cloudflare-hardeninglisted

# Cloudflare Hardening Cloudflare gives you a powerful edge layer for free, but its defaults are conservative — most of the protection is opt-in. This skill walks the security-relevant settings and the ones that catch people out. Applies to Cloudflare's main product (DNS + Proxy + WAF + Workers/Pages/R2). Not Magic Transit / Spectrum specifics. ## When to invoke - Domain just onboarded to Cloudflare - Site behind CF was scraped, brute-forced, or DDoSed - Origin IP may be exposed (showed up in `dnshistory`, accidentally A-recorded) - Periodic review of an existing public site - Setting up Cloudflare Pages or R2 with a custom domain ## Step 1 — Lock the account itself Before site settings, harden the account. - **2FA on the account** with WebAuthn / hardware key, not SMS - **API tokens, not Global API Key** — Global API Key has account-wide power and cannot be scoped - **Audit Logs** — `Account → Audit Log` shows who did what; review monthly - **Members** — separate humans from automation; each automation gets its own scoped token API tokens: scope to **specific zones + specific permissions**. A common mistake is creating a "DNS edit" token at account level when only one zone needs it. ## Step 2 — DNS and proxy posture ``` Zone → DNS → Records ``` - **All public hostnames proxied (orange cloud)** unless you have a specific reason for grey-cloud (e.g. mail records — MX must be grey) - **Origin IP must not be in any public DNS record** — common leaks: - Direct A reco