# Verify connection URL: https://developers.cloudflare.com/1.1.1.1/check/ import { PublicStats } from "~/components"; After setting up `1.1.1.1`, you can check if you are correctly connected to Cloudflare's resolver. 1. Open a web browser on a configured device (smartphone or computer) or on a device connected to your configured router. 2. Enter [https://1.1.1.1/help](https://one.one.one.one/help) on the browser address bar. Wait for the page to load and run its tests. The page will present you a summary of the type of connection you have to `1.1.1.1`, as well as the Cloudflare data center you are connected to. --- # FAQ URL: https://developers.cloudflare.com/1.1.1.1/faq/ import { GlossaryTooltip } from "~/components" Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. ## What is 1.1.1.1? 1.1.1.1 is Cloudflare's fast and secure DNS resolver. When you request to visit an application like `cloudflare.com`, your computer needs to know which server to connect you to so that it can load the application. Computers do not know how to do this name to address translation, so they ask a specialized server to do it for them. This specialized server is called a DNS recursive resolver. The resolver's job is to find the address for a given name, like `2400:cb00:2048:1::c629:d7a2` for `cloudflare.com`, and return it to the computer that asked for it. Computers are configured to talk to specific DNS resolvers, identified by IP address. Usually the configuration is managed by your ISP (like Comcast or AT\&T) if you are on your home or wireless Internet, and by your network administrator if you are connected to the office Internet. You can also change the configured DNS resolver your computer talks to yourself. ## How can I check if my computer / smartphone / tablet is connected to 1.1.1.1? Visit [1.1.1.1/help](https://one.one.one.one/help) to make sure your system is connected to 1.1.1.1 and that it is working. ## What do DNS resolvers do? DNS resolvers are like address books for the Internet. They translate the name of places to addresses so that your browser can figure out how to get there. DNS resolvers do this by working backwards from the top until they find the website you are looking for. Every resolver knows how to find the invisible `.` at the end of domain names (for example, `cloudflare.com.`). There are [hundreds of root servers](http://www.root-servers.org/) all over the world that host the `.` file, and resolvers are [hard coded to know the IP addresses](http://www.internic.net/domain/named.root) of those servers. Cloudflare itself hosts [that file](http://www.internic.net/domain/root.zone) on all of its servers around the world through a [partnership with ISC](https://blog.cloudflare.com/f-root/). The resolver asks one of the root servers where to find the next link in the chain — the top-level domain (abbreviated to TLD) or domain ending. An example of a TLD is `.com` or `.org`. Luckily, the root servers store the locations of all the TLD servers, so they can return which IP address the DNS resolver should go ask next. The resolver then asks the TLD's servers where it can find the domain it is looking for. For example, a resolver might ask `.com` where to find `cloudflare.com`. TLDs host a file containing the location of every domain using the TLD. Once the resolver has the final IP address, it returns the answer to the computer that asked. This whole system is called the [Domain Name System (DNS)](https://www.cloudflare.com/learning/dns/what-is-dns/). This system includes the servers that host the information (called [authoritative DNS](https://www.cloudflare.com/learning/dns/dns-server-types/)) and the servers that seek the information (the DNS resolvers). ## Does 1.1.1.1 support ANY? Cloudflare [stopped supporting the ANY query](https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/) in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. 1.1.1.1 returns `NOTIMPL` when asked for `qtype==ANY`. ## How does 1.1.1.1 work with DNSSEC? 1.1.1.1 is a DNSSEC validating resolver. 1.1.1.1 sends the `DO` (`DNSSEC OK`) bit on every query to convey to the authoritative server that it wishes to receive signed answers if available. 1.1.1.1 supports the signature algorithms specified in [Supported DNSKEY signature algorithms](/1.1.1.1/encryption/dnskey/). ## ​Does 1.1.1.1 send EDNS Client Subnet header? 1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet (ECS) header to authoritative servers. The exception is the single Akamai debug domain `whoami.ds.akahelp.net` to aid in cross-provider debugging. However, Cloudflare does not send ECS to any of Akamai's production domains, such as `akamaihd.net` or similar. ## Does 1.1.1.1 support IPv6? 1.1.1.1 has full IPv6 support. ## What is Purge Cache? 1.1.1.1's Purge Cache tool allows you to refresh 1.1.1.1's DNS cache for domain names. To refresh the cache for a domain name, visit the [Purge Cache page](https://one.one.one.one/purge-cache/). ## What is query name minimization? Cloudflare minimizes privacy leakage by only sending minimal query name to authoritative DNS servers. For example, if a client is looking for foo.bar.example.com, the only part of the query 1.1.1.1 discloses to .com is that we want to know who's responsible for example.com and the zone internals stay hidden. ## What are root hints? For decreased latency, reduced privacy leakage of queries and lower load on the DNS system, 1.1.1.1 upstreams to [locally hosted root zone files](https://blog.cloudflare.com/f-root/). ## Can IPs used by 1.1.1.1 be allowlisted? Authoritative DNS providers may want to allowlist IP's 1.1.1.1 uses to query upstream DNS providers. The comprehensive list of IP's to allowlist is available at [https://www.cloudflare.com/ips/](https://www.cloudflare.com/ips/). --- # 1.1.1.1 (DNS Resolver) URL: https://developers.cloudflare.com/1.1.1.1/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Speed up your online experience with Cloudflare's public DNS resolver. 1.1.1.1 is Cloudflare’s public DNS resolver. It offers a fast and private way to browse the Internet. [DNS resolvers](https://www.cloudflare.com/learning/dns/what-is-dns/) translate domains like `cloudflare.com` into the IP addresses necessary to reach the website (like `104.16.123.96`). Unlike most DNS resolvers, 1.1.1.1 does not sell user data to advertisers. 1.1.1.1 has also been measured to be the [fastest DNS resolver available](https://www.dnsperf.com/#!dns-resolvers) — it is deployed in [hundreds of cities worldwide](https://www.cloudflare.com/network/), and has access to the addresses of millions of domain names on the same servers it runs on. 1.1.1.1 is completely free. Setting it up takes minutes and requires no special software. *** ## Features 1.1.1.1 for Families has additional protection against malware and adult content. 1.1.1.1 offers an encrypted service through DNS over HTTPS (DoH) or DNS over TLS (DoT) for increased security and privacy. You can also access 1.1.1.1 [as a Tor hidden service](/1.1.1.1/other-ways-to-use-1.1.1.1/dns-over-tor/). *** ## Related products Access the Internet in a more secure and private way. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. Secure and accelerate your TCP or UDP based applications. --- # IP addresses URL: https://developers.cloudflare.com/1.1.1.1/ip-addresses/ import { Render } from "~/components" Consider the tables below to know which IPv4 or IPv6 addresses are used by the different Cloudflare DNS resolver offerings. For detailed guidance refer to [Set up](/1.1.1.1/setup/). *** ## 1.1.1.1 1.1.1.1 is Cloudflare’s public DNS resolver. It offers a fast and private way to browse the Internet. | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.1`
`1.0.0.1` | `2606:4700:4700::1111`
`2606:4700:4700::1001` | Refer to [Encryption](/1.1.1.1/encryption/) to learn how to use 1.1.1.1 in an encrypted way. *** ## 1.1.1.1 for Families 1.1.1.1 for Families categorizes destinations on the Internet based on the potential threat they pose regarding malware, phishing, or other types of security risks. For more information, refer to [1.1.1.1 for Families set up](/1.1.1.1/setup/#1111-for-families). ### Block malware | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.2`
`1.0.0.2` | `2606:4700:4700::1112`
`2606:4700:4700::1002` | ### Block malware and adult content | IPv4 | IPv6 | | ------------------------ | -------------------------------------------------- | | `1.1.1.3`
`1.0.0.3` | `2606:4700:4700::1113`
`2606:4700:4700::1003` | --- # Terms of use URL: https://developers.cloudflare.com/1.1.1.1/terms-of-use/ By using 1.1.1.1 Public DNS Resolver or 1.1.1.1 for Families, you consent to be bound by the [Cloudflare Website and Online Services Terms of Use](https://www.cloudflare.com/website-terms/). If you are an [Internet Service Provider (ISP) or network equipment provider](/1.1.1.1/infrastructure/network-operators/), you agree to provide proper attribution to Cloudflare in accordance with our Trademark Guidelines using our Public DNS Resolver. Please reach out to `resolver@cloudflare.com` for such logo requests. --- # Troubleshooting URL: https://developers.cloudflare.com/1.1.1.1/troubleshooting/ import { Render } from "~/components" This guide will help you diagnose and resolve common issues with Cloudflare's DNS Resolver. Before proceeding with manual troubleshooting steps, you can [verify your connection](/1.1.1.1/check/) to automatically gather relevant information. ## Name resolution issues ### Linux/macOS ```sh # Test DNS resolution dig example.com @1.1.1.1 dig example.com @1.0.0.1 dig example.com @8.8.8.8 # Check connected nameserver dig +short CHAOS TXT id.server @1.1.1.1 dig +short CHAOS TXT id.server @1.0.0.1 # Optional: Network information dig @ns3.cloudflare.com whoami.cloudflare.com txt +short ``` ### Windows ```sh # Test DNS resolution nslookup example.com 1.1.1.1 nslookup example.com 1.0.0.1 nslookup example.com 8.8.8.8 # Check connected nameserver nslookup -class=chaos -type=txt id.server 1.1.1.1 nslookup -class=chaos -type=txt id.server 1.0.0.1 # Optional: Network information nslookup -type=txt whoami.cloudflare.com ns3.cloudflare.com ``` **Note:** The network information command reveals your IP address. Only include this in reports to Cloudflare if you are comfortable sharing this information. For additional analysis, you can generate a [DNSViz](http://dnsviz.net/) report for the domain in question. ## Connectivity and routing issues Before reporting connectivity issues: 1. Search for existing reports from your country and ISP. 2. Run traceroutes to both Cloudflare DNS resolvers. ### Linux/macOS ```sh # Basic connectivity tests traceroute 1.1.1.1 traceroute 1.0.0.1 # If reachable, check nameserver identity dig +short CHAOS TXT id.server @1.1.1.1 dig +short CHAOS TXT id.server @1.0.0.1 # TCP connection tests dig +tcp @1.1.1.1 id.server CH TXT dig +tcp @1.0.0.1 id.server CH TXT ``` ### Windows ```sh # Basic connectivity tests tracert 1.1.1.1 tracert 1.0.0.1 # If reachable, check nameserver identity nslookup -class=chaos -type=txt id.server 1.1.1.1 nslookup -class=chaos -type=txt id.server 1.0.0.1 # TCP connection tests nslookup -vc -class=chaos -type=txt id.server 1.1.1.1 nslookup -vc -class=chaos -type=txt id.server 1.0.0.1 ``` ## DNS-over-TLS (DoT) troubleshooting ### Linux/macOS ```sh # Test TLS connectivity openssl s_client -connect 1.1.1.1:853 openssl s_client -connect 1.0.0.1:853 # Test DNS resolution over TLS kdig +tls @1.1.1.1 id.server CH TXT kdig +tls @1.0.0.1 id.server CH TXT ``` ### Windows Windows does not include a standalone DoT client. You can test TLS connectivity using OpenSSL after installing it manually. ## DNS-over-HTTPS (DoH) troubleshooting ### Linux/macOS ```sh curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=cloudflare.com&type=AAAA' ``` ### Windows ```powershell (Invoke-WebRequest -Uri 'https://cloudflare-dns.com/dns-query?name=cloudflare.com&type=AAAA').RawContent ``` ## Common issues ### First hop failures If your traceroute fails at the first hop, the issue is likely hardware-related. Your router may have a hardcoded route for 1.1.1.1. When reporting this issue, include: - Router make and model - ISP name - Any relevant router configuration details ## Additional resources - [1.1.1.1 DNS Resolver homepage](https://1.1.1.1) - [DNS over TLS documentation](/1.1.1.1/encryption/dns-over-tls/) - [Diagnostic tool](https://one.one.one.one/help/) --- # Analytics URL: https://developers.cloudflare.com/aegis/analytics/ import { Type, Render } from "~/components"; Use the [GraphQL API](/analytics/graphql-api/) to get aggregate data and monitor your Aegis IPs capacity. Refer to the GraphQL Analytics API documentation to [get started](/analytics/graphql-api/getting-started/). The specific Aegis schema is called `aegisIpUtilizationAdaptiveGroups`. You can get average (`avg`) or maximum (`max`) utilization values (in percentage), and use the following dimensions: - `datetimeFiveMinutes` - Timestamp truncated to five minutes. For example, `2025-01-10T00:05:00Z`. - `popName` - The Cloudflare point of presence (PoP). For example, `sjc`. - `egressIp` - Your assigned Aegis IP. For example, `192.0.2.1`. - `origin` - Origin IP and port. For example, `203.0.113.150:443`. - `popUtilizationKey` - The Cloudflare point of presence (PoP), the Aegis IP, and the origin IP and port. For example, `sjc 192.0.2.1 203.0.113.150:443`. --- # Cloudflare Aegis URL: https://developers.cloudflare.com/aegis/ import { CardGrid, Description, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct } from "~/components" Leverage dedicated IPs to improve your origin security and implement Zero Trust. Cloudflare Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 [WAF](/waf/) and CDN services, as well as [Spectrum](/spectrum/). The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. Both [BYOIP](/byoip) and Cloudflare-leased IPs are supported by Cloudflare Aegis. :::caution[Availability] Cloudflare Aegis is available in early access to Enterprise customers. Contact your account team to request access. ::: *** ## Related products Cloudflare Access determines who can reach your application by applying the Access policies you configure. Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Authenticated Origin Pulls gives you the ability to perform mutual TLS between Cloudflare and your origin environment, providing cryptographically verifiable proof of the source of the traffic you receive. *** ## More resources Deep dive into use cases where Aegis can help secure enterprise origins. Reference Architecture for multi-vendor application security and performance. --- # Setup URL: https://developers.cloudflare.com/aegis/setup/ import { APIRequest } from "~/components"; You can control Aegis enablement on your zones [via API](/api/resources/zones/subresources/settings/methods/edit/). If you are not familiar with how Cloudflare API works, refer to [Fundamentals](/fundamentals/api/). :::caution[Availability] Cloudflare Aegis is available in early access to Enterprise customers. Contact your account team to request access. ::: ## Requirements - The Aegis zone setting endpoint is only available within Cloudflare accounts that own leased IPs, or accounts to which a [BYOIP prefix](/byoip/) has been delegated. If you wish to use Aegis for zones that do not meet this criteria, contact your account team. - Each Aegis pool can consist of either IPs from a BYOIP prefix or Cloudflare-leased IPs. A single dedicated egress pool cannot contain both BYOIPs and leased IPs. ## Steps 1. Contact your account team to get the ID for your dedicated egress pool. 2. Make a `PATCH` request to the [Edit Zone Setting](/api/resources/zones/subresources/settings/methods/edit/) endpoint: - Specify `aegis` as the setting ID in the URL. - In the request body, set `enabled` to `true` and use the ID from the previous step as `pool_id`. ", }, }} parameters={{ setting_id: "aegis", }} /> --- # Build Agents on Cloudflare URL: https://developers.cloudflare.com/agents/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, PackageManagers, Plan, RelatedProduct, Render, TabItem, Tabs, TypeScriptExample, } from "~/components"; The Agents SDK enables you to build and deploy AI-powered agents that can autonomously perform tasks, communicate with clients in real time, call AI models, persist state, schedule tasks, run asynchronous workflows, browse the web, query data from your database, support human-in-the-loop interactions, and [a lot more](/agents/api-reference/). ### Ship your first Agent To use the Agent starter template and create your first Agent with the Agents SDK: ```sh # install it npm create cloudflare@latest agents-starter -- --template=cloudflare/agents-starter # and deploy it npx wrangler@latest deploy ``` Head to the guide on [building a chat agent](/agents/getting-started/build-a-chat-agent) to learn how the starter project is built and how to use it as a foundation for your own agents. If you're already building on [Workers](/workers/), you can install the `agents` package directly into an existing project: ```sh npm i agents ``` And then define your first Agent by creating a class that extends the `Agent` class: ```ts import { Agent, AgentNamespace } from 'agents'; export class MyAgent extends Agent { // Define methods on the Agent: // https://developers.cloudflare.com/agents/api-reference/agents-api/ // // Every Agent has built in state via this.setState and this.sql // Built-in scheduling via this.schedule // Agents support WebSockets, HTTP requests, state synchronization and // can run for seconds, minutes or hours: as long as the tasks need. } ``` Dive into the [Agent SDK reference](/agents/api-reference/agents-api/) to learn more about how to use the Agents SDK package and defining an `Agent`. ### Why build agents on Cloudflare? We built the Agents SDK with a few things in mind: - **Batteries (state) included**: Agents come with [built-in state management](/agents/api-reference/store-and-sync-state/), with the ability to automatically sync state between an Agent and clients, trigger events on state changes, and read+write to each Agent's SQL database. - **Communicative**: You can connect to an Agent via [WebSockets](/agents/api-reference/websockets/) and stream updates back to client in real-time. Handle a long-running response from a reasoning model, the results of an [asynchronous workflow](/agents/api-reference/run-workflows/), or build a chat app that builds on the `useAgent` hook included in the Agents SDK. - **Extensible**: Agents are code. Use the [AI models](/agents/api-reference/using-ai-models/) you want, bring-your-own headless browser service, pull data from your database hosted in another cloud, add your own methods to your Agent and call them. Agents built with Agents SDK can be deployed directly to Cloudflare and run on top of [Durable Objects](/durable-objects/) — which you can think of as stateful micro-servers that can scale to tens of millions — and are able to run wherever they need to. Run your Agents close to a user for low-latency interactivity, close to your data for throughput, and/or anywhere in between. --- ### Build on the Cloudflare Platform Build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. Observe and control your AI applications with caching, rate limiting, request retries, model fallback, and more. Build full-stack AI applications with Vectorize, Cloudflare’s vector database. Adding Vectorize enables you to perform tasks such as semantic search, recommendations, anomaly detection or can be used to provide context and memory to an LLM. Run machine learning models, powered by serverless GPUs, on Cloudflare's global network. Build stateful agents that guarantee executions, including automatic retries, persistent state that runs for minutes, hours, days, or weeks. --- # Changelog URL: https://developers.cloudflare.com/ai-audit/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # AI Audit URL: https://developers.cloudflare.com/ai-audit/ import { Description, Feature, FeatureTable, Plan, LinkButton, RelatedProduct } from "~/components"; Analyze and control how third-party AI crawlers access and interact with your website. AI Audit helps manage AI crawlers on your website by providing visibility on which crawlers are accessing your pages, and allowing you to block unwanted crawlers. Get started :::note[Beta phase] AI Audit is currently only available as a beta product. ::: --- ## Features Control how AI crawlers interact with your domain. Gain insight into how AI crawlers are interacting with your pages. Allow AI crawlers to access content by paying per crawl. --- ## Related Products Identify and mitigate automated traffic to protect your domain from bad bots. Get automatic protection from vulnerabilities and the flexibility to create custom rules. --- # Get started URL: https://developers.cloudflare.com/ai-audit/get-started/ import { Details, Render, Steps, Tabs, TabItem, GlossaryTooltip } from "~/components"; This guide instructs you on how to: - View AI crawlers that are interacting with pages in your domain (a [Cloudflare zone](/fundamentals/concepts/accounts-and-zones/#zones)). - Use AI Audit to block individual crawlers from accessing your content. ## Prerequisites 1. Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up/). 2. [Connect your domain to Cloudflare](/fundamentals/manage-domains/add-site/). 3. Make sure your domain is [proxying traffic through Cloudflare](/fundamentals/concepts/how-cloudflare-works/#cloudflare-as-a-reverse-proxy). ## 1. Block specific AI crawlers To only block specific AI crawlers: {/* prettier-ignore */} 1. Go to **AI Audit**. 2. From the **AI Crawlers** tab, go to the list of AI crawlers. 3. Review the AI crawlers that are accessing your domain. 4. From the **Block** column, select the option **Block**. :::note[Quality of AI crawler detection] On the free plan, AI Audit identifies AI crawlers based on their [user agent strings](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent). This enables AI Audit to detect easy-to-detect (well-known) AI crawlers. Upgrade your plan to enable a more thorough detection using Cloudflare's [Bot Management detection ID](/bots/reference/bot-management-variables/#ruleset-engine-fields) field. ::: To only block specific AI crawlers: {/* prettier-ignore */} 1. Go to **AI Audit**. 2. From the **AI Crawlers** tab, go to the list of AI crawlers. 3. Review key information such as: - Bot operator - Number of requests sent by the AI crawler - Whether the AI crawler is allowed according to your `robots.txt`, or the number of times the AI crawler has violated your `robots.txt`. 4. From the **Block** column, toggle the switch for AI crawlers you wish to block. For more information, refer to [Manage AI crawlers](/ai-audit/features/manage-ai-crawlers/). You can also create more complex rules when taking action on AI crawlers, using [Cloudflare WAF](/waf/). For more information on creating more specific rules, refer to [Create a custom rule in the dashboard](/waf/custom-rules/create-dashboard/). ## 2. Review detected AI crawlers Review the AI crawlers detected on your site. 1. Go to **AI Audit**. 2. From the **Metrics** tab, view key metrics on AI crawlers. Note that on free plans, the **Metrics** tab only displays metrics for the past 24 hours. ## Related resources Refer to the following related resources: - Cloudflare blog: [Start auditing and controlling the AI models accessing your content](https://blog.cloudflare.com/nl-nl/cloudflare-ai-audit-control-ai-content-crawlers/) - Block AI crawlers that do not adhere to recommended guidelines using [Cloudflare AI Labyrinth](/bots/additional-configurations/ai-labyrinth/). - [Direct AI crawlers with managed robots.txt](/bots/additional-configurations/managed-robots-txt/). --- # Changelog URL: https://developers.cloudflare.com/ai-gateway/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # OpenAI Compatibility URL: https://developers.cloudflare.com/ai-gateway/chat-completion/ Cloudflare's AI Gateway offers an OpenAI-compatible `/chat/completions` endpoint, enabling integration with multiple AI providers using a single URL. This feature simplifies the integration process, allowing for seamless switching between different models without significant code modifications. ## Endpoint URL ```txt https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions ``` Replace `{account_id}` and `{gateway_id}` with your Cloudflare account and gateway IDs. ## Parameters Switch providers by changing the `model` and `apiKey` parameters. Specify the model using `{provider}/{model}` format. For example: - `openai/gpt-4o-mini` - `google-ai-studio/gemini-2.0-flash` - `anthropic/claude-3-haiku` ## Examples ### OpenAI SDK ```js import OpenAI from "openai"; const client = new OpenAI({ apiKey: "YOUR_PROVIDER_API_KEY", // Provider API key // NOTE: the OpenAI client automatically adds /chat/completions to the end of the URL, you should not add it yourself. baseURL: "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat", }); const response = await client.chat.completions.create({ model: "google-ai-studio/gemini-2.0-flash", messages: [{ role: "user", content: "What is Cloudflare?" }], }); console.log(response.choices[0].message.content); ``` ### cURL ```bash curl -X POST https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions \ --header 'Authorization: Bearer {openai_token}' \ --header 'Content-Type: application/json' \ --data '{ "model": "google-ai-studio/gemini-2.0-flash", "messages": [ { "role": "user", "content": "What is Cloudflare?" } ] }' ``` ### Universal provider You can also use this pattern with the [Universal Endpoint](/ai-gateway/universal/) to add [fallbacks](/ai-gateway/configuration/fallbacks/) across multiple providers. When used in combination, every request will return the same standardized format, whether from the primary or fallback model. This behavior means that you do not have to add extra parsing logic to your app. ```ts title="index.ts" export interface Env { AI: Ai; } export default { async fetch(request: Request, env: Env) { return env.AI.gateway("default").run({ provider: "compat", endpoint: "chat/completions", headers: { authorization: "Bearer", }, query: { model: "google-ai-studio/gemini-2.0-flash", messages: [ { role: "user", content: "What is Cloudflare?", }, ], }, }); }, }; ``` ## Supported Providers The OpenAI-compatible endpoint supports models from the following providers: - [Anthropic](/ai-gateway/providers/anthropic/) - [OpenAI](/ai-gateway/providers/openai/) - [Groq](/ai-gateway/providers/groq/) - [Mistral](/ai-gateway/providers/mistral/) - [Cohere](/ai-gateway/providers/cohere/) - [Perplexity](/ai-gateway/providers/perplexity/) - [Workers AI](/ai-gateway/providers/workersai/) - [Google-AI-Studio](/ai-gateway/providers/google-ai-studio/) - [Grok](/ai-gateway/providers/grok/) - [DeepSeek](/ai-gateway/providers/deepseek/) - [Cerebras](/ai-gateway/providers/cerebras/) --- # Getting started URL: https://developers.cloudflare.com/ai-gateway/get-started/ import { Details, DirectoryListing, LinkButton, Render } from "~/components"; In this guide, you will learn how to create your first AI Gateway. You can create multiple gateways to control different applications. ## Prerequisites Before you get started, you need a Cloudflare account. Sign up ## Create gateway Then, create a new AI Gateway. ## Choosing gateway authentication When setting up a new gateway, you can choose between an authenticated and unauthenticated gateway. Enabling an authenticated gateway requires each request to include a valid authorization token, adding an extra layer of security. We recommend using an authenticated gateway when storing logs to prevent unauthorized access and protect against invalid requests that can inflate log storage usage and make it harder to find the data you need. Learn more about setting up an [Authenticated Gateway](/ai-gateway/configuration/authentication/). ## Connect application Next, connect your AI provider to your gateway. AI Gateway offers multiple endpoints for each Gateway you create - one endpoint per provider, and one Universal Endpoint. To use AI Gateway, you will need to create your own account with each provider and provide your API key. AI Gateway acts as a proxy for these requests, enabling observability, caching, and more. Additionally, AI Gateway has a [WebSockets API](/ai-gateway/websockets-api/) which provides a single persistent connection, enabling continuous communication. This API supports all AI providers connected to AI Gateway, including those that do not natively support WebSockets. Below is a list of our supported model providers: If you do not have a provider preference, start with one of our dedicated tutorials: - [OpenAI](/ai-gateway/tutorials/deploy-aig-worker/) - [Workers AI](/ai-gateway/tutorials/create-first-aig-workers/) ## View analytics Now that your provider is connected to the AI Gateway, you can view analytics for requests going through your gateway.
