Hosted by Qlyne

The hosted connector is the Qlyne proxy running on Qlyne’s servers. Your domain points to Qlyne, Qlyne fetches the pages from your servers (the origins) and applies your rules on the way. Nothing to install, so it fits shared hosting and any place where Docker is not an option. The rules, reports and panel are the same as with the other connectors.

Choose it when you cannot run anything next to your site. If your domain is already on Cloudflare, the Cloudflare Worker is lighter; if you run your own server, the Qlyne proxy keeps everything on your side.

1. Confirm the domain

Open the site in the panel and go to Settings. Set the domain and add the TXT record it shows (_qlyne.your-domain) at your DNS provider, then press Check. Hosting needs a confirmed domain, because Qlyne will answer for it.

2. Tell Qlyne where your site is

Go to Connector › Hosted by Qlyne and add your servers:

• Each origin is an address with http:// or https://: an IP (https://203.0.113.9) or a name that does not point to Qlyne (https://origin.example.com:8443). Scheme, host and port only.
• With more than one origin, visits are spread by weight (1 to 100). A server that stops answering is skipped until it is back; no server turns hosting off.
• Verify the origin certificate is on for https:// origins and checks the certificate by your host name even when the origin is an IP. Turn it off only for a self-signed certificate; the connection stays encrypted.
• Keep each visitor on the same origin is for apps that keep sessions in memory. It is set by a cookie; if that origin goes down, the visitor moves.
• Cache static files: CSS, JS, images and fonts your origin sends as public with a max-age stay on the proxy for that time, so your server is not hit on every visit.

The hosts covered are your domain and www by default. Add other host names within the domain if the site answers on them.

3. Point the DNS to Qlyne

The same screen shows the address to point to. At your DNS provider, make an A record for each host to that address. With your DNS on Cloudflare, keep these records grey (DNS only), or Cloudflare’s proxy would sit in front of Qlyne’s.

The screen tells you when each host already points to Qlyne. The certificate is issued on the first visit after the DNS changes, and your rules apply from then on. Until then nothing changes for your visitors.

4. Lock your origin

Whoever finds your server’s IP can skip Qlyne by calling it directly. Qlyne sends a key in every request, in the Qlyne-Origin-Key header; make your server refuse requests without it. The screen shows the key and the snippet for your server, for example in nginx, inside the server block:

if ($http_qlyne_origin_key != "YOUR_KEY") { return 403; }

What you get

HTTPS with certificates issued and renewed by Qlyne, HTTP/2, compression, every rule of the panel (waiting room, bot score and challenge, firewall, login protection, access gates, security headers) and the TLS fingerprint of each visitor. Requests to your origin carry the visitor’s address in X-Forwarded-For and X-Real-IP, and the signals to your app headers.

Turn hosting off by removing the origins; point the DNS back to your server and the proxy stops answering for the site within a minute.

The same screen is available to assistants over MCP with the hosted-proxy tool.