| Cloudflare Fundamentals | |
| What is Cloudflare? | |
| 1 min read | |
| Cloudflare is a global network of servers | |
| . When you add your application to Cloudflare, we use this network to sit in between | |
| requests and your origin server. | |
| This position allows us to do several things — speeding up content delivery and user | |
| experience ( CDN), protecting your website from malicious activity ( DDoS, Web Application | |
| Firewall), routing traffic (Load balancing, Waiting Room), and more. | |
| How Cloudflare works | |
| 3 min read | |
| Fundamentally, Cloudflare is a large network of servers that can improve the security, | |
| performance, and reliability of anything connected to the Internet. | |
| Cloudflare does this by serving as a reverse proxy | |
| for your web traffic. All requests to and from your origin flow through Cloudflare and — as | |
| these requests pass through our network — we can apply various rules and optimizations to | |
| improve security, performance, and reliability. | |
| Life of a request | |
| Even though it feels pretty instantaneous, there’s a lot happening when you type | |
| www.example.com into your browser. | |
| A website’s content does not technically live at a URL like www.example.com, but rather at | |
| an IP address like 192.0.2.1. It’s similar to how we say that Cloudflare’s headquarters is | |
| 101 Townsend St., San Francisco, CA 94107, but really that address is just a placeholder for | |
| latitude and longitude coordinates (37.780259, -122.390519). URLs and street addresses | |
| are much easier for humans to remember. | |
| The process of converting a human-readable URL (www.example.com) into a | |
| machine-friendly address (192.0.2.1) is known as a DNS lookup | |
| . | |
| Without Cloudflare | |
| Without Cloudflare, DNS lookups for your application’s URL return the IP address of your | |
| origin server | |
| . | |
| URL Returned IP | |
| address | |
| example.c 192.0.2.1 | |
| om | |
| When using Cloudflare with unproxied DNS records, DNS lookups for unproxied domains or | |
| subdomains also return your origin’s IP address. | |
| Another way of thinking about this concept is that visitors directly connect with your origin | |
| server. | |
| ConnectionVisitor | |
| Origin server | |
| With Cloudflare | |
| With Cloudflare — meaning your domain or subdomain is using proxied DNS records — | |
| DNS lookups for your application’s URL will resolve to Cloudflare Anycast IPs | |
| instead of their original DNS target. | |
| URL Returned IP | |
| address | |
| example.c 104.16.77.250 | |
| om | |
| This means that all requests intended for proxied hostnames will go to Cloudflare first and | |
| then be forwarded to your origin server. | |
| Visitor ← Connection → Cloudflare global network ←Connection→Origin Server | |
| Cloudflare assigns specific Anycast IPs to your domain dynamically and these IPs may | |
| change at any time. This is an expected part of the operation of our Anycast network and | |
| does not affect the proxy behavior described above. | |
| Benefits | |
| When your traffic is proxied through Cloudflare before reaching your origin server, your | |
| application gets additional security, performance, and reliability benefits. | |
| Security | |
| Beyond hiding your origin’s IP address from potential attackers, Cloudflare also stops | |
| malicious traffic before it reaches your origin web server. | |
| Cloudflare automatically mitigates security risks using our WAF and DDoS protection. | |
| For additional details on security, refer to our guide on how to Secure your website. | |
| Performance | |
| For proxied traffic, Cloudflare also serves as a Content Delivery Network (CDN) | |
| , caching static resources and otherwise optimizing asset delivery. | |
| For additional details on performance, refer to our guides on Optimizing Site Speed and | |
| Caching. | |
| Reliability | |
| Cloudflare’s globally distributed Anycast network | |
| routes visitor requests to the nearest Cloudflare data center. | |
| Combined together with our CDN | |
| and DDoS protection, our network helps keep your application online. | |
| Cloudflare IPs | |
| 2 min read | |
| Cloudflare has several IP address ranges | |
| which are shared by all proxied hostnames. | |
| Together, these IP addresses form the backbone of our Anycast network | |
| , helping distribute traffic amongst various edge network servers. | |
| Cloudflare uses other IP ranges for various products and services, but these addresses will | |
| not make connections to your origin. | |
| Allow Cloudflare IP addresses | |
| Because of how Cloudflare works, all traffic to proxied DNS records pass through Cloudflare | |
| before reaching your origin server. This means that your origin server will stop receiving | |
| traffic from individual visitor IP addresses and instead receive traffic from Cloudflare IP | |
| addresses | |
| , which are shared by all proxied hostnames. | |
| This setup can cause issues if your origin server blocks or rate limits connections from | |
| Cloudflare IP addresses. Because all visitor traffic will appear to come from Cloudflare IP | |
| addresses, blocking these IPs — even accidentally — will prevent visitor traffic from | |
| reaching your application. | |
| To avoid rate limiting or blocking these requests, you will need to allow Cloudflare IPs at your | |
| origin server. | |
| For Magic Transit customers, Cloudflare routes the traffic instead of proxying it. Once | |
| Cloudflare starts advertising your IP prefixes, it will accept IP packets destined for your | |
| network, process them, and then output these packets to your origin infrastructure. | |
| Customize Cloudflare IP addresses | |
| If they do not want to use Cloudflare IP addresses — which are shared by all proxied | |
| hostnames — Enterprise customers have two potential alternatives: | |
| ● Bring Your Own IP (BYOIP): Cloudflare announces your IPs in all our locations. | |
| ● Static IP addresses: Cloudflare sets static IP addresses for your domain. For more | |
| details, contact your account team. | |
| Business and Enterprise customers can also reduce the number of Cloudflare IPs that their | |
| domain shares with other Cloudflare customer domains by uploading a Custom SSL | |
| certificate. | |
| Reference architectures | |
| 1 min read | |
| Reference architecture documents and diagrams are designed to provide a foundational | |
| knowledge of Cloudflare solutioning for a variety of products. Building on the information in | |
| these documents, you can architect software solutions based on your specific context and | |