:::note[Note] The cost metric is an estimation based on the number of tokens sent and received in requests. While this metric can help you monitor and predict cost trends, refer to your provider's dashboard for the most accurate cost details. ::: ## Next steps - Learn more about [caching](/ai-gateway/configuration/caching/) for faster requests and cost savings and [rate limiting](/ai-gateway/configuration/rate-limiting/) to control how your application scales. - Explore how to specify model or provider [fallbacks](/ai-gateway/configuration/fallbacks/) for resiliency. - Learn how to use low-cost, open source models on [Workers AI](/ai-gateway/providers/workersai/) - our AI inference service. --- # Architectures URL: https://developers.cloudflare.com/ai-gateway/demos/ import { GlossaryTooltip, ResourcesBySelector } from "~/components"; Learn how you can use AI Gateway within your existing architecture. ## Reference architectures Explore the following reference architectures that use AI Gateway: --- # Header Glossary URL: https://developers.cloudflare.com/ai-gateway/glossary/ import { Glossary } from "~/components"; AI Gateway supports a variety of headers to help you configure, customize, and manage your API requests. This page provides a complete list of all supported headers, along with a short description ## Configuration hierarchy Settings in AI Gateway can be configured at three levels: **Provider**, **Request**, and **Gateway**. Since the same settings can be configured in multiple locations, the following hierarchy determines which value is applied: 1. **Provider-level headers**: Relevant only when using the [Universal Endpoint](/ai-gateway/universal/), these headers take precedence over all other configurations. 2. **Request-level headers**: Apply if no provider-level headers are set. 3. **Gateway-level settings**: Act as the default if no headers are set at the provider or request levels. This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use provider-level and request-level headers for more fine-tuned control, and gateway settings for general defaults. --- # Cloudflare AI Gateway URL: https://developers.cloudflare.com/ai-gateway/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Observe and control your AI applications. Cloudflare's AI Gateway allows you to gain visibility and control over your AI apps. By connecting your apps to AI Gateway, you can gather insights on how people are using your application with analytics and logging and then control how your application scales with features such as caching, rate limiting, as well as request retries, model fallback, and more. Better yet - it only takes one line of code to get started. Check out the [Get started guide](/ai-gateway/get-started/) to learn how to configure your applications with AI Gateway. ## Features View metrics such as the number of requests, tokens, and the cost it takes to run your application. Gain insight on requests and errors. Serve requests directly from Cloudflare's cache instead of the original model provider for faster requests and cost savings. Control how your application scales by limiting the number of requests your application receives. Improve resilience by defining request retry and model fallbacks in case of an error. Workers AI, OpenAI, Azure OpenAI, HuggingFace, Replicate, and more work with AI Gateway. --- ## Related products Run machine learning models, powered by serverless GPUs, on Cloudflare’s global network. Build full-stack AI applications with Vectorize, Cloudflare's vector database. Adding Vectorize enables you to perform tasks such as semantic search, recommendations, anomaly detection or can be used to provide context and memory to an LLM. ## More resources Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Learn how you can build and deploy ambitious AI applications to Cloudflare's global network. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Analytics URL: https://developers.cloudflare.com/analytics/ import { Feature, RelatedProduct } from "~/components" Cloudflare visualizes the metadata collected by our products in the Cloudflare dashboard. Refer to [Types of analytics](/analytics/types-of-analytics/) for more information about the various types of analytics and where they exist in the dashboard. *** ## Features Send unlimited-cardinality data from your Worker to a time-series database. Query it with SQL. Provides details about the requests and traffic related to your Cloudflare accounts and zones. Provides near real-time visibility into network and transport-layer traffic patterns and DDoS attacks. Provides all of your performance, security, and reliability data from one endpoint. Select exactly what you need, from one metric for a domain to multiple metrics aggregated for your account. *** ## Related products Cloudflare Workers allows developers to build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. Detailed logs that contain metadata generated by Cloudflare products helpful for debugging, identifying configuration adjustments, and creating analytics. --- # Universal Endpoint URL: https://developers.cloudflare.com/ai-gateway/universal/ import { Render, Badge } from "~/components"; You can use the Universal Endpoint to contact every provider. ```txt https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id} ``` AI Gateway offers multiple endpoints for each Gateway you create - one endpoint per provider, and one Universal Endpoint. The Universal Endpoint requires some adjusting to your schema, but supports additional features. Some of these features are, for example, retrying a request if it fails the first time, or configuring a [fallback model/provider](/ai-gateway/configuration/fallbacks/). You can use the Universal endpoint to contact every provider. The payload is expecting an array of message, and each message is an object with the following parameters: - `provider` : the name of the provider you would like to direct this message to. Can be OpenAI, workers-ai, or any of our supported providers. - `endpoint`: the pathname of the provider API you’re trying to reach. For example, on OpenAI it can be `chat/completions`, and for Workers AI this might be [`@cf/meta/llama-3.1-8b-instruct`](/workers-ai/models/llama-3.1-8b-instruct/). See more in the sections that are specific to [each provider](/ai-gateway/providers/). - `authorization`: the content of the Authorization HTTP Header that should be used when contacting this provider. This usually starts with 'Token' or 'Bearer'. - `query`: the payload as the provider expects it in their official API. ## cURL example The above will send a request to Workers AI Inference API, if it fails it will proceed to OpenAI. You can add as many fallbacks as you need, just by adding another JSON in the array. ## WebSockets API The Universal Endpoint can also be accessed via a [WebSockets API](/ai-gateway/websockets-api/) which provides a single persistent connection, enabling continuous communication. This API supports all AI providers connected to AI Gateway, including those that do not natively support WebSockets. ## WebSockets example ```javascript import WebSocket from "ws"; const ws = new WebSocket( "wss://gateway.ai.cloudflare.com/v1/my-account-id/my-gateway/", { headers: { "cf-aig-authorization": "Bearer AI_GATEWAY_TOKEN", }, }, ); ws.send( JSON.stringify({ type: "universal.create", request: { eventId: "my-request", provider: "workers-ai", endpoint: "@cf/meta/llama-3.1-8b-instruct", headers: { Authorization: "Bearer WORKERS_AI_TOKEN", "Content-Type": "application/json", }, query: { prompt: "tell me a joke", }, }, }), ); ws.on("message", function incoming(message) { console.log(message.toString()); }); ``` ## Workers Binding example import { WranglerConfig } from "~/components"; ```toml title="wrangler.toml" [ai] binding = "AI" ``` ```typescript title="src/index.ts" type Env = { AI: Ai; }; export default { async fetch(request: Request, env: Env) { return env.AI.gateway('my-gateway').run({ provider: "workers-ai", endpoint: "@cf/meta/llama-3.1-8b-instruct", headers: { authorization: "Bearer my-api-token", }, query: { prompt: "tell me a joke", }, }); }, }; ``` ## Header configuration hierarchy The Universal Endpoint allows you to set fallback models or providers and customize headers for each provider or request. You can configure headers at three levels: 1. **Provider level**: Headers specific to a particular provider. 2. **Request level**: Headers included in individual requests. 3. **Gateway settings**: Default headers configured in your gateway dashboard. Since the same settings can be configured in multiple locations, AI Gateway applies a hierarchy to determine which configuration takes precedence: - **Provider-level headers** override all other configurations. - **Request-level headers** are used if no provider-level headers are set. - **Gateway-level settings** are used only if no headers are configured at the provider or request levels. This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use provider-level and request-level headers for fine-tuned control, and gateway settings for general defaults. ## Hierarchy example This example demonstrates how headers set at different levels impact caching behavior: - **Request-level header**: The `cf-aig-cache-ttl` is set to `3600` seconds, applying this caching duration to the request by default. - **Provider-level header**: For the fallback provider (OpenAI), `cf-aig-cache-ttl` is explicitly set to `0` seconds, overriding the request-level header and disabling caching for responses when OpenAI is used as the provider. This shows how provider-level headers take precedence over request-level headers, allowing for granular control of caching behavior. ```bash curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id} \ --header 'Content-Type: application/json' \ --header 'cf-aig-cache-ttl: 3600' \ --data '[ { "provider": "workers-ai", "endpoint": "@cf/meta/llama-3.1-8b-instruct", "headers": { "Authorization": "Bearer {cloudflare_token}", "Content-Type": "application/json" }, "query": { "messages": [ { "role": "system", "content": "You are a friendly assistant" }, { "role": "user", "content": "What is Cloudflare?" } ] } }, { "provider": "openai", "endpoint": "chat/completions", "headers": { "Authorization": "Bearer {open_ai_token}", "Content-Type": "application/json", "cf-aig-cache-ttl": "0" }, "query": { "model": "gpt-4o-mini", "stream": true, "messages": [ { "role": "user", "content": "What is Cloudflare?" } ] } } ]' ``` --- # Understanding sampling in Cloudflare Analytics URL: https://developers.cloudflare.com/analytics/sampling/ [Sampling](https://en.wikipedia.org/wiki/Sampling_(statistics)) is a technique used in analytics to analyze a subset of data rather than processing every individual data point. In Cloudflare Analytics, sampling ensures efficient performance and scalability while maintaining high accuracy and reliability. This document provides a comprehensive overview of how sampling works, why it is used, and its impact on analytics across different Cloudflare tools. ## How sampling works We use a sampling method called [Adaptive Bit Rate (ABR)](https://blog.cloudflare.com/explaining-cloudflares-abr-analytics/) to ensure that queries complete quickly, even when working with large datasets. ABR dynamically adjusts the level of detail in the data retrieved based on query complexity and duration. This approach ensures fairness by preventing large or complex queries from consuming a disproportionate amount of computing resources, which could otherwise slow down or block smaller queries. By distributing resources more equitably, ABR allows the system to maintain consistent performance for all users, regardless of the dataset size. To make this possible, data is stored at multiple resolutions (100%, 10%, 1%), each representing different sampling percentages. When a query is run, ABR selects the best resolution based on the query's complexity and number of rows to retrieve. By dynamically adjusting the data resolution, ABR optimizes performance and prevents delays. This sets it apart from systems that struggle with timeouts, errors, or high costs when dealing with large datasets. ## Why sampling is applied Cloudflare's data pipeline handles [over 700 million events per second](https://blog.cloudflare.com/how-we-make-sense-of-too-much-data) (and growing) across its global network. Processing and storing all this data in real-time would be prohibitively expensive and time-consuming. By leveraging carefully designed sampling methods, Cloudflare Analytics delivers accurate and actionable data, balancing precision with performance. Sampling enables: - **Scalability**: Reduces the volume of data processed without compromising insights. - **Performance**: Speeds up query execution for analytics. - **Cost-Efficiency**: Minimizes resource usage and storage needs. ## Can I trust sampled data? Sampled data is highly reliable, and can provide insights that are as dependable as those derived from full datasets. Cloudflare designs sampling techniques to ensure we capture the essential characteristics of the entire dataset, delivering results you can trust. Sampling is an approach similarly used in other domains, for instance: - Google Maps: Just as online maps display lower-resolution images when zoomed out and higher-resolution images when zoomed in — keeping the total number of pixels relatively constant — Cloudflare Analytics dynamically adjusts sampling rates to efficiently provide insights, ensuring queries return consistent and accurate results regardless of dataset size. - Opinion Polls: Similar to how pollsters sample a subset of the population to predict election outcomes, Cloudflare samples a portion of your data to provide accurate, system-wide insights. - Movie Frames: Watching a movie at 30 frames per second (fps) instead of 60 fps does not change the overall experience, much like how analyzing fewer data points still reveals the same patterns and trends in your analytics dataset. We acknowledge it can be challenging to verify the exact resolution of ABR query results at this time. However, as a general rule, you can check the number of rows read. A higher number of rows read will result in higher resolution results. For example, results based on thousands of rows are highly likely to be representative, while those based on just a few rows may not be as reliable. In the near future, we plan to expose confidence intervals along with query results, so you can see precisely how accurate your results are. ## Additional considerations **When sampling occurs** - Sampling is typically applied to very high-traffic datasets where full data analysis would be impractical. - For smaller datasets, full data analysis is often performed without sampling. **Sampling rates** - Sampling rates vary depending on the dataset and product. - Cloudflare ensures that sampling rates are consistent within a single dataset to maintain accuracy across queries. **Impact on metrics** - While sampling reduces the volume of processed data, aggregated metrics like totals, averages, and percentiles are extrapolated based on the sample size. This ensures the reported metrics represent the entire dataset accurately. **Limitations** - Sampling may not capture extremely rare events with very low occurrence rates. **Sampling in analytics interfaces** - GraphQL API: Sampling metadata is included in the query response. For more information, refer to the sampling [GraphQL Analytics API](/analytics/graphql-api/sampling/) documentation. - Workers Analytics Engine: For more information, refer to the [Workers Analytics Engine](/analytics/analytics-engine/sampling/) documentation. - Dashboard Analytics: Displays an icon with the sampled percentage of data, if sampled data was used for the visualization. --- # Types of analytics URL: https://developers.cloudflare.com/analytics/types-of-analytics/ import { Badge } from "~/components"; Cloudflare Analytics is a comprehensive product that encompasses all metadata generated by the Cloudflare network. You can access these insights through the Cloudflare dashboard. Depending on where in the dashboard you are, it will show you different aspects from the collected metadata. ## Account-level analytics ### Account Analytics (beta) Available under **Analytics & Logs** in your Cloudflare dashboard when you log in, Account Analytics (beta) shows you an [overview of traffic for all domains](/analytics/account-and-zone-analytics/account-analytics/) under your Cloudflare account, such as requests and bandwidth by country, information related to security, cache, and errors, among others. To access Account Analytics, [log in to the Cloudflare dashboard](https://dash.cloudflare.com/login), select the appropriate account, and go to **Analytics & Logs** > **Account Analytics**. ### Network Analytics Network Analytics provides [visibility into network and transport-layer traffic patterns, and DDoS attacks](/analytics/network-analytics/). The Network Analytics dashboard is only available for customers with an Enterprise domain plan who use [Spectrum](/spectrum/), [Magic Transit](/magic-transit/), or [Bring Your Own IP (BYOIP)](/byoip/). ### Web Analytics Web Analytics (formerly known as Browser Insights) [provides free, privacy-first analytics for your website](/web-analytics/). Web Analytics does not collect your visitor's personal data, and allows you to have a detailed view into the performance of web pages as experienced by your visitors. ### Carbon Impact Report Carbon Impact Report gives you a [report on carbon savings](https://blog.cloudflare.com/understand-and-reduce-your-carbon-impact-with-cloudflare/) from using Cloudflare services versus Internet averages for your usage volume. Cloudflare is committed to use 100% renewable energy sources, but also to [remove all greenhouse gases emitted](https://blog.cloudflare.com/cloudflare-committed-to-building-a-greener-internet/) as a result of powering our network since 2010. ## Analytics related to specific properties Access aggregated traffic, security, and performance metrics for each domain proxied through Cloudflare. To access these analytics, [log in to the Cloudflare dashboard](https://dash.cloudflare.com/login), select your account and domain, and go to the **Analytics & Logs** section. Data available under the **Analytics & Logs** section includes: * **HTTP Traffic** - Requests, Data transfer, Page views, Visits, and API requests. * **Security** - Total Threats, Top Crawlers/Bots, Rate Limiting, Total Threats Stopped. * **Performance** - Origin Performance, Bandwidth Saved. * **Edge Reachability** - [Last mile insights](/network-error-logging/) for Enterprise customers. * **Workers** - [Detailed information](/workers/observability/metrics-and-analytics/) related to your Workers per zone, and Workers KV per account. * **Logs** - [Detailed logs](/logs/) of the metadata generated by Cloudflare products for Enterprise customers. * **Instant logs** - [Live stream of traffic](/logs/instant-logs/) for your domain. Enterprise customers can access this live stream from the Cloudflare dashboard or from a command-line interface (CLI). ## Product analytics Beyond the analytics provided for your properties, you can also access analytics related to specific products: * [Bot Analytics](/bots/bot-analytics/) - Shows which requests are associated with known bots, likely automated traffic, likely human traffic, and more. * [Cache Analytics](/cache/performance-review/cache-analytics/) - Insights to that help determine if resources are missing from cache, expired, or ineligible for caching. * [DNS Analytics](/dns/additional-options/analytics/) - Provides insights about DNS queries to your zone. * [Load Balancing Analytics](/load-balancing/reference/load-balancing-analytics/) - Features metrics to help gain insights into traffic load balancer steering decisions. * [Security Events](/waf/analytics/security-events/) - Highlights attack and mitigation metrics detected by the Cloudflare WAF and HTTP DDoS protection systems. * [Security Analytics](/waf/analytics/security-analytics/) - Displays information about all incoming HTTP requests, including those not affected by security measures (for example, from the WAF and DDoS protection systems). ## GraphQL APIs If you would like to have more control over how you visualize the analytic and log information available on the Cloudflare dashboard, use the [GraphQL Analytics API](/analytics/graphql-api/) to build customized views. This API replaces and expands on the previous Zone Analytics API. --- # API Gateway URL: https://developers.cloudflare.com/api-shield/api-gateway/ Cloudflare API Shield empowers you to use Cloudflare as your API Gateway, providing robust security features, streamlined management tools, and integration with the Cloudflare Developer Platform for building new APIs.​ APIs are fundamental to modern applications but are increasingly targeted by malicious actors. Cloudflare API Shield offers a comprehensive solution to protect, manage, and build your APIs. - **Enhanced security**: Implement robust runtime protection such as JWT validation, mutual TLS (mTLS) authentication, schema validation, and protection against the [OWASP Top 10 API Security risks](https://owasp.org/www-project-api-security/). - **Efficient management and monitoring**: Utilize tools for endpoint management, analytics, and routing to streamline API operations. Highlight risks with Posture Management, and gain visibility with Security Analytics and Security Center Insights. - **Integrated development**: Leverage the Cloudflare Developer Platform to build and deploy new APIs with ease, taking advantage of scalable infrastructure and a suite of developer tools. ## Cloudflare as your API Gateway ### API security features - **Protection Against OWASP Top 10 API Security risks**: Mitigate common API vulnerabilities, including injection attacks and improper asset management. ### Management and Monitoring tools - **[Endpoint Management](/api-shield/management-and-monitoring/endpoint-management/)**: Gain visibility into your API endpoints, including discovery of shadow APIs and monitoring of active endpoints. - **[Analytics and logging](/api-shield/security/sequence-analytics/)**: Access detailed analytics and logs to monitor API usage, performance, and security events. - **[API Routing](/api-shield/management-and-monitoring/api-routing/)**: Optimize API performance and reliability with secure routing. - **[Posture Management](/api-shield/security/authentication-posture/)**: Monitor API Authentication status and receive alerts for common API risks. ### Build APIs with Cloudflare’s Developer Platform The [Cloudflare Developer Platform](https://www.cloudflare.com/developer-platform/) offers a serverless execution environment, allowing you to build and deploy new APIs without the need to manage infrastructure. Its benefits include: - **Global scalability**: Deploy your APIs across Cloudflare's extensive global network, ensuring low latency and high availability. ​ - **Integrated services**: Access a suite of services, including storage, databases, and AI tools, to enhance your API functionality. - **Developer-friendly tools**: Utilize modern development tools and frameworks to streamline the API development process. ​ ## Get started To begin using Cloudflare API Shield, refer to our [Get started](/api-shield/get-started/) guide. For detailed instructions and additional resources, refer to the Cloudflare [API Shield documentation](/api-shield/). By integrating API security, management, and development into a single platform, Cloudflare API Shield provides a comprehensive solution to protect, manage, and build APIs. --- # FAQ URL: https://developers.cloudflare.com/api-shield/frequently-asked-questions/ ## Why are my API endpoints not found by API Discovery? In most cases, this is due to the system not observing enough valid requests over a continuous period. API Discovery only looks at requests that satisfy all of the following criteria: 1. Requests must return `2XX` response codes from the edge. 2. Requests must not come directly from Cloudflare Workers. 