Cloudflare 25 rules 4 checks

Cloudflare configuration checks

TLS settings that mean something, DNS that does not advertise your origin, R2 buckets that do not quietly compound. These are the rules lumioguard runs against a connected Cloudflare zone.

Cloudflare 4 rules

DNS & origin exposure

DNS records that route around your own protection.

Security & complianceReleasesCode quality Open
Cloudflare 8 rules

Edge TLS posture

Whether the padlock covers the whole path to your origin.

Security & complianceReleasesStability Open
Cloudflare 4 rules

WAF & rate limiting

Whether anything filters traffic before it reaches your app.

Security & complianceStabilityCost Open
Cloudflare 9 rules

Workers, Pages & API tokens

Edge compute health, and the token that manages it.

StabilityCostReleases Open

Every Cloudflare rule

DNS & origin exposure

4 rules
Unproxied A/AAAA/CNAME records expose the origin IP CloudflareDNS & origin exposure Wildcard DNS record widens the attack surface CloudflareDNS & origin exposure No DMARC record (domain can be spoofed in email) CloudflareDNS & origin exposure Mail domain (has MX) missing an SPF record CloudflareDNS & origin exposure

Edge TLS posture

8 rules
SSL mode off/flexible (unencrypted origin hop) CloudflareEdge TLS posture Minimum TLS version below 1.2 CloudflareEdge TLS posture Always Use HTTPS is off CloudflareEdge TLS posture DNSSEC not active on the zone CloudflareEdge TLS posture Automatic HTTPS Rewrites off (mixed-content risk) CloudflareEdge TLS posture TLS 1.3 not enabled CloudflareEdge TLS posture HSTS missing, disabled, or max-age under 6 months CloudflareEdge TLS posture 0-RTT early data enabled (request replay risk) CloudflareEdge TLS posture

WAF & rate limiting

4 rules
No managed WAF ruleset on a production zone CloudflareWAF & rate limiting No rate-limiting rules on the zone CloudflareWAF & rate limiting Security Level essentially off (no IP challenges) CloudflareWAF & rate limiting Browser Integrity Check off CloudflareWAF & rate limiting

Workers, Pages & API tokens

9 rules
Connected Cloudflare API token never expires CloudflareWorkers, Pages & API tokens Worker runtime error rate elevated (last 24h) CloudflareWorkers, Pages & API tokens Worker throwing unhandled exceptions (last 24h) CloudflareWorkers, Pages & API tokens Worker exceeding CPU/memory limits (last 24h) CloudflareWorkers, Pages & API tokens Pages project's latest production deployment failed CloudflareWorkers, Pages & API tokens Pages project has repeated recent deployment failures CloudflareWorkers, Pages & API tokens Paid-plan zone with negligible traffic (idle spend) CloudflareWorkers, Pages & API tokens High-volume Worker (Workers cost driver) CloudflareWorkers, Pages & API tokens Large R2 bucket storage (storage cost) CloudflareWorkers, Pages & API tokens

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing