20 minutes · Website owners using Cloudflare

The Cloudflare Site Kit

For site owners whose domain runs through Cloudflare. Four checks, about twenty minutes.

1. Check whether new-vulnerability rules block or only log

Why: when a new vulnerability is disclosed, Cloudflare adds rules to its managed rulesets. Some of those rules start in Log mode, which means attacks are recorded but still reach your site. Your own overrides can also leave rules in Log, or turned off, without you remembering.

How: 1. In the Cloudflare dashboard, open your site (zone) and go to your zone's WAF managed rules. 2. Confirm the Cloudflare Managed Ruleset is deployed. On plans that include it, also check the OWASP Core Ruleset. 3. Open the ruleset's configuration and look at overrides: any rule or category set to Log or disabled. 4. Search the rule list for the CVE number you care about. Check its action. 5. Look at Security Events for hits on that rule. If they look like real attacks and nothing legitimate is matching, switch it to Block.

Deciding: Block if the rule protects software you actually run and you see no false positives. Keep Log only while you are watching for false positives, and set a reminder to come back.

Time: 10 minutes.

2. Keep your origin server private

Why: Cloudflare only protects traffic that goes through Cloudflare. If attackers find your server's real IP address, they can skip the WAF entirely.

How (pick one): - Best: use Cloudflare Tunnel. Your server makes an outbound connection to Cloudflare and needs no open inbound ports. - Otherwise: set your server's firewall to accept web traffic only from Cloudflare's published IP ranges (cloudflare.com/ips). Add Authenticated Origin Pulls so only Cloudflare can connect, even from those ranges. - If your origin IP was ever public (old DNS records, mail server on the same host, an old subdomain), assume it is known. Changing it is worth considering.

Time: 15 minutes for a firewall rule; longer for a tunnel.

3. Protect login and API paths

Why: login pages and APIs attract credential stuffing and scraping. These cost little to slow down.

How: - Search your zone's security settings for Bot Fight Mode (or Super Bot Fight Mode on paid plans) and turn it on. Test your site afterward: it can interfere with legitimate automated clients, such as your own monitoring or mobile app. - Add a rate limiting rule for paths like /login, /wp-login.php, /api/auth, and password reset. Start generous (for example, a few dozen requests per minute per IP) and tighten after watching Security Events. - Consider Turnstile on login and signup forms.

Time: 5 minutes.

4. Follow Cloudflare's own briefing

Cloudflare publishes security briefings on new threats it sees across its network: radar.cloudflare.com/security/zero-wire. When something there matches software you run, come back to step 1.

Coming soon

A read-only command-line checker that inspects your zone's settings (managed rule actions, origin exposure, bot and rate-limit settings) and reports what it finds without changing anything.