| needs. | |
| ● Content Delivery Network | |
| ● Magic Transit | |
| ● Multi-vender Application Security and Performance | |
| Account setup | |
| To create a Cloudflare account: | |
| 1. Go to the Sign up page | |
| 1. . | |
| 2. Enter your Email and Password. | |
| 3. Click Create Account. | |
| Once you create your account, Cloudflare will automatically send an email to your address to | |
| verify that email address. | |
| Best practices | |
| If you are creating an account for your team or a business, we recommend choosing an | |
| email alias or distribution list for your Email, such as cloudflare@example.com. | |
| This email address is the main point of contact for your Cloudflare billing, usage notifications, | |
| and account recovery. | |
| Set-up 2FA | |
| 2 min read | |
| Two-factor authentication (2FA) allows user account owners to add an additional layer of | |
| login security to Cloudflare accounts. This additional authentication step requires you to | |
| provide both something you know, such as a Cloudflare password, and something you have, | |
| such as an authentication code from a mobile device. | |
| Cloudflare user accounts configured to use single sign-on (SSO) cannot configure 2FA. | |
| Cloudflare offers the option to use either a phishing-resistant security key, like a YubiKey, or | |
| a Time-Based One-Time password (TOTP) mobile app for authentication, like Google | |
| Authenticator, or both. If you add both of these authentication methods to your account, you | |
| are initially prompted to log in with the security key, but can opt-out and use TOTP instead. | |
| To ensure that you can securely access your account even without your mobile device or | |
| security keys, Cloudflare also provides backup codes for download. | |
| Tip | |
| After downloading your backup codes, we recommend saving them in a secure location. | |
| As the user account owner, you are automatically assigned the Super Administrator role. | |
| Once 2FA is enabled, all Cloudflare account members are required to configure 2FA on their | |
| mobile devices. | |
| Enable 2FA | |
| We recommend that all Cloudflare user account holders enable two-factor authentication | |
| (2FA) to keep your accounts secure. | |
| 2FA can only be enabled successfully on an account with a verified email address. If you do | |
| not verify your email address first, you may lock yourself out of your account. | |
| Super Administrators can turn on 2FA Enforcement to require all members to enable 2FA. If | |
| you are not a Super Administrator, you will be forced to turn on 2FA prior to accepting the | |
| invitation to join a Cloudflare account as a member. | |
| To enable two-factor authentication for your Cloudflare login: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. . | |
| 2. Under the My Profile dropdown, select My Profile. | |
| 3. Select Authentication. | |
| 4. Select Manage in the Two-Factor Authentication card. | |
| 5. Configure either a TOTP mobile app or a security key to enable 2FA on your account. | |
| Additional configurations | |
| Cloudflare also supports 2FA with device built-in authenticators (Apple Touch ID, Android | |
| fingerprint, or Windows Hello), Yubikeys and TOTP mobile applications. | |
| Customize your account | |
| 2 min read | |
| After creating an account, here are a handful of configurations you can customize: | |
| Account name | |
| Your account name defaults to <<YOUR_EMAIL_ADDRESS>>'s Account. | |
| You may want to customize the name of this account, either to help specify its purpose or to | |
| help associated with multiple accounts. | |
| To change your account name: | |
| 1. Log into the Cloudflare dashboard | |
| 1. . | |
| 2. Go to Manage Account > Configurations. | |
| 3. For Account Name, select Change Name. | |
| 4. Enter a new account name. | |
| 5. Select Save. | |
| Appearance | |
| If you want to adjust how the Cloudflare dashboard appears on your device, you can adjust | |
| relevant settings in your account Profile. | |
| To update appearance preferences: | |
| 1. Log into the Cloudflare dashboard | |
| 1. . | |
| 2. Go to My Profile | |
| 3. For Appearance, choose a value: | |
| ○ Dark: Defaults to darker colors. | |
| ○ Light: Defaults to lighter colors. | |
| ○ Use system setting: Defaults to whatever is used on your device. | |
| 4. Your dashboard display will update to the new appearance setting automatically. | |
| Communication preferences | |
| When you create an account, Cloudflare automatically chooses your Communication | |
| Preferences, or when Cloudflare might occasionally send you emails. | |
| To update the communication preferences for your profile (which requires a verified email | |
| address): | |
| 1. Log into the Cloudflare dashboard | |
| 1. . | |
| 2. Go to My Profile | |
| 3. For Communication Preferences, select Edit. | |
| 4. If you want a specific category of emails, make sure its associated box is checked. | |
| 5. Select Save. | |
| Language preferences | |
| After you create your account, you may want to update your language preference. | |
| To update the language preference for your profile: | |
| 1. Log into the Cloudflare dashboard | |
| . | |
| Go to My Profile | |
| For Language Preference, select a value. | |
| Your dashboard display will update to the new language automatically. | |
| Add and manage other members | |
| 3 min read | |
| Learn how to add new account members, edit or revoke their permissions and access, and | |
| resend verifications emails. | |
| To manage account members, you must have a role of Super Administrator and have a | |
| verified email address. | |
| View account members | |
| To manage account members, you must have a role of Super Administrator and have a | |
| verified email address. | |
| Dashboard mode: | |
| To view members using the dashboard: | |
| 1. Log in to the Cloudflare dashboard | |
| and select your account. | |
| Go to Manage Account > Members. | |
| API mode: | |
| To view members using the API, send a GET request. | |
| Baseurl: | |
| GET https://api.cloudflare.com/client/v4 | |
| An API key is a token that you provide when making API calls. Include the token in a header parameter called | |
| X-Auth-Email. | |
| Example: X-Auth-Email: 123 | |
| An API key is a token that you provide when making API calls. Include the token in a header parameter called | |
| X-Auth-Key. | |
| Example: X-Auth-Key: 123 | |
| An API key is a token that you provide when making API calls. Include the token in a header parameter called | |
| X-Auth-User-Service-Key. | |
