# Verify connection URL: https://developers.cloudflare.com/1.1.1.1/check/ import { PublicStats } from "~/components"; After setting up `1.1.1.1`, you can check if you are correctly connected to Cloudflare's resolver. 1. Open a web browser on a configured device (smartphone or computer) or on a device connected to your configured router. 2. Enter [https://1.1.1.1/help](https://one.one.one.one/help) on the browser address bar. Wait for the page to load and run its tests. The page will present you a summary of the type of connection you have to `1.1.1.1`, as well as the Cloudflare data center you are connected to. --- # FAQ URL: https://developers.cloudflare.com/1.1.1.1/faq/ import { GlossaryTooltip } from "~/components" Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. ## What is 1.1.1.1? 1.1.1.1 is Cloudflare's fast and secure DNS resolver. When you request to visit an application like `cloudflare.com`, your computer needs to know which server to connect you to so that it can load the application. Computers do not know how to do this name to address translation, so they ask a specialized server to do it for them. This specialized server is called a DNS recursive resolver. The resolver's job is to find the address for a given name, like `2400:cb00:2048:1::c629:d7a2` for `cloudflare.com`, and return it to the computer that asked for it. Computers are configured to talk to specific DNS resolvers, identified by IP address. Usually the configuration is managed by your ISP (like Comcast or AT\&T) if you are on your home or wireless Internet, and by your network administrator if you are connected to the office Internet. You can also change the configured DNS resolver your computer talks to yourself. ## How can I check if my computer / smartphone / tablet is connected to 1.1.1.1? Visit [1.1.1.1/help](https://one.one.one.one/help) to make sure your system is connected to 1.1.1.1 and that it is working. ## What do DNS resolvers do? DNS resolvers are like address books for the Internet. They translate the name of places to addresses so that your browser can figure out how to get there. DNS resolvers do this by working backwards from the top until they find the website you are looking for. Every resolver knows how to find the invisible `.` at the end of domain names (for example, `cloudflare.com.`). There are [hundreds of root servers](http://www.root-servers.org/) all over the world that host the `.` file, and resolvers are [hard coded to know the IP addresses](http://www.internic.net/domain/named.root) of those servers. Cloudflare itself hosts [that file](http://www.internic.net/domain/root.zone) on all of its servers around the world through a [partnership with ISC](https://blog.cloudflare.com/f-root/). The resolver asks one of the root servers where to find the next link in the chain — the top-level domain (abbreviated to TLD) or domain ending. An example of a TLD is `.com` or `.org`. Luckily, the root servers store the locations of all the TLD servers, so they can return which IP address the DNS resolver should go ask next. The resolver then asks the TLD's servers where it can find the domain it is looking for. For example, a resolver might ask `.com` where to find `cloudflare.com`. TLDs host a file containing the location of every domain using the TLD. Once the resolver has the final IP address, it returns the answer to the computer that asked. This whole system is called the [Domain Name System (DNS)](https://www.cloudflare.com/learning/dns/what-is-dns/). This system includes the servers that host the information (called [authoritative DNS](https://www.cloudflare.com/learning/dns/dns-server-types/)) and the servers that seek the information (the DNS resolvers). ## Does 1.1.1.1 support ANY? Cloudflare [stopped supporting the ANY query](https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/) in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. 1.1.1.1 returns `NOTIMPL` when asked for `qtype==ANY`. ## How does 1.1.1.1 work with DNSSEC? 1.1.1.1 is a DNSSEC validating resolver. 1.1.1.1 sends the `DO` (`DNSSEC OK`) bit on every query to convey to the authoritative server that it wishes to receive signed answers if available. 1.1.1.1 supports the signature algorithms specified in [Supported DNSKEY signature algorithms](/1.1.1.1/encryption/dnskey/). ## ​Does 1.1.1.1 send EDNS Client Subnet header? 1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet (ECS) header to authoritative servers. The exception is the single Akamai debug domain `whoami.ds.akahelp.net` to aid in cross-provider debugging. However, Cloudflare does not send ECS to any of Akamai's production domains, such as `akamaihd.net` or similar. ## Does 1.1.1.1 support IPv6? 1.1.1.1 has full IPv6 support. ## What is Purge Cache? 1.1.1.1's Purge Cache tool allows you to refresh 1.1.1.1's DNS cache for domain names. To refresh the cache for a domain name, visit the [Purge Cache page](https://one.one.one.one/purge-cache/). ## What is query name minimization? Cloudflare minimizes privacy leakage by only sending minimal query name to authoritative DNS servers. For example, if a client is looking for foo.bar.example.com, the only part of the query 1.1.1.1 discloses to .com is that we want to know who's responsible for example.com and the zone internals stay hidden. ## What are root hints? For decreased latency, reduced privacy leakage of queries and lower load on the DNS system, 1.1.1.1 upstreams to [locally hosted root zone files](https://blog.cloudflare.com/f-root/). ## Can IPs used by 1.1.1.1 be allowlisted? Authoritative DNS providers may want to allowlist IP's 1.1.1.1 uses to query upstream DNS providers. The comprehensive list of IP's to allowlist is available at [https://www.cloudflare.com/ips/](https://www.cloudflare.com/ips/). --- # 1.1.1.1 (DNS Resolver) URL: https://developers.cloudflare.com/1.1.1.1/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Speed up your online experience with Cloudflare's public DNS resolver. 1.1.1.1 is Cloudflare’s public DNS resolver. It offers a fast and private way to browse the Internet. [DNS resolvers](https://www.cloudflare.com/learning/dns/what-is-dns/) translate domains like `cloudflare.com` into the IP addresses necessary to reach the website (like `104.16.123.96`). Unlike most DNS resolvers, 1.1.1.1 does not sell user data to advertisers. 1.1.1.1 has also been measured to be the [fastest DNS resolver available](https://www.dnsperf.com/#!dns-resolvers) — it is deployed in [hundreds of cities worldwide](https://www.cloudflare.com/network/), and has access to the addresses of millions of domain names on the same servers it runs on. 1.1.1.1 is completely free. Setting it up takes minutes and requires no special software. *** ## Features 1.1.1.1 for Families has additional protection against malware and adult content. 1.1.1.1 offers an encrypted service through DNS over HTTPS (DoH) or DNS over TLS (DoT) for increased security and privacy. You can also access 1.1.1.1 [as a Tor hidden service](/1.1.1.1/other-ways-to-use-1.1.1.1/dns-over-tor/). *** ## Related products Access the Internet in a more secure and private way. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. Secure and accelerate your TCP or UDP based applications. --- # IP addresses URL: https://developers.cloudflare.com/1.1.1.1/ip-addresses/ import { Render } from "~/components" Consider the tables below to know which IPv4 or IPv6 addresses are used by the different Cloudflare DNS resolver offerings. For detailed guidance refer to [Set up](/1.1.1.1/setup/). *** ## 1.1.1.1 1.1.1.1 is Cloudflare’s public DNS resolver. It offers a fast and private way to browse the Internet. | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.1`
`1.0.0.1` | `2606:4700:4700::1111`
`2606:4700:4700::1001` | Refer to [Encryption](/1.1.1.1/encryption/) to learn how to use 1.1.1.1 in an encrypted way. *** ## 1.1.1.1 for Families 1.1.1.1 for Families categorizes destinations on the Internet based on the potential threat they pose regarding malware, phishing, or other types of security risks. For more information, refer to [1.1.1.1 for Families set up](/1.1.1.1/setup/#1111-for-families). ### Block malware | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.2`
`1.0.0.2` | `2606:4700:4700::1112`
`2606:4700:4700::1002` | ### Block malware and adult content | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.3`
`1.0.0.3` | `2606:4700:4700::1113`
`2606:4700:4700::1003` | --- # Terms of use URL: https://developers.cloudflare.com/1.1.1.1/terms-of-use/ By using 1.1.1.1 Public DNS Resolver or 1.1.1.1 for Families, you consent to be bound by the [Cloudflare Website and Online Services Terms of Use](https://www.cloudflare.com/website-terms/). If you are an [Internet Service Provider (ISP) or network equipment provider](/1.1.1.1/infrastructure/network-operators/), you agree to provide proper attribution to Cloudflare in accordance with our Trademark Guidelines using our Public DNS Resolver. Please reach out to `resolver@cloudflare.com` for such logo requests. --- # Troubleshooting URL: https://developers.cloudflare.com/1.1.1.1/troubleshooting/ import { Render } from "~/components" This guide will help you diagnose and resolve common issues with Cloudflare's DNS Resolver. Before proceeding with manual troubleshooting steps, you can [verify your connection](/1.1.1.1/check/) to automatically gather relevant information. ## Name resolution issues ### Linux/macOS ```sh # Test DNS resolution dig example.com @1.1.1.1 dig example.com @1.0.0.1 dig example.com @8.8.8.8 # Check connected nameserver dig +short CHAOS TXT id.server @1.1.1.1 dig +short CHAOS TXT id.server @1.0.0.1 # Optional: Network information dig @ns3.cloudflare.com whoami.cloudflare.com txt +short ``` ### Windows ```sh # Test DNS resolution nslookup example.com 1.1.1.1 nslookup example.com 1.0.0.1 nslookup example.com 8.8.8.8 # Check connected nameserver nslookup -class=chaos -type=txt id.server 1.1.1.1 nslookup -class=chaos -type=txt id.server 1.0.0.1 # Optional: Network information nslookup -type=txt whoami.cloudflare.com ns3.cloudflare.com ``` **Note:** The network information command reveals your IP address. Only include this in reports to Cloudflare if you are comfortable sharing this information. For additional analysis, you can generate a [DNSViz](http://dnsviz.net/) report for the domain in question. ## Connectivity and routing issues Before reporting connectivity issues: 1. Search for existing reports from your country and ISP. 2. Run traceroutes to both Cloudflare DNS resolvers. ### Linux/macOS ```sh # Basic connectivity tests traceroute 1.1.1.1 traceroute 1.0.0.1 # If reachable, check nameserver identity dig +short CHAOS TXT id.server @1.1.1.1 dig +short CHAOS TXT id.server @1.0.0.1 # TCP connection tests dig +tcp @1.1.1.1 id.server CH TXT dig +tcp @1.0.0.1 id.server CH TXT ``` ### Windows ```sh # Basic connectivity tests tracert 1.1.1.1 tracert 1.0.0.1 # If reachable, check nameserver identity nslookup -class=chaos -type=txt id.server 1.1.1.1 nslookup -class=chaos -type=txt id.server 1.0.0.1 # TCP connection tests nslookup -vc -class=chaos -type=txt id.server 1.1.1.1 nslookup -vc -class=chaos -type=txt id.server 1.0.0.1 ``` ## DNS-over-TLS (DoT) troubleshooting ### Linux/macOS ```sh # Test TLS connectivity openssl s_client -connect 1.1.1.1:853 openssl s_client -connect 1.0.0.1:853 # Test DNS resolution over TLS kdig +tls @1.1.1.1 id.server CH TXT kdig +tls @1.0.0.1 id.server CH TXT ``` ### Windows Windows does not include a standalone DoT client. You can test TLS connectivity using OpenSSL after installing it manually. ## DNS-over-HTTPS (DoH) troubleshooting ### Linux/macOS ```sh curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=cloudflare.com&type=AAAA' ``` ### Windows ```powershell (Invoke-WebRequest -Uri 'https://cloudflare-dns.com/dns-query?name=cloudflare.com&type=AAAA').RawContent ``` ## Common issues ### First hop failures If your traceroute fails at the first hop, the issue is likely hardware-related. Your router may have a hardcoded route for 1.1.1.1. When reporting this issue, include: - Router make and model - ISP name - Any relevant router configuration details ## Additional resources - [1.1.1.1 DNS Resolver homepage](https://1.1.1.1) - [DNS over TLS documentation](/1.1.1.1/encryption/dns-over-tls/) - [Diagnostic tool](https://one.one.one.one/help/) --- # Analytics URL: https://developers.cloudflare.com/aegis/analytics/ import { Type } from "~/components"; Use the [GraphQL API](/analytics/graphql-api/) to get aggregate data and monitor your Aegis IPs capacity. As explained in [IPs allocation](/aegis/about/ips-allocation/), each Aegis IP can support 40,000 concurrent connections per origin IP. Refer to the GraphQL Analytics API documentation to [get started](/analytics/graphql-api/getting-started/). The specific Aegis schema is called `aegisIpUtilizationAdaptiveGroups`. You can get average (`avg`) or maximum (`max`) utilization values (in percentage), and use the following dimensions: - `datetimeFiveMinutes` - Timestamp truncated to five minutes. For example, `2025-01-10T00:05:00Z`. - `popName` - The Cloudflare point of presence (PoP). For example, `sjc`. - `egressIp` - Your assigned Aegis IP. For example, `192.0.2.1`. - `origin` - Origin IP and port. For example, `203.0.113.150:443`. - `popUtilizationKey` - The Cloudflare point of presence (PoP), the Aegis IP, and the origin IP and port. For example, `sjc 192.0.2.1 203.0.113.150:443`. --- # Cloudflare Aegis URL: https://developers.cloudflare.com/aegis/ import { CardGrid, Description, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct } from "~/components" Leverage dedicated IPs to improve your origin security and implement Zero Trust. Cloudflare Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 [WAF](/waf/) and CDN services, as well as [Spectrum](/spectrum/). The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. Both [BYOIP](/byoip) and Cloudflare-leased IPs are supported by Cloudflare Aegis. :::caution[Availability] Cloudflare Aegis is available in early access to Enterprise customers. Contact your account team to request access. ::: *** ## Related products Cloudflare Access determines who can reach your application by applying the Access policies you configure. Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Authenticated Origin Pulls gives you the ability to perform mutual TLS between Cloudflare and your origin environment, providing cryptographically verifiable proof of the source of the traffic you receive. *** ## More resources Deep dive into use cases where Aegis can help secure enterprise origins. Reference Architecture for multi-vendor application security and performance. --- # Setup URL: https://developers.cloudflare.com/aegis/setup/ import { APIRequest } from "~/components"; You can control Aegis enablement on your zones via API. If you are not familiar with how Cloudflare API works, refer to [Fundamentals](/fundamentals/api/). :::caution[Availability] Cloudflare Aegis is available in early access to Enterprise customers. Contact your account team to request access. ::: ## Requirements - The Aegis zone setting endpoint is only available within Cloudflare accounts that own leased IPs, or accounts to which a [BYOIP prefix](/byoip/) has been delegated. If you wish to use Aegis for zones that do not meet this criteria, contact your account team. - Each Aegis pool can consist of either IPs from a BYOIP prefix or Cloudflare-leased IPs. A single dedicated egress pool cannot contain both BYOIPs and leased IPs. ## Steps 1. Contact your account team to get the ID for your dedicated egress pool. 2. Make a `PATCH` request to the [Edit Zone Setting](/api/resources/zones/subresources/settings/methods/edit/) endpoint: - Specify `aegis` as the setting ID in the URL. - In the request body, set `enabled` to `true` and use the ID from the previous step as `pool_id`. ", }, }} parameters={{ setting_id: "aegis", }} /> --- # Build Agents on Cloudflare URL: https://developers.cloudflare.com/agents/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, PackageManagers, Plan, RelatedProduct, Render, TabItem, Tabs, TypeScriptExample, } from "~/components"; The Agents SDK enables you to build and deploy AI-powered agents that can autonomously perform tasks, communicate with clients in real time, call AI models, persist state, schedule tasks, run asynchronous workflows, browse the web, query data from your database, support human-in-the-loop interactions, and [a lot more](/agents/api-reference/). ### Ship your first Agent To use the Agent starter template and create your first Agent with the Agents SDK: ```sh # install it npm create cloudflare@latest agents-starter -- --template=cloudflare/agents-starter # and deploy it npx wrangler@latest deploy ``` Head to the guide on [building a chat agent](/agents/getting-started/build-a-chat-agent) to learn how the starter project is built and how to use it as a foundation for your own agents. If you're already building on [Workers](/workers/), you can install the `agents` package directly into an existing project: ```sh npm i agents ``` And then define your first Agent by creating a class that extends the `Agent` class: ```ts import { Agent, AgentNamespace } from 'agents'; export class MyAgent extends Agent { // Define methods on the Agent: // https://developers.cloudflare.com/agents/api-reference/agents-api/ // // Every Agent has built in state via this.setState and this.sql // Built-in scheduling via this.schedule // Agents support WebSockets, HTTP requests, state synchronization and // can run for seconds, minutes or hours: as long as the tasks need. } ``` Dive into the [Agent SDK reference](/agents/api-reference/agents-api/) to learn more about how to use the Agents SDK package and defining an `Agent`. ### Why build agents on Cloudflare? We built the Agents SDK with a few things in mind: - **Batteries (state) included**: Agents come with [built-in state management](/agents/api-reference/store-and-sync-state/), with the ability to automatically sync state between an Agent and clients, trigger events on state changes, and read+write to each Agent's SQL database. - **Communicative**: You can connect to an Agent via [WebSockets](/agents/api-reference/websockets/) and stream updates back to client in real-time. Handle a long-running response from a reasoning model, the results of an [asynchronous workflow](/agents/api-reference/run-workflows/), or build a chat app that builds on the `useAgent` hook included in the Agents SDK. - **Extensible**: Agents are code. Use the [AI models](/agents/api-reference/using-ai-models/) you want, bring-your-own headless browser service, pull data from your database hosted in another cloud, add your own methods to your Agent and call them. Agents built with Agents SDK can be deployed directly to Cloudflare and run on top of [Durable Objects](/durable-objects/) — which you can think of as stateful micro-servers that can scale to tens of millions — and are able to run wherever they need to. Run your Agents close to a user for low-latency interactivity, close to your data for throughput, and/or anywhere in between. --- ### Build on the Cloudflare Platform Build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. Observe and control your AI applications with caching, rate limiting, request retries, model fallback, and more. Build full-stack AI applications with Vectorize, Cloudflare’s vector database. Adding Vectorize enables you to perform tasks such as semantic search, recommendations, anomaly detection or can be used to provide context and memory to an LLM. Run machine learning models, powered by serverless GPUs, on Cloudflare's global network. Build stateful agents that guarantee executions, including automatic retries, persistent state that runs for minutes, hours, days, or weeks. --- # Changelog URL: https://developers.cloudflare.com/ai-gateway/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Architectures URL: https://developers.cloudflare.com/ai-gateway/demos/ import { GlossaryTooltip, ResourcesBySelector } from "~/components"; Learn how you can use AI Gateway within your existing architecture. ## Reference architectures Explore the following reference architectures that use AI Gateway: --- # Getting started URL: https://developers.cloudflare.com/ai-gateway/get-started/ import { Details, DirectoryListing, LinkButton, Render } from "~/components"; In this guide, you will learn how to create your first AI Gateway. You can create multiple gateways to control different applications. ## Prerequisites Before you get started, you need a Cloudflare account. Sign up ## Create gateway Then, create a new AI Gateway. ## Choosing gateway authentication When setting up a new gateway, you can choose between an authenticated and unauthenticated gateway. Enabling an authenticated gateway requires each request to include a valid authorization token, adding an extra layer of security. We recommend using an authenticated gateway when storing logs to prevent unauthorized access and protect against invalid requests that can inflate log storage usage and make it harder to find the data you need. Learn more about setting up an [Authenticated Gateway](/ai-gateway/configuration/authentication/). ## Connect application Next, connect your AI provider to your gateway. AI Gateway offers multiple endpoints for each Gateway you create - one endpoint per provider, and one Universal Endpoint. To use AI Gateway, you will need to create your own account with each provider and provide your API key. AI Gateway acts as a proxy for these requests, enabling observability, caching, and more. Additionally, AI Gateway has a [WebSockets API](/ai-gateway/websockets-api/) which provides a single persistent connection, enabling continuous communication. This API supports all AI providers connected to AI Gateway, including those that do not natively support WebSockets. Below is a list of our supported model providers: If you do not have a provider preference, start with one of our dedicated tutorials: - [OpenAI](/ai-gateway/tutorials/deploy-aig-worker/) - [Workers AI](/ai-gateway/tutorials/create-first-aig-workers/) ## View analytics Now that your provider is connected to the AI Gateway, you can view analytics for requests going through your gateway.
:::note[Note] The cost metric is an estimation based on the number of tokens sent and received in requests. While this metric can help you monitor and predict cost trends, refer to your provider's dashboard for the most accurate cost details. ::: ## Next steps - Learn more about [caching](/ai-gateway/configuration/caching/) for faster requests and cost savings and [rate limiting](/ai-gateway/configuration/rate-limiting/) to control how your application scales. - Explore how to specify model or provider [fallbacks](/ai-gateway/configuration/fallbacks/) for resiliency. - Learn how to use low-cost, open source models on [Workers AI](/ai-gateway/providers/workersai/) - our AI inference service. --- # Header Glossary URL: https://developers.cloudflare.com/ai-gateway/glossary/ import { Glossary } from "~/components"; AI Gateway supports a variety of headers to help you configure, customize, and manage your API requests. This page provides a complete list of all supported headers, along with a short description ## Configuration hierarchy Settings in AI Gateway can be configured at three levels: **Provider**, **Request**, and **Gateway**. Since the same settings can be configured in multiple locations, the following hierarchy determines which value is applied: 1. **Provider-level headers**: Relevant only when using the [Universal Endpoint](/ai-gateway/universal/), these headers take precedence over all other configurations. 2. **Request-level headers**: Apply if no provider-level headers are set. 3. **Gateway-level settings**: Act as the default if no headers are set at the provider or request levels. This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use provider-level and request-level headers for more fine-tuned control, and gateway settings for general defaults. --- # Cloudflare AI Gateway URL: https://developers.cloudflare.com/ai-gateway/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Observe and control your AI applications. Cloudflare's AI Gateway allows you to gain visibility and control over your AI apps. By connecting your apps to AI Gateway, you can gather insights on how people are using your application with analytics and logging and then control how your application scales with features such as caching, rate limiting, as well as request retries, model fallback, and more. Better yet - it only takes one line of code to get started. Check out the [Get started guide](/ai-gateway/get-started/) to learn how to configure your applications with AI Gateway. ## Features View metrics such as the number of requests, tokens, and the cost it takes to run your application. Gain insight on requests and errors. Serve requests directly from Cloudflare's cache instead of the original model provider for faster requests and cost savings. Control how your application scales by limiting the number of requests your application receives. Improve resilience by defining request retry and model fallbacks in case of an error. Workers AI, OpenAI, Azure OpenAI, HuggingFace, Replicate, and more work with AI Gateway. --- ## Related products Run machine learning models, powered by serverless GPUs, on Cloudflare’s global network. Build full-stack AI applications with Vectorize, Cloudflare's vector database. Adding Vectorize enables you to perform tasks such as semantic search, recommendations, anomaly detection or can be used to provide context and memory to an LLM. ## More resources Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Learn how you can build and deploy ambitious AI applications to Cloudflare's global network. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Universal Endpoint URL: https://developers.cloudflare.com/ai-gateway/universal/ import { Render, Badge } from "~/components"; You can use the Universal Endpoint to contact every provider. ```txt https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id} ``` AI Gateway offers multiple endpoints for each Gateway you create - one endpoint per provider, and one Universal Endpoint. The Universal Endpoint requires some adjusting to your schema, but supports additional features. Some of these features are, for example, retrying a request if it fails the first time, or configuring a [fallback model/provider](/ai-gateway/configuration/fallbacks/). You can use the Universal endpoint to contact every provider. The payload is expecting an array of message, and each message is an object with the following parameters: - `provider` : the name of the provider you would like to direct this message to. Can be OpenAI, workers-ai, or any of our supported providers. - `endpoint`: the pathname of the provider API you’re trying to reach. For example, on OpenAI it can be `chat/completions`, and for Workers AI this might be [`@cf/meta/llama-3.1-8b-instruct`](/workers-ai/models/llama-3.1-8b-instruct/). See more in the sections that are specific to [each provider](/ai-gateway/providers/). - `authorization`: the content of the Authorization HTTP Header that should be used when contacting this provider. This usually starts with 'Token' or 'Bearer'. - `query`: the payload as the provider expects it in their official API. ## cURL example The above will send a request to Workers AI Inference API, if it fails it will proceed to OpenAI. You can add as many fallbacks as you need, just by adding another JSON in the array. ## WebSockets API The Universal Endpoint can also be accessed via a [WebSockets API](/ai-gateway/websockets-api/) which provides a single persistent connection, enabling continuous communication. This API supports all AI providers connected to AI Gateway, including those that do not natively support WebSockets. ## WebSockets example ```javascript import WebSocket from "ws"; const ws = new WebSocket( "wss://gateway.ai.cloudflare.com/v1/my-account-id/my-gateway/", { headers: { "cf-aig-authorization": "Bearer AI_GATEWAY_TOKEN", }, }, ); ws.send( JSON.stringify({ type: "universal.create", request: { eventId: "my-request", provider: "workers-ai", endpoint: "@cf/meta/llama-3.1-8b-instruct", headers: { Authorization: "Bearer WORKERS_AI_TOKEN", "Content-Type": "application/json", }, query: { prompt: "tell me a joke", }, }, }), ); ws.on("message", function incoming(message) { console.log(message.toString()); }); ``` ## Header configuration hierarchy The Universal Endpoint allows you to set fallback models or providers and customize headers for each provider or request. You can configure headers at three levels: 1. **Provider level**: Headers specific to a particular provider. 2. **Request level**: Headers included in individual requests. 3. **Gateway settings**: Default headers configured in your gateway dashboard. Since the same settings can be configured in multiple locations, AI Gateway applies a hierarchy to determine which configuration takes precedence: - **Provider-level headers** override all other configurations. - **Request-level headers** are used if no provider-level headers are set. - **Gateway-level settings** are used only if no headers are configured at the provider or request levels. This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use provider-level and request-level headers for fine-tuned control, and gateway settings for general defaults. ## Hierarchy example This example demonstrates how headers set at different levels impact caching behavior: - **Request-level header**: The `cf-aig-cache-ttl` is set to `3600` seconds, applying this caching duration to the request by default. - **Provider-level header**: For the fallback provider (OpenAI), `cf-aig-cache-ttl` is explicitly set to `0` seconds, overriding the request-level header and disabling caching for responses when OpenAI is used as the provider. This shows how provider-level headers take precedence over request-level headers, allowing for granular control of caching behavior. ```bash curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id} \ --header 'Content-Type: application/json' \ --header 'cf-aig-cache-ttl: 3600' \ --data '[ { "provider": "workers-ai", "endpoint": "@cf/meta/llama-3.1-8b-instruct", "headers": { "Authorization": "Bearer {cloudflare_token}", "Content-Type": "application/json" }, "query": { "messages": [ { "role": "system", "content": "You are a friendly assistant" }, { "role": "user", "content": "What is Cloudflare?" } ] } }, { "provider": "openai", "endpoint": "chat/completions", "headers": { "Authorization": "Bearer {open_ai_token}", "Content-Type": "application/json", "cf-aig-cache-ttl": "0" }, "query": { "model": "gpt-4o-mini", "stream": true, "messages": [ { "role": "user", "content": "What is Cloudflare?" } ] } } ]' ``` --- # API Gateway URL: https://developers.cloudflare.com/api-shield/api-gateway/ API Gateway is a package of features that will do everything for your APIs, including: - **Security**: Protect your API from malicious traffic with [API Discovery](/api-shield/security/api-discovery/), [Schema validation](/api-shield/security/schema-validation/), [mTLS validation](/api-shield/security/mtls/), and more. - **Management and monitoring**: Streamline API management with [Endpoint Management](/api-shield/management-and-monitoring/) and [tools](https://blog.cloudflare.com/api-gateway/) like analytics, routing, and authentication. - **Logging, quota management, and more**: All of Cloudflare's [established features](https://blog.cloudflare.com/api-gateway/), like caching, load balancing, and log integrations work natively with API Gateway. For more details about API Gateway, refer to the [introductory blog post](https://blog.cloudflare.com/api-gateway/). --- # Changelog URL: https://developers.cloudflare.com/api-shield/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # Glossary URL: https://developers.cloudflare.com/bots/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Bots documentation. --- # Cloudflare bot solutions URL: https://developers.cloudflare.com/bots/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Render } from "~/components" Identify and mitigate automated traffic to protect your domain from bad bots. While Cloudflare offers several products that relate to bot traffic, this section reviews our bot-specific products, Bot Fight Mode, Super Bot Fight Mode, and Bot Management for Enterprise. ## Which bot solution do I need? ## Features Detect and mitigate bot traffic on your domain. Identify traffic matching patterns of known bots, challenge or block bots, protect static resources, and view analytics to help you understand bot traffic using Super Bot Fight Mode. Use Bot Analytics to dynamically examine bot traffic. Access several new variables within the Firewall expression builder. ## Related products Identify and address API vulnerabilities using API Shield. Detect and mitigate Distributed Denial of Service (DDoS) attacks using Cloudflare's Autonomous Edge. Use Cloudflare's smart CAPTCHA alternative to run less intrusive challenges. Get automatic protection from vulnerabilities and the flexibility to create custom rules. ## More resources Compare available Cloudflare plans --- # Changelog URL: https://developers.cloudflare.com/browser-rendering/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/browser-rendering/faq/ import { GlossaryTooltip } from "~/components"; Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [Discord](https://discord.cloudflare.com) to explore additional resources. ### I see `Cannot read properties of undefined (reading 'fetch')` when using Browser Rendering. How do I fix this? This error occurs because your Puppeteer launch is not receiving the Browser binding or you are not on a Workers Paid plan. To resolve: Pass your Browser binding into `puppeteer.launch`. ### Will Browser Rendering bypass Cloudflare's Bot Protection? No, Browser Rendering requests are always identified as bots by Cloudflare and do not bypass Bot Protection. Additionally, Browser Rendering respects the robots.txt protocol, ensuring that any disallowed paths specified for user agents are not accessed during rendering. If you are attempting to scan your **own zone** and need Browser Rendering to access areas protected by Cloudflare’s Bot Protection, you can create a [WAF skip rule](/waf/custom-rules/skip/) to bypass the bot protection using a header or a custom user agent. ### Why can't I use an XPath selector when using Browser Rendering with Puppeteer? Currently it is not possible to use Xpath to select elements since this poses a security risk to Workers. As an alternative try to use a css selector or `page.evaluate` for example: ```ts const innerHtml = await page.evaluate(() => { return ( // @ts-ignore this runs on browser context new XPathEvaluator() .createExpression("/html/body/div/h1") // @ts-ignore this runs on browser context .evaluate(document, XPathResult.FIRST_ORDERED_NODE_TYPE).singleNodeValue .innerHTML ); }); ``` :::note Keep in mind that `page.evaluate` can only return primitive types like strings, numbers, etc. Returning an `HTMLElement` will not work. ::: ### What are the usage limits and pricing tiers for Cloudflare Browser Rendering and how do I estimate my costs? You can view the complete breakdown of concurrency caps, request rates, timeouts, and REST API quotas on the [limits page](/browser-rendering/platform/limits/). By default, idle browser sessions close after 60 seconds of inactivity. You can adjust this with the [`keep_alive` option](/browser-rendering/platform/puppeteer/#keep-alive). #### Pricing Browser Rendering is currently free up to the limits above until billing begins. Pricing will be announced in advance. ### Does Browser Rendering rotate IP addresses for outbound requests? No. Browser Rendering requests originate from Cloudflares global network, but you cannot configure per-request IP rotation. All rendering traffic comes from Cloudflare IP ranges and requests include special headers [(`cf-biso-request-id`, `cf-biso-devtools`)](/browser-rendering/reference/automatic-request-headers/) so origin servers can identify them. ### I see `Error processing the request: Unable to create new browser: code: 429: message: Browser time limit exceeded for today`. How do I fix it? This error indicates you have hit the daily browser-instance limit on the Workers Free plan. [Free-plan accounts are capped at free plan limit is 10 minutes of browser use a day](/browser-rendering/platform/limits/#workers-free) once you exceed those, further creation attempts return a 429 until the next UTC day. To resolve:[Upgrade to a Workers Paid plan](/workers/platform/pricing/) - Paid accounts raise these limits to [10 concurrent browsers and 10 new instances per minute](/browser-rendering/platform/limits/#workers-paid). --- # Browser Rendering URL: https://developers.cloudflare.com/browser-rendering/ import { CardGrid, Description, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Browser automation for [Cloudflare Workers](/workers/) and [quick browser actions](/browser-rendering/rest-api/). Browser Rendering enables developers to programmatically control and interact with headless browser instances running on Cloudflare’s global network. This facilitates tasks such as automating browser interactions, capturing screenshots, generating PDFs, and extracting data from web pages. ## Integration Methods You can integrate Browser Rendering into your applications using one of the following methods: - **[REST API](/browser-rendering/rest-api/)**: Ideal for simple, stateless tasks like capturing screenshots, generating PDFs, extracting HTML content, and more. - **[Workers Binding API](/browser-rendering/workers-binding-api/)**: Suitable for advanced browser automation within [Cloudflare Workers](/workers/). This method provides greater control, enabling more complex workflows and persistent sessions. Choose the method that best fits your use case. For example, use the [REST API endpoints](/browser-rendering/rest-api/) for straightforward tasks from external applications and the [Workers Binding API](/browser-rendering/workers-binding-api/) for complex automation within the Cloudflare ecosystem. ## Use Cases Browser Rendering can be utilized for various purposes, including: - Fetch HTML content of a page. - Capture screenshot of a webpage. - Convert a webpage into a PDF document. - Take a webpage snapshot. - Scrape specified HTML elements from a webpage. - Retrieve data in a structured format. - Extract Markdown content from a webpage. - Gather all hyperlinks found on a webpage. ## Related products Build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. A globally distributed coordination API with strongly consistent storage. Build and deploy AI-powered agents that can autonomously perform tasks. ## More resources Deploy your first Browser Rendering project using Wrangler and Cloudflare's version of Puppeteer. New to Workers? Get started with the Workers Learning Path. Learn about Browser Rendering limits. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Get started URL: https://developers.cloudflare.com/browser-rendering/get-started/ Browser rendering can be used in two ways: - [Workers Binding API](/browser-rendering/workers-binding-api) for complex scripts. - [REST API](/browser-rendering/rest-api/) for simple actions. --- # Changelog URL: https://developers.cloudflare.com/byoip/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/byoip/get-started/ import { GlossaryTooltip } from "~/components" To bring your own IPs, you must work with your account team to understand everything you need to ensure a smooth transition during the onboarding process. Cloudflare requires a service-specific configuration for your prefixes, as well as some requirements common to all BYOIP customers regardless of service type. These requirements are common to all products compatible with BYOIP, such as [Magic Transit](/magic-transit/), [Spectrum](/spectrum/), and [CDN services](/cache/). ## Prerequisites There are two major prerequisites before Cloudflare can begin onboarding your IP space. 1. Cloudflare must receive a [Letter of Agency (LOA)](/byoip/concepts/loa/) to announce your prefixes, which we will share with our transit partners as evidence that we are allowed to announce the route. 2. You must verify that your [Internet Routing Registry (IRR)](/byoip/concepts/irr-entries/) records are up to date and contain: - `route` or `route6` objects matching the exact prefixes you want to onboard - `origin` matching the correct ASN you want to onboard :::caution[RPKI validation] You are not required to use Resource Public Key Infrastructure (RPKI). However, if you do, make sure your ROAs are accurate. You can use [Cloudflare's RPKI Portal](https://rpki.cloudflare.com/?view=validator) and a second source such as [Routinator](https://rpki-validator.ripe.net/ui/) to double check your prefixes. ::: After onboarding, [Border Gateway Protocol (BGP)](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/) announcements for customer prefixes can be controlled with the [Dynamic Advertisement](/byoip/concepts/dynamic-advertisement/) API or via the Cloudflare dashboard. ## Cloudflare IPs If you are unable to bring your own IP to Cloudflare, you can use an IP address issued by Cloudflare. Using a Cloudflare IP may be a good option if you: * Have one or a few IPs allocated from home or business class ISPs. * Are an online streamer who could be the target of a DoS attack if your IP is leaked. * Are a business owner with a small number of locations with broadband Internet connections. * Do not own an IP space with a /24 prefix length. * Maintain a large number of locations with a combination of connectivity methods. * Own an IP space with a /24 prefix length but do not advertise prefixes from every location. To protect your network using a Cloudflare IP address, contact your account manager. :::note When you use a Cloudflare-managed IP space, you do not need to provide a Letter of Agency (LOA) and advertise your prefixes that are associated with bringing your own IP. ::: --- # Glossary URL: https://developers.cloudflare.com/byoip/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's BYOIP documentation. --- # Cloudflare BYOIP URL: https://developers.cloudflare.com/byoip/ import { LinkButton, Plan, Description } from "~/components"; Get Cloudflare's security and performance while using your own IPs. With **Bringing Your Own IPs** (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with [Magic Transit](/magic-transit/), [Spectrum](/spectrum/), [CDN services](/cache/), or [Gateway DNS](/cloudflare-one/policies/gateway/dns-policies/). Learn how to [get started](/byoip/get-started/). --- # Route Leak Detection URL: https://developers.cloudflare.com/byoip/route-leak-detection/ import { AvailableNotifications } from "~/components" Route Leak Detection protects your routes on the Internet by notifying you when your traffic is routed somewhere it should not go, which could indicate a possible attack. Route Leak Detection also reduces the amount of time needed to mitigate leaks by providing you with timely notifications. Cloudflare detects route leaks by using several sources of routing data to create a synthesis of how the Internet sees routes to BYOIP users. Cloudflare then watches these views to track any sudden changes that occur on the Internet. If the changes can be correlated to actions Cloudflare has taken, no further action is required. However, if changes have not been made, Cloudflare notifies you to inform you that your routes and users may be at risk. ## Enable Route Leak Detection You must be a user who has brought your own IP address to Cloudflare, which includes Magic Transit, Spectrum, and WAF users. Only prefixes advertised by Cloudflare qualify for Route Leak Detection. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Select **Notifications** > **Add**. 3. Locate **Route Leak Detection** from the list > **Select**. 4. Enter a name and description for the notification. 5. Enter one or more email addresses to receive the notifications. 6. Select **Save**. --- # Troubleshooting URL: https://developers.cloudflare.com/byoip/troubleshooting/ import { GlossaryTooltip } from "~/components"; The following topics are useful for troubleshooting BYOIP issues. ## uRPF filtering and packet loss Routers receive IP packets and forward the packets to the destination IP address. Unicast Reverse Path Forwarding (uRPF) is a security feature that can prevent spoofing attacks. uRPF operates under two modes: strict and loose mode. Under **strict mode**, the router performs two checks on incoming packets to look for a matching entry in the source routing table and to determine whether the interface that received the packet can be used to reach the source. If the incoming IP packets pass both checks, the packets are forwarded; if the checks do not pass, the packets are dropped. When uRPF is set to loose mode, the router performs a single check when it receives an IP packet to look for a source's matching entry in the routing table. If you are experiencing packet loss as a result of an upstream ISP implementing uRPF filtering, contact your ISP and request the link be set to **loose mode**. ## Non-SNI support Currently, BYOIP cannot be used with [legacy custom certificates](/ssl/edge-certificates/custom-certificates/uploading/) to support non-SNI requests. Instead, you can use Address Maps to set a default SNI for IPs on your account or zone. Refer to [Setup](/byoip/address-maps/setup/#non-sni-support) for further guidance. --- # Changelog URL: https://developers.cloudflare.com/cache/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # Product compatibility URL: https://developers.cloudflare.com/data-localization/compatibility/ The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table. ✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable ## Application Performance | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------- | --------------- | ----------------- | -------------------------- | | Caching/CDN | ✅ | ✅ | ✅ | | Cache Reserve | ⚫️ | 🚧 | ✅ [^29] | | DNS | ⚫️ | 🚧 [^33] | 🚧 [^32] | | HTTP/3 (with QUIC) | ⚫️ | ✘ | ⚫️ | | Image Resizing | ✅ | ✅ [^6] | 🚧 [^1] | | Load Balancing | ✅ | ✅ | 🚧 [^1] | | Onion Routing | ✘ | ✘ | ✘ | | Orange-to-Orange (O2O) | ✘ | ✘ | ✘ | | Stream Delivery | ✅ | ✅ | ✅ | | Tiered Caching | ✅ | 🚧 [^2] | 🚧 [^30] | | Trace | ✘ | ✘ | ✘ | | Waiting Room | ⚫️ | ✅ | ✅ | | Web Analytics / Real User Monitoring (RUM) | ⚫️ | ⚫️ | ✘ [^43] | | Zaraz | ✅ | ✅ | ✅ | *** ## Application Security | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------------- | --------------- | ----------------- | -------------------------- | | Advanced Certificate Manager | ⚫️ | ⚫️ | ⚫️ | | Advanced DDoS Protection | ✅ | ✅ | 🚧 [^3] | | API Shield | ✅ | ✅ | 🚧 [^4] | | Bot Management | ✅ | ✅ | 🚧 [^5] | | DNS Firewall | ⚫️ | ⚫️ | 🚧 [^22] | | Page Shield | ✅ | ✅ | ✅ | | Rate Limiting | ✅ | ✅ | ✅ [^37] | | SSL | ✅ | ✅ | ✅ | | Cloudflare for SaaS | ✘ | ✅ | ✅ | | Turnstile | ⚫️ | ✘ | ✅ [^38] | | WAF/L7 Firewall | ✅ | ✅ | ✅ | | DMARC Management | ⚫️ | ⚫️ | ✅ | *** ## Developer Platform | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------------- | --------------- | ----------------- | -------------------------- | | Cloudflare Images | ⚫️ | ✅ [^36] | 🚧 [^35] | | AI Gateway | ✘ | ✘ | 🚧 [^39] | | Cloudflare Pages | ✅ [^11] | ✅ [^11] | 🚧 [^1] | | Cloudflare D1 | ⚫️ | ⚫️ | 🚧 [^40] | | Durable Objects | ⚫️ | ✅ [^7] | 🚧 [^1] | | Email Routing | ⚫️ | ⚫️ | ✅ | | R2 | ✅ [^27] | ✅ [^8] | ✅ [^28] | | Smart Placement | ⚫️ | ✘ | ✘ | | Stream | ⚫️ | ✘ | 🚧 [^1] | | Workers (deployed on a Zone) | ✅ | ✅ | 🚧 [^41] | | Workers AI | ⚫️ | ✘ | ✅ | | Workers KV | ⚫️ | ✘ | ✅ [^34] | | Workers.dev | ✘ | ✘ | ✘ | | Workers Analytics Engine (WAE) | ⚫️ | ⚫️ | 🚧 [^1] | *** ## Network Services | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ------------------ | --------------- | ----------------- | -------------------------- | | Argo Smart Routing | ✅ | ✘ [^9] | ✘ [^10] | | Static IP/BYOIP | ⚫️ | ✅ [^26] | ⚫️ | | Magic Firewall | ⚫️ | ⚫️ | ✅ | | Magic Network Monitoring | ⚫️ | ⚫️ | 🚧 [^1] | | Magic Transit | ⚫️ | ⚫️ | 🚧 [^1] | | Magic WAN | ⚫️ | ⚫️ | ✅ | | Spectrum | ✅ | ✅ [^42] | ✅ | *** ## Platform | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ------- | --------------- | ----------------- | -------------------------- | | Logpull | ⚫️ | ⚫️ | 🚧 [^12] | | Logpush | ⚫️ | ✅ | 🚧 [^13] | | Log Explorer | ⚫️ | ⚫️ | ✘ [^23] | *** ## Zero Trust | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ----------------- | --------------- | ----------------- | -------------------------- | | Access | 🚧 [^14] | 🚧 [^15] | 🚧 [^16] | | Browser Isolation | ⚫️ | 🚧 [^17] | ✅ | | CASB | ⚫️ | ⚫️ | ✘ | | Cloudflare Tunnel | ⚫️ | 🚧 [^18] | ⚫️ | | DLP | ⚫️ [^19] | ⚫️ [^19] | 🚧 [^31] | | Gateway | 🚧 [^20] | 🚧 [^21] | 🚧 [^22] | | WARP | ⚫️ | ⚫️ | 🚧 [^1] | [^1]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. [^2]: Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. [^3]: Adaptive DDoS Protection is only supported for US CMB. [^4]: Features such as API Discovery and Volumetric Abuse Detection will not work with CMB set to EU only. [^5]: Some advanced Enterprise features, including the [Anomaly Detection engine](/bots/concepts/bot-score/#anomaly-detection), are not available. [^6]: Only when using a Custom Domain set to a region, either through Workers or [Transform Rules](/images/transform-images/serve-images-custom-paths/) within the same zone. [^7]: [Jurisdiction restrictions for Durable Objects](/durable-objects/reference/data-location/#restrict-durable-objects-to-a-jurisdiction). [^8]: Only when using a [Custom Domain](/r2/buckets/public-buckets/#connect-a-bucket-to-a-custom-domain) set to a region and using [jurisdictions with the S3 API](/r2/reference/data-location/#using-jurisdictions-with-the-s3-api). [^9]: Argo cannot be used with Regional Services. [^10]: Argo cannot be used with Customer Metadata Boundary. [^11]: Only when using [Custom Domain](/pages/configuration/custom-domains/) set to a region. [^12]: Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with [Logs Engine](https://blog.cloudflare.com/announcing-logs-engine/) which is adding region support in 2025. [^13]: Logpush available with Customer Metadata Boundary for [these datasets](/data-localization/metadata-boundary/logpush-datasets/). Contact your account team if you need another dataset. [^14]: Access App SSL keys can use Geo Key Manager. [Access JWT](/cloudflare-one/identity/authorization-cookie/validating-json/) is not yet localized. [^15]: Can be localized to US FedRAMP Moderate Domestic region only. [^16]: Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. [^17]: Currently may only be used with US FedRAMP region. [^18]: The only connectivity option is [US FedRAMP Moderate Domestic region](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#region). Regional Services only applies when using [Public Hostnames](/cloudflare-one/connections/connect-networks/routing-to-tunnel/) set to a region. [^19]: Uses Gateway HTTP and CASB. [^20]: You can [bring your own certificate](https://blog.cloudflare.com/bring-your-certificates-cloudflare-gateway/) to Gateway but these cannot yet be restricted to a specific region. [^21]: Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. [^22]: Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. [^23]: Currently, customers do not have the ability to choose the location of the Cloudflare-managed R2 bucket for Log Explorer. [^26]: Static IP/BYOIP can be used with the legacy Spectrum setup. [^27]: Only when using a Custom Domain and a [Custom Certificate](/r2/reference/data-security/#encryption-in-transit) or [Keyless SSL](/ssl/keyless-ssl/). [^28]: R2 Dashboard [Metrics and Analytics](/r2/platform/metrics-analytics/) are populated. Additionally, [Jurisdictional Restrictions](/r2/reference/data-location/#jurisdictional-restrictions) guarantee objects in a bucket are stored within a specific jurisdiction. [^29]: You cannot yet specify region location for object storage itself. [^30]: Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
With CMB set to EU, the Zone Dashboard **Caching** > **Tiered Cache** > **Smart Tiered Caching** option will not populate the Dashboard Analytics. [^31]: DLP is part of Gateway HTTP, however, [DLP datasets](/cloudflare-one/policies/data-loss-prevention/datasets/#use-dlp-datasets) are not available outside US region when using Customer Metadata Boundary. [^32]: Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. [^33]: [Outgoing zone transfers](/dns/zone-setups/zone-transfers/cloudflare-as-primary/) will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. [^34]: Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. [^35]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. [^36]: Only when using a [Custom Domain](/images/manage-images/serve-images/serve-from-custom-domains/) set to a region. [^37]: Legacy Zone Analytics & Logs section not available outside US region when using CMB. Use [Security Analytics](/waf/analytics/security-analytics/) instead. [^38]: [Turnstile Analytics](/turnstile/turnstile-analytics/) are available. However, there are no regionalization guarantees for the Siteverify API yet. [^39]: Jurisdictional Restrictions (storage) options for [Logs](/ai-gateway/observability/logging/) are not supported today. [^40]: Jurisdictional Restrictions ([data location](/d1/configuration/data-location/) / storage) options are not supported today. [^41]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. Use Logpush instead. [^42]: Only applies to HTTP/S Spectrum applications. [^43]: Web Analytics collects the [minimum amount of information](/web-analytics/data-metrics/data-origin-and-collection/). Alternatively, you can [exclude EU Visitors from RUM](/speed/speed-test/rum-beacon/#rum-excluding-eeaeu). --- # FAQs URL: https://developers.cloudflare.com/data-localization/faq/ ## Are DLP and DLS the same? No, they are not. DLP stands for [Data Loss Prevention](/cloudflare-one/policies/data-loss-prevention/), and it is part of Cloudflare’s Zero Trust offering (requiring Gateway). It allows customers to scan web traffic and SaaS apps for sensitive data like secret keys, financial information (credit card numbers), and other keywords. [Data Localization Suite](/data-localization/) (DLS) is a suite of features that can provide localization and data residency features. ## Are Cloudflare’s services GDPR compliant? Yes, even without DLS, Cloudflare services are designed to satisfy the GDPR’s requirements. Cloudflare services are also verified compliant with the EU Cloud CoC, Verification-ID: 2023LVL02SCOPE4316. For further information, visit EU Cloud CoC [public register](https://eucoc.cloud/en/public-register). ## How can I use DLS? Once you have purchased DLS, the post-sales team will entitle DLS for you, and you will be able to configure all features by yourself via dashboard or API. You can find more specific information under the [Configuration guides](/data-localization/how-to/) section. ## Does Regional Services work with HTTP/3 / QUIC? Not yet. ## Are there other options if I prefer not to have Cloudflare handle TLS termination (decryption)? Yes, you have these options available: * [Spectrum TCP/UDP Apps](/spectrum/) (without TLS Termination) * [Magic Transit](/magic-transit/) * [Privacy Gateway](/privacy-gateway/) These options only offer L3/L4 DDoS protection and using them imply that no application / L7 security or performance services can be applied. --- # Geo Key Manager URL: https://developers.cloudflare.com/data-localization/geo-key-manager/ Geo Key Manager offers enhanced control over the storage location of private SSL/TLS keys, ensuring compliance with regional data regulations and security requirements. ## Customize key storage By default, private keys will be encrypted and securely distributed to each data center, where they can be utilized for local SSL/TLS termination. Geo Key Manager allows you to choose where you want to store your private keys. Geo Key Manager was restricted to the US, EU, and high-security data centers, but with the new version of Geo Key Manager, available in [Closed Beta](https://blog.cloudflare.com/configurable-and-scalable-geo-key-manager-closed-beta/), you can now create `allowlists` and `blocklists` of countries in which your private keys will be stored. That means that you will be able define specific geographic locations where to store keys, for instance you can store your private keys exclusively in Australia or limit private keys storage to the EU and the UK. ## Cloudflare data center flow example The following diagram is a high-level example of the flow of the Cloudflare data centers without private TLS key. In this process, data centers have to request and create temporary Session Keys to perform TLS termination by reaching out to Cloudflare data centers which hold the private TLS keys:
```mermaid sequenceDiagram participant User as End user participant CloudflarePoP as Closest data center without TLS Key participant CloudflarePoPwTLS as Data center with TLS Key User->>CloudflarePoP: Initial request Note right of CloudflarePoP: Closest data center cannot decrypt CloudflarePoP-->>CloudflarePoPwTLS: Requests TLS Signature CloudflarePoPwTLS-->>CloudflarePoP: Sends TLS Signature in order to establish Session Key Note right of CloudflarePoP: Decrypts and performs business logic (for example, WAF, Configuration Rules, Load Balancing) CloudflarePoP-->>User: Subsequent requests use the Session Key User-->>CloudflarePoP: Subsequent requests use the Session Key ```
For detailed information on setup and supported options, refer to [Geo Key Manager documentation](/ssl/edge-certificates/geokey-manager/). --- # Data Localization Suite URL: https://developers.cloudflare.com/data-localization/ import { CardGrid, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" The Data Localization Suite (DLS) is a collection of tools that enable customers to choose the location where Cloudflare inspects and stores data, while maintaining the security and performance benefits of our global network. *** ## Features Keep your keys within a specified region, ensuring compliance and data sovereignty. Ensure that any traffic metadata that can identify your end user stays in the region you selected. Comply with regional restrictions by choosing which subset of data centers decrypts and services your HTTPS traffic. *** ## Related products Cloudflare SSL/TLS encrypts your web traffic to prevent data theft and other tampering. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. *** ## More resources Refer to our latest resources to learn more about privacy. Read articles about the latest updates to the Data Localization Suite. --- # Limitations URL: https://developers.cloudflare.com/data-localization/limitations/ import { Render } from "~/components" There are some caveats and limitations when deploying Data Localization Suite features. Cloudflare is working hard to improve this offering and fill the gaps. If you have a specific feature request, please contact your [Account Team](/support/contacting-cloudflare-support/). ## Key Management When using Geo Key Manager or Keyless SSL, some caveats may apply. The remote procedure call from the server to the key server can add latency to the handshake, slowing down connection establishment. The additional latency cost corresponds to the round-trip time from the server to the key server, which can be as much as a second if the key server is on the other side of the world. Luckily, this latency cost only applies to the first time you connect to a server. Once the handshake is complete, the key server is not involved. Furthermore, if you reconnect to a site you do not have to pay the latency cost either because resuming a connection with TLS Session Resumption does not require the private key. Hence, latency is only added for the initial connection. Learn more about how it works in our [blog post](https://blog.cloudflare.com/geo-key-manager-how-it-works/). ## Regional Services When using Regional Services, some caveats and limitations may apply. For product-specific caveats, refer to [Cloudflare product compatibility](/data-localization/compatibility/) page. The following features and protocols are not supported by Regional Services and might not work on regionalized hostnames: * [ICMP](https://www.cloudflare.com/learning/ddos/glossary/internet-control-message-protocol-icmp/) * [Encrypted Client Hello (ECH)](/ssl/edge-certificates/ech/) * [Orange-to-Orange (O2O)](/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/) * [Onion Routing (Tor)](/network/onion-routing/) Since Regional Services leverages Spectrum in the background, [Spectrum limitations](/spectrum/reference/limitations/) apply. Regional Services does not apply to [Subrequests](/workers/platform/limits/#subrequests). Regional Services operates on your hostname's IPs. We recommend using [DNSSEC](/learning-paths/application-security/default-traffic-security/dnssec/) and/or [DNS over HTTPS](/1.1.1.1/encryption/dns-over-https/) to ensure that DNS responses are secure and correct. ## Customer Metadata Boundary There are certain limitations and caveats when using Customer Metadata Boundary. Specifically most of the Zone Analytics & Logs UI Tabs will be showing up as empty, when configuring Customer Metadata Boundary to EU only. It is recommended to use the UI [Security Analytics](/waf/analytics/security-analytics/) instead, or the [HTTP request](/logs/reference/log-fields/zone/http_requests/) logs via [Logpush](/logs/about/). To configure Customer Metadata Boundary to EU only, you must disable Log Retention for all zones within your account. Log Retention is a legacy feature of [Logpull](/logs/logpull/). For product-specific caveats, refer to [Cloudflare product compatibility](/data-localization/compatibility/) page. ### Data unavailability ### Dashboard UI Analytics In some cases, when using Customer Metadata Boundary set to the EU, some Dashboard UI Analytics might show up empty. --- # Region support URL: https://developers.cloudflare.com/data-localization/region-support/ Support by product and region is summarized in the following table: | Region | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------------------- | --------------- | ----------------- | ----------------------------- | | US | ✅ | ✅ | ✅ | | EU | ✅ | ✅ | ✅ | | UK | ✅ | ✅ | Can use EU metadata boundary. | | Canada | ✅ | ✅ | ✘ | | Australia | ✅ | ✅ | ✘ | | Japan | ✅ | ✅ | ✘ | | India | ✅ | ✅ | ✘ | | ISO 27001 Certified European Union | ✅ | ✅ | Can use EU metadata boundary. | | Germany | ✅ | ✅ | Can use EU metadata boundary. | | Singapore | ✅ | ✅ | ✘ | | South Korea | ✅ | ✅ | ✘ | | Austria | ✘ | ✅ | Can use EU metadata boundary. | | Brazil | ✘ | ✅ | ✘ | | Cloudflare Green Energy | ✘ | ✅ | ✘ | | Exclusive of Hong Kong and Macau | ✘ | ✅ | ✘ | | Exclusive of Russia and Belarus | ✘ | ✅ | ✘ | | France | ✘ | ✅ | Can use EU metadata boundary. | | Hong Kong | ✘ | ✅ | ✘ | | Italy | ✘ | ✅ | Can use EU metadata boundary. | | NATO | ✘ | ✅ | ✘ | | Netherlands | ✘ | ✅ | Can use EU metadata boundary. | | Russia | ✘ | ✅ | ✘ | | Saudi Arabia | ✘ | ✅ | ✘ | | South Africa | ✘ | ✅ | ✘ | | Spain | ✘ | ✅ | Can use EU metadata boundary. | | Switzerland | ✘ | ✅ | ✘ | | Taiwan | ✘ | ✅ | ✘ | | US State of California | ✘ | ✅ | ✘ | | US State of Florida | ✘ | ✅ | ✘ | | US State of Texas | ✘ | ✅ | ✘ | | FedRAMP Moderate Compliant (Domestic) [^1] | ✅ | ✅ | ✅ | | FedRAMP Moderate Compliant (International) [^2] | ✘ | ✅ | ✅ | Only supported in [Geo Key Manager v2](/ssl/edge-certificates/geokey-manager/). [^1]: FedRAMP Moderate Compliant (Domestic) was previously named FedRAMP Compliant. It consists of our FedRAMP Moderate compliant data centers in the US. [^2]: FedRAMP Moderate Compliant (International) consists of all our FedRAMP Moderate compliant data centers globally. --- # Application guide URL: https://developers.cloudflare.com/developer-spotlight/application-guide/ If you use Cloudflare's developer products and would like to share your expertise then Cloudflare's Developer Spotlight program is for you. Whether you use Cloudflare in your profession, as a student or as a hobby, let us spotlight your creativity. Write a tutorial for our documentation and earn credits for your Cloudflare account along with having your name credited on your work. The Developer Spotlight program is open for applicants until Thursday, the 24th of October 2024. ## Who can apply? The following is required in order to be an eligible applicant for the Developer Spotlight program: - You must not be an employee of Cloudflare. - You must be 18 or older. - All participants must agree to the [Developer Spotlight terms](/developer-spotlight/terms/). ## Submission rules Your tutorial must be: 1. Easy for anyone to follow. 2. Technically accurate. 3. Entirely original, written only by you. 4. Written following Cloudflare's documentation style guide. For more information, please visit our [style guide documentation](/style-guide/) and our [tutorial style guide documentation](/style-guide/documentation-content-strategy/content-types/tutorial/#template) 5. About how to use [Cloudflare's Developer Platform products](/products/?product-group=Developer+platform) to create a project or solve a problem. 6. Complete, not an unfinished draft. ## How to apply To apply to the program, submit an application through the [Developer Spotlight signup form](https://forms.gle/anpTPu45tnwjwXsk8). Successful applicants will be contacted by email. ## Account credits Account credits can be used towards recurring monthly charges for Cloudflare plans or add-on services. Once a tutorial submission has been approved and published, we can then add 350 credits to your Cloudflare account. Credits are only valid for three years. Valid payment details must be stored on the recieving account before credits can be added. ## FAQ ### How many tutorial topic ideas can I submit? You may submit as many tutorial topics ideas as you like in your application. ### When will I be compensated for my tutorial? We will add the account credits to your Cloudflare account after your tutorial has been approved and published under the Developer Spotlight program. ### If my tutorial is accepted and published on Cloudflare's Developer Spotlight program, can I republish it elsewhere? We ask that you do not republish any tutorials that have been published under the Cloudflare Developer Spotlight program. ### Will I be credited for my work? You will be credited as the author of any tutorial you submit that is successfully published through the Cloudflare Developer Spotlight program. We will add your details to your work after it has been approved. ### What happens If my topic of choice gets accepted but the tutorial submission gets rejected? Our team will do our best to help you edit your tutorial's pull request to be ready for submission; however, in the unlikely chance that your tutorial's pull request is rejected, you are still free to publish your work elsewhere. --- # Developer Spotlight program URL: https://developers.cloudflare.com/developer-spotlight/ import { LinkTitleCard } from "~/components"; ![Illustration of a laptop.](~/assets/images/developer_spotlight/developer_spotlight.png) Find examples of how our community of developers are getting the most out of our products. Applications are currently open until Thursday, the 24th of October 2024. To apply, please read the [application guide](/developer-spotlight/application-guide/) ## View latest contributions By Mackenly Jones By Rajeev R. Sharma By Hidetaka Okamoto By Ivan Buendia By Vasyl By Aleksej Komnenovic By John Siciliano By Hidetaka Okamoto By Dominik Fuerst By Cody Walsh --- # Developer Spotlight Terms URL: https://developers.cloudflare.com/developer-spotlight/terms/ These Developer Spotlight Terms (the “Terms”) govern your participation in the Cloudflare Developer Spotlight Program (the “Program”). As used in these Terms, "Cloudflare", "us" or "we" refers to Cloudflare, Inc. and its affiliates. THESE TERMS DO NOT APPLY TO YOUR ACCESS AND USE OF THE CLOUDFLARE PRODUCTS AND SERVICES THAT ARE PROVIDED UNDER THE [SELF-SERVE SUBSCRIPTION AGREEMENT](https://www.cloudflare.com/terms/), THE [ENTERPRISE SUBSCRIPTION AGREEMENT](https://www.cloudflare.com/enterpriseterms/), OR OTHER WRITTEN AGREEMENT SIGNED BETWEEN YOU AND CLOUDFLARE (IF APPLICABLE). 1. Eligibility. By agreeing to these Terms, you represent and warrant to us: (i) that you are at least eighteen (18) years of age; (ii) that you have not previously been suspended or removed from the Program and (iii) that your participation in the Program is in compliance with any and all applicable laws and regulations. 2. Submissions. From time-to-time, Cloudflare may accept certain tutorials, blogs, and other content submissions from its developer community (“Dev Content”) for consideration for publication on a Cloudflare blog, developer documentation, social media platform or other website. You grant us a worldwide, perpetual, irrevocable, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Dev Content in any and all media or distribution methods now known or later developed. a. Likeness. You hereby grant to Cloudflare the royalty free right to use your name and likeness and any trademarks you include in the Dev Content in any and all manner, media, products, means, or methods, now known or hereafter created, throughout the world, in perpetuity, in connection with Cloudflare’s exercise of its rights under these Terms, including Cloudflare’s use of the Dev Content. Notwithstanding any other provision of these Terms, nothing herein will obligate Cloudflare to use the Dev Content in any manner. You understand and agree that you will have no right to any proceeds derived by Cloudflare or any third party from the use of the Dev Content. b. Representations & Warranties. By submitting Dev Content, you represent and warrant that (1) you are the author and sole owner of all rights to the Dev Content; (2) the Dev Content is original and has not in whole or in part previously been published in any form and is not in the public domain; (3) your Dev Content is accurate and not misleading; (4) your Dev Content, does not: (i) infringe, violate, or misappropriate any third-party right, including any copyright, trademark, patent, trade secret, moral right, privacy right, right of publicity, or any other intellectual property or proprietary right; or (ii) slander, defame, or libel any third-party; and (2) no payments will be due from Cloudflare to any third party for the exercise of any rights granted under these Terms. c. Compensation. Unless otherwise agreed by Cloudflare in writing, you understand and agree that Cloudflare will have no obligation to you or any third-party for any compensation, reimbursement, or any other payments in connection with your participation in the Program or publication of Dev Content. 3. Termination. These Terms will continue in full force and effect until either party terminates upon 30 days’ written notice to the other party. The provisions of Sections 2, 4, and 5 shall survive any termination or expiration of this agreement. 4. Indemnification. You agree to defend, indemnify, and hold harmless Cloudflare and its officers, directors, employees, consultants, affiliates, subsidiaries and agents (collectively, the "Cloudflare Entities") from and against any and all claims, liabilities, damages, losses, and expenses, including reasonable attorneys' fees and costs, arising out of or in any way connected with your violation of any third-party right, including without limitation any intellectual property right, publicity, confidentiality, property or privacy right. We reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you (and without limiting your indemnification obligations with respect to such matter), and in such case, you agree to cooperate with our defense of such claim. 5. Limitation of Liability. IN NO EVENT WILL THE CLOUDFLARE ENTITIES BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO YOUR PARTICIPATION IN THE PROGRAM, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, WHETHER OR NOT THE CLOUDFLARE ENTITIES HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE. 6. Independent Contractor. The parties acknowledge and agree that you are an independent contractor, and nothing in these Terms will create a relationship of employment, joint venture, partnership or agency between the parties. Neither party will have the right, power or authority at any time to act on behalf of, or represent the other party. Cloudflare will not obtain workers’ compensation or other insurance on your behalf, and you are solely responsible for all payments, benefits, and insurance required for the performance of services hereunder, including, without limitation, taxes or other withholdings, unemployment, payroll disbursements, and other related expenses. You hereby acknowledge and agree that these Terms are not governed by any union or collective bargaining agreement and Cloudflare will not pay you any union-required residuals, reuse fees, pension, health and welfare benefits or other benefits/payments. 7. Governing Law. These Terms will be governed by the laws of the State of California without regard to conflict of law principles. To the extent that any lawsuit or court proceeding is permitted hereunder, you and Cloudflare agree to submit to the personal and exclusive jurisdiction of the state and federal courts located within San Francisco County, California for the purpose of litigating all such disputes. 8. Modifications. Cloudflare reserves the right to make modifications to these Terms at any time. Revised versions of these Terms will be posted publicly online. Unless otherwise specified, any modifications to the Terms will take effect the day they are posted publicly online. If you do not agree with the revised Terms, your sole and exclusive remedy will be to discontinue your participation in the Program. 9. General. These Terms, together with any applicable product limits, disclaimers, or other terms presented to you on a Cloudflare controlled website (e.g., www.cloudflare.com, as well as the other websites that Cloudflare operates and that link to these Terms) or documentation, each of which are incorporated by reference into these Terms, constitute the entire and exclusive understanding and agreement between you and Cloudflare regarding your participation in the Program. Use of section headers in these Terms is for convenience only and will not have any impact on the interpretation of particular provisions. You may not assign or transfer these Terms or your rights hereunder, in whole or in part, by operation of law or otherwise, without our prior written consent. We may assign these Terms at any time without notice. The failure to require performance of any provision will not affect our right to require performance at any time thereafter, nor will a waiver of any breach or default of these Terms or any provision of these Terms constitute a waiver of any subsequent breach or default or a waiver of the provision itself. In the event that any part of these Terms is held to be invalid or unenforceable, the unenforceable part will be given effect to the greatest extent possible and the remaining parts will remain in full force and effect. Upon termination of these Terms, any provision that by its nature or express terms should survive will survive such termination or expiration. --- # Botnet Threat Feed URL: https://developers.cloudflare.com/ddos-protection/botnet-threat-feed/ The Cloudflare DDoS Botnet Threat Feed is a threat intelligence feed for service providers (SPs) such as hosting providers and Internet service providers (ISPs) that provides information about their own IP addresses that have participated in HTTP DDoS attacks as observed from Cloudflare's global network. The feed aims to help service providers stop the abuse and reduce DDoS attacks originating from within their networks. Each offense is a mitigated HTTP request from the specific IP address. For example, if an IP has 3,000 offenses, it means that Cloudflare has mitigated 3,000 HTTP requests from that IP. A service provider can only get information about IP addresses associated with their autonomous system numbers (ASNs). The affiliation of a service provider with their ASNs will be checked against [PeeringDB](https://www.peeringdb.com/), a reliable and globally recognized interconnection database. To ensure the feed's accuracy, Cloudflare will only include IP addresses that have participated in multiple HTTP DDoS attacks and have triggered high-confidence rules. ## Context A single DDoS attack consisting of thousands of bots can involve as little as one single IP per service provider. Service providers usually only see a small fraction of the attack traffic leaving their network, and it can be hard to correlate it to malicious activity, while trying to identify abusers. In the case of HTTPS DDoS attacks, service providers only see encrypted payloads leaving their network without any possibility to decrypt or understand if it is malicious or legitimate traffic. However, Cloudflare can see an entire attack and all of its sources if the attack targets an Internet property that uses Cloudflare's services. This global view can help service providers stop the abusers. For more details, refer to [How DDoS protection works](/ddos-protection/about/how-ddos-protection-works/). ## Availability The Cloudflare DDoS Botnet Threat Feed is available for free to service providers. For more information, refer to the [Terms of Use](https://www.cloudflare.com/en-gb/service-specific-terms-application-services/#ddos-botnet-threat-feed). --- ## Before you begin Make sure that: - You have [created a Cloudflare account](/fundamentals/setup/account/). ## Get started ### 1. Authenticate your ASN via PeeringDB 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Manage Account** > **Configurations**. 3. Select **DDoS Threat Feed ASNs**. 4. On the list of ASNs configured for your threat feed, select **Add ASN**. 5. You will be redirected to the PeeringDB authentication page, where you can log in and consent to share the affiliation data with us. You will be redirected back to the configuration page once it is successful. :::note You can add multiple ASNs to your threat feed. ::: ### 2. Obtain Cloudflare API token You must [obtain a Cloudflare API token](/fundamentals/api/get-started/create-token/) with at least the following account-level permission: - _DDoS Botnet Feed_ > _Read_ ### 3. Call Botnet Threat Feed API Invoke one of the Botnet Threat Feed API endpoints: - [Get full report](#get-full-report) - [Get day report](#get-day-report) --- ## Available API endpoints :::caution[Important notes] - The API URI path is planned to change from `.../botnet_feed/...` to `.../ddos_botnet_feed/...` in the future. - Responses with no IP addresses in the results (empty state) will return an `HTTP 200` status code (success), with an empty list in the `result` property. - When the response is a success but the result is `0` or `null`, this means that there are no detected offenses. ::: To invoke an API endpoint, append the operation endpoint to the Cloudflare API base URL: ```txt https://api.cloudflare.com/client/v4 ``` ### Get full report Retrieves all the data in the botnet tracking database for a given ASN (currently two weeks worth of data). - HTTP verb: `GET` - Operation endpoint: `/accounts/{account_id}/botnet_feed/asn/{asn}/full_report` The provided `{asn}` must be affiliated with your account. ```bash title="Example request" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/botnet_feed/asn/{asn}/full_report" \ --header "Content-Type: application/json" \ --header "Authorization: Bearer " ``` ```json title="Example response" { "result": [ { "cidr": "127.0.0.1/32", "date": "1970-01-01T00:00:00Z", "offense_count": 10000 }, // ... other entries ... ], "success": true, "errors": [], "messages": [] } ``` ### Get day report Retrieves all the data the botnet tracking database has for a given ASN on a given date. This operation currently allows dates greater than two weeks prior, but in this case it will return an empty dataset (the database currently stores two-weeks worth of data). - HTTP verb: `GET` - Operation endpoint: `/accounts/{account_id}/botnet_feed/asn/{asn}/day_report?date={date}` The provided `{asn}` must be affiliated with your account. `{date}` must be an ISO 8601-formatted date: `YYYY-MM-DD`. If no date is specified, the API responds with the data from the day before. ```bash title="Example request" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/botnet_feed/asn/{asn}/day_report?date=2024-05-05" \ --header "Content-Type: application/json" \ --header "Authorization: Bearer " ``` ```json title="Example response" { "result": [ { "cidr": "127.0.0.1/32", "date": "2024-05-05T00:00:00Z", "offense_count": 10000 }, // ... other entries ... ], "success": true, "errors": [], "messages": [] } ``` --- # FAQ URL: https://developers.cloudflare.com/ddos-protection/frequently-asked-questions/ ## What is a DDoS attack event? When Cloudflare's DDoS systems detect and mitigate attacks, they drop, rate-limit, or challenge (as applicable) packets, DNS queries, or HTTP requests, based on the type of attack. There are three main DDoS mitigation systems: 1. [DDoS Managed Ruleset](/ddos-protection/managed-rulesets/) a. [Network-layer DDoS Managed Ruleset](/ddos-protection/managed-rulesets/network/) b. [HTTP DDoS Managed Ruleset](/ddos-protection/managed-rulesets/http/) 3. [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) 4. [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) The DDoS Managed Ruleset includes many individual rules. Each rule provides the heuristics that instructs the system how to identify DDoS attack traffic. When the DDoS Managed Ruleset identifies an attack, it will generate a real-time fingerprint to match against the attack traffic, and install an ephemeral mitigation rule to mitigate the attack using that fingerprint. The start time of the attack is when the mitigation rule is installed. The attack ends when there is no more traffic matching the rule. This is a single DDoS attack event. A DDoS attack therefore has a start time, end time, and additional attack metadata such as: 1. Attack ID 2. Attack vector 3. Mitigating rule 4. Total bytes and packets 5. Attack target 6. Mitigation action This information is used to populate the [Executive Summary](/analytics/network-analytics/understand/main-dashboard/#executive-summary) section in the [Network Analytics](/analytics/network-analytics/) dashboard. It can also be retrieved via GraphQL API using the `dosdAttackAnalyticsGroups` node. Currently, the concept of a DDoS attack event only exists for the Network-layer DDoS Managed Ruleset. There is no such grouping of individual packets, queries, or HTTP requests for the other systems, although we plan to implement it. --- ## How does Cloudflare protect against "low and slow" DDoS attacks? A [low and slow DDoS attack](https://www.cloudflare.com/learning/ddos/ddos-low-and-slow-attack/) is most commonly a non-volumetric attack. The attacker will send a low volume of HTTP requests, and do so slowly. This type of attack aims to be less detectable and slowly exhausts resources. [Slowloris](https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/) is a type of low and slow attack where the attacker establishes [TCP connections](/fundamentals/reference/tcp-connections/) to the target server, often using HTTP or HTTPS protocols. In the case of a Slowloris attack, the attacker sends incomplete HTTP header lines, thus never completing the HTTP request. The server waits for the complete request, holding the connection open. The attacker periodically sends additional HTTP header fields or partial lines to keep the connection alive. This can be achieved by sending partial HTTP headers, or using the `content-length` header to declare a message body size larger than what is actually sent. The best practice to defend against low and slow attacks is by using an HTTP reverse proxy, such as Cloudflare's [CDN](/fundamentals/concepts/how-cloudflare-works/) or [WAF](/waf/) service. The reverse proxy acts as a shield. It waits for a full HTTP request before forwarding it to the origin, serving from cache, or applying other actions based on user configuration. If you are using our CDN/WAF services, our L7 reverse proxy will absorb low and slow attacks. It will buffer uploads at the edge by default. The proxy will wait for the full HTTP request before passing it on. The client requests must be completed. The request will be served from Cloudflare's [Cache](/cache/) or [Workers](/workers/), if applicable. If not, it will only be sent to the origin — assuming it was fully completed and has passed WAF checks. So the attack does not exist, similar to TCP Slowloris attacks protection. Additionally, the reverse proxy will timeout incomplete HTTP requests after a series of [keepalive probes](/fundamentals/reference/tcp-connections/#tcp-connections-and-keepalives). There is not a minimum threshold for activation. However, to provide additional security, custom firewall rules check for payload sizes and conducts basic sanity checks to ensure the content looks like what is expected. The RUDY (R-U-Dead-Yet?) DDoS attack is another type of denial-of-service (DoS) tool that performs slow-rate attacks on targeted servers. Unlike conventional DDoS attacks that overwhelm servers with a high volume of requests in a short period, RUDY focuses on creating a few prolonged requests. It does this by submitting form data at an extremely slow pace to keep the web server tied up and unavailable to legitimate traffic. This approach makes RUDY attacks difficult to detect, because the traffic can appear legitimate and does not flood the server with requests that would typically trigger conventional DDoS protection mechanisms​​​​​​. RUDY specifically targets the application layer (Layer 7) of web servers by exploiting the way web forms handle data submission. The attack works by injecting one byte of information into an application `POST` field at a time, then waiting. This process causes application threads to await the completion of the form submission indefinitely, effectively exhausting the server's resources and preventing it from processing legitimate requests​​​​. Refer to the [learning center](https://www.cloudflare.com/learning/ddos/ddos-attack-tools/r-u-dead-yet-rudy/) for more information on RUDY attacks. --- ## How does Cloudflare deal with SSL/TLS negotiation attacks or floods? SSL/TLS based attacks such as BEAST, Poodle, and CRIME are mitigated by Cloudflare's TLS settings, configuration, and cipher limitations. Because Cloudflare serves as the HTTP reverse proxy, TLS exhaustion style attacks are mitigated by terminating TLS sessions before passing HTTP requests to origin servers. TLS traffic is not proxied to origin servers without completing a proper TLS handshake. Additionally, our automated DDoS detection and mitigation systems leverage cipher suites, packet fields, HTTP request attributes and metadata, origin health, traffic profiling, Machine Learning models, and threat intelligence to detect and mitigate additional SSL-based attacks. --- ## Does Cloudflare use BGP Flowspec for upstream mitigation? Yes. Using our anycast network, along with Traffic Manager, Unimog, and Plurimog, we conduct automated traffic engineering to spread the load of traffic (legitimate and attack) to ensure our network is performant, especially during mitigation of large attacks. --- ## Where can I see latest DDoS trends? Cloudflare publishes quarterly DDoS reports and coverage of signficant DDoS attacks. The publications are available on our [blog website](https://blog.cloudflare.com/tag/ddos-reports/) and as interactive reports on the [Cloudflare Radar Reports website](https://radar.cloudflare.com/reports?q=DDoS). Learn more about the [methodologies](/radar/reference/quarterly-ddos-reports/) behind these reports. You can also view [Cloudflare Radar](https://radar.cloudflare.com/) for near real-time insights and trends. --- ## What is the Ping of Death DDoS attacks? The Ping of Death (PoD) attack involves sending malformed or oversized packets to another computer or server, which can cause the system to freeze, crash, or reboot. Packets are pieces of data sent over the Internet, and the Ping of Death takes advantage of the fact that the IP protocol requires packets to be a maximum of 65,535 bytes in size. By sending a packet larger than this size, the attacker can exploit vulnerabilities in the target's TCP/IP stack, causing a buffer overflow and leading to unpredictable behavior, including system crashes. This type of attack is less common nowadays, as most modern systems and networking equipment have been patched to handle such anomalies. --- ## What are LOIC and HOIC? LOIC is a popular network stress testing and DoS attack application that is used to flood a server with TCP, UDP, or HTTP requests with the intention of disrupting the service. It is known for its simplicity and ability to be used by individuals with minimal hacking experience. LOIC can be directed by the user to attack a small server, which can cause the server to slow down or crash from the overload of requests. It became famous around 2010 for its use by the hacker group Anonymous in attacks against major companies and organizations. HOIC is an upgrade from LOIC, designed to overcome some of its limitations, especially in terms of detection and mitigation. It allows users to launch a more powerful DoS attack by enabling attacks on multiple websites at the same time with a higher volume of requests. HOIC also incorporates a feature that makes it more difficult for defense mechanisms to identify and mitigate the attack traffic, partly because it uses a technique that allows the traffic to mimic legitimate HTTP traffic, which is more challenging for traditional network security tools to detect. HOIC supports the use of "booster" scripts that enable it to target various websites simultaneously, significantly increasing its potency as a tool for conducting broad-scale DoS attacks. These tools and attacks exploit different aspects of network protocols and behaviors to overwhelm targets with unwanted traffic, leading to denial of service. Due to their potential for abuse, their use is illegal and unethical outside of controlled environments for testing purposes. --- ## Can I exclude a specific user agent from the HTTP DDoS protection? Yes, you can create an [override](/ddos-protection/managed-rulesets/http/override-expressions/) and use the expression fields to match against HTTP requests with the user agent. There are a variety of [fields](/ddos-protection/managed-rulesets/http/override-expressions/#available-expression-fields) that you can use. You can then adjust the [sensitivity level](/ddos-protection/managed-rulesets/http/override-parameters/#sensitivity-level) or [mitigation action](/ddos-protection/managed-rulesets/http/override-parameters/#action). Refer to the guide on how to [create an override](/ddos-protection/managed-rulesets/http/configure-dashboard/#create-a-ddos-override). The use of expression fields is subject to [availability](#availability). ## Does Cloudflare charge for DDoS attack traffic? No. Since 2017, Cloudflare offers [free, unmetered, and unlimited DDoS protection](https://blog.cloudflare.com/unmetered-mitigation/). There is no limit to the number of DDoS attacks, their duration, or their size. Cloudflare's billing systems automatically exclude DDoS attack traffic from your usage. --- # Cloudflare DDoS Protection URL: https://developers.cloudflare.com/ddos-protection/ import { Description, Feature, FeatureTable, GlossaryTooltip, Plan, RelatedProduct } from "~/components" Detect and mitigate distributed denial-of-service (DDoS) attacks automatically. Cloudflare automatically detects and mitigates distributed denial-of-service (DDoS) attacks via our autonomous DDoS systems. These systems include multiple dynamic mitigation rules exposed as [DDoS attack protection managed rulesets](/ddos-protection/managed-rulesets/). You can customize the mitigation rules included in these rulesets to optimize and tailor the protection to your needs. --- ## Features Protect against a variety of DDoS attacks across layers 3/4 (network layer) and layer 7 (application layer) of the OSI model. Get increased protection against sophisticated DDoS attacks on layer 7 and layers 3/4. Detect and mitigate sophisticated out-of-state TCP attacks such as randomized and spoofed ACK floods, or SYN and SYN-ACK floods. Protect against DNS-based DDoS attacks, specifically sophisticated and fully randomized DNS attacks such as random prefix attacks. --- ## Availability
--- ## Related products Provides security and acceleration for any TCP or UDP based application. A network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Get automatic protection from vulnerabilities and the flexibility to create custom rules. --- # Get started URL: https://developers.cloudflare.com/ddos-protection/get-started/ ## Free, Pro, and Business plans The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit. In some situations, the default protection offered by DDoS rules may need to be fine-tuned to your specific situation. You may also want to configure additional protection using other Cloudflare products. ### Adjust the provided DDoS rules If one or more DDoS rules provided by Cloudflare affects legitimate traffic, you can adjust them so that they do not perform any mitigation action against this kind of traffic. Follow the steps in [Handle a false positive](/ddos-protection/managed-rulesets/adjust-rules/false-positive/) to reduce the sensitivity level of one or more DDoS rules and allow incoming legitimate traffic. ### Configure additional protection To configure additional protection against DDoS attacks, refer to the related Cloudflare products listed in [Network-layer DDoS Attack Protection](/ddos-protection/managed-rulesets/network/#related-cloudflare-products) and [HTTP DDoS Attack Protection](/ddos-protection/managed-rulesets/http/#related-cloudflare-products). ## Enterprise plan Cloudflare's DDoS protection systems automatically detect and mitigate DDoS attacks. Additionally, the systems may flag suspiciously-looking incoming traffic from legacy applications, Internet services, or faulty client applications as malicious and apply mitigation actions. If the traffic is in fact legitimate, the mitigation actions can cause service disruptions and outages in your Internet properties. To prevent this situation, Cloudflare recommends that you perform these steps to get started: 1. Set the ruleset actions for all the [DDoS Attack Protection managed rulesets](/ddos-protection/managed-rulesets/) to _Log_. 2. Analyze the flagged traffic. 3. Adjust the sensitivity or action of individual managed ruleset rules, if required. 4. Switch ruleset actions from _Log_ back to the default. ### Prerequisites You must have one of the following: - [A zone onboarded to Cloudflare](/dns/zone-setups/full-setup/) but without updated DNS records. - [An IP application onboarded to Spectrum](/spectrum/get-started/). - [An IP Prefix onboarded to Magic Transit](/magic-transit/get-started/). ### 1. Configure ruleset actions to Log :::note The _Log_ action is only available to Enterprise customers. ::: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. [Configure all the rules in the HTTP DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/http/configure-dashboard/#create-a-ddos-override), setting their action to _Log_. 3. [Configure all the rules in the Network-layer DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/network/configure-dashboard/#create-a-ddos-override), setting the action to _Log_. Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to `log` by following these instructions: - [Configure an override for the HTTP DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/http/configure-api/#configure-an-override-for-the-http-ddos-attack-protection-managed-ruleset) - [Configure an override for the Network-layer DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/network/configure-api/#configure-an-override-for-the-network-layer-ddos-attack-protection-managed-ruleset) ### 2. Review flagged traffic 1. Go to your [analytics dashboard](/ddos-protection/reference/analytics/) (the exact dashboard depends on your Cloudflare services). 2. Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if _Log_ mode were disabled. Take note of the rule IDs. ### 3. Customize managed ruleset rules Customize the specific managed ruleset rules you identified, changing their sensitivity or their action, using the Cloudflare dashboard or using the API. If you are using the Cloudflare dashboard, refer to: - [Configure HTTP DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/http/configure-dashboard/) - [Configure Network-layer DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/network/configure-dashboard/) If you are using the API, refer to: - [Configure HTTP DDoS Attack Protection via API](/ddos-protection/managed-rulesets/http/configure-api/) - [Configure Network-layer DDoS Attack Protection via API](/ddos-protection/managed-rulesets/network/configure-api/) When using the API, ensure that you add any required rule overrides without removing the ruleset override you configured in [Step 1](#1-configure-ruleset-actions-to-log). ### 4. Switch ruleset actions back to the default Revert the change you did in [Step 1](#1-configure-ruleset-actions-to-log), changing the action of each managed ruleset rule back to _Default_ in **Ruleset action**. Alternatively, if you are using the API, [remove the override](/ddos-protection/managed-rulesets/http/configure-api/#configure-an-override-for-the-http-ddos-attack-protection-managed-ruleset) you previously configured at the ruleset level for each managed ruleset. Ensure that you only remove the ruleset override and not any of the rule overrides you may have configured in [Step 3](#3-customize-managed-ruleset-rules). --- # Enable DMARC Management URL: https://developers.cloudflare.com/dmarc-management/enable/ import { GlossaryTooltip } from "~/components" You need to enable DMARC Management to allow Cloudflare to process DMARC reports on your behalf. DMARC Management only works with apex domains and not domains in [subdomain setups](/dns/zone-setups/subdomain-setup/). :::caution[A warning on DMARC Management and SPF records] DMARC Management does not support actions on SPF records when your zone has a CNAME record that points to a different domain. Changing the SPF record would make DMARC rules invalid, as Cloudflare cannot change other DNS records to reflect your updates. ::: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. Select **Enable DMARC Management**. 4. DMARC Management will scan your zone for DMARC records. 1. If no record is found, Cloudflare will automatically invite you to add one that you can edit later. Select **Add** to continue. 2. If there is a DMARC record in your zone, Cloudflare will add another `rua` entry to it. This additional `rua` tag has a Cloudflare email address and is needed for Cloudflare to be able to start processing DMARC reports on your behalf. Select **Next** to continue. DMARC Management (beta) is now active. However, it may take up to 24 hours to receive your first DMARC report and to display this information in DMARC Management. --- # DNS lookup limit URL: https://developers.cloudflare.com/dmarc-management/dns-lookup-limits/ The [Sender Policy Framework (SPF)](https://datatracker.ietf.org/doc/rfc4408/) specification has a limit on the number of DNS lookups required to fully resolve an SPF record. According to the specification, SPF must limit the number of DNS lookups to 10 per SPF check. If your SPF records exceed this number, your emails might not reach their destination. To check if your SPF records are compliant with the SPF specification: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. In **Email record overview**, select **View records**. 4. Find your SPF record, and select the three dots next to it > **Inspect**. 5. DMARC Management will inspect your records and check for the total number of DNS lookups. If the record exceeds the maximum number of DNS lookups, DMARC Management will warn you about this. You should edit and remove unnecessary records in the DNS page. Refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/#delete-dns-records) for more information on how to delete DNS records. --- # Cloudflare DMARC Management URL: https://developers.cloudflare.com/dmarc-management/ import { Description, Plan, RelatedProduct } from "~/components" Stop brand impersonation. Cloudflare DMARC Management (beta) helps you track every source that is sending emails from your domain and review [Domain-based Message Authentication Reporting and Conformance (DMARC)](https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/) reports for each source. DMARC reports will help you understand if messages sent from your domain are passing DMARC authentication, [DomainKeys Identified Mail (DKIM)](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/) authentication, and [Sender Policy Framework (SPF)](https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/) policies. DMARC Management (beta) is available to all Cloudflare customers with [Cloudflare DNS](/dns/). *** ## Related products Stop phishing attacks with Area 1 cloud-native email security service. Fast, resilient and easy-to-manage DNS service. --- # Overview URL: https://developers.cloudflare.com/docs-guide/ This section provides guidance on creating and leveling up your docs website. It's also still in progress, so check back as we add more resources over time. --- # Statistics and details URL: https://developers.cloudflare.com/dmarc-management/statistics/ DMARC Management (beta) allows you to review how emails sent on your behalf have fared regarding security policies such as DMARC, SFP, and DKIM. 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. The graph shows you the volume of emails during a certain period of time. Select the dropdown to select a period of time up to 30 days. 4. Moving your mouse through the graph gives you details for a particular day. Select **View reports** for a list of DMARC reports by date. 5. Select one of the dates shown to open a window with more details. ## Source details The Top 10 sources section shows you details about the top sources sending emails on your behalf, with information such as total volume of emails and how these sources fared regarding security policies. You also have access to information about all third parties, and can drill down for further details on each of them: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. Select **View all**. 4. The next page shows you a list of all sources sending email on your behalf. You can filter this list by time period. 5. Find a source you want to inspect further, and select the three dots in front of it > **Details** to learn more about that third party. --- # Security records URL: https://developers.cloudflare.com/dmarc-management/security-records/ import { Render } from "~/components" ## Create security records To set up email security records: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. In **Email record overview**, select **View records**. 4. Use the available options to set up SPF, DKIM, and DMARC records. This page will also list any previous records you might already have in your account. ## Edit or delete records Refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/) for more information. --- # Changelog URL: https://developers.cloudflare.com/dns/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # Videos URL: https://developers.cloudflare.com/durable-objects/video-tutorials/ import { CardGrid, LinkCard } from "~/components"; --- # What are Durable Objects? URL: https://developers.cloudflare.com/durable-objects/what-are-durable-objects/ import { Render } from "~/components"; ## Durable Objects highlights Durable Objects have properties that make them a great fit for distributed stateful scalable applications. **Serverless compute, zero infrastructure management** - Durable Objects are built on-top of the Workers runtime, so they support exactly the same code (JavaScript and WASM), and similar memory and CPU limits. - Each Durable Object is [implicitly created on first access](/durable-objects/api/namespace/#get). User applications are not concerned with their lifecycle, creating them or destroying them. Durable Objects migrate among healthy servers, and therefore applications never have to worry about managing them. - Each Durable Object stays alive as long as requests are being processed, and remains alive for several seconds after being idle before hibernating, allowing applications to [exploit in-memory caching](/durable-objects/reference/in-memory-state/) while handling many consecutive requests and boosting their performance. **Storage colocated with compute** - Each Durable Object has its own [durable, transactional, and strongly consistent storage](/durable-objects/api/storage-api/) (up to 10 GB[^1]), persisted across requests, and accessible only within that object. **Single-threaded concurrency** - Each [Durable Object instance has an identifier](/durable-objects/api/id/), either randomly-generated or user-generated, which allows you to globally address which Durable Object should handle a specific action or request. - Durable Objects are single-threaded and cooperatively multi-tasked, just like code running in a web browser. For more details on how safety and correctness are achieved, refer to the blog post ["Durable Objects: Easy, Fast, Correct — Choose three"](https://blog.cloudflare.com/durable-objects-easy-fast-correct-choose-three/). **Elastic horizontal scaling across Cloudflare's global network** - Durable Objects can be spread around the world, and you can [optionally influence where each instance should be located](/durable-objects/reference/data-location/#provide-a-location-hint). Durable Objects are not yet available in every Cloudflare data center; refer to the [where.durableobjects.live](https://where.durableobjects.live/) project for live locations. - Each Durable Object type (or ["Namespace binding"](/durable-objects/api/namespace/) in Cloudflare terms) corresponds to a JavaScript class implementing the actual logic. There is no hard limit on how many Durable Objects can be created for each namespace. - Durable Objects scale elastically as your application creates millions of objects. There is no need for applications to manage infrastructure or plan ahead for capacity. ## Durable Objects features ### In-memory state Each Durable Object has its own [in-memory state](/durable-objects/reference/in-memory-state/). Applications can use this in-memory state to optimize the performance of their applications by keeping important information in-memory, thereby avoiding the need to access the durable storage at all. Useful cases for in-memory state include batching and aggregating information before persisting it to storage, or for immediately rejecting/handling incoming requests meeting certain criteria, and more. In-memory state is reset when the Durable Object hibernates after being idle for some time. Therefore, it is important to persist any in-memory data to the durable storage if that data will be needed at a later time when the Durable Object receives another request. ### Storage API The [Durable Object Storage API](/durable-objects/api/storage-api/) allows Durable Objects to access fast, transactional, and strongly consistent storage. A Durable Object's attached storage is private to its unique instance and cannot be accessed by other objects. There are two flavors of the storage API, a [key-value (KV) API](/durable-objects/api/storage-api/#kv-api) and an [SQL API](/durable-objects/api/storage-api/#sql-api). When using the [new SQLite in Durable Objects storage backend](/durable-objects/reference/durable-objects-migrations/#enable-sqlite-storage-backend-on-new-durable-object-class-migration), you have access to both the APIs. However, if you use the previous storage backend you only have access to the key-value API. ### Alarms API Durable Objects provide an [Alarms API](/durable-objects/api/alarms/) which allows you to schedule the Durable Object to be woken up at a time in the future. This is useful when you want to do certain work periodically, or at some specific point in time, without having to manually manage infrastructure such as job scheduling runners on your own. You can combine Alarms with in-memory state and the durable storage API to build batch and aggregation applications such as queues, workflows, or advanced data pipelines. ### WebSockets WebSockets are long-lived TCP connections that enable bi-directional, real-time communication between client and server. Because WebSocket sessions are long-lived, applications commonly use Durable Objects to accept either the client or server connection. Because Durable Objects provide a single-point-of-coordination between Cloudflare Workers, a single Durable Object instance can be used in parallel with WebSockets to coordinate between multiple clients, such as participants in a chat room or a multiplayer game. Durable Objects support the [WebSocket Standard API](/durable-objects/best-practices/websockets/#websocket-standard-api), as well as the [WebSockets Hibernation API](/durable-objects/best-practices/websockets/#websocket-hibernation-api) which extends the Web Standard WebSocket API to reduce costs by not incurring billing charges during periods of inactivity. ### RPC Durable Objects support Workers [Remote-Procedure-Call (RPC)](/workers/runtime-apis/rpc/) which allows applications to use JavaScript-native methods and objects to communicate between Workers and Durable Objects. Using RPC for communication makes application development easier and simpler to reason about, and more efficient. ## Actor programming model Another way to describe and think about Durable Objects is through the lens of the [Actor programming model](https://en.wikipedia.org/wiki/Actor_model). There are several popular examples of the Actor model supported at the programming language level through runtimes or library frameworks, like [Erlang](https://www.erlang.org/), [Elixir](https://elixir-lang.org/), [Akka](https://akka.io/), or [Microsoft Orleans for .NET](https://learn.microsoft.com/en-us/dotnet/orleans/overview). The Actor model simplifies a lot of problems in distributed systems by abstracting away the communication between actors using RPC calls (or message sending) that could be implemented on-top of any transport protocol, and it avoids most of the concurrency pitfalls you get when doing concurrency through shared memory such as race conditions when multiple processes/threads access the same data in-memory. Each Durable Object instance can be seen as an Actor instance, receiving messages (incoming HTTP/RPC requests), executing some logic in its own single-threaded context using its attached durable storage or in-memory state, and finally sending messages to the outside world (outgoing HTTP/RPC requests or responses), even to another Durable Object instance. Each Durable Object has certain capabilities in terms of [how much work it can do](/durable-objects/platform/limits/#how-much-work-can-a-single-durable-object-do), which should influence the application's [architecture to fully take advantage of the platform](/reference-architecture/diagrams/storage/durable-object-control-data-plane-pattern/). Durable Objects are natively integrated into Cloudflare's infrastructure, giving you the ultimate serverless platform to build distributed stateful applications exploiting the entirety of Cloudflare's network. ## Durable Objects in Cloudflare Many of Cloudflare's products use Durable Objects. Some of our technical blog posts showcase real-world applications and use-cases where Durable Objects make building applications easier and simpler. These blog posts may also serve as inspiration on how to architect scalable applications using Durable Objects, and how to integrate them with the rest of Cloudflare Developer Platform. - [Durable Objects aren't just durable, they're fast: a 10x speedup for Cloudflare Queues](https://blog.cloudflare.com/how-we-built-cloudflare-queues/) - [Behind the scenes with Stream Live, Cloudflare's live streaming service](https://blog.cloudflare.com/behind-the-scenes-with-stream-live-cloudflares-live-streaming-service/) - [DO it again: how we used Durable Objects to add WebSockets support and authentication to AI Gateway](https://blog.cloudflare.com/do-it-again/) - [Workers Builds: integrated CI/CD built on the Workers platform](https://blog.cloudflare.com/workers-builds-integrated-ci-cd-built-on-the-workers-platform/) - [Build durable applications on Cloudflare Workers: you write the Workflows, we take care of the rest](https://blog.cloudflare.com/building-workflows-durable-execution-on-workers/) - [Building D1: a Global Database](https://blog.cloudflare.com/building-d1-a-global-database/) - [Billions and billions (of logs): scaling AI Gateway with the Cloudflare Developer Platform](https://blog.cloudflare.com/billions-and-billions-of-logs-scaling-ai-gateway-with-the-cloudflare/) - [Indexing millions of HTTP requests using Durable Objects](https://blog.cloudflare.com/r2-rayid-retrieval/) Finally, the following blog posts may help you learn some of the technical implementation aspects of Durable Objects, and how they work. - [Durable Objects: Easy, Fast, Correct — Choose three](https://blog.cloudflare.com/durable-objects-easy-fast-correct-choose-three/) - [Zero-latency SQLite storage in every Durable Object](https://blog.cloudflare.com/sqlite-in-durable-objects/) - [Workers Durable Objects Beta: A New Approach to Stateful Serverless](https://blog.cloudflare.com/introducing-workers-durable-objects/) ## Get started Get started now by following the ["Get started" guide](/durable-objects/get-started/) to create your first application using Durable Objects. [^1]: Storage per Durable Object with SQLite is currently 1 GB. This will be raised to 10 GB for general availability. --- # Cloudflare Firewall Rules URL: https://developers.cloudflare.com/firewall/ import { FeatureTable, Render } from "~/components"; Cloudflare Firewall Rules allows you to create rules that inspect incoming traffic and block, challenge, log, or allow specific requests. ## Main features - **Rule-based protection**: Use pre-defined rulesets provided by Cloudflare, or define your own firewall rules. Create rules in the Cloudflare dashboard or via API. - **Complex custom rules**: Each rule's expression can reference multiple fields from all the available HTTP request parameters and fields, allowing you to create complex rules. ## Availability This table outlines the Firewall Rules features and entitlements available with each customer plan: ## Next steps - Unless you are already an advanced user, refer to [Expressions](/ruleset-engine/rules-language/expressions/) and [Actions](/firewall/cf-firewall-rules/actions/) to learn more about the basic elements of firewall rules. - To start building your own firewall rules, refer to one of the following pages: - [Manage firewall rules in the dashboard](/firewall/cf-dashboard/create-edit-delete-rules/) - [Manage firewall rules via the APIs](/firewall/api/) - You can also manage firewall rules through Terraform. For more information, refer to [Getting Started with Terraform](https://blog.cloudflare.com/getting-started-with-terraform-and-cloudflare-part-1/). ## Related resources - [Cloudflare Rules language](/ruleset-engine/rules-language/) --- # Changelog URL: https://developers.cloudflare.com/fundamentals/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-11-21 **Import cloud resources for VMs and LBs** Cloud network discovery now includes cloud native virtual machine (VM) and load-balancer (LB) resources. ## 2024-11-21 **Export resource catalog** Customers can export their resource catalog including all discovered resource metadata to a downloadable JSON file, suitable for offline analysis. ## 2024-10-01 **Cost visibility for managed cloud configuration** Customers can now see the cloud provider list price of discovered network resources and will be informed of total cost and delta cost when deploying managed configuration. ## 2024-08-14 **GCP on-ramps** Magic Cloud Networking supports Google Cloud Platform. ## 2024-07-01 **Closed beta launch** The Magic Cloud Networking closed beta release is available, with the managed cloud on-ramps feature. --- # Get started URL: https://developers.cloudflare.com/magic-cloud-networking/get-started/ To get started with Magic Cloud Networking (beta) you need to give Cloudflare permission to interact with cloud providers on your behalf. You might have multiple provider accounts for the same cloud provider — for example, you might want Cloudflare to manage virtual private clouds (VPCs) belonging to two different AWS accounts. Once Cloudflare has the credentials required to access your cloud environments, Magic Cloud Networking will automatically begin discovering your cloud resources — like routing tables and virtual private networks. Discovered resources appear in your [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog). ## Set up Amazon AWS ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **AWS integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Amazon AWS. ### 2. Create IAM policy 1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered. Then, paste the following [JSON code](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html) in the JSON tab: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayPeeringAttachment", "ec2:CreateTransitGatewayPeeringAttachment", "ec2:DeleteTransitGatewayPeeringAttachment", "ec2:DescribeRegions", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:RejectTransitGatewayPeeringAttachment", "ec2:GetManagedPrefixListEntries", "ec2:CreateManagedPrefixList", "ec2:ModifyManagedPrefixList", "ec2:DeleteManagedPrefixList", "ec2:CreateTransitGatewayPrefixListReference", "ec2:DeleteTransitGatewayPrefixListReference", "ec2:GetTransitGatewayPrefixListReferences", "ec2:ModifyTransitGatewayPrefixListReference" ], "Resource": "*" } ] } ``` ### 3. Authorize access to your AWS account 1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered. 2. Create an [AWS role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html) with the following settings: - **Trusted entity type**: Select **Custom trust policy**, and paste the custom trust policy returned by the Cloudflare dashboard. - **Permissions**: Add the IAM policy created in step 1, along with these AWS-managed policies: - `NetworkAdministrator` - `AmazonEC2ReadOnlyAccess` - `AmazonVPCReadOnlyAccess` - `IAMReadOnlyAccess` - **ARN**: Copy the ARN for your newly created user. :::note The trust policy may take several minutes to propagate to all regions. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect. ::: 3. Select **I authorize Cloudflare to access my AWS account.** 4. Select **Authorize**. The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Set up Microsoft Azure ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **Azure integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Microsoft Azure. ### 2. Authorize access to your Azure account :::caution Magic Cloud does not support personal Microsoft accounts. Please sign in using a work or school account that is part of an Azure Entra Tenant. ::: 1. Select **Create service principal**. You will be redirected to Microsoft's login page. 2. Enter your Azure credentials. If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 3. The next screen lists Cloudflare required permissions to access your account. Select **Accept**. 4. [Add a role assignment](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal). The purpose of this step is to give the app that you registered in step 1 permission to access your Azure Subscription. - In step 3 of the linked document, select the **Contributor** role from the **Privileged administrator roles** tab. - In step 4 of the linked document, search for `mcn-provider-integrations-bot-prod` when selecting members. 5. In **Provide account information**, enter the **Tenant ID** and **Subscription ID** you copied from step 4. 6. In **Verify account ownership**, [add the tags displayed in the Cloudflare dashboard](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources-portal). :::note The tags may take several minutes to propagate and become readable to Cloudflare. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect. ::: 7. Select **I authorize Cloudflare to access my AWS account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 8. Select **Authorize**. The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Set up Google Cloud ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **Google integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Google Cloud. ### 2. Authorize access to your Google account 1. Create a new [GCP service account](https://cloud.google.com/iam/docs/service-accounts-create) in your **Google account** > **GCP Console** > **IAM & Admin** > **Service Accounts**. 2. Grant the new service account these roles: - `Compute Network Admin` - `Compute Viewer` 3. Under **IAM & Admin** > **Service Accounts**, select the service account you just created, and navigate to the **Permissions** tab. 4. Grant the **Service Account Token Creator** role to our bot account to allow it to impersonate this service account. Learn how to grant a specific role [in Google's documentation](https://cloud.google.com/iam/docs/manage-access-service-accounts#grant-single-role): - `mcn-integrations-bot-prod@mcn-gcp-01.iam.gserviceaccount.com` 5. In the **service account email field**, enter the email account that you used to create the GCP service account. 6. In the **Project ID field**, enter the [project ID](https://support.google.com/googleapi/answer/7014113?hl=en) associated with your project. 7. [Add the label](https://cloud.google.com/resource-manager/docs/creating-managing-labels#create-labels) displayed on the dash to your project. 8. Select **I authorize Cloudflare to access my GCP account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 9. Select **Authorize**. You have successfully connected your cloud provider to Magic Cloud Networking. Cloud resources found by Magic Cloud Networking are available in the [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog). The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Next steps - [Set up Magic WAN](/magic-cloud-networking/cloud-on-ramps/) as an on-ramp to your cloud. - [Manage resources](/magic-cloud-networking/manage-resources/) found by Magic Cloud Networking. - [Edit](/magic-cloud-networking/manage-resources/#edit-cloud-integrations) cloud integrations. --- # Magic Cloud Networking (beta) URL: https://developers.cloudflare.com/magic-cloud-networking/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Automate resource discovery, and reduce management burden when connecting to your public cloud. Magic Cloud Networking (beta) simplifies the process of connecting to your public cloud infrastructure, like Amazon Web Services, Google Cloud Platform, or Azure. With Magic Cloud Networking you can automatically discover your cloud resources through Cloudflare's dashboard, and effortlessly combine your cloud networks with your office and data center networks. Magic Cloud Networking allows you to connect, accelerate, and manage your virtual private clouds securely through Cloudflare. Grow your multi-cloud network architecture in a consistent and scalable manner, centered on Cloudflare's connectivity cloud services. Magic Cloud Networking is currently in closed beta. If you would like to be among the first customers to try it out, [fill out this form](https://www.cloudflare.com/lp/cloud-networking/). Learn how to [get started](/magic-cloud-networking/get-started/). --- ## Features Discover your cloud resources like virtual private clouds (VPCs), subnets, virtual machines (VMs), route tables, and routes automatically, and easily set up your integrations. Automatically build VPN tunnels between cloud networks and Magic WAN. --- ## Related products Secure your network from incoming Internet traffic, and improve performance at Cloudflare scale. --- # Manage resources URL: https://developers.cloudflare.com/magic-cloud-networking/manage-resources/ ## Cloud resource catalog Your cloud environment is built from individual cloud resources, like virtual private clouds (VPCs), subnets, virtual machines (VMs), route tables, and routes. Magic Cloud Networking (beta) discovers all of your cloud resources and stores their configuration and status in the Cloud resource catalog, a read-only snapshot of your cloud environment. Discovery runs regularly in the background, keeping your catalog up to date as your environment changes. When Magic Cloud Networking creates or modifies configurations in the cloud provider - for example, to deploy a managed IPsec on-ramp for Magic WAN - the created resources will be labeled as **Managed** in the resource catalog. To browse the resources in your catalog: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Resource catalog**. 4. Select a resource to inspect its details. ## Edit Cloud integrations 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Select the integration you want to edit > **Edit**. 4. In **Credentials**, select **I would like to update my credentials**, and make the required changes to your credentials. 5. Select **Save** when you are finished. 6. (Optional) You can also select **Delete** to delete your cloud integration. ## Download cloud resource catalog You can download a JSON file containing metadata and configuration for all your cloud resources: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Resource catalog**. 4. Select **Download catalog**. After your browser finishes downloading the ZIP file, expand it to access the JSON with the information about your cloud resources. --- # Reference URL: https://developers.cloudflare.com/magic-cloud-networking/reference/ Refer to this page for details about how Cloudflare orchestrates VPN connectivity to your cloud networks. ## Cloud on-ramps ### AWS ![Diagram showing how Cloudflare creates on-ramps to AWS](~/assets/images/magic-cloud-networking/reference/aws.png) When using Magic Cloud Networking (beta) to automatically create on-ramps to your AWS account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will create a new customer-managed prefix list named **Magic WAN and Cloudflare Edge** populated with your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) prefixes and the IPv4 address ranges for Cloudflare's global network servers (the latter prefixes are necessary if you use any Cloudflare L7 processing features). You must create rules in your Network Security Groups (NSGs) allowing traffic to/from this prefix list in order to have connectivity with Magic WAN. (The prefix list will contain around 15 to 25 entries, which each count against the rules-per-security-group quota for NSGs in your AWS account.) - Cloudflare will create a Virtual Private Gateway and attach it to your Virtual Private Cloud (VPC). If an existing Virtual Private Gateway is already attached to the VPC, on-ramp creation will fail. - Cloudflare will enable route propagation from the Virtual Private Gateway into all route tables in your VPC. This will result in a route for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) targeting the gateway. - Cloudflare will add a route in Magic WAN for each IPv4 CIDR block in your VPC. ### Azure ![Diagram showing how Cloudflare creates on-ramps to AWS](~/assets/images/magic-cloud-networking/reference/azure.png) When using Magic Cloud Networking to automatically create on-ramps to your Azure account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will create a Virtual Network Gateway in your Virtual Network (VNet). Virtual Network Gateways in Azure require a subnet named `GatewaySubnet`. Cloudflare will create a `GatewaySubnet` if one does not already exist in your VNet. If there is not enough unused address space left in your VNet to create a `/27` subnet for the`GatewaySubnet`, or if a `GatewaySubnet` exists but does not have enough address space left for a Virtual Network Gateway, on-ramp creation will fail. - Cloudflare will enable gateway route propagation on all route tables in your VNet. This will result in a route for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) pointing to the gateway. If your VNet has other Virtual Network Gateways, their routes will also propagate to your route tables. If you delete the on-ramp, route propagation will not be disabled. - By default, Network Security Groups in Azure contain Allow rules for outbound/inbound traffic to/from the `VirtualNetwork` service tag, which includes Virtual Network Gateway address space (and therefore your Magic WAN Address Space). If you do not want all resources in your VNet to be accessible from Magic WAN, add the appropriate Deny rules to your Network Security Groups (NSGs). - Cloudflare will add a route in Magic WAN for each IPv4 address range in your VNet. ### GCP ![Diagram showing how Cloudflare creates on-ramps to GCP](~/assets/images/magic-cloud-networking/reference/gcp.png) When using Magic Cloud Networking to automatically create on-ramps to your Google Cloud Platform (GCP) account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will reserve a public Internet routable IP address from GCP. - Cloudflare will create a VPN Gateway and two VPN Tunnels in the region you specify. - Cloudflare will create routes for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) within your VPC pointing to the VPN Tunnels. - Cloudflare will add routes in Magic WAN for all subnet CIDR prefixes in your VPC. This includes all regions within the VPC. Traffic bound for a region other than the VPN Gateway's region will be subject to GCP's [Inter-region Pricing](https://cloud.google.com/vpc/network-pricing#inter-region-data-transfer). - Traffic sent to and from your VM instances through the VPN Tunnels is still subject to VPC firewall rules, and may [require further configuration](https://cloud.google.com/network-connectivity/docs/vpn/how-to/configuring-firewall-rules#firewall_rules). ## Supported resources Magic Cloud Networking discovers the following resource types. ### AWS - AWS Customer Gateway - AWS EC2 Managed Prefix List - AWS EC2 Transit Gateway - AWS EC2 Transit Gateway Prefix List - AWS EC2 Transit Gateway VPC Attachment - AWS Egress Only Internet Gateway - AWS Internet Gateway - AWS Instance - AWS Network Interface - AWS Route Table - AWS Route Table Association - AWS Security Group - AWS Subnet - AWS VPC - AWS VPC IPv4 CIDR Block Association - AWS VPC Security Group Egress Rule - AWS VPC Security Group Ingress Rule - AWS VPN Connection - AWS VPN Connection Route - AWS VPN Gateway ### Azure - Azure Application Security Group - Azure Load Balancer - Azure Load Balancer Backend Address Pool - Azure Load Balancer NAT Pool - Azure Load Balancer NAT Rule - Azure Load Balancer Rule - Azure Local Network Gateway - Azure Network Interface - Azure Network Interface Application Security Group Association - Azure Network Interface Backend Address Pool Association - Azure Network Interface Security Group Association - Azure Network Security Group - Azure Public IP - Azure Route - Azure Route Table - Azure Subnet - Azure Subnet Route Table Association - Azure Virtual Machine - Azure Virtual Machine Gateway Connection - Azure Virtual Network - Azure Virtual Network Gateway - Azure Virtual Network Gateway Connection ### GCP - Google Compute Address - Google Compute Forwarding Rule - Google Compute Global Address - Google Compute HA VPN Gateway - Google Compute Interconnect Attachment - Google Compute Network - Google Compute Network Firewall Policy - Google Compute Network Firewall Policy Rule - Google Compute Route - Google Compute Router - Google Compute Subnetwork - Google Compute VPN Gateway - Google Compute VPN Tunnel --- # Cloudflare Magic Firewall URL: https://developers.cloudflare.com/magic-firewall/ import { Description, Feature, GlossaryTooltip, Plan, RelatedProduct } from "~/components" Protect your cloud infrastructure or network offices with advanced, scalable firewall-as-a-service protection. Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, scalable protection. With Magic Firewall, you can apply filter rules on a variety of criteria, such as protocol and packet length, to filter unwanted traffic before it reaches your network. Magic Firewall uses Wireshark syntax, a domain-specific language (DSL) common in the networking world and the same syntax used across our other products. With this syntax, you can easily craft powerful rules to precisely allow or deny any traffic in or out of your network. Magic Firewall is available with the purchase of [Magic Transit](/magic-transit/) or [Magic WAN](/magic-wan/). *** ## Features Actively monitor for a wide range of known threat signatures in your traffic. *** ## Related products Secure your network from incoming Internet traffic, and improve performance at Cloudflare scale. Improve security and performance for your entire corporate networking, reducing cost and operation complexity. --- # Changelog URL: https://developers.cloudflare.com/magic-firewall/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-09-12 **New UI improvements** The dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page. ## 2024-08-16 **Magic Firewall Analytics Rule Log Enhancement** Customers who create a rule in a disabled mode will see the rule as **Log (rule disabled)**. --- # Plans URL: https://developers.cloudflare.com/magic-firewall/plans/ import { GlossaryTooltip } from "~/components" If you are a [Magic Transit](/magic-transit/) or [Magic WAN](/magic-wan/) user, you are automatically provided with a standard list of Magic Firewall features. For additional features available for purchase, refer to the list of advanced features below. ## Standard features * Filtering rules based on protocol, port, IP addresses, packet length, and bit field match. * Fast propagation of rule changes in less than a minute. * Single dashboard to manage firewall and network configuration. * Programmable API for automated deployment and management — compatible with infrastructure-as-code platforms like [Terraform](/terraform/). * Traffic analytics per rule in the dashboard and using the [GraphQL API](/analytics/graphql-api/). * Integration with [Magic WAN network-as-a-service](/magic-wan/). * Included DDoS protection with [Magic Transit](/magic-transit/). ## Advanced features All standard features are included with the purchase of the advanced features below: * Customizable IP lists. * Managed threat intelligence IP lists (Anonymizer, Botnet, Malware, Open Proxies, VPNs). * Geoblocking based on user location by country. * Block or allow packets based on Autonomous System Number (ASN). * Packet captures on demand for network troubleshooting. * [Protocol validation rules](/magic-firewall/about/protocol-validation-rules/) to inspect traffic validity and enforce a positive security model. * [Secure Web Gateway](/cloudflare-one/policies/gateway/) filtering for outbound Internet traffic (network and HTTP policies). The Secure Web Gateway supports all TCP and UDP ports, as well as traffic sourced from RFC. Gateway will proxy BYOIP traffic to egress via the default Cloudflare IPs or your assigned [dedicated egress IPs](/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips/). * Intrusion Detection System (IDS). --- # API URL: https://developers.cloudflare.com/magic-network-monitoring/api/ Use Magic Network Monitoring's API to configure your [account](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) and [rules](/api/resources/magic_network_monitoring/subresources/rules/methods/list/). ## Account configuration Refer to [account configuration](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) to: - Create, list, update, and delete Magic Network Monitoring configurations - List default sampling, router IPs, and rules for an account ## Rules configuration Refer to [rules configuration](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) to: - Create, list, update, and delete rules - Update advertisement for a rule --- # Changelog URL: https://developers.cloudflare.com/magic-network-monitoring/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # Cloud flow logs (beta) URL: https://developers.cloudflare.com/magic-network-monitoring/cloud-flow-logs/ Customers using Magic Network Monitoring can export virtual private cloud (VPC) flow logs from their cloud environment to Cloudflare's network. Cloudflare will then process these VPC flow logs and display analytics on your cloud traffic in the dashboard. Customers can also ingest data on their cloud traffic via our public GraphQL API which powers the cloud traffic analytics in the dashboard. Currently, Magic Network Monitoring only supports AWS VPC flow logs via AWS Firehose. AWS VPC flow logs can only be configured via Cloudflare's API for Magic Network Monitoring. To learn how to set up this feature, refer to [VPC flow log guide (beta)](/magic-network-monitoring/get-started/#vpc-flow-log-guide). --- # FAQ URL: https://developers.cloudflare.com/magic-network-monitoring/faq/ Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. ## I am getting an "Invalid account settings request body: account name format contains illegal characters or is not supported" error when trying to create a rule. This probably means that your account name has unsupported characters. Make sure your account name does not have characters like, for example, `&`, `<`, `>`, `"`, `'`, ``` ` ```. Refer to [Account name](/fundamentals/setup/account/customize-account/account-name/) to learn how to change your account name. ## Can I send NetFlow/sFlow data to Cloudflare in a secure, encrypted way? Yes. Both enterprise and free customers can send encrypted network flow data to Cloudflare. Enterprise customers with Magic Transit or Magic WAN are able to send encrypted network flow data via an IPsec tunnel to Cloudflare's network. You can achieve this by: 1. Configuring your [NetFlow](/magic-network-monitoring/routers/netflow-ipfix-config/) or [sFlow](/magic-network-monitoring/routers/sflow-config/) data to be sent to Cloudflare's network for parsing. 2. Directing that network flow data to be sent over [Magic Transit IPsec tunnels](/magic-transit/how-to/configure-tunnels/) or [Magic WAN IPsec tunnels](/magic-wan/configuration/manually/how-to/configure-tunnels/) to Cloudflare's network. Cloudflare's network will then identify this traffic via the destination IP address/port, and direct the network flow traffic to Magic Network Monitoring for parsing. Free customers can route their network flow traffic through a device that is running the WARP client. Then, network flow traffic can be forwarded from the WARP enabled device to Cloudflare's network flow endpoints. You can learn more about this in the [Encrypt network flow data tutorial](/magic-network-monitoring/tutorials/encrypt-network-flow-data). ## I have Auto-Advertisement enabled and it was triggered by an attack. Do I have to turn Magic Transit off manually? Once Auto-Advertisement is activated for an IP prefix that is under attack, the IP prefix will continue to be advertised by Cloudflare even if the attack ends. You will then need to manually disable advertisement for that IP prefix. Refer to [Configure dynamic advertisement](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement) to learn how to withdraw your prefixes, and stop using Magic Transit. ## If Auto-Advertisement is enabled, and the threshold has been triggered, will the IP prefix show as advertised in the dashboard? Yes, the IP prefix will show as advertised under the [IP Prefixes tab](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement). ## Does Auto-advertisement also work with BGP-controlled advertisements? No. Auto-advertisement only works with API-controlled advertisement, not BGP-controlled advertisement. ## In the API, Magic Network Monitoring rules have a `bandwidth_threshold` data field. Does the value for this field refer to bytes transferred or current throughput? The threshold for a [Magic Network Monitoring (MNM) rule](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) has two values. The first value is `bandwidth_threshold`. This value is a measure of the total ingress throughput on a network at any given moment. The second value is `duration`. The `duration`value refers to the amount of time that `bandwidth_threshold` must be exceeded before an alert is sent to the customer. For example, you create a MNM rule with the following parameters: ```txt "bandwidth_threshold": 50000000 "duration": "1m0s" ``` With this rule, your network needs to receive a throughput greater than 50,000,000 bits per second (50 Gigabits per second or Gbps) for 60 seconds. If both of these conditions are met, then MNM will send you an alert. ## My router's public IP address is different from the IP address of my network flow `agent-ip`. I cannot change my network flow `agent-ip`, and I am not seeing my router's traffic in MNM analytics It is recommended that you set your router's public IP address and network flow `agent-ip` to the same value. However, if you are unable to do this, you can register both your router's public IP and your network flow `agent-ip` in the Magic Network Monitoring (MNM) [router configuration](/magic-network-monitoring/get-started/). This will prevent MNM from blocking network traffic received from any unknown IP addresses, and will show your router's network flow data underneath the router's `agent-ip`. ## What is Magic Network Monitoring's data retention policy for Netflow/sFlow received from customer's routers? Currently, all data received from a customer's router goes to our servers in the US. If you enable data sovereignty in Europe, you cannot currently use Magic Network Monitoring. GraphQL analytics is retained for 90 days for enterprise customers. For non-enterprise customers, data retention is seven days. Cloudflare also retains data for six hours in the US, for threshold crossing detection. --- # Get started URL: https://developers.cloudflare.com/magic-network-monitoring/get-started/ import { APIRequest, Badge, GlossaryTooltip } from "~/components"; Magic Network Monitoring includes an onboarding workflow that guides you step-by-step through the product configuration process. If you are unable to complete the configuration in one session, you can exit the workflow and resume it at any time. To begin using Magic Network Monitoring for network and/or cloud traffic visibility, complete the list of tasks below. - [NetFlow and sFlow guide](#netflow-and-sflow-guide) - [VPC flow log guide (beta)](#vpc-flow-log-guide) If you are an Enterprise customer, Cloudflare can significantly accelerate the onboarding timeline during active-attack scenarios. Enterprise customers that would like to use Magic Network Monitoring and Magic Transit On Demand together can begin by [configuring Magic Transit](/magic-transit/get-started/). ## NetFlow and sFlow guide ### 1. Verify NetFlow or sFlow capabilities Verify your routers are capable of exporting NetFlow or sFlow to an IP address on Cloudflare's network. Magic Network Monitoring supports NetFlow v5, NetFlow v9, IPFIX, and sFlow. Refer to [Supported routers](/magic-network-monitoring/routers/supported-routers) to view a list of supported routers. The list is not exhaustive. ### 2. Register your router with Cloudflare When you register your router with Cloudflare, your router links your NetFlow or sFlow data to your Cloudflare account. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. 3. In **Magic Network Monitoring Analytics**, select **Configure Magic Network Monitoring**. 4. Select the **Configure routers** tab. 5. (Optional) Under **IP Address**, enter your router's public IP address. 6. Under **Default router sampling rate**, enter a value for the sampling rate. The value should match the sampling rate of your NetFlow or sFlow configuration. 7. Select **Next**. ### 3. Configure your router Next, configure your router to send NetFlow/SFlow data to Cloudflare. For this step, you will also need to have your router's configuration menu open to input the values shown in the Cloudflare dashboard. Refer to the [NetFlow/IPFIX configuration](/magic-network-monitoring/routers/netflow-ipfix-config/) or the [sFlow configuration guide](/magic-network-monitoring/routers/sflow-config/) for more information. 1. From **Configure routers** in the dashboard, select either **NetFlow Configuration** or **sFlow configuration**. 2. Follow the configuration steps for the selected configuration type. 3. Enter the values shown in your router's configuration. 4. Select **Next**. ### 4. Check your router configuration After setting up your router, confirm the configuration was successfully set up. From the **Check routers** page on the dashboard, you can view the status of your routers. Keep in mind that router data takes five to ten minutes to be sent to Cloudflare. Refer to **Router status description** to confirm whether data is successfully being sent. When you are done with router configuration, select **Finish onboarding**. :::note This will only be visible during the onboarding process. When you are finished onboarding, this page will no longer be visible. ::: ### 5. Create rules Create rules to analyze data for a specific set of destinations or to implement thresholds. Refer to [Rules](/magic-network-monitoring/rules/) for more information. ## VPC flow log guide ### 1. Verify cloud flow log capabilities Verify that your AWS account is capable of exporting AWS VPC flow logs via AWS Firehose. Currently, Magic Network Monitoring only supports VPC flow log ingestion for AWS. ### 2. Set up AWS Firehose to export VPC flow logs to Cloudflare :::note AWS VPC flow logs can only be configured via the Cloudflare API for Magic Network Monitoring. There are no inputs in the dashboard for configuring AWS VPC flow logs. ::: 1. Create an authorization token via [Cloudflare's API for Magic Network Monitoring](/api/resources/magic_network_monitoring/subresources/vpc_flows/subresources/tokens/methods/create/). This authorization token allows Cloudflare to identify and verify the account sending VPC flow logs to our endpoint. 2. Set the `HTTP Headers - X-Amz-Firehose-Access-Key` in the stream configuration for the authorization token generated in the previous step. 3. Send your AWS Firehose VPC flow log stream towards `https://aws-flow-logs.cloudflare.com/`. 4. Select all of the AWS VPC flow log data fields that you want to send to Cloudflare. You should select the highest number AWS VPC flow log version that supports all the fields you want to export to Cloudflare (refer to [AWS flow log documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html) for more information). For example, if you need a version 8 field like `reject-reason`, you must export all fields from versions 1 through 8. Cloudflare supports all seven templates for AWS VPC Flow logs. ### 3. Verify your cloud traffic via analytics After setting up AWS Firehose to send VPC flow logs to Magic Network Monitoring, you can confirm that Cloudflare is receiving the logs as expected by searching for your cloud traffic data in the analytics page of the Magic Network Monitoring dashboard. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. The default view will be the analytics dashboard for Magic Network Monitoring. --- # Glossary URL: https://developers.cloudflare.com/magic-network-monitoring/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic Network Monitoring documentation. --- # Cloudflare Magic Network Monitoring URL: https://developers.cloudflare.com/magic-network-monitoring/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Improve your network and cloud traffic visibility. Customers with public IPs can also detect DDoS attacks based on their traffic flows. Magic Network Monitoring provides visibility into your network traffic and cloud traffic by analyzing network flow data sent from a customer's routers or cloud environment. Magic Network Monitoring supports NetFlow v5, NetFlow v9, IPFIX, and sFlow. In cloud environments, Magic Network Monitoring supports AWS VPC flow logs via AWS Firehose. Magic Network Monitoring is generally available to everyone with a Cloudflare account by default. You can log in to your Cloudflare dashboard, select your account, then go to **Analytics & Logs** > **Magic Monitoring** to get started. Everyone can use the [free version](/magic-network-monitoring/magic-network-monitoring-free/) of Magic Network Monitoring in a home network, network lab, or business to get end to end visibility across their network traffic. Potential enterprise customers are encouraged to use the free version to run a proof of concept. Enterprise customers can use Magic Network Monitoring with [Magic Transit on-demand](/magic-transit/on-demand/) to monitor their network, identify volumetric DDoS attacks, and activate Magic Transit on-demand to mitigate those attacks. Learn how to [get started](/magic-network-monitoring/get-started/). --- ## Features Create rules to configure the threshold for data flowing from your network. Magic Transit On Demand customers can use Magic Network Monitoring to enable DDoS mitigation when a DDoS attack is detected. Set up notifications to learn about an attack. --- ## Related products Mitigates L7, L4, and L3 DDoS attacks with Magic Network Monitoring with Magic Transit on-demand. Provides HTTP DDoS attack protection for zones onboarded to Cloudflare in addition to L3 and L4 DDoS attack protection. Connects your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. ## More resources Connect with the Magic Network Monitoring community on Discord to ask questions, and share feedback. --- # Free version URL: https://developers.cloudflare.com/magic-network-monitoring/magic-network-monitoring-free/ The free version of Magic Network Monitoring (MNM) is generally available to everyone with a Cloudflare account by default. All free customers are encouraged to join [Cloudflare's Discord server](https://discord.com/invite/cloudflaredev) to discuss the use cases, configuration, and troubleshooting of Magic Network Monitoring. Free customers are always welcome to provide product feedback and discuss feature requests. The product and engineering team that works on Magic Network Monitoring regularly engages with the Discord community. You can find the channel by joining the Cloudflare Developers Discord server. Then scroll down in the side bar navigation to the **Cloudflare One** category and select **magic-network-monitoring**. ## Access the free version of MNM The free version includes all the features of the enterprise version, but has network flow volume and configuration limitations. These limits are detailed below. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. 3. Complete the onboarding wizard to configure Magic Network Monitoring. Refer to [Get started](/magic-network-monitoring/get-started/) for more information. ## Limitations | Limitation Type | Value | | ------------------------------------ | ----- | | Number of registered routers | 10 | | Number of rules | 25 | | Network flows per second per account | 250 | --- # Magic Transit integration URL: https://developers.cloudflare.com/magic-network-monitoring/magic-transit-integration/ import { Render } from "~/components" --- # About URL: https://developers.cloudflare.com/magic-transit/about/ import { GlossaryTooltip } from "~/components" Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Magic Transit delivers its connectivity, security, and performance benefits by serving as the front door to your IP network. This means it accepts IP packets destined for your network, processes them, and then outputs them to your origin infrastructure. The Cloudflare network uses [Border Gateway Protocol (BGP)](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/) to announce your company's IP address space, extending your network presence globally, and anycast to ingest your traffic. Today, Cloudflare's anycast global network spans [hundreds of cities worldwide](https://www.cloudflare.com/network/). Once [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) hit Cloudflare's network, traffic is inspected for attacks, filtered, steered, accelerated, and sent onward to your origin. Magic Transit connects to your origin infrastructure using anycast Generic Routing Encapsulation (GRE) tunnels over the Internet or, with [Cloudflare Network Interconnect (CNI)](/network-interconnect/), via physical or virtual interconnect. Magic Transit users have two options for their implementation: ingress traffic or ingress and [egress traffic](/magic-transit/reference/egress/). Users with an egress implementation will need to set up policy-based routing (PBR) or ensure default routing on their end forwards traffic to Cloudflare via tunnels. ```mermaid flowchart LR accTitle: Magic Transit accDescr: Diagram showing how Magic Transit protects traffic on the customer's network. A(DDoS
attack) B[("Cloudflare global
anycast network
(DDoS protection +
network firewall)")] C[Customer
network] D((User)) E([BGP
announcement]) A --x B E --- B B-- Anycast
GRE tunnel ---C B-- Cloudflare
Network
Interconnect ---C C-- Egress via
Direct Server
Return --> D D -- Ingress --> B style A stroke: red,fill: red,color: white style B stroke: orange,fill: orange,color: black style C stroke: #ADD8E6,fill: #ADD8E6,color: black style D stroke: blue,fill: blue,color: white linkStyle 0 stroke-width:3px,stroke:red linkStyle 1 stroke-width:2px,stroke:orange linkStyle 2 stroke-width:2px,stroke:#ADD8E6 linkStyle 3 stroke-width:2px,stroke:gray linkStyle 4 stroke-width:3px,stroke:green ``` :::note Magic Transit is not yet supported on Cloudflare's China Network. ::: For detailed information on Magic Transit architecture, refer to the [Reference section](/magic-transit/reference/). --- # Alerts URL: https://developers.cloudflare.com/magic-transit/alerts/ import { AvailableNotifications, Render } from "~/components" You can configure alerts to receive notifications for changes in your network. --- # Changelog URL: https://developers.cloudflare.com/magic-transit/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-10-01 **Early access testing for BGP on CNI 2.0 circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. --- # Cloudflare IPs URL: https://developers.cloudflare.com/magic-transit/cloudflare-ips/ import { Render } from "~/components" --- # DDoS protection URL: https://developers.cloudflare.com/magic-transit/ddos/ Cloudflare DDoS protection automatically detects and mitigates Distributed Denial of Service (DDoS) attacks using its Autonomous Edge. Magic Transit customers have access to additional features, such as: - [Advanced TCP protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) (disabled by default) - [Advanced DNS protection (beta)](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) Refer to [Cloudflare DDoS documentation](/ddos-protection/) for more information. --- ## Execution order The execution order of the different mitigation systems for Magic Transit customers is the following: 1. [DDoS managed rulesets](/ddos-protection/managed-rulesets/) 2. [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) 3. [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) 4. [Magic Firewall](/magic-firewall/) --- # Glossary URL: https://developers.cloudflare.com/magic-transit/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic Transit documentation. --- # Cloudflare Magic Transit URL: https://developers.cloudflare.com/magic-transit/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Secure your network and improve performance at Cloudflare scale. Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. - **DDoS mitigation and protection**: Instead of relying on local infrastructure that can be overwhelmed by large DDoS attacks, Magic Transit uses the [global Cloudflare Network](https://www.cloudflare.com/network/) to ingest and mitigate attacks close to their source. - **Traffic acceleration**: Magic Transit takes advantage of the Cloudflare global network to reduce latency and ensure that requests always have a data center nearby. Learn more [about how Magic Transit works](/magic-transit/about/) and how to [get started](/magic-transit/get-started/). --- ## Features Magic Transit sends health check probes to monitor network status and the health of specific network components. Magic Transit steers traffic along tunnel routes based on priorities you define during the onboarding process. Use Cloudflare-owned IP addresses if you want to protect a smaller network and do not meet Magic Transit's `/24` prefix length requirements. Use BGP peering between your networks and Cloudflare to automate the process of adding or removing networks and subnets, and take advantage of failure detection and session recovery features. --- ## Related products Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, scalable protection. Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. Cloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised. With Bringing Your Own IPs (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with Magic Transit, Spectrum, or CDN services. --- ## More resources Deep dive into the key architecture, functionalities, and network deployment options of Cloudflare Magic Transit. --- # Get started URL: https://developers.cloudflare.com/magic-transit/get-started/ import { Render } from "~/components" --- # Magic Network Monitoring URL: https://developers.cloudflare.com/magic-transit/magic-network-monitoring/ import { Render } from "~/components" --- # Network Interconnect (CNI) URL: https://developers.cloudflare.com/magic-transit/network-interconnect/ import { Render } from "~/components"; --- # Magic Transit on-demand URL: https://developers.cloudflare.com/magic-transit/on-demand/ Customers with access to the Magic Transit on-demand option can [configure prefix advertisement](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement) from the **IP Prefixes** page in their Cloudflare account home or via the [Cloudflare API](/api/resources/addressing/subresources/prefixes/subresources/advertisement_status/methods/edit/). A common workflow is to enable prefix advertisement during an attack so that you can take advantage of Cloudflare protection and then disable advertisement once the incident is resolved. Prefixes using BGP-controlled advertisements cannot be used in conjunction with dynamic advertisement (via dashboard/API). Please specify your preferred on-demand advertisement method during the prefix onboarding. To ensure smooth operation in general and simplify the advertisement process during an attack scenario, refer to [Dynamic advertisement: Best practices](/byoip/concepts/dynamic-advertisement/best-practices/). :::note Magic Transit on-demand cannot be used with Cloudflare leased IPs. ::: --- # Migration guides URL: https://developers.cloudflare.com/migration-guides/ import { CardGrid, Description, LinkTitleCard } from "~/components" Content designed to help you migrate from another provider to Cloudflare. This section is still in work. Expect more guides soon. *** ## More resources High-level overviews of Cloudflare's network and platform. Read articles and announcements about the latest Cloudflare products and features. Module-based guidance on Cloudflare product workflows. --- # Changelog URL: https://developers.cloudflare.com/magic-wan/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2025-02-14 **Sites feature available to all Magic WAN customers** All Magic WAN customers now have full access to the Magic WAN sites feature. Customers can configure a Magic WAN site either with or without a Magic WAN connector. ## 2024-12-17 **Magic WAN Connector configurable health checks** Health check rate on Magic WAN Connector IPsec tunnels are now configurable. ## 2024-12-17 **BGP support for Cloudflare Network Interconnect (CNI)** Magic WAN customers can now establish BGP peering over Direct CNI circuits. Customers can now dynamically exchange routes and path availability status between their router device and the Magic WAN table. ## 2024-12-12 **LAN Policy improvements for the Magic WAN Connector** Magic WAN Connector LAN Policy now supports unidirectional traffic flows and port-ranges. ## 2024-10-01 **Early access testing for BGP on CNI 2.0 circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. ## 2024-09-27 **Magic WAN Connector sends WARP client traffic to Internet** All Magic WAN Connectors now route WARP client traffic directly to the Internet, bypassing IPsec tunneling, to prevent double encapsulation of WARP traffic. ## 2024-07-17 **Updates to High Availability on the Magic WAN Connector** The High Availability feature on Magic WAN Connector now supports additional failover conditions, DHCP lease syncing, and staggered upgrades. ## 2024-06-23 **ICMP support for traffic sourced from private IPs** Magic WAN will now support ICMP traffic sourced from private IPs going to the Internet via Gateway. ## 2024-06-05 **Application based prioritization** The Magic WAN Connector can now prioritize traffic on a per-application basis. ## 2024-05-31 **WARP virtual IP addresses** Customers using Gateway to filter traffic to Magic WAN destinations will now see traffic from Cloudflare egressing with WARP virtual IP addresses (CGNAT range), rather than public Cloudflare IP addresses. This simplifies configuration and improves visibility for customers. ## 2024-01-23 **Network segmentation** You can define policies in your Connector to either allow traffic to flow between your LANs without it leaving your local premises or to forward it via the Cloudflare network where you can add additional security features. --- # Get started URL: https://developers.cloudflare.com/magic-wan/get-started/ import { GlossaryTooltip, Render } from "~/components"; Magic WAN allows you to achieve any-to-any connectivity across branch and retail sites and data centers, with Cloudflare connectivity cloud. ## Before you begin Magic WAN is an Enterprise-only product. [Contact Cloudflare](https://www.cloudflare.com/magic-wan/) to acquire Magic WAN. If you plan on using Magic WAN Connector to automatically onboard your locations to Cloudflare, you will need to purchase Magic WAN first. ## Set up method Magic WAN supports an automatic setup and a manual setup. The automatic setup through Magic WAN Connector is the preferred method. ### Automatic set up Setting up Magic WAN automatically is done through Magic WAN Connector, and is the preferred method. You can choose between the hardware version and the virtual version of the Magic WAN Connector. The virtual version can be installed on your own machines. If you plan on using Magic WAN Connector, you can skip the prerequisites below, and refer to [Configure with Connector](/magic-wan/configuration/connector/) for more information on how to continue. ### Manual set up Setting up Magic WAN manually is done through a combination of third-party devices in your premises and the Cloudflare dashboard. To be successful, you need to: 1. Read the [Prerequisites](#prerequisites) below. 