Adding Cloudflare Turnstile with mandatory server-side verification Turnstile can protect a form from unwanted automated submissions, but the server must validate each token before accepting the operation. Displaying a…

Adjusting Cloudflare Challenge Passage Challenge Passage controls how long a visitor who successfully completes an eligible Cloudflare challenge can avoid repeating that challenge. It uses a…

Applying an available rate-limit rule to an abused login endpoint A rate-limit rule can reduce repeated requests to an abused login endpoint. Design it from normal traffic and the available plan controls so shared…

Choosing Cloudflare bot controls that fit the site and plan Cloudflare’s bot products differ in available controls and exception support. Choose settings that fit both your subscription and your legitimate…

Creating a limited Cloudflare API token for DNS automation A scoped Cloudflare API token lets an integration manage only its required resources. For DNS automation, restrict the token to the relevant zone and…

Creating a narrowly scoped Cloudflare WAF custom rule A Cloudflare WAF custom rule should match a clearly defined unwanted request pattern. Start with the smallest hostname, path and condition that…

Investigating a Cloudflare WAF false positive with Ray IDs When a legitimate action is blocked, use its Ray ID and request time to identify the Cloudflare control responsible. A precise exception is easier to…

Planning origin access restrictions behind Cloudflare Origin access restrictions can prevent ordinary visitors from bypassing Cloudflare and reaching the web server directly. Implement them with the hosting…

Reading Cloudflare security events for an incident Security Events explains actions taken by Cloudflare security products. Use it to investigate a specific incident, remembering that events and HTTP…

Using Cloudflare Under Attack mode during a web attack Under Attack mode adds a browser challenge before eligible requests reach the site. It can help during an active web attack, but it can also interrupt…

Using Cloudflare’s current security controls instead of old security levels Older Cloudflare guides refer to selectable Low, Medium or High security levels. Current security behaviour uses an Always protected model, while Under…