| Example: X-Auth-User-Service-Key: 123 | |
| Provide your bearer token in the Authorization header when making requests to protected resources. | |
| Example: Authorization: Bearer 123 | |
| Interact with Cloudflare's products and services via the Cloudflare API. | |
| Using the Cloudflare API requires authentication so that Cloudflare knows who is making | |
| requests and what permissions you have. Create an API token to grant access to the API to | |
| perform actions. | |
| To create an API token, from the Cloudflare dashboard, go to My Profile > API Tokens and | |
| select Create Token. | |
| Add account members | |
| To manage account members, you must have a role of Super Administrator and have a | |
| verified email address. | |
| Dashboard mode: | |
| To add a member to your account: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. and select your account. | |
| 2. Go to Manage Account > Members. | |
| 3. Select Invite. | |
| 4. Fill out the following information: | |
| ○ Invite members: Enter one or more email addresses (if multiple, separate | |
| addresses with commas). | |
| ○ Scope: Use a variety of fields to adjust the scope of your roles. | |
| ○ Roles: Choose one or more roles to assign your members. | |
| 5. Select Continue to summary. | |
| 6. Review the information, then select Invite. | |
| If a user already has an account with Cloudflare and you have an Enterprise account, you | |
| can also select Direct Add to add them to your account without sending an email invitation. | |
| API mode: | |
| POST https://api.cloudflare.com/client/v4/accounts/{account_identifier}/members | |
| Request Sample | |
| curl --request POST \ | |
| --url https://api.cloudflare.com/client/v4/accounts/account_identifier/members \ | |
| --header 'Content-Type: application/json' \ | |
| --header 'X-Auth-Email: ' \ | |
| --data '{ | |
| "email": "user@example.com", | |
| "roles": [ | |
| "3536bcfad5faccb999b47003c79917fb" | |
| ], | |
| "status": "pending" | |
| }' | |
| Response Example | |
| { | |
| "errors": [], | |
| "messages": [], | |
| "result": { | |
| "id": "4536bcfad5faccb111b47003c79917fa", | |
| "roles": [ | |
| { | |
| "description": "Administrative access to the entire Account", | |
| "id": "3536bcfad5faccb999b47003c79917fb", | |
| "name": "Account Administrator", | |
| "permissions": { | |
| "analytics": { | |
| "read": true, | |
| "write": false | |
| }, | |
| "zones": { | |
| "read": true, | |
| "write": true | |
| } | |
| } | |
| } | |
| ], | |
| "status": null, | |
| "user": { | |
| "email": "user@example.com", | |
| "first_name": "John", | |
| "id": "023e105f4ecef8ad9ca31a8372d0c353", | |
| "last_name": "Appleseed", | |
| "two_factor_authentication_enabled": false | |
| }, | |
| "code": "05dd05cce12bbed97c0d87cd78e89bc2fd41a6cee72f27f6fc84af2e45c0fac0" | |
| }, | |
| "success": true | |
| } | |
| Resend an invitation | |
| If you invited a member to your account but they cannot find the invitation or the invitation | |
| expires, you can resend the invitation through the Cloudflare dashboard: | |
| 1. Log in to the Cloudflare dashboard and select your account[^1]. | |
| 2. Go to Manage Account > Members. | |
| 3. Select a member record where their Status is Invite Pending. | |
| 4. Select Resend invite | |
| Create an API token | |
| 2 min read | |
| Prerequisite | |
| Before you begin, find your zone and account IDs. | |
| 1. From the Cloudflare dashboard, go to My Profile > API Tokens. | |
| 2. Select Create Token. | |
| 3. Select a template from the available API token templates or create a custom token. | |
| We use the Edit zone DNS template in the following examples. | |
| 4. Add or edit the token name to describe why or how the token is used. Templates are | |
| prefilled with a token name and permissions. | |
| 5. Modify the token’s permissions. After selecting a permissions group (Account, User, | |
| or Zone), choose what level of access to grant the token. Most groups offer Edit or | |
| Read options. Edit is full CRUDL (create, read, update, delete, list) access, while | |
| Read is the read permission and list where appropriate. Refer to the available token | |
| permissions for more information. | |
| 6. Select which resources the token is authorized to access. For example, granting | |
| Zone DNS Read access to a zone example.com will allow the token to read DNS | |
| records only for that specific zone. Any other zone will return an error for DNS record | |
| reads operations. Any other operation on that zone will also return an error. | |
| 7. (Optional) Restrict how a token is used in the Client IP Address Filtering and TTL | |
| (time to live) fields. | |
| 8. Select Continue to summary. | |
| 9. Review the token summary. Select Edit token to make adjustments. You can also | |
| edit a token after creation. | |
| 10. Select Create Token to generate the token’s secret. | |
| 11. Copy the secret to a secure place. | |
| Warning | |
| The token secret is only shown once. Do not store the secret in plaintext where others can | |
| access it. Anyone with this token can perform the authorized actions against the resources | |
| that the token has access to. | |
| The token secret page also includes an example command to test the token. Use the | |
| /user/tokens/verify endpoint to fetch the current status of the given token. | |
| $ curl "https://api.cloudflare.com/client/v4/user/tokens/verify" \ | |
| -H "Authorization: Bearer <API_TOKEN>" | |
| The result: | |
| { | |
| "result": { | |
| "id": "100bf38cc8393103870917dd535e0628", | |
| "status": "active" | |
| }, | |
| "success": true, | |
| "errors": [], | |
| "messages": [ | |
| { | |
| "code": 10000, | |
| "message": "This API Token is valid and active", | |
| "type": null | |
| } | |
| ] | |
| } | |
| With this you have successfully created an API token and can start working with the | |
| Cloudflare API. After creating your first API token, you can create additional API tokens via | |
| the API. | |
| Add your domain to Cloudflare | |
| Minimize downtime | |
| 2 min read | |
| When making any change to the routing of an Internet application, there is always a | |
| possibility of downtime due to certificate issuance, misconfigured settings, or limitations at | |
| your origin server. To avoid downtime when going live, it’s important to review the most | |
| common configurations. | |
| Update and review DNS records. | |
| Before activating your domain on Cloudflare (exact steps depend on your DNS setup), | |
| review the DNS records in your Cloudflare account. | |
| Start with unproxied records | |