2. Follow the steps in [Manual configuration](/magic-wan/configuration/manually/how-to/configure-tunnels/). ## Prerequisites :::note The list of prerequisites below is only for customers planning to connect manually to Cloudflare with a third-party device. If you plan on using Magic WAN Connector, skip this section and refer to [Configure with Connector](/magic-wan/configuration/connector/). ::: ### Use compatible tunnel endpoint routers Magic WAN relies on GRE and IPsec tunnels to transmit [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) from Cloudflare's global network to your origin network. To ensure compatibility with Magic WAN, the routers at your tunnel endpoints must: - Allow configuration of at least one tunnel per Internet service provider (ISP). - Support maximum segment size (MSS) clamping. - Support the configuration parameters for IPsec mentioned in [IPsec tunnels](/magic-wan/reference/tunnels/#supported-configuration-parameters). ### Set maximum segment size #### MSS clamping recommendations ##### GRE tunnels as off-ramp ##### IPsec tunnels :::caution[Important] Refer to your device documentation to check if it sets IPsec MSS clamping automatically. If that is not the case and you are using IPsec inside GRE, you have to set MSS clamp manually. ::: Refer to [Maximum transmission unit and maximum segment size](/magic-wan/reference/mtu-mss/) for more details. ### Follow router vendor guidelines --- # Glossary URL: https://developers.cloudflare.com/magic-wan/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic WAN documentation. --- # Cloudflare Magic WAN URL: https://developers.cloudflare.com/magic-wan/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Improve security and performance for your entire corporate networking, reducing cost and operation complexity. Magic WAN provides secure, performant connectivity and [routing](https://www.cloudflare.com/learning/network-layer/what-is-routing/) for your entire corporate networking, reducing cost and operation complexity. [Magic Firewall](/magic-firewall/) integrates smoothly with Magic WAN, enabling you to enforce network firewall policies at Cloudflare's global network, across traffic from any entity within your network. With Magic WAN, you can securely connect any traffic source - data centers, offices, devices, cloud properties - to Cloudflare's network and configure routing policies to get the bits where they need to go, all within one SaaS solution. Magic WAN supports a variety of on-ramps including any device that supports anycast GRE or IPsec tunnels. To make it easier to onboard your cloud properties, you can use [Magic Cloud Networking](/magic-wan/configuration/magic-cloud-networking/), which automates the process of creating on-ramps from your cloud networks. Refer to [On-ramps](/magic-wan/on-ramps/) for a full list of supported on-ramps. Learn how to [get started](/magic-wan/get-started/). --- ## Features Use Magic WAN Connector to automatically connect, steer, and shape any IP traffic. Magic WAN is compatible with a host of third-party devices. If you do not have Magic WAN Connector, start here to learn how to set up Magic WAN manually. Automate resource discovery, and reduce management burden when connecting to your public cloud. Learn how you can use Magic WAN with other Cloudflare Zero Trust products. Use BGP peering between your networks and Cloudflare to automate the process of adding or removing networks and subnets, and take advantage of failure detection and session recovery features. --- ## Related products Cloudflare Zero Trust replaces legacy security perimeters with our global edge, making the Internet faster and safer for teams around the world. Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, and scalable protection. Simplify and automate cloud resource discovery, and reduce your management burden when connecting to your public cloud. Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. Cloudflare Load Balancing distributes traffic across your endpoints, which reduces endpoint strain and latency and improves the experience for end users. --- ## More resources Deep dive into key architecture and functionalities aspects of Cloudflare One, and learn more about Magic WAN and its structure. --- # Load Balancing URL: https://developers.cloudflare.com/magic-wan/load-balancing/ You can use Cloudflare Load Balancing with Magic WAN to distribute traffic across endpoints, reducing strain and improving the performance of your network. This works through Private Network Load Balancing, which supports both on-ramping and off-ramping traffic to Magic WAN tunnels. Refer to [Private Network Load Balancing](/load-balancing/private-network/) for more information about the feature and how to set it up. You will need to [enable Load Balancing](/load-balancing/) before you can use this feature. --- # Network Interconnect (CNI) URL: https://developers.cloudflare.com/magic-wan/network-interconnect/ import { Render } from "~/components"; --- # On-ramps URL: https://developers.cloudflare.com/magic-wan/on-ramps/ To on-ramp your network traffic to Magic WAN, you can use [Magic WAN Connector](/magic-wan/configuration/connector/), a lightweight software package you can install in corporate network locations to automatically connect, steer, and shape any IP traffic. You can also use any device that supports [GRE or IPsec](/magic-wan/configuration/manually/third-party/) tunnels with the supported configuration parameters. Additional compatible on-ramps include: - [Cloudflare Network Interconnect (CNI)](/magic-wan/network-interconnect/): Connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. - [Cloudflare Tunnel](/magic-wan/zero-trust/cloudflare-tunnel/): Magic WAN can be used together with Cloudflare Tunnel for easy access between your networks and applications. - [WARP](/cloudflare-one/connections/connect-devices/warp/): Protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where Cloudflare Gateway can apply advanced web filtering. - [Magic Cloud Networking](/magic-wan/configuration/magic-cloud-networking/): Automatically create on-ramps from your cloud networks to Magic WAN. - [Network on-ramp partnerships](https://www.cloudflare.com/network-onramp-partners/): Refer to our [third-party integration tutorials](/magic-wan/configuration/manually/third-party/) for guidance on configuring the most asked for third-party products. --- # Security filters URL: https://developers.cloudflare.com/magic-wan/security/ Magic WAN customers have [automatic access to Magic Firewall](/magic-firewall/plans/). Magic Firewall is Cloudflare's firewall-as-a-service solution that allows you to protect your infrastructure. Magic Firewall supports layers three and four of the [OSI model](https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/), and enables you to allow or block traffic on a variety of packet characteristics. Refer to [Magic Firewall](/magic-firewall/) for more information about this product. As a Magic WAN customer, you can also use Cloudflare Gateway to set up policies to inspect network and HTTP traffic to the Internet or your private network infrastructure. Refer to [Connect to Cloudflare Gateway with Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) to learn how to filter Magic WAN traffic with Gateway policies. --- # Network settings URL: https://developers.cloudflare.com/network/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Manage network settings for your website. *** ## Features Include the country code of the visitor location with all requests to your website. Enable IPv6 support and gateway. Allow WebSockets connections to your origin server. *** ## Related products The Cloudflare China Network is a package of selected Cloudflare’s performance and security products running on data centers located in mainland China and operated by Cloudflare’s partner JD Cloud. Managed Transforms allow you to perform common adjustments to HTTP request and response headers with the click of a button. --- # gRPC connections URL: https://developers.cloudflare.com/network/grpc-connections/ import { FeatureTable, Render } from "~/components" Cloudflare offers support for gRPC to protect your APIs on any [proxied gRPC endpoints](/dns/proxy-status/). The gRPC protocol helps build efficient APIs with smaller payloads for reduced bandwidth usage, decreased latency, and faster implementations. ## Availability Charges may occur for gRPC traffic over add-on products such as [Argo Smart Routing](/argo-smart-routing/), [WAF](/waf/), and [Bot Management](/bots/). ## Limitations Running gRPC traffic on Cloudflare is compatible with most Cloudflare products. However, the following products have limited capabilities with gRPC requests: * The [Cloudflare WAF](/waf/) will only run for header inspection during the connection phase. WAF Managed Rules will not run on the content of a gRPC stream. * * [Cloudflare Access](/cloudflare-one/policies/access/) does not support gRPC traffic sent through Cloudflare’s reverse proxy. gRPC traffic will be ignored by Access if gRPC is enabled in Cloudflare. We recommend disabling gRPC for any sensitive origin servers protected by Access or enabling another means of authenticating gRPC traffic to your origin servers. ## Enable gRPC ### Requirements * Your gRPC endpoint must listen on port 443.  * Your gRPC endpoint must support TLS and HTTP/2. * HTTP/2 must be advertised over ALPN. * Use `application/grpc` or `application/grpc+ ## Add IP geolocation information The recommended procedure to enable IP geolocation information is to [enable the **Add visitor location headers** Managed Transform](/rules/transform/managed-transforms/reference/#add-visitor-location-headers). This Managed Transform adds HTTP request headers with location information for the visitor's IP address, such as city, country, continent, longitude, and latitude. If you only want the request header for the visitor's country, you can enable **IP Geolocation**. To enable **IP Geolocation** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **IP Geolocation**, switch the toggle to **On**. To enable **IP Geolocation** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `ip_geolocation` as the setting name in the URI path, and the `value` parameter set to `"on"`. :::note In order to use this data, you will need to then retrieve it from the [`CF-IPCountry` header](/fundamentals/reference/http-headers/#cf-ipcountry). ::: --- ## Report an incorrect IP location If you find an incorrect IP location, consider the following: - If the IP is part of the [current Cloudflare IP ranges](https://www.cloudflare.com/ips/), report to `ip-corrections@cloudflare.com`. - If the IP is **not** listed within the [current Cloudflare IP ranges](https://www.cloudflare.com/ips/), [report to MaxMind](https://www.maxmind.com/en/geoip-data-correction-request). --- # IPv6 compatibility URL: https://developers.cloudflare.com/network/ipv6-compatibility/ import { FeatureTable, TabItem, Tabs } from "~/components"; Cloudflare enables IPv6 on all domains without requiring additional configuration or hardware (as long as your host provides IPv6 support). When both IPv4 and IPv6 connections are available, Cloudflare prefers IPv4. ## Availability ## Enable IPv6 compatibility By default, IPv6 compatibility is enabled on your domain and will apply to all domains and subdomains covered by [proxied DNS records](/dns/proxy-status/). :::note If you have signed up for Cloudflare through a [Cloudflare hosting partner](http://www.cloudflare.com/hosting-partners) or by use [partial setup](/dns/zone-setups/partial-setup/), IPv6 compatibility does not apply to your apex domain. ::: ## Disable IPv6 compatibility If your origin web server only understands IPv4 formatted IP addresses, non-Enterprise customers should [enable **Pseudo IPv4**](/network/pseudo-ipv4/). Alternatively, customers with an Enterprise account can disable Cloudflare's IPv6 compatibility. To disable **IPv6 Compatibility** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **IPv6 Compatibility**, switch the toggle to **Off**. To disable **IPv6 Compatibility** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `ipv6` as the setting name in the URI path, and the `value` parameter set to `"off"`. :::note Even when IPv6 is disabled, domains can still receive IPv6 traffic via the Tor network. To completely disable all IPv6 traffic: - Disable [**Onion Routing**](/network/onion-routing/). - Use a [WAF custom rule](/waf/custom-rules/create-dashboard/) to block `0:0:0:0:0:0:0:0/0` using the filter `ip.src in {::/0}`. ::: --- ## Troubleshoot an IPv6 network issue Provide the following information to [Cloudflare Support](/support/contacting-cloudflare-support/) if you experience issues with IPv6 connectivity: - A [traceroute](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#perform-a-traceroute) that demonstrates the IPv6 connection issues, - the [Cloudflare data center serving your request](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#identify-the-cloudflare-data-center-serving-your-request) when the IPv6 issues occur, and - confirmation of whether [disabling IPv6 Compatibility](#disable-ipv6-compatibility) resolves the issue. --- # Onion Routing and Tor support URL: https://developers.cloudflare.com/network/onion-routing/ import { FeatureTable, TabItem, Tabs } from "~/components"; Improve the Tor user experience by enabling Onion Routing, which enables Cloudflare to serve your website’s content directly through the Tor network and without requiring exit nodes. ## Availability ## How it works Onion Routing helps improve Tor browsing as follows: - Tor users no longer access your site via exit nodes, which can sometimes be compromised, and may snoop on user traffic. - Human Tor users and bots can be distinguished by our Onion services, such that interactive challenges are only served to malicious bot traffic. [Tor Browser](https://tb-manual.torproject.org/about/) users receive an [alt-svc header](https://httpwg.org/specs/rfc7838.html#alt-svc) as part of the response to the first request to your website. The browser then creates a Tor Circuit to access this website using the `.onion` TLD service provided by this header. You should note that the visible domain in the user interface remains unchanged, as the host header and the SNI are preserved. However, the underlying connection changes to be routed through Tor, as the [UI denotes on the left of the address bar](https://tb-manual.torproject.org/managing-identities/#managing-identities) with a Tor Circuit. Cloudflare does not provide a certificate for the `.onion` domain provided as part of alt-svc flow, which therefore cannot be accessed via HTTPS. ## Enable Onion Routing To enable **Onion Routing** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com), and select your account and domain. 2. Go to **Network**. 3. For **Onion Routing**, switch the toggle to **On**. To enable **Onion Routing** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `opportunistic_onion` as the setting name in the URI path, and the `value` parameter set to `"on"`. --- # Pseudo IPv4 URL: https://developers.cloudflare.com/network/pseudo-ipv4/ import { FeatureTable, Render, TabItem, Tabs } from "~/components"; Cloudflare customers can use **Pseudo IPv4** if their origin web server only understands IPv4 formatted IP addresses (meaning it would not support Cloudflare's default [IPv6 compatibility](/network/ipv6-compatibility/)). ## Availability ## Background Some older origin server analytics and fraud detection software expect IP addresses in an IPv4 format and do not support IPv6 addresses. **Pseudo IPv4** uses the [Class E IPv4 address space](https://tools.ietf.org/html/rfc1112#section-4) to provide as many unique IPv4 addresses corresponding to IPv6 addresses as possible. - Example Class E IPv4 address: `240.16.0.1` - Example IPv6 address: `2400:cb00:f00d:dead:beef:1111:2222:3333` :::note Class E IPv4 addresses are designated as experimental and are not used for production Internet traffic. ::: ## Configure Pseudo IPv4 Cloudflare offers three options for configuring **Pseudo IPv4**: - **Off**: Default value. - **Add Header**: Cloudflare automatically adds the `Cf-Pseudo-IPv4` header with a Class E IPv4 address hashed from the original IPv6 address. - **Overwrite Headers**:  :::note When using _Overwrite Headers_, no software changes are necessary in your origin web server. ::: To configure **Pseudo IPv4**: To change the **Pseudo IPv4** setting in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **Pseudo IPv4**, choose your desired setting. To change **Pseudo IPv4** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `pseudo_ipv4` as the setting name in the URI path, and the `value` parameter set to your desired value: `"off"`, `"add_header"`, or `"overwrite_header"`. --- # Response Buffering URL: https://developers.cloudflare.com/network/response-buffering/ import { FeatureTable, TabItem, Tabs } from "~/components"; If your domain sends many small packets, it may be faster to buffer the file and deliver the full payload all at once (instead of streaming it). ## Availability ## How it works By default, Cloudflare **streams** traffic data, meaning that each packet is sent as it becomes available. This can improve the delivery of large files. However, this streaming behavior only applies to dynamic traffic; cacheable traffic is buffered and this behavior cannot be changed. If your domain sends many small packets, however, it might be faster to **buffer** the file. This approach waits to send the full file until all packets are ready, preventing a client browser from having to re-assemble packets. ## Enable Response Buffering To enable **Response Buffering** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **Response Buffering**, switch the toggle to **On**. To enable **Response Buffering** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `response_buffering` as the setting name in the URI path, and the `value` parameter set to `"on"`. --- # Understanding the True-Client-IP Header URL: https://developers.cloudflare.com/network/true-client-ip-header/ import { FeatureTable } from "~/components"; Enabling the True-Client-IP Header adds the [`True-Client-IP` header](/fundamentals/reference/http-headers/#true-client-ip-enterprise-plan-only) to all requests to your origin server, which includes the end user's IP address. ## Availability ## Add True-Client-IP Header The recommended procedure to access client IP information is to [enable the **Add "True-Client-IP" header** Managed Transform](/rules/transform/managed-transforms/reference/#add-true-client-ip-header). :::note To use this data, you will need to then retrieve it from the [`True-Client-IP` header](/fundamentals/reference/http-headers/#cf-ipcountry). ::: ## Additional resources For additional guidance on using True-Client-IP Header with Cloudflare, refer to the following resources: - [Available Managed Transforms](/rules/transform/managed-transforms/reference/#add-true-client-ip-header) - [Cloudflare HTTP headers](/fundamentals/reference/http-headers/#true-client-ip-enterprise-plan-only) - [Restoring original visitor IPs](/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) --- # WebSockets URL: https://developers.cloudflare.com/network/websockets/ import { FeatureTable, TabItem, Tabs } from "~/components"; Cloudflare supports proxied WebSocket connections without additional configuration. ## Background WebSockets are open connections sustained between the client and the origin server. Inside a WebSockets connection, the client and the origin can pass data back and forth without having to reestablish sessions. This makes exchanging data within a WebSockets connection fast. WebSockets are often used for real-time applications such as live chat and gaming. ## Enable WebSockets To enable **WebSockets** connections to your origin server in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **WebSockets**, switch the toggle to **On**. To enable **WebSockets** connections to your origin server with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `websockets` as the setting name in the URI path, and the `value` parameter set to `"on"`. ## Compatibility notes | Product | Compatible | Notes | | ---------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [SSL](/ssl/) | Yes | | | [WAF](/waf/) | Yes\* | The initial HTTP 101 request is subject to WAF managed rules, custom rules, rate limiting rules, and other WAF features like any other WebSockets connection. However, once a connection has been established, the WAF does not perform any further inspections. | | [Workers](/workers/examples/websockets/) | Yes | You can also use [Durable Objects](/durable-objects/) as an endpoint for WebSocket sessions, giving you full control over messages sent to and from clients. | :::note Cloudflare also supports [ASP.NET SignalR](http://signalr.net/), which helps negotiate which transport method to use (long polling or WebSockets). ::: ## Availability WebSockets are supported on all Cloudflare plans. ## Requests and Bandwidth measurement Given the nature of WebSocket connections, you may notice they differ from typical HTTP traffic in terms of requests and bandwidth usage. If you are an Enterprise customer, it is important to consider how Cloudflare measures requests and bandwidth to accurately estimate your usage. Cloudflare measures a single WebSocket connection in the following way: - **Requests**: Cloudflare recognizes only the initial upgrade request per WebSocket connection as an HTTP request. Even though you can send a bidirectional message stream through the established WebSocket connection, it will be counted as a single long-lived HTTP request. - **Bandwidth**: Cloudflare measures data transfer sent from Cloudflare to the client. This typically means that messages from the WebSocket server behind Cloudflare to the WebSocket client are counted towards bandwidth usage. Once a WebSocket connection is closed, you can view your aggregated WebSocket usage through [Traffic Analytics](/analytics/account-and-zone-analytics/zone-analytics/#traffic), the [GraphQL Analytics API](/analytics/graphql-api/), and [HTTP requests logs](/logs/reference/log-fields/zone/http_requests/). ## Technical note When Cloudflare releases new code to its global network, we may restart servers, which terminates WebSockets connections. ### Best practices - Implement a [keepalive](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_servers#pings_and_pongs_the_heartbeat_of_websockets). - Review and then remove or extend timeout settings on the origin and/or on the client. ### Troubleshooting Investigating issues with Websocket can be facilitated with client tools like [wscat](https://github.com/websockets/wscat). Being able to reproduce an issue on a single URL with a minimalistic tool helps narrowing down the issue. The `EdgeStartTimestamp` and `EdgeStopTimestamp` fields in [HTTP requests logs](/logs/reference/log-fields/zone/http_requests/) represent the duration of the WebSocket connection (they do not represent the initial HTTP connection). --- # How to URL: https://developers.cloudflare.com/network-error-logging/how-to/ Use NEL reports to view information such as: * Why a request failed * The country a request failed from * The last mile network a request failed from * The Cloudflare data center the request was most likely meant for 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/). 2. Select **Analytics & Logs** > **Edge Reachability**. Click a tab under **Reachability summary** to view specific information related to your Origin ASN, Origin, IP, or data center. Hover over a location on the map to view the number of reachable requests. Under **Reachability by data center**, click a location under Data Centers to filter reachability by a specific location. To view the log fields available for NEL, refer to [NEL reports](/logs/reference/log-fields/zone/nel_reports/). --- # Get started URL: https://developers.cloudflare.com/network-error-logging/get-started/ Network Error Logging is available to users on all plan types. To enable Network Error Logging for Free and Pro zones: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/). 2. Select **Network** and locate **Network Error Logging Monitoring**. 3. Select the toggle to enable Network Error Logging. To enable this for Business and Enterprise, contact support or your account team. --- # Network Error Logging URL: https://developers.cloudflare.com/network-error-logging/ Network Error Logging (NEL) is a browser-based reporting system that allows users to report their own failures to an external endpoint. You can use Network Error Logging to gain insight into connectivity issues on the Internet to learn when and where an incident is happening, who is impacted, and how they are being impacted. ## The last mile The last mile is the path from a user to the first point of ingress to the resource, whether that be a network like Cloudflare or directly to the origin server. The last mile is important because it is in the critical path of the request for a resource: if the last mile has issues, users cannot connect to their resources. When Network Error Logging is enabled, you can receive alerts about issues in the last mile — which are typically difficult to detect — to learn what the problem is and how to fix it. ![The last mile diagram, showing the steps involved in delivering data to a customer](~/assets/images/network-error-logging/last-mile.png) ## How NEL affects requests The Report-To header is present in all requests to Cloudflare zones that have NEL enabled:   ```txt report-to: {"group":"cf-nel","max_age":31536000,"endpoints":[{"url":"`[`https://a.nel.cloudflare.com/report?lkg-colo=lhr&lkg-time=1600338181`](https://gcp.nel.cloudflare.com/report?lkg-colo=lhr&lkg-time=1600338181&lkg-ip=1.1.1.1)`"}]} ``` A sample Network Error Report payload appears as follows: ```json { "age": 20, "type": "network-error", "url": "https://example.com/previous-page", "body": { "elapsed_time": 18, "method": "POST", "phase": "dns", "protocol": "http/1.1", "referrer": "https://example.com/previous-page", "sampling_fraction": 1, "server_ip": "", "status_code": 0, "type": "dns.name_not_resolved", "url": "https://example-host.com/" } } ``` ## Privacy Cloudflare uses geolocation lookups to extract the following information from every client IP in a NEL report: * Client ASN * Client country * Client metro area Cloudflare uses internal lookups to associate the above data with a customer domain and customer account. Cloudflare does not store any PII or user-specific data, and any IP data is only kept for the duration of the request as it is processed. After the report is processed through the NEL pipeline, all PII data is purged from the system. The client IP address is only stored in volatile memory for the lifetime of the request to Cloudflare’s NEL endpoint (order of milliseconds) and is dropped immediately after the request completes. Cloudflare does not log the client IP address anywhere in the Network Error Logging pipeline. Customers can opt out of having their end users consume the NEL headers by emailing Cloudflare support. --- # Reference URL: https://developers.cloudflare.com/network-error-logging/reference/ If a user is able to connect to Cloudflare and the site they connect to has NEL enabled, Cloudflare passes back two headers to the browser indicating that they should report any network failures to an endpoint specified in the headers. The browser will operate as usual, and if something happens that prevents the browser from connecting to the site, the browser will log the failure as a report and send it to the endpoint. Network Error Logging failures can occur for different reasons which are outlined below. ## Internet Service Provider (ISP) outage An ISP outage appears to NEL users as failures from one particular last-mile network. By examining NEL data to look at the client autonomous system number (ASN) view, you can see which networks are causing the most impact. For customers, this scenario appears as an influx of `tcp.timed_out errors`, as well as `tcp.failed`, `h2.protocol_error` and `h3.protocol_error`. In the event of a last-mile outage, the best course of action is to contact the provider to investigate. ## Transit Flap Transit flaps look like momentary outages caused by transits re-establishing BGP sessions. To customers, this will appear as `tcp.timed_out` reports from a variety of ASNs over a short period of time. This could happen for several reasons: - Maintenance in the transit network necessitated a reset of the session. - Maintenance or reboots in Cloudflare necessitated a reset of the BGP session. - Packet loss in the network caused the session to flap. Heavy packet loss in the network will likely result in a series of flaps over time. Maintenance is typically one impact period that lasts no more than two minutes. ## Infrastructure outage Infrastructure outages occur at shared peering points, such as Internet exchanges. These outages appear to customers as an increase in `tcp.timed_out`, `tcp.failed`, and `tcp.aborted reports`. These failures will likely appear across multiple networks for an extended period of time. Depending on the severity of the report volume, Cloudflare may declare an incident to track remediation. Alternatively, Cloudflare may deactivate peering from these shared points until the issue is resolved. ## Cloudflare outage Cloudflare outages consist of issues within Cloudflare’s data-center fabric. These outages appear to customers as an increase in `tcp.timed_out`, `tcp.failed`, and `tcp.aborted` reports and will likely appear across multiple networks for a short period of time. By pivoting by data center, customers can track the impact across Cloudflare points of presence. Cloudflare-based incidents will always be tracked through a status page, which will indicate whether or not there are issues within the impacted region. ## Provider sending traffic through scrubbing center/blocking traffic This type of outage manifests as TLS errors, such as `tls.cert.authority_invalid`, `tls.cert.name_invalid,` or others and may also present with `tcp.aborted errors`. Customers may uncover this behavior by looking at which last-mile ASNs are displaying increased failures, as it will typically be only one. Customers can seek remediation by contacting the provider that they believe is scrubbing their traffic. ## Certificate issues Certificate issues are also detectable through NEL. The `TLS.version`, `cipher_mismatch`, or other errors may present across multiple ISPs in multiple Cloudflare locations. If this is detected in NEL, the issue can be remediated by deploying new certificates or using [Cloudflare’s SSL management suite](/ssl/edge-certificates/advanced-certificate-manager/) to automatically deploy new certificates. --- # Changelog URL: https://developers.cloudflare.com/notifications/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Notifications URL: https://developers.cloudflare.com/notifications/ import { Plan } from "~/components" Cloudflare Notifications help you stay up to date with your Cloudflare account. Manage your Notifications to define what you want to be warned about and how, be it a denial-of-service attack or an issue with your server. The available Notification features vary according to your plan: - Free plans can set up email-based Notifications. - Business and higher plans can also [access PagerDuty](/notifications/get-started/configure-pagerduty/). - Professional and higher plans can also [use webhooks](/notifications/get-started/configure-webhooks/). The notification service only works on the [proxied](/dns/proxy-status/) domains because Cloudflare needs enough information necessary to decide if we need to trigger a notification or not. :::note The availability of delivery methods like PagerDuty and webhooks in Free or Professional zones depends on the highest zone plan in your Cloudflare account: - PagerDuty is available in zones on a Free/Professional plan if your Cloudflare account has at least one zone in a Business plan (or higher). - Webhooks are available in zones on a Free plan if your Cloudflare account has at least one zone in a Professional plan (or higher). ::: --- # Available Notifications URL: https://developers.cloudflare.com/notifications/notification-available/ import { AvailableNotifications } from "~/components" Available Notifications depend on your Cloudflare plan. Cloudflare offers a variety of Notifications for our products and services, such as [Billing](/fundamentals/subscriptions-and-billing/), [Denial of Service protection](/ddos-protection/), [Magic Transit](/magic-transit/), and [SSL/TLS](/ssl/). Depending on your plan, you can also configure webhooks, allowing you to connect your account with external services such as Slack and Google Chat, and PagerDuty to receive Cloudflare Notifications. ## Actions available on receiving a Notification Each Notification carries different types of information about the status of your Cloudflare account, or the type of action you can take. Refer to information below to understand what each Notification does and what to do when receiving one. --- # Notification History URL: https://developers.cloudflare.com/notifications/notification-history/ Notification History is a log of notifications that have been sent to your account via the Notifications service. Information contained in Notification History includes the notification itself, when the notification was sent, and who the notification was sent to. ## How to access Notification History Currently, customers can access Notification History [via the Cloudflare API](/api/resources/alerting/subresources/history/methods/list/). Using `GET`, customers can retrieve a list of history records for notifications sent to an account. The records are displayed for the last 30 or 90 days, based on the type of plan. ```txt title="Syntax" GET accounts/{account_id}/alerting/v3/history ``` ```bash title="Example" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/alerting/v3/history?page=1&per_page=25" \ --header "Authorization: Bearer " ``` ## Availability Notification History is available on all plans. The amount of history clients have access to depends on the type of plan: - **Free, Pro, and Business**: History from the past 30 days. - **Enterprise**: History from the past 90 days. :::note Customers will not be able to access Notification History from before 2021-10-11. ::: --- # About URL: https://developers.cloudflare.com/network-interconnect/about/ Cloudflare supports a variety of options to connect your network to Cloudflare: - Direct CNI, for Magic WAN and Magic Transit. - Classic CNI, for Magic Transit. - Cloud CNI, for Magic WAN and Magic Transit. - Peering via either an Internet exchange, or a private network interconnect (PNI). Below is a brief overview of the options to help you decide which method best fits your network. | Network interconnect mode | Use cases | Capabilities | | --- | --- | --- | | [Direct CNI](/network-interconnect/express-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with on-premise locations. | - 10, 100 Gbps
- Available at Direct CNI-capable Cloudflare locations
- No tunnel required
- Set up via dashboard in less than three minutes. | | [Classic CNI](/network-interconnect/classic-cni/) | Use for Magic Transit, interconnecting directly or via a partner with on-premise locations. | - 10, 100 Gbps
- Available at classic CNI capable Cloudflare data centers
- Overlay GRE tunnel required for egress
- BGP route reflector signaling
- Setup facilitated by account team. | | [Cloud CNI](/network-interconnect/cloud-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with virtual networks (VPCs) from public cloud providers. | - Speed depends on cloud provider
- Available at Cloud CNI capable Cloudflare locations
- Setup facilitated by account team. | | [Peering, or private network interconnect (PNI)](/network-interconnect/pni-and-peering/) | Use for connecting your users to any Cloudflare services, via a more direct, performant and potentially cost-effective network path. | - No requirement to be a customer
- Speed depends on IX or PNI
- Available at PNI capable Cloudflare locations (PNI) and any Internet Exchange (IX) where Cloudflare peers today.
- Setup facilitated by `peering@cloudflare.com` | --- # Changelog URL: https://developers.cloudflare.com/network-interconnect/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-10-01 **Early access testing for BGP on Direct CNI circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. ## 2024-09-02 **Interconnect portal displays all available locations in a list** Customers can now see all available Direct CNI locations when searching for a Cloudflare site in the Interconnects interface. --- # Cloud CNI URL: https://developers.cloudflare.com/network-interconnect/cloud-cni/ Cloud Interconnect allows you to connect your virtual private cloud (VPC) virtual networks directly with Cloudflare — for a more reliable and secure experience. Connecting to Cloudflare directly with a Cloud Interconnect reduces latency, makes your network more stable by bypassing Internet performance potential bottlenecks, and will often reduce your cloud provider network egress bandwidth charges. The use case for Cloud Interconnect is Magic WAN. ## Supported cloud providers Cloudflare supports interconnect with: - Amazon Web Services (AWS) Direct Connect - Google Cloud (GCP) Interconnect Azure ExpressRoute support is coming soon. ## Cloud Interconnect Setup Enterprise customers using Magic WAN can get started with Cloud Interconnect by contacting their account team. ### AWS Direct Connect (beta) If you are a Magic WAN customer, you can connect to [AWS Direct Connect](https://docs.aws.amazon.com/directconnect/) using Cloud Interconnect. Currently, Cloud Interconnect only supports Dedicated Direct Connect, not Hosted Direct Connect. A Dedicated AWS Direct Connect involves a full physical port allocation in AWS, whereas a Hosted AWS Direct Connect uses a VLAN on a shared port between AWS and Cloudflare. For your AWS Direct Connect, you can choose between connection speeds of 10 Gbps or 1 Gbps. To connect to AWS Direct Connect: 1. Contact your account team to start the Cloud Interconnect provisioning process. Your team will let you know of available interconnect locations so you can choose the best one for you, as well as all the details involved in this process. 2. Log in to your AWS portal and order a Direct Connect. 3. AWS will provide you a Letter of Agency (LOA) — sometimes referred to as a Letter of Authorization — and a VLAN ID that you need to send to your account team. 4. Your account team will continue the process of provisioning your Cloud Interconnect with the AWS documents you have provided. Overall, this process should take around four weeks to finish. ### Google Cloud interconnect (beta) 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Interconnects** > **Create new**. 3. Under **Cloud CNI** select **Create new** . 4. Under **Google Integration**, select **Select integration**. 5. Give your interconnect a name and optionally a description. Make sure the **MTU** value matches the MTU configured on the [GCP VLAN attachment](https://cloud.google.com/network-connectivity/docs/interconnect/how-to/dedicated/creating-vlan-attachments). 6. Select **Continue**. 7. From the **Interface speed** dropdown menu, select an **Interface speed**. GCP will charge you based on the speed of the interconnect that you choose. 8. Enter your [VLAN attachment pairing key](https://cloud.google.com/network-connectivity/docs/interconnect/how-to/partner/creating-vlan-attachments). 9. Select **Continue**. 10. Review the details you provided and select **Confirm order**. Your Google Cloud Platform (GCP) interconnect will take a few minutes to be available. A BGP session will be established but no routes will be exchanged. #### GCP next steps You can now select **View interconnects** for a list of all interconnects on your account. Select the interconnect name to show the interconnect details. The interconnect has a unique **Interconnect ID**. After you have configured your Google Cloud Interconnect, you will need to add routes to use the interconnect: - To create routes in the Magic routing table to direct traffic towards GCP: - Add [static routes](/magic-wan/configuration/manually/how-to/configure-routes/#configure-static-routes) to your Magic WAN routing table with [legacy bidirectional tunnel health checks](/magic-wan/configuration/manually/how-to/configure-tunnels/#legacy-bidirectional-health-checks) to detect failures and steer traffic to alternative paths. - Note that routes advertised by BGP from GCP Cloud Router will be ignored. - To create routes in GCP routing table to direct traffic towards Cloudflare, you must use the GCP Cloud Router: - Add [custom learned routes to Cloud Router](https://cloud.google.com/network-connectivity/docs/router/how-to/configure-custom-learned-routes). - Use the BGP session. Reach out to your account team to request a list of one or more prefixes to advertise, and specify the interconnect ID you want to advertise over. --- # Cloudflare Network Interconnect URL: https://developers.cloudflare.com/network-interconnect/ import { Description, Plan, RelatedProduct } from "~/components" Connect your network infrastructure directly to Cloudflare Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience. With CNI, you can bring Cloudflare's full suite of network functions to your physical network edge. *** ## Related products Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Improve security and performance for your entire corporate network, reducing cost and operation complexity. --- # PNI and peering setup URL: https://developers.cloudflare.com/network-interconnect/pni-and-peering/ Cloudflare has an [open peering policy](https://www.cloudflare.com/peering-policy/). There is no requirement to be a Cloudflare customer for public peering, or a Private Network Interconnect (PNI). You can use BGP to peer with Cloudflare at any of the Public Internet Exchanges listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/net/4224). If you have many users accessing websites protected and proxied by Cloudflare, then peering with Cloudflare may help you remove bandwidth from your Internet transit links, and increase performance by reducing latency to Cloudflare. You may also optionally sign up for the [Cloudflare Peering Portal](https://www.cloudflare.com/partners/peering-portal/), which allows operators of public BGP Autonomous System Number (ASN) listed on PeeringDB to view where their network exchanges traffic with Cloudflare. Finally, if our networks exchange more than 1 Gbps of traffic in a single location, we can move your peering from the Internet Exchange to a Private Network Interconnect (PNI). If you operate a public autonomous system on the BGP table, and would like to peer with Cloudflare at a Public Internet Exchange listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/asn/13335), you can request peering by emailing `peering@cloudflare.com`. ## PNI and peering setup You can use a peering portal, such as PeeringDB, to view and maintain your database of peering locations. Before you begin using PeeringDB, you must create an account and affiliate with Cloudflare. ### Log in to the PeeringDB portal :::note You must first [create PeeringDB portal account](https://www.peeringdb.com/register) before you can log in. ::: 1. [Log in](https://www.peeringdb.com/account/login/?next=/register) to your account. 2. Ensure your email address is affiliated with the ASN you want to request access for. Select the **OIDC PeeringDB** and follow the log in process. If you receive a message stating your account has not been affiliated with an organization, you will need to request affiliation. ![Error message about missing organization affiliation](~/assets/images/network-interconnect/peeringdb-request-affiliation.png) When your affiliation is approved, **Cloudflare, Inc.** appears under **Existing affiliations** on your profile. ![List of existing affiliations](~/assets/images/network-interconnect/peeringdb-affiliation-approved.png) ### Request peer sessions Before you can request a peering session for an ASN, you must be an admin for that ASN. 1. On the **ASN** page on [PeeringDB](https://www.peeringdb.com/), select **Users**. Confirm your email address in the **Admin** group. 2. From the **Peering Portal**, locate **Peering Locations**. 3. From the **Sessions** toggle, select **Potential**. The **Peer** button under **Peering Request** only appears active to admins. ![Admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-admin-view.png) Non-admin users will be unable to select **Peer** and hovering over the button will display a message about the need for admin access. ![Non-admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-nonadmin-view.png) --- # Changelog URL: https://developers.cloudflare.com/page-shield/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/page-shield/get-started/ import { Render } from "~/components"; ## Activate Page Shield To enable Page Shield: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Security** > **Page Shield**. 3. Select **Enable Page Shield**. If you do not have access to Page Shield in the Cloudflare dashboard, check if your user has one of the [necessary roles](/page-shield/reference/roles-and-permissions/). ## Review detected scripts When you enable Page Shield, it may take a while to get the list of detected scripts in your domain. Review the scripts displayed in the [**Monitors** dashboard](/page-shield/detection/monitor-connections-scripts/), checking them for signs of malicious activity. Depending on your plan, you may be able to also review the connections made by scripts in your domain's pages and check them for malicious activity. ## Configure alerts :::note Only available to customers on a Business or Enterprise plan. ::: ## Define policies :::note Only available to Enterprise customers with a paid add-on. ::: [Policies](/page-shield/policies/) define allowed resources on your websites. Create policies to implement a positive security model [^1]. 1. [Create a policy](/page-shield/policies/create-dashboard/) with the _Log_ action. 2. After some time, [review the list of policy violations](/page-shield/policies/violations/) to make sure the policy is correct. Update the policy if needed. 3. Change the policy action to _Allow_ to start blocking resources not covered by the policy. [^1]: A positive security model is one that defines what is allowed and rejects everything else. In contrast, a negative security model defines what will be rejected and accepts the rest. --- # Cloudflare Page Shield URL: https://developers.cloudflare.com/page-shield/ import { Description, Feature, FeatureTable, Plan } from "~/components"; Ensures the safety and privacy of your website visitors' browsing environment. Page Shield helps manage resources loaded by your website visitors — including scripts, their connections, and cookies — and triggers alert notifications when resources change or are considered malicious. Learn how to [get started](/page-shield/get-started/). --- ## Features Displays information about loaded scripts in your domain's pages and the connections they make. Find in which page a resource first appeared, and view a list of the latest occurrences of the resource in your pages. Detects malicious scripts in your pages using threat intelligence and machine learning. Detects any changes in the scripts loaded in your pages. Receive notifications about newly detected scripts, scripts loaded from unknown domains, new scripts considered malicious, or code changes in your existing scripts. Policies define allowed resources on your websites. Use policies to enforce an allowlist of resources, effectively blocking resources not included in your policies. ## Availability --- # Troubleshooting URL: https://developers.cloudflare.com/page-shield/troubleshooting/ import { GlossaryTooltip } from "~/components"; ### How do I set up Page Shield? For help setting up Page Shield, refer to our [get started guide](/page-shield/get-started/). ## Page Shield does not show any resources after activating it Page Shield does not collect data on every single page view. Instead, it uses a sampling approach to gather information efficiently. This means that domains with lower traffic might take longer to generate initial reports, as these domains need more page views to accumulate enough samples. To speed up the reporting process, it is recommended that you actively generate traffic to your application after [activating Page Shield](/page-shield/get-started/). This will provide Page Shield with more data to work with, leading to faster report generation. ## Page Shield shows scripts and connections that I do not recognize Scripts often reference other scripts outside your application. But, if you see unexpected scripts on your Script Monitor dashboard, check them for signs of malicious activity. ## I get warnings in my browser's developer tools related to Content Security Policy (CSP) Page Shield uses a Content Security Policy (CSP) report-only directive to gather a list of all scripts running on your application. Some browsers display scripts being reported as warnings in the console pane of their developer tools. For example: ```txt [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='), or a nonce ('nonce-...') is required to enable inline execution. ``` You can safely ignore these warnings, since they are related to the reports that Page Shield requires to detect loaded scripts. For more information, refer to [How Page Shield works](/page-shield/how-it-works/). ## I get policy violation reports for a domain I allowlisted Policy violations reported via CSP's [report-only directive](/page-shield/reference/csp-header/) do not take into consideration any redirects or redirect HTTP status codes. This is [by design](https://www.w3.org/TR/CSP3/#create-violation-for-request) for security reasons. Some third-party services you may want to cover in your Page Shield allow policies perform redirects. An example of such a service is Google Ads, which [does not work well with CSP policies](https://support.google.com/adsense/thread/102839782?hl=en&msgid=103611259). For example, if you add the `adservice.google.com` domain to an allow policy, you could get policy violation reports for this domain due to redirects to a different domain (not present in your allow policy). In this case, the violation report would still mention the original domain, and not the domain of the redirected destination, which can cause some confusion. To try to solve this issue, add the domain of the redirected destination to your allow policy. You may need to add several domains to your policy due to redirects. --- # Demos and architectures URL: https://developers.cloudflare.com/pages/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector, } from "~/components"; Learn how you can use Pages within your existing application and architecture. ## Demos Explore the following demo applications for Pages. ## Reference architectures Explore the following reference architectures that use Pages: --- # Cloudflare Pages URL: https://developers.cloudflare.com/pages/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Render, Aside, } from "~/components"; Create full-stack applications that are instantly deployed to the Cloudflare global network. Deploy your Pages project by connecting to [your Git provider](/pages/get-started/git-integration/), uploading prebuilt assets directly to Pages with [Direct Upload](/pages/get-started/direct-upload/) or using [C3](/pages/get-started/c3/) from the command line. --- ## Features Use Pages Functions to deploy server-side code to enable dynamic functionality without running a dedicated server. Rollbacks allow you to instantly revert your project to a previous production deployment. Set up redirects for your Cloudflare Pages project. --- ## Related products Cloudflare Workers provides a serverless execution environment that allows you to create new applications or augment existing ones without configuring or maintaining infrastructure. Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. D1 is Cloudflare’s native serverless database. Create a database by importing data or defining your tables and writing your queries within a Worker or through the API. Offload third-party tools and services to the cloud and improve the speed and security of your website. --- ## More resources Learn about limits that apply to your Pages project (500 deploys per month on the Free plan). Deploy popular frameworks such as React, Hugo, and Next.js on Pages. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Getting started URL: https://developers.cloudflare.com/pipelines/getting-started/ import { Render, PackageManagers, Details } from "~/components"; Cloudflare Pipelines allows you to ingest load high volumes of real time streaming data, and load into [R2 Object Storage](/r2/), without managing any infrastructure. By following this guide, you will: 1. Setup an R2 bucket. 2. Create a pipeline, with HTTP as a source, and an R2 bucket as a sink. 3. Send data to your pipeline's HTTP ingestion endpoint. 4. Verify the output delivered to R2. :::note Pipelines is in **public beta**, and any developer with a [paid Workers plan](/workers/platform/pricing/#workers) can start using Pipelines immediately. ::: *** ## Prerequisites To use Pipelines, you will need: ## 1. Set up an R2 bucket Create a bucket by following the [get started guide for R2](/r2/get-started/), or by running the command below: ```sh npx wrangler r2 bucket create my-bucket ``` Save the bucket name for the next step. ## 2. Create a Pipeline To create a pipeline using Wrangler, run the following command in a terminal, and specify: - The name of your pipeline - The name of the R2 bucket you created in step 1 ```sh npx wrangler pipelines create my-clickstream-pipeline --r2-bucket my-bucket --batch-max-seconds 5 --compression none ``` After running this command, you will be prompted to authorize Cloudflare Workers Pipelines to create an R2 API token on your behalf. These tokens used by your pipeline when loading data into your bucket. You can approve the request through the browser link which will open automatically.
Choosing a pipeline name When choosing a name for your pipeline: - Ensure it is descriptive and relevant to the type of events you intend to ingest. You cannot change the name of the pipeline after creating it. - The pipeline name must be between 1 and 63 characters long. - The name cannot contain special characters outside dashes (`-`). - The name must start and end with a letter or a number.
You will notice two optional flags are set while creating the pipeline: `--batch-max-seconds` and `--compression`. These flags are added to make it faster for you to see the output of your first pipeline. For production use cases, we recommend keeping the default settings. Once you create your pipeline, you will receive a summary of your pipeline's configuration, as well as an HTTP endpoint which you can post data to: ```sh 🌀 Authorizing R2 bucket "my-bucket" 🌀 Creating pipeline named "my-clickstream-pipeline" ✅ Successfully created pipeline my-clickstream-pipeline Id: [PIPELINE-ID] Name: my-clickstream-pipeline Sources: HTTP: Endpoint: https://[PIPELINE-ID].pipelines.cloudflare.com/ Authentication: off Format: JSON Worker: Format: JSON Destination: Type: R2 Bucket: my-bucket Format: newline-delimited JSON Compression: GZIP Batch hints: Max bytes: 100 MB Max duration: 300 seconds Max records: 100,000 🎉 You can now send data to your Pipeline! Send data to your Pipeline's HTTP endpoint: curl "https://[PIPELINE-ID].pipelines.cloudflare.com/" -d '[{ ...JSON_DATA... }]' To send data to your Pipeline from a Worker, add the following configuration to your config file: { "pipelines": [ { "pipeline": "my-clickstream-pipeline", "binding": "PIPELINE" } ] } ``` ## 3. Post data to your pipeline Use a curl command in your terminal to post an array of JSON objects to the endpoint you received in step 1. ```sh curl -H "Content-Type:application/json" \ -d '[{"event":"viewedCart", "timestamp": "2025-04-03T15:42:30Z"},{"event":"cartAbandoned", "timestamp": "2025-04-03T15:42:37Z"}]' \ ``` Once the pipeline successfully accepts the data, you will receive a success message. You can continue posting data to the pipeline. The pipeline will automatically buffer ingested data. Based on the batch settings (`--batch-max-seconds`) specified in step 2, a batch will be generated every 5 seconds, turned into a file, and written out to your R2 bucket. ## 4. Verify in R2 Open the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/overview), and navigate to the R2 bucket you created in step 1. You will see a directory, labeled with today's date (such as `event_date=2025-04-05`). Click on the directory, and you'll see a sub-directory with the current hour (such as `hr=04`). You should see a newline delimited JSON file, containing the data you posted in step 3. Download the file, and open it in a text editor of your choice, to verify that the data posted in step 2 is present. *** ## Next steps * Learn about how to [setup authentication, or CORS settings](/pipelines/build-with-pipelines/sources/http), on your HTTP endpoint. * Send data to your Pipeline from a Cloudflare Worker using the [Workers API documentation](/pipelines/build-with-pipelines/sources/workers-apis). If you have any feature requests or notice any bugs, share your feedback directly with the Cloudflare team by joining the [Cloudflare Developers community on Discord](https://discord.cloudflare.com). --- # Overview URL: https://developers.cloudflare.com/pipelines/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components"; Ingest real time data streams and load into R2, using Cloudflare Pipelines. Cloudflare Pipelines lets you ingest high volumes of real time data, without managing any infrastructure. A single pipeline can ingest up to 100 MB of data per second. Ingested data is automatically batched, written to output files, and delivered to an [R2 bucket](/r2/) in your account. You can use Pipelines to build a data lake of clickstream data, or to store events from a Worker. ## Create your first pipeline You can setup a pipeline to ingest data via HTTP, and deliver output to R2, with a single command: ```sh $ npx wrangler@latest pipelines create my-clickstream-pipeline --r2-bucket my-bucket 🌀 Authorizing R2 bucket "my-bucket" 🌀 Creating pipeline named "my-clickstream-pipeline" ✅ Successfully created pipeline my-clickstream-pipeline Id: 0e00c5ff09b34d018152af98d06f5a1xvc Name: my-clickstream-pipeline Sources: HTTP: Endpoint: https://0e00c5ff09b34d018152af98d06f5a1xvc.pipelines.cloudflare.com/ Authentication: off Format: JSON Worker: Format: JSON Destination: Type: R2 Bucket: my-bucket Format: newline-delimited JSON Compression: GZIP Batch hints: Max bytes: 100 MB Max duration: 300 seconds Max records: 100,000 🎉 You can now send data to your pipeline! Send data to your pipeline's HTTP endpoint: curl "https://0e00c5ff09b34d018152af98d06f5a1xvc.pipelines.cloudflare.com/" -d '[{ ...JSON_DATA... }]' To send data to your pipeline from a Worker, add the following configuration to your config file: { "pipelines": [ { "pipeline": "my-clickstream-pipeline", "binding": "PIPELINE" } ] } ``` Refer to the [getting started guide](/pipelines/getting-started) to start building with pipelines. :::note While in beta, you will not be billed for Pipelines usage. You will be billed only for [R2 usage](/r2/pricing/). ::: *** ## Features Each pipeline generates a globally scalable HTTP endpoint, which supports authentication and CORS settings. Send data to a pipeline directly from a Cloudflare Worker. Define batch sizes and enable compression to generate output files that are efficient to query. *** ## Related products Cloudflare R2 Object Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. Cloudflare Workers allows developers to build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. *** ## More resources Learn about pipelines limits. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. --- # Get started URL: https://developers.cloudflare.com/privacy-gateway/get-started/ Privacy Gateway implementation consists of three main parts: 1. Application Gateway Server/backend configuration (operated by you). 2. Client configuration (operated by you). 3. Connection to a Privacy Gateway Relay Server (operated by Cloudflare). *** ## Before you begin Privacy Gateway is currently in closed beta. If you are interested, [contact us](https://www.cloudflare.com/lp/privacy-edge/). *** ## Step 1 - Configure your server As a customer of the Privacy Gateway, you also need to add server support for OHTTP by implementing an application gateway server. The application gateway is responsible for decrypting incoming requests, forwarding the inner requests to their destination, and encrypting the corresponding response back to the client. The [server implementation](#resources) will handle incoming requests and produce responses, and it will also advertise its public key configuration for clients to access. The public key configuration is generated securely and made available via an API. Refer to the [README](https://github.com/cloudflare/privacy-gateway-server-go#readme) for details about configuration. Applications can also implement this functionality themselves. Details about [public key configuration](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-3), HTTP message [encryption and decryption](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-4), and [server-specific details](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-5) can be found in the OHTTP specification. ### Resources Use the following resources for help with server configuration: * **Go**: * [Sample gateway server](https://github.com/cloudflare/privacy-gateway-server-go) * [Gateway library](https://github.com/chris-wood/ohttp-go) * **Rust**: [Gateway library](https://github.com/martinthomson/ohttp/tree/main/ohttp-server) * **JavaScript / TypeScript**: [Gateway library](https://github.com/chris-wood/ohttp-js) *** ## Step 2 - Configure your client As a customer of the Privacy Gateway, you need to set up client-side support for the gateway. Clients are responsible for encrypting requests, sending them to the Cloudflare Privacy Gateway, and then decrypting the corresponding responses. Additionally, app developers need to [configure the client](#resources-1) to fetch or otherwise discover the gateway’s public key configuration. How this is done depends on how the gateway makes its public key configuration available. If you need help with this configuration, [contact us](https://www.cloudflare.com/lp/privacy-edge/). ### Resources Use the following resources for help with client configuration: * **Objective C**: [Sample application](https://github.com/cloudflare/privacy-gateway-client-demo) * **Rust**: [Client library](https://github.com/martinthomson/ohttp/tree/main/ohttp-client) * **JavaScript / TypeScript**: [Client library](https://github.com/chris-wood/ohttp-js) *** ## Step 3 - Review your application After you have configured your client and server, review your application to make sure you are only sending intended data to Cloudflare and the application backend. In particular, application data should not contain anything unique to an end-user, as this would invalidate the benefits that OHTTP provides. * Applications should scrub identifying user data from requests forwarded through the Privacy Gateway. This includes, for example, names, email addresses, phone numbers, etc. * Applications should encourage users to disable crash reporting when using Privacy Gateway. Crash reports can contain sensitive user information and data, including email addresses. * Where possible, application data should be encrypted on the client device with a key known only to the client. For example, iOS generally has good support for [client-side encryption (and key synchronization via the KeyChain)](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys). Android likely has similar features available. *** ## Step 4 - Relay requests through Cloudflare Before sending any requests, you need to first set up your account with Cloudflare. That requires [contacting us](https://www.cloudflare.com/lp/privacy-edge/) and providing the URL of your application gateway server. Then, make sure you are forwarding requests to a mutually agreed URL with the following conventions. ```txt https://.privacy-gateway.cloudflare.com/ ``` --- # Cloudflare Privacy Gateway URL: https://developers.cloudflare.com/privacy-gateway/ import { Description, Feature, Plan } from "~/components" Implements the Oblivious HTTP IETF standard to improve client privacy. [Privacy Gateway](https://blog.cloudflare.com/building-privacy-into-internet-standards-and-how-to-make-your-app-more-private-today/) is a managed service deployed on Cloudflare’s global network that implements part of the [Oblivious HTTP (OHTTP) IETF](https://www.ietf.org/archive/id/draft-thomson-http-oblivious-01.html) standard. The goal of Privacy Gateway and Oblivious HTTP is to hide the client's IP address when interacting with an application backend. OHTTP introduces a trusted third party between client and server, called a relay, whose purpose is to forward encrypted requests and responses between client and server. These messages are encrypted between client and server such that the relay learns nothing of the application data, beyond the length of the encrypted message and the server the client is interacting with. *** ## Availability Privacy Gateway is currently in closed beta – available to select privacy-oriented companies and partners. If you are interested, [contact us](https://www.cloudflare.com/lp/privacy-edge/). *** ## Features Learn how to set up Privacy Gateway for your application. Learn about the different parties and data shared in Privacy Gateway. Learn about how to query Privacy Gateway metrics. --- # FAQs URL: https://developers.cloudflare.com/pub-sub/faq/ ## What messaging systems are similar? Messaging systems that also implement or strongly align to the "publish-subscribe" model include AWS SNS (Simple Notification Service), Google Cloud Pub/Sub, Redis' PUBLISH-SUBSCRIBE features, and RabbitMQ. If you have used one of these systems before, you will notice that Pub/Sub shares similar foundations (topics, subscriptions, fan-in/fan-out models) and is easy to migrate to. ## How is Pub/Sub priced? Cloudflare is still exploring pricing models for Pub/Sub and will share more with developers prior to GA. Users will be given prior notice and will require beta users to explicitly opt-in. ## Does Pub/Sub show data in the Cloudflare dashboard? Pub/Sub today does not support the Cloudflare dashboard. You can set up Pub/Sub through Wrangler by following [these steps](/pub-sub/guide/). ## Where can I speak with other like-minded developers about Pub/Sub? Try the #pubsub-beta channel on the [Cloudflare Developers Discord](https://discord.com/invite/cloudflaredev). ## What limits does Pub/Sub have? Refer to [Limits](/pub-sub/platform/limits) for more details on client, broker, and topic-based limits. --- # Get started URL: https://developers.cloudflare.com/pub-sub/guide/ import { Render, PackageManagers } from "~/components"; :::note Pub/Sub is currently in private beta. You can [sign up for the waitlist](https://www.cloudflare.com/cloudflare-pub-sub-lightweight-messaging-private-beta/) to register your interest. ::: Pub/Sub is a flexible, scalable messaging service built on top of the MQTT messaging standard, allowing you to publish messages from tens of thousands of devices (or more), deploy code to filter, aggregate and transform messages using Cloudflare Workers, and/or subscribe to topics for fan-out messaging use cases. This guide will: - Instruct you through creating your first Pub/Sub Broker using the Cloudflare API. - Create a `..cloudflarepubsub.com` endpoint ready to publish and subscribe to using any MQTT v5.0 compatible client. - Help you send your first message to the Pub/Sub Broker. Before you begin, you should be familiar with using the command line and running basic terminal commands. ## Prerequisite: Create a Cloudflare account In order to use Pub/Sub, you need a [Cloudflare account](/fundamentals/setup/account/). If you already have an account, you can skip this step. ## 1. Enable Pub/Sub During the Private Beta, your account will need to be explicitly granted access. If you have not, sign up for the waitlist, and we will contact you when you are granted access. ## 2. Install Wrangler (Cloudflare CLI) :::note Pub/Sub support in Wrangler requires wrangler `2.0.16` or above. If you're using an older version of Wrangler, ensure you [update the installed version](/workers/wrangler/install-and-update/#update-wrangler). ::: Installing `wrangler`, the Workers command-line interface (CLI), allows you to [`init`](/workers/wrangler/commands/#init), [`dev`](/workers/wrangler/commands/#dev), and [`publish`](/workers/wrangler/commands/#publish) your Workers projects. To install [`wrangler`](https://github.com/cloudflare/workers-sdk/tree/main/packages/wrangler), ensure you have [`npm` installed](https://docs.npmjs.com/getting-started), preferably using a Node version manager like [Volta](https://volta.sh/) or [nvm](https://github.com/nvm-sh/nvm). Using a version manager helps avoid permission issues and allows you to easily change Node.js versions. Then run: Validate that you have a version of `wrangler` that supports Pub/Sub: ```sh wrangler --version ``` ```sh output 2.0.16 # should show 2.0.16 or greater - e.g. 2.0.17 or 2.1.0 ``` With `wrangler` installed, we can now create a Pub/Sub API token for `wrangler` to use. ## 3. Fetch your credentials To use Wrangler with Pub/Sub, you'll need an API Token that has permissions to both read and write for Pub/Sub. The `wrangler login` flow does not issue you an API Token with valid Pub/Sub permissions. :::note This API token requirement will be lifted prior to Pub/Sub becoming Generally Available. ::: 1. From the [Cloudflare dashboard](https://dash.cloudflare.com), click on the profile icon and select **My Profile**. 2. Under **My Profile**, click **API Tokens**. 3. On the [**API Tokens**](https://dash.cloudflare.com/profile/api-tokens) page, click **Create Token** 4. Choose **Get Started** next to **Create Custom Token** 5. Name the token - e.g. "Pub/Sub Write Access" 6. Under the **Permissions** heading, choose **Account**, select **Pub/Sub** from the first drop-down, and **Edit** as the permission. 7. Select **Add More** below the newly created permission. Choose **User** > **Memberships** from the first dropdown and **Read** as the permission. 8. Select **Continue to Summary** at the bottom of the page, where you should see _All accounts - Pub/Sub:Edit_ as the permission. 9. Select **Create Token** and copy the token value. In your terminal, configure a `CLOUDFLARE_API_TOKEN` environmental variable with your Pub/Sub token. When this variable is set, `wrangler` will use it to authenticate against the Cloudflare API. ```sh export CLOUDFLARE_API_TOKEN="pasteyourtokenhere" ``` :::caution[Warning] This token should be kept secret and not committed to source code or placed in any client-side code. ::: With this environmental variable configured, you can now create your first Pub/Sub Broker! ## 4. Create your first namespace A namespace represents a collection of Pub/Sub Brokers, and they can be used to separate different environments (production vs. staging), infrastructure teams, and in the future, permissions. Before you begin, consider the following: - **Choose your namespace carefully**. Although it can be changed later, it will be used as part of the hostname for your Brokers. You should not use secrets or other data that cannot be exposed on the Internet. - Namespace names are global; they are globally unique. - Namespaces must be valid DNS names per RFC 1035. In most cases, this means only a-z, 0-9, and hyphens are allowed. Names are case-insensitive. For example, a namespace of `my-namespace` and a broker of `staging` would create a hostname of `staging.my-namespace.cloudflarepubsub.com` for clients to connect to. With this in mind, create a new namespace. This example will use `my-namespace` as a placeholder: ```sh wrangler pubsub namespace create my-namespace ``` ```json output { "id": "817170399d784d4ea8b6b90ae558c611", "name": "my-namespace", "description": "", "created_on": "2022-05-11T23:13:08.383232Z", "modified_on": "2022-05-11T23:13:08.383232Z" } ``` If you receive an HTTP 403 (Forbidden) response, check that your credentials are correct and that you have not pasted erroneous spaces or characters. ## 5. Create a broker A broker, in MQTT terms, is a collection of connected clients that publish messages to topics, and clients that subscribe to those topics and receive messages. The broker acts as a relay, and with Cloudflare Pub/Sub, a Cloudflare Worker can be configured to act on every message published to it. This broker will be configured to accept `TOKEN` authentication. In MQTT terms, this is typically defined as username:password authentication. Pub/Sub uses JSON Web Tokens (JWT) that are unique to each client, and that can be revoked, to make authentication more secure. Broker names must be: - Chosen carefully. Although it can be changed later, the name will be used as part of the hostname for your brokers. Do not use secrets or other data that cannot be exposed on the Internet. - Valid DNS names (per RFC 1035). In most cases, this means only `a-z`, `0-9` and hyphens are allowed. Names are case-insensitive. - Unique per namespace. To create a new MQTT Broker called `example-broker` in the `my-namespace` namespace from the example above: ```sh wrangler pubsub broker create example-broker --namespace=my-namespace ``` ```json output { "id": "4c63fa30ee13414ba95be5b56d896fea", "name": "example-broker", "authType": "TOKEN", "created_on": "2022-05-11T23:19:24.356324Z", "modified_on": "2022-05-11T23:19:24.356324Z", "expiration": null, "endpoint": "mqtts://example-broker.namespace.cloudflarepubsub.com:8883" } ``` In the example above, a broker is created with an endpoint of `mqtts://example-broker.my-namespace.cloudflarepubsub.com`. This means: - Our Pub/Sub (MQTT) Broker is reachable over MQTTS (MQTT over TLS) - port 8883 - The hostname is `example-broker.my-namespace.cloudflarepubsub.com` - [Token authentication](/pub-sub/platform/authentication-authorization/) is required to clients to connect. ## 6. Create credentials for your broker In order to connect to a Pub/Sub Broker, you need to securely authenticate. Credentials are scoped to each broker and credentials issued for `broker-a` cannot be used to connect to `broker-b`. Note that: - You can generate multiple credentials at once (up to 100 per API call), which can be useful when configuring multiple clients (such as IoT devices). - Credentials are associated with a specific Client ID and encoded as a signed JSON Web Token (JWT). - Each token has a unique identifier (a `jti` - or `JWT ID`) that you can use to revoke a specific token. - Tokens are prefixed with the broker name they are associate with (for example, `my-broker`) to make identifying tokens across multiple Pub/Sub brokers easier. :::note Ensure you do not commit your credentials to source control, such as GitHub. A valid token allows anyone to connect to your broker and publish or subscribe to messages. Treat credentials as secrets. ::: To generate two tokens for a broker called `example-broker` with a 48 hour expiry: ```sh wrangler pubsub broker issue example-broker --namespace=NAMESPACE_NAME --number=2 --expiration=48h ``` You should receive a success response that resembles the example below, which is a map of Client IDs and their associated tokens. ```json { "01G3A5GBJE5P3GPXJZ72X4X8SA": "eyJhbGciOiJFZERTQSIsImtpZCI6IkpEUHVZSnFIT3Zxemxha2tORlE5a2ZON1dzWXM1dUhuZHBfemlSZG1PQ1UifQ. not-a-real-token.ZZL7PNittVwJOeMpFMn2CnVTgIz4AcaWXP9NqMQK0D_iavcRv_p2DVshg6FPe5xCdlhIzbatT6gMyjMrOA2wBg", "01G3A5GBJECX5DX47P9RV1C5TV": "eyJhbGciOiJFZERTQSIsImtpZCI6IkpEUHVZSnFIT3Zxemxha2tORlE5a2ZON1dzWXM1dUhuZHBfemlSZG1PQ1UifQ.also-not-a-real-token.WrhK-VTs_IzOEALB-T958OojHK5AjYBC5ZT9xiI_6ekdQrKz2kSPGnvZdUXUsTVFDf9Kce1Smh-mw1sF2rSQAQ", } ``` Each token allows you to publish or subscribe to the associated broker. ## 7. Subscribe and publish messages to a topic Your broker is now created and ready to accept messages from authenticated clients. Because Pub/Sub is based on the MQTT protocol, there are client libraries for most popular programming languages. Refer to the list of [recommended client libraries](/pub-sub/learning/client-libraries/). :::note You can view a live demo available at [demo.mqtt.dev](http://demo.mqtt.dev) that allows you to use your own Pub/Sub Broker and a valid token to subscribe to a topic and publish messages to it. The `JWT` field in the demo accepts a valid token from your Broker. ::: The example below uses [MQTT.js](https://github.com/mqttjs/MQTT.js) with Node.js to subscribe to a topic on a broker and publish a very basic "hello world" style message. You will need to have a [supported Node.js](https://nodejs.org/en/download/current/) version installed. ```sh # Check that Node.js is installed which node # Install MQTT.js npm i mqtt --save ``` Set your environment variables. ```sh export CLOUDFLARE_API_TOKEN="YourAPIToken" export CLOUDFLARE_ACCOUNT_ID="YourAccountID" export DEFAULT_NAMESPACE="TheNamespaceYouCreated" export BROKER_NAME="TheBrokerYouCreated" ``` We can now generate an access token for Pub/Sub. We will need both the client ID and the token (a JSON Web Token) itself to authenticate from our MQTT client: ```sh curl -s -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" -H "Content-Type: application/json" "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pubsub/namespaces/namespace/brokers/is-it-broken/credentials?type=TOKEN&topicAcl=#" | jq '.result | to_entries | .[0]' ``` This will output a `key` representing the `clientId`, and a `value` representing our (secret) access token, resembling the following: ```json { "key": "01HDQFD5Y8HWBFGFBBZPSWQ22M", "value": "eyJhbGciOiJFZERTQSIsImtpZCI6IjU1X29UODVqQndJbjlFYnY0V3dzanRucG9ycTBtalFlb1VvbFZRZDIxeEUifQ....NVpToBedVYGGhzHJZmpEG1aG_xPBWrE-PgG1AFYcTPEBpZ_wtN6ApeAUM0JIuJdVMkoIC9mUg4vPtXM8jLGgBw" } ``` Copy the `value` field and set it as the `BROKER_TOKEN` environmental variable: ```sh export BROKER_TOKEN="" ``` Create a file called `index.js `, making sure that: - `brokerEndpoint` is set to the address of your Pub/Sub broker. - `clientId` is the `key` from your newly created access token - The `BROKER_TOKEN` environmental variable populated with your access token. :::note Your `BROKER_TOKEN` is sensitive, and should be kept secret to avoid unintended access to your Pub/Sub broker. Avoid committing it to source code. ::: ```js const mqtt = require("mqtt"); const brokerEndpoint = "mqtts://my-broker.my-namespace.cloudflarepubsub.com"; const clientId = "01HDQFD5Y8HWBFGFBBZPSWQ22M"; // Replace this with your client ID const options = { port: 8883, username: clientId, // MQTT.js requires this, but Pub/Sub does not clientId: clientId, // Required by Pub/Sub password: process.env.BROKER_TOKEN, protocolVersion: 5, // MQTT 5 }; const client = mqtt.connect(brokerEndpoint, options); client.subscribe("example-topic"); client.publish( "example-topic", `message from ${client.options.clientId}: hello at ${Date.now()}`, ); client.on("message", function (topic, message) { console.log(`received message on ${topic}: ${message}`); }); ``` Run the example. You should see the output written to your terminal (stdout). ```sh node index.js ``` ```sh output > received message on example-topic: hello from 01HDQFD5Y8HWBFGFBBZPSWQ22M at 1652102228 ``` Your client ID and timestamp will be different from above, but you should see a very similar message. You can also try subscribing to multiple topics and publishing to them by passing the same topic name to `client.publish`. Provided they have permission to, clients can publish to multiple topics at once or as needed. If you do not see the message you published, or you are receiving error messages, ensure that: - The `BROKER_TOKEN` environmental variable is not empty. Try echo `$BROKER_TOKEN` in your terminal. - You updated the `brokerEndpoint` to match the broker you created. The **Endpoint** field of your broker will show this address and port. - You correctly [installed MQTT.js](https://github.com/mqttjs/MQTT.js#install). ## Next Steps What's next? - [Connect a worker to your broker](/pub-sub/learning/integrate-workers/) to programmatically read, parse, and filter messages as they are published to a broker - [Learn how PubSub and the MQTT protocol work](/pub-sub/learning/how-pubsub-works) - [See example client code](/pub-sub/examples) for publishing or subscribing to a PubSub broker --- # Pub/Sub URL: https://developers.cloudflare.com/pub-sub/ :::note Pub/Sub is currently in private beta. Browse the documentation to understand how Pub/Sub works and integrates with our broader Developer Platform, and [sign up for the waitlist](https://www.cloudflare.com/cloudflare-pub-sub-lightweight-messaging-private-beta/) to get access in the near future. ::: Pub/Sub is Cloudflare's distributed MQTT messaging service. MQTT is one of the most popular messaging protocols used for consuming sensor data from thousands (or tens of thousands) of remote, distributed Internet of Things clients; publishing configuration data or remote commands to fleets of devices in the field; and even for building notification or messaging systems for online games and mobile apps. Pub/Sub is ideal for cases where you have many (from a handful to tens of thousands of) clients sending small, sub-1MB messages — such as event, telemetry or transaction data — into a centralized system for aggregation, or where you need to push configuration updates or remote commands to remote clients at scale. Pub/Sub: * Scales automatically. You do not have to provision "vCPUs" or "memory", or set autoscaling parameters to handle spikes in message rates. * Is global. Cloudflare's Pub/Sub infrastructure runs in [hundreds of cities worldwide](https://www.cloudflare.com/network/). Every edge location is part of one, globally distributed Pub/Sub system. * Is secure by default. Clients must authenticate and connect over TLS, and clients are issued credentials that are scoped to a specific broker. * Allows you to create multiple brokers to isolate clients or use cases, for example, staging vs. production or customers A vs. B vs. C — as needed. Each broker is addressable by a unique DNS hostname. * Integrates with Cloudflare Workers to enable programmable messaging capabilities: parse, filter, aggregate, and re-publish MQTT messages directly from your serverless code. * Supports MQTT v5.0, the most recent version of the MQTT specification, and one of the most ubiquitous messaging protocols in use today. If you are new to the MQTT protocol, visit the [How Pub/Sub works](/pub-sub/learning/how-pubsub-works/) to better understand how MQTT differs from other messaging protocols. --- # Demos and architectures URL: https://developers.cloudflare.com/queues/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector } from "~/components" Learn how you can use Queues within your existing application and architecture. ## Demos Explore the following demo applications for Queues. ## Reference architectures Explore the following reference architectures that use Queues: --- # Getting started URL: https://developers.cloudflare.com/queues/get-started/ import { Render, PackageManagers, WranglerConfig } from "~/components"; Cloudflare Queues is a flexible messaging queue that allows you to queue messages for asynchronous processing. By following this guide, you will create your first queue, a Worker to publish messages to that queue, and a consumer Worker to consume messages from that queue. ## Prerequisites To use Queues, you will need: ## 1. Create a Worker project You will access your queue from a Worker, the producer Worker. You must create at least one producer Worker to publish messages onto your queue. If you are using [R2 Bucket Event Notifications](/r2/buckets/event-notifications/), then you do not need a producer Worker. To create a producer Worker, run: This will create a new directory, which will include both a `src/index.ts` Worker script, and a [`wrangler.jsonc`](/workers/wrangler/configuration/) configuration file. After you create your Worker, you will create a Queue to access. Move into the newly created directory: ```sh cd producer-worker ``` ## 2. Create a queue To use queues, you need to create at least one queue to publish messages to and consume messages from. To create a queue, run: ```sh npx wrangler queues create ``` Choose a name that is descriptive and relates to the types of messages you intend to use this queue for. Descriptive queue names look like: `debug-logs`, `user-clickstream-data`, or `password-reset-prod`. Queue names must be 1 to 63 characters long. Queue names cannot contain special characters outside dashes (`-`), and must start and end with a letter or number. You cannot change your queue name after you have set it. After you create your queue, you will set up your producer Worker to access it. ## 3. Set up your producer Worker To expose your queue to the code inside your Worker, you need to connect your queue to your Worker by creating a binding. [Bindings](/workers/runtime-apis/bindings/) allow your Worker to access resources, such as Queues, on the Cloudflare developer platform. To create a binding, open your newly generated `wrangler.jsonc` file and add the following: ```toml [[queues.producers]] queue = "MY-QUEUE-NAME" binding = "MY_QUEUE" ``` Replace `MY-QUEUE-NAME` with the name of the queue you created in [step 2](/queues/get-started/#2-create-a-queue). Next, replace `MY_QUEUE` with the name you want for your `binding`. The binding must be a valid JavaScript variable name. This is the variable you will use to reference this queue in your Worker. ### Write your producer Worker You will now configure your producer Worker to create messages to publish to your queue. Your producer Worker will: 1. Take a request it receives from the browser. 2. Transform the request to JSON format. 3. Write the request directly to your queue. In your Worker project directory, open the `src` folder and add the following to your `index.ts` file: ```ts null {8} export default { async fetch(request, env, ctx): Promise { let log = { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), }; await env..send(log); return new Response('Success!'); }, } satisfies ExportedHandler; ``` Replace `MY_QUEUE` with the name you have set for your binding from your `wrangler.jsonc` file. Also add the queue to `Env` interface in `index.ts`. ```ts null {2} export interface Env { : Queue; } ``` If this write fails, your Worker will return an error (raise an exception). If this write works, it will return `Success` back with a HTTP `200` status code to the browser. In a production application, you would likely use a [`try...catch`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch) statement to catch the exception and handle it directly (for example, return a custom error or even retry). ### Publish your producer Worker With your Wrangler file and `index.ts` file configured, you are ready to publish your producer Worker. To publish your producer Worker, run: ```sh npx wrangler deploy ``` You should see output that resembles the below, with a `*.workers.dev` URL by default. ``` Uploaded (0.76 sec) Published (0.29 sec) https://..workers.dev ``` Copy your `*.workers.dev` subdomain and paste it into a new browser tab. Refresh the page a few times to start publishing requests to your queue. Your browser should return the `Success` response after writing the request to the queue each time. You have built a queue and a producer Worker to publish messages to the queue. You will now create a consumer Worker to consume the messages published to your queue. Without a consumer Worker, the messages will stay on the queue until they expire, which defaults to four (4) days. ## 4. Create your consumer Worker A consumer Worker receives messages from your queue. When the consumer Worker receives your queue's messages, it can write them to another source, such as a logging console or storage objects. In this guide, you will create a consumer Worker and use it to log and inspect the messages with [`wrangler tail`](/workers/wrangler/commands/#tail). You will create your consumer Worker in the same Worker project that you created your producer Worker. :::note Queues also supports [pull-based consumers](/queues/configuration/pull-consumers/), which allows any HTTP-based client to consume messages from a queue. This guide creates a push-based consumer using Cloudflare Workers. ::: To create a consumer Worker, open your `index.ts` file and add the following `queue` handler to your existing `fetch` handler: ```ts null {11} export default { async fetch(request, env, ctx): Promise { let log = { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), }; await env..send(log); return new Response('Success!'); }, async queue(batch, env): Promise { let messages = JSON.stringify(batch.messages); console.log(`consumed from our queue: ${messages}`); }, } satisfies ExportedHandler; ``` Replace `MY_QUEUE` with the name you have set for your binding from your `wrangler.jsonc` file. Every time messages are published to the queue, your consumer Worker's `queue` handler (`async queue`) is called and it is passed one or more messages. In this example, your consumer Worker transforms the queue's JSON formatted message into a string and logs that output. In a real world application, your consumer Worker can be configured to write messages to object storage (such as [R2](/r2/)), write to a database (like [D1](/d1/)), further process messages before calling an external API (such as an [email API](/workers/tutorials/)) or a data warehouse with your legacy cloud provider. When performing asynchronous tasks from within your consumer handler, use `waitUntil()` to ensure the response of the function is handled. Other asynchronous methods are not supported within the scope of this method. ### Connect the consumer Worker to your queue After you have configured your consumer Worker, you are ready to connect it to your queue. Each queue can only have one consumer Worker connected to it. If you try to connect multiple consumers to the same queue, you will encounter an error when attempting to publish that Worker. To connect your queue to your consumer Worker, open your Wrangler file and add this to the bottom: ```toml [[queues.consumers]] queue = "" # Required: this should match the name of the queue you created in step 3. # If you misspell the name, you will receive an error when attempting to publish your Worker. max_batch_size = 10 # optional: defaults to 10 max_batch_timeout = 5 # optional: defaults to 5 seconds ``` Replace `MY-QUEUE-NAME` with the queue you created in [step 2](/queues/get-started/#2-create-a-queue). In your consumer Worker, you are using queues to auto batch messages using the `max_batch_size` option and the `max_batch_timeout` option. The consumer Worker will receive messages in batches of `10` or every `5` seconds, whichever happens first. `max_batch_size` (defaults to 10) helps to reduce the amount of times your consumer Worker needs to be called. Instead of being called for every message, it will only be called after 10 messages have entered the queue. `max_batch_timeout` (defaults to 5 seconds) helps to reduce wait time. If the producer Worker is not sending up to 10 messages to the queue for the consumer Worker to be called, the consumer Worker will be called every 5 seconds to receive messages that are waiting in the queue. ### Publish your consumer Worker With your Wrangler file and `index.ts` file configured, publish your consumer Worker by running: ```sh npx wrangler deploy ``` ## 5. Read messages from your queue After you set up consumer Worker, you can read messages from the queue. Run `wrangler tail` to start waiting for our consumer to log the messages it receives: ```sh npx wrangler tail ``` With `wrangler tail` running, open the Worker URL you opened in [step 3](/queues/get-started/#3-set-up-your-producer-worker). You should receive a `Success` message in your browser window. If you receive a `Success` message, refresh the URL a few times to generate messages and push them onto the queue. With `wrangler tail` running, your consumer Worker will start logging the requests generated by refreshing. If you refresh less than 10 times, it may take a few seconds for the messages to appear because batch timeout is configured for 10 seconds. After 10 seconds, messages should arrive in your terminal. If you get errors when you refresh, check that the queue name you created in [step 2](/queues/get-started/#2-create-a-queue) and the queue you referenced in your Wrangler file is the same. You should ensure that your producer Worker is returning `Success` and is not returning an error. By completing this guide, you have now created a queue, a producer Worker that publishes messages to that queue, and a consumer Worker that consumes those messages from it. ## Related resources - Learn more about [Cloudflare Workers](/workers/) and the applications you can build on Cloudflare. --- # Glossary URL: https://developers.cloudflare.com/queues/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Queues documentation. --- # Cloudflare Queues URL: https://developers.cloudflare.com/queues/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Send and receive messages with guaranteed delivery and no charges for egress bandwidth. Cloudflare Queues integrate with [Cloudflare Workers](/workers/) and enable you to build applications that can [guarantee delivery](/queues/reference/delivery-guarantees/), [offload work from a request](/queues/reference/how-queues-works/), [send data from Worker to Worker](/queues/configuration/configure-queues/), and [buffer or batch data](/queues/configuration/batching-retries/). *** ## Features Cloudflare Queues allows you to batch, retry and delay messages. Redirect your messages when a delivery failure occurs. Configure pull-based consumers to pull from a queue over HTTP from infrastructure outside of Cloudflare Workers. *** ## Related products Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. Cloudflare Workers allows developers to build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. *** ## More resources Learn about pricing. Learn about Queues limits. Try Cloudflare Queues which can run on your local machine. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Learn how to configure Cloudflare Queues using Wrangler. Learn how to use JavaScript APIs to send and receive messages to a Cloudflare Queue. --- # Pulumi URL: https://developers.cloudflare.com/pulumi/ import { CardGrid, Description, Feature, LinkTitleCard, RelatedProduct } from "~/components" Create, deploy, and manage Cloudflare resources in various programming languages. Provision and manage Cloudflare using infrastructure as code through [Pulumi](https://www.pulumi.com/). With the [Pulumi Cloudflare package](https://www.pulumi.com/registry/packages/cloudflare/), you can build, deploy, and manage Cloudflare resources using standard programming languages (TypeScript, JavaScript, Python, .NET, Java, Go, and YAML). You can define the desired state for your infrastructure in code and leverage language features like loops, functions, classes, and package management. *** ## Features [Pulumi](https://github.com/pulumi/pulumi) is open source and uses the Apache 2.0 license. Use TypeScript, JavaScript, Python, Go, .Net, Java, or YAML to write Pulumi programs. Each language is as capable as the other and supports the entire [Pulumi Registry](https://www.pulumi.com/registry/). *** ## Related products Pulumi Cloud fully manages infrastructure state and secrets, provides rich search capabilities, and more. Pulumi AI is an experimental feature that lets you use natural-language prompts to generate Pulumi infrastructure-as-code programs in any language. Pulumi ESC provides centralized management of environments, secrets, and configurations. *** ## More resources To learn more about Pulumi. Report Pulumi configuration issues via GitHub. --- # Get started URL: https://developers.cloudflare.com/pulumi/installing/ Follow the recommended steps for your operating system below. For official instructions on installing Pulumi and other install options, refer to [Install Pulumi](https://www.pulumi.com/docs/install/). :::note Pulumi is free, open source, and optionally pairs with the [Pulumi Cloud](https://www.pulumi.com/product/pulumi-cloud/) to make managing infrastructure secure, reliable, and hassle-free. ::: :::caution To avoid resource management conflicts, it’s **always** recommended to manage Pulumi-controlled resources via Pulumi. ::: ## Installation ### Mac Install via Homebrew package manager. ```sh brew install pulumi/tap/pulumi ``` ### Linux Use the installation script. ```sh curl -fsSL https://get.pulumi.com | sh ``` ### Windows 1. Download the latest installer from the [Pulumi Repository](https://github.com/pulumi/pulumi-winget/releases/latest) 2. Double click the MSI file and complete the wizard. ## Verify installation To verify your installation, run the following in the terminal: ```sh pulumi version ``` :::note[Note] For upgrades and installation alternatives, refer to [Install Pulumi](https://www.pulumi.com/docs/install/). ::: ## Next steps Follow the [Hello World tutorial](/pulumi/tutorial/hello-world/) to write a simple Pulumi program. It takes about 10 minutes to complete. --- # Getting started URL: https://developers.cloudflare.com/r2/get-started/ import { Render, PackageManagers } from "~/components"; Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services.
