Cloudflare
Security & compliance
Stability
Security Level essentially off (no IP challenges)
Part of the WAF & rate limiting check · fix arrives as a guide
What it is
The zone's Security Level is set to Essentially Off, so Cloudflare issues no challenges based on IP reputation.
Why it matters
Traffic from addresses with known-bad reputation passes straight through. It is a control that costs legitimate users nothing and is usually turned down during an unrelated debugging session and never turned back up.
How to fix it
Return the Security Level to Medium. If it was lowered because a specific integration was being challenged, add a targeted skip rule for that path rather than lowering it zone-wide.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.