3. At least 500 requests are made to the discovered endpoint within a 10 day period. Endpoints discovered using session identifiers will be labeled as such in the dashboard. If the endpoints are not discovered through session identifiers, they will be discovered using our machine learning-based [API Discovery](/api-shield/security/api-discovery/). --- ## How does Cloudflare calculate the recommended rate limit for my endpoint? Cloudflare uses both the volume and frequency of traffic to guide your recommended rate. We calculate the recommended rate value throughout the day, and the new calculation may equal the existing recommendation due to similar traffic profiles existing on your API. When we recalculate, we look at requests that happened in the last 24 hours. You can view the `P50`/`95`/`99` of your request count for more details under an endpoint’s expanded view. --- ## Will I be able to access an endpoint’s data after I delete it? No. Cloudflare will stop tracking performance data when you delete an endpoint and its previous data will not be stored. This means that if you save this endpoint again, the metrics will start tracking from the point that you save it. --- ### Why do I not receive threshold recommendations for my discovered API endpoints? Thresholds can only be recommended for endpoints that receive sufficient levels of traffic that meet the following criteria: - Only requests with the same criteria as API Discovery are considered. - If traffic has been erratic or intermittent to this endpoint, the threshold might not show up. Cloudflare needs endpoints to receive sufficient valid traffic in any 24-hour period in the last 7 days or since the initial discovery of the endpoint to make statistically safe threshold suggestions. - Cloudflare also requires at least 50 distinct sessions to have accessed the endpoint in any 24-hour period in the last 7 days or since the initial discovery of the endpoint. To detect sessions, you must set up [session identifiers](/api-shield/get-started/#session-identifiers). If you do not receive threshold recommendations for a discovered endpoint, you will see one of the following error codes: - `404 response`: Cloudflare has not seen sufficient valid traffic for this zone to generate recommendations. - `551 response`: Cloudflare has successfully generated recommendations at some point in the past, but we have not seen sufficient recent valid traffic to provide up-to-date recommendations. --- ## Does API Shield work for JDCloud customers? Not currently. --- ## What version of OpenAPI specification do you support? The importing ([Schema validation](/api-shield/security/schema-validation/)) and exporting ([Schema Learning](/api-shield/management-and-monitoring/#endpoint-schema-learning)) of OpenAPI schemas from our product to customers is done using **OpenAPI v3.0**. Any specifications using patched versions (3.0.x) are compatible as well. --- ## Why am I not seeing latency metrics? Latency metrics currently are not supported when a Cloudflare Worker is running on the URL, as the requests are not passed directly to your origin. Some Cloudflare products such as [Waiting Room](/waiting-room/) are built on top of Workers, so the same limitations apply to applications using these products. --- # Changelog URL: https://developers.cloudflare.com/api-shield/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/browser-rendering/faq/ import { GlossaryTooltip } from "~/components"; Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [Discord](https://discord.cloudflare.com) to explore additional resources. ### I see `Cannot read properties of undefined (reading 'fetch')` when using Browser Rendering. How do I fix this? This error occurs because your Puppeteer launch is not receiving the Browser binding or you are not on a Workers Paid plan. To resolve: Pass your Browser binding into `puppeteer.launch`. ### Will Browser Rendering bypass Cloudflare's Bot Protection? No, Browser Rendering requests are always identified as bots by Cloudflare and do not bypass Bot Protection. Additionally, Browser Rendering respects the robots.txt protocol, ensuring that any disallowed paths specified for user agents are not accessed during rendering. If you are attempting to scan your **own zone** and need Browser Rendering to access areas protected by Cloudflare’s Bot Protection, you can create a [WAF skip rule](/waf/custom-rules/skip/) to bypass the bot protection using a header or a custom user agent. ### Why can't I use an XPath selector when using Browser Rendering with Puppeteer? Currently it is not possible to use Xpath to select elements since this poses a security risk to Workers. As an alternative try to use a css selector or `page.evaluate` for example: ```ts const innerHtml = await page.evaluate(() => { return ( // @ts-ignore this runs on browser context new XPathEvaluator() .createExpression("/html/body/div/h1") // @ts-ignore this runs on browser context .evaluate(document, XPathResult.FIRST_ORDERED_NODE_TYPE).singleNodeValue .innerHTML ); }); ``` :::note Keep in mind that `page.evaluate` can only return primitive types like strings, numbers, etc. Returning an `HTMLElement` will not work. ::: ### What are the usage limits and pricing tiers for Cloudflare Browser Rendering and how do I estimate my costs? You can view the complete breakdown of concurrency caps, request rates, timeouts, and REST API quotas on the [limits page](/browser-rendering/platform/limits/). By default, idle browser sessions close after 60 seconds of inactivity. You can adjust this with the [`keep_alive` option](/browser-rendering/platform/puppeteer/#keep-alive). #### Pricing Browser Rendering is currently free up to the limits above until billing begins. Pricing will be announced in advance. ### Does Browser Rendering rotate IP addresses for outbound requests? No. Browser Rendering requests originate from Cloudflares global network, but you cannot configure per-request IP rotation. All rendering traffic comes from Cloudflare IP ranges and requests include special headers [(`cf-biso-request-id`, `cf-biso-devtools`)](/browser-rendering/reference/automatic-request-headers/) so origin servers can identify them. ### I see `Error processing the request: Unable to create new browser: code: 429: message: Browser time limit exceeded for today`. How do I fix it? This error indicates you have hit the daily browser-instance limit on the Workers Free plan. [Free-plan accounts are capped at free plan limit is 10 minutes of browser use a day](/browser-rendering/platform/limits/#workers-free) once you exceed those, further creation attempts return a 429 until the next UTC day. To resolve:[Upgrade to a Workers Paid plan](/workers/platform/pricing/) - Paid accounts raise these limits to [10 concurrent browsers and 10 new instances per minute](/browser-rendering/platform/limits/#workers-paid). --- # Get started URL: https://developers.cloudflare.com/browser-rendering/get-started/ Browser rendering can be used in two ways: - [Workers Bindings](/browser-rendering/workers-bindings/) for complex scripts. - [REST API](/browser-rendering/rest-api/) for simple actions. --- # Browser Rendering URL: https://developers.cloudflare.com/browser-rendering/ import { CardGrid, Description, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Browser automation for [Cloudflare Workers](/workers/) and [quick browser actions](/browser-rendering/rest-api/). Browser Rendering enables developers to programmatically control and interact with headless browser instances running on Cloudflare’s global network. This facilitates tasks such as automating browser interactions, capturing screenshots, generating PDFs, and extracting data from web pages. ## Integration Methods You can integrate Browser Rendering into your applications using one of the following methods: - **[REST API](/browser-rendering/rest-api/)**: Ideal for simple, stateless tasks like capturing screenshots, generating PDFs, extracting HTML content, and more. - **[Workers Bindings](/browser-rendering/workers-bindings/)**: Suitable for advanced browser automation within [Cloudflare Workers](/workers/). This method provides greater control, enabling more complex workflows and persistent sessions. Choose the method that best fits your use case. For example, use the [REST API endpoints](/browser-rendering/rest-api/) for straightforward tasks from external applications and use [Workers Bindings](/browser-rendering/workers-bindings/) for complex automation within the Cloudflare ecosystem. ## Use Cases Browser Rendering can be utilized for various purposes, including: - Fetch HTML content of a page. - Capture screenshot of a webpage. - Convert a webpage into a PDF document. - Take a webpage snapshot. - Scrape specified HTML elements from a webpage. - Retrieve data in a structured format. - Extract Markdown content from a webpage. - Gather all hyperlinks found on a webpage. ## Related products Build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. A globally distributed coordination API with strongly consistent storage. Build and deploy AI-powered agents that can autonomously perform tasks. ## More resources Deploy your first Browser Rendering project using Wrangler and Cloudflare's version of Puppeteer. New to Workers? Get started with the Workers Learning Path. Learn about Browser Rendering limits. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Bot Analytics URL: https://developers.cloudflare.com/bots/bot-analytics/ import { GlossaryTooltip, Render } from "~/components" ## Business and Enterprise Business and Enterprise customers without Bot Management can use **Bot Analytics** to dynamically examine bot traffic. These dashboards offer less functionality than Bot Management for Enterprise but still help you understand bot traffic on your domain. ### Access You can access Bot Analytics by going to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and selecting your account and domain. Old dashboard: **Security** > **Bots**. New dashboard: **Security** > **Analytics** > **Bot analysis**. ![View Bot Analytics in the Cloudflare dashboard. For more details, keep reading.](~/assets/images/bots/bot-analytics-dashboard-biz.png) ### Features For a full tour of Bot Analytics, see [our blog post](https://blog.cloudflare.com/introducing-bot-analytics/). At a high level, the tool includes: - **Requests by traffic type**: View your total domain traffic segmented vertically by traffic type. Keep an eye on _automated_ and _likely automated_ traffic. - **Requests by detection source**: Identify the most common detection engines used to score your traffic. Hover over a tooltip to learn more about each engine. - **Top requests by attribute**: View more detailed information on specific IP addresses and other characteristics. Bot Analytics shows up to 72 hours of data at a time and can display data up to 30 days old. Bot Analytics displays data in real time in most cases. ### Common uses Business and Enterprise customers without Bot Management can use Bot Analytics to: - Understand bot traffic - Study recent attacks to find trends and detailed information - Learn more about Cloudflare’s detection engines with real data For more details and granular control over bot traffic, consider upgrading to [Bot Management for Enterprise](/bots/bot-analytics/#enterprise-bot-management). ## Enterprise Bot Management Enterprise customers with Bot Management can use **Bot Analytics** to dynamically examine bot traffic. ### Access You can access Bot Analytics by going to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and selecting your account and domain. Old dashboard: **Security** > **Bots**. New dashboard: **Security** > **Analytics** > **Bot analysis**. ![View Bot Analytics in the Cloudflare dashboard. For more details, keep reading.](~/assets/images/bots/bot-analytics-dashboard-ent.png) ### Features ### Common uses Bot Management customers can use Bot Analytics to: - Understand traffic during [your onboarding phase](/bots/get-started/bot-management/). - Tune WAF custom rules to be effective but not overly aggressive. - Study recent attacks to find trends and detailed information. - Learn more about Cloudflare’s detection engines with real data. ### API Data from Bot Analytics is also available via the GraphQL API. You can access bot scores, bot sources, bot tags, and bot _decisions_ (_automated_, _likely automated_, etc.), and more. Read the [GraphQL Analytics API documentation](/analytics/graphql-api/) for more information about GraphQL and basic querying. --- # Changelog URL: https://developers.cloudflare.com/bots/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/bots/frequently-asked-questions/ import { Render, RuleID } from "~/components"; ## Bots ### How does Cloudflare detect bots? Cloudflare uses multiple methods to detect bots, but these vary by plan. For more details, refer to [Plans](/bots/plans). --- ### How do I know what is included in my plan? To know what's included in your plan, refer to our [Plans](/bots/plans). --- ### How do I set up my bot product? To learn how to set up your bot product, refer to [Get started](/bots/get-started/). --- ### Yandex bot unexpectedly blocked by the WAF managed rule with ID `...f6cbb163` Yandex updates their bots very frequently, you may see more false positives while these changes are propagated. New and recently updated bots will occasionally be blocked by a Cloudflare WAF managed rule, as the IP list of Yandex bots has not yet synced with Yandex's most recent changes. **Workarounds:** - Create an [exception](/waf/managed-rules/waf-exceptions/) to temporarily skip the managed rule with ID when a request is coming from the **Yandex IP** and the user-agent contains **Yandex.** - Create a [WAF custom rule with the _Skip_ action](/waf/custom-rules/skip/) to temporarily bypass WAF Managed Rules when a request is coming from the **Yandex IP** and the user-agent contains **Yandex.** If you are using the [legacy WAF managed rules](/waf/reference/legacy/old-waf-managed-rules/), disable the WAF managed rule with ID `100203` temporarily. **Solution:** Once the new Yandex IP is propagated to our system, the requests will not be blocked anymore and you can remove any workaround you configured. This can take up to 48 hours. If you see any Yandex bots still being blocked after 48 hours with no change to the bot, contact [Cloudflare Support](/support/contacting-cloudflare-support/). --- ### How does machine learning work? Supervised machine learning takes certain variables (X) like gender and age and predicts another variable (Y) like income. In Bot Management and Super Bot Fight Mode, the X variables are request features, while the Y variable represents the probability of solving a challenge based on X values. Cloudflare uses data from millions of requests and re-train the system on a periodic basis. You can learn about this data from your own request logs such as Cloudflare Logpull and Logpush as well as the Firewall API. --- ### Why am I seeing a Managed Challenge action for WAF rules? When you choose to challenge different bot categories with Bot Fight Mode or Super Bot Fight Mode, you will see Security Events with an **Action Taken** of **Managed Challenge**. You may also see Managed Challenge due to a triggered [WAF custom rule](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended). This does not mean that your traffic was blocked. It is the challenge sent to your user to determine whether they are likely human or likely bot. To understand if the result of the challenge was a success or a failure, you can verify using [Logpush](/logs/about/). ### Does the WAF run before Super Bot Fight Mode? Yes. WAF rules are executed before Super Bot Fight Mode. If a WAF custom rule performs a [terminating action](/ruleset-engine/rules-language/actions/) such as _Block_, your Super Bot Fight Mode configuration will not be evaluated. --- ### What is cf.bot_management.verified_bot? A request's _cf.bot_management.verified_bot_ value is a boolean indicating whether such request comes from a Cloudflare allowed bot. Cloudflare has built an allowlist of good, automated bots, for example Google Search Engine, Pingdom, and more. This allowlist is large based on reverse DNS verification, meaning that the IPs we allow really match the requesting service. In addition to this, Cloudflare uses multiple validation methods including ASN blocks and public lists. If none of these validation types are available for a customer, we use internal Cloudflare data and machine learning to identify legitimate IP addresses from good bots. To allow traffic from good bots, use the [Verified Bot](/ruleset-engine/rules-language/fields/reference/cf.bot_management.verified_bot/) field in your WAF custom rule. --- ### Why might the ja3hash or JA4 be empty in HTTP logs? --- ### I run a good bot and want for it to be added to the allowlist (cf.bot_management.verified_bot). What should I do? Cloudflare maintains a sample list of verified bots in [Cloudflare Radar](https://radar.cloudflare.com/verified-bots). As a bot operator, in order to be listed by Cloudflare as a Verified Bot, your bot must conform with our [verified bot public policy](/bots/concepts/bot/verified-bots/policy/). If your bot meets this criteria, submit this [online application](https://docs.google.com/forms/d/e/1FAIpQLSdqYNuULEypMnp4i5pROSc-uP6x65Xub9svD27mb8JChA_-XA/viewform?usp=sf_link). --- ### What information do I need to troubleshoot my bot issues? If you are experiencing errors with your bot solution and need to submit a Support request, include the following information: :::caution The following information gathering are required when you are experiencing issues (for example, false positives) with Enterprise Bot Management only (Enterprise plan). Because Bot Fight Mode (BFM) and Super Bot Fight Mode (SBFM) are set at a domain level, we often find that disabling these features is the best solution to false positives. Please follow instructions in the following questions on how to disable BFM and SBFM features. We conduct more thorough investigations for Enterprise Bot Management. ::: - RayIDs - IP addresses - WAF custom rule IDs, rule expression, Challenge solve rates - Common user-agents among false positives - Common ASNs among false positives - Screenshots of strange activity from the WAF, such as a huge spike in challenged traffic on the graph - Problematic URIs or paths - Rough description of how your domain is configured. - Is one zone Cloudflare for SaaS while the others are not? - Is most API traffic sent to a particular URI? - How much mobile traffic do you expect? --- ### What should I do if I am getting False positives caused by Bot Fight Mode (BFM) or Super Bot Fight Mode (SBFM)? :::caution[Important considerations you need to be aware of before turning on BFM or SBFM] - BFM and SBFM are high security features intended to quickly help customers under active attack stop as many bots as possible. Due to the high security threshold, false positives do sometimes happen. - BFM has limited control. You cannot bypass or skip BFM using the _Skip_ action in WAF custom rules or using Page Rules. BFM will be disabled if there are any IP Access rules present. If you turned on BFM during an attack, and the attack has subsided, we recommend either disabling the feature using IP Access rules to bypass BFM, or looking at [Bot Management for Enterprise](/bots/plans/bm-subscription/), which gives you the ability to precisely customize your security threshold and create exception rules as needed. - SBFM can be bypassed with IP Access _Allow_ action rules. You can use the _Skip_ action in [WAF custom rules](/waf/custom-rules/skip/) to specify where Super Bot Fight Mode should not run. ::: **How to disable BFM/SBFM feature?** If you encounter any issues with BFM/SBFM feature (for example, false positive), you can disable it under **Security** > **Settings**. For **Free** plans 1. Filter by **Bot traffic**. 2. Turn **Bot Fight Mode** off. For **Pro** plans 1. Filter by **Bot traffic**. 2. Go to **Super Bot Fight Mode**. 3. Set **Definitely automated traffic** and **Verified bots** to **Allow** 4. Turn **Static resource protection** and **JavaScript detections** off. For **Business** and **Enterprise** (with no Bot Management add-on) plans 1. Filter by **Bot traffic**. 2. Go to **Super Bot Fight Mode**. 3. Set each of **Definitely automated traffic**, **Likely automated** and **Verified bots** to **Allow**. 4. Turn **Static resource protection** and **JavaScript detections** off. You cannot bypass or skip Bot Fight Mode using the _Skip_ action in WAF custom rules or using Page Rules. _Skip_, _Bypass_, and _Allow_ actions apply to rules or rulesets running on the [Ruleset Engine](/ruleset-engine/). While Super Bot Fight Mode rules are implemented in the Ruleset Engine, Bot Fight Mode checks are not. This is why you can skip Super Bot Fight Mode, but not Bot Fight Mode. If you need to skip Bot Fight Mode, consider using [Super Bot Fight Mode](/bots/get-started/super-bot-fight-mode/). Bot Fight Mode can still trigger if you have IP Access rules, but it cannot trigger if an IP Access rule matches the request. For example, the IP Access rule matches the connecting IP. --- ### Super Bot Fight Mode feature (SBFM) is still blocking requests even though the feature is turned off, why? This is a known issue the Bots team is working to resolve in the near future. In the meantime, there is a workaround to resolve such issue. You will need to run the following API command to check and remove the SBFM ruleset: 1. List the existing Rulesets at the zone level. ```bash curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \ --header "Authorization: Bearer " ``` 2. From the output in step 1, find the ruleset ID that is associated with the zone's SBFM configuration. You should be able to see `"kind": "zone"` and `"phase": "http_request_sbfm"` for that ruleset. 