTTPS. Replace the upstream address and certificate paths with the values for your environment; the example assumes the application is reachable at that upstream.
server {
listen 443 ssl http2;
server_name moodle.example.com;
ssl_certificate /etc/letsencrypt/live/moodle.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/moodle.example.com/privkey.pem;
client_max_body_size 100M;
location / {
proxy_pass http://moodle:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_read_timeout 300s;
}
}
server {
listen 80;
server_name moodle.example.com;
return 301 https://$host$request_uri;
}The headers preserve information Moodle and the upstream may need. Host and X-Forwarded-Host carry the public host; X-Forwarded-Proto tells the upstream the browser-facing scheme was HTTPS; and the forwarded address headers carry client-address information through the proxy chain. The sample explicitly sets the forwarded protocol to HTTPS because this server block handles TLS requests.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
The example also sets a 100 MB Nginx request-body limit and a 300-second proxy read timeout. These are configuration values in the example, not universal requirements: choose limits that suit the courses and uploads your site must handle. Moodle uploads can be rejected if Nginx allows a larger body than PHP does, so align client_max_body_size with PHP’s upload_max_filesize and post_max_size.
Why every directive matters
listen 443 ssl http2makes Nginx accept encrypted requests for the public endpoint. The certificate and key paths must point to the files that cover the configured hostname.server_nameselects this virtual host. A typo or a different hostname can route Cloudflare to the wrong server block and produce a certificate mismatch or an unexpected site.proxy_passpoints to the Moodle service. Confirm that the upstream address is reachable from Nginx before troubleshooting Cloudflare.proxy_http_version 1.1and the host headers preserve a normal HTTP request to the application rather than replacing the public host with an internal service name.proxy_read_timeout 300sgives long-running Moodle responses time to finish. If you increase it for a particular workload, keep the value intentional rather than using an unlimited timeout.- The port-80 block performs one canonical redirect. It should redirect to the same host requested by the visitor, not to a second Moodle hostname.
After editing Nginx, validate the configuration and reload the service using your operating system’s normal procedure. Then test the origin directly over HTTPS before enabling Cloudflare proxying. This isolates syntax, upstream connectivity, and certificate problems from DNS and edge behavior.
Which Moodle settings need to change behind the proxy?
Set Moodle’s public root to the exact HTTPS URL learners and administrators use. If TLS terminates at Nginx or Cloudflare before traffic reaches Moodle, configure Moodle to recognize the forwarded HTTPS scheme and ensure Nginx sends X-Forwarded-Proto: https.
- In Moodle’s configuration, set
$CFG->wwwrootto the canonical URL, for examplehttps://moodle.example.com. - When a proxy terminates TLS before Moodle, set
$CFG->sslproxy = 1. This setting belongs with a proxy configuration that correctly forwards the HTTPS scheme. - Use
$CFG->reverseproxy = trueonly if the same installation is intentionally accessed through multiple base URLs. A single canonical hostname does not require that mode. - In Moodle, review Administration > Site administration > Server > HTTP for the reverse-proxy header ordering. Normally keep slash arguments enabled.
- Enable HTTPS logins only after the proxy path and certificate are working, so an unfinished HTTPS setup does not lock administrators out.
These settings solve different parts of the problem: wwwroot defines the public site address Moodle uses when generating URLs, while sslproxy lets Moodle account for HTTPS when TLS has been terminated upstream. Setting only one does not fix a mismatch in the other layer.
When should you use reverse-proxy mode?
A single canonical hostname is the simplest and least surprising arrangement. Keep wwwroot fixed to that hostname and use the normal proxy headers. Moodle’s legacy reverse-proxy option is intended for an installation deliberately reachable through multiple base URLs. Enabling it merely because Nginx or Cloudflare is present can make URL behavior harder to reason about. Decide first whether multiple public base URLs are a real requirement; if they are not, leave that option out.
Slash arguments and file URLs
Moodle file delivery can use slash arguments in the URL. Review the slash-argument setting under Administration > Site administration > Server > HTTP and normally leave it enabled. Test an actual course file after the proxy is deployed, because a homepage can work while a rewrite or proxy rule mishandles a file path.
How do PHP limits and timeouts affect Moodle uploads?
Request size is enforced at more than one layer. Cloudflare, Nginx, PHP, and Moodle’s own handling must all accept the intended course or assignment upload. The Nginx example permits 100 MB, but that number is only useful if PHP’s upload_max_filesize and post_max_size are at least as large. If either PHP value is lower, users may see an upload failure even though Nginx accepted the request.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Set the limits deliberately for the largest file your courses need, then restart or reload the PHP service as required by your deployment so the new values are active. Test a file near the expected maximum rather than relying on a tiny test upload. Also test a request that takes time to process; the 300-second Nginx read timeout in the example is intended to prevent long Moodle responses from being cut off prematurely, but it should match the behavior you actually need.
How do you deploy the setup in a safe order?
Build and verify the origin path before turning on Cloudflare proxying. Then set Moodle’s public URL and strict TLS mode to match the fully configured HTTPS endpoint.
- Create the public hostname in Cloudflare DNS. Use a dedicated name such as
moodle.example.com. Leave proxying off until the origin can be reached and tested directly. - Install a certificate for the hostname on Nginx. Confirm that it is unexpired and covers the exact hostname. Test HTTPS on Nginx’s port 443 before asking Cloudflare to connect to the origin.
- Configure Nginx. Add the HTTPS proxy server block and the HTTP-to-HTTPS redirect. Set a suitable request-body limit and timeout, and align the body limit with PHP’s upload and post limits.
- Configure Moodle. Set
$CFG->wwwrootto the exact public HTTPS URL, set$CFG->sslproxy = 1when TLS terminates upstream, and review the reverse-proxy header ordering in Moodle’s HTTP administration settings. - Choose Cloudflare Full (strict). Enable proxying after the origin is reachable over HTTPS and its certificate meets strict validation requirements.
- Test the learner and administrator paths. Check login, CSS and JavaScript, slash-argument file delivery, course uploads, redirects, and client-IP logging. If URL or theme settings changed, purge Moodle caches.
Preflight checklist before switching DNS proxying on
- The DNS record points to the intended origin and the public hostname is spelled identically everywhere.
- Nginx answers on port 443 with a certificate whose SAN or CN contains the public hostname.
- The origin can reach the Moodle upstream at the address in
proxy_pass. - The port-80 request redirects once to the HTTPS version of the same hostname.
- Moodle’s
wwwrootuses HTTPS, andsslproxyis set when TLS ends at the proxy. - Nginx’s body limit and PHP’s two upload limits accommodate the required course files.
- Cloudflare is set to Full (strict), not Flexible, once the origin certificate has passed its checks.
How can you tell whether the setup is working?
Test both ordinary page loads and functions that rely on Moodle’s generated URLs or file handling. A successful homepage alone does not confirm that uploads, proxy-aware HTTPS, or client-IP logging are correct.
- Address and certificate: Open the canonical HTTPS hostname and confirm the browser is using the expected address. The origin certificate must cover that hostname for Full (strict).
- Redirect behavior: An HTTP request should end at the HTTPS hostname without cycling between schemes or hosts.
- Page assets: Check that stylesheets and JavaScript load; broken assets can signal that Moodle’s public root does not match the browser-facing URL.
- File delivery: Test a Moodle file path that uses slash arguments, as well as a course upload large enough to exercise the configured limits.
- Application logs: Confirm that the logging layer uses trusted original-client headers rather than mistaking the Cloudflare edge address for the visitor.
- Administrative actions: Sign in, open a course, save a setting, and verify that the session remains on the same HTTPS hostname. This catches scheme or host changes that a public page may not reveal.
- Outbound functions: Verify that Moodle can reach language-pack and update services, repositories, portfolios, plagiarism or messaging plugins, and timezone update services when your site uses them.
How do you fix common Moodle, Nginx, and Cloudflare errors?
Start with the failing layer rather than changing several settings at once. Redirect loops usually point to the TLS mode or forwarded scheme; missing assets usually point to the public URL; 525 or 526 errors point to the origin connection or certificate; and failed uploads point to a limit somewhere in the request path.