| With a new domain, make sure all your DNS records have a proxy status of DNS-only. | |
| This setting prevents Cloudflare from proxying your traffic before you have an active edge | |
| certificate or before you have allowed Cloudflare IP addresses. | |
| Confirm record accuracy | |
| Take extra time to confirm the accuracy of your DNS records before activating your domain, | |
| paying special attention to: | |
| ● Zone apex records (example.com) | |
| ● Subdomain records (www.example.com or blog.example.com) | |
| ● Email records | |
| If you add DNS records to your authoritative DNS provider between onboarding your domain | |
| and activating your domain, you may need to also add these records within Cloudflare. | |
| Activate your domain. | |
| Finish the DNS setup for your domain, moving the domain status to Active: | |
| ● Full setups: Update the authoritative nameservers at your registrar and wait for that | |
| change to be authenticated. | |
| ● Partial setups: Add the verification TXT record to your authoritative DNS and wait for | |
| that change to be authenticated. | |
| Verify SSL/TLS edge certificates. | |
| Before proxying your traffic through Cloudflare, verify that Cloudflare has an active Edge | |
| Certificate for your domain. | |
| For more details about timing and certificate recommendations, refer to Certificate issuance. | |
| Optional - Test configuration. | |
| You may want to test your configuration using your local machine or proxying traffic from a | |
| development domain or subdomain. | |
| If you experience issues, you should make sure that you have allowed Cloudflare IP | |
| addresses at your origin server. | |
| Update proxy status. | |
| Once you have verified that your SSL/TLS edge certificate is active and you have allowed | |
| Cloudflare IP addresses, change the proxy status of appropriate DNS records to Proxied. | |
| Allow Cloudflare IP addresses | |
| 2 min read | |
| Because of how Cloudflare works, all traffic to proxied DNS records pass through Cloudflare | |
| before reaching your origin server. This means that your origin server will stop receiving | |
| traffic from individual visitor IP addresses and instead receive traffic from Cloudflare IP | |
| addresses | |
| , which are shared by all proxied hostnames. | |
| This setup can cause issues if your origin server blocks or rate limits connections from | |
| Cloudflare IP addresses. Because all visitor traffic will appear to come from Cloudflare IP | |
| addresses, blocking these IPs — even accidentally — will prevent visitor traffic from | |
| reaching your application. | |
| To avoid rate limiting or blocking these requests, you will need to allow Cloudflare IPs at your | |
| origin server. | |
| For Magic Transit customers, Cloudflare routes the traffic instead of proxying it. Once | |
| Cloudflare starts advertising your IP prefixes, it will accept IP packets destined for your | |
| network, process them, and then output these packets to your origin infrastructure. | |
| Review external tools | |
| To avoid blocking Cloudflare IP addresses unintentionally, review your external tools to | |
| check that: | |
| ● Any security plugins — such as those for WordPress — allow Cloudflare IP | |
| addresses. | |
| ● The mod_security | |
| ● plugin is up to date. | |
| Configure origin server | |
| Allowlist Cloudflare IP addresses | |
| To avoid blocking Cloudflare IP addresses unintentionally, you also want to allow Cloudflare | |
| IP addresses at your origin web server. | |
| You can explicitly allow these IP addresses with a .htaccess file or by using iptables. | |
| The following example demonstrates how your could use an iptables rule to allow a | |
| Cloudflare IP address range. Replace $ip below with one of the Cloudflare IP address | |
| ranges | |
| # For IPv4 addresses | |
| iptables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT | |
| # For IPv6 addresses | |
| ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT | |
| Block other IP addresses (recommended) | |
| As a best practice, we also recommend that you explicitly block all traffic that does not come | |
| from Cloudflare IP addresses or the IP addresses of your trusted partners, vendors, or | |
| applications. | |
| For example, you might update your iptables | |
| with the following commands: | |
| #for IPv4 | |
| iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP | |
| #for IPv6 | |
| ip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP | |
| Disable DNSSEC | |
| 2 min read | |
| DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring | |
| requests are not routed to a spoofed domain. | |
| Disable DNSSEC | |
| If you are onboarding an existing domain to Cloudflare, make sure DNSSEC is disabled at | |
| your registrar (where you purchased your domain name). Otherwise, your domain will | |
| experience connectivity errors when you change your nameservers. | |
| Why do I have to disable DNSSEC? | |
| When your domain has DNSSEC enabled, your DNS provider digitally signs all your DNS | |
| records. This action prevents anyone else from issuing false DNS records on your behalf | |
| and redirecting traffic intended for your domain. | |
| However, having a single set of signed records also prevents Cloudflare from issuing new | |
| DNS records on your behalf (which is part of using Cloudflare for your authoritative | |
| nameservers). So if you change your nameservers without disabling DNSSEC, DNSSEC will | |
| prevent Cloudflare’s DNS records from resolving properly. | |
| Add a site | |
| 2 min read | |
| 1. Log in to the Cloudflare dashboard. | |
| 2. In the top navigation bar, click Add site. | |
| 3. Enter your website’s apex domain (example.com) and then click Add Site. | |
| If Cloudflare is unable to identify your domain as a registered domain, make sure you are | |
| using an existing top-level domain | |
| (.com, .net, .biz, or others). | |
| Additionally, Cloudflare requires your apex domain to be one level below a valid TLD | |
| defined in the Public Suffix List (PSL). | |
| 1. Select your plan level. For more details on features and pricing, refer to our Plans | |
| page | |
| . | |
| 2. Review your DNS records. | |
| When you add a new site to Cloudflare, Cloudflare automatically scans for common | |
| records and adds them to the DNS zone. The records show up under the respective | |
| zone DNS > Records page. | |
| 3. Since this scan is not guaranteed to find all existing DNS records, you need to review | |
| your records, paying special attention to the following record types: | |