3. Use the ruleset ID you found to delete the SBFM ruleset. ```bash curl --request DELETE "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}" \ --header "Authorization: Bearer " ``` Note that you need to replace `` with your own [API token](/fundamentals/api/get-started/create-token/). --- ## Web Bot Auth ### What key algorithms does Cloudflare support? Cloudflare supports Ed25519 key algorithm. --- ### What `web-bot-auth` features from the IETF draft are not supported? The following derived components are not supported, and we will fail to verify a message if they are included: - `@query-params`: Cloudflare recommends signing the whole query using the `@query` component instead of signing an individual parameter. - `@status`: This is not possible to include in the request path. The following component parameters defined in IETF RFC 9421 are not supported, and Cloudflare will fail to verify a message if they are included: - `sf` (for HTTP header fields) - `bs` (for HTTP header fields) - `key` (for HTTP header fields) - `req` (for HTTP header fields or derived components) - `name` (for `@query-param` support - this requires `@query-param` support) --- ### Should I supply a `nonce` parameter in `Signature-Input`? The `nonce` parameter allows you to supply a `nonce` to prevent attackers from replaying past messages against a server. While Cloudflare recommends including it, there is currently no `nonce` validation, nor does Cloudflare guard against replay attacks using a database of seen `nonces`. Instead, Cloudflare recommends short `expires` as a protection against replay attacks. A minute is often sufficient. --- ### How do I know my JSON Web Key set directory will be accepted? Cloudflare uses [`http-signature-directory` tool](https://crates.io/crates/http-signature-directory) to validate your directory. Please ensure this works against your directory before registering with us. --- ### My message is failing validation. What could be the cause? - Ensure you have a [`Signature-Agent` header](/bots/concepts/bot/verified-bots/web-bot-auth/#signature-agent-header), and that its value is in double-quotes. - Ensure you include `signature-agent` in the component list in your [`Signature-Input` header](/bots/concepts/bot/verified-bots/web-bot-auth/#signature-agent-header). - Ensure your `expires` timestamp is not too short, such that, by the time it arrives at Cloudflare servers, it has already expired. A minute is often sufficient. - Ensure you are not signing components containing non-ASCII values, or on the unsupported list. --- ### I want to use HTTP message signatures / Web Bot Auth on my zone, and do not want Cloudflare's verification to intervene. What do I do? You can request the Web Bot Auth feature be disabled for your zone by contacting Cloudflare support. This will disable usage of Web Bot Auth specifically with Cloudflare, and verified bots will fallback to other modes to validate traffic. --- # Cloudflare bot solutions URL: https://developers.cloudflare.com/bots/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Render } from "~/components" Identify and mitigate automated traffic to protect your domain from bad bots. While Cloudflare offers several products that relate to bot traffic, this section reviews our bot-specific products, Bot Fight Mode, Super Bot Fight Mode, and Bot Management for Enterprise. ## Which bot solution do I need? ## Features Detect and mitigate bot traffic on your domain. Identify traffic matching patterns of known bots, challenge or block bots, protect static resources, and view analytics to help you understand bot traffic using Super Bot Fight Mode. Use Bot Analytics to dynamically examine bot traffic. Access several new variables within the Firewall expression builder. ## Related products Identify and address API vulnerabilities using API Shield. Detect and mitigate Distributed Denial of Service (DDoS) attacks using Cloudflare's Autonomous Edge. Use Cloudflare's smart CAPTCHA alternative to run less intrusive challenges. Get automatic protection from vulnerabilities and the flexibility to create custom rules. ## More resources Compare available Cloudflare plans --- # Glossary URL: https://developers.cloudflare.com/bots/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Bots documentation. --- # Changelog URL: https://developers.cloudflare.com/byoip/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/byoip/get-started/ import { GlossaryTooltip } from "~/components"; Work with your account team to understand everything you need to ensure a smooth transition during the onboarding process. Cloudflare requires a service-specific configuration for your prefixes, as well as some requirements common to all BYOIP customers regardless of service type. ## Requirements The following requirements are common to all products compatible with BYOIP. You must verify that your [Internet Routing Registry (IRR)](/byoip/concepts/irr-entries/) records are up to date and contain: - `route` or `route6` objects matching the exact prefixes you want to onboard - `origin` matching the correct ASN you want to onboard :::caution[RPKI validation] You are not required to use Resource Public Key Infrastructure (RPKI). However, if you do, make sure your ROAs are accurate. You can use [Cloudflare's RPKI Portal](https://rpki.cloudflare.com/?view=validator) and a second source such as [Routinator](https://rpki-validator.ripe.net/ui/) to double-check your prefixes. ::: ## Process overview Overall, the steps can be summarized as follows: 1. You revise your [IRRs and ROAs](#requirements) (if applicable) to make sure they are correct. 2. You prepare a [Letter of Agency (LOA)](/byoip/concepts/loa/) containing both the prefix you are authorizing Cloudflare to announce and which ASN they will be announced under. Cloudflare will present this to our transit partners as evidence that we are allowed to announce the route. 3. You use the [Upload LOA Document](/api/resources/addressing/subresources/loa_documents/methods/create/) API endpoint to submit the letter under your account and the [Add Prefix](/api/resources/addressing/subresources/prefixes/methods/create/) endpoint to create the prefix in your account with the associated `loa_document_id`. 4. After receiving the LOA, Cloudflare validates the [requirements](#requirements) and provisions the IPs. 5. (Optional) You can use [prefix delegations](/byoip/concepts/prefix-delegations/) to share all or part of your prefix with another Cloudflare account. 6. You use [service bindings](/byoip/service-bindings/)[^1] and [address maps](/byoip/address-maps/)[^2] to control how your IPs are used. 7. You advertise or withdraw the BGP route for a prefix via the [BGP Prefixes API](/api/resources/addressing/subresources/prefixes/subresources/bgp_prefixes/). [^1]: Mappings that control through which pipeline traffic destined for a given IP address will be routed. [^2]: Mappings that specify which IP addresses should be used when Cloudflare responds to DNS queries for proxied hostnames. --- # Glossary URL: https://developers.cloudflare.com/byoip/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's BYOIP documentation. --- # Cloudflare BYOIP URL: https://developers.cloudflare.com/byoip/ import { LinkButton, Plan, Description } from "~/components"; Get Cloudflare's security and performance while using your own IPs. With **Bringing Your Own IPs** (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with [Magic Transit](/magic-transit/), [Spectrum](/spectrum/), [CDN services](/cache/), or [Gateway DNS](/cloudflare-one/policies/gateway/dns-policies/). Learn how to [get started](/byoip/get-started/). --- # Route Leak Detection URL: https://developers.cloudflare.com/byoip/route-leak-detection/ import { AvailableNotifications } from "~/components" Route Leak Detection protects your routes on the Internet by notifying you when your traffic is routed somewhere it should not go, which could indicate a possible attack. Route Leak Detection also reduces the amount of time needed to mitigate leaks by providing you with timely notifications. Cloudflare detects route leaks by using several sources of routing data to create a synthesis of how the Internet sees routes to BYOIP users. Cloudflare then watches these views to track any sudden changes that occur on the Internet. If the changes can be correlated to actions Cloudflare has taken, no further action is required. However, if changes have not been made, Cloudflare notifies you to inform you that your routes and users may be at risk. ## Enable Route Leak Detection You must be a user who has brought your own IP address to Cloudflare, which includes Magic Transit, Spectrum, and WAF users. Only prefixes advertised by Cloudflare qualify for Route Leak Detection. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Select **Notifications** > **Add**. 3. Locate **Route Leak Detection** from the list > **Select**. 4. Enter a name and description for the notification. 5. Enter one or more email addresses to receive the notifications. 6. Select **Save**. --- # Troubleshooting URL: https://developers.cloudflare.com/byoip/troubleshooting/ import { GlossaryTooltip } from "~/components"; The following topics are useful for troubleshooting BYOIP issues. ## uRPF filtering and packet loss Routers receive IP packets and forward the packets to the destination IP address. Unicast Reverse Path Forwarding (uRPF) is a security feature that can prevent spoofing attacks. uRPF operates under two modes: strict and loose mode. Under **strict mode**, the router performs two checks on incoming packets to look for a matching entry in the source routing table and to determine whether the interface that received the packet can be used to reach the source. If the incoming IP packets pass both checks, the packets are forwarded; if the checks do not pass, the packets are dropped. When uRPF is set to loose mode, the router performs a single check when it receives an IP packet to look for a source's matching entry in the routing table. If you are experiencing packet loss as a result of an upstream ISP implementing uRPF filtering, contact your ISP and request the link be set to **loose mode**. ## Non-SNI support Currently, BYOIP cannot be used with [legacy custom certificates](/ssl/edge-certificates/custom-certificates/uploading/) to support non-SNI requests. Instead, you can use Address Maps to set a default SNI for IPs on your account or zone. Refer to [Setup](/byoip/address-maps/setup/#non-sni-support) for further guidance. --- # Changelog URL: https://developers.cloudflare.com/cache/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # Product compatibility URL: https://developers.cloudflare.com/data-localization/compatibility/ The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table. ✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable ## Application Performance | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------- | --------------- | ----------------- | -------------------------- | | Caching/CDN | ✅ | ✅ | ✅ | | Cache Reserve | ⚫️ | 🚧 | ✅ [^29] | | DNS | ⚫️ | 🚧 [^33] | 🚧 [^32] | | HTTP/3 (with QUIC) | ⚫️ | ✘ | ⚫️ | | Image Resizing | ✅ | ✅ [^6] | 🚧 [^1] | | Load Balancing | ✅ | ✅ | 🚧 [^1] | | Onion Routing | ✘ | ✘ | ✘ | | Orange-to-Orange (O2O) | ✘ | ✘ | ✘ | | Stream Delivery | ✅ | ✅ | ✅ | | Tiered Caching | ✅ | 🚧 [^2] | 🚧 [^30] | | Trace | ✘ | ✘ | ✘ | | Waiting Room | ⚫️ | ✅ | ✅ | | Web Analytics / Real User Monitoring (RUM) | ⚫️ | ⚫️ | ✘ [^43] | | Zaraz | ✅ | ✅ | ✅ | *** ## Application Security | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------------- | --------------- | ----------------- | -------------------------- | | Advanced Certificate Manager | ⚫️ | ⚫️ | ⚫️ | | Advanced DDoS Protection | ✅ | ✅ | 🚧 [^3] | | API Shield | ✅ | ✅ | 🚧 [^4] | | Bot Management | ✅ | ✅ | 🚧 [^5] | | DNS Firewall | ⚫️ | ⚫️ | 🚧 [^22] | | Page Shield | ✅ | ✅ | ✅ | | Rate Limiting | ✅ | ✅ | ✅ [^37] | | SSL | ✅ | ✅ | ✅ | | Cloudflare for SaaS | ✘ | ✅ | ✅ | | Turnstile | ⚫️ | ✘ | ✅ [^38] | | WAF/L7 Firewall | ✅ | ✅ | ✅ | | DMARC Management | ⚫️ | ⚫️ | ✅ | *** ## Developer Platform | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ---------------------------- | --------------- | ----------------- | -------------------------- | | Cloudflare Images | ⚫️ | ✅ [^36] | 🚧 [^35] | | AI Gateway | ✘ | ✘ | 🚧 [^39] | | Cloudflare Pages | ✅ [^11] | ✅ [^11] | 🚧 [^1] | | Cloudflare D1 | ⚫️ | ⚫️ | 🚧 [^40] | | Durable Objects | ⚫️ | ✅ [^7] | 🚧 [^1] | | Email Routing | ⚫️ | ⚫️ | ✅ | | R2 | ✅ [^27] | ✅ [^8] | ✅ [^28] | | Smart Placement | ⚫️ | ✘ | ✘ | | Stream | ⚫️ | ✘ | 🚧 [^1] | | Workers (deployed on a Zone) | ✅ | ✅ | 🚧 [^41] | | Workers AI | ⚫️ | ✘ | ✅ | | Workers KV | ⚫️ | ✘ | ✅ [^34] | | Workers.dev | ✘ | ✘ | ✘ | | Workers Analytics Engine (WAE) | ⚫️ | ⚫️ | 🚧 [^1] | *** ## Network Services | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ------------------ | --------------- | ----------------- | -------------------------- | | Argo Smart Routing | ✅ | ✘ [^9] | ✘ [^10] | | Static IP/BYOIP | ⚫️ | ✅ [^26] | ⚫️ | | Magic Firewall | ⚫️ | ⚫️ | ✅ | | Magic Network Monitoring | ⚫️ | ⚫️ | 🚧 [^1] | | Magic Transit | ⚫️ | ⚫️ | 🚧 [^1] | | Magic WAN | ⚫️ | ⚫️ | ✅ | | Spectrum | ✅ | ✅ [^42] | ✅ | *** ## Platform | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ------- | --------------- | ----------------- | -------------------------- | | Logpull | ⚫️ | ⚫️ | 🚧 [^12] | | Logpush | ⚫️ | ✅ | 🚧 [^13] | | Log Explorer | ⚫️ | ⚫️ | ✘ [^23] | *** ## Zero Trust | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ----------------- | --------------- | ----------------- | -------------------------- | | Access | 🚧 [^14] | 🚧 [^15] | 🚧 [^16] | | Browser Isolation | ⚫️ | 🚧 [^17] | ✅ | | CASB | ⚫️ | ⚫️ | ✘ | | Cloudflare Tunnel | ⚫️ | 🚧 [^18] | ⚫️ | | DLP | ⚫️ [^19] | ⚫️ [^19] | 🚧 [^31] | | Gateway | 🚧 [^20] | 🚧 [^21] | 🚧 [^22] | | WARP | ⚫️ | ⚫️ | 🚧 [^1] | [^1]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. [^2]: Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. [^3]: Adaptive DDoS Protection is only supported for US CMB. [^4]: Features such as API Discovery and Volumetric Abuse Detection will not work with CMB set to EU only. [^5]: Some advanced Enterprise features, including the [Anomaly Detection engine](/bots/concepts/bot-score/#anomaly-detection), are not available. [^6]: Only when using a Custom Domain set to a region, either through Workers or [Transform Rules](/images/transform-images/serve-images-custom-paths/) within the same zone. [^7]: [Jurisdiction restrictions for Durable Objects](/durable-objects/reference/data-location/#restrict-durable-objects-to-a-jurisdiction). [^8]: Only when using a [Custom Domain](/r2/buckets/public-buckets/#connect-a-bucket-to-a-custom-domain) set to a region and using [jurisdictions with the S3 API](/r2/reference/data-location/#using-jurisdictions-with-the-s3-api). [^9]: Argo cannot be used with Regional Services. [^10]: Argo cannot be used with Customer Metadata Boundary. [^11]: Only when using [Custom Domain](/pages/configuration/custom-domains/) set to a region. [^12]: Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with [Logs Engine](https://blog.cloudflare.com/announcing-logs-engine/) which is adding region support in 2025. [^13]: Logpush available with Customer Metadata Boundary for [these datasets](/data-localization/metadata-boundary/logpush-datasets/). Contact your account team if you need another dataset. [^14]: Access App SSL keys can use Geo Key Manager. [Access JWT](/cloudflare-one/identity/authorization-cookie/validating-json/) is not yet localized. [^15]: Can be localized to US FedRAMP Moderate Domestic region only. [^16]: Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. [^17]: Currently may only be used with US FedRAMP region. [^18]: When Cloudflare Tunnel connects to Cloudflare, the connectivity options available are the Global Region (default) and [US FedRAMP Moderate Domestic region](/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#region). For incoming requests to the Cloudflare Edge, Regional Services only applies when using [Public Hostnames](/cloudflare-one/connections/connect-networks/routing-to-tunnel/). In this case, the region associated with the DNS record will apply. [^19]: Uses Gateway HTTP and CASB. [^20]: You can [bring your own certificate](https://blog.cloudflare.com/bring-your-certificates-cloudflare-gateway/) to Gateway but these cannot yet be restricted to a specific region. [^21]: Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. [^22]: Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. [^23]: Currently, customers do not have the ability to choose the location of the Cloudflare-managed R2 bucket for Log Explorer. [^26]: Static IP/BYOIP can be used with the legacy Spectrum setup. [^27]: Only when using a Custom Domain and a [Custom Certificate](/r2/reference/data-security/#encryption-in-transit) or [Keyless SSL](/ssl/keyless-ssl/). [^28]: R2 Dashboard [Metrics and Analytics](/r2/platform/metrics-analytics/) are populated. Additionally, [Jurisdictional Restrictions](/r2/reference/data-location/#jurisdictional-restrictions) guarantee objects in a bucket are stored within a specific jurisdiction. [^29]: You cannot yet specify region location for object storage itself. [^30]: Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
With CMB set to EU, the Zone Dashboard **Caching** > **Tiered Cache** > **Smart Tiered Caching** option will not populate the Dashboard Analytics. [^31]: DLP is part of Gateway HTTP, however, [DLP datasets](/cloudflare-one/policies/data-loss-prevention/datasets/#use-dlp-datasets) are not available outside US region when using Customer Metadata Boundary. [^32]: Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. [^33]: [Outgoing zone transfers](/dns/zone-setups/zone-transfers/cloudflare-as-primary/) will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. [^34]: Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. [^35]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. [^36]: Only when using a [Custom Domain](/images/manage-images/serve-images/serve-from-custom-domains/) set to a region. [^37]: Legacy Zone Analytics & Logs section not available outside US region when using CMB. Use [Security Analytics](/waf/analytics/security-analytics/) instead. [^38]: [Turnstile Analytics](/turnstile/turnstile-analytics/) are available. However, there are no regionalization guarantees for the Siteverify API yet. [^39]: Jurisdictional Restrictions (storage) options for [Logs](/ai-gateway/observability/logging/) are not supported today. [^40]: Jurisdictional Restrictions ([data location](/d1/configuration/data-location/) / storage) options are not supported today. [^41]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. Use Logpush instead. [^42]: Only applies to HTTP/S Spectrum applications. [^43]: Web Analytics collects the [minimum amount of information](/web-analytics/data-metrics/data-origin-and-collection/). Alternatively, you can [exclude EU Visitors from RUM](/speed/speed-test/rum-beacon/#rum-excluding-eeaeu). --- # FAQs URL: https://developers.cloudflare.com/data-localization/faq/ ## Are DLP and DLS the same? No, they are not. DLP stands for [Data Loss Prevention](/cloudflare-one/policies/data-loss-prevention/), and it is part of Cloudflare’s Zero Trust offering (requiring Gateway). It allows customers to scan web traffic and SaaS apps for sensitive data like secret keys, financial information (credit card numbers), and other keywords. [Data Localization Suite](/data-localization/) (DLS) is a suite of features that can provide localization and data residency features. ## Are Cloudflare’s services GDPR compliant? Yes, even without DLS, Cloudflare services are designed to satisfy the GDPR’s requirements. Cloudflare services are also verified compliant with the EU Cloud CoC, Verification-ID: 2023LVL02SCOPE4316. For further information, visit EU Cloud CoC [public register](https://eucoc.cloud/en/public-register). ## How can I use DLS? Once you have purchased DLS, the post-sales team will entitle DLS for you, and you will be able to configure all features by yourself via dashboard or API. You can find more specific information under the [Configuration guides](/data-localization/how-to/) section. ## Does Regional Services work with HTTP/3 / QUIC? Not yet. ## Are there other options if I prefer not to have Cloudflare handle TLS termination (decryption)? Yes, you have these options available: * [Spectrum TCP/UDP Apps](/spectrum/) (without TLS Termination) * [Magic Transit](/magic-transit/) * [Privacy Gateway](/privacy-gateway/) These options only offer L3/L4 DDoS protection and using them imply that no application / L7 security or performance services can be applied. ## I have configured [Customer Metadata Boundary](/data-localization/metadata-boundary/) for EU region, I'm accessing the Cloudflare Dashboard from Europe, why am I getting an error `Data not available due to your account's Customer Metadata Boundary configuration`? Based on Internet conditions that vary over time, users may be dynamically steered to a data center that is physically further away. This can be based on a variety of factors, including latency and network congestion. [Out of region access](/data-localization/metadata-boundary/out-of-region-access/) allows requests arriving in the United States to pull Customer Logs from the European Union and vice-versa. The analytics are still exclusively stored in the CMB configured region. --- # Geo Key Manager URL: https://developers.cloudflare.com/data-localization/geo-key-manager/ Geo Key Manager offers enhanced control over the storage location of private SSL/TLS keys, ensuring compliance with regional data regulations and security requirements. ## Customize key storage By default, private keys will be encrypted and securely distributed to each data center, where they can be utilized for local SSL/TLS termination. Geo Key Manager allows you to choose where you want to store your private keys. Geo Key Manager was restricted to the US, EU, and high-security data centers, but with the new version of Geo Key Manager, available in [Closed Beta](https://blog.cloudflare.com/configurable-and-scalable-geo-key-manager-closed-beta/), you can now create `allowlists` and `blocklists` of countries in which your private keys will be stored. That means that you will be able define specific geographic locations where to store keys, for instance you can store your private keys exclusively in Australia or limit private keys storage to the EU and the UK. ## Cloudflare data center flow example The following diagram is a high-level example of the flow of the Cloudflare data centers without private TLS key. In this process, data centers have to request and create temporary Session Keys to perform TLS termination by reaching out to Cloudflare data centers which hold the private TLS keys:
```mermaid sequenceDiagram participant User as End user participant CloudflarePoP as Closest data center without TLS Key participant CloudflarePoPwTLS as Data center with TLS Key User->>CloudflarePoP: Initial request Note right of CloudflarePoP: Closest data center cannot decrypt CloudflarePoP-->>CloudflarePoPwTLS: Requests TLS Signature CloudflarePoPwTLS-->>CloudflarePoP: Sends TLS Signature in order to establish Session Key Note right of CloudflarePoP: Decrypts and performs business logic (for example, WAF, Configuration Rules, Load Balancing) CloudflarePoP-->>User: Subsequent requests use the Session Key User-->>CloudflarePoP: Subsequent requests use the Session Key ```
