Quick orientation before we go live

Here's the map for today — then we're 100% live in the dashboard

One network instead of five vendors. Nothing reaches your infrastructure until it's actually safe to.

🌐
Visitor browser / API client
→
←
request / response
Cloudflare Network
One network — DNS, encryption, and security checks all happen here, before traffic ever reaches you
→
←
only if it's safe to
🖥️
Your Origin web app / API
DNS Onboarding

Two ways onto Cloudflare

The difference is whether Cloudflare becomes your authoritative DNS provider — the system that holds the real, final answer for every query about your domain — or just proxies specific hostnames while someone else stays authoritative.

Most common

Full (Primary) Setup

  • Cloudflare becomes your authoritative DNS provider
  • Change nameservers at your registrar — one-time step
  • Manage all DNS records in Cloudflare going forward
  • DNS-layer DDoS protection included (Cloudflare sees all query traffic)
  • Available on every plan, including Free
Business/Enterprise only

CNAME (Partial) Setup

  • Keep your existing authoritative DNS provider
  • No nameserver change — add CNAME records instead
  • Only the specific hostnames you point get proxied
  • No DNS-layer DDoS protection — Cloudflare isn't authoritative
  • Apex domain needs CNAME flattening support from your provider
💡 Most customers go Full Setup: full protection, one place to manage DNS, zero ongoing coordination with a second provider.
↑ Back to the map
TLS / SSL

Encryption modes — how far does it actually go?

"Encrypted" isn't one thing — these are four genuinely different postures between the edge and your origin.

OffNo encryption at all
FlexibleVisitor→Cloudflare encrypted, Cloudflare→Origin plaintext
FullEncrypted end-to-end, origin cert not validated
Full (strict)Encrypted end-to-end, origin cert cryptographically validated
💡 "Encrypted" alone isn't a compliance answer. Full (strict) is the difference between encrypted and actually verified end-to-end — the posture auditors and regulated data actually require.
↑ Back to the map
Caching & Performance

The fastest response is the one that never reaches your origin

Every cache hit is a request your origin never has to think about — that's latency and infrastructure load, at the same time.

Cache MISS
Visitor
→
Cloudflare
→
Origin (full round trip)
First request, or content not cacheable
Cache HIT
Visitor
→
Cloudflare
→
Served straight from the edge — origin never touched
💡 Page speed is a revenue conversation, not just a technical one — faster loads measurably reduce bounce rate and improve conversion.
↑ Back to the map
WAF

Two rule types, one enforcement point

Malicious requests are stopped before they ever reach your application code.

💉SQL InjectionMalicious DB query payloads in input fields
🧩Cross-Site ScriptingInjected scripts targeting other visitors
⚙️Remote Code ExecutionAttempts to run arbitrary code on your server
Managed RulesCloudflare-maintained, covers known CVEs and OWASP Top 10 patterns — updated continuously, no effort from you
Custom RulesYour own logic — specific paths, headers, or business rules unique to your application
💡 The real question isn't "can we block this" — it's the cost of one breach or one hour of downtime versus the cost of the control that prevents it.
↑ Back to the map
Bot Management

A score, not a switch

Every request gets scored 1-99. The action taken depends on where it lands — not a binary allow/block.

1Block
Definite bot
2-29Challenge
Likely bot — not blocked outright
30-99Allow
Likely human
💡 The gray zone gets challenged, not blocked — so you're not losing real customers to false positives while still shutting the door on automated abuse.
↑ Back to the map
DDoS Protection

Always-on, before anyone decides to turn it on

Every packet is inspected at the network layer by default — this isn't something you opt into during an attack.

🌊
Attack TrafficVolumetric / protocol / application layer
Cloudflare NetworkAbsorbed & filtered at the edge, globally distributed
✅
Your OriginNever sees the attack traffic at all
🎛️ Under Attack Mode — a manual dial for the application layer during an active incident: adds an extra interstitial check for every visitor. Not the first line of defense — the always-on network layer is.
💡 Uptime matters most during the exact moment it's hardest to guarantee — an active attack, not a normal Tuesday. That's precisely when this stays passive and automatic.
↑ Back to the map
Rate Limiting

Counting by the wrong thing lets attackers walk right through

If a compromised credential is used to pull data, does your current limiting even notice?

The gap

IP-Based Limiting

  • Counts requests per source IP address
  • An attacker spreading requests across a botnet of IPs never trips the limit
  • The credential itself is never the thing being tracked
The fix

Per-Identity Limiting

  • Counts by token, session, or JWT claim — the actual credential
  • Catches abuse regardless of how many IPs are used
  • Same stolen-credential scenario gets caught immediately
↑ Back to the map