| a. Zone apex records (example.com) | |
| b. Subdomain records (www.example.com or blog.example.com) | |
| c. Email records | |
| 4. If you activate your domain on Cloudflare without setting up the correct DNS records | |
| for your domain and subdomain, your visitors may experience | |
| DNS_PROBE_FINISHED_NXDOMAIN errors. | |
| 5. If you find any missing records, manually add those records. | |
| 6. Depending on your site setup, you may want to adjust the proxy status for certain A, | |
| AAAA, or CNAME records. | |
| 7. Click Continue. | |
| 8. Go through the Quick Start Guide and when you have finished, click Finish. | |
| Update your nameservers | |
| 1 min read | |
| Once you have added a domain (also known as a zone) to Cloudflare, that domain will | |
| receive two assigned authoritative nameservers. | |
| Before your domain can begin using Cloudflare for DNS resolution, you need to add these | |
| nameservers at your registrar. Make sure DNSSEC is disabled at this point. | |
| Domain Resolution | |
| Ensure all your traffic is proxying through Cloudflare successfully. | |
| Objectives | |
| By the end of this module, you will be able to: | |
| ● Confirm your zone is set up correctly on Cloudflare | |
| ● Recognize and troubleshoot issues with your DNS records and SSL/TLS certificates | |
| Review DNS records | |
| 1 min read | |
| When you add a new site to Cloudflare, Cloudflare automatically scans for common records | |
| and adds them to the DNS zone. The records show up under the respective zone DNS > | |
| Records page. | |
| The DNS records quick scan is not automatically invoked in the following cases: | |
| ● If you choose Enterprise plan and, instead of the Quick Scan, choose to upload a | |
| DNS zone file or add records manually. | |
| ● If you add a zone via the API. | |
| You can manually invoke the quick scan via API with the Scan DNS Records endpoint. Note | |
| that the quick scan is a best effort attempt based on a predefined list of commonly used | |
| record names and types. You can read more about this in the reference page. | |
| Since this scan is not guaranteed to find all existing DNS records, you need to review your | |
| records, paying special attention to the following record types: | |
| ● Zone apex records (example.com) | |
| ● Subdomain records (www.example.com or blog.example.com) | |
| ● Email records | |
| If you want more control over which DNS records are imported and how, import a zone file. | |
| If your domain is added to Cloudflare by a hosting partner, manage your DNS records via the | |
| hosting partner. | |
| Proxy status | |
| 3 min read | |
| The Proxy status of a DNS record affects how Cloudflare treats incoming traffic to that | |
| record. Cloudflare recommends enabling our proxy for all A, AAAA, and CNAME records. | |
| Proxied records | |
| Note that if you have multiple A/AAAA records on the same name and at least one of them is | |
| proxied, Cloudflare will treat all A/AAAA records on this name as being proxied. | |
| When you proxy specific DNS records through Cloudflare - specifically A, AAAA, or CNAME | |
| records — DNS queries for these will resolve to Cloudflare Anycast IPs instead of their | |
| original DNS target. This means that all requests intended for proxied hostnames will go to | |
| Cloudflare first and then be forwarded to your origin server. | |
| This behavior allows Cloudflare to optimize, cache, and protect all requests to your | |
| application, as well as protect your origin server from DDoS attacks | |
| Because requests to proxied hostnames go through Cloudflare before reaching your origin | |
| server, all requests will appear to be coming from Cloudflare’s IP addresses (and could | |
| potentially be blocked or rate limited). If you use proxied records, you may need to adjust | |
| your server configuration to allow Cloudflare IPs. | |
| Cloudflare Anycast IPs used to proxy traffic on your domain are assigned automatically. | |
| These IPs might change at any time for operational reasons. If you need to allowlist | |
| Cloudflare IPs on your infrastructure or hosting provider, include the full list of Cloudflare | |
| Anycast IPs | |
| As an Enterprise customer, you have the option to get static IPs or bring your own IPs | |
| (BYOIP). | |
| Limitations | |
| Record types | |
| By default, Cloudflare only supports proxied A, AAAA, and CNAME records. You cannot proxy | |
| other record types. | |
| If you encounter a CNAME record that you cannot proxy — usually associated with another | |
| CDN provider — a proxied version of that record will cause connectivity errors. Cloudflare is | |
| purposely preventing that record from being proxied to protect you from a misconfiguration. | |
| Ports and protocols | |
| By default, Cloudflare only proxies HTTP and HTTPS traffic. | |
| If you need to connect to your origin using a non-HTTP protocol (SSH, FTP, SMTP) or the | |
| traffic targets an unsupported port at the origin, either leave your records unproxied | |
| (DNS-only) or use Cloudflare Spectrum. | |
| Pending domains | |
| When you add a domain to Cloudflare, Cloudflare protection will be in a pending state until | |
| we can verify ownership. This could take up to 24 hours to complete. | |
| This means that DNS records - even those set to proxy traffic through Cloudflare – will be | |
| DNS-only until your zone has been activated and any requests to your DNS records will | |
| return your origin server’s IP address. | |
| If this warning is still present after 24 hours, refer to Troubleshooting. | |
| For enhanced security, we recommend rolling your origin IP addresses at your hosting | |
| provider after your zone has been activated. This action prevents your origin IPs from being | |
| leaked during onboarding. | |
| Windows authentication | |
| Because Microsoft Integrated Windows Authentication, NTLM, and Kerberos violate | |
| HTTP/1.1 specifications, they are not compatible with proxied DNS records. | |
| Enable DNSSEC | |
| 2 min read | |
| DNS Security Extensions (DNSSEC) adds an extra layer of authentication to DNS, ensuring | |
| requests are not routed to a spoofed domain. | |
| For additional background on DNSSEC, visit the Cloudflare Learning Center | |
| . | |
| When you enable DNSSEC, Cloudflare signs your zone, publishes your public signing keys, | |
| and generates your DS record. | |
| Step 1 - Activate DNSSEC in Cloudflare | |
| 1. Log in to the Cloudflare dashboard | |
| 1. and select your account and domain. | |
| 2. Go to DNS > Settings. | |
| 3. For DNSSEC, click Enable DNSSEC. | |