For detailed information on setup and supported options, refer to [Geo Key Manager documentation](/ssl/edge-certificates/geokey-manager/). --- # Data Localization Suite URL: https://developers.cloudflare.com/data-localization/ import { CardGrid, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" The Data Localization Suite (DLS) is a collection of tools that enable customers to choose the location where Cloudflare inspects and stores data, while maintaining the security and performance benefits of our global network. *** ## Features Keep your keys within a specified region, ensuring compliance and data sovereignty. Ensure that any traffic metadata that can identify your end user stays in the region you selected. Comply with regional restrictions by choosing which subset of data centers decrypts and services your HTTPS traffic. *** ## Related products Cloudflare SSL/TLS encrypts your web traffic to prevent data theft and other tampering. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. *** ## More resources Refer to our latest resources to learn more about privacy. Read articles about the latest updates to the Data Localization Suite. --- # Limitations URL: https://developers.cloudflare.com/data-localization/limitations/ import { Render } from "~/components" There are some caveats and limitations when deploying Data Localization Suite features. Cloudflare is working hard to improve this offering and fill the gaps. If you have a specific feature request, please contact your [Account Team](/support/contacting-cloudflare-support/). ## Key Management When using Geo Key Manager or Keyless SSL, some caveats may apply. The remote procedure call from the server to the key server can add latency to the handshake, slowing down connection establishment. The additional latency cost corresponds to the round-trip time from the server to the key server, which can be as much as a second if the key server is on the other side of the world. Luckily, this latency cost only applies to the first time you connect to a server. Once the handshake is complete, the key server is not involved. Furthermore, if you reconnect to a site you do not have to pay the latency cost either because resuming a connection with TLS Session Resumption does not require the private key. Hence, latency is only added for the initial connection. Learn more about how it works in our [blog post](https://blog.cloudflare.com/geo-key-manager-how-it-works/). ## Regional Services When using Regional Services, some caveats and limitations may apply. For product-specific caveats, refer to [Cloudflare product compatibility](/data-localization/compatibility/) page. The following features and protocols are not supported by Regional Services and might not work on regionalized hostnames: * [ICMP](https://www.cloudflare.com/learning/ddos/glossary/internet-control-message-protocol-icmp/) * [Encrypted Client Hello (ECH)](/ssl/edge-certificates/ech/) * [Orange-to-Orange (O2O)](/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/) * [Onion Routing (Tor)](/network/onion-routing/) Since Regional Services leverages Spectrum in the background, [Spectrum limitations](/spectrum/reference/limitations/) apply. Regional Services does not apply to [Subrequests](/workers/platform/limits/#subrequests). Regional Services operates on your hostname's IPs. We recommend using [DNSSEC](/learning-paths/application-security/default-traffic-security/dnssec/) and/or [DNS over HTTPS](/1.1.1.1/encryption/dns-over-https/) to ensure that DNS responses are secure and correct. ## Customer Metadata Boundary There are certain limitations and caveats when using Customer Metadata Boundary. Specifically most of the Zone Analytics & Logs UI Tabs will be showing up as empty, when configuring Customer Metadata Boundary to EU only. It is recommended to use the UI [Security Analytics](/waf/analytics/security-analytics/) instead, or the [HTTP request](/logs/reference/log-fields/zone/http_requests/) logs via [Logpush](/logs/about/). To configure Customer Metadata Boundary to EU only, you must disable Log Retention for all zones within your account. Log Retention is a legacy feature of [Logpull](/logs/logpull/). For product-specific caveats, refer to [Cloudflare product compatibility](/data-localization/compatibility/) page. ### Data unavailability ### Dashboard UI Analytics In some cases, when using Customer Metadata Boundary set to the EU, some Dashboard UI Analytics might show up empty. --- # Region support URL: https://developers.cloudflare.com/data-localization/region-support/ Support by product and region is summarized in the following table: | Region | Geo Key Manager | Regional Services | Customer Metadata Boundary | | ------------------------------------------ | --------------- | ----------------- | ----------------------------- | | Australia | ✅ [^1] | ✅ | ✘ | | Austria | ✘ | ✅ | Can use EU metadata boundary. | | Brazil | ✘ | ✅ | ✘ | | Canada | ✅ [^1] | ✅ | ✘ | | Cloudflare Green Energy | ✘ | ✅ | ✘ | | European Union | ✅ | ✅ | ✅ | | Exclusive of Hong Kong and Macau | ✘ | ✅ | ✘ | | Exclusive of Russia and Belarus | ✘ | ✅ | ✘ | | FedRAMP Moderate Compliant (Domestic) | ✅ [^1] | ✅ | ✅ | | FedRAMP Moderate Compliant (International) | ✘ | ✅ | ✅ | | France | ✘ | ✅ | Can use EU metadata boundary. | | Germany | ✅ [^1] | ✅ | Can use EU metadata boundary. | | Hong Kong | ✘ | ✅ | ✘ | | India | ✅ [^1] | ✅ | ✘ | | ISO 27001 Certified European Union | ✘ | ✅ | Can use EU metadata boundary. | | Italy | ✘ | ✅ | Can use EU metadata boundary. | | Japan | ✅ [^1] | ✅ | ✘ | | NATO | ✘ | ✅ | ✘ | | Netherlands | ✘ | ✅ | Can use EU metadata boundary. | | Russia | ✘ | ✅ | ✘ | | Saudi Arabia | ✘ | ✅ | ✘ | | Singapore | ✅ [^1] | ✅ | ✘ | | South Africa | ✘ | ✅ | ✘ | | South Korea | ✅ [^1] | ✅ | ✘ | | Spain | ✘ | ✅ | Can use EU metadata boundary. | | Switzerland | ✘ | ✅ | ✘ | | Taiwan | ✘ | ✅ | ✘ | | United Kingdom | ✅ [^1] | ✅ | Can use EU metadata boundary. | | United States of America | ✅ | ✅ | ✅ | | US State of California | ✘ | ✅ | ✘ | | US State of Florida | ✘ | ✅ | ✘ | | US State of Texas | ✘ | ✅ | ✘ | Refer to the table below for the complete list of available regions and their definitions. | Region | Definition | | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Australia | Cloudflare will only use data centers that are physically located within Australia to decrypt and service HTTPS traffic. | | Austria | Cloudflare will only use data centers that are physically located within Austria to decrypt and service HTTPS traffic. | | Brazil | Cloudflare will only use data centers that are physically located within Brazil to decrypt and service HTTPS traffic. | | Canada | Cloudflare will only use data centers that are physically located within Canada to decrypt and service HTTPS traffic. | | Cloudflare Green Energy | Cloudflare will only use data centers that are committed to powering their operations with renewable energy. | | European Union | Cloudflare will only use data centers that are physically located within the European Union. For more details, refer to the [list of European Union countries](https://european-union.europa.eu/principles-countries-history/country-profiles_en). | | Exclusive of Hong Kong and Macau | Cloudflare will only use data centers that are NOT physically located within Hong Kong and Macau to decrypt and service HTTPS traffic. | | Exclusive of Russia and Belarus | Cloudflare will only use data centers that are NOT physically located within Russia and Belarus to decrypt and service HTTPS traffic. | | FedRAMP Moderate Compliant (Domestic) | Cloudflare will only use data centers that are FedRAMP Moderate certified and located within the United States. | | FedRAMP Moderate Compliant (International) | Cloudflare will only use data centers that are FedRAMP Moderate certified, including certified locations outside the United States. | | France | Cloudflare will only use data centers that are physically located within Metropolitan France (the European territory of France) to decrypt and service HTTPS traffic. | | Germany | Cloudflare will only use data centers that are physically located within Germany to decrypt and service HTTPS traffic. | | Hong Kong | Cloudflare will only use data centers that are physically located within Hong Kong to decrypt and service HTTPS traffic. | | India | Cloudflare will only use data centers that are physically located within India to decrypt and service HTTPS traffic. | | ISO 27001 Certified European Union | Cloudflare will only use data centers that are physically located within the [European Union](https://european-union.europa.eu/principles-countries-history/country-profiles_en) and that adhere to the ISO 27001 certification. | | Italy | Cloudflare will only use data centers that are physically located within Italy to decrypt and service HTTPS traffic. | | Japan | Cloudflare will only use data centers that are physically located within Japan to decrypt and service HTTPS traffic. | | NATO | Cloudflare will only use data centers that are physically located within North Atlantic Treaty Organization (NATO) countries. For more details, refer to the [list of NATO countries](https://www.nato.int/nato-welcome/). | | Netherlands | Cloudflare will only use data centers that are physically located within the Netherlands to decrypt and service HTTPS traffic. | | Russia | Cloudflare will only use data centers that are physically located within Russia to decrypt and service HTTPS traffic. | | Saudi Arabia | Cloudflare will only use data centers that are physically located within Saudi Arabia to decrypt and service HTTPS traffic. | | Singapore | Cloudflare will only use data centers that are physically located within Singapore to decrypt and service HTTPS traffic. | | South Africa | Cloudflare will only use data centers that are physically located within South Africa to decrypt and service HTTPS traffic. | | South Korea | Cloudflare will only use data centers that are physically located within South Korea to decrypt and service HTTPS traffic. | | Spain | Cloudflare will only use data centers that are physically located within Spain to decrypt and service HTTPS traffic. | | Switzerland | Cloudflare will only use data centers that are physically located within Switzerland to decrypt and service HTTPS traffic. | | Taiwan | Cloudflare will only use data centers that are physically located within Taiwan to decrypt and service HTTPS traffic. | | United Kingdom | Cloudflare will only use data centers that are physically located within the United Kingdom to decrypt and service HTTPS traffic. | | United States of America | Cloudflare will only use data centers that are physically located within the United States of America to decrypt and service HTTPS traffic. | | US State of California | Cloudflare will only use data centers that are physically located within the US State of California to decrypt and service HTTPS traffic. | | US State of Florida | Cloudflare will only use data centers that are physically located within the US State of Florida to decrypt and service HTTPS traffic. | | US State of Texas | Cloudflare will only use data centers that are physically located within the US State of Texas to decrypt and service HTTPS traffic. | [^1]: Only supported in [Geo Key Manager v2](/ssl/edge-certificates/geokey-manager/). --- # Botnet Threat Feed URL: https://developers.cloudflare.com/ddos-protection/botnet-threat-feed/ import { Steps } from "~/components" The Cloudflare DDoS Botnet Threat Feed is a threat intelligence feed for service providers (SPs) such as hosting providers and Internet service providers (ISPs) that provides information about their own IP addresses that have participated in HTTP DDoS attacks as observed from Cloudflare's global network. The feed aims to help service providers stop the abuse and reduce DDoS attacks originating from within their networks. Each offense is a mitigated HTTP request from the specific IP address. For example, if an IP has 3,000 offenses, it means that Cloudflare has mitigated 3,000 HTTP requests from that IP. A service provider can only get information about IP addresses associated with their autonomous system numbers (ASNs). The affiliation of a service provider with their ASNs will be checked against [PeeringDB](https://www.peeringdb.com/), a reliable and globally recognized interconnection database. To ensure the feed's accuracy, Cloudflare will only include IP addresses that have participated in multiple HTTP DDoS attacks and have triggered high-confidence rules. ## Context A single DDoS attack consisting of thousands of bots can involve as little as one single IP per service provider. Service providers usually only see a small fraction of the attack traffic leaving their network, and it can be hard to correlate it to malicious activity, while trying to identify abusers. In the case of HTTPS DDoS attacks, service providers only see encrypted payloads leaving their network without any possibility to decrypt or understand if it is malicious or legitimate traffic. However, Cloudflare can see an entire attack and all of its sources if the attack targets an Internet property that uses Cloudflare's services. This global view can help service providers stop the abusers. For more details, refer to [How DDoS protection works](/ddos-protection/about/how-ddos-protection-works/). ## Availability The Cloudflare DDoS Botnet Threat Feed is available for free to service providers. For more information, refer to the [Terms of Use](https://www.cloudflare.com/en-gb/service-specific-terms-application-services/#ddos-botnet-threat-feed). --- ## Before you begin Make sure that: - You have [created a Cloudflare account](/fundamentals/account/). ## Get started ### 1. Authenticate your ASN via PeeringDB 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Manage Account** > **Configurations**. 3. Select **DDoS Threat Feed ASNs**. 4. On the list of ASNs configured for your threat feed, select **Add ASN**. 5. You will be redirected to the PeeringDB authentication page, where you can log in and consent to share the affiliation data with us. You will be redirected back to the configuration page once it is successful. :::note You can add multiple ASNs to your threat feed. ::: ### 2. Obtain Cloudflare API token You must [obtain a Cloudflare API token](/fundamentals/api/get-started/create-token/) with at least the following account-level permission: - _DDoS Botnet Feed_ > _Read_ ### 3. Call Botnet Threat Feed API Invoke one of the Botnet Threat Feed API endpoints: - [Get full report](#get-full-report) - [Get day report](#get-day-report) --- ## Available API endpoints :::caution[Important notes] - The API URI path is planned to change from `.../botnet_feed/...` to `.../ddos_botnet_feed/...` in the future. - Responses with no IP addresses in the results (empty state) will return an `HTTP 200` status code (success), with an empty list in the `result` property. - When the response is a success but the result is `0` or `null`, this means that there are no detected offenses. ::: To invoke an API endpoint, append the operation endpoint to the Cloudflare API base URL: ```txt https://api.cloudflare.com/client/v4 ``` ### Get full report Retrieves all the data in the botnet tracking database for a given ASN (currently two weeks worth of data). - HTTP verb: `GET` - Operation endpoint: `/accounts/{account_id}/botnet_feed/asn/{asn}/full_report` The provided `{asn}` must be affiliated with your account. ```bash title="Example request" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/botnet_feed/asn/{asn}/full_report" \ --header "Content-Type: application/json" \ --header "Authorization: Bearer " ``` ```json title="Example response" { "result": [ { "cidr": "127.0.0.1/32", "date": "1970-01-01T00:00:00Z", "offense_count": 10000 }, // ... other entries ... ], "success": true, "errors": [], "messages": [] } ``` ### Get day report Retrieves all the data the botnet tracking database has for a given ASN on a given date. This operation currently allows dates greater than two weeks prior, but in this case it will return an empty dataset (the database currently stores two-weeks worth of data). - HTTP verb: `GET` - Operation endpoint: `/accounts/{account_id}/botnet_feed/asn/{asn}/day_report?date={date}` The provided `{asn}` must be affiliated with your account. `{date}` must be an ISO 8601-formatted date: `YYYY-MM-DD`. If no date is specified, the API responds with the data from the day before. ```bash title="Example request" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/botnet_feed/asn/{asn}/day_report?date=2024-05-05" \ --header "Content-Type: application/json" \ --header "Authorization: Bearer " ``` ```json title="Example response" { "result": [ { "cidr": "127.0.0.1/32", "date": "2024-05-05T00:00:00Z", "offense_count": 10000 }, // ... other entries ... ], "success": true, "errors": [], "messages": [] } ``` --- # FAQ URL: https://developers.cloudflare.com/ddos-protection/frequently-asked-questions/ ## What is a DDoS attack event? When Cloudflare's DDoS systems detect and mitigate attacks, they drop, rate-limit, or challenge (as applicable) packets, DNS queries, or HTTP requests, based on the type of attack. There are three main DDoS mitigation systems: 1. [DDoS managed rulesets](/ddos-protection/managed-rulesets/) a. [Network-layer DDoS managed ruleset](/ddos-protection/managed-rulesets/network/) b. [HTTP DDoS managed ruleset](/ddos-protection/managed-rulesets/http/) 3. [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) 4. [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) The DDoS managed ruleset includes many individual rules. Each rule provides the heuristics that instructs the system how to identify DDoS attack traffic. When the DDoS managed ruleset identifies an attack, it will generate a real-time fingerprint to match against the attack traffic, and install an ephemeral mitigation rule to mitigate the attack using that fingerprint. The start time of the attack is when the mitigation rule is installed. The attack ends when there is no more traffic matching the rule. This is a single DDoS attack event. A DDoS attack has a start time, end time, and additional attack metadata such as: - Attack ID - Attack vector - Mitigating rule - Total bytes and packets - Attack target - Mitigation action This information is used to populate the [Executive Summary](/analytics/network-analytics/understand/main-dashboard/#executive-summary) section in the [Network Analytics](/analytics/network-analytics/) dashboard. It can also be retrieved via GraphQL API using the `dosdAttackAnalyticsGroups` node. Currently, the concept of a DDoS attack event only exists for the [Network-layer DDoS managed ruleset](/ddos-protection/managed-rulesets/network/). There is no such grouping of individual packets, queries, or HTTP requests for the other systems yet. --- ## How does Cloudflare protect against "low and slow" DDoS attacks? A [low and slow DDoS attack](https://www.cloudflare.com/learning/ddos/ddos-low-and-slow-attack/) is most commonly a non-volumetric attack. The attacker will send a low volume of HTTP requests, and do so slowly. This type of attack aims to be less detectable and slowly exhausts resources. [Slowloris](https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/) is a type of low and slow attack where the attacker establishes [TCP connections](/fundamentals/reference/tcp-connections/) to the target server, often using HTTP or HTTPS protocols. In the case of a Slowloris attack, the attacker sends incomplete HTTP header lines, thus never completing the HTTP request. The server waits for the complete request, holding the connection open. The attacker periodically sends additional HTTP header fields or partial lines to keep the connection alive. This can be achieved by sending partial HTTP headers, or using the `content-length` header to declare a message body size larger than what is actually sent. The best practice to defend against low and slow attacks is by using an HTTP reverse proxy, such as Cloudflare's [CDN](/fundamentals/concepts/how-cloudflare-works/) or [WAF](/waf/) service. The reverse proxy acts as a shield. It waits for a full HTTP request before forwarding it to the origin, serving from cache, or applying other actions based on user configuration. If you are using our CDN/WAF services, our L7 reverse proxy will absorb low and slow attacks. It will buffer uploads at the edge by default. The proxy will wait for the full HTTP request before passing it on. The client requests must be completed. The request will be served from Cloudflare's [Cache](/cache/) or [Workers](/workers/), if applicable. If not, it will only be sent to the origin — assuming it was fully completed and has passed WAF checks. So the attack does not exist, similar to TCP Slowloris attacks protection. Additionally, the reverse proxy will timeout incomplete HTTP requests after a series of [keepalive probes](/fundamentals/reference/tcp-connections/#tcp-connections-and-keepalives). There is not a minimum threshold for activation. However, to provide additional security, custom firewall rules check for payload sizes and conducts basic sanity checks to ensure the content looks like what is expected. The RUDY (R-U-Dead-Yet?) DDoS attack is another type of denial-of-service (DoS) tool that performs slow-rate attacks on targeted servers. Unlike conventional DDoS attacks that overwhelm servers with a high volume of requests in a short period, RUDY focuses on creating a few prolonged requests. It does this by submitting form data at an extremely slow pace to keep the web server tied up and unavailable to legitimate traffic. This approach makes RUDY attacks difficult to detect, because the traffic can appear legitimate and does not flood the server with requests that would typically trigger conventional DDoS protection mechanisms​​​​​​. RUDY specifically targets the application layer (Layer 7) of web servers by exploiting the way web forms handle data submission. The attack works by injecting one byte of information into an application `POST` field at a time, then waiting. This process causes application threads to await the completion of the form submission indefinitely, effectively exhausting the server's resources and preventing it from processing legitimate requests​​​​. Refer to the [learning center](https://www.cloudflare.com/learning/ddos/ddos-attack-tools/r-u-dead-yet-rudy/) for more information on RUDY attacks. --- ## How does Cloudflare deal with SSL/TLS negotiation attacks or floods? SSL/TLS based attacks such as BEAST, Poodle, and CRIME are mitigated by Cloudflare's TLS settings, configuration, and cipher limitations. Because Cloudflare serves as the HTTP reverse proxy, TLS exhaustion style attacks are mitigated by terminating TLS sessions before passing HTTP requests to origin servers. TLS traffic is not proxied to origin servers without completing a proper TLS handshake. Additionally, our automated DDoS detection and mitigation systems leverage cipher suites, packet fields, HTTP request attributes and metadata, origin health, traffic profiling, Machine Learning models, and threat intelligence to detect and mitigate additional SSL-based attacks. --- ## Does Cloudflare use BGP Flowspec for upstream mitigation? Yes. Using our anycast network, along with Traffic Manager, Unimog, and Plurimog, we conduct automated traffic engineering to spread the load of traffic (legitimate and attack) to ensure our network is performant, especially during mitigation of large attacks. --- ## Where can I see latest DDoS trends? Cloudflare publishes quarterly DDoS reports and coverage of significant DDoS attacks. The publications are available on our [blog website](https://blog.cloudflare.com/tag/ddos-reports/) and as interactive reports on the [Cloudflare Radar Reports website](https://radar.cloudflare.com/reports?q=DDoS). Learn more about the [methodologies](/radar/reference/quarterly-ddos-reports/) behind these reports. You can also view [Cloudflare Radar](https://radar.cloudflare.com/) for near real-time insights and trends. --- ## What