Checklists / Cloudflare

The Cloudflare setup, security, and performance checklist.

34 checks across dns and domain, ssl/tls, origin protection, caching, waf and bots, workers and r2, account and resilience. Tick items off as you go. Your progress is saved in this browser.

1. DNS and domain

• DNSSEC is enabled and the DS record is added at your domain registrar Enabling it in Cloudflare isn't enough: until the DS record is at the domain registrar, resolvers don't validate it. If Cloudflare is your domain registrar, it publishes the record for you.
• The domain registrar account has a transfer lock and 2FA Whoever controls your domain registrar account controls your nameservers, which bypasses everything configured in Cloudflare.
• Web records are proxied, and mail and other non-HTTP records are DNS-only Proxied records get caching, WAF, and DDoS protection. Mail and other non-HTTP services can't be proxied, and DNS-only records expose their IP.
• The origin IP isn't exposed by DNS-only records, old DNS history, or mail headers Anyone who finds it can send traffic straight to the origin and skip the WAF.
• CAA records limit which certificate authorities can issue for your domain Stops an unexpected CA from issuing a certificate for your domain.

dig +short DS example.com

2. SSL/TLS

• The encryption mode is Full (strict), with a valid certificate on the origin Flexible sends traffic to the origin over plain HTTP. Full encrypts but accepts any certificate, including expired or self-signed ones. Only Full (strict) validates it.
• The origin certificate is publicly trusted or a Cloudflare Origin CA certificate, and its expiry is monitored Origin CA certificates are trusted only by Cloudflare, which is fine while traffic is proxied. If the certificate fails under Full (strict), visitors get 526 errors.
• Always Use HTTPS is on, and HSTS is enabled once every subdomain serves HTTPS HSTS makes browsers refuse plain HTTP for the whole max-age, so enabling it before every subdomain supports HTTPS locks visitors out.
• The minimum TLS version is 1.2 or higher, and TLS 1.3 is on TLS 1.0 and 1.1 are deprecated. Check analytics for old clients before raising the minimum.

3. Origin protection

• The origin only accepts traffic from Cloudflare, through a firewall allowlist of Cloudflare's IP ranges or through Cloudflare Tunnel Otherwise anyone who finds the origin IP bypasses the WAF, rate limits, and caching. Test by requesting the origin IP directly: it should fail.
• If you use Authenticated Origin Pulls, you've chosen zone-level over global Global AOP only proves a request came through Cloudflare, which includes other Cloudflare customers. Zone-level AOP uses your own certificate. AOP doesn't apply with Tunnel or Flexible mode.
• The origin logs and rate-limits on the real visitor IP (CF-Connecting-IP) Otherwise every request appears to come from a Cloudflare address, so IP-based limits and logs are useless.
• Admin panels, staging, and internal tools sit behind Cloudflare Access A login page open to the internet gets scanned constantly. Access puts authentication in front of it.

curl -skI --resolve example.com:443:203.0.113.10 https://example.com

4. Caching

• Static assets have Cache Rules and long edge and browser TTLs By default Cloudflare caches by file extension: static assets yes, HTML and JSON no.
• Cache status has been checked in response headers, and you know DYNAMIC from BYPASS DYNAMIC means the URL wasn't eligible for cache. BYPASS means it was eligible but the origin response wasn't cacheable, for example Cache-Control: private or Set-Cookie.
• Any cached HTML excludes requests with cookies or authentication Caching a personalized page serves one user's content to another.
• Asset filenames are hashed or versioned, and the origin sends correct Cache-Control headers Hashed filenames let you cache for a year without ever purging.
• Purges target specific URLs where possible instead of purging everything A full purge sends all traffic back to the origin at once.

curl -sI https://example.com/assets/app.js | grep -iE 'cf-cache-status|cache-control|^age'

5. WAF and bots

• Managed rules are enabled, and new custom rules start in Log or Managed Challenge before Block Lets you see what a rule would catch before it blocks real users.
• Rate limiting protects login, signup, password reset, and expensive API endpoints These are the endpoints that credential stuffing and scraping target.
• Bot protections are checked against legitimate automation: webhooks, mobile apps, uptime checks Challenges can break clients that can't run JavaScript. Allow known good traffic explicitly.
• Security Events are reviewed after every rule change False positives show up there first.
• Under Attack mode has a named owner and a defined point to turn it off It challenges every visitor, so leaving it on costs real traffic.

6. Workers and R2

• Usage and billing notifications are configured for Workers and R2 Both are usage-billed, so a retry loop or a traffic spike shows up on the bill before anywhere else.
• R2 request patterns have been reviewed, not just storage size R2 has no egress fees, but operations are billed. Many small objects and frequent listing add up.
• Production R2 buckets use a custom domain, not r2.dev r2.dev is not for production use and is rate limited. A custom domain also gives you caching, WAF rules, and bot controls.
• Secrets are stored as Worker secrets, not plain-text variables or code Plain-text variables are visible in the dashboard and config. Secrets are not.
• Worker errors are visible (Workers Logs or Logpush) and alert somewhere An uncaught exception returns an error page to visitors and nobody sees it.
• Worker deployments are versioned, and you know how to roll back Rolling back is faster than writing and shipping a hotfix.

7. Account and resilience

• 2FA is required for every account member, with least-privilege roles Taking over the account gives control of DNS, certificates, and rules.
• API tokens are scoped to specific zones and permissions, and the Global API Key isn't used A scoped token limits the damage if it leaks. The Global API Key can't be scoped.
• Configuration is managed as code (Terraform or the API) and kept in version control Dashboard-only changes drift, can't be reviewed, and can't be rolled back.
• Audit logs are reviewed, and notifications are set for DDoS attacks, origin health, and certificate events Without notifications, you hear about an expired certificate from users. Audit logs show who changed a rule or record, and when.
• You have a plan for a Cloudflare outage Know how you'd switch records to DNS-only, which exposes the origin, so the firewall has to allow it first. Keep your status page off the same Cloudflare account.

Frequently asked questions