| 4. In the dialog, you have access to several necessary values to help you create a DS | |
| record at your registrar. Once you close the dialog, you can access this information | |
| by clicking DS record on the DNSSEC card. | |
| Step 2 — Add DS record to your registrar | |
| Add the DS record to your registrar. If Algorithm 13 - Cloudflare’s preferred cipher choice - is | |
| not listed by your registrar, it may also be called ECDSA Curve P-256 with SHA-256. | |
| Provider-specific instructions | |
| Note: | |
| Cloudflare automatically adds DS records for domains using Cloudflare Registrar or those | |
| using .ch and .cz top-level domains. | |
| Create a subdomain | |
| 1 min read | |
| Most subdomains serve a specific purpose within the overall context of your website. For | |
| example, blog.example.com might be your blog, support.example.com could be your | |
| customer help portal, and store.example.com would be your e-commerce site. | |
| Subdomain records | |
| To create a new subdomain, you would first add the subdomain content at your host. | |
| Then, you would create a corresponding A, AAAA, or CNAME record for that subdomain | |
| (blog, store). | |
| Type Name IPv4 Proxy | |
| address status | |
| A www 192.0.2.1 Proxied | |
| Set up email records | |
| 1 min read | |
| Receive email | |
| If you only need to receive emails, Cloudflare offers Email Routing for free email forwarding | |
| to custom email addresses. | |
| Send and receive email | |
| To send and receive emails from your domain, you need: | |
| ● An SMTP provider. | |
| ● To create two DNS records within Cloudflare. | |
| To route emails through Cloudflare and to your mail server: | |
| 1. Get the IP address and MX record details from your SMTP provider (vendor-specific | |
| guidelines). | |
| 2. Add an A or AAAA record for your mail subdomain that points to the IP address of | |
| your mail server. | |
| Type Name IPv4 Proxy | |
| address status | |
| A mail 192.0.2.1 DNS only | |
| 3. API example | |
| 4. Add an MX record that points to that subdomain. | |
| Type Name Mail server TTL | |
| MX @ mail.example. Auto | |
| com | |
| API Example: | |
| Request: | |
| curl -sX POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/dns_records" \ | |
| -H 'x-auth-email: <EMAIL>' \ | |
| -H 'x-auth-key: <API_KEY>' \ | |
| -H "Content-Type: application/json" \ | |
| --data '{ | |
| "type":"MX", | |
| "name":"example.com", | |
| "content":"mail.example.com", | |
| "ttl":3600 | |
| }' | |
| Response: | |
| { | |
| "result": { | |
| "id": "<ID>", | |
| "zone_id": "<ZONE_ID>", | |
| "zone_name": "example.com", | |
| "name": "example.com", | |
| "type": "MX", | |
| "content": "mail.example.com", | |
| "priority": 10, | |
| "proxiable": false, | |
| "proxied": false, | |
| "ttl": 3600, | |
| "locked": false, | |
| "meta": { | |
| "auto_added": false, | |
| "managed_by_apps": false, | |
| "managed_by_argo_tunnel": false, | |
| "source": "primary" | |
| }, | |
| "comment": null, | |
| "tags": [], | |
| "created_on": "2023-01-17T20:54:23.660869Z", | |
| "modified_on": "2023-01-17T20:54:23.660869Z" | |
| }, | |
| "success": true, | |
| "errors": [], | |
| "messages": [] | |
| } | |
| Default improvements | |
| 1 min read | |
| When your DNS records are proxied through Cloudflare, Cloudflare provides free and | |
| unmetered DDoS protection and other protection measures through the Web Application | |
| Firewall (WAF). | |
| DDoS protection | |
| A distributed denial-of-service (DDoS) attack is where a large number of computers or | |
| devices, usually controlled by a single attacker, attempt to access a website or online service | |
| all at once. This flood of traffic can overwhelm the website’s origin servers, causing the site | |
| to slow down or even crash. | |
| For more information about DDoS attacks and Cloudflare DDoS protection, refer to Prevent | |
| DDoS attacks. | |
| Managed rulesets | |
| All customers have access to the Cloudflare Free Managed Ruleset, which provides | |
| mitigations against high and wide-impacting vulnerabilities. | |
| For more details, refer to the WAF documentation. | |
| SSL/TLS settings | |
| 2 min read | |
| Once you make sure that your Cloudflare SSL/TLS is working correctly, you will likely want | |
| to customize your SSL/TLS setup. | |
| Encryption mode | |
| Your zone’s SSL/TLS Encryption Mode controls how Cloudflare manages two connections: | |
| one between your visitors and Cloudflare, and the other between Cloudflare and your origin | |
| server. | |
| Basic setup | |
| The simplest way to choose your encryption mode is to enable the SSL/TLS | |
| Recommender, which scans your domain and recommends the appropriate setting. | |
| To make sure you do not inadvertently block the SSL/TLS Recommender, review your | |
| settings to make sure your domain: | |
| ● Is accessible. | |
| ● Is not blocking requests from our bot (which uses a user agent of | |
| Cloudflare-SSLDetector). | |
| ● Does not have any active, SSL-specific Page Rules or Configuration rules. | |
| Then, you can enable SSL/TLS recommendations in the dashboard: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. and select your account and application. | |
| 2. Go to SSL/TLS. | |
| 3. For SSL/TLS Recommender, switch the toggle to On. | |
| Once enabled, the SSL/TLS Recommender runs an origin scan using the user agent | |
| Cloudflare-SSLDetector and ignores your robots.txt file (except for rules explicitly | |
| targeting the user agent). | |
| Based on this initial scan, the Recommender may decide that you could use a stronger SSL | |
| encryption mode. It will never recommend a weaker option than what is currently configured. | |
| If so, it will send the application owner an email with the recommended option and add a | |
| Recommended by Cloudflare tag to that option on the SSL/TLS page. You are not required | |
| to use this recommendation. | |
| If you do not receive an email, keep your current SSL encryption mode. | |
| Secure setup | |
| If possible, Cloudflare recommends using Full or Full (strict) modes to prevent malicious | |
| connections to your origin. | |
| These modes usually require additional setup and can be more technically challenging. | |
| Enforce HTTPS connections | |
| Even if your application has an active edge certificate, visitors can still access resources | |
| over unsecured HTTP connections. | |
| Using various Cloudflare settings, however, you can force all or most visitor connections to | |
| use HTTPS. | |
| Evaluate additional features | |
| After you have chosen your encryption mode and enforced HTTPS connections, evaluate | |