is the Ping of Death DDoS attacks? The Ping of Death (PoD) attack involves sending malformed or oversized packets to another computer or server, which can cause the system to freeze, crash, or reboot. Packets are pieces of data sent over the Internet, and the Ping of Death takes advantage of the fact that the IP protocol requires packets to be a maximum of 65,535 bytes in size. By sending a packet larger than this size, the attacker can exploit vulnerabilities in the target's TCP/IP stack, causing a buffer overflow and leading to unpredictable behavior, including system crashes. This type of attack is less common nowadays, as most modern systems and networking equipment have been patched to handle such anomalies. --- ## What are LOIC and HOIC? LOIC is a popular network stress testing and DoS attack application that is used to flood a server with TCP, UDP, or HTTP requests with the intention of disrupting the service. It is known for its simplicity and ability to be used by individuals with minimal hacking experience. LOIC can be directed by the user to attack a small server, which can cause the server to slow down or crash from the overload of requests. It became famous around 2010 for its use by the hacker group Anonymous in attacks against major companies and organizations. HOIC is an upgrade from LOIC, designed to overcome some of its limitations, especially in terms of detection and mitigation. It allows users to launch a more powerful DoS attack by enabling attacks on multiple websites at the same time with a higher volume of requests. HOIC also incorporates a feature that makes it more difficult for defense mechanisms to identify and mitigate the attack traffic, partly because it uses a technique that allows the traffic to mimic legitimate HTTP traffic, which is more challenging for traditional network security tools to detect. HOIC supports the use of "booster" scripts that enable it to target various websites simultaneously, significantly increasing its potency as a tool for conducting broad-scale DoS attacks. These tools and attacks exploit different aspects of network protocols and behaviors to overwhelm targets with unwanted traffic, leading to denial of service. Due to their potential for abuse, their use is illegal and unethical outside of controlled environments for testing purposes. --- ## Can I exclude specific user agents from HTTP DDoS protection? Yes, you can create an [override](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/) and use the expression fields to match against HTTP requests with the user agent. There are a variety of [fields](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/#available-expression-fields) that you can use. You can then adjust the [sensitivity level](/ddos-protection/managed-rulesets/http/override-parameters/#sensitivity-level) or [mitigation action](/ddos-protection/managed-rulesets/http/override-parameters/#action). Refer to the guide on how to [create an override](/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard/#create-a-ddos-override). The use of expression fields is subject to [availability](/ddos-protection/#availability). --- ## Does Cloudflare charge for DDoS attack traffic? No. Since 2017, Cloudflare offers [free, unmetered, and unlimited DDoS protection](https://blog.cloudflare.com/unmetered-mitigation/). There is no limit to the number of DDoS attacks, their duration, or their size. Cloudflare's billing systems automatically exclude DDoS attack traffic from your usage. --- ## How does DDoS Protection determine whether a SYN flood attack is mitigated by `dosd` or Advanced TCP Protection? DDoS [managed rules](/ddos-protection/managed-rulesets/) detect and mitigate attacks by finding commonality between attack packets and generating a real-time fingerprint to mitigate the attack. When the attacks are highly randomized and DDoS managed rules are unable to detect a common pattern among the attack packets, [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) uses its stateful TCP flowtracking capabilities to determine whether or not packets are legitimate. Advanced TCP Protection also mitigates simpler TCP-based attacks. Advanced TCP Protection is only necessary and available to [Magic Transit](/magic-transit/) customers. For [Spectrum](/spectrum/) and our HTTP services, we leverage the reverse proxy to mitigate sophisticated randomized TCP-based DDoS attacks. --- ## How does Cloudflare handle hyper-localized DDoS attacks that may aim to overwhelm a specific Point of Presence (PoP)? Hyper-localized DDoS attacks are attacks that target specific PoPs or data centers from botnet nodes that are close to those locations in an attempt to overwhelm them and cause an outage or service disruptions. However, Cloudflare's defense approach is resilient to these attacks and uses a combination of intelligent traffic engineering, global Anycast, and real-time, autonomous DDoS mitigation to handle hyper-localized DDoS attacks — even those that may temporarily exceed the capacity of a specific Point of Presence (PoP). ### Global Anycast Network Anycast allows multiple servers (PoPs) to share the same IP address, and the Border Gateway Protocol (BGP) routing system ensures user traffic is routed to the nearest or lowest-cost node. #### Process When one PoP is overwhelmed due to a local DDoS flood or as a result of limited capacity, BGP route propagation can be adjusted to shift traffic away from that PoP. Cloudflare can also withdraw BGP announcements from specific peers or upstreams to force traffic to reroute through better-equipped PoPs. Because DDoS traffic originates from multiple geographic regions, Anycast and traffic engineering distributes the attack across [Cloudflare's full capacity Anycast network](https://www.cloudflare.com/network/) to reduce the burden on a single PoP. ### Intelligent Traffic Engineering Cloudflare uses real-time data and intelligence systems to make decisions about traffic routing, load balancing, and congestion management. #### Process If a specific PoP becomes saturated or experiences attack traffic, Cloudflare's internal traffic engineering systems dynamically steer traffic across alternative paths using traffic shaping, path-aware routing, and dynamic DNS responses. The system monitors CPU load, network congestion, and traffic type to make smart decisions about whether to reroute or throttle connections. For Layer 7 (application-level) attacks, Cloudflare can challenge or rate-limit traffic before it reaches application servers. This scenario is similar to some extent to when we take down certain PoPs for maintenance. This can be done automatically via Traffic Manager, and if needed, by our Site Reliability Engineers (SRE). ### Real-Time DDoS Mitigation DDoS managed rules and Advanced DDoS Protection are autonomous and run on every single server independently, while also coordinating locally and globally, contributing to the resilience of each server and PoP. These systems run close to the network edge in every PoP, meaning detection and mitigation happen rapidly, often before any noticeable impact. If traffic exceeds the capacity of one PoP, mitigation rules are replicated to other PoPs to help absorb overflow. - **DDoS managed rules**: Detects and mitigates DDoS attacks in real-time. When it detects an attack, it deploys rules within seconds to mitigate the malicious traffic. - **Advanced TCP Protection**: Identifies and drops abnormal TCP/IP behavior before it hits application servers. - **Advanced DNS Protection**: Identifies and drops abnormal DNS queries behavior before it hits DNS servers. --- # Get started URL: https://developers.cloudflare.com/ddos-protection/get-started/ import { Steps } from "~/components" ## Free, Pro, and Business plans The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit. In some situations, the default protection offered by DDoS rules may need to be fine-tuned to your specific situation. You may also want to configure additional protection using other Cloudflare products. ### Adjust the provided DDoS rules If one or more DDoS rules provided by Cloudflare affects legitimate traffic, you can adjust them so that they do not perform any mitigation action against this kind of traffic. Follow the steps in [handling a false positive](/ddos-protection/managed-rulesets/http/http-overrides/override-examples/#legitimate-traffic-is-incorrectly-identified-as-an-attack-and-causes-a-false-positive) to reduce the sensitivity level of one or more DDoS rules and allow incoming legitimate traffic. ### Configure additional protection To configure additional protection against DDoS attacks, refer to the related Cloudflare products listed in [Network-layer DDoS Attack Protection](/ddos-protection/managed-rulesets/network/#related-cloudflare-products) and [HTTP DDoS Attack Protection](/ddos-protection/managed-rulesets/http/#related-cloudflare-products). ## Enterprise plan Cloudflare's DDoS protection systems automatically detect and mitigate DDoS attacks. Additionally, the systems may flag suspiciously-looking incoming traffic from legacy applications, Internet services, or faulty client applications as malicious and apply mitigation actions. If the traffic is in fact legitimate, the mitigation actions can cause service disruptions and outages in your Internet properties. To prevent this situation, Cloudflare recommends that you perform these steps to get started: 1. Set the ruleset actions for all the [DDoS Attack Protection managed rulesets](/ddos-protection/managed-rulesets/) to _Log_. 2. Analyze the flagged traffic. 3. Adjust the sensitivity or action of individual managed ruleset rules, if required. 4. Switch ruleset actions from _Log_ back to the default. ### Prerequisites You must have one of the following: - [A zone onboarded to Cloudflare](/dns/zone-setups/full-setup/) but without updated DNS records. - [An IP application onboarded to Spectrum](/spectrum/get-started/). - [An IP Prefix onboarded to Magic Transit](/magic-transit/get-started/). ### 1. Configure ruleset actions to Log :::note The _Log_ action is only available to Enterprise customers. ::: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. [Configure all the rules in the HTTP DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard/#create-a-ddos-override), setting their action to _Log_. 3. [Configure all the rules in the Network-layer DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard/#create-a-ddos-override), setting the action to _Log_. Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to `log` by following these instructions: - [Configure an override for the HTTP DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/http/http-overrides/configure-api/#configure-an-override-for-the-http-ddos-attack-protection-managed-ruleset) - [Configure an override for the Network-layer DDoS Attack Protection managed ruleset](/ddos-protection/managed-rulesets/network/network-overrides/configure-api/#configure-an-override-for-the-network-layer-ddos-attack-protection-managed-ruleset) ### 2. Review flagged traffic 1. Go to your [analytics dashboard](/ddos-protection/reference/analytics/) (the exact dashboard depends on your Cloudflare services). 2. Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if _Log_ mode were disabled. Take note of the rule IDs. ### 3. Customize managed ruleset rules Customize the specific managed ruleset rules you identified, changing their sensitivity or their action, using the Cloudflare dashboard or using the API. If you are using the Cloudflare dashboard, refer to: - [Configure HTTP DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/http/http-overrides/configure-dashboard/) - [Configure Network-layer DDoS Attack Protection in the dashboard](/ddos-protection/managed-rulesets/network/network-overrides/configure-dashboard/) If you are using the API, refer to: - [Configure HTTP DDoS Attack Protection via API](/ddos-protection/managed-rulesets/http/http-overrides/configure-api/) - [Configure Network-layer DDoS Attack Protection via API](/ddos-protection/managed-rulesets/network/network-overrides/configure-api/) When using the API, ensure that you add any required rule overrides without removing the ruleset override you configured in [Step 1](#1-configure-ruleset-actions-to-log). ### 4. Switch ruleset actions back to the default Revert the change you did in [Step 1](#1-configure-ruleset-actions-to-log), changing the action of each managed ruleset rule back to _Default_ in **Ruleset action**. Alternatively, if you are using the API, [remove the override](/ddos-protection/managed-rulesets/http/http-overrides/configure-api/#configure-an-override-for-the-http-ddos-attack-protection-managed-ruleset) you previously configured at the ruleset level for each managed ruleset. Ensure that you only remove the ruleset override and not any of the rule overrides you may have configured in [Step 3](#3-customize-managed-ruleset-rules). --- # Cloudflare DDoS Protection URL: https://developers.cloudflare.com/ddos-protection/ import { Description, Feature, FeatureTable, GlossaryTooltip, Plan, RelatedProduct } from "~/components" Detect and mitigate distributed denial-of-service (DDoS) attacks automatically. Cloudflare automatically detects and mitigates distributed denial-of-service (DDoS) attacks via our autonomous DDoS systems. These systems include multiple dynamic mitigation rules exposed as [DDoS attack protection managed rulesets](/ddos-protection/managed-rulesets/). You can customize the mitigation rules included in these rulesets to optimize and tailor the protection to your needs. --- ## Features Protect against a variety of DDoS attacks across layers 3/4 (network layer) and layer 7 (application layer) of the OSI model. Get increased protection against sophisticated DDoS attacks on layer 7 and layers 3/4. Detect and mitigate sophisticated out-of-state TCP attacks such as randomized and spoofed ACK floods, or SYN and SYN-ACK floods. Protect against DNS-based DDoS attacks, specifically sophisticated and fully randomized DNS attacks such as random prefix attacks. --- ## Availability
--- ## Related products Provides security and acceleration for any TCP or UDP based application. A network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Get automatic protection from vulnerabilities and the flexibility to create custom rules. --- # Application guide URL: https://developers.cloudflare.com/developer-spotlight/application-guide/ If you use Cloudflare's developer products and would like to share your expertise then Cloudflare's Developer Spotlight program is for you. Whether you use Cloudflare in your profession, as a student or as a hobby, let us spotlight your creativity. Write a tutorial for our documentation and earn credits for your Cloudflare account along with having your name credited on your work. The Developer Spotlight program is open for applicants until Thursday, the 24th of October 2024. ## Who can apply? The following is required in order to be an eligible applicant for the Developer Spotlight program: - You must not be an employee of Cloudflare. - You must be 18 or older. - All participants must agree to the [Developer Spotlight terms](/developer-spotlight/terms/). ## Submission rules Your tutorial must be: 1. Easy for anyone to follow. 2. Technically accurate. 3. Entirely original, written only by you. 4. Written following Cloudflare's documentation style guide. For more information, please visit our [style guide documentation](/style-guide/) and our [tutorial style guide documentation](/style-guide/documentation-content-strategy/content-types/tutorial/#template) 5. About how to use [Cloudflare's Developer Platform products](/products/?product-group=Developer+platform) to create a project or solve a problem. 6. Complete, not an unfinished draft. ## How to apply To apply to the program, submit an application through the [Developer Spotlight signup form](https://forms.gle/anpTPu45tnwjwXsk8). Successful applicants will be contacted by email. ## Account credits Account credits can be used towards recurring monthly charges for Cloudflare plans or add-on services. Once a tutorial submission has been approved and published, we can then add 350 credits to your Cloudflare account. Credits are only valid for three years. Valid payment details must be stored on the receiving account before credits can be added. ## FAQ ### How many tutorial topic ideas can I submit? You may submit as many tutorial topics ideas as you like in your application. ### When will I be compensated for my tutorial? We will add the account credits to your Cloudflare account after your tutorial has been approved and published under the Developer Spotlight program. ### If my tutorial is accepted and published on Cloudflare's Developer Spotlight program, can I republish it elsewhere? We ask that you do not republish any tutorials that have been published under the Cloudflare Developer Spotlight program. ### Will I be credited for my work? You will be credited as the author of any tutorial you submit that is successfully published through the Cloudflare Developer Spotlight program. We will add your details to your work after it has been approved. ### What happens If my topic of choice gets accepted but the tutorial submission gets rejected? Our team will do our best to help you edit your tutorial's pull request to be ready for submission; however, in the unlikely chance that your tutorial's pull request is rejected, you are still free to publish your work elsewhere. --- # Developer Spotlight program URL: https://developers.cloudflare.com/developer-spotlight/ import { LinkTitleCard } from "~/components"; ![Illustration of a laptop.](~/assets/images/developer_spotlight/developer_spotlight.png) Find examples of how our community of developers are getting the most out of our products. Applications are currently open until Thursday, the 24th of October 2024. To apply, please read the [application guide](/developer-spotlight/application-guide/) ## View latest contributions By Mackenly Jones By Rajeev R. Sharma By Hidetaka Okamoto By Ivan Buendia By Vasyl By Aleksej Komnenovic By John Siciliano By Hidetaka Okamoto By Dominik Fuerst By Cody Walsh --- # Developer Spotlight Terms URL: https://developers.cloudflare.com/developer-spotlight/terms/ These Developer Spotlight Terms (the “Terms”) govern your participation in the Cloudflare Developer Spotlight Program (the “Program”). As used in these Terms, "Cloudflare", "us" or "we" refers to Cloudflare, Inc. and its affiliates. THESE TERMS DO NOT APPLY TO YOUR ACCESS AND USE OF THE CLOUDFLARE PRODUCTS AND SERVICES THAT ARE PROVIDED UNDER THE [SELF-SERVE SUBSCRIPTION AGREEMENT](https://www.cloudflare.com/terms/), THE [ENTERPRISE SUBSCRIPTION AGREEMENT](https://www.cloudflare.com/enterpriseterms/), OR OTHER WRITTEN AGREEMENT SIGNED BETWEEN YOU AND CLOUDFLARE (IF APPLICABLE). 1. Eligibility. By agreeing to these Terms, you represent and warrant to us: (i) that you are at least eighteen (18) years of age; (ii) that you have not previously been suspended or removed from the Program and (iii) that your participation in the Program is in compliance with any and all applicable laws and regulations. 2. Submissions. From time-to-time, Cloudflare may accept certain tutorials, blogs, and other content submissions from its developer community (“Dev Content”) for consideration for publication on a Cloudflare blog, developer documentation, social media platform or other website. You grant us a worldwide, perpetual, irrevocable, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Dev Content in any and all media or distribution methods now known or later developed. a. Likeness. You hereby grant to Cloudflare the royalty free right to use your name and likeness and any trademarks you include in the Dev Content in any and all manner, media, products, means, or methods, now known or hereafter created, throughout the world, in perpetuity, in connection with Cloudflare’s exercise of its rights under these Terms, including Cloudflare’s use of the Dev Content. Notwithstanding any other provision of these Terms, nothing herein will obligate Cloudflare to use the Dev Content in any manner. You understand and agree that you will have no right to any proceeds derived by Cloudflare or any third party from the use of the Dev Content. b. Representations & Warranties. By submitting Dev Content, you represent and warrant that (1) you are the author and sole owner of all rights to the Dev Content; (2) the Dev Content is original and has not in whole or in part previously been published in any form and is not in the public domain; (3) your Dev Content is accurate and not misleading; (4) your Dev Content, does not: (i) infringe, violate, or misappropriate any third-party right, including any copyright, trademark, patent, trade secret, moral right, privacy right, right of publicity, or any other intellectual property or proprietary right; or (ii) slander, defame, or libel any third-party; and (2) no payments will be due from Cloudflare to any third party for the exercise of any rights granted under these Terms. c. Compensation. Unless otherwise agreed by Cloudflare in writing, you understand and agree that Cloudflare will have no obligation to you or any third-party for any compensation, reimbursement, or any other payments in connection with your participation in the Program or publication of Dev Content. 3. Termination. These Terms will continue in full force and effect until either party terminates upon 30 days’ written notice to the other party. The provisions of Sections 2, 4, and 5 shall survive any termination or expiration of this agreement. 4. Indemnification. You agree to defend, indemnify, and hold harmless Cloudflare and its officers, directors, employees, consultants, affiliates, subsidiaries and agents (collectively, the "Cloudflare Entities") from and against any and all claims, liabilities, damages, losses, and expenses, including reasonable attorneys' fees and costs, arising out of or in any way connected with your violation of any third-party right, including without limitation any intellectual property right, publicity, confidentiality, property or privacy right. We reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you (and without limiting your indemnification obligations with respect to such matter), and in such case, you agree to cooperate with our defense of such claim. 5. Limitation of Liability. IN NO EVENT WILL THE CLOUDFLARE ENTITIES BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO YOUR PARTICIPATION IN THE PROGRAM, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, WHETHER OR NOT THE CLOUDFLARE ENTITIES HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE. 6. Independent Contractor. The parties acknowledge and agree that you are an independent contractor, and nothing in these Terms will create a relationship of employment, joint venture, partnership or agency between the parties. Neither party will have the right, power or authority at any time to act on behalf of, or represent the other party. Cloudflare will not obtain workers’ compensation or other insurance on your behalf, and you are solely responsible for all payments, benefits, and insurance required for the performance of services hereunder, including, without limitation, taxes or other withholdings, unemployment, payroll disbursements, and other related expenses. You hereby acknowledge and agree that these Terms are not governed by any union or collective bargaining agreement and Cloudflare will not pay you any union-required residuals, reuse fees, pension, health and welfare benefits or other benefits/payments. 