Cloudflare security
In preview
If a domain's DNS is at Cloudflare, you can set its protection from the panel, in plain words, without opening Cloudflare's dashboard.
Built and lab-tested
- Firewall rules in plain words: block countries, challenge bots on the WordPress login, block bad paths, allow your own addresses. Your own rule works too and is checked before it is sent.
- Rate limits for login pages and API paths, and Cloudflare's managed rules: the free set on every plan, the Cloudflare and OWASP sets where the plan includes them. The screen shows what your plan allows instead of failing.
- Security level, Bot Fight Mode, the browser integrity check and how long a passed challenge is remembered.
- Allow, block or challenge by address, range, network or country, for one domain or for the whole Cloudflare account.
- HTTPS settings in one place: Full (strict), Always Use HTTPS, minimum TLS and HSTS. A free Cloudflare Origin CA certificate is made on your server and installed on the site.
- Authenticated Origin Pulls, and an option to accept only Cloudflare traffic for a site, with a clear warning first and a check that the name goes through Cloudflare.
- The real visitor address behind Cloudflare, so logs, rate limits and the firewall see the visitor. Cloudflare's address list is refreshed every day.
- Cloudflare Tunnel: create a tunnel, run it on a server and route a site's name through it. The site needs no open port 80 or 443. cloudflared is installed from Cloudflare's own package repository, with its signing key pinned.
- Everyone reaches only their own domains. Every change is logged, and the risky ones show a plan first.
Not there yet
- Tunnels need a Debian or Ubuntu server for now.
- Authenticated Origin Pulls uses Cloudflare's shared certificate. Certificates for one host name are not built.
- The rules, settings and certificates are tested against a simulated Cloudflare. A live run on a real domain is still to come.
Every action in this area is in the panel, one keystroke away in the command palette (Ctrl K), on the command line and in the API, and most changes can be previewed as a plan first. Built and tested in our lab; RespireCloud is not released yet.