## 1. Install and authenticate Wrangler :::note Before you create your first bucket, you must purchase R2 from the Cloudflare dashboard. ::: 1. [Install Wrangler](/workers/wrangler/install-and-update/) within your project using npm and Node.js or Yarn. 2. [Authenticate Wrangler](/workers/wrangler/commands/#login) to enable deployments to Cloudflare. When Wrangler automatically opens your browser to display Cloudflare's consent screen, select **Allow** to send the API Token to Wrangler. ```txt wrangler login ``` ## 2. Create a bucket To create a new R2 bucket from the Cloudflare dashboard: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select **R2**. 2. Select **Create bucket**. 3. Enter a name for the bucket and select **Create bucket**. ## 3. Upload your first object 1. From the **R2** page in the dashboard, locate and select your bucket. 2. Select **Upload**. 3. Choose to either drag and drop your file into the upload area or **select from computer**. You will receive a confirmation message after a successful upload. ## Bucket access options Cloudflare provides multiple ways for developers to access their R2 buckets: - [Workers Runtime API](/r2/api/workers/workers-api-usage/) - [S3 API compatibility](/r2/api/s3/api/) - [Public buckets](/r2/buckets/public-buckets/) --- # Demos and architectures URL: https://developers.cloudflare.com/r2/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector, } from "~/components"; Learn how you can use R2 within your existing application and architecture. ## Demos Explore the following demo applications for R2. ## Reference architectures Explore the following reference architectures that use R2: --- # Cloudflare R2 URL: https://developers.cloudflare.com/r2/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Object storage for all your data. Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. You can use R2 for multiple scenarios, including but not limited to: - Storage for cloud-native applications - Cloud storage for web content - Storage for podcast episodes - Data lakes (analytics and big data) - Cloud storage output for large batch processes, such as machine learning model artifacts or datasets Get started Browse the examples --- ## Features Location Hints are optional parameters you can provide during bucket creation to indicate the primary geographical location you expect data will be accessed from. Configure CORS to interact with objects in your bucket and configure policies on your bucket. Public buckets expose the contents of your R2 bucket directly to the Internet. Create bucket scoped tokens for granular control over who can access your data. --- ## Related products A [serverless](https://www.cloudflare.com/learning/serverless/what-is-serverless/) execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure. Upload, store, encode, and deliver live and on-demand video with one API, without configuring or maintaining infrastructure. A suite of products tailored to your image-processing needs. --- ## More resources Understand pricing for free and paid tier rates. Ask questions, show off what you are building, and discuss the platform with other developers. Learn about product announcements, new tutorials, and what is new in Cloudflare Workers. --- # Pricing URL: https://developers.cloudflare.com/r2/pricing/ import { InlineBadge } from "~/components"; R2 charges based on the total volume of data stored, along with two classes of operations on that data: 1. [Class A operations](#class-a-operations) which are more expensive and tend to mutate state. 2. [Class B operations](#class-b-operations) which tend to read existing state. For the Infrequent Access storage class, [data retrieval](#data-retrieval) fees apply. There are no charges for egress bandwidth for any storage class. All included usage is on a monthly basis. :::note To learn about potential cost savings from using R2, refer to the [R2 pricing calculator](https://r2-calculator.cloudflare.com/). ::: ## R2 pricing | | Standard storage | Infrequent Access storage | | ---------------------------------- | ------------------------ | ------------------------------------------------------- | | Storage | $0.015 / GB-month | $0.01 / GB-month | | Class A Operations | $4.50 / million requests | $9.00 / million requests | | Class B Operations | $0.36 / million requests | $0.90 / million requests | | Data Retrieval (processing) | None | $0.01 / GB | | Egress (data transfer to Internet) | Free [^1] | Free [^1] | ### Free tier You can use the following amount of storage and operations each month for free. The free tier only applies to Standard storage. | | Free | | ---------------------------------- | --------------------------- | | Storage | 10 GB-month / month | | Class A Operations | 1 million requests / month | | Class B Operations | 10 million requests / month | | Egress (data transfer to Internet) | Free [^1] | ### Storage usage Storage is billed using gigabyte-month (GB-month) as the billing metric. A GB-month is calculated by averaging the _peak_ storage per day over a billing period (30 days). For example: - Storing 1 GB constantly for 30 days will be charged as 1 GB-month. - Storing 3 GB constantly for 30 days will be charged as 3 GB-month. - Storing 1 GB for 5 days, then 3 GB for the remaining 25 days will be charged as `1 GB * 5/30 month + 3 GB * 25/30 month = 2.66 GB-month` For objects stored in Infrequent Access storage, you will be charged for the object for the minimum storage duration even if the object was deleted or moved before the duration specified. ### Class A operations Class A Operations include `ListBuckets`, `PutBucket`, `ListObjects`, `PutObject`, `CopyObject`, `CompleteMultipartUpload`, `CreateMultipartUpload`, `LifecycleStorageTierTransition`, `ListMultipartUploads`, `UploadPart`, `UploadPartCopy`, `ListParts`, `PutBucketEncryption`, `PutBucketCors` and `PutBucketLifecycleConfiguration`. ### Class B operations Class B Operations include `HeadBucket`, `HeadObject`, `GetObject`, `UsageSummary`, `GetBucketEncryption`, `GetBucketLocation`, `GetBucketCors` and `GetBucketLifecycleConfiguration`. ### Free operations Free operations include `DeleteObject`, `DeleteBucket` and `AbortMultipartUpload`. ### Data retrieval Data retrieval fees apply when you access or retrieve data from the Infrequent Access storage class. This includes any time objects are read or copied. ### Minimum storage duration For objects stored in Infrequent Access storage, you will be charged for the object for the minimum storage duration even if the object was deleted, moved, or replaced before the specified duration. | Storage class | Minimum storage duration | | ------------------------------------------------------ | ------------------------ | | Standard storage | None | | Infrequent Access storage | 30 days | ## R2 Data Catalog pricing R2 Data Catalog is in **public beta**, and any developer with an [R2 subscription](/r2/pricing/) can start using it. Currently, outside of standard R2 storage and operations, you will not be billed for your use of R2 Data Catalog. We will provide at least 30 days' notice before we make any changes or start charging for usage. To learn more about our thinking on future pricing, refer to the [R2 Data Catalog announcement blog](https://blog.cloudflare.com/r2-data-catalog-public-beta). ## Data migration pricing ### Super Slurper Super Slurper is free to use. You are only charged for the Class A operations that Super Slurper makes to your R2 bucket. Objects with sizes < 100MiB are uploaded to R2 in a single Class A operation. Larger objects use multipart uploads to increase transfer success rates and will perform multiple Class A operations. Note that your source bucket might incur additional charges as Super Slurper copies objects over to R2. Once migration completes, you are charged for storage & Class A/B operations as described in previous sections. ### Sippy Sippy is free to use. You are only charged for the operations Sippy makes to your R2 bucket. If a requested object is not present in R2, Sippy will copy it over from your source bucket. Objects with sizes < 200MiB are uploaded to R2 in a single Class A operation. Larger objects use multipart uploads to increase transfer success rates, and will perform multiple Class A operations. Note that your source bucket might incur additional charges as Sippy copies objects over to R2. As objects are migrated to R2, they are served from R2, and you are charged for storage & Class A/B operations as described in previous sections. ## Pricing calculator To learn about potential cost savings from using R2, refer to the [R2 pricing calculator](https://r2-calculator.cloudflare.com/). ## R2 billing examples ### Data storage example 1 If a user writes 1,000 objects in R2 for 1 month with an average size of 1 GB and requests each 1,000 times per month, the estimated cost for the month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | ------------------------------------------- | ------------ | ----------------- | ---------- | | Class B Operations | (1,000 objects) \* (1,000 reads per object) | 10 million | 0 | $0.00 | | Class A Operations | (1,000 objects) \* (1 write per object) | 1 million | 0 | $0.00 | | Storage | (1,000 objects) \* (1 GB per object) | 10 GB-months | 990 GB-months | $14.85 | | **TOTAL** | | | | **$14.85** | | | | | | | ### Data storage example 2 If a user writes 10 objects in R2 for 1 month with an average size of 1 GB and requests 1,000 times per month, the estimated cost for the month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | ------------------------------------------- | ------------ | ----------------- | --------- | | Class B Operations | (1,000 objects) \* (1,000 reads per object) | 10 million | 0 | $0.00 | | Class A Operations | (1,000 objects) \* (1 write per object) | 1 million | 0 | $0.00 | | Storage | (10 objects) \* (1 GB per object) | 10 GB-months | 0 | $0.00 | | **TOTAL** | | | | **$0.00** | | | | | | | ### Asset hosting If a user writes 100,000 files with an average size of 100 KB object and reads 10,000,000 objects per day, the estimated cost in a month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | --------------------------------------- | ------------ | ----------------- | ----------- | | Class B Operations | (10,000,000 reads per day) \* (30 days) | 10 million | 290,000,000 | $104.40 | | Class A Operations | (100,000 writes) | 1 million | 0 | $0.00 | | Storage | (100,000 objects) \* (100KB per object) | 10 GB-months | 0 GB-months | $0.00 | | **TOTAL** | | | | **$104.40** | | | | | | | ## Cloudflare billing policy To learn more about how usage is billed, refer to [Cloudflare Billing Policy](/billing/billing-policy/). ## Frequently asked questions ### Will I be charged for unauthorized requests to my R2 bucket? No. You are not charged for operations when the caller does not have permission to make the request (HTTP 401 `Unauthorized` response status code). [^1]: Egressing directly from R2, including via the [Workers API](/r2/api/workers/), [S3 API](/r2/api/s3/), and [`r2.dev` domains](/r2/buckets/public-buckets/#enable-managed-public-access) does not incur data transfer (egress) charges and is free. If you connect other metered services to an R2 bucket, you may be charged by those services. --- # Glossary URL: https://developers.cloudflare.com/radar/glossary/ This page provides a list of terms and concepts to help you understand Radar and the information shown. ## AI bot and crawler traffic HTTP request activity from user agents associated with AI assistants, AI data scrapers, and AI search crawlers. This information is normalized to show trends in traffic volume, providing insights into the activity levels of AI-driven web interactions over time. User agents included in this analysis are derived from the AI-focused user agents listed in the [ai.robots.txt](https://github.com/ai-robots-txt/ai.robots.txt) repository. ## Application-level attacks Layer 7 attack information based on mitigated requests, including the most frequent mitigation techniques as well as the trend of mitigated request volume over time. For the "Application layer attack volume" and "Mitigated traffic sources" graphs, the selected location or ASN is the source of the mitigated requests. For the "Application layer attack distribution" graph, the Origin Location graph shows where attacks targeting the selected location are coming from and the Target Location graph shows the target locations of attacks coming from the selected location. "Application layer attack distribution" insights are not available at an ASN level. ## Authentication methods [SPF](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#spf), [DKIM](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#dkim), and [DMARC](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#dmarc) are policy-driven email authentication methods and when used together, they help prevent spammers, phishers, and other unauthorized parties from sending emails on behalf of a domain they do not own. PASS is the share of processed messages that pass the associated checks. FAIL is the share of processed messages that fail the associated checks. NONE is the share of processed messages for which no associated policy could be found. Data for these metrics comes from Cloudflare’s email routing service. ## Autonomous systems The Internet is a network of networks, and autonomous systems are the networks that make up the Internet. More specifically, an autonomous system (AS) is a large network or group of networks that has a unified routing policy - the process by which a path through one or more networks is chosen. Data packets hop from one AS to another until they reach their final destination. Every computer or device that connects to the Internet is connected to an AS. ISPs have one or more ASes, and each AS is assigned an official Autonomous System Number (ASN) for use in Border Gateway Protocol (BGP) routing. For example, Cloudflare's ASN is AS13335. Learn more in the [Cloudflare Learning Center](https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/). ## BGP announcements Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most efficient routes for delivering Internet traffic. A BGP announcement is a way for an AS to say to another, "When you receive traffic to this network prefix, please send it to me". That message is then processed and (possibly) forwarded to other ASes, allowing for every AS in the path to learn where to send traffic to that network prefix. Learn more in the [Cloudflare Learning Center](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/). On Cloudflare Radar, we provide time series charts for both the volume of BGP messages announced by ASes and the total size of their announced IP address space. BGP message volume shows the level of overall routing activity for a given AS, while announced IP address space indicates the size of the networks a given AS operates over time. We represent the IP address space size with the number of minimum routable network prefix sizes, which are the number of /24 prefixes for IPv4 and /48s for IPv6. Correspondingly, a /24 prefix represents 256 IP addresses while a /48 represents 2^80 IP addresses. ## BGP route leaks [BGP route leaks](https://www.rfc-editor.org/rfc/rfc7908.html) are defined as the propagation of routing announcements beyond their intended scope. In Cloudflare Radar, you can inspect the detected route leak events on the corresponding autonomous system number (ASN) pages. The columns in the table are defined as follows: * `From`: The autonomous system (AS) from which the routes are learned from. * `By`: The AS that leaked the routes, or the leaker. * `To`: The AS that received and propagated the leaked routes. * `Start` and `End`: The starting and ending time of a route leak event. * `BGP Msgs.`: The number of BGP announcements that contain leaked routes. * `Prefixes`: The number of IP prefixes a route leak event affects. * `Origins`: The number of origin ASes a route leak event affects. * `Vantage Points`: The number of route collectors that observed a route leak event. Learn more about our route leak detection system design and usages in [How we detect route leaks and our new Cloudflare Radar route leak service](https://blog.cloudflare.com/route-leak-detection-with-cloudflare-radar/) blog post. ## BGP origin hijacks [BGP origin hijack](https://www.cloudflare.com/learning/security/glossary/bgp-hijacking/) is one type of BGP anomaly where networks falsely announce ownership for groups of IP addresses (prefixes) that they do not own, control, or route to. A BGP origin hijack can redirect Internet traffic to the hijacker from its legitimate destination, causing data loss with potential leak of private/confidential information. In Cloudflare Radar, you can inspect the detected BGP origin hijack events in the "BGP Origin Hijacks" table. The columns of the table are defined as follows: * `ID`: Event ID, clickable and navigates to the event details page. * `Detected Origin`: The AS that originated the prefixes at the time of detection, potentially being a BGP hijacker. * `Expected Origin(s)`: The AS(es) that are expected to originate the corresponding prefixes based on various evidences. * `Start Time (UTC)` and `Duration`: The detected timestamp in UTC with a human-readable time duration for how long the event lasted. Ongoing events will not have a duration value, indicated by the `--` sign. * `BGP Messages`: The number of BGP messages that contain the detected anomaly. * `Prefixes`: The prefixes hijacked during the event, showing only one full prefix due to table space limitation. * `Confidence`: The level of confidence that we have on the event being a true hijacks. Values can be `High`, `Medium`, or `Low`. * `Tags`: The relevant evidence presented as short tags, presenting key facts we compiled using additional data sources, such as RPKI validation results or network relationship. You can also access the detection result programmatically via our [public API](/api/resources/radar/subresources/bgp/subresources/hijacks/subresources/events/methods/list/) ([CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/) license). ## Certificates Encryption is a critical part of a safe Internet. SSL/TLS is the standard security technology for establishing an encrypted link between a client and a server. In Cloudflare Radar, you can view all certificates issued for a given domain by a trusted Certificate Authority that are listed in active certificate transparency logs. You can review the certificates issued for your domain name to ensure that there have been no incorrect or fraudulent issuances of certificates associated with your domains. You can also sign up to receive alerts from our certificate transparency monitor in the [Cloudflare Dashboard](https://dash.cloudflare.com/). ## Connection characteristics Share of inbound connections to Cloudflare from mail transfer agents with the given characteristics. “IP Version” breaks down connections made over IPv4 and IPv6. “Encryption” breaks down connections made over an encrypted connection using TLS, and those made over an unencrypted connection, in the clear. Data for these metrics comes from Cloudflare’s email routing service. ## Connection quality Connection quality metrics include download and upload speed, latency (round-trip time), and latency jitter (round-trip time stability), reflecting the best expected performance for specific countries or ASNs. These metrics are derived from speed tests initiated by end users on the [Cloudflare Speed Test website](https://speed.cloudflare.com/), aggregated over the previous 90 days. The underlying raw data is freely accessible for analysis through [Measurement Lab's BigQuery](https://blog.cloudflare.com/aim-database-for-internet-quality/). In speed, latency, and jitter rankings, only countries where users run speed tests with sufficient regularity are included. Consequently, certain countries may be excluded from the rankings, even though their data can be found in other sections of Radar. Cloudflare Speed Test measures latency multiple times over the course of the test. Measurements taken before a download or upload begins are aggregated into idle latency and jitter, while measurements taken while a download or upload is in progress are aggregated as loaded latency and jitter. ## Content categories Cloudflare uses a variety of data sources to categorize domains. Using Cloudflare Radar, you can view the content categories associated with a given domain. Cloudflare customers using Cloudflare Gateway or [1.1.1.1 for Families](/1.1.1.1/setup/#1111-for-families) can decide to block certain categories, like "Adult Content", in addition to security threats like malware and phishing. In some cases, a domain may be miscategorized. For example, a social media site might be categorized as "Shopping & Auctions". If you believe a domain is miscategorized, or a domain has not yet been categorized, please provide your suggested category using [this form](https://radar.cloudflare.com/domains/feedback) to bring it to our attention. ## DNS The [Domain Name System (DNS)](https://www.cloudflare.com/learning/dns/what-is-dns/) is a network service that is most commonly used to translate human-readable domain names into numerical IP addresses that computers can use to talk to each other. It is an essential Internet service, and is also used to look up other network-related information. The data displayed on Radar for DNS is based on aggregated and anonymized DNS lookups to Cloudflare's [1.1.1.1](/1.1.1.1/) public resolver service. ## Domain rankings Domain Rankings is based on our anonymized and aggregated [1.1.1.1 DNS resolver](/1.1.1.1/) data, complies with our [privacy policy](https://www.cloudflare.com/en-gb/privacypolicy/), and aims to identify the top most popular domains that reflect how people use the Internet globally. Domain Rankings’ popularity metric is best described as the estimated number of unique users that access a domain over some period of time. Trending domains are domains which are currently experiencing an increase in popularity. Domains Trending Today are domains spiking in popularity, reflecting increased interest potentially related to a particular event or a topic. Domains Trending This Week are domains that have steadily grown in popularity, reflecting an increase of their user base over the week. ## Geographical distribution Countries contributing traffic to this AS, and their relative contribution as percentage of the total AS traffic seen by Cloudflare. ## Internet outages Internet connectivity can experience outages or disruptions due to a number of factors. These factors include power outages, damage to fiber optic cables, severe weather, natural disasters, or government directed shutdowns. Outages may be sub-national or national in geographic scope, or may impact one or more [ASNs](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-an-autonomous-system/). Some outages may be brief, lasting just a few minutes, while others can stretch on for months — the duration can be related, in part, to the underlying cause. Internet outages listed in the Cloudflare Radar Outage Center are notable drops in traffic that have generally been corroborated with third party-information, which may include a social media or status page post from a telecommunications provider, a news report, or industry/community mailing lists. An early warning signal that an Internet outage may be underway on a given network or in a given country is an anomalous drop in traffic as compared to historical traffic patterns and trends. Internet anomalies listed in the Cloudflare Radar Outage Center represent an algorithmically-observed anomalous drop in traffic for the listed entity. If a given entry is marked as verified, it means that we have manually corroborated the observed drop in traffic across multiple Cloudflare data sources and/or third-party sources such as [IODA](https://ioda.inetintel.cc.gatech.edu/), or third-party sources of information, such as those listed above. In the case of the latter, an associated Internet outage event will be opened, with the event listed in the Internet Outages table (and API). ## Internet services ranking Internet services ranking is based on our anonymized and aggregated [1.1.1.1 DNS resolver](/1.1.1.1/) data, complies with our [privacy policy](https://www.cloudflare.com/en-gb/privacypolicy/), and aims to identify the top most popular Internet services that reflect how people use the Internet globally. A service represents one or more domains aggregated together. Ranking popularity metric is best described as the estimated number of unique users that access domains associated with a service, over some period of time. ## Internet traffic trends Trends observed in Internet traffic originating globally or within a given location or autonomous system within the selected time range, based on aggregated data from our network. ## IP address geolocation IP address geolocation is the term used for the process of associating an IP address with a location in the physical world. IP geolocation used on Cloudflare Radar comes from a third-party database. Note that a number of factors may affect the accuracy of the geolocation information, including mobile network architecture, the use of VPN services, and the use of privacy-protecting proxy services. Learn more from [MaxMind](https://www.maxmind.com/en/geoip-data-correction-request) about how to suggest a correction if you believe the location provided is incorrect. ## IPv6 adoption The IPv4 vs. IPv6 graph shows the distribution of traffic by IP version, and is intended to highlight IPv6 adoption trends. Note that prior to January 23, 2023, the IPv6 percentage shown in the chart was calculated as (IPv6 requests / IPv4+IPv6 requests). After that date, the IPv6 percentage is calculated as (IPv6 requests / requests for dual-stacked content). ## IQI The Internet Quality Index estimates connection performance under average utilization, such as web browsing. It is based on end user measurements against a fixed set of Cloudflare and third-party targets, providing numbers for bandwidth, round-trip time (latency), and DNS response time, aggregated by continent, country, or ASN. The IQI methodology requires a minimum number of measurements to generate estimates. As a result, graphs for smaller countries and ASNs may display occasional gaps, especially during nighttime. These gaps do not indicate outages. The number of measurements underlying IQI does not necessarily correlate with the volume of traffic observed by Cloudflare in a specific country or ASN. ## Leaked credentials [Leaked credentials detection](/waf/detections/leaked-credentials/) scans incoming HTTP requests for known authentication patterns from common web apps and any custom detection locations that were configured. Cloudflare Radar provides visibility into aggregate trends in authentication requests, including the detection of leaked credentials. ## Mobile operating systems The Mobile Operating Systems graph shows the distribution of mobile device requests by operating system, representing trends observed in Internet traffic originating globally or within a given location or autonomous system within the selected time range, based on aggregated data from our network. "Mobile device" includes phones and tablets only, and does not include other types of devices, such as those classified as desktops/laptops, smart TVs, or gaming consoles. ## Most observed TLDs [Top-level domains, also known as TLDs](https://www.cloudflare.com/learning/dns/top-level-domain/), are found in the right-most portion of a hostname. As of February 2024, there are nearly 1600 Top Level Domains listed in the [IANA Root Zone Database](https://www.iana.org/domains/root/db). On Radar, we are sharing our own perspective on these TLDs, highlighting those with the largest shares of spam and malicious emails. The analysis is based on the sending domain’s TLD, found in the `From:` header of an email message. Data for this metric comes from Cloudflare’s cloud email security service. ## Network-level DDoS attacks Attacks mitigated by our Level 3 and 4 Denial of Service Attack prevention systems. We show the most used attack vectors as well as the change in attack volume over the selected time range. Selected location is the location of the data center(s) where the attacks were mitigated. Target industry and vertical categories are associated with the customers being attacked. Industry categories include business types grouped by their primary activities, such as information technology and services, retail, or telecommunications. Vertical categories are high-level groupings that incorporate related industries, such as the "Internet and Telecom" vertical, which includes industries such as "Internet" and "Telecommunications". Network-level DDoS attacks graphs are based on traffic measured in bytes. ## Post-quantum encryption adoption The Post-Quantum Encryption Adoption graph shows the share of HTTPS requests to Cloudflare that are encrypted with post-quantum (PQ) cryptography. Additional details about Cloudflare's support for PQ cryptography can be found at [Cloudflare Research](https://pq.cloudflareresearch.com/). ## Robots.txt A [robots.txt](https://www.cloudflare.com/learning/bots/what-is-robots-txt/) file contains instructions for bots that tell them which webpages they can and cannot access. The data displayed for robots.txt is based on successfully parsed robots.txt files from the top 10,000 domains. From these files, we count the occurrences of each user agent under the `Allow` and `Disallow` directives. A user agent is classified as "fully allowed" or "fully disallowed" if the directive value is `*`. Otherwise, if the user agent is only allowed or disallowed to crawl specific paths, it is classified as "partially allowed" or "partially disallowed." Currently, we only include AI-focused user agents listed in the [ai.robots.txt](https://github.com/ai-robots-txt/ai.robots.txt) repository. ## TCP resets and timeouts In the Transmission Control Protocol (TCP), client-initiated connection resets (via the RST flag, TCP's "panic button") are atypical, and indicate to the server that *something went wrong* requiring the connection to be closed immediately. Similarly, connection timeouts (where the server closes a connection due to an unresponsive client) should not happen in conventional data exchanges. For comparison, a typical TCP connection consists of a 3-way handshake initiated by a client with a SYN packet to the server, then a data exchange moderated with ACK and PSH flags in the data packets, and finally a graceful close initiated from either side with a FIN packet. A FIN close is considered graceful because it ensures both sides complete their data transfer before closing the connection. In contrast, a timeout or RST flag triggers a hard stop, even if data is waiting to be sent or acknowledged. See [RFC 9293](https://datatracker.ietf.org/doc/html/rfc9293) for more details on the TCP protocol. A TCP server may see timed-out or reset connections for a variety of reasons. Some are benign, such as client applications that lose connectivity or abruptly shut down (e.g., browsers cleaning up closed tabs or port scanners). Others are more concerning, such as [DoS attacks](https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/) or third-party interference. In some cases, a close examination of the packets in a connection can help to shed light on the reason for termination. For example, [Global, Passive Detection of Connection Tampering](https://research.cloudflare.com/publications/SundaraRaman2023/) finds that certain packet patterns can be linked to middlebox connection tampering. On Cloudflare Radar’s [Security & Attacks page](https://radar.cloudflare.com/security-and-attacks), you can view statistics on resets and timeouts from a sample of TCP connections to Cloudflare’s servers, broken down by how far the connection progressed before termination. The plot lines are defined as follows: * **Post-SYN (mid-handshake)**: Connection resets or timeouts after the server received only a single SYN packet. * **Post-ACK (immediately post-handshake)**: Connection resets or timeouts after the server received both a SYN packet and an ACK packet, meaning the connection was successfully established. * **Post-PSH (after first data packet)**: Connection resets or timeouts after the server received a packet with PSH flag set, following connection establishment. The PSH flag indicates that the TCP packet contains data (such as a TLS Client Hello message) ready to deliver to the application. * **Later (after multiple data packets)**: Connection resets within the first 10 packets from the client, but after the server has received multiple data packets. * **None**: All other connections. Learn more about the TCP resets and timeouts dataset in our [blog post](https://blog.cloudflare.com/tcp-resets-timeouts). ## Threat categories Attackers use multiple types of techniques when carrying out email-based attacks, including links or attachments leading to malware; identity deception, where the message appears to be coming from a trusted contact; and brand impersonation, where the message appears to be coming from a trusted brand. Categories are assigned to the various types of threats found during the analysis of a malicious email message, and a single message can have multiple categories. These categories are aggregated into “Link”, “Attachment”, “Impersonation”, and “Other” groupings. “Link” groups individual threat types where the attacker is trying to get the user to click on something, “Attachment” groups individual threat types where the attacker has attached a file to the email message, and “Impersonation” groups individual threat types where the attacker is impersonating a trusted brand or contact. The “Other” grouping includes other threat types not covered by the previous three. The percentages represent the share of malicious email messages where the given threat categories have been found. Data for this metric comes from Cloudflare’s cloud email security service. ## Threat classification Malicious email messages may be part of a phishing campaign, where recipients are tricked into sharing personal information like login details, or they are an attempt to spread malware through embedded images, links, or attachments. The percentage shown represents the share of processed messages that are classified as malicious. Data for this metric comes from Cloudflare’s cloud email security service. ## Traffic type filter * **Human Only Traffic**: Traffic that our algorithms determine as being generated by human activity. * **Automated Only Traffic**: Traffic that our algorithms determine as being generated by bot or automated script activity. * **All Traffic**: Use all traffic, which includes both human activity and automated activity. ## Trends Based on the aggregated HTTP/s metadata we see, we are able to show trends about a diverse set of metrics, including the distribution of mobile device vs. desktop traffic, the percentage of traffic detected as coming from bots, and the distribution of user agents/browsers. We also provide insights into the usage of HTTPS and IPv6. ## Verified bots Bot traffic describes any non-human traffic to a website or an app. Some bots are useful, such as search engine bots that index content for search or customer service bots that help users. Other bots may be used to perform malicious activities, such as break into user accounts or scan the web for contact information to send spam. Verified bots, such as the ones from search engines, are usually transparent about who they are. Cloudflare manually approves well-behaved services that benefit the broader Internet and honor robots.txt. Each entry on the Verified Bots list exists because a corresponding IP address was seen associated with a verified bot in the last 30 days. A verified bot is not necessarily good or bad. ## Visitor location The data displayed on domain-specific geographic traffic patterns is based solely on data from our recursive DNS services. All data displayed is in accordance with our privacy policies and commitments. This data may include attack traffic and cross-origin requests. ## WHOIS WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar's WHOIS service to reveal the data behind a given domain. ## Workers AI [Workers AI](/workers-ai/) allows you to run machine learning models, on the Cloudflare network, from your own code -- whether that be from Workers, Pages, or anywhere via the Cloudflare API. The data displayed for Workers AI is based on the number of Cloudflare accounts using a model during a specific time interval. --- # Cloudflare Radar URL: https://developers.cloudflare.com/radar/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Plan, } from "~/components"; Get access to Cloudflare's data on global Internet traffic. [Cloudflare Radar](https://radar.cloudflare.com) is a hub that showcases global Internet traffic, attacks, and technology trends and insights. It is powered by data from [Cloudflare’s global network](https://www.cloudflare.com/network/), as well as aggregated and [anonymized data](/1.1.1.1/privacy/public-dns-resolver/) from Cloudflare’s [1.1.1.1 public DNS resolver](/1.1.1.1/). Using [Radar's API](/api/resources/radar/) you can access Cloudflare's data on global Internet traffic. Radar's API is free, allowing academics, technology professionals, and other web enthusiasts to investigate Internet usage across the globe. Data available via Radar API endpoints is made available under the [CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/) license. Get started Radar website --- ## Features Start learning how to use Radar's API by making your first request. What to know before making comparisons between locations, [autonomous systems](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-an-autonomous-system/), and more. Understand the security, performance, technology, and network details of a URL with a publicly shareable report. --- ## More resources Explore the diverse data available in Cloudflare Radar, including NetFlows, HTTP requests, DNS queries, and much more. Follow @CloudflareRadar on X to learn about Internet trends, as seen by the Cloudflare global network. Follow @cloudflareradar on Mastodon to learn about Internet trends, as seen by the Cloudflare global network. Follow @radar.cloudflare.com on Bluesky to learn about Internet trends, as seen by the Cloudflare global network. Read articles about the latest trends and updates on Cloudflare Radar. Enable any MCP client to access and explore trends and insights on Cloudflare Radar. --- # Release notes URL: https://developers.cloudflare.com/radar/release-notes/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Cloudflare Randomness Beacon URL: https://developers.cloudflare.com/randomness-beacon/ drand (pronounced "dee-rand") is a distributed randomness beacon daemon written in Golang. Servers running drand can be linked to each other to produce collective, publicly verifiable, unbiased, unpredictable random values at fixed intervals using bilinear pairings and threshold cryptography. drand is meant to be an Internet infrastructure level service that provides randomness to applications, similar to how NTP provides timing information and Certificate Transparency Logs provide certificate issuance information. For the most up-to-date documentation on drand, please visit [drand.love](https://drand.love). --- # Find by solution URL: https://developers.cloudflare.com/reference-architecture/by-solution/ import { CardGrid, LinkTitleCard, Render } from "~/components"; Use the list below for reference architecture documentation that relates to a solution area you are interested in. ### Cloudflare Connectivity Cloud Content that pertains to the Cloudflare platform in general. #### Reference architectures - [Cloudflare security reference architecture](/reference-architecture/architectures/security/) - [Multi-vendor Application Security and Performance Reference Architecture](/reference-architecture/architectures/multi-vendor/) - [Protect network infrastructure with Magic Transit](/reference-architecture/architectures/magic-transit/) - [Protect Hybrid Cloud Networks with Cloudflare Magic Transit](/reference-architecture/diagrams/network/protect-hybrid-cloud-networks-with-cloudflare-magic-transit/) #### Reference architecture diagrams - [Protecting ISP and telecommunications networks from DDoS attacks](/reference-architecture/diagrams/network/protecting-sp-networks-from-ddos/) #### Design guides - [Extend Cloudflare's Benefits to SaaS Providers' End-Customers](/reference-architecture/design-guides/extending-cloudflares-benefits-to-saas-providers-end-customers/) ### Zero Trust / SASE Architecture documentation related to using Cloudflare for Zero Trust, SSE and SASE initiatives for protecting your applications, data, employees and the corporate network. #### Reference architectures - [Evolving to a SASE architecture with Cloudflare](/reference-architecture/architectures/sase/) - [Using Cloudflare SASE with Microsoft](/reference-architecture/architectures/cloudflare-sase-with-microsoft/) #### Reference architecture diagrams - [Access to private apps without having to deploy client agents](/reference-architecture/diagrams/sase/sase-clientless-access-private-dns/) - [Securing data at rest](/reference-architecture/diagrams/security/securing-data-at-rest/) - [Securing data in transit](/reference-architecture/diagrams/security/securing-data-in-transit/) - [Securing data in use](/reference-architecture/diagrams/security/securing-data-in-use/) - [Extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/) - [DNS filtering solution for Internet service providers](/reference-architecture/diagrams/sase/gateway-dns-for-isp/) - [Magic WAN Connector deployment options](/reference-architecture/diagrams/sase/magic-wan-connector-deployment/) - [Deploy self-hosted VoIP services for hybrid users](/reference-architecture/diagrams/sase/deploying-self-hosted-voip-services-for-hybrid-users/) #### Design guides - [Designing ZTNA access policies for Cloudflare Access](/reference-architecture/design-guides/designing-ztna-access-policies/) - [Building zero trust architecture into your startup](/reference-architecture/design-guides/zero-trust-for-startups/) - [Network-focused migration from VPN concentrators to Zero Trust Network Access](/reference-architecture/design-guides/network-vpn-migration/) - [Using a zero trust framework to secure SaaS applications](/reference-architecture/design-guides/zero-trust-for-saas/) #### Implementation guides - [Secure your Internet traffic and SaaS apps](/learning-paths/secure-internet-traffic/concepts/) - [Replace your VPN](/learning-paths/replace-vpn/concepts/) - [Deploy clientless access](/learning-paths/clientless-access/concepts/) - [Secure Microsoft 365 email with Email Security](/learning-paths/secure-o365-email/concepts/) ### Networking #### Reference architecture diagrams - [Protect public networks with Cloudflare](/reference-architecture/diagrams/network/protect-public-networks-with-cloudflare/) - [Bring your own IP space to Cloudflare](/reference-architecture/diagrams/network/bring-your-own-ip-space-to-cloudflare/) - [Protect hybrid cloud networks with Cloudflare Magic Transit](/reference-architecture/diagrams/network/protect-hybrid-cloud-networks-with-cloudflare-magic-transit/) - [Protect ISP and telecommunications networks from DDoS attacks](/reference-architecture/diagrams/network/protecting-sp-networks-from-ddos/) ### Application Performance Content related to DNS, caching, load balancing and other Cloudflare services designed to improve application reliability and performance. #### Reference architectures - [Content Delivery Network](/reference-architecture/architectures/cdn/) - [Load Balancing](/reference-architecture/architectures/load-balancing/) ### Application Security Content related to protecting your applications from threats such as DDoS attack, SQL injection, exploiting application vulnerabilities, scraping API data and more. #### Reference architecture diagrams - [Bot management](/reference-architecture/diagrams/bots/bot-management/) #### Design guides - [Secure application delivery](/reference-architecture/design-guides/secure-application-delivery/) #### Implementation guides - [Use mTLS with Cloudflare protected resources](/learning-paths/mtls/concepts/) ### Developer Platform Architecture content for our developer platform. #### Reference architecture diagrams ##### AI - [Automatic captioning for video uploads](/reference-architecture/diagrams/ai/ai-video-caption/) - [Composable AI architecture](/reference-architecture/diagrams/ai/ai-composable/) - [Content-based asset creation](/reference-architecture/diagrams/ai/ai-asset-creation/) - [Multi-vendor AI observability and control](/reference-architecture/diagrams/ai/ai-multivendor-observability-control/) - [Retrieval Augmented Generation (RAG)](/reference-architecture/diagrams/ai/ai-rag/) - [Ingesting BigQuery Data into Workers AI](/reference-architecture/diagrams/ai/bigquery-workers-ai/) ##### Serverless - [Optimizing Image Delivery with Cloudflare Image Resizing and R2](/reference-architecture/diagrams/content-delivery/optimizing-image-delivery-with-cloudflare-image-resizing-and-r2/) - [A/B-testing using Workers](/reference-architecture/diagrams/serverless/a-b-testing-using-workers/) - [Fullstack Applications](/reference-architecture/diagrams/serverless/fullstack-application/) - [Serverless ETL pipelines](/reference-architecture/diagrams/serverless/serverless-etl/) - [Serverless global APIs](/reference-architecture/diagrams/serverless/serverless-global-apis/) - [Serverless image content management](/reference-architecture/diagrams/serverless/serverless-image-content-management/) ##### Storage - [Egress-free object storage in multi-cloud setups](/reference-architecture/diagrams/storage/egress-free-storage-multi-cloud/) - [On-demand Object Storage Data Migration](/reference-architecture/diagrams/storage/on-demand-object-storage-migration/) - [Event notifications for storage](/reference-architecture/diagrams/storage/event-notifications-for-storage/) - [Storing User Generated Content](/reference-architecture/diagrams/storage/storing-user-generated-content/) --- # How to use URL: https://developers.cloudflare.com/reference-architecture/how-to-use/ import { CardGrid, Description, LinkTitleCard, Render } from "~/components"; The reference architecture content in our documentation is designed to help you understand how Cloudflare has been designed and built, and how our products and services integrate with your current IT architecture. Below are the different types of architecture content and information is organized from high level reference architectures, to design guides with best practices and guidelines to implementation guides which provide detailed steps to deploy a specific solution. ## Reference architectures [Reference architectures](/reference-architecture/architectures/) provide a foundational knowledge of the Cloudflare platform and products while offering a description for how they relate to your existing infrastructure and business challenges. They are high-level, conceptual documents that walk through the concepts of an area of our platform, mapping our network, products and features to the typical architecture of a customer's environment. Detailed diagrams with supporting content explain how our technology works and how it can be integrated with your own infrastructure. The goal of a reference architecture is: - Present thought leadership for a broad technology area - Visualize the architecture of Cloudflare and understand how it's been designed - Explain integration points between Cloudflare and your infrastructure ## Reference architecture diagrams A [reference architecture diagram](/reference-architecture/diagrams/) focusses on a specific solution or use case where Cloudflare can be used. One or more diagrams are the primary content with supporting introduction and summary. These can focus on sections from a reference architecture that are not fully developed. The goal of this type of document is: - Visualize the components of a specific solution's architecture - Provide a quick answer to a specific question around a use case ## Design guides These [guides](/reference-architecture/design-guides/) are typically aimed at architects, developers, and IT professionals who are tasked with designing and deploying systems that leverage the company's technologies. They typically focus on a specific solution that would be a subset of the greater architecture. For example, if you have read our [SASE Reference Architecture](/reference-architecture/architectures/sase/), but are a startup, you may want to understand the details of using a [SASE approach for a small startup](/reference-architecture/design-guides/zero-trust-for-startups/). These documents are: - Helping you think through how to design a deployment of Cloudflare as part of an overall solution. - More prescriptive than reference architectures, sharing best practices and guidelines. - Focused on a solution design that you are trying to achieve, such as connecting private networks to Cloudflare, or using a web application firewall to secure a public website. - Not a replacement for product documentation and do not describe specific product configuration or commands to run. ## Implementation guides Implementation guides provide [step-by-step instructions](/reference-architecture/implementation-guides/) and practical guidance for how to effectively deploy and configure specific solutions or services. Implementation guides are focused on a specific implementation goal. While a design guide provides the overall best practices for designing a solution, an implementation guide details the actual steps to deploy in the context of a specific job-to-be-done. These documents are: - Focused on a specific implementation outcome, such as connecting a remote office using the Magic WAN Connector. - Provide information about the exact commands and configuration steps to take. --- # Reference Architectures URL: https://developers.cloudflare.com/reference-architecture/ import { CardGrid, Description, LinkTitleCard, Render, DirectoryListing, } from "~/components"; ![Hero image](~/assets/images/reference-architecture/reference-architecture-hero.svg) All the documents in this section are designed to help you understand how Cloudflare and its products are designed and architected. These documents describe how you can leverage our platform to create solutions based on your business needs. No matter if you know Cloudflare well, or if you are just starting out. These documents help you understand how our connectivity cloud is architectured and how the services can be integrated with your own infrastructure. Read [How to use](/reference-architecture/how-to-use/) to understand how the documentation is structured, and either navigate by type from the menu or [find by solution](/reference-architecture/by-solution/) area. --- ## More resources Read articles and announcements about the latest Cloudflare products and features. Module-based guidance on Cloudflare product workflows. --- # Realtime vs Regular SFUs URL: https://developers.cloudflare.com/realtime/calls-vs-sfus/ ## Cloudflare Realtime vs. Traditional SFUs Cloudflare Realtime represents a paradigm shift in building real-time applications by leveraging a distributed real-time data plane. It creates a seamless experience in real-time communication, transcending traditional geographical limitations and scalability concerns. Realtime is designed for developers looking to integrate WebRTC functionalities in a server-client architecture without delving deep into the complexities of regional scaling or server management. ### The Limitations of Centralized SFUs Selective Forwarding Units (SFUs) play a critical role in managing WebRTC connections by selectively forwarding media streams to participants in a video call. However, their centralized nature introduces inherent limitations: - **Regional Dependency:** A centralized SFU requires a specific region for deployment, leading to latency issues for global users except for those in proximity to the selected region. - **Scalability Concerns:** Scaling a centralized SFU to meet global demand can be challenging and inefficient, often requiring additional infrastructure and complexity. ### How is Cloudflare Realtime different? Cloudflare Realtime addresses these limitations by leveraging Cloudflare's global network infrastructure: - **Global Distribution Without Regions:** Unlike traditional SFUs, Cloudflare Realtime operates on a global scale without regional constraints. It utilizes Cloudflare's extensive network of over 250 locations worldwide to ensure low-latency video forwarding, making it fast and efficient for users globally. - **Decentralized Architecture:** There are no dedicated servers for Realtime. Every server within Cloudflare's network contributes to handling Realtime, ensuring scalability and reliability. This approach mirrors the distributed nature of Cloudflare's products such as 1.1.1.1 DNS or Cloudflare's CDN. ## How Cloudflare Realtime Works ### Establishing Peer Connections To initiate a real-time communication session, an end user's client establishes a WebRTC PeerConnection to the nearest Cloudflare location. This connection benefits from anycast routing, optimizing for the lowest possible latency. ### Signaling and Media Stream Management - **HTTPS API for Signaling:** Cloudflare Realtime simplifies signaling with a straightforward HTTPS API. This API manages the initiation and coordination of media streams, enabling clients to push new MediaStreamTracks or request these tracks from the server. - **Efficient Media Handling:** Unlike traditional approaches that require multiple connections for different media streams from different clients, Cloudflare Realtime maintains a single PeerConnection per client. This streamlined process reduces complexity and improves performance by handling both the push and pull of media through a singular connection. ### Application-Level Management Cloudflare Realtime delegates the responsibility of state management and participant tracking to the application layer. Developers are empowered to design their logic for handling events such as participant joins or media stream updates, offering flexibility to create tailored experiences in applications. ## Getting Started with Cloudflare Realtime Integrating Cloudflare Realtime into your application promises a straightforward and efficient process, removing the hurdles of regional scalability and server management so you can focus on creating engaging real-time experiences for users worldwide. --- # DataChannels URL: https://developers.cloudflare.com/realtime/datachannels/ DataChannels are a way to send arbitrary data, not just audio or video data, between client in low latency. DataChannels are useful for scenarios like chat, game state, or any other data that doesn't need to be encoded as audio or video but still needs to be sent between clients in real time. While it is possible to send audio and video over DataChannels, it's not optimal because audio and video transfer includes media specific optimizations that DataChannels do not have, such as simulcast, forward error correction, better caching across the Cloudflare network for retransmissions. ```mermaid graph LR A[Publisher] -->|Arbitrary data| B[Cloudflare Realtime SFU] B -->|Arbitrary data| C@{ shape: procs, label: "Subscribers"} ``` DataChannels on Cloudflare Realtime can scale up to many subscribers per publisher, there is no limit to the number of subscribers per publisher. ### How to use DataChannels 1. Create two Realtime sessions, one for the publisher and one for the subscribers. 2. Create a DataChannel by calling /datachannels/new with the location set to "local" and the dataChannelName set to the name of the DataChannel. 3. Create a DataChannel by calling /datachannels/new with the location set to "remote" and the sessionId set to the sessionId of the publisher. 4. Use the DataChannel to send data from the publisher to the subscribers. ### Unidirectional DataChannels Cloudflare Realtime SFU DataChannels are one way only. This means that you can only send data from the publisher to the subscribers. Subscribers cannot send data back to the publisher. While regular MediaStream WebRTC DataChannels are bidirectional, this introduces a problem for Cloudflare Realtime because the SFU does not know which session to send the data back to. This is especially problematic for scenarios where you have multiple subscribers and you want to send data from the publisher to all subscribers at scale, such as distributing game score updates to all players in a multiplayer game. To send data in a bidirectional way, you can use two DataChannels, one for sending data from the publisher to the subscribers and one for sending data the opposite direction. ## Example An example of DataChannels in action can be found in the [Realtime Examples github repo](https://github.com/cloudflare/calls-examples/tree/main/echo-datachannels). --- # Changelog URL: https://developers.cloudflare.com/realtime/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Demos URL: https://developers.cloudflare.com/realtime/demos/ import { ExternalResources, GlossaryTooltip } from "~/components" Learn how you can use Realtime within your existing architecture. ## Demos Explore the following demo applications for Realtime. --- # Example architecture URL: https://developers.cloudflare.com/realtime/example-architecture/
![Example Architecture](~/assets/images/realtime/video-calling-application.png)