| Symptom | Likely cause | What to check |
|---|---|---|
ERR_TOO_MANY_REDIRECTS |
Flexible mode is sending HTTP to an origin that redirects to HTTPS, or Moodle is not receiving the forwarded HTTPS scheme. | Use Full (strict) when the origin certificate is valid; confirm Nginx sends X-Forwarded-Proto: https and Moodle has $CFG->sslproxy = 1 when required. |
| Broken CSS or JavaScript | The public hostname or scheme in Moodle differs from the URL in the browser. | Make Moodle’s wwwroot, Nginx server_name, Cloudflare hostname, and certificate hostname consistent, using the public HTTPS URL. |
| Cloudflare 525 or 526 | The origin cannot be reached over HTTPS or its certificate is invalid or mismatched. | Check origin availability on port 443, certificate expiry and issuer, and whether the certificate CN or SAN covers the requested hostname. |
| Course uploads fail | Nginx or PHP rejects the request body because its limit is too low. | Review Nginx client_max_body_size and PHP upload_max_filesize and post_max_size; raise them consistently for the required upload size. |
| Logs show only Cloudflare addresses | The logging or application layer is recording the socket peer instead of the original visitor address. | Configure the trusted proxy chain and logging layer to consume Cloudflare’s CF-Connecting-IP or the appropriate X-Forwarded-For chain. |
Redirect loops: isolate the two HTTPS legs
First determine whether the browser-to-Cloudflare leg is HTTPS. Then determine whether Cloudflare is using HTTPS to Nginx. Flexible mode leaves the second leg as HTTP, so an origin redirect to HTTPS can repeat indefinitely. With Full (strict), inspect the origin certificate and port 443 availability. If the mode is correct, verify that Nginx sends X-Forwarded-Proto: https and that Moodle’s sslproxy setting reflects the TLS termination point.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Missing CSS or JavaScript: inspect generated URLs
View the failing asset URL in the browser and compare its host and scheme with $CFG->wwwroot. If Moodle emits an HTTP URL, a different hostname, or a path that bypasses the proxy, correct the public root and proxy headers first. Purge Moodle caches after changing URL or theme settings so previously generated references do not obscure the fix.
525 and 526 errors: distinguish reachability from validation
A 525 indicates that Cloudflare cannot complete the SSL connection to the origin. Check that Nginx is listening on port 443 and that the origin is reachable. A 526 indicates that strict validation failed; check the certificate’s expiration, issuer, and SAN or CN. Full (strict) requires both a reachable origin and a matching, unexpired certificate.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How should Moodle recover the visitor’s real IP address?
When Cloudflare proxies the request, the origin connection’s socket address belongs to a Cloudflare edge, not the visitor. Cloudflare provides the original address in CF-Connecting-IP and X-Forwarded-For; configure the trusted proxy chain and logging layer to use the appropriate header.
Do not accept forwarding headers indiscriminately from any request. If a client can bypass Cloudflare and reach the origin, it may be able to supply its own forwarding values. Trust the headers only along the proxy chain you control, and avoid exposing a direct-origin path that undermines that trust.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchComparing client-IP choices
| Approach | Result | Trade-off |
|---|---|---|
| Use the socket peer address | Logs show Cloudflare edge addresses. | Simple, but it does not identify the visitor. |
Use CF-Connecting-IP |
Records Cloudflare’s dedicated original-client header. | Accurate when requests are trusted to come through Cloudflare. |
Use the trusted X-Forwarded-For chain |
Preserves addresses through multiple proxies. | Requires correct proxy-chain trust and must not accept arbitrary client-supplied values. |
What deployment choices should you compare?
There is no single proxy layout for every Moodle installation. Compare the options against the same operational requirements: TLS validation, where TLS terminates, whether one or multiple public hostnames are needed, maximum upload size, timeout behavior, and client-IP fidelity.
| Decision | Option A | Option B | Practical consequence |
|---|---|---|---|
| Origin TLS validation | Full | Full (strict) | Both encrypt the origin leg, but only Full (strict) validates the origin certificate. Strict is preferred when its certificate requirements can be met. |
| TLS termination | Cloudflare only | Nginx and Cloudflare | Cloudflare still needs a correctly configured origin connection. If Nginx terminates TLS, it must present the certificate and forward the HTTPS scheme to Moodle. |
| Public hostnames | One canonical hostname | Multiple intentional base URLs | One hostname keeps wwwroot and redirects straightforward. Multiple bases may require Moodle reverse-proxy mode and careful header ordering. |
| Upload capacity | Default limits | Raised, aligned limits | Small defaults can reject course files. Nginx and both PHP size settings must support the same intended maximum. |
| Timeout behavior | Short proxy timeout | 300-second example timeout | Long Moodle responses can fail if Nginx stops waiting too soon. Choose a deliberate value for your workload. |
| Client-IP fidelity | Socket peer logging | Trusted Cloudflare headers | The first records edge addresses; the second can record visitors when direct-origin bypass is controlled. |
What does this deployment not configure automatically?