| the following settings: | |
| ● Edge certificates: Customize different aspects of your edge certificates, from enabling | |
| Opportunistic Encryption to specifying a Minimum TLS Version. | |
| ● Authenticated origin pull: Ensure all requests to your origin server originate from the | |
| Cloudflare network. | |
| ● Notifications: Set up alerts related to certificate validation status, issuance, | |
| deployment, renewal, and expiration. | |
| Bot Fight Mode | |
| 1 min read | |
| Bot Fight Mode is a simple, free product that helps detect and mitigate bot traffic on your | |
| domain. When enabled, the product: | |
| ● Identifies traffic matching patterns of known bots | |
| ● Issues computationally expensive challenges in response to these bots | |
| ● Notifies Bandwidth Alliance | |
| ● partners (if applicable) to disable bots | |
| Considerations | |
| Bot Fight Mode has a few limitations, including that it: | |
| ● Protects entire domains without endpoint restrictions. | |
| ● Cannot be customized, adjusted, or reconfigured via WAF custom rules. | |
| If these limitations could cause issues with your application, do not enable this feature. | |
| For more granular control - including the ability to use the Skip action for bot mitigation - | |
| consider using Super Bot Fight Mode. | |
| Setup | |
| To start using Bot Fight Mode: | |
| 1. Log in to the Cloudflare dashboard | |
| and select your account and domain. | |
| Go to Security > Bots. | |
| For Bot Fight Mode, select On. | |
| Secure your origin | |
| 4 min read | |
| Your origin server | |
| is a physical or virtual machine that is not owned by Cloudflare and hosts your application | |
| content (data, webpages, etc.). | |
| Receiving too many requests can be bad for your origin. These requests might increase | |
| latency for visitors, incur higher costs — particularly for cloud-based machines — and could | |
| knock your application offline. | |
| Secure origin connections | |
| When you secure origin connections, it prevents attackers from discovering and overloading | |
| your origin server with requests. | |
| ● DNS: | |
| 1. Proxy records (when possible): Set up proxied (orange-clouded) DNS | |
| records to hide your origin IP addresses and provide DDoS protection. As | |
| part of this, you should allow Cloudflare IP addresses at your origin to prevent | |
| requests from being blocked. | |
| 2. Review DNS-only records: Audit existing DNS-only records (SPF, TXT, and | |
| more) to make sure they do not contain origin IP information. | |
| 3. Evaluate mail infrastructure: If possible, do not host a mail service on the | |
| same server as the web resource you want to protect, since emails sent to | |
| non-existent addresses get bounced back to the attacker and reveal the mail | |
| server IP. | |
| 4. Rotate origin IPs: Once onboarded, rotate your origin IPs, as DNS records | |
| are in the public domain. Historical records are kept and would contain IP | |
| addresses prior to joining Cloudflare | |
| Application layer | |
| 1. Cloudflare Tunnel (HTTP/WebSockets) | |
| Cloudflare Tunnel connects your resources to Cloudflare without a publicly routable IP | |
| address, by creating an outbound-only connections to Cloudflare’s global network. | |
| ● Security: Very secure. | |
| ● Availability: All customers. | |
| ● Challenges: Requires installing the cloudflared daemon on origin server or | |
| virtual machine. | |
| 2. HTTP Header Validation | |
| Only allow traffic with specific (and secret) HTTP headers. | |
| ● Security: Moderately secure. | |
| ● Availability: All customers. | |
| ● Challenges: | |
| 1. Requires more configuration efforts on application- and server-side to accept | |
| those headers. | |
| 2. Basic authentication is vulnerable to replay attacks. Because basic | |
| authentication does not encrypt user credentials, it is important that traffic | |
| always be sent over an encrypted SSL session. | |
| 3. There might be valid use cases for a mismatch in SNI / Host headers such as | |
| through Page Rules, Load Balancing, or Workers, which all offer HTTP Host | |
| Header overrides. | |
| ● Process: | |
| 1. Use Transform rules or Workers to add an HTTP Auth Header. | |
| 2. Configure your origin server to restrict access based on the HTTP Auth | |
| Header (or perform HTTP Basic Authentication). | |
| 3. Configure your origin server to restrict access based on the HTTP Host | |
| Header. Specifically, only allow requests which contain expected HTTP Host | |
| Header values, and reject all other requests. | |
| 3. JSON Web Tokens (JWT) Validation | |
| Only allow traffic with the appropriate JWT. | |
| ● Security: Very secure. | |
| ● Availability: Some customers. | |
| ● Challenges: | |
| ○ Requires either installing incremental software or modifying application code. | |
| ○ Lots of manual work. | |
| ● Resources: | |
| ○ Validate JWTs for an Access application | |
| ○ Validate JWTs for an API | |
| Transport Layer | |
| Authenticated Origin Pulls | |
| Authenticated Origin Pulls helps ensure requests to your origin server come from the | |
| Cloudflare network. | |
| ● Security: Very secure. | |
| ● Availability: All customers. | |
| ● Challenges: | |
| ○ Requires Full or Full (strict) encryption modes. | |
| ○ Requires more configuration efforts for application and server, such as | |
| uploading a certificate and configuring the server to use it. | |
| ○ For more strict security, you should upload your own certificate. Although | |
| Cloudflare provides you a certificate for easy configuration, this certificate | |
| only guarantees that a request is coming from the Cloudflare network. | |
| ○ Not scalable for large numbers of origin servers. | |
| Cloudflare Tunnel (SSH / RDP) | |
| Cloudflare Tunnel connects your resources to Cloudflare without a publicly routable IP | |
| address, by creating an outbound-only connections to Cloudflare’s global network. | |
| ● Security: Very secure. | |
| ● Availability: All customers. | |
| ● Challenges: Requires installing the cloudflared daemon on origin server or | |
| virtual machine. | |
| Network Layer | |
| Allowlist Cloudflare IP addresses | |
| Explicitly block all traffic that does not come from Cloudflare IP addresses (or the IP | |
| addresses of your trusted partners, vendors, or applications). | |
| ● Security: Moderately secure. | |
| ● Availability: All customers. | |
| ● Challenges: | |
| ○ Requires allowlisting Cloudflare IP ranges at your origin server. | |
| ○ Vulnerable to IP spoofing. | |
| Cloudflare Network Interconnect | |
