diff --git a/tests/scripts/setup_env_test.sh b/tests/scripts/setup_env_test.sh
index 4518269..d5f4bd2 100644
--- a/tests/scripts/setup_env_test.sh
+++ b/tests/scripts/setup_env_test.sh
@@ -122,6 +122,28 @@ test_flat_hosts_put_every_address_one_level_deep_beside_the_panel() {
     assert_eq "$(env_lines overlays/config/api-config.env AUTH_COOKIE_DOMAIN)" "AUTH_COOKIE_DOMAIN=.example.com"
 }
 
+test_the_free_cloudflare_plan_puts_every_address_one_level_deep_and_says_so() {
+    make_panel
+    sed -i.bak 's/^CLOUDFLARE=false$/CLOUDFLARE=true/' "$PANEL/.5stack-env.config"
+    set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
+    export CLOUDFLARE_PLAN=free
+    run_setup_env
+    assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=panel-api.example.com"
+    assert_eq "$(env_lines overlays/config/typesense-config.env TYPESENSE_HOST)" "TYPESENSE_HOST=panel-search.example.com"
+    assert_contains "$(cat "$WORK_DIR/setup-output")" "Cloudflare's free plan only covers one level below example.com, so the addresses become panel-api.example.com, panel-ws.example.com, panel-tv.example.com, panel-demos.example.com, panel-hls.example.com, panel-console.example.com, panel-search.example.com."
+    assert_contains "$(cat "$WORK_DIR/setup-output")" "Other sites on example.com will receive the panel's sign-in cookie."
+}
+
+test_a_paid_cloudflare_plan_keeps_every_address_under_the_panel() {
+    make_panel
+    sed -i.bak 's/^CLOUDFLARE=false$/CLOUDFLARE=true/' "$PANEL/.5stack-env.config"
+    set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
+    export CLOUDFLARE_PLAN=paid
+    run_setup_env
+    assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=api.panel.example.com"
+    assert_not_contains "$(cat "$WORK_DIR/setup-output")" "sign-in cookie"
+}
+
 test_a_root_domain_keeps_its_addresses_under_it() {
     make_panel
     set_env overlays/config/api-config.env WEB_DOMAIN example.com
diff --git a/utils/setup-env.sh b/utils/setup-env.sh
index 9e48d4a..64bc1b4 100755
--- a/utils/setup-env.sh
+++ b/utils/setup-env.sh
@@ -165,8 +165,29 @@ panel_host() {
     fi
 }
 
+ask_cloudflare_plan() {
+    local answer
+    while true; do
+        read -p "Which Cloudflare plan is ${WEB_DOMAIN#*.} on? Free or Pro or Higher (f/p): " answer
+        case "$answer" in
+            f) CLOUDFLARE_PLAN=free; return ;;
+            p) CLOUDFLARE_PLAN=paid; return ;;
+        esac
+        echo "Please enter 'f' or 'p'"
+    done
+}
+
+flat_hosts_alert() {
+    local parent="${WEB_DOMAIN#*.}" sub names=""
+    for sub in api ws tv demos hls console search; do
+        names="${names:+$names, }$(flat_host "$sub")"
+    done
+    warn "Cloudflare's free plan only covers one level below $parent, so the addresses become $names."
+    warn "Other sites on $parent will receive the panel's sign-in cookie."
+}
+
 ask_flat_hosts() {
-    local parent="${WEB_DOMAIN#*.}"
+    local parent="${WEB_DOMAIN#*.}" interactive=true
     if [[ "$parent" != *.* ]]; then
         FLAT_HOSTS=false
         return
@@ -174,8 +195,25 @@ ask_flat_hosts() {
     if [ -n "$FLAT_HOSTS" ] || [ -n "$API_DOMAIN$WS_DOMAIN$RELAY_DOMAIN$DEMOS_DOMAIN$GAME_STREAM_DOMAIN$S3_CONSOLE_HOST$TYPESENSE_HOST" ]; then
         return
     fi
-    FLAT_HOSTS=false
     if [ "$ASSUME_YES" = true ] || [ ! -t 0 ]; then
+        interactive=false
+    fi
+    FLAT_HOSTS=false
+    if [ "$CLOUDFLARE" = true ]; then
+        if [ -z "$CLOUDFLARE_PLAN" ] && [ "$interactive" = true ]; then
+            ask_cloudflare_plan
+        fi
+        if [ "$CLOUDFLARE_PLAN" != free ]; then
+            return
+        fi
+        FLAT_HOSTS=true
+        flat_hosts_alert
+        if [ "$interactive" = true ] && ! ask_yes_no "Keep every address one level deep? n keeps them under the panel, straight to this server"; then
+            FLAT_HOSTS=false
+        fi
+        return
+    fi
+    if [ "$interactive" != true ]; then
         return
     fi
     echo "Sign-in then covers all of $parent, so other sites on $parent get the panel's sign-in cookie."