A working reverse proxy does not configure PHP’s upload limits, guarantee that Moodle’s generated URLs use the public hostname, or make the application interpret forwarded headers correctly. Those are separate settings at separate layers and need their own verification.
Moodle also needs outbound Internet access for tasks such as obtaining language packs and updates, connecting to repositories and portfolios, and supporting plagiarism, messaging, and timezone updates. A site that loads through Cloudflare can still have problems with these functions if its server cannot make outbound connections.
Cloudflare proxying also does not replace certificate renewal, Nginx configuration checks, Moodle cache management, or log review. Keep a record of the canonical hostname, certificate location, selected TLS mode, upload limits, and trusted proxy behavior so future changes can be tested against the same baseline.
Operational pitfalls to avoid
- Turning on Flexible mode for convenience: it can conflict immediately with an origin that redirects HTTP to HTTPS.
- Using a certificate for the wrong name: Full (strict) checks the requested hostname, not merely whether some certificate is installed.
- Changing only Moodle’s URL: Nginx, DNS, the certificate, and forwarded headers must agree with it.
- Raising only one upload limit: the smallest limit in the path still wins.
- Trusting every forwarding header: a request that bypasses Cloudflare can spoof values unless the proxy chain is restricted.
- Enabling HTTPS login protection too early: finish and test the certificate and proxy path before enforcing it.
- Skipping file and asset tests: a working home page does not prove slash arguments, CSS, JavaScript, or course uploads work.
Frequently Asked Questions
Can I use a Cloudflare Origin CA certificate with Full (strict)?
Yes. Cloudflare accepts an unexpired Cloudflare Origin CA certificate for the origin connection, provided the requested hostname matches the certificate’s CN or SAN. A publicly trusted certificate such as Let’s Encrypt is another supported route.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Why does Moodle need outbound Internet access if Cloudflare is serving the site?
Cloudflare handles incoming web traffic, not Moodle’s outbound connections. Moodle may need outbound access for language packs, updates, repositories, portfolios, plagiarism or messaging plugins, and timezone updates.
Where do I check Moodle’s slash-argument setting?
Open Administration > Site administration > Server > HTTP and review the slash-argument setting there. It is normally kept enabled.
Why am I getting an infinite redirect loop after enabling Cloudflare?
The usual cause is Flexible mode sending HTTP to an origin that redirects to HTTPS. Select Full (strict) when the origin certificate is valid, confirm Nginx sends X-Forwarded-Proto: https, and set Moodle’s $CFG->sslproxy = 1 when TLS terminates upstream.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why is Moodle CSS missing behind Nginx?
Compare the browser’s asset URL with Moodle’s $CFG->wwwroot. The public hostname and HTTPS scheme must match the Cloudflare hostname, Nginx server_name, and certificate. Purge Moodle caches after correcting URL or theme settings.
Do I need $CFG->reverseproxy = true for every Nginx deployment?
No. A single canonical public hostname normally needs $CFG->wwwroot and the proxy-SSL setting, not reverse-proxy mode. Use reverse-proxy mode only when the installation is intentionally reachable through multiple base URLs.
Why does Cloudflare show error 525 or 526?
For 525, check that Nginx is reachable on port 443 and can complete the origin TLS connection. For 526, check that the origin certificate is unexpired, issued by an accepted authority, and contains the requested hostname in its SAN or CN.
Why do Moodle logs show Cloudflare IP addresses instead of users?
The application is recording the socket peer. Configure the trusted proxy chain and logging layer to consume CF-Connecting-IP or the appropriate X-Forwarded-For value, and prevent direct-origin requests from supplying arbitrary headers.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhy do large course uploads fail even though the page loads?
Nginx and PHP enforce independent request-size limits. Align client_max_body_size, upload_max_filesize, and post_max_size with the largest file your courses require, then reload the affected services.
The Bottom Line
Use one canonical HTTPS hostname, a matching certificate, Nginx proxy headers, and Moodle’s wwwroot and sslproxy settings as one coordinated configuration. Prefer Cloudflare Full (strict), align Nginx and PHP upload limits, trust original-IP headers only through a controlled proxy chain, and test redirects, assets, files, uploads, logging, and outbound Moodle features before calling the deployment complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
