# The Cloudflare Site Kit

**For site owners whose domain runs through Cloudflare. Four checks, about twenty minutes.**

---

## 1. Check whether new-vulnerability rules block or only log

**Why:** when a new vulnerability is disclosed, Cloudflare adds rules to its managed rulesets. Some of those rules start in **Log** mode, which means attacks are recorded but still reach your site. Your own overrides can also leave rules in Log, or turned off, without you remembering.

**How:**
1. In the Cloudflare dashboard, open your site (zone) and go to your zone's **WAF managed rules**.
2. Confirm the **Cloudflare Managed Ruleset** is deployed. On plans that include it, also check the **OWASP Core Ruleset**.
3. Open the ruleset's configuration and look at **overrides**: any rule or category set to Log or disabled.
4. Search the rule list for the CVE number you care about. Check its action.
5. Look at **Security Events** for hits on that rule. If they look like real attacks and nothing legitimate is matching, switch it to **Block**.

**Deciding:** Block if the rule protects software you actually run and you see no false positives. Keep Log only while you are watching for false positives, and set a reminder to come back.

**Time:** 10 minutes.

## 2. Keep your origin server private

**Why:** Cloudflare only protects traffic that goes through Cloudflare. If attackers find your server's real IP address, they can skip the WAF entirely.

**How (pick one):**
- **Best:** use **Cloudflare Tunnel**. Your server makes an outbound connection to Cloudflare and needs no open inbound ports.
- **Otherwise:** set your server's firewall to accept web traffic only from Cloudflare's published IP ranges (cloudflare.com/ips). Add **Authenticated Origin Pulls** so only Cloudflare can connect, even from those ranges.
- If your origin IP was ever public (old DNS records, mail server on the same host, an old subdomain), assume it is known. Changing it is worth considering.

**Time:** 15 minutes for a firewall rule; longer for a tunnel.

## 3. Protect login and API paths

**Why:** login pages and APIs attract credential stuffing and scraping. These cost little to slow down.

**How:**
- Search your zone's security settings for **Bot Fight Mode** (or **Super Bot Fight Mode** on paid plans) and turn it on. Test your site afterward: it can interfere with legitimate automated clients, such as your own monitoring or mobile app.
- Add a **rate limiting rule** for paths like `/login`, `/wp-login.php`, `/api/auth`, and password reset. Start generous (for example, a few dozen requests per minute per IP) and tighten after watching Security Events.
- Consider **Turnstile** on login and signup forms.

**Time:** 5 minutes.

## 4. Follow Cloudflare's own briefing

Cloudflare publishes security briefings on new threats it sees across its network: [radar.cloudflare.com/security/zero-wire](https://radar.cloudflare.com/security/zero-wire). When something there matches software you run, come back to step 1.

---

## Coming soon

A read-only command-line checker that inspects your zone's settings (managed rule actions, origin exposure, bot and rate-limit settings) and reports what it finds without changing anything.