Cloudflare hardening reference
Settings#
| Setting | What it does | Plan | Doc |
|---|---|---|---|
| API tokens | Scoped credential; use it in place of the Global API Key. Service Key authentication reaches end of life 2026-09-30 (deprecation notice) | F | Create API tokens |
| DNSSEC | Signs the zone; Cloudflare's default is algorithm 13, ECDSA P-256 (RFC 6605) | F | DNSSEC |
| CAA records | Restricts which CAs can issue a certificate for the zone (RFC 8659 section 3) | F | CAA records |
| Proxied A/AAAA/CNAME | Hides the origin IP; TLS terminates at the edge | F | Proxy status |
| SSL/TLS mode: Full (strict) | Only mode that validates the origin certificate | F | SSL modes |
| Minimum TLS version | Zone-wide floor on the TLS version accepted; raise to 1.2 | F zone-wide / P per-hostname | Minimum TLS |
| HSTS | Browser-enforced HTTPS on repeat visits | F | HSTS |
| Always Use HTTPS | Redirects HTTP requests to HTTPS at the edge | F | Always Use HTTPS |
| TLS 1.3 | Current TLS version; no reason to leave it off | F | SSL modes |
| Email auth (SPF/DKIM/DMARC) | Must stay DNS-only; a domain that never sends mail should publish null SPF, null DKIM, and a DMARC reject policy | F | Full setup guide |
| 2FA | Security keys (WebAuthn) are phishing-resistant; TOTP is acceptable, email-only is weakest | F | 2FA |
| Zone Hold | Blocks a zone from being added to another Cloudflare account without authorization | P, Enterprise only | Zone Holds |
| Free Managed Ruleset (WAF) | Baseline managed WAF rules; the only managed ruleset on Free | F | WAF managed rules |
| Rate Limiting Rules | Throttles one abuse-prone endpoint on Free | F limited / P more rules | Rate limiting rules |
| Bot Fight Mode | Challenges traffic matching known-bot patterns; on/off only, not customizable | F | Bot Fight Mode |
| API rate limit | 1,200 requests per 5 minutes per user, cumulative across dashboard, API key, and tokens | F | API limits |
Verify from outside#
Asks a signed zone for its public keys.
dig @1.1.1.1 +dnssec isitdns.net DNSKEYGO NOERROR, the DNSKEY set, and an RRSIG over it
NO GO NOERROR with no answer, which means the zone is not signed
The ad flag means the resolver validated the chain (RFC 4035 section 3.2.3), not that your path to the resolver is trusted: an on-path attacker on plain UDP/53 can strip or forge it. Query over DoT or DoH to a known validating resolver instead.
Check the DS record the parent TLD serves:
dig @1.1.1.1 +short isitdns.net DS2371 13 2 2DF8E1D4E0855DF60F2A8B51C914F2F2866ED1E3344F74F9682DAC4D 42D18802Keytag, algorithm, digest type, digest hash. No DS here means an insecure delegation: validating resolvers accept the zone unsigned (RFC 4035 section 5.2). A DS that matches no DNSKEY is what makes them SERVFAIL the zone (dnssec-troubleshooting).
Check CAA, including what Cloudflare auto-injects for Universal SSL:
dig @1.1.1.1 +short isitdns.net CAA0 issue "comodoca.com"
0 issue "digicert.com; cansignhttpexchanges=yes"
0 issue "letsencrypt.org"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issue "sectigo.com"
0 issue "ssl.com"
0 issuewild "comodoca.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "letsencrypt.org"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
0 issuewild "sectigo.com"
0 issuewild "ssl.com"Cloudflare auto-injects records for the CAs backing Universal SSL once the zone holds at least one CAA record of its own; a zone with none permits any CA (RFC 8659 section 3). The injected records appear in dig output but not in the dashboard, so the live response is the only complete list.
See also#
- caa-policy: CAA record structure and validation
- caa: CAA record type reference
- dnssec: DNSSEC concepts and signing
- email-records: SPF, DKIM, and DMARC record structure
- nslookup-and-dig: dig and nslookup tool reference