1. Clients connect to the backend service 2. Backend service manages the relationship between the clients and the tracks they should subscribe to 3. Backend service contacts the Cloudflare Realtime API to pass the SDP from the clients to establish the WebRTC connection. 4. Realtime API relays back the Realtime API SDP reply and renegotiation messages. 5. If desired, headless clients can be used to record the content from other clients or publish content. 6. Admin manages the rooms and room members. --- # Quickstart guide URL: https://developers.cloudflare.com/realtime/get-started/ :::note[Before you get started:] You must first [create a Cloudflare account](/fundamentals/setup/account/create-account/). ::: ## Create your first app Every Realtime App is a separate environment, so you can make one for development, staging and production versions for your product. Either using [Dashboard](https://dash.cloudflare.com/?to=/:account/calls), or the [API](/api/resources/calls/subresources/sfu/methods/create/) create a Realtime App. When you create a Realtime App, you will get: * App ID * App Secret These two combined will allow you to make API Realtime from your backend server to Realtime. --- # Connection API URL: https://developers.cloudflare.com/realtime/https-api/ Cloudflare Realtime simplifies the management of peer connections and media tracks through HTTPS API endpoints. These endpoints allow developers to efficiently manage sessions, add or remove tracks, and gather session information. ## API Endpoints - **Create a New Session**: Initiates a new session on Cloudflare Realtime, which can be modified with other endpoints below. - `POST /apps/{appId}/sessions/new` - **Add a New Track**: Adds a media track (audio or video) to an existing session. - `POST /apps/{appId}/sessions/{sessionId}/tracks/new` - **Renegotiate a Session**: Updates the session's negotiation state to accommodate new tracks or changes in the existing ones. - `PUT /apps/{appId}/sessions/{sessionId}/renegotiate` - **Close a Track**: Removes a specified track from the session. - `PUT /apps/{appId}/sessions/{sessionId}/tracks/close` - **Retrieve Session Information**: Fetches detailed information about a specific session. - `GET /apps/{appId}/sessions/{sessionId}` [View full API and schema (OpenAPI format)](/realtime/static/calls-api-2024-05-21.yaml) ## Handling Secrets It is vital to manage App ID and its secret securely. While track and session IDs can be public, they should be protected to prevent misuse. An attacker could exploit these IDs to disrupt service if your backend server does not authenticate request origins properly, for example by sending requests to close tracks on sessions other than their own. Ensuring the security and authenticity of requests to your backend server is crucial for maintaining the integrity of your application. ## Using STUN and TURN Servers Cloudflare Realtime is designed to operate efficiently without the need for TURN servers in most scenarios, as Cloudflare exposes a publicly routable IP address for Realtime. However, integrating a STUN server can be necessary for facilitating peer discovery and connectivity. - **Cloudflare STUN Server**: `stun.cloudflare.com:3478` Utilizing Cloudflare's STUN server can help the connection process for Realtime applications. ## Lifecycle of a Simple Session This section provides an overview of the typical lifecycle of a simple session, focusing on audio-only applications. It illustrates how clients are notified by the backend server as new remote clients join or leave, incorporating video would introduce additional tracks and considerations into the session. ```mermaid sequenceDiagram participant WA as WebRTC Agent participant BS as Backend Server participant CA as Realtime API Note over BS: Client Joins WA->>BS: Request BS->>CA: POST /sessions/new CA->>BS: newSessionResponse BS->>WA: Response WA->>BS: Request BS->>CA: POST /sessions//tracks/new (Offer) CA->>BS: newTracksResponse (Answer) BS->>WA: Response WA-->>CA: ICE Connectivity Check Note over WA: iceconnectionstatechange (connected) WA-->>CA: DTLS Handshake Note over WA: connectionstatechange (connected) WA<<->>CA: *Media Flow* Note over BS: Remote Client Joins WA->>BS: Request BS->>CA: POST /sessions//tracks/new CA->>BS: newTracksResponse (Offer) BS->>WA: Response WA->>BS: Request BS->>CA: PUT /sessions//renegotiate (Answer) CA->>BS: OK BS->>WA: Response Note over BS: Remote Client Leaves WA->>BS: Request BS->>CA: PUT /sessions//tracks/close CA->>BS: closeTracksResponse BS->>WA: Response Note over BS: Client Leaves WA->>BS: Request BS->>CA: PUT /sessions//tracks/close CA->>BS: closeTracksResponse BS->>WA: Response ``` --- # Cloudflare Realtime URL: https://developers.cloudflare.com/realtime/ import { Description, LinkButton } from "~/components"; Build real-time serverless video, audio and data applications. Cloudflare Realtime is infrastructure for real-time audio/video/data applications. It allows you to build real-time apps without worrying about scaling or regions. It can act as a selective forwarding unit (WebRTC SFU), as a fanout delivery system for broadcasting (WebRTC CDN) or anything in between. Cloudflare Realtime runs on [Cloudflare's global cloud network](https://www.cloudflare.com/network/) in hundreds of cities worldwide. Get started Realtime dashboard Orange Meets demo app --- # Introduction URL: https://developers.cloudflare.com/realtime/introduction/ Cloudflare Realtime can be used to add realtime audio, video and data into your applications. Cloudflare Realtime uses WebRTC, which is the lowest latency way to communicate across a broad range of platforms like browsers, mobile, and native apps. Realtime integrates with your backend and frontend application to add realtime functionality. ## Why Cloudflare Realtime exists * **It is difficult to scale WebRTC**: Many struggle scaling WebRTC servers. Operators run into issues about how many users can be in the same "room" or want to build unique solutions that do not fit into the current concepts in high level APIs. * **High egress costs**: WebRTC is expensive to use as managed solutions charge a high premium on cloud egress and running your own servers incur system administration and scaling overhead. Cloudflare already has 300+ locations with upwards of 1,000 servers in some locations. Cloudflare Realtime scales easily on top of this architecture and can offer the lowest WebRTC usage costs. * **WebRTC is growing**: Developers are realizing that WebRTC is not just for video conferencing. WebRTC is supported on many platforms, it is mature and well understood. ## What makes Cloudflare Realtime unique * **Unopinionated**: Cloudflare Realtime does not offer a SDK. It instead allows you to access raw WebRTC to solve unique problems that might not fit into existing concepts. The API is deliberately simple. * **No rooms**: Unlike other WebRTC products, Cloudflare Realtime lets you be in charge of each track (audio/video/data) instead of offering abstractions such as rooms. You define the presence protocol on top of simple pub/sub. Each end user can publish and subscribe to audio/video/data tracks as they wish. * **No lock-in**: You can use Cloudflare Realtime to solve scalability issues with your SFU. You can use in combination with peer-to-peer architecture. You can use Cloudflare Realtime standalone. To what extent you use Cloudflare Realtime is up to you. ## What exactly does Cloudflare Realtime do? * **SFU**: Realtime is a special kind of pub/sub server that is good at forwarding media data to clients that subscribe to certain data. Each client connects to Cloudflare Realtime via WebRTC and either sends data, receives data or both using WebRTC. This can be audio/video tracks or DataChannels. * **It scales**: All Cloudflare servers act as a single server so millions of WebRTC clients can connect to Cloudflare Realtime. Each can send data, receive data or both with other clients. ## How most developers get started 1. Get started with the echo example, which you can download from the Cloudflare dashboard when you create a Realtime App or from [demos](/realtime/demos/). This will show you how to send and receive audio and video. 2. Understand how you can manipulate who can receive what media by passing around session and track ids. Remember, you control who receives what media. Each media track is represented by a unique ID. It is your responsibility to save and distribute this ID. :::note[Realtime is not a presence protocol] Realtime does not know what a room is. It only knows media tracks. It is up to you to make a room by saving who is in a room along with track IDs that unique identify media tracks. If each participant publishes their audio/video, and receives audio/video from each other, you have got yourself a video conference! ::: 3. Create an app where you manage each connection to Cloudflare Realtime and the track IDs created by each connection. You can use any tool to save and share tracks. Check out the example apps at [demos](/realtime/demos/), such as [Orange Meets](https://github.com/cloudflare/orange), which is a full-fledged video conferencing app that uses [Workers Durable Objects](/durable-objects/) to keep track of track IDs. --- # Limits, timeouts and quotas URL: https://developers.cloudflare.com/realtime/limits/ Understanding the limits and timeouts of Cloudflare Realtime is crucial for optimizing the performance and reliability of your applications. This section outlines the key constraints and behaviors you should be aware of when integrating Cloudflare Realtime into your app. ## Free * Each account gets 1,000GB/month of data transfer from Cloudflare to your client for free. * Data transfer from your client to Cloudflare is always free of charge. ## Limits * **API Realtime per Session**: You can make up to 50 API calls per second for each session. There is no ratelimit on a App basis, just sessions. * **Tracks per API Call**: Up to 64 tracks can be added with a single API call. If you need to add more tracks to a session, you should distribute them across multiple API calls. * **Tracks per Session**: There's no upper limit to the number of tracks a session can contain, the practical limit is governed by your connection's bandwidth to and from Cloudflare. ## Inactivity Timeout * **Track Timeout**: Tracks will automatically timeout and be garbage collected after 30 seconds of inactivity, where inactivity is defined as no media packets being received by Cloudflare. This mechanism ensures efficient use of resources and session cleanliness across all Sessions that use a track. ## PeerConnection Requirements * **Session State**: For any operation on a session (e.g., pulling or pushing tracks), the PeerConnection state must be `connected`. Operations will block for up to 5 seconds awaiting this state before timing out. This ensures that only active and viable sessions are engaged in media transmission. ## Handling Connectivity Issues * **Internet Connectivity Considerations**: The potential for internet connectivity loss between the client and Cloudflare is an operational reality that must be addressed. Implementing a detection and reconnection strategy is recommended to maintain session continuity. This could involve periodic 'heartbeat' signals to your backend server to monitor connectivity status. Upon detecting connectivity issues, automatically attempting to reconnect and establish a new session is advised. Sessions and tracks will remain available for reuse for 30 seconds before timing out, providing a brief window for reconnection attempts. Adhering to these limits and understanding the timeout behaviors will help ensure that your applications remain responsive and stable while providing a seamless user experience. --- # Pricing URL: https://developers.cloudflare.com/realtime/pricing/ Cloudflare Realtime billing is based on data sent from Cloudflare edge to your application. Cloudflare Realtime SFU and TURN services cost $0.05 per GB of data egress. There is a free tier of 1,000 GB before any charges start. This free tier includes usage from both SFU and TURN services, not two independent free tiers. Cloudflare Realtime billing appears as a single line item on your Cloudflare bill, covering both SFU and TURN. Traffic between Cloudflare Realtime TURN and Cloudflare Realtime SFU or Cloudflare Stream (WHIP/WHEP) does not get double charged, so if you are using both SFU and TURN at the same time, you will get charged for only one. ### TURN Please see the [TURN FAQ page](/realtime/turn/faq), where there is additional information on speficially which traffic path from RFC8656 is measured and counts towards billing. ### SFU Only traffic originating from Cloudflare towards clients incurs charges. Traffic pushed to Cloudflare incurs no charge even if there is no client pulling same traffic from Cloudflare. --- # Sessions and Tracks URL: https://developers.cloudflare.com/realtime/sessions-tracks/ Cloudflare Realtime offers a simple yet powerful framework for building real-time experiences. At the core of this system are three key concepts: **Applications**, **Sessions** and **Tracks**. Familiarizing yourself with these concepts is crucial for using Realtime. ## Application A Realtime Application is an environment within different Sessions and Tracks can interact. Examples of this could be production, staging or different environments where you'd want separation between Sessions and Tracks. Cloudflare Realtime usage can be queried at Application, Session or Track level. ## Sessions A **Session** in Cloudflare Realtime correlates directly to a WebRTC PeerConnection. It represents the establishment of a communication channel between a client and the nearest Cloudflare data center, as determined by Cloudflare's anycast routing. Typically, a client will maintain a single Session, encompassing all communications between the client and Cloudflare. * **One-to-One Mapping with PeerConnection**: Each Session is a direct representation of a WebRTC PeerConnection, facilitating real-time media data transfer. * **Anycast Routing**: The client connects to the closest Cloudflare data center, optimizing latency and performance. * **Unified Communication Channel**: A single Session can handle all types of communication between a client and Cloudflare, ensuring streamlined data flow. ## Tracks Within a Session, there can be one or more **Tracks**. * **Tracks map to MediaStreamTrack**: Tracks align with the MediaStreamTrack concept, facilitating audio, video, or data transmission. * **Globally Unique Ids**: When you push a track to Cloudflare, it is assigned a unique ID, which can then be used to pull the track into another session elsewhere. * **Available globally**: The ability to push and pull tracks is central to what makes Realtime a versatile tool for real-time applications. Each track is available globally to be retrieved from any Session within an App. ## Realtime as a Programmable "Switchboard" The analogy of a switchboard is apt for understanding Realtime. Historically, switchboard operators connected calls by manually plugging in jacks. Similarly, Realtime allows for the dynamic routing of media streams, acting as a programmable switchboard for modern real-time communication. ## Beyond "Rooms", "Users", and "Participants" While many SFUs utilize concepts like "rooms" to manage media streams among users, this approach has scalability and flexibility limitations. Cloudflare Realtime opts for a more granular and flexible model with Sessions and Tracks, enabling a wide range of use cases: * Large-scale remote events, like 'fireside chats' with thousands of participants. * Interactive conversations with the ability to bring audience members "on stage." * Educational applications where an instructor can present to multiple virtual classrooms simultaneously. ### Presence Protocol vs. Media Flow Realtime distinguishes between the presence protocol and media flow, allowing for scalability and flexibility in real-time applications. This separation enables developers to craft tailored experiences, from intimate calls to massive, low-latency broadcasts. --- # Simulcast URL: https://developers.cloudflare.com/realtime/simulcast/ Simulcast is a feature of WebRTC that allows a publisher to send multiple video streams of the same media at different qualities. For example, this is useful for scenarios where you want to send a high quality stream for desktop users and a lower quality stream for mobile users. ```mermaid graph LR A[Publisher] -->|Low quality| B[Cloudflare Realtime SFU] A -->|Medium quality| B A -->|High quality| B B -->|Low quality| C@{ shape: procs, label: "Subscribers"} B -->|Medium quality| D@{ shape: procs, label: "Subscribers"} B -->|High quality| E@{ shape: procs, label: "Subscribers"} ``` ### How it works Simulcast in WebRTC allows a single video source, like a camera or screen share, to be encoded at multiple quality levels and sent simultaneously, which is beneficial for subscribers with varying network conditions and device capabilities. The video source is encoded into multiple streams, each identified by RIDs (RTP Stream Identifiers) for different quality levels, such as low, medium, and high. These simulcast streams are described in the SDP you send to Cloudflare Realtime SFU. It's the responsibility of the Cloudflare Realtime SFU to ensure that the appropriate quality stream is delivered to each subscriber based on their network conditions and device capabilities. Cloudflare Realtime SFU will automatically handle the simulcast configuration based on the SDP you send to it from the publisher. The SFU will then automatically switch between the different quality levels based on the subscriber's network conditions, or the qaulity level can be controlled manually via the API. You can control the quality switching behavior using the `simulcast` configuration object when you send an API call to start pulling a remote track. ### Quality Control The `simulcast` configuration object in the API call when you start pulling a remote track allows you to specify: - `preferredRid`: The preferred quality level for the video stream (RID for the simulcast stream. [RIDs can be specified by the publisher.](https://developer.mozilla.org/en-US/docs/Web/API/RTCRtpSender/setParameters#encodings)) - `priorityOrdering`: Controls how the SFU handles bandwidth constraints. - `none`: Keep sending the preferred layer, set via the preferredRid, even if there's not enough bandwidth. - `asciibetical`: Use alphabetical ordering (a-z) to determine priority, where 'a' is most desirable and 'z' is least desirable. - `ridNotAvailable`: Controls what happens when the preferred RID is no longer available, for example when the publisher stops sending it. - `none`: Do nothing. - `asciibetical`: Switch to the next available RID based on the priority ordering, where 'a' is most desirable and 'z' is least desirable. You will likely want to order the asciibetical RIDs based on your desired metric, such as higest resoltion to lowest or highest bandwidth to lowest. ### Bandwidth Management across media tracks Cloudflare Realtime treats all media tracks equally at the transport level. For example, if you have multiple video tracks (cameras, screen shares, etc.), they all have equal priority for bandwidth allocation. This means: 1. Each track's simulcast configuration is handled independently 1. The SFU performs automatic bandwidth estimation and layer switching based on network conditions independently for each track ### Layer Switching Behavior When a layer switch is requested (through updating `preferredRid`) with the `/tracks/update` API: 1. The SFU will automatically generate a Full Intraframe Request (FIR) 2. PLI generation is debounced to prevent excessive requests ### Publisher Configuration For publishers (local tracks), you only need to include the simulcast attributes in your SDP. The SFU will automatically handle the simulcast configuration based on the SDP. For example, the SDP should contain a section like this: ```txt a=simulcast:send f;h;q a=rid:f send a=rid:h send a=rid:q send ``` If the publisher endpoint is a browser you can include these by specifying `sendEncodings` when creating the transceiver like this: ```js const transceiver = peerConnection.addTransceiver(track, { direction: "sendonly", sendEncodings: [ { scaleResolutionDownBy: 1, rid: "f" }, { scaleResolutionDownBy: 2, rid: "h" }, { scaleResolutionDownBy: 4, rid: "q" } ] }); ``` ## Example Here's an example of how to use simulcast with Cloudflare Realtime: 1. Create a new local track with simulcast configuration. There should be a section in the SDP with `a=simulcast:send`. 2. Use the [Cloudflare Realtime API](/realtime/https-api) to push this local track, by calling the /tracks/new endpoint. 3. Use the [Cloudflare Realtime API](/realtime/https-api) to start pulling a remote track (from another browser or device), by calling the /tracks/new endpoint and specifying the `simulcast` configuration object along with the remote track ID you get from step 2. For more examples, check out the [Realtime Examples GitHub repository](https://github.com/cloudflare/calls-examples/tree/main/simulcast). --- # About URL: https://developers.cloudflare.com/registrar/about/ Cloudflare Registrar offers several advantages over other [registrars](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name-registrar/), such as domain name registration renewal [without markups fees](https://www.cloudflare.com/products/registrar/). You only pay what is charged by registries and [ICANN](https://www.icann.org/). Cloudflare Registrar also offers additional security features, such as free, one-click activation for [Domain Name System Security Extensions (DNSSEC)](/registrar/get-started/enable-dnssec/), [custom domain protection](/registrar/custom-domain-protection/), and [WHOIS redaction](/registrar/account-options/whois-redaction/). You can buy your domain from Cloudflare Registrar or from a third party. Even when you buy it from a third party, you can manage your domain with Cloudflare to benefit from all the features Cloudflare offers. --- # Cloudflare Custom Domain Protection URL: https://developers.cloudflare.com/registrar/custom-domain-protection/ Cloudflare offers [Custom Domain Protection](https://www.cloudflare.com/products/registrar/custom-domain-protection/) to customers with a Cloudflare Enterprise plan and high-profile domains who need the highest level of security against domain hijacking. Custom Domain Protection offers additional safeguard features for registered domains, including: * **Registry lock**: Cloudflare applies Registry Lock, when available, to all domains registered through Custom Domain Protection. Any changes to a domain requires Cloudflare to first unlock the domain at the registry level. * **Out-of-band authentication**: All changes to domain ownership or nameserver information are verified and executed manually based on an authentication process defined by the customer. * **No interface**: Custom Domain Protection does not offer an interface, to remove the possibility of domain hijack through a compromised account. Contact your account team if you are interested in Cloudflare's Custom Domain Protection. --- # FAQ URL: https://developers.cloudflare.com/registrar/faq/ Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. * [Domain transfers](#domain-transfers) * [Domain registrations](#domain-registrations) * [Billing](#billing) ## Domain transfers ### Why did my transfer fail? Domain transfers sometimes fail. Refer to [Registrar: troubleshoot stalled domain transfers](/registrar/troubleshooting/) for more information on what might have happened and how to solve the issue. If you cannot solve the issue, open a support ticket or contact your account team. ### ​​Why did my domain’s expiration date change after transferring it to Cloudflare? ICANN requires that any transfer also extends the expiration date of your domain by at least one year — that is one year from your current expiration date, not one year from the date of transfer. For example, if you transfer a domain on October 10, 2021, but it expires on March 10, 2022, your new expiration date will be March 10, 2023. Whenever a domain is first registered, the registrant purchases control of that domain for some number of years — up to 10 years. For example, a domain registered on October 8, 2020 will have an expiration date of October 8th in some year between 2021 and 2030, depending on the amount of years originally purchased. Transferring a domain adds time to the current expiration date, unless your domain already has [10 years on the term](#if-i-registered-my-domain-for-10-years-at-another-registrar-will-i-gain-another-year-if-i-transfer-it-to-cloudflare). ### ​​Why did my domain’s expiration date change after transferring it to Cloudflare? Cloudflare Registrar only supports transfers of domains that are active on a Cloudflare [full setup](/dns/zone-setups/full-setup/). Domains on Cloudflare use [nameservers assigned by Cloudflare](/dns/zone-setups/reference/nameserver-assignment/) to the associated account and those nameservers must remain in place for the domain to be Active. ### How can I see the status of my domain transfer? Once you initiate a domain transfer, your previous registrar has five days to release the domain. In most cases, they will send you an email to confirm you want to transfer. If you actively acknowledge that email (through a link or the registrar's dashboard), they can process it immediately. To see the progress of your transfer, log in to the Cloudflare dashboard and select your account. Then, select **Domain Registration** > **Transfer Domains** to see a list of domain transfers that are in progress. To accelerate the process, be sure to check with your old registrar how you can approve the transfer out. Once successful, you will receive an email from Cloudflare and be able to manage the domain in the dashboard under **Overview** of that site. ### ​​Why am I not allowed to transfer my domain? ICANN prohibits domain transfers within 60 days of a change to the WHOIS data or registrar of a domain. If you modified your contact information, transferred registrars, or registered your domain in the last 60 days, Cloudflare will be unable to process your transfer immediately. You can leave the domain **In Progress** and Cloudflare will wait until after the 60-day window passes to attempt to process the transfer. :::note[Note] This information does not apply to `.uk` domains. ::: ### Why am I not able to start a transfer? If you have an [unverified email address](/fundamentals/setup/account/verify-email-address/), you might experience issues when initiating a domain transfer. ### What happens if I enter the wrong auth code? If you enter an incorrect auth code (also referred to as authentication code or authorization code), return to the **Domain Registration** page or the **Overview** for your site. You can use the available input field to reenter your authentication code. ### ​​If I registered my domain for 10 years at another registrar, will I gain another year if I transfer it to Cloudflare? No. A domain cannot have more than 10 years on the term. If you registered your domain for 10 years, you will get 10 years upon transferring it to Cloudflare. *** ## Domain registrations ### My domain’s registration was not extended by one year after transferring to Cloudflare When you transfer your domain to Cloudflare, the registry will extend your registration by one year. However, in one specific circumstance your transfer could result in you keeping your original expiration date. When a domain expires, the registration enters the auto-renew grace period. During that time, you can renew the domain at your registrar to avoid losing it. If your domain expires at your current registrar, you renew it and then transfer to Cloudflare within 45 days, the registry can restrict the addition of an extra year. Say you have `example.com` registered and it expires on December 10, 2021. You decide to renew it during the auto-renew grace period on December 20, 2021. That renewal extends the registration to December 20, 2022. You then transfer to Cloudflare on December 30, 2021. Since that transfer is within 45 days of the expiration, the registry may not add the year to your registration. When you transfer to Cloudflare or any registrar in this circumstance, your expiration can still remain December 20th, 2022. If a year is not added to your registration, you have effectively paid twice for the same added year. Per ICANN rules, you are entitled to request a refund at your previous registrar. ### What Happens When a Domain Expires? In summary, here is what will happen after a domain expires: * **Day 0**: Expiration Date. * **Day 1 - 30**: Grace Period (domain resolves normally). * **Day 31 - 40**: Suspension Period (domains resolves to suspension page). * **Day 41 - 70**: Redemption Period. * **Day 71 - 75**: Pending Delete Period. Cloudflare currently offers a 40-day grace period for most top-level domains (TLDs). During this period you may renew/extend the domain at any time from within the dashboard but no further auto-renew attempts will be made. For the first 30 days of the grace period, the domain will continue to resolve as normal. On the 30th day after the expiration date, the domain will be suspended and a parked suspension page will be displayed. You may still renew the domain at any time during this suspension period. On the 40th day, the domain will enter the Redemption Period and will no longer resolve to any web page. The redemption period lasts for 30 days. During this time, it may be possible to restore and renew the domain. A restore fee may apply in addition to the renewal fee. At the end of the 30 day redemption period, the domain will be placed in pending delete status for a period of five days, after which it will be released and made available for re-registration. The domain cannot be restored or renewed during this period. If the domain is in a state where it can be restored, the Manage Domain page in the Registrar section of dash will display a message indicating the domain is restorable. You will then will be able to initiate the restore process directly from the dashboard. *** ## Domain restoration ### Which domains are eligible to be restored? Domains that are in the Redemption Period and have an EPP status of redemptionPeriod may be restored. For most TLDs this will include domains that are between 40 and 70 days past expiration. Currently `.uk` domains cannot be restored using this process. We are working on an alternative process for `.uk` domains and will provide additional information at a later date. ### ​​Is there a fee to restore a domain? Yes, in most cases there is a restore fee. The amount varies depending on the TLD. The restore fee is separate from the renewal fee. You will be presented with both the restore and renewal fees before confirming they wish to proceed. ### Will the domain be renewed after the restore has completed? Yes. We will attempt to renew the domain after the restore has been completed. While not common, it is possible for the renewal transaction to fail. In the event of a failure, we will make several retry attempts. If we are unable to process the renewal after several retries, you will be presented with a message that you should contact support for assistance. ### ​​How long does the restore process take? The entire process can take a few minutes to complete. There are multiple steps to the restore process, and each step must be completed in a specific sequence. These steps are performed automatically by the system. The UI will continue to poll for an updated status and will provide feedback as each step completes. ### What happens if the domain renewal fails? The restore and the renewal are two distinct processes that happen sequentially. In rare cases the domain may be successfully restored but the renewal fails. We will make several attempts to renew the domain. However, should all the renewals fail the customer may attempt to manually renew the domain or contact support so we may investigate the cause of the failure. ### ​​Can a restore be reversed or refunded? No. Once a restore has been completed it can not be reversed. It may be possible to delete the domain again but there are no refunds. :::note[Note] Domain names should be released after a period of 75 days, although the exact deletion timeline is ultimately determined by the domain's registry. You should monitor the domain status to ascertain when it will become available for registration once again. ::: *** ## Domain deletions ### Why am I unable to delete my Registrar domain? A domain can only be deleted if all the following conditions are met: * The user initiating the action is a Super Admin or Read/Write Administrator. * The domain is not delete locked at the registry with either `clientDeleteProhibited` or `serverDeleteProhibited`. * The domain is not already in `pendingDelete`, `redemptionPeriod`, or in `pendingTransfer`. * The domain has not been administratively locked by Cloudflare. This typically occurs for legal reasons such as a UDRP filing or court order, but may also be the result of an abuse or payment investigation. * The domain is NOT a .UK domain. .UK domains currently cannot be deleted at the registry. If any of the above conditions are not met, the domain cannot be deleted. ### ​​Who has permission to delete a domain registration? Only Super Admins and Administrators with Read/Write access can initiate the deletion of a domain. Note that only Super Admins will receive the email with the delete token. ### Will I receive a refund for my deleted domain registration? No. Refunds will not be issued for costs incurred by a domain registration. ### How do I get the domain deletion token? The delete token is only sent to the Super Admins of the account. If the user requesting the deletion is not a Super Admin they will need to obtain the delete token from one of the Super Admins of the account. ### ​​How long is the domain deletion token valid for? The delete token is valid for 30 minutes. After the 30 minutes the code will expire and the user must restart the process. ### Will the domain be deleted immediately from my account? If the domain is within 5 days of the initial registration, the domain will be immediately released by the registry and made available for re-registration. In this scenario the domain will be immediately removed from the registrar section of the account. You may need to refresh the page to force an update of the data. If the domain is more than 5 days old, it will enter the redemption period and will remain in account until the redemption period expires and the registry releases the domain. *** ## Billing ### How much does Cloudflare Registrar cost? Refer to [What is Cloudflare Registrar](https://www.cloudflare.com/learning/dns/what-is-cloudflare-registrar/) for more information on pricing. ### When will I be billed? You will be billed when you input your authorization code and initiate the transfer of your domain to Cloudflare. Currently, Cloudflare Registrar only uses the primary payment method for any associated transaction. Make sure to copy and paste the code to avoid mistakes. The transfer will not initiate if the code is incorrect. ### ​​Is there a fee to transfer a .UK domain? No, there is no fee to transfer a `.uk` domain. Also, an additional year is NOT added during the transfer process. However, if the domain is nearing the expiration date and is set to auto-renew, it may be automatically renewed shortly after the completion of the transfer. --- # Cloudflare Registrar URL: https://developers.cloudflare.com/registrar/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Buy and renew your domain at cost with Cloudflare Registrar. Buy and manage your domain with Cloudflare Registrar, and add an additional layer of security to your DNS records for free. Cloudflare Registrar also offers redacted WHOIS information by default and will only charge you what is paid to the registry for your domain. No markup. No surprise fees. *** ## Features Cloudflare Registrar offers one-click DNSSEC activation. DNSSEC secures DNS records with cryptographic signatures, and is free to all Cloudflare customers. Buy and renew domains through Cloudflare Registrar at cost, without markup fees. You only pay what is charged by [registries and ICANN](https://www.cloudflare.com/products/registrar/). *** ## Related products When you use Cloudflare DNS, all DNS queries for your domain are answered by Cloudflare’s global anycast network. This network delivers performance and global availability. --- # Troubleshoot failed domain transfers URL: https://developers.cloudflare.com/registrar/troubleshooting/ After you start the transfer process to Cloudflare Registrar, your previous registrar has five days to release the domain after a successful transfer request. If your transfer has not been completed within that time frame, something has likely gone wrong. Most issues with a stalled transfer can be solved by checking the following details and [restarting the transfer](#restart-your-transfer). ## Registrar lock reapplied You have reapplied the registrar lock at your current registrar since requesting the transfer. You will need to remove it again to restart the transfer process. ## Transfer rejected Your transfer has been rejected by your previous registrar. There are several reasons for this to happen: * You actively rejected the transfer request in the email you received from your registrar or on your registrar’s interface. * Your registrar determined the domain is not eligible for transfer. * Some registrars allow customers to enable a setting to reject all transfer requests. * In some instances, registrars may reject the transfer if they suspect malicious behavior. You will need to restart the transfer and approve the request or contact your current registrar to solve this issue. ## Auth code invalid Your auth code (also referred to as authentication code and authorization code) has since changed or been deprecated, and Cloudflare cannot complete the transfer. Confirm the code with your current registrar again. To avoid mistakes, copy and paste the auth code provided by your current registrar. ## WHOIS Guard / privacy protection Some registrars may prohibit transfer requests if you have WHOIS privacy services enabled. You need to first disable those services at your current registrar before you can proceed with the transfer process. ## Restart your transfer :::note This solution does not apply to `.uk` domains. ::: 1. Log in to [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account. 2. Select **Domain Registration** > **Manage Domains**. 3. Find the correct domain and select **Manage**. 4. Select **Cancel Transfer and Retry**. After you initiate the retry, you must re-enter your auth code and confirm your WHOIS information. --- # Changelog URL: https://developers.cloudflare.com/rules/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-09-20 **Automatic DNS Validation for Cloudflare Rules** The Cloudflare dashboard now automatically validates [DNS records](https://developers.cloudflare.com/dns/proxy-status/) and [Cloudflare for SaaS custom hostnames](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/) for rules targeting specific hostnames or URLs. To prevent misconfigured rules and ensure smoother deployments, you will get proactive warnings for missing or misconfigured DNS records and custom hostnames. ## 2024-09-17 **Compression Rules available to all plans with Zstandard support** [Compression Rules](https://developers.cloudflare.com/rules/compression-rules/) now support Zstandard compression and are available in all Cloudflare plans. Users in the Free plan will gradually get access throughout 2024. ## 2024-09-13 **Snippets now available in beta** [Cloudflare Snippets](https://developers.cloudflare.com/rules/snippets/) have transitioned from alpha to beta. ## 2024-09-10 **wildcard\_replace() function now supported in URL rewrites** You can now use the [`wildcard_replace()`](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace) function in rewrite expressions of [URL rewrites](https://developers.cloudflare.com/rules/transform/url-rewrite/). ## 2024-09-05 **New Rules Templates for one-click rule creation** The new **Rules** > **Templates** page in the Cloudflare dashboard allows you to create common rules with a single click, featuring dozens of pre-built templates. You can also access these templates directly from each product's rule builder. Also, explore the [Examples gallery](https://developers.cloudflare.com/rules/examples/) in the developer docs for real-world use cases and inspiration. ## 2024-08-22 **Simplified UI for Single Redirects with wildcard support** The simplified UI for [Single Redirects](https://developers.cloudflare.com/rules/url-forwarding/single-redirects/) is now available to all users, making URL redirects easier and more intuitive. This update builds on the recent [wildcard support](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace) in Ruleset Engine products. Access the new UI under **Rules > Redirect Rules**. Learn more about wildcard support and our open-source Rust crate in the [blog post](https://blog.cloudflare.com/wildcard-rules). ## 2024-08-20 **Cloud Connector now available to all customers** Cloud Connector (beta) is now available to all customers. For setup details, refer to the [documentation](https://developers.cloudflare.com/rules/cloud-connector/), explore [examples](https://developers.cloudflare.com/rules/cloud-connector/examples/), and check out the [blog post](https://blog.cloudflare.com/cloud-connector). ## 2024-08-16 **Cloud Connector now available to all free customers** Cloud Connector (beta) is now available to all free and a subset of paid customers. This rollout will be [gradually extended](https://developers.cloudflare.com/rules/cloud-connector/#availability) to all Cloudflare users, simplifying multi-cloud management and enhancing integration with Cloudflare's Connectivity Cloud. For more information, refer to the [blog post](https://blog.cloudflare.com/cloud-connector). ## 2024-08-12 **Cloudflare Snippets limits have been upgraded** Cloudflare Snippets (alpha) now allow multiple subrequests depending on your plan. For more information, refer to the [Availability](https://developers.cloudflare.com/rules/snippets/#availability). ## 2024-07-31 **Wildcard support added to Ruleset Engine products** Wildcards are now supported across our Ruleset Engine-based products, including Single Redirects, Cache Rules, Transform Rules, WAF, Waiting Room, and more: * You can now use the `wildcard` and `strict wildcard` operators with any string field in the Ruleset Engine, such as full URI, host, headers, cookies, user-agent, and country. For more details, refer to [Operators](https://developers.cloudflare.com/ruleset-engine/rules-language/operators/) and [Wildcard matching](https://developers.cloudflare.com/ruleset-engine/rules-language/operators/#wildcard-matching). * In [Single Redirects](https://developers.cloudflare.com/rules/url-forwarding/single-redirects/), the `wildcard_replace()` function allows you to use segments matched by the `wildcard` and `strict wildcard` operators in redirect URL targets. For more information, refer to [Functions](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace). ## 2024-07-01 **Cloudflare Snippets now available to all paid customers** Cloudflare Snippets (alpha) are now available to all paid customers. ## 2024-06-03 **Cloudflare Snippets now available to all Enterprise customers** Cloudflare Snippets (alpha) are now available to all Enterprise customers. Customers in other paid plans will gradually get access throughout 2024. ## 2024-05-14 **Page Rules migration** The [Page Rules migration guide](https://developers.cloudflare.com/rules/reference/page-rules-migration/) is now available for users interested in transitioning to modern Rules features instead of Page Rules. Explore the guide for detailed instructions on migrating your configurations. ## 2024-05-13 **New Configuration Rules setting for Web Analytics (RUM)** You can now turn off Cloudflare Web Analytics, also known as Real User Monitoring (RUM), for specific requests using a configuration rule. ## 2024-04-29 **New Configuration Rules setting for Cloudflare Fonts** You can now turn on or off Cloudflare Fonts for specific requests using a configuration rule. ## 2024-03-22 **New TLS fields in rule expressions** Customers can now use new fields `cf.tls_client_hello_length` (the length of the client hello message sent in a TLS handshake), `cf.tls_client_random` (the value of the 32-byte random value provided by the client in a TLS handshake), and `cf.tls_client_extensions_sha1` (the SHA-1 fingerprint of TLS client extensions) in various products built on Ruleset Engine. ## 2024-03-20 **Origin Rules now allow port numbers in Host Header Override** Customers can now use arbitrary port numbers in Host Header Override in Origin Rules. Previously, only hostname was allowed as a value (for example, `example.com`). Now, you can set the value to `hostname:port` (for example, `example.com:1234`) as well. --- # Examples URL: https://developers.cloudflare.com/rules/examples/ import { ListExamples, GlossaryTooltip } from "~/components"; Explore the following examples for Rules. --- # Cloudflare Rules URL: https://developers.cloudflare.com/rules/ import { CardGrid, Feature, LinkTitleCard, Plan, RelatedProduct, Render, } from "~/components"; Rules features require that you [proxy the DNS records](/dns/proxy-status/) of your domain (or subdomain) through Cloudflare. --- ## Features Customize Cloudflare configuration settings for matching incoming requests. Customize the behavior of your website or application using short pieces of JavaScript code. Adjust the URI path, query string, and HTTP headers of requests and responses on the Cloudflare global network. Redirect visitors from a source URL to a target URL with a specific HTTP status code. Use Single Redirects or Bulk Redirects depending on your use case. Customize where the incoming traffic will go and with which parameters. Override request properties such as `Host` header, destination hostname, and destination port. Route matching incoming traffic from your website to a public cloud provider such as AWS, Google Cloud, and Azure. Customize the compression applied to responses from Cloudflare's global network to your website visitors, based on the file extension and content type. Trigger certain actions when a request matches a URL pattern. Modify the URLs of incoming requests so that they conform to a consistent formatting standard. Define what custom content to serve for errors returned by an origin server or by a Cloudflare product, including Workers. --- ## Related products Control incoming traffic by filtering requests to a zone. You can block or challenge incoming requests according to rules you define. Define rate limits for requests matching an expression, and the action to perform when those rate limits are reached. Customize the cache properties of your HTTP requests. Cloudflare Workers provides a serverless execution environment that allows you to create new applications or augment existing ones without configuring or maintaining infrastructure. --- ## More resources Compare available Cloudflare plans --- # Cloudflare Ruleset Engine URL: https://developers.cloudflare.com/ruleset-engine/ import { LinkButton } from "~/components"; The Cloudflare Ruleset Engine allows you to create and deploy rules and rulesets in different Cloudflare products using the same basic syntax. ## Main features - **Powerful syntax**: Rule expressions use a powerful Rules language similar to the wirefilter syntax that allows you to create complex rules. - **High-performance rule evaluation**: Allows you to have many rules in different Cloudflare products with almost no impact on performance. - **Engine powering different Cloudflare products**: Cloudflare keeps building products on top of the Ruleset Engine, which means that you can use the same API methods for configuring different products, with the same customization possibilities. Additionally, the Ruleset Engine supports the different phases of the request life cycle at Cloudflare. ## Availability The Ruleset Engine supports different Cloudflare products. Refer to [Phases list](/ruleset-engine/reference/phases-list/) and to each product's documentation for details. --- # Secrets Store access control URL: https://developers.cloudflare.com/secrets-store/access-control/ Secrets Store allows security administrators to have more control by implementing role-based access. For details about roles at Cloudflare, refer to [Fundamentals](/fundamentals/setup/manage-members/). :::note[Availability] While all Cloudflare accounts will have access to the Secrets Store section on the dashboard, only users with the necessary permissions will be able to interact with it, as described below. ::: ## Relevant roles for Secrets Store Refer to the list below for default role definitions. - **Super Administrator**: Can create, edit, duplicate, delete, and view secrets metadata. Can also [add a Secrets Store binding to a Worker](/secrets-store/integrations/workers/). - **Secrets Store Admin**: Can create, edit, duplicate, delete, and view secrets metadata. - **Secrets Store Deployer**: Can view secrets metadata but cannot create, edit, duplicate, nor delete secrets. Can also [add a Secrets Store binding to a Worker](/secrets-store/integrations/workers/). - **Secrets Store Reporter**: Can view secrets metadata. Cannot perform any actions (create, edit, duplicate, delete secrets), nor add a Secrets Store binding to a Worker. ## API token permissions The following API token permissions can also be used to grant access to Secrets Store resources. - **Account Secrets Store Edit**: Allows a user to create, edit, duplicate, or delete secrets. - **Account Secrets Store Read**: Allows a user to view secrets metadata. --- # Audit logs URL: https://developers.cloudflare.com/secrets-store/audit-logs/ [Audit logs](/fundamentals/setup/account/account-security/review-audit-logs/) provide a comprehensive summary of changes made within your Cloudflare account. This page lists the actions that are logged for Secrets Store. - Access - Create - Duplicating a secret is presented as a `create` log with a field `duplicated_from_id`. - Update - A boolean `"value_modified": true` is presented when the secret value is edited. - Delete For information on how to access and use audit logs, refer to [Fundamentals](/fundamentals/setup/account/account-security/review-audit-logs/). --- # Cloudflare Secrets Store URL: https://developers.cloudflare.com/secrets-store/ import { Description, Plan } from "~/components"; Encrypt and store sensitive information as secrets that are securely reusable across your account. Cloudflare Secrets Store is a secure, centralized location in which account-level secrets are stored and managed. The secrets are securely encrypted and stored across all Cloudflare data centers. Secrets Store is currently [compatible with Cloudflare Workers](/secrets-store/integrations/workers/). Integrations with other products will be added in the future. :::note[China availability] Secrets Store is unavailable in the [Cloudflare China Network](/china-network/), operated by Cloudflare's partner JD Cloud. ::: --- # Application security dashboard (beta) URL: https://developers.cloudflare.com/security/ import { Card, CardGrid, Feature, LinkTitleCard, RelatedProduct, } from "~/components"; The application security dashboard (beta) is your starting point to better understand the security posture of your web applications, and to configure rules to protect them. The new **Security** navigation in the Cloudflare dashboard is currently available in beta for users that opt in to the new user interface. To opt in: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. 2. Open any page under **Security**. 3. In the top right-hand corner of the page, select **Try new security dashboard**. You can swap back to the previous dashboard at any time by selecting **Return to old security dashboard** in the same page location. ## Features Get a high-level overview of your domain's security posture. Shows information about all incoming HTTP requests or mitigated requests (rule matches). Tailor your security configurations based on sampled logs. Discover your web assets (including API endpoints) and instruct Cloudflare how to best protect them. Perform security actions on incoming requests that match specified filters. --- ## More resources Compare available Cloudflare plans --- # Security analytics URL: https://developers.cloudflare.com/security/analytics/ import { GlossaryTooltip } from "~/components"; Security analytics shows information about all incoming HTTP requests or only about requests mitigated by Cloudflare. Use Security analytics as your starting point to understand and analyze traffic patterns, and to create security rules based on the filters you applied. Security analytics is available in **Security** > **Analytics**. ## Traffic The **Traffic** tab displays information about all incoming HTTP requests for your domain, including requests not handled by Cloudflare security products. In this tab you can perform several tasks: - View the traffic distribution for your domain. - Understand which traffic is being mitigated by Cloudflare security products, and where non-mitigated traffic is being served from (Cloudflare global network or [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/)). - Analyze suspicious traffic and create tailored custom [security rules](/security/rules/) based on applied filters. - [Find an appropriate rate limit](/waf/rate-limiting-rules/find-rate-limit/) for incoming traffic. For information on how to use the **Traffic** tab, refer to [Security Analytics](/waf/analytics/security-analytics/#adjusting-displayed-data). If you need to modify existing security-related rules you already configured, consider also using the [Events](#events) tab. This tab displays information about requests affected by Cloudflare security products. ### Suspicious activity The suspicious activity gives you information about suspicious requests that were identified by the Cloudflare detections you have enabled. The supported detections include: - [Account takeover](/bots/additional-configurations/detection-ids/#account-takeover-detections) - [Leaked credential check](/waf/detections/leaked-credentials/) (only for user and password leaked) - [Malicious uploads](/waf/detections/malicious-uploads/) - [WAF attack score](/waf/detections/attack-score/) - [Firewall for AI](/waf/detections/firewall-for-ai/) Each suspicious activity is classified with a severity score that can vary from critical to low. You can use the filter option to investigate further. :::note The **Traffic** tab includes functionality available in the [Security Analytics](/waf/analytics/security-analytics/) page in the previous dashboard navigation structure. However, some page elements will appear in a different order, or they may be unavailable in the **Traffic** tab, such as Insights or the score-based analyses sidebar. ::: ## Events Use the **Events** tab to review mitigated requests and to tailor your security configurations. The **Events** tab displays information about requests actioned or flagged by Cloudflare security products. Each incoming HTTP request might generate one or more security events. The tab only shows these events, not the HTTP requests themselves. To obtain information on all incoming HTTP requests, use the [Traffic](#traffic) tab. Users on a Free plan can view summarized events by date in sampled logs. Customers on paid plans have access to additional graphs and dashboards that summarize the most relevant information about the current behavior of Cloudflare's security features on your domain. For more information on the **Events** tab, refer to [Security Events](/waf/analytics/security-events/). :::note The **Events** tab corresponds to the [Security Events](/waf/analytics/security-events/) page in the previous dashboard navigation structure. ::: --- # Security overview URL: https://developers.cloudflare.com/security/overview/ Security overview provides a high-level security overview of your domain. Security overview allows you to review the security posture of your domain. The security overview page is available on both the new security dashboard as well as the existing security dashboard. The Security overview page will display the following information: - **Traffic last 7 days**: Review traffic from the last seven days that has been mitigated, served by Cloudflare, and served by origin. - **Security posture**: - **Configurations**: Review your currently enabled configurations, and whether additional configurations are required for them. - **Suggestions**: Review security suggestions to improve your security posture. - **Rules with the most activity**: Review the number of times a security rule has been activated by matching requests. - **Last updated rules**: Review rules you recently changed. --- # Security rules URL: https://developers.cloudflare.com/security/rules/ Security rules perform security-related actions on incoming requests that match specified filters. Rules are evaluated and executed in order, from first to last. Security rules are available in **Security** > **Security rules**. ## Security rules The **Security rules** tab includes a list of different types of rules configured in your domain / zone to protect your applications and resources. To create a security rule: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account and domain. 2. Go to **Security** > **Security rules**. 3. (Optional) Select **Templates**, and then select a template from the list. You can customize the default configuration of the template before deploying the new rule. Refer to the resources listed in the next step. 4. Select **Create rule** > select the type of rule you want to create. Refer to the following resources about each rule type: - [Custom rules](/waf/custom-rules/create-dashboard/#rule-form) - [Rate limiting rules](/waf/rate-limiting-rules/create-zone-dashboard/#rule-form) - [API sequence rules](/api-shield/security/sequence-mitigation/#rule-form) - [API JWT validation rules](/api-shield/security/jwt-validation/#rule-form) (requires a [token configuration](/security/settings/#all-settings)) - [Managed rules exceptions](/waf/managed-rules/waf-exceptions/define-dashboard/#2-define-basic-exception-parameters) - [Content security rules](/page-shield/policies/create-dashboard/#rule-form) (previously known as Page Shield policies) :::note[Notes] The **Security rules** tab includes functionality available in different products in the previous dashboard navigation structure, such as the [WAF](/waf/), [API Shield](/api-shield/), and [Page Shield](/page-shield/). The tab may show additional rule types if you have configured at least one of the following: - [IP access rules](/waf/tools/ip-access-rules/) - [User agent blocking rules](/waf/tools/user-agent-blocking/) - [Zone lockdown rules](/waf/tools/zone-lockdown/) ::: ## DDoS protection The **DDoS Protection** tab shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription. To learn more about DDoS protection overrides, refer to the following resources: - [HTTP DDoS attack protection overrides](/ddos-protection/managed-rulesets/http/override-expressions/) - [Network-layer DDoS attack protection overrides](/ddos-protection/managed-rulesets/network/override-expressions/) :::note You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level in Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**. ::: --- # Security settings URL: https://developers.cloudflare.com/security/settings/ This page describes the settings available in **Security** > **Settings** for a given domain. ## Security modules ### Web application exploits module In the **Web application exploits** security module you can enable and configure the following managed rulesets and detections: - [Cloudflare Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) - [Cloudflare OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/) - [Leaked credentials detection](/waf/detections/leaked-credentials/) - [Malicious upload detection](/waf/detections/malicious-uploads/) - [Sensitive data detection ruleset](/waf/managed-rules/reference/sensitive-data-detection/) - [Firewall for AI](/waf/detections/firewall-for-ai/) Refer to each linked page for details. :::note The web application exploits module includes features and settings from the [Cloudflare WAF](/waf/) in the previous dashboard navigation structure. ::: ### DDoS attacks module The **DDoS protection** security module shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription. To learn more about DDoS protection overrides, refer to the following resources: - [HTTP DDoS attack protection overrides](/ddos-protection/managed-rulesets/http/override-expressions/) - [Network-layer DDoS attack protection overrides](/ddos-protection/managed-rulesets/network/override-expressions/) :::note You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level in Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**. ::: ### Bot traffic module In the **Bot traffic** security module you can perform the following tasks: - Enable [Bot fight mode](/bots/get-started/bot-fight-mode/) (depending on your Cloudflare plan). - Enable [Super Bot fight mode](/bots/get-started/super-bot-fight-mode/) (depending on your Cloudflare plan). - Review information about [Bot Management](/bots/get-started/bot-management/) (always enabled if included in your Enterprise subscriptions). - Turn on [Block AI Bots](/bots/concepts/bot/#ai-bots). - Turn on [AI Labyrinth](/bots/get-started/bot-fight-mode/#enable-ai-labyrinth). :::note The bot traffic module includes features and settings from [Bots](/bots/) in the previous dashboard navigation structure. ::: ### API abuse module In the **API abuse** security module you can perform the following tasks: - Review information about [Endpoint Discovery](/api-shield/security/api-discovery/) (always enabled if included in your Enterprise subscriptions). - Enable [Sequence Discovery](/api-shield/security/sequence-analytics/) (requires that you configure a session identifier). - Enable [Schema Validation](/api-shield/security/schema-validation/) (requires that you upload a schema or apply a learned schema). - Enable [JWT Validation](/api-shield/security/jwt-validation/) (requires that you add a [JWT configuration](/api-shield/security/jwt-validation/configure/#token-configurations)). :::note The API abuse module includes features and settings from [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ### Client-side abuse module In the **Client-side abuse** security module you can perform the following tasks: - Turn [continuous script monitoring](/page-shield/how-it-works/) on or off (previously you turned [Page Shield](/page-shield/) on or off). - Create a [client-side resource alert](/page-shield/reference/alerts/) (also known as a Page Shield alert). - Set the [reporting endpoint](/page-shield/reference/settings/#reporting-endpoint) to use your hostname instead of a Cloudflare-owned endpoint (only for Enterprise customers with a paid add-on). - Adjust the [data logged in client-side abuse reports](/page-shield/reference/settings/#connection-target-details) (only the hostname or the full URI). :::note The client-side abuse module includes features and settings from [Page Shield](/page-shield/) in the previous dashboard navigation structure. ::: ## All settings This section allows you to configure multiple security-related settings. The following table links to additional information about each setting: | Setting | Location in previous dashboard navigation | | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | [Endpoint labels](/api-shield/management-and-monitoring/endpoint-labels/) | **Security** > **Settings** > **Labels** | | [Session identifiers](/api-shield/management-and-monitoring/session-identifiers/#rule-form) | **Security** > **API Shield** > **Settings** | | [Schemas default action](/api-shield/security/schema-validation/#change-the-global-default-action-of-schema-validation) | **Security** > **API Shield** > **Schema Validation** | | [Uploaded schemas](/api-shield/security/schema-validation/) | **Security** > **API Shield** > **Schema Validation** | | [Learned schemas](/api-shield/security/schema-validation/) | **Security** > **API Shield** > **Schema Validation** | | [Token configuration](/api-shield/security/jwt-validation/#add-a-token-validation-configuration) | **Security** > **API Shield** > **Settings** | | [Client-side resource alerts](/page-shield/detection/configure-alerts/#rule-form) | **Security** > **Page Shield** > **Settings**
