Cloudflare
Security & compliance
Stability
Cost
WAF & rate limiting
Whether anything filters traffic before it reaches your app.
Overview
Checks that the zone has managed WAF rulesets deployed and rate-limiting rules in place, along with the security level and integrity settings that decide which requests get challenged.
What it looks for
- No managed WAF ruleset deployed on a production zone
- No rate-limiting rules on the zone
- Security level effectively off, so no IP reputation challenges run
- Browser Integrity Check disabled
Why it matters
Cloudflare in front of your app does nothing for security until the rules are switched on — proxying alone is not filtering. Without rate limiting, credential stuffing against your login endpoint is a normal-looking traffic pattern.
Rules in this check
| What it reports | Fix path |
|---|---|
| No managed WAF ruleset on a production zone | Guide |
| No rate-limiting rules on the zone | Guide |
| Security Level essentially off (no IP challenges) | Guide |
| Browser Integrity Check off | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.