arcubalino

proof-of-prod

Harden a small production web app behind Cloudflare and prove every layer actually works. Use when deploying, securing, or reviewing an app on a single server/VPS behind Cloudflare: locking the origin so it only accepts Cloudflare (closing the direct-IP bypass), edge-caching public read endpoints, enabling free-tier WAF / Bot Fight / rate limits / HSTS / Always Online, adding a dependency-aware health check, and wiring external uptime monitoring. Every step ships with a curl command that proves it. Triggers: "harden my server", "lock down the origin", "Cloudflare security", "protect my VPS", "production hardening", "is my site actually secure", "add a health check and monitoring". Framework-agnostic, with app recipes for Laravel, Node/Express, Django, Go, and Next.js.