| Cloudflare Network Interconnect allows you to connect your network infrastructure directly | |
| with Cloudflare – rather than using the public Internet – for a more reliable and secure | |
| experience. | |
| ● Security: Very secure. | |
| ● Availability: Enterprise-only. | |
| ● Challenges | |
| ○ Requires some networking knowledge. | |
| ○ Only applies to some customer use cases. | |
| Cloudflare Aegis | |
| Cloudflare Aegis | |
| prevents external connections by providing dedicated egress IP addresses. | |
| ● Security: Very secure. | |
| ● Availability: Enterprise-only. | |
| ● Challenges: Requires network-level firewall policies. | |
| Security Center | |
| 1 min read | |
| Cloudflare Security Center brings together our suite of security products, our security | |
| expertise, and unique Internet intelligence as a unified security intelligence solution. Security | |
| Center enables you to strengthen your security posture by: | |
| ● Mapping your cyber attack surface | |
| ● Providing asset inventory and discovery | |
| ● Identifying potential security risks, misconfigurations, and vulnerabilities | |
| ● Helping you to mitigate these risks through remediation in a few clicks | |
| For additional details and help, refer to the Security Center documentation. | |
| Setup | |
| To enable Security Insights and perform an initial security scan: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. and select your account. | |
| 2. In the Account Home, go to Security Center > Security Insights. | |
| 3. Under Enable Security Center scans, select Start scan. | |
| The initial Security Insights scan will start. The initial scan time depends on the number of IT | |
| assets in all the domains of your Cloudflare account. When the scan is complete, the status | |
| of the page will change from Scan in Progress to Last scan performed on: | |
| <DATE_TIME>. | |
| Performance | |
| Improve your application’s performance by enabling and optimizing your sites settings. | |
| Objectives | |
| By the end of this module, you will be able to: | |
| ● Explain how - just by using Cloudflare - you can increase application performance | |
| ● Optimize caching using various Cloudflare settings | |
| ● Improve performance using different settings within Speed settings | |
| ● Set up Cloudflare Web Analytics for free, privacy-first analytics | |
| ● Evaluate other, add-on products that can improve application performance | |
| Default improvements | |
| 1 min read | |
| Cloudflare provides a variety of speed improvements by default. | |
| DNS resolution | |
| When your site is using Cloudflare, your site always benefits from Cloudflare’s lightning-fast | |
| DNS resolution | |
| . | |
| Caching | |
| When your DNS records are proxied through Cloudflare, Cloudflare caches certain types of | |
| resources automatically (which improves application performance). | |
| How does caching improve performance? | |
| Caching is the process of storing copies of files in a cache, or temporary storage location, so | |
| that they can be accessed more quickly. | |
| When Cloudflare stores content in its cache, the request never needs to go to your | |
| application or origin server, which reduces the number of requests and gets content to the | |
| user more quickly. | |
| Optimize caching | |
| 1 min read | |
| Beyond default caching settings, you can further optimize your cache using different | |
| Cloudflare settings. | |
| A few ways to optimize Cloudflare caching include: | |
| ● Creating cache rules to customize the cache properties of specific HTTP requests. | |
| ● Enabling the Tiered Cache feature, which dramatically increases cache hit ratios. | |
| ● Reviewing our other various configuration options, which may vary based on your | |
| plan and application setup. | |
| Optimize analytics | |
| 2 min read | |
| Web analytics let you measure user behavior - pageviews, sessions, and custom events - on | |
| your application. | |
| Cloudflare offers two ways to improve the privacy and performance of the way you gather | |
| these analytics. | |
| Cloudflare Web Analytics | |
| If you want analytics without using third-party tools, check out Cloudflare Web Analytics. | |
| Cloudflare Web Analytics provides free, privacy-first analytics for your website without | |
| changing your DNS or using Cloudflare’s proxy. Cloudflare Web Analytics helps you | |
| understand the performance of your web pages as experienced by your site visitors. | |
| All you need to enable Cloudflare Web Analytics is a Cloudflare account and a JavaScript | |
| snippet on your page to start getting information on page views and visitors. The JavaScript | |
| snippet (also known as a beacon) collects metrics using the Performance API, which is | |
| available in all major web browsers. | |
| Setup | |
| So long as your traffic is proxied through Cloudflare, setting up Web Analytics only involves a | |
| few steps: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. , and select your account. | |
| 2. Select the Analytics & Logs drop-down and choose Web Analytics. | |
| 3. Under Quick Actions, select Add a site. | |
| 4. Select a hostname from the drop-down menu > Done. | |
| Access | |
| Once you have enabled Web Analytics, you can review analytics at any time: | |
| 1. Log in to the Cloudflare dashboard | |
| 1. , and select your account. | |
| 2. Select the Analytics & Logs drop-down and choose Web Analytics. | |
| 3. Select your zone. | |
| 4. Review the various metrics provided by Cloudflare. | |
| Notifications | |
| Web Analytics uses Cloudflare’s Notification service. When enabled, Web Analytics sends | |
| you a weekly report with aggregate visits, page views and median page load time for all your | |
| sites, so you can monitor their performance. | |
| To get started, add Web Analytics notification on your Cloudflare dashboard. Refer to | |
| Cloudflare Notifications to learn more. | |
| Cloudflare Zaraz | |
| If you already use third-party tools on your website, check out Cloudflare Zaraz. | |
| Cloudflare Zaraz gives you complete control over third-party tools and services for your | |
| website, and allows you to offload them to Cloudflare’s edge, improving the speed and | |
| security of your website. With Cloudflare Zaraz you can load tools such as analytics tools, | |
| advertising pixels and scripts, chatbots, marketing automation tools, and more, in the most | |
| optimized way. | |
| Cloudflare Zaraz is built for speed, privacy, and security, and you can use it to load as many | |
| tools as you need, with a near-zero performance hit. | |