Account Home > **Notifications** | | [Reporting endpoint](/page-shield/reference/settings/#reporting-endpoint) | **Security** > **Page Shield** > **Settings** | | [Data processing](/page-shield/reference/settings/#connection-target-details) | **Security** > **Page Shield** > **Settings** | | [IP lists](/waf/tools/lists/custom-lists/#ip-lists) | Account Home > **Manage Account** > **Configurations** | | [Custom username and password location](/waf/detections/leaked-credentials/#custom-detection-locations) | **Security** > **Settings** | | [Custom content location](/waf/detections/malicious-uploads/#custom-scan-expressions) | **Security** > **Settings** | | [Custom sensitive data deployment](/waf/managed-rules/reference/sensitive-data-detection/#configure-in-the-dashboard) | **Security** > **Sensitive Data** | | [Block definitely automated traffic](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Block likely bots](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Managed `robots.txt`](/bots/additional-configurations/managed-robots-txt/) | **Security** > **Bots** > **Configure Bot Fight Mode
Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Allow verified bots](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Static resource protection](/bots/additional-configurations/static-resources/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Optimize for WordPress](/bots/troubleshooting/wordpress-loopback-issue/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [JavaScript detections](/bots/additional-configurations/javascript-detections/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Auto-update machine learning model](/bots/reference/machine-learning-models/) | **Security** > **Bots** > **Configure Bot Management** | | [Enable Security.txt](/security-center/infrastructure/security-file/) | **Security** > **Settings** | | [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage) | **Security** > **Settings** | | [Browser Integrity Check](/waf/tools/browser-integrity-check/) | **Security** > **Settings** | | [Replace insecure JavaScript libraries](/waf/tools/replace-insecure-js-libraries/) | **Security** > **Settings** | | [Security Level](/waf/tools/security-level/) | **Security** > **Settings** | --- # Web assets URL: https://developers.cloudflare.com/security/web-assets/ Discover web assets such as your API endpoints and instruct Cloudflare how to best protect them. ## Endpoints Use the **Endpoints** tab to manage endpoints available on your domain and monitor their health. You can save endpoints directly from [API Discovery](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-api-discovery), [manually](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-manually) by method, path, and host, or via [Schema Validation](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-schema-validation). This will add the specified endpoints to your list of managed endpoints. You can view your list of managed endpoints in the **Endpoints** tab. For saved endpoints: - Cloudflare will start collecting [performance data](/api-shield/management-and-monitoring/endpoint-management/#endpoint-analysis) per endpoint. - You can use the [labeling service](/api-shield/management-and-monitoring/endpoint-labels/) to organize your endpoints by use case. For more information on how to manage your endpoints, refer to the following resources. - [Endpoint Management](/api-shield/management-and-monitoring/endpoint-management/) - [Schema learning](/api-shield/management-and-monitoring/endpoint-management/schema-learning/) - [Endpoint Analysis](/api-shield/management-and-monitoring/endpoint-management/#endpoint-analysis) ## Discovery **Discovery** continuously finds your active API endpoints via path normalization. [Add endpoints](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-api-discovery) to produce recommendations and analytics of your APIs. Your [session identifiers](/api-shield/management-and-monitoring/session-identifiers/) must match your API traffic. Otherwise, API endpoints are also discoverable via [Machine Learning](/api-shield/security/api-discovery/#machine-learning-based-discovery). :::note **Discovery** is only available for Enterprise customers. If you are an Enterprise customer and interested in this product, contact your account team. ::: ## Sequences Use **Sequences** to discover how users interact with your API, by tracking the order of API session requests over time. Sequences will group and highlight popular user journeys across your API. Once you configure [session identifiers](/api-shield/management-and-monitoring/session-identifiers/), the **Sequences** tab will start grouping and highlighting important user journeys (sequences) across your API. To configure session identifiers, go to **Security** > **Settings** > **All settings** tab and select **Edit** next to **Session identifiers**. For more information on how Cloudflare identifies API sequences and how you can configure API sequence rules, refer to the following resources: - [Sequence analytics](/api-shield/security/sequence-analytics/) - [Sequence mitigation](/api-shield/security/sequence-mitigation/) :::note The **Sequences** tab includes functionality available in [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ## Schema validation Use **Schema validation** to check if your incoming traffic complies with a previously supplied API Schema. API Schemas are defined by the validity of the API request's properties such as target endpoint, path or query variable format, and HTTP method. A rule is created for incoming traffic and defines which traffic is allowed and which traffic is logged or blocked based on the API schema that you provide or select from the list of learned schemas. You can add schema validation by: - [Uploading a schema](/api-shield/security/schema-validation/#add-validation-by-uploading-a-schema) - [Applying a learned schema to a single endpoint](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-a-single-endpoint) - [Applying a learned schema to an entire hostname](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-an-entire-hostname) - [Adding a fallthrough rule](/api-shield/security/schema-validation/#add-validation-by-adding-a-fallthrough-rule) :::note The **Schema validation** tab includes functionality available in [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ## Client-side resources Use **Client-side resources** to [monitor scripts, connections, and cookies](/page-shield/detection/monitor-connections-scripts/) on your domain. If you notice unexpected scripts or connections on the dashboard, check them for signs of malicious activity. You should also check for any new or unexpected cookies. Enterprise customers with a paid add-on will have their connections and scripts [classified as potentially malicious](/page-shield/how-it-works/malicious-script-detection/) based on threat feeds. :::note The **Client-side resources** tab includes functionality available in [Page Shield](/page-shield/) in the previous dashboard navigation structure. ::: --- # Security reports URL: https://developers.cloudflare.com/security-center/app-security-reports/ :::note Currently, this feature is only available to Enterprise customers. ::: Application security reports provide visibility into requests blocked or challenged by the Cloudflare Application Security suite of products. These reports allow you to get insights and analyze trends for all the zones in your account on a monthly basis, covering the mitigation actions performed by all Cloudflare layer 7 (application layer) security products. Each report includes an overview section and a per-product breakdown. Cloudflare automatically generates a report every month, usually within the first five days of the month. To dive deeper into the mitigations performed by Cloudflare security products, use the [Security Analytics](/waf/analytics/security-analytics/) dashboard. ## Download a report To download a monthly application security report: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com) and select your account. 2. Go to **Security Center** > **Security Reports**. 3. For a given month and year, select **Download** to download the report for that particular month. :::caution Due to limitations in the current reporting solution, some customers do not have access to reports from the past few months. We are working on a new version of app security reports without the current limitations. ::: *** ## Required roles A Cloudflare user must have one of the following [roles](/fundamentals/setup/manage-members/roles/) to download application security reports: * Super Administrator * Administrator ## Number of mitigated requests As of the April 2023 report, the number of mitigated requests in each report is a sum of the following requests: * Blocked requests * Challenged requests that were not solved or bypassed (that is, not issued again because the visitor had previously passed a similar challenge) --- # Blocked Content URL: https://developers.cloudflare.com/security-center/blocked-content/ If your domain has content that has been blocked, Blocked Content on the dashboard gives you the ability to request the Trust and Safety team to remove a block. To view Blocked Content on the dashboard: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Security Center** > **Blocked Content**. :::note You must have Admin, Super Admin, or Trust and Safety [role](/fundamentals/setup/manage-members/roles/) to access Blocked Content. ::: The Security Center dashboard displays three statuses for blocked content: active, pending, or resolved blocks. ## Active blocks An active block is a block that is in effect on blocking content. When you select **Request Review**, the status changes to **In Review**, and the block will be reviewed by the Trust and Safety team. ## Pending blocks A pending block represents a blocking action Cloudflare will take at the scheduled time. You can view all your pending blocks by selecting **Pending** on the dashboard. Selecting **Request Review** cancels the pending delayed action. This means that the block will not be placed. ## Resolved blocks Resolved blocks list your recently resolved blocks. Resolved blocks are limited to 30 days of recently resolved blocks. Resolved blocks require no action. You can only sort and/or filter the list. --- # Brand Protection URL: https://developers.cloudflare.com/security-center/brand-protection/ import { AvailableNotifications, Render } from "~/components" :::note[User permission] While the Brand Protection tool is in beta, all Cloudflare Enterprise customers have automatic access to Brand Protection, including five saved queries. Only Admin, Super Admin and users with a Brand Protection role can access Brand Protection ::: ## Domain search To start searching for new domains that might be trying to impersonate your brand: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Security Center** > **Brand Protection**. 3. In **String query**, provide a name for your query. You can add multiple brand phrases on the same query, and the results will generate matches for all of those. Once you entered the string queries, select **Search matches**. 4. In the **Character distance**, select from `0-3`. The number of characters the results can differ from your domain. :::note If a brand phrase or search term has less than five characters, you can only choose a max distance of `0` (zero). ::: 5. You can select **Save query** to monitor it in the future and perform other actions, such as delete, clone and set up alerts, according to your Paid plan limits. 6. To export all matches from a saved query, select your **Query name** > select the three dots > **Export matches**. In the section **Monitor Strings**, you can check all the string queries that you selected to monitor. You can delete, clone, or create notifications for a string query. Refer to [Brand Protection Alerts](#brand-protection-alerts) to set up notifications. ### Report abuse :::note[Submit abuse report] You can only submit an abuse report if your domain is with [Cloudflare Registrar](https://www.cloudflare.com/products/registrar/), or if the IP used by the domain is hosted by Cloudflare. ::: To submit abuse reports directly from the dashboard: 1. Go to the **Query name** you want to report. 2. Select **Report to Cloudflare**. 3. Fill in the details to submit an abuse report. 4. Select **Submit**. ## Logo queries To set up a new logo query: 1. Go to **Security Center** > **Monitor Logos** and select **Add logo**. 2. Add a name for your query and upload your logo. Only the `.png`, `.jpeg`, and `.jpg` file extensions are supported. 3. Select **Save logo**. The browser will return to the **Monitor Images** overview page, where you can access your query and configure notifications. ## Investigate a query In this section, the dashboard displays: - **Domain overview**. - **WHOIS** that provides details about the date the domain was created, registrant and nameservers. - **Domain history** that provides information on the domain category and when it was last changed. Refer to [Investigate threats](/security-center/investigate/investigate-threats/) for more details. - **URL Reports** that provides information on any reported URL. To investigate a string query: 1. Go to the **Monitor Strings** or **Monitor Logos** section to view all your queries. 2. Select a monitored query to inspect all the domains that matched your query. 3. Next to the domain, select **Domain** or **URL**. This will trigger a search on the [**Investigate**](/security-center/investigate/) section in a separate tab. URL scanner will also be triggered from **Brand Protection** through **Security Center** > **Investigate**. You will also have access to a report which will be generated automatically. The report will display screenshots of the matched domain, and the registrar of your domain. ## Brand Protection Alerts To set up a Brand Protection Alert: 1. Go to **Monitor Strings** and locate the query for which you would like to create notifications. 2. Select **alerts**. This should redirect you to the **Add Notification** page, where you can configure what you want to be notified about, and how. :::note You can also set up the alerts from your [Notifications](/notifications/) menu. ::: 3. Create a notification name, add a description (optional), and select the monitored queries. You can also add a Webhook, and a notification email. You can add multiple email addresses. 4. Select **Save**. Manage your notifications in the **All notifications** tab. You can disable, edit, delete, or test them. ## Limitations * While this product is in beta, all Enterprise customers and Cloudforce One subscribers have access to Brand Protection. Enterprise customers are entitled to one saved query per Enterprise zone on their account. * You may only use the Brand Protection search tools to search for domains that may be attempting to impersonate your brand or a brand that has authorized you to conduct such search on its behalf. --- # Changelog URL: https://developers.cloudflare.com/security-center/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/security-center/get-started/ import { Render } from "~/components" This guide covers the steps you need to take to set up Security Center in your Cloudflare account for the first time. ## Prerequisites * A Cloudflare account * At least one zone onboarded to Cloudflare ## Enable Security Insights and start initial scan ### Start a new scan To manually start a scan: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account. 2. Go to Account Home > **Security Center** > **Infrastructure**. 3. Select **Scan now**. ### Scan Frequency Once you enable Security Insights, Cloudflare performs scans at a [regular frequency](/security-center/security-insights/how-it-works/#scan-frequency), according to your Cloudflare plan. --- # Cloudflare Security Center URL: https://developers.cloudflare.com/security-center/ import { LinkButton, Render } from "~/components" ## Main features Get started *** ## Availability Cloudflare Security Center is available to customers on all plans. If you have any comments, questions, or bugs to report, create a post in the [Cloudflare Community forum](https://community.cloudflare.com/c/security/security-center/65). The frequency of security scans depends on your Cloudflare plan. Refer to [Scan frequency](/security-center/security-insights/how-it-works/#scan-frequency) for more information. ## Limitations * Users with an [Administrator Read Only](/fundamentals/setup/manage-members/roles/#account-scoped-roles) role cannot access the Cloudflare Security Center. * Only Cloudflare accounts with at least one Business or Enterprise zone, or accounts on the Teams Standard or Teams Enterprise plans, can manually start a new scan. --- # Custom Indicator Feeds URL: https://developers.cloudflare.com/security-center/indicator-feeds/ import { Render } from "~/components"; Cloudflare's threat intelligence team crowdsources attack trends and protects users automatically, such as from zero-day vulnerabilities like the [HTTP/2 Rapid Reset attack](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/). However, in some cases, Cloudflare will partner with external entities that have their own feeds which can be shared with eligible Cloudflare users. With Custom Indicator Feeds, Cloudflare provides a threat intelligence feed based on data received from various Cyber Defense Collaboration groups. The security filtering capabilities are available to eligible public and private sector organizations. ## Publicly available feeds Cloudflare provides some feeds to Gateway users without the need to establish a provider relationship. | Name | Description | Availability | | ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | | [Treasury Early Indicator Feed](https://www.cloudflare.com/press-releases/2024/us-department-of-treasury-pnnl-finserv-threat-intel-feed/) | Threat data for financial institutions provided by the US Department of Treasury and Pacific Northwest National Laboratory (PNNL). For more information, contact your account team. | Approved financial services organizations | | [UK NCSC Public Threat Indicators](https://www.ncsc.gov.uk/information/pdns) | Recursive DNS service supplied by the UK National Cyber Security Centre (NCSC) to block DNS-based malware. | All users | | Cloudforce One - Public Feed | Feed of indicators. | All users | ## Get started If your organization is interested in becoming a provider or a subscriber, contact your account team. ### Create a Custom Indicator Feed Providers can create and manage a Custom Indicator Feed with the [Custom Indicator Feeds API endpoints](/api/resources/intel/subresources/indicator_feeds/methods/list/): 1. Contact your account team to configure your account as an indicator feed provider. 2. Create a feed with the [Create new indicator feed endpoint](/api/resources/intel/subresources/indicator_feeds/methods/create/). Make note of the `feed_id` generated for your feed. For example: ```bash title="Create new indicator feed" curl "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds" \ --header 'Content-Type: application/json' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --data '{ "description": "Custom indicator feed to detect threats", "name": "threat_indicator_feed" }' ``` ```json output {3} { "result": { "id": 10, "name": "threat_indicator_feed", "description": "Custom indicator feed to detect threats", "created_on": "2024-09-17T21:16:09.412Z", "modified_on": "2024-09-17T21:16:09.412Z" }, "success": true, "errors": [], "messages": [] } ``` 3. Upload data to the feed with the [Update indicator feed data endpoint](/api/resources/intel/subresources/indicator_feeds/subresources/snapshots/methods/update/). Uploaded indicator data must be in a [`.stix2`](https://oasis-open.github.io/cti-documentation/stix/intro) formatted file. ```bash title="Update indicator feed data" curl --request PUT \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//snapshot" \ --header 'Content-Type: multipart/form-data' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --form 'source=@/path/to/file' ``` ```json output { "result": { "file_id": 1, "filename": "snapshot_file.unified", "status": "unified" }, "errors": [], "messages": [], "success": true } ``` :::note Indicator feeds use a snapshot system. To update feeds with new data, providers must upload a file containing all previous and new indicators. ::: 4. (Optional) Verify the status of your feed upload with the [Get indicator feed data endpoint](/api/resources/intel/subresources/indicator_feeds/methods/data/). For example: ```bash title="Get indicator feed data" curl --request GET \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//data" \ --header 'Content-Type: application/json' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' ``` ```json output {8} { "result": { "id": 10, "name": "threat_indicator_feed", "description": "Custom indicator feed to detect threats", "created_on": "2023-08-01T18:00:26.65715Z", "modified_on": "2023-08-01T18:00:26.65715Z", "latest_upload_status": "Complete" }, "success": true, "errors": [], "messages": [] } ``` 5. Grant access to subscribers with the [Grant permission to indicator feed endpoint](/api/resources/intel/subresources/indicator_feeds/subresources/permissions/methods/create/). You can add subscribers to the feed's allowed subscribers list using their [account IDs](/fundamentals/setup/find-account-and-zone-ids/). For example: ```bash title="Update indicator feed data" curl --request PUT \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//snapshot" \ --header 'Content-Type: multipart/form-data' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --data '{ "account_tag": "823f45f16fd2f7e21e1e054aga4d2859", "feed_id": 10 }' ``` ### Use a feed in Gateway Once an account is granted access to a feed, it will be available to match traffic as a [selector in Gateway DNS policies](/cloudflare-one/policies/gateway/dns-policies/#indicator-feeds). 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**. Select **DNS**. 2. To create a new DNS policy, select **Add a policy**. 3. Name your policy. 4. In **Traffic**, add a condition with the **Indicator Feeds** selector. If your account has been granted access to a Custom Indicator Feed, Gateway will list the feed in **Value**. For example, you can block sites that appear in a feed: | Selector | Operator | Value | Action | | --------------- | -------- | ------------------- | ------ | | Indicator Feeds | in | _Threat Intel Feed_ | Block | 5. Select **Create policy**. For more information on creating Gateway policies, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/). --- # Changelog URL: https://developers.cloudflare.com/spectrum/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/spectrum/get-started/ import { Details, Render } from "~/components" Spectrum is available on all paid plans. Pro and Business support selected protocols only, whereas Enterprise supports all TCP and UDP based traffic. Refer to [Configuration options](/spectrum/reference/configuration-options/) for more configuration details. To create a Spectrum application, you can either use an IP address, a CNAME Record or a load balancer. Independently of the method you use, you can create the application through the dashboard or via [API](/api/resources/spectrum/subresources/apps/methods/list/). Certain fields in Spectrum request and response bodies require an Enterprise plan. Refer to the [Settings by plan](/spectrum/reference/settings-by-plan/) page for more details. ## Create a Spectrum application using an IP address To create a Spectrum application using an IP address, Cloudflare normally assigns you an arbitrary IP from Cloudflare’s IP pool to your application. If you want to use your own IP addresses, you can use [BYOIP](/spectrum/about/byoip/) or you can also use a [Static IP](/spectrum/about/static-ip/). In these two last cases, you need to create your Spectrum application through the API, as these features are not available via dash. When using the API, the field `origin_direct` takes as input the IP address.
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login). 2. Select **Spectrum**. 3. Select **Create an Application**. If this is your first time using Spectrum, the **Create an Application** modal appears. 4. Select your **Application Type**. 5. Under **Domain**, enter the domain that will use Spectrum. 6. Under **Edge Port**, enter the port Cloudflare should use for your application. 7. Under **Origin**, enter your application's origin IP and port. 8. If your application requires the client IP and supports [Proxy Protocol](https://www.haproxy.com/blog/haproxy/proxy-protocol/), enable **Proxy Protocols**. Proxy Protocol is a method for a proxy like Cloudflare to send the client IP to the origin application. 9. Select **Add**.
Below is a curl example and the associated data being posted to the API. **API example:** ```bash curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/spectrum/apps" \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{"protocol":"tcp/22","dns":{"type":"CNAME","name":"ssh.example.com"},"origin_direct":["tcp://192.0.2.1:22"],"proxy_protocol":"off","ip_firewall":true,"tls":"full","edge_ips":{"type":"dynamic","connectivity":"all"},"traffic_type":"direct","argo_smart_routing":true}' ``` **Example data:** ```json { "success": true, "errors": [], "messages": [], "result": { "id": "ea95132c15732412d22c1476fa83f27a", "protocol": "tcp/22", "dns": { "type": "CNAME", "name": "ssh.example.com" }, "origin_direct": [ "tcp://192.0.2.1:22" ], "proxy_protocol": "off", "ip_firewall": true, "tls": "full", "edge_ips": { "type": "dynamic", "connectivity": "all" }, "traffic_type": "direct", "argo_smart_routing": true, "created_on": "2014-01-02T02:20:00Z", "modified_on": "2014-01-02T02:20:00Z" } } ```
## Create a Spectrum application using a CNAME record To create a Spectrum application using a CNAME record, you will need to create a [CNAME record](https://www.cloudflare.com/learning/dns/dns-records/dns-cname-record/) on your Cloudflare hosted zone that points to your origin's hostname. This is required to resolve to your hostname origin. Refer to [Create DNS records](/dns/manage-dns-records/how-to/create-dns-records/#create-dns-records), for more information. When using a CNAME as an origin, note that Cloudflare needs to be authoritative for that zone. When using the API, the `origin_dns` field takes as input the CNAME record.
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login). 2. Select **Spectrum**. 3. Select **Create an Application**. If this is your first time using Spectrum, the **Create an Application** modal appears. 4. Select your **Application Type**. 5. Under **Domain**, enter the domain that will use Spectrum. 6. Under **Edge Port**, enter the port Cloudflare should use for your application. 7. Under **Origin**, enter your `CNAME` record name. 8. Select **Add**.
Below is a curl example and the associated data being posted to the API. **API example:** ```bash curl 'https://api.cloudflare.com/client/v4/zones/{zone_id}/spectrum/apps' \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{"dns":{"type":"CNAME","name":"spectrum-cname.example.com"},"ip_firewall":false,"protocol":"tcp/22","proxy_protocol":"off","tls":"off","origin_dns": {"name": "cname-to-origin.example.com", "ttl": 1200}, "origin_port": 22}' ``` **Example data:** ```json { "dns": { "type": "CNAME", "name": "spectrum-cname.example.com" }, "ip_firewall": false, "protocol": "tcp/22", "proxy_protocol": "off", "tls": "off", "origin_dns": { "name": "cname-to-origin.example.com", "ttl": 1200 }, "origin_port": 22 } ```
## Create a Spectrum application using a load balancer To create a Spectrum application using a load balancer, you will need to generate a load balancer from the dashboard or via the API. Refer to the [Load Balancing documentation](/load-balancing/additional-options/spectrum/#1-configure-your-load-balancer) for more details. :::note To prevent issues with DNS resolution for a Spectrum application, do not use the same Spectrum hostname as a current Load Balancing hostname. :::
## View traffic You can now proxy traffic through Cloudflare without additional configuration. As you run traffic through Cloudflare, you will see the last minute of traffic from **Spectrum** in the dashboard. If you have any feedback, please [let us know](https://community.cloudflare.com/c/website-application-performance/spectrum/48). --- # Glossary URL: https://developers.cloudflare.com/spectrum/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Spectrum documentation. --- # Cloudflare Spectrum URL: https://developers.cloudflare.com/spectrum/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Spectrum provides security and acceleration for any [TCP](https://www.cloudflare.com/learning/ddos/glossary/tcp-ip/) or [UDP](https://www.cloudflare.com/learning/ddos/glossary/user-datagram-protocol-udp/) based application. Spectrum allows you to route MQTT, email, file transfer, version control, games, and more over TCP or UDP through Cloudflare to mask the origin and protect it from [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/). --- ## Features Use a proxy protocol for Cloudflare to pass on the client IP to your service. Learn more about what L3/4 DDoS Protection is included as part of the Spectrum service. --- ## Related products Cloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised. With Bringing Your Own IPs (BYOIP), Cloudflare announces your IPs in all our locations. Cloudflare Load Balancing distributes traffic across your{" "} endpoints, which reduces endpoint strain and latency and improves the experience for end users. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. --- ## More resources Compare available Cloudflare plans. --- # Protocols per plan URL: https://developers.cloudflare.com/spectrum/protocols-per-plan/ import { FeatureTable } from "~/components" On this table, you have information about which protocols are available per plan. --- # Aggregated Internet Measurement URL: https://developers.cloudflare.com/speed/aim/ Aggregated Internet Measurement (AIM) helps you understand your Internet quality to identify scenarios that your Internet connection is good or bad for. Typically, an Internet speed test provides you with upload and download speeds, which may not always provide a holistic view of your Internet quality. AIM uses a scoring rubric that assigns point values based on speed tests to help you understand how your Internet quality will perform for streaming, gaming, and webchat/real-time communication (RTC). ## Scoring Rubric AIM analyzes the following metrics to generate your score: * Latency * Packet Loss * Download * Upload * Loaded Latency * Jitter After the test is run and a point value is assigned to each metric, the points are translated to a network score for streaming, gaming, and webchat/RTC. These scores will indicate how good your Internet is in each of these scenarios. The possible network scores are: * Bad * Poor * Average * Good * Great ## Improve your network score You have a few options to help improve network scores. * **Switch to a wired connection.** When possible, switch to a wired connection instead of wireless to avoid performance issues due to radio interference and signal strength. * **Move closer to your router.** If you are unable to use a wired connection, try to move closer to your wireless router. Signal strength drops as you move away from your wireless router and a weaker signal means poorer connectivity. Keep in mind that any objects or materials between you and your wireless router can also have a negative impact on signal strength. * **Upgrade your router.** Ensure you are using a router capable of handling smarter queueing with hardware that will not fall over under load. * **Contact your ISP.** If you’re using a wired connection or have a good connection to your wireless router and are still seeing issues, you may have issues with your Internet connection and should reach out to your ISP. --- # Glossary URL: https://developers.cloudflare.com/speed/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Speed documentation. --- # Speed URL: https://developers.cloudflare.com/speed/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Improve the performance of your website or web application. Speed allows you to assess the performance of your website and get recommendations of Cloudflare products to enhance the website performance. *** ## Features Use Observatory to conduct tests with both synthetic and real user data to identify potential website performance enhancements. Get recommendations of Cloudflare products and settings to improve your website’s performance. Understand your Internet quality to identify scenarios that your Internet connection is good or bad for. *** ## Related products Customize the cache properties of your HTTP requests. Understand the performance of your webpages as experienced by your site visitors. Transform images on Cloudflare's edge platform: resize, adjust quality, and convert images to WebP or AVIF format on demand. Take advantage of "server think time" to asynchronously send instructions to the browser to begin loading resources while the origin server is compiling the full response. *** ## More resources Learn about the quota limits for the number of tests you can run per month. Engage with other users and explore more resources on Cloudflare support forum. --- # Troubleshooting URL: https://developers.cloudflare.com/speed/troubleshooting/ import { TroubleshootingList } from "~/components" The following topics are useful for troubleshooting Speed issues. --- # Changelog URL: https://developers.cloudflare.com/ssl/changelog/ import { ProductChangelog } from "~/components"; {/* B((Cloudflare))<--Origin certificate--> C[(Origin server)] ``` ### Origin certificate [Origin certificates](/ssl/origin-configuration/) guarantee the security and authentication on the other side of the network, between Cloudflare and the origin server of your website or application. Origin certificates are managed on your origin server. [SSL/TLS encryption modes](/ssl/origin-configuration/ssl-modes/) control whether and how Cloudflare will use both these ceritifcates, and you can choose between different modes on the [SSL/TLS overview page](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls). ## Validity period One common aspect of every SSL/TLS certificate is that they must have a fixed expiration date. If a certificate is expired, clients - such as your visitor's browser - will consider that a secure connection cannot be established, resulting in warnings or errors. Different [certificate authorities (CAs)](#certificate-authority-ca) support different validity periods. Cloudflare works with them to guarantee that both [Universal](/ssl/edge-certificates/universal-ssl/) and [Advanced](/ssl/edge-certificates/advanced-certificate-manager/) edge certificates are always renewed. ## Certificate authority (CA) A [certificate authority (CA)](/ssl/reference/certificate-authorities/) is a trusted third party that generates and gives out SSL/TLS certificates. The CA digitally signs the certificates with their own private key, allowing client devices - such as your visitor's browser - to verify that the certificate is trustworthy. As explained in the article about [what is an ssl certificate](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/), this means that, besides not being expired, an SSL/TLS certificate should be issued by a certificate authority (CA) in order to avoid warnings or errors. ## Validation level SSL/TLS certificates vary in terms of the level to which a CA has validated them. As explained in the article about [types of certificates](https://www.cloudflare.com/learning/ssl/types-of-ssl-certificates/), SSL/TLS certificates can be DV (Domain Validated), OV (Organization Validated) or EV (Extended Validation).
## Origin pull When visitors request content from your website or application, Cloudflare first attempts to [serve content from the cache](https://www.cloudflare.com/learning/cdn/what-is-caching/). If this attempt fails, Cloudflare sends a request back to your origin web server to get the content. This request between Cloudflare and your origin web server is called origin pull. This relates to the difference between [edge certificates](#edge-certificate) and [origin certificates](#origin-certificate), and also explains why some specifications such as [cipher suites](#cipher-suites) can be set differently depending on whether they refer to the connection between Cloudflare and your visitor's browser or between Cloudflare and your origin server. ## Cipher suites Besides the authentication and integrity aspects that valid certificates guarantee, the other important aspect of SSL/TLS certificates is encryption. Cipher suites determine the set of algorithms that can be used for encryption/decryption and that will be negotiated during an [SSL/TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/). For the purpose of this documentation, keep in mind that [cipher suites supported at Cloudflare's network](/ssl/edge-certificates/additional-options/cipher-suites/supported-cipher-suites/) may not be the same as [cipher suites presented by Cloudflare to your origin server](/ssl/origin-configuration/cipher-suites/). ## Trust store The list of [certificate authority (CA)](#certificate-authority-ca) and intermediate certificates that are trusted by operating systems, web browsers or other software that interacts with SSL/TLS certificates is called trust store. Cloudflare maintains its trust store on a public [GitHub repository](https://github.com/cloudflare/cfssl_trust). While for most cases you do not have to worry about this list or how it is used when a client checks your SSL/TLS certificate, some features such as [Custom Origin Trust Store](/ssl/origin-configuration/custom-origin-trust-store/), and processes such as [bundle methodologies](/ssl/edge-certificates/custom-certificates/bundling-methodologies/), are directly related to it. ## Chain of trust Depending on your organization requirements, or if you have to troubleshoot an issue with your certificates, for example, you might come across the terms root certificate, intermediate certificate and leaf certificate. These terms refer to the way in which the certificate presented to a client - the leaf certificate - has to be traceable back to a trusted certificate authority (CA) certificate - the [root certificate](https://en.wikipedia.org/wiki/Root_certificate). This process is structured around a [chain of trust](https://en.wikipedia.org/wiki/Chain_of_trust). --- # Get started URL: https://developers.cloudflare.com/ssl/get-started/ import { GlossaryDefinition, Render } from "~/components" Follow the steps below to enable SSL/TLS protection for your application. ## Before you begin * [Create an account and register an application](/fundamentals/setup/) ## Choose an edge certificate As explained in the [concepts page](/ssl/concepts/#ssltls-certificate), edge certificates are the SSL/TLS certificates that Cloudflare presents to your visitors. Cloudflare offers a variety of options for your application's edge certificates: * [**Universal certificates**](/ssl/edge-certificates/universal-ssl/): * [**Advanced certificates**](/ssl/edge-certificates/advanced-certificate-manager/): * [**Custom certificates**](/ssl/edge-certificates/custom-certificates/): * [**Keyless certificates**](/ssl/keyless-ssl/) (Enterprise only): Refer to [Edge certificates](/ssl/edge-certificates/) for more information on how different certificate types can respond to common use cases. :::note[For SaaS providers] For more details, refer to [Cloudflare for SaaS (managed hostnames)](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/). ::: ## Choose your encryption mode Once you have chosen your edge certificate, [choose an encryption mode](/ssl/origin-configuration/ssl-modes/). Encryption modes specify how Cloudflare encrypts connections between (a) visitors and Cloudflare, and (b) Cloudflare and your origin server. For more context about this two-part process refer to the [concepts page](/ssl/concepts/#ssltls-certificate). Note that some encryption modes will require you to have a valid [origin certificate](/ssl/concepts/#origin-certificate), which is managed on your origin server. Each encryption mode setup page lists out this and other requirements and you can also [consider other Cloudflare options to use with your origin server](/ssl/origin-configuration/), such as [Origin CA certificates](/ssl/origin-configuration/origin-ca/). ## Enforce HTTPS connections ## Optional - Enable additional features --- # Cloudflare SSL/TLS URL: https://developers.cloudflare.com/ssl/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Encrypt your web traffic to prevent data theft and other tampering. Through [Universal SSL](/ssl/edge-certificates/universal-ssl/), Cloudflare is the first Internet performance and security company to offer free SSL/TLS protection. Cloudflare SSL/TLS also provides a number of other features to meet your encryption requirements and certificate management needs. Refer to [Get started](/ssl/get-started/) for more. *** ## Features Extending the protection offered by Universal SSL, Total TLS is an easy way to automatically issue certificates for all levels of subdomains that you have. Even if you use a different provider for authoritative DNS, you can delegate domain control validation (DCV) to Cloudflare, reducing the need of manual intervention. Cloudflare also allows you to specify the minimum TLS version that visitors must use to connect to your website or application, and [restrict cipher suites](/ssl/edge-certificates/additional-options/cipher-suites/customize-cipher-suites/) according to your security requirements.
Refer to [features and availability](/ssl/reference/all-features/) for a complete list of SSL/TLS features and their availability according to different Cloudflare plans. *** ## Related products When you use Cloudflare DNS, all DNS queries for your domain are answered by Cloudflare's global anycast network. This network delivers performance and global availability. Cloudflare for SaaS allows you to extend the security and performance benefits of Cloudflare's network to your customers via their own custom or vanity domains. --- # Changelog URL: https://developers.cloudflare.com/stream/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/stream/faq/ import { GlossaryTooltip } from "~/components" ## Stream ### What formats and quality levels are delivered through Cloudflare Stream? Cloudflare decides on which bitrate, resolution, and codec is best for you. We deliver all videos to industry standard H264 codec. We use a few different adaptive streaming levels from 360p to 1080p to ensure smooth streaming for your audience watching on different devices and bandwidth constraints. ### Can I download original video files from Stream? You cannot download the *exact* input file that you uploaded. However, depending on your use case, you can use the [Downloadable Videos](/stream/viewing-videos/download-videos/) feature to get encoded MP4s for use cases like offline viewing. ### Is there a limit to the amount of videos I can upload? * By default, a video upload can be at most 30 GB. * By default, you can have up to 120 videos queued or being encoded simultaneously. Videos in the `ready` status are playable but may still be encoding certain quality levels until the `pctComplete` reaches 100. Videos in the `error`, `ready`, or `pendingupload` state do not count toward this limit. If you need the concurrency limit raised, [contact Cloudflare support](/support/contacting-cloudflare-support/) explaining your use case and why you would like the limit raised. :::note The limit to the number of videos only applies to videos being uploaded to Cloudflare Stream. This limit is not related to the number of end users streaming videos. ::: * An account cannot upload videos if the total video duration exceeds the video storage capacity purchased. Limits apply to Direct Creator Uploads at the time of upload URL creation. Uploads over these limits will receive a [429 (Too Many Requests)](/support/troubleshooting/http-status-codes/4xx-client-error/#429-too-many-requests) or [413 (Payload too large)](/support/troubleshooting/http-status-codes/4xx-client-error/#413-payload-too-large) HTTP status codes with more information in the response body. Please write to Cloudflare support or your customer success manager for higher limits. ### Can I embed videos on Stream even if my domain is not on Cloudflare? Yes. Stream videos can be embedded on any domain, even domains not on Cloudflare. ### What input file formats are supported? Users can upload video in the following file formats: MP4, MKV, MOV, AVI, FLV, MPEG-2 TS, MPEG-2 PS, MXF, LXF, GXF, 3GP, WebM, MPG, QuickTime ### Does Stream support High Dynamic Range (HDR) video content? When HDR videos are uploaded to Stream, they are re-encoded and delivered in SDR format, to ensure compatibility with the widest range of viewing devices. ### What frame rates (FPS) are supported? Cloudflare Stream supports video file uploads for any FPS, however videos will be re-encoded for 70 FPS playback. If the original video file has a frame rate lower than 70 FPS, Stream will re-encode at the original frame rate. If the frame rate is variable we will drop frames (for example if there are more than 1 frames within 1/30 seconds, we will drop the extra frames within that period). ### What browsers does Stream work on? You can embed the Stream player on the following platforms: | Browser | Version | | ------- | ----------------------------------- | | Chrome | Supported since Chrome version 88+ | | Firefox | Supported since Firefox version 87+ | | Edge | Supported since Edge 89+ | | Safari | Supported since Safari version 14+ | | Opera | Supported since Opera version 75+ | :::note[Note] Cloudflare Stream is not available on Chromium, as Chromium does not support H.264 videos. ::: | Mobile Platform | Version | | --------------------- | ------------------------------------------------------------------------ | | Chrome on Android | Supported on Chrome 90 | | UC Browser on Android | Supported on version 12.12+ | | Samsung Internet | Supported on 13+ | | Safari on iOS | Supported on iOS 13.4+. Speed selector supported when not in fullscreen. | ### What are the recommended upload settings for video uploads? If you are producing a brand new file for Cloudflare Stream, we recommend you use the following settings: * MP4 containers, AAC audio codec, H264 video codec, 30 or below frames per second * moov atom should be at the front of the file (Fast Start) * H264 progressive scan (no interlacing) * H264 high profile * Closed GOP * Content should be encoded and uploaded in the same frame rate it was recorded * Mono or Stereo audio (Stream will mix audio tracks with more than 2 channels down to stereo) Below are bitrate recommendations for encoding new videos for Stream: | Resolution | Recommended bitrate | | ---------- | ------------------- | | 1080p | 8 Mbps | | 720p | 4.8 Mbps | | 480p | 2.4 Mbps | | 360p | 1 Mbps | ### If I cancel my stream subscription, are the videos deleted? Videos are removed if the subscription is not renewed within 30 days. ### I use Content Security Policy (CSP) on my website. What domains do I need to add to which directives? If your website uses Content Security Policy (CSP) directives, depending on your configuration, you may need to add Cloudflare Stream's domains to particular directives, in order to allow videos to be viewed or uploaded by your users. If you use the provided [Stream Player](/stream/viewing-videos/using-the-stream-player/), `videodelivery.net` and `*.cloudflarestream.com` must be included in the `frame-src` or `default-src` directive to allow the player's ` ``` The embed code above can also be found in the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream).
### Next steps * [Edit your video](/stream/edit-videos/) and add captions or watermarks * [Customize the Stream player](/stream/viewing-videos/using-the-stream-player/) ## Start your first live stream ### Step 1: Create a live input You can create a live input via the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs/create) or using the API. To use the API, replace the `API_TOKEN` and `ACCOUNT_ID` values with your credentials in the example below. ```bash title="Request" curl -X POST \ -H "Authorization: Bearer " \ -D '{"meta": {"name":"test stream"},"recording": { "mode": "automatic" }}' \ https://api.cloudflare.com/client/v4/accounts//stream/live_inputs ``` ```json title="Response" { "uid": "f256e6ea9341d51eea64c9454659e576", "rtmps": { "url": "rtmps://live.cloudflare.com:443/live/", "streamKey": "MTQ0MTcjM3MjI1NDE3ODIyNTI1MjYyMjE4NTI2ODI1NDcxMzUyMzcf256e6ea9351d51eea64c9454659e576" }, "created": "2021-09-23T05:05:53.451415Z", "modified": "2021-09-23T05:05:53.451415Z", "meta": { "name": "test stream" }, "status": null, "recording": { "mode": "automatic", "requireSignedURLs": false, "allowedOrigins": null } } ``` ### Step 2: Copy the RTMPS URL and key, and use them with your live streaming application. We recommend using [Open Broadcaster Software (OBS)](https://obsproject.com/) to get started. ### Step 3: Play the live stream in your website or app Live streams can be played on any device and platform, from websites to native apps, using the same video players as videos uploaded to Stream. See [Play videos](/stream/viewing-videos) for details and examples of video playback across platforms. To play the live stream you just started on your website with the [Stream Player](/stream/viewing-videos/using-the-stream-player/), copy the `uid` of the live input from the request above, along with your unique customer code, and replace `` and `` in the embed code below: ```html ``` The embed code above can also be found in the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream). ### Next steps * [Secure your stream](/stream/viewing-videos/securing-your-stream/) * [View live viewer counts](/stream/getting-analytics/live-viewer-count/) ## Accessibility considerations To make your video content more accessible, include [captions](/stream/edit-videos/adding-captions/) and [high-quality audio recording](https://www.w3.org/WAI/media/av/av-content/). --- # Cloudflare Stream URL: https://developers.cloudflare.com/stream/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Render } from "~/components" Serverless live and on-demand video streaming Cloudflare Stream lets you or your end users upload, store, encode, and deliver live and on-demand video with one API, without configuring or maintaining infrastructure. You can use Stream to build your own video features in websites and native apps, from simple playback to an entire video platform. Cloudflare Stream runs on [Cloudflare’s global cloud network](https://www.cloudflare.com/network/) in hundreds of cities worldwide. Get started Stream dashboard *** ## Features Restrict access to paid or authenticated content with signed URLs. Let users in your app upload videos directly to Stream with a unique, one-time upload URL. Play on-demand and live video on websites, in native iOS and Android apps, and dedicated streaming devices like Apple TV. Understand and analyze which videos and live streams are viewed most and break down metrics on a per-creator basis. *** ## More resources Join the Stream developer community --- # Pricing URL: https://developers.cloudflare.com/stream/pricing/ Cloudflare Stream lets you broadcast, store, and deliver video using a simple, unified API and simple pricing. Stream bills on two dimensions only: - **Minutes of video stored:** the total duration of uploaded video and live recordings - **Minutes of video delivered:** the total duration of video delivered to end users On-demand and live video are billed the same way. Ingress (sending your content to us) and encoding are always free. Bandwidth is already included in "video delivered" with no additional egress (traffic/bandwidth) fees. ## Minutes of video stored Storage is a prepaid pricing dimension purchased in increments of $5 per 1,000 minutes stored, regardless of file size. You can check how much storage you have and how much you have used on the [Stream](https://dash.cloudflare.com/?to=/:account/stream) page in Dash. Storage is consumed by: - Original videos uploaded to your account - Recordings of live broadcasts - The reserved `maxDurationSeconds` for Direct Creator and TUS uploads which have not been completed. After these uploads are complete or the upload link expires, this reservation is released. Storage is not consumed by: - Videos in an unplayable or errored state - Expired Direct Creator upload links - Deleted videos - Downloadable files generated for [MP4 Downloads](/stream/viewing-videos/download-videos/) - Multiple quality levels that Stream generates for each uploaded original Storage consumption is rounded up to the second of video duration; file size does not matter. Video stored in Stream does not incur additional storage fees from other storage products such as R2. :::note If you run out of storage, you will not be able to upload new videos or start new live streams until you purchase more storage or delete videos. Enterprise customers _may_ continue to upload new content beyond their contracted quota without interruption. ::: ## Minutes of video delivered Delivery is a post-paid, usage-based pricing dimension billed at $1 per 1,000 minutes delivered. You can check how much delivery you have used on the [Billable Usage](https://dash.cloudflare.com/?to=/:account/billing/billable-usage) page in Dash or the [Stream Analytics](https://dash.cloudflare.com/?to=/:account/stream/analytics) page under Stream. Delivery is counted for the following uses: - Playback on the web or an app using [Stream's built-in player](/stream/viewing-videos/using-the-stream-player/) or the [HLS or DASH manifests](/stream/viewing-videos/using-own-player/) - MP4 Downloads - Simulcasting via SRT or RTMP live outputs Delivery is counted by HTTP requests for video segments or parts of the MP4. Therefore: - Client-side preloading and buffering is counted as billable delivery. - Content played from client-side/browser cache is _not_ billable, like a short looping video. Some mobile app player libraries do not cache HLS segments by default. - MP4 Downloads are billed by percentage of the file delivered. Minutes delivered for web playback (Stream Player, HLS, and DASH) are rounded to the _segment_ length: for uploaded content, segments are four seconds. Live broadcast and recording segments are determined by the keyframe interval or GOP size of the original broadcast. ## Example scenarios **Two people each watch thirty minutes of a video or live broadcast. How much would it cost?** This will result in 60 minutes of Minutes Delivered usage (or $0.06). Stream bills on total minutes of video delivered across all users. **I have a really large file. Does that cost more?** The cost to store a video is based only on its duration, not its file size. If the file is within the [30GB max file size limitation](/stream/faq/#is-there-a-limit-to-the-amount-of-videos-i-can-upload), it will be accepted. Be sure to use an [upload method](/stream/uploading-videos/) like Upload from Link or TUS that handles large files well. **If I make a Direct Creator Upload link with a maximum duration (`maxDurationSeconds`) of 600 seconds which expires in 1 hour, how is storage consumed?** - Ten minutes (600 seconds) will be subtracted from your available storage immediately. - If the link is unused in one hour, those 10 minutes will be released. - If the creator link is used to upload a five minute video, when the video is uploaded and processed, the 10 minute reservation will be released and the true five minute duration of the file will be counted. - If the creator link is used to upload a five minute video but it fails to encode, the video will be marked as errored, the reserved storage will be released, and no storage use will be counted. **I am broadcasting live, but no one is watching. How much does that cost?** A live broadcast with no viewers will cost $0 for minutes delivered, but the recording of the broadcast will count toward minutes of video stored. If someone watches the recording, that will be counted as minutes of video delivered. If the recording is deleted, the storage use will be released. **I want to store and deliver millions of minutes a month. Do you have volume pricing?** Yes, contact our [Sales Team](https://www.cloudflare.com/plans/enterprise/contact/). --- # WebRTC URL: https://developers.cloudflare.com/stream/webrtc-beta/ import { Badge, InlineBadge } from '~/components'; Sub-second latency live streaming (using WHIP) and playback (using WHEP) to unlimited concurrent viewers. WebRTC is ideal for when you need live video to playback in near real-time, such as: * When the outcome of a live event is time-sensitive (live sports, financial news) * When viewers interact with the live stream (live Q\&A, auctions, etc.) * When you want your end users to be able to easily go live or create their own video content, from a web browser or native app :::note WebRTC streaming is currently in beta, and we'd love to hear what you think. Join the Cloudflare Discord server [using this invite](https://discord.com/invite/cloudflaredev/) and hop into our [Discord channel](https://discord.com/channels/595317990191398933/893253103695065128) to let us know what you're building with WebRTC! ::: ## Step 1: Create a live input [Use the Stream Dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs/create), or make a POST request to the [`/live_inputs` API endpoint](/api/resources/stream/subresources/live_inputs/methods/create/) ```json title="API response from a POST request to /live_inputs" {5} { "uid": "1a553f11a88915d093d45eda660d2f8c", ... "webRTC": { "url": "https://customer-.cloudflarestream.com//webRTC/publish" }, "webRTCPlayback": { "url": "https://customer-.cloudflarestream.com//webRTC/play" }, ... } ``` ## Step 2: Go live using WHIP Every live input has a unique URL that one creator can be stream to. This URL should *only* be shared with the creator — anyone with this URL has the ability to stream live video to this live input. Copy the URL from the `webRTC` key in the API response (see above), or directly from the [Cloudflare Dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs). Paste this URL into the example code. ```javascript title="Simplified example code" {4} // Add a