7. Governing Law. These Terms will be governed by the laws of the State of California without regard to conflict of law principles. To the extent that any lawsuit or court proceeding is permitted hereunder, you and Cloudflare agree to submit to the personal and exclusive jurisdiction of the state and federal courts located within San Francisco County, California for the purpose of litigating all such disputes. 8. Modifications. Cloudflare reserves the right to make modifications to these Terms at any time. Revised versions of these Terms will be posted publicly online. Unless otherwise specified, any modifications to the Terms will take effect the day they are posted publicly online. If you do not agree with the revised Terms, your sole and exclusive remedy will be to discontinue your participation in the Program. 9. General. These Terms, together with any applicable product limits, disclaimers, or other terms presented to you on a Cloudflare controlled website (e.g., www.cloudflare.com, as well as the other websites that Cloudflare operates and that link to these Terms) or documentation, each of which are incorporated by reference into these Terms, constitute the entire and exclusive understanding and agreement between you and Cloudflare regarding your participation in the Program. Use of section headers in these Terms is for convenience only and will not have any impact on the interpretation of particular provisions. You may not assign or transfer these Terms or your rights hereunder, in whole or in part, by operation of law or otherwise, without our prior written consent. We may assign these Terms at any time without notice. The failure to require performance of any provision will not affect our right to require performance at any time thereafter, nor will a waiver of any breach or default of these Terms or any provision of these Terms constitute a waiver of any subsequent breach or default or a waiver of the provision itself. In the event that any part of these Terms is held to be invalid or unenforceable, the unenforceable part will be given effect to the greatest extent possible and the remaining parts will remain in full force and effect. Upon termination of these Terms, any provision that by its nature or express terms should survive will survive such termination or expiration. --- # DNS lookup limit URL: https://developers.cloudflare.com/dmarc-management/dns-lookup-limits/ The [Sender Policy Framework (SPF)](https://datatracker.ietf.org/doc/rfc4408/) specification has a limit on the number of DNS lookups required to fully resolve an SPF record. According to the specification, SPF must limit the number of DNS lookups to 10 per SPF check. If your SPF records exceed this number, your emails might not reach their destination. To check if your SPF records are compliant with the SPF specification: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. In **Email record overview**, select **View records**. 4. Find your SPF record, and select the three dots next to it > **Inspect**. 5. DMARC Management will inspect your records and check for the total number of DNS lookups. If the record exceeds the maximum number of DNS lookups, DMARC Management will warn you about this. You should edit and remove unnecessary records in the DNS page. Refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/#delete-dns-records) for more information on how to delete DNS records. --- # Enable DMARC Management URL: https://developers.cloudflare.com/dmarc-management/enable/ import { GlossaryTooltip } from "~/components" You need to enable DMARC Management to allow Cloudflare to process DMARC reports on your behalf. DMARC Management only works with apex domains and not domains in [subdomain setups](/dns/zone-setups/subdomain-setup/). :::caution[A warning on DMARC Management and SPF records] DMARC Management does not support actions on SPF records when your zone has a CNAME record that points to a different domain. Changing the SPF record would make DMARC rules invalid, as Cloudflare cannot change other DNS records to reflect your updates. ::: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. Select **Enable DMARC Management**. 4. DMARC Management will scan your zone for DMARC records. 1. If no record is found, Cloudflare will automatically invite you to add one that you can edit later. Select **Add** to continue. 2. If there is a DMARC record in your zone, Cloudflare will add another `rua` entry to it. This additional `rua` tag has a Cloudflare email address and is needed for Cloudflare to be able to start processing DMARC reports on your behalf. Select **Next** to continue. DMARC Management (beta) is now active. However, it may take up to 24 hours to receive your first DMARC report and to display this information in DMARC Management. --- # Cloudflare DMARC Management URL: https://developers.cloudflare.com/dmarc-management/ import { Description, Plan, RelatedProduct } from "~/components" Stop brand impersonation. Cloudflare DMARC Management helps you track every source that is sending emails from your domain and review [Domain-based Message Authentication Reporting and Conformance (DMARC)](https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/) reports for each source. DMARC reports will help you understand if messages sent from your domain are passing DMARC authentication, [DomainKeys Identified Mail (DKIM)](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/) authentication, and [Sender Policy Framework (SPF)](https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/) policies. DMARC Management is available to all Cloudflare customers with [Cloudflare DNS](/dns/). *** ## Related products Protect your email inbox with Email Security. Fast, resilient and easy-to-manage DNS service. --- # Statistics and details URL: https://developers.cloudflare.com/dmarc-management/statistics/ DMARC Management (beta) allows you to review how emails sent on your behalf have fared regarding security policies such as DMARC, SFP, and DKIM. 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. The graph shows you the volume of emails during a certain period of time. Select the dropdown to select a period of time up to 30 days. 4. Moving your mouse through the graph gives you details for a particular day. Select **View reports** for a list of DMARC reports by date. 5. Select one of the dates shown to open a window with more details. ## Source details The Top 10 sources section shows you details about the top sources sending emails on your behalf, with information such as total volume of emails and how these sources fared regarding security policies. You also have access to information about all third parties, and can drill down for further details on each of them: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. Select **View all**. 4. The next page shows you a list of all sources sending email on your behalf. You can filter this list by time period. 5. Find a source you want to inspect further, and select the three dots in front of it > **Details** to learn more about that third party. --- # Security records URL: https://developers.cloudflare.com/dmarc-management/security-records/ import { Render } from "~/components" ## Create security records To set up email security records: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Email** > **DMARC Management**. 3. In **Email record overview**, select **View records**. 4. Use the available options to set up SPF, DKIM, and DMARC records. This page will also list any previous records you might already have in your account. ## Edit or delete records Refer to [Manage DNS records](/dns/manage-dns-records/how-to/create-dns-records/) for more information. --- # Overview URL: https://developers.cloudflare.com/docs-guide/ This section provides guidance on creating and leveling up your docs website. It's also still in progress, so check back as we add more resources over time. --- # Changelog URL: https://developers.cloudflare.com/dns/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # What are Durable Objects? URL: https://developers.cloudflare.com/durable-objects/what-are-durable-objects/ import { Render } from "~/components"; ## Durable Objects highlights Durable Objects have properties that make them a great fit for distributed stateful scalable applications. **Serverless compute, zero infrastructure management** - Durable Objects are built on-top of the Workers runtime, so they support exactly the same code (JavaScript and WASM), and similar memory and CPU limits. - Each Durable Object is [implicitly created on first access](/durable-objects/api/namespace/#get). User applications are not concerned with their lifecycle, creating them or destroying them. Durable Objects migrate among healthy servers, and therefore applications never have to worry about managing them. - Each Durable Object stays alive as long as requests are being processed, and remains alive for several seconds after being idle before hibernating, allowing applications to [exploit in-memory caching](/durable-objects/reference/in-memory-state/) while handling many consecutive requests and boosting their performance. **Storage colocated with compute** - Each Durable Object has its own [durable, transactional, and strongly consistent storage](/durable-objects/api/storage-api/) (up to 10 GB[^1]), persisted across requests, and accessible only within that object. **Single-threaded concurrency** - Each [Durable Object instance has an identifier](/durable-objects/api/id/), either randomly-generated or user-generated, which allows you to globally address which Durable Object should handle a specific action or request. - Durable Objects are single-threaded and cooperatively multi-tasked, just like code running in a web browser. For more details on how safety and correctness are achieved, refer to the blog post ["Durable Objects: Easy, Fast, Correct — Choose three"](https://blog.cloudflare.com/durable-objects-easy-fast-correct-choose-three/). **Elastic horizontal scaling across Cloudflare's global network** - Durable Objects can be spread around the world, and you can [optionally influence where each instance should be located](/durable-objects/reference/data-location/#provide-a-location-hint). Durable Objects are not yet available in every Cloudflare data center; refer to the [where.durableobjects.live](https://where.durableobjects.live/) project for live locations. - Each Durable Object type (or ["Namespace binding"](/durable-objects/api/namespace/) in Cloudflare terms) corresponds to a JavaScript class implementing the actual logic. There is no hard limit on how many Durable Objects can be created for each namespace. - Durable Objects scale elastically as your application creates millions of objects. There is no need for applications to manage infrastructure or plan ahead for capacity. ## Durable Objects features ### In-memory state Each Durable Object has its own [in-memory state](/durable-objects/reference/in-memory-state/). Applications can use this in-memory state to optimize the performance of their applications by keeping important information in-memory, thereby avoiding the need to access the durable storage at all. Useful cases for in-memory state include batching and aggregating information before persisting it to storage, or for immediately rejecting/handling incoming requests meeting certain criteria, and more. In-memory state is reset when the Durable Object hibernates after being idle for some time. Therefore, it is important to persist any in-memory data to the durable storage if that data will be needed at a later time when the Durable Object receives another request. ### Storage API The [Durable Object Storage API](/durable-objects/api/storage-api/) allows Durable Objects to access fast, transactional, and strongly consistent storage. A Durable Object's attached storage is private to its unique instance and cannot be accessed by other objects. There are two flavors of the storage API, a [key-value (KV) API](/durable-objects/api/storage-api/#kv-api) and an [SQL API](/durable-objects/api/storage-api/#sql-api). When using the [new SQLite in Durable Objects storage backend](/durable-objects/reference/durable-objects-migrations/#enable-sqlite-storage-backend-on-new-durable-object-class-migration), you have access to both the APIs. However, if you use the previous storage backend you only have access to the key-value API. ### Alarms API Durable Objects provide an [Alarms API](/durable-objects/api/alarms/) which allows you to schedule the Durable Object to be woken up at a time in the future. This is useful when you want to do certain work periodically, or at some specific point in time, without having to manually manage infrastructure such as job scheduling runners on your own. You can combine Alarms with in-memory state and the durable storage API to build batch and aggregation applications such as queues, workflows, or advanced data pipelines. ### WebSockets WebSockets are long-lived TCP connections that enable bi-directional, real-time communication between client and server. Because WebSocket sessions are long-lived, applications commonly use Durable Objects to accept either the client or server connection. Because Durable Objects provide a single-point-of-coordination between Cloudflare Workers, a single Durable Object instance can be used in parallel with WebSockets to coordinate between multiple clients, such as participants in a chat room or a multiplayer game. Durable Objects support the [WebSocket Standard API](/durable-objects/best-practices/websockets/#websocket-standard-api), as well as the [WebSockets Hibernation API](/durable-objects/best-practices/websockets/#websocket-hibernation-api) which extends the Web Standard WebSocket API to reduce costs by not incurring billing charges during periods of inactivity. ### RPC Durable Objects support Workers [Remote-Procedure-Call (RPC)](/workers/runtime-apis/rpc/) which allows applications to use JavaScript-native methods and objects to communicate between Workers and Durable Objects. Using RPC for communication makes application development easier and simpler to reason about, and more efficient. ## Actor programming model Another way to describe and think about Durable Objects is through the lens of the [Actor programming model](https://en.wikipedia.org/wiki/Actor_model). There are several popular examples of the Actor model supported at the programming language level through runtimes or library frameworks, like [Erlang](https://www.erlang.org/), [Elixir](https://elixir-lang.org/), [Akka](https://akka.io/), or [Microsoft Orleans for .NET](https://learn.microsoft.com/en-us/dotnet/orleans/overview). The Actor model simplifies a lot of problems in distributed systems by abstracting away the communication between actors using RPC calls (or message sending) that could be implemented on-top of any transport protocol, and it avoids most of the concurrency pitfalls you get when doing concurrency through shared memory such as race conditions when multiple processes/threads access the same data in-memory. Each Durable Object instance can be seen as an Actor instance, receiving messages (incoming HTTP/RPC requests), executing some logic in its own single-threaded context using its attached durable storage or in-memory state, and finally sending messages to the outside world (outgoing HTTP/RPC requests or responses), even to another Durable Object instance. Each Durable Object has certain capabilities in terms of [how much work it can do](/durable-objects/platform/limits/#how-much-work-can-a-single-durable-object-do), which should influence the application's [architecture to fully take advantage of the platform](/reference-architecture/diagrams/storage/durable-object-control-data-plane-pattern/). Durable Objects are natively integrated into Cloudflare's infrastructure, giving you the ultimate serverless platform to build distributed stateful applications exploiting the entirety of Cloudflare's network. ## Durable Objects in Cloudflare Many of Cloudflare's products use Durable Objects. Some of our technical blog posts showcase real-world applications and use-cases where Durable Objects make building applications easier and simpler. These blog posts may also serve as inspiration on how to architect scalable applications using Durable Objects, and how to integrate them with the rest of Cloudflare Developer Platform. - [Durable Objects aren't just durable, they're fast: a 10x speedup for Cloudflare Queues](https://blog.cloudflare.com/how-we-built-cloudflare-queues/) - [Behind the scenes with Stream Live, Cloudflare's live streaming service](https://blog.cloudflare.com/behind-the-scenes-with-stream-live-cloudflares-live-streaming-service/) - [DO it again: how we used Durable Objects to add WebSockets support and authentication to AI Gateway](https://blog.cloudflare.com/do-it-again/) - [Workers Builds: integrated CI/CD built on the Workers platform](https://blog.cloudflare.com/workers-builds-integrated-ci-cd-built-on-the-workers-platform/) - [Build durable applications on Cloudflare Workers: you write the Workflows, we take care of the rest](https://blog.cloudflare.com/building-workflows-durable-execution-on-workers/) - [Building D1: a Global Database](https://blog.cloudflare.com/building-d1-a-global-database/) - [Billions and billions (of logs): scaling AI Gateway with the Cloudflare Developer Platform](https://blog.cloudflare.com/billions-and-billions-of-logs-scaling-ai-gateway-with-the-cloudflare/) - [Indexing millions of HTTP requests using Durable Objects](https://blog.cloudflare.com/r2-rayid-retrieval/) Finally, the following blog posts may help you learn some of the technical implementation aspects of Durable Objects, and how they work. - [Durable Objects: Easy, Fast, Correct — Choose three](https://blog.cloudflare.com/durable-objects-easy-fast-correct-choose-three/) - [Zero-latency SQLite storage in every Durable Object](https://blog.cloudflare.com/sqlite-in-durable-objects/) - [Workers Durable Objects Beta: A New Approach to Stateful Serverless](https://blog.cloudflare.com/introducing-workers-durable-objects/) ## Get started Get started now by following the ["Get started" guide](/durable-objects/get-started/) to create your first application using Durable Objects. [^1]: Storage per Durable Object with SQLite is currently 1 GB. This will be raised to 10 GB for general availability. --- # Cloudflare Email Routing URL: https://developers.cloudflare.com/email-routing/ import { Description, Feature, Plan, RelatedProduct, Render } from "~/components" Create custom email addresses for your domain and route incoming emails to your preferred mailbox. It is available to all Cloudflare customers [using Cloudflare as an authoritative nameserver](/dns/zone-setups/full-setup/). *** ## Features Leverage the power of Cloudflare Workers to implement any logic you need to process your emails. Create rules as complex or simple as you need. With Email Routing you can have many custom email addresses to use for specific situations. Email Routing includes metrics to help you check on your email traffic history. *** ## Related products Cloudflare Email Security is a cloud based service that stops phishing attacks, the biggest cybersecurity threat, across all traffic vectors - email, web and network. Email Routing is available to customers using Cloudflare as an authoritative nameserver. --- # Limits URL: https://developers.cloudflare.com/email-routing/limits/ import { Render } from "~/components" ## Email Workers size limits When you process emails with Email Workers and you are on [Workers’ free pricing tier](/workers/platform/pricing/) you might encounter an allocation error. This may happen due to the size of the emails you are processing and/or the complexity of your Email Worker. Refer to [Worker limits](/workers/platform/limits/#worker-limits) for more information. You can use the [log functionality for Workers](/workers/observability/logs/) to look for messages related to CPU limits (such as `EXCEEDED_CPU`) and troubleshoot any issues regarding allocation errors. If you encounter these error messages frequently, consider upgrading to the [Workers Paid plan](/workers/platform/pricing/) for higher usage limits. ## Message size Currently, Email Routing does not support messages bigger than 25 MiB. ## Rules and addresses | Feature | Limit | | -------------------------------------------------------------------------------- | ----- | | [Rules](/email-routing/setup/email-routing-addresses/) | 200 | | [Addresses](/email-routing/setup/email-routing-addresses/#destination-addresses) | 200 | ## Email Routing summary for emails sent through Workers Emails sent through Workers will show up in the Email Routing summary page as dropped even if they were successfully delivered. --- # Postmaster URL: https://developers.cloudflare.com/email-routing/postmaster/ This page provides technical information about Email Routing to professionals who administer email systems, and other email providers. Here you will find information regarding Email Routing, along with best practices, rules, guidelines, troubleshooting tools, as well as known limitations for Email Routing. ## Postmaster ### Authenticated Received Chain (ARC) Email Routing supports [Authenticated Received Chain (ARC)](http://arc-spec.org/). ARC is an email authentication system designed to allow an intermediate email server (such as Email Routing) to preserve email authentication results. Google also supports ARC. ### Contact information The best way to contact us is using our [community forum](https://community.cloudflare.com/new-topic?category=Feedback/Previews%20%26%20Betas&tags=email) or our [Discord server](https://discord.com/invite/cloudflaredev). ### DKIM signature [DKIM (DomainKeys Identified Mail)](https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail) ensures that email messages are not altered in transit between the sender and the recipient's SMTP servers through public-key cryptography. Through this standard, the sender publishes its public key to a domain's DNS once, and then signs the body of each message before it leaves the server. The recipient server reads the message, gets the domain public key from the domain's DNS, and validates the signature to ensure the message was not altered in transit. Email Routing adds two new signatures to the emails in transit, one on behalf of the Cloudflare domain used for sender rewriting `email.cloudflare.net`, and another one on behalf of the customer's recipient domain. Below is the DKIM key for `email.cloudflare.net`: ```sh dig TXT cf2024-1._domainkey.email.cloudflare.net +short ``` ```sh output "v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiweykoi+o48IOGuP7GR3X0MOExCUDY/BCRHoWBnh3rChl7WhdyCxW3jgq1daEjPPqoi7sJvdg5hEQVsgVRQP4DcnQDVjGMbASQtrY4WmB1VebF+RPJB2ECPsEDTpeiI5ZyUAwJaVX7r6bznU67g7LvFq35yIo4sdlmtZGV+i0H4cpYH9+3JJ78k" "m4KXwaf9xUJCWF6nxeD+qG6Fyruw1Qlbds2r85U9dkNDVAS3gioCvELryh1TxKGiVTkg4wqHTyHfWsp7KD3WQHYJn0RyfJJu6YEmL77zonn7p2SRMvTMP3ZEXibnC9gz3nnhR6wcYL8Q7zXypKTMD58bTixDSJwIDAQAB" ``` You can find the DKIM key for the customer's `example.com` domain by querying the following: ```sh dig TXT cf2024-1._domainkey.example.com +short ``` ### DMARC enforcing Email Routing enforces Domain-based Message Authentication, Reporting & Conformance (DMARC). Depending on the sender's DMARC policy, Email Routing will reject emails when there is an authentication failure. Refer to [dmarc.org](https://dmarc.org/) for more information on this protocol. It is recommended that all senders implement the DMARC protocol in order to successfully deliver email to Cloudflare. ### Mail authentication requirement Cloudflare requires emails to [pass some form of authentication](/changelog/2025-06-30-mail-authentication/), either pass SPF verification or be correctly DKIM-signed to forward them. Having DMARC configured will also have a positive impact and is recommended. ### IPv6 support Currently, Email Routing will connect to the upstream SMTP servers using IPv6 if they provide AAAA records for their MX servers, and fall back to IPv4 if that is not possible. Below is an example of a popular provider that supports IPv6: ```sh dig mx gmail.com ``` ```sh output gmail.com. 3084 IN MX 5 gmail-smtp-in.l.google.com. gmail.com. 3084 IN MX 20 alt2.gmail-smtp-in.l.google.com. gmail.com. 3084 IN MX 40 alt4.gmail-smtp-in.l.google.com. gmail.com. 3084 IN MX 10 alt1.gmail-smtp-in.l.google.com. gmail.com. 3084 IN MX 30 alt3.gmail-smtp-in.l.google.com. ``` ```sh dig AAAA gmail-smtp-in.l.google.com ``` ```sh output gmail-smtp-in.l.google.com. 17 IN AAAA 2a00:1450:400c:c09::1b ``` Email Routing also supports IPv6 through Cloudflare’s inbound MX servers. ### MX, SPF, and DKIM records Email Routing automatically adds a few DNS records to the zone when our customers enable Email Routing. If we take `example.com` as an example: ```txt example.com. 300 IN MX 13 amir.mx.cloudflare.net. example.com. 300 IN MX 86 linda.mx.cloudflare.net. example.com. 300 IN MX 24 isaac.mx.cloudflare.net. example.com. 300 IN TXT "v=spf1 include:_spf.mx.cloudflare.net ~all" ``` [The MX (mail exchange) records](https://www.cloudflare.com/learning/dns/dns-records/dns-mx-record/) tell the Internet where the inbound servers receiving email messages for the zone are. In this case, anyone who wants to send an email to `example.com` can use the `amir.mx.cloudflare.net`, `linda.mx.cloudflare.net`, or `isaac.mx.cloudflare.net` SMTP servers. ### Outbound prefixes Email Routing sends its traffic using both IPv4 and IPv6 prefixes, when supported by the upstream SMTP server. If you are a postmaster and are having trouble receiving Email Routing's emails, allow the following outbound IP addresses in your server configuration: **IPv4** `104.30.0.0/19` **IPv6** `2405:8100:c000::/38` _Ranges last updated: December 13th, 2023_ ### Outbound hostnames In addition to the outbound prefixes, Email Routing will use the following outbound domains for the `HELO/EHLO` command: - `cloudflare-email.net` - `cloudflare-email.org` - `cloudflare-email.com` PTR records (reverse DNS) ensure that each hostname has an corresponding IP. For example: ```sh dig a-h.cloudflare-email.net +short ``` ```sh output 104.30.0.7 ``` ```sh dig -x 104.30.0.7 +short ``` ```sh output a-h.cloudflare-email.net. ``` ### Sender rewriting Email Routing rewrites the SMTP envelope sender (`MAIL FROM`) to the forwarding domain to avoid issues with [SPF](#spf-record). Email Routing uses the [Sender Rewriting Scheme](https://en.wikipedia.org/wiki/Sender_Rewriting_Scheme) to achieve this. This has no effect to the end user's experience, though. The message headers will still report the original sender's `From:` address. ### SMTP errors In most cases, Email Routing forwards the upstream SMTP errors back to the sender client in-session. ### Realtime Block Lists Email Routing uses an internal Domain Name System Blocklists (DNSBL) service to check if the sender's IP is present in one or more Realtime Block Lists (RBL) lists. When the system detects an abusive IP, it blocks the email and returns an SMTP error: ```txt 554 found on one or more RBLs (abusixip). Refer to https://developers.cloudflare.com/email-routing/postmaster/#spam-and-abusive-traffic/ ``` We update our RBLs regularly. You can use combined block list lookup services like [MxToolbox](https://mxtoolbox.com/blacklists.aspx) to check if your IP matches other RBLs. IP reputation blocks are usually temporary, but if you feel your IP should be removed immediately, please contact the RBL's maintainer mentioned in the SMTP error directly. ### Anti-spam In addition to DNSBL, Email Routing uses advanced heuristic and statistical analysis of the email's headers and text to calculate a spam score. We inject the score in the custom `X-Cf-Spamh-Score` header: ``` X-Cf-Spamh-Score: 2 ``` This header is visible in the forwarded email. The higher the score, 5 being the maximum, the more likely the email is spam. Currently, this system is experimental and passive; we do not act on it and suggest that upstream servers and email clients don't act on it either. We will update this page with more information as we fine-tune the system. ### SPF record A SPF DNS record is an anti-spoofing mechanism that is used to specify which IP addresses and domains are allowed to send emails on behalf of your zone. The Internet Engineering Task Force (IETF) tracks the SPFv1 specification [in RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208). Refer to the [SPF Record Syntax](http://www.open-spf.org/SPF_Record_Syntax/) to learn the SPF syntax. Email Routing's SPF record contains the following: ```txt v=spf1 include:_spf.mx.cloudflare.net ~all ``` In the example above: - `spf1`: Refers to SPF version 1, the most common and more widely adopted version of SPF. - `include`: Include a second query to `_spf.mx.cloudflare.net` and allow its contents. - `~all`: Otherwise [`SoftFail`](http://www.open-spf.org/SPF_Record_Syntax/) on all other origins. `SoftFail` means NOT allowed to send, but in transition. This instructs the upstream server to accept the email but mark it as suspicious if it came from any IP addresses outside of those defined in the SPF records. If we do a TXT query to `_spf.mx.cloudflare.net`, we get: ```txt _spf.mx.cloudflare.net. 300 IN TXT "v=spf1 ip4:104.30.0.0/20 ~all" ``` This response means: - Allow all IPv4 IPs coming from the `104.30.0.0/20` subnet. - Otherwise, `SoftFail`. You can read more about SPF, DKIM, and DMARC in our [Tackling Email Spoofing and Phishing](https://blog.cloudflare.com/tackling-email-spoofing/) blog. --- ## Known limitations Below, you will find information regarding known limitations for Email Routing. ### Email address internationalization (EAI) Email Routing does not support [internationalized email addresses](https://en.wikipedia.org/wiki/International_email). Email Routing only supports [internationalized domain names](https://en.wikipedia.org/wiki/Internationalized_domain_name). This means that you can have email addresses with an internationalized domain, but not an internationalized local-part (the first part of your email address, before the `@` symbol). Refer to the following examples: - `info@piñata.es` - Supported. - `piñata@piñata.es` - Not supported. ### Non-delivery reports (NDRs) Email Routing does not forward non-delivery reports to the original sender. This means the sender will not receive a notification indicating that the email did not reach the intended destination. ### Restrictive DMARC policies can make forwarded emails fail Due to the nature of email forwarding, restrictive DMARC policies might make forwarded emails fail to be delivered. Refer to [dmarc.org](https://dmarc.org/wiki/FAQ#My_users_often_forward_their_emails_to_another_mailbox.2C_how_do_I_keep_DMARC_valid.3F) for more information. ### Sending or replying to an email from your Cloudflare domain Email Routing does not support sending or replying from your Cloudflare domain. When you reply to emails forwarded by Email Routing, the reply will be sent from your destination address (like `my-name@gmail.com`), not your custom address (like `info@my-company.com`). ### Signs such "`+`" and "`.`" are treated as normal characters for custom addresses Email Routing does not have advanced routing options. Characters such as `+` or `.`, which perform special actions in email providers like Gmail and Outlook, are currently treated as normal characters on custom addresses. More flexible routing options are in our roadmap. --- # Glossary URL: https://developers.cloudflare.com/email-security/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Email Security (formerly Area 1) documentation. --- # Overview URL: https://developers.cloudflare.com/email-security/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, Render } from "~/components" Stop phishing attacks with Email Security (formerly Area 1) cloud-native email security service. :::caution[Area 1 has been renamed] Area 1 is now **Email Security (formerly Area 1)**. Customers who purchased the new Email Security can access the documentation by going to Cloudflare Zero Trust > [Email Security](/cloudflare-one/email-security/). ::: *** ## Features Email Security (formerly Area 1) provides two architectures to protect your organization: inline or API setup. Inline architecture evaluates email messages before they reach a user's inbox. API architecture evaluates emails when they have already reached a user's inbox. In addition to standard logins, Email Security (formerly Area 1) offers support for SAML based single sign-on (SSO) logins to your dashboard. Attackers often try to impersonate executives within an organization when sending malicious emails. The Business email compromise (BEC) feature protects against these attacks. *** ## Related products Cloudflare Zero Trust replaces legacy security perimeters with Cloudflare's global network, making the Internet faster and safer for teams around the world. Email Routing simplifies the way you create and manage custom email addresses. Email Security (formerly Area 1) helps secure your mail infrastructure from phishing attacks. Stop brand impersonation. Track and manage every source that is sending emails from your domain. *** ## More resources Email Security (formerly Area 1) is available as a standalone product purchase. --- # Migrate to Email Security URL: https://developers.cloudflare.com/email-security/migrate-to-email-security/ This page aims at showing you how to perform Area 1 actions in [Zero Trust Email Security](/cloudflare-one/email-security/), and new terminology introduced in Email Security. :::note Your Area 1 data and configuration settings are available in Email Security. ::: ## Invite users In Area 1, you [invite users](/email-security/account-setup/manage-account-members/#add-user) by logging in to the Area 1 portal and inviting members. To invite users in Zero Trust Email Security: 1. Log in to [Zero Trust](https://one.dash.cloudflare.com/). 2. Go to **Manage Account**. 3. Select **Members** > **Invite** > [Add account members](/fundamentals/manage-members/manage/#add-account-members). Once you have added new account members, you will have to assign each member an [Email Security role](/cloudflare-one/roles-permissions/#email-security-roles). | Area 1 | Email Security | Description | |---------------------|--------------------------------------------------------------------|--------------------------------------------------------------| | Super Admin | Email Security Analyst + Email Security Config Admin = Super Admin | Has full access to all products on Zero Trust Email Security | | Configuration Admin | Email Security Configuration Admin | Admin, cannot take actions on emails or see emails | | SOC Analyst | Email Security Analyst | Admin, can take actions on emails and see emails | | Viewer | Email Security Reporting | Can see metrics | |N/A | Cloudflare Zero Trust PII | Can read PII in Zero Trust (this includes Email Security) ## Create webhooks In Area 1, you can [create alert webhooks](/email-security/email-configuration/domains-and-routing/alert-webhooks/#create-an-alert-webhook). In Zero Trust Email Security, webhooks are instead referred to as logs. You can enable [detection logs](/cloudflare-one/insights/logs/enable-logs/#enable-detection-logs) and/or [user action logs](/cloudflare-one/insights/logs/enable-logs/#enable-user-action-logs). Additionally, you can enable [Outbound Data Loss Prevention](/cloudflare-one/email-security/outbound-dlp/) to protect sensitive information in outbound emails. ## Set up system alerts In Area 1, you can view [statistics](/email-security/reporting/statistics-overview/) of your account in the Home section. In Email Security, you can: - Go to [Cloudflare System Status](https://www.cloudflarestatus.com/) to view system status for the Cloudflare service. - Go to [Cloudflare Status API](https://www.cloudflarestatus.com/api) to view status information for the API documentation and functionality. - Configure [Cloudflare Notifications](/notifications/get-started/). ## Contact support In Area 1, you can reach out to support via the following email addresses: - support@area1security.com - phishguard@area1security.com (for PhishGuard customers only) In Email Security, you can: - Go to the [Cloudflare Help Center](https://www.support.cloudflare.com/s/?language=en_US) - [Contact Cloudflare Support](/support/contacting-cloudflare-support/) - [Raise a ticket](/support/contacting-cloudflare-support/#getting-help-with-an-issue) and enter the correct answer to the following questions: - What type of question do you have? **Technical - Other Products** - In what area can we help you? **Email Security** - Email phishguard@area1security.com (for PhishGuard customers only). ## Search emails In Area 1, you can perform two types of search: [Fielded Search](/email-security/reporting/search/#fielded-search) and [Freeform Search](/email-security/reporting/search/#freeform-search). In Email Security, the ability to search emails has been expanded. You can use three different [screen criteria](/cloudflare-one/email-security/email-monitoring/search-email/#screen-criteria) to search emails: - [Advanced screen](/cloudflare-one/email-security/email-monitoring/search-email/#advanced-screen) - [Regular screen](/cloudflare-one/email-security/email-monitoring/search-email/#regular-screen) - [Popular screen](/cloudflare-one/email-security/email-monitoring/search-email/#popular-screen) ## Check metrics In Area 1, you can check [statistics](/email-security/reporting/statistics-overview/) in your Home section. In Email Security, you can check your metrics in the [Monitoring](/cloudflare-one/email-security/email-monitoring/) section in the dashboard. ## Move messages to a specific folder Area 1 allows you to set up [message retraction](/email-security/email-configuration/retract-settings/) to move messages to specific folders. This is known as **retraction**. Moving messages to a specific folder is known as [auto-moves](/cloudflare-one/email-security/auto-moves/) in Zero Trust Email Security. ## Create policies This table displays the difference in terminology used when creating policies: | Area 1 | Email Security | |-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | [Allowed patterns](/email-security/email-configuration/lists/allowed-patterns/) | [Allow policies](/cloudflare-one/email-security/detection-settings/allow-policies/) | | [Block lists](/email-security/email-configuration/lists/block-list/) | [Blocked senders](/cloudflare-one/email-security/detection-settings/blocked-senders/) | | [Trusted domains](/email-security/email-configuration/lists/trusted-domains/) | [Trusted domains](/cloudflare-one/email-security/detection-settings/trusted-domains/) | | [Text add-ons](/email-security/email-configuration/email-policies/text-addons/) | [Text add-ons](/cloudflare-one/email-security/detection-settings/configure-text-add-ons/) | | [Link actions](/email-security/email-configuration/email-policies/link-actions/) | [Link actions](/cloudflare-one/email-security/detection-settings/configure-link-actions/) | | [Added detections](/email-security/email-configuration/enhanced-detections/added-detections/) | [Additional detections](/cloudflare-one/email-security/detection-settings/additional-detections/) | ## Reclassifications This table displays the difference in terminology used when finding emails whose disposition is incorrect: | Area 1 | Email Security | |--|--| | Report [false negative](/email-security/email-configuration/phish-submissions/#false-negatives)/[false positive](/email-security/email-configuration/phish-submissions/#false-positives) | [ Reclassify messages ](/cloudflare-one/email-security/email-monitoring/search-email/#reclassify-messages) | | N/A | Escalate user submissions | | [Team submission](/email-security/email-configuration/phish-submissions/#how-to-submit-phish) | [Team submissions](/cloudflare-one/email-security/email-monitoring/search-email/#team-submissions) | | [User submission](/email-security/email-configuration/phish-submissions/#how-to-submit-phish) | [User submissions](/cloudflare-one/email-security/email-monitoring/search-email/#user-submissions) | ## Business Email Compromise In Area 1, you can set up a [Business email compromise (BEC)](/email-security/email-configuration/enhanced-detections/business-email-compromise/) list to protect against attackers who try to impersonate executives. In Email Security, this feature is known as [impersonation registry](/cloudflare-one/email-security/detection-settings/impersonation-registry/). ## Synchronize directories In Area 1, you can [integrate directories](/email-security/email-configuration/enhanced-detections/business-email-compromise/#integrating-a-directory) in your email provider. In Email Security, you can add and sync [directories](/cloudflare-one/email-security/directories/). --- # Channel and Alliance Partners URL: https://developers.cloudflare.com/email-security/partners/ import { GlossaryTooltip, Render } from "~/components" :::caution[Area 1 has been renamed] ::: Email Security Channel and Alliance partners have the option to set up accounts for themselves and their customers. ## Create accounts Start by creating parent and child accounts. ### Create a parent account Parent accounts are treated as containers with no services provisioned. User accounts created at the parent level will allow them to access any child account. :::note This is only required for administrators that manage multiple accounts. For example, Managed Security Service Providers (MSSP) managing multiple customer accounts. ::: 1. Log in to the [Email Security dashboard](https://horizon.area1security.com/). 2. Go to **Settings** (the gear icon). 3. In **Delegated Accounts** > **Accounts**, select **Create new customer**. 4. Enter their information, and make sure you select *Parent* in **Account Type**. 5. Select **Save**. Your newly created account should show up in the list. If not, refresh the page. ### Create a child account 1. Log in to the [Email Security dashboard](https://horizon.area1security.com/). 2. Go to **Settings** (the gear icon). 3. In **Delegated Accounts** > **Accounts**, select the parent account where you want to create a child account. 4. Select **Create New customer**. 5. Enter their information, and make sure you select *Advantage* in **Account Type**. 6. Scroll down to the **Email Traffic Related Information** section, and enter the information related to your email provider. The number to enter in **Loopback Hops** will depend on your email configuration and where Email Security is in the chain of events. Refer to [Inline deployment](/email-security/deployment/inline/) and [API deployment](/email-security/deployment/api/) for more information. 7. For **Daily Email Volume** and **Number of Email Users** make sure you enter the appropriate values for your organization. 8. Select **Save**. ## Create users and assign permissions You can create users at both the parent and child account level. Users created at parent level will have access to all its child accounts. Users created at child level will only have access to the assigned child account. Child accounts can [limit or disable](/email-security/account-setup/manage-parent-permissions/) the level of access allowed from their parent account. If you modify the Delegated Access controls, make sure you create an administrator account in the child first. To create an account at parent level or child level: ## Escalation contacts You should add escalation contacts so Email Security can send notifications regarding detection events and critical service related issues. Email Security highly recommends that these contacts have both phone and email contacts. Refer to [Escalation contacts](/email-security/account-setup/escalation-contacts/) for more information. ## Status alerts Subscribe to incident status alerts [from Email Security](https://status.area1security.com/). ## Domains setup (inline/API) Refer to the [setup options](/email-security/deployment/) for Email Security to learn about the best way of deploying Email Security in your organization. You can choose between two main setup architectures: * Inline deployment * API deployment With an [inline deployment](/email-security/deployment/inline/), Email Security evaluates email messages before they reach a user’s inbox. When you choose an [API deployment](/email-security/deployment/api/), email messages only reach Email Security after they have already reached a user’s inbox. ## Classification actions Email Security recommends that you quarantine `MALICIOUS` and `SPAM` dispositions. You can configure this directly in [Office 365](/email-security/deployment/inline/setup/office-365-area1-mx/) and [Gsuite](/email-security/deployment/inline/setup/gsuite-area1-mx/), as well as [Email Security](/email-security/email-configuration/domains-and-routing/domains/). ## Message retraction You can configure message retraction to take post-delivery actions against suspicious email messages. You can retract messages manually or automatically. Refer to [Retract settings](/email-security/email-configuration/retract-settings/) for more information. ## TLS enforcement for domains To add additional TLS requirements for emails coming from certain domains, you can enforce higher levels of SSL/TLS inspection. Refer to [Partner Domains TLS](/email-security/email-configuration/domains-and-routing/partner-domains-tls/) for more information. ## Reports You can subscribe to [daily and weekly email reports](https://horizon.area1security.com/settings/subscriptions/email-subscriptions), as well as SIEM events. For SIEM events, you will need to [configure your SIEM tool](/email-security/reporting/siem-integration/) into Email Security first. ## Whitelisting and blocklisting senders If you need to whitelist of blocklist senders, refer to [Allow and block lists](/email-security/email-configuration/lists/). ## Submitting false positives and false negatives There are several ways of dealing with missed phish or messages flagged as such that are not. Refer to [Phish submissions](/email-security/email-configuration/phish-submissions/) to learn more. ## Best practices Refer to the following pages to learn more: 1. [Business Email compromise (BEC)](/email-security/email-configuration/enhanced-detections/business-email-compromise/) 2. [Text add-ons](/email-security/email-configuration/email-policies/text-addons/) 3. [Search and reports](/email-security/reporting/) --- # Cloudflare Firewall Rules URL: https://developers.cloudflare.com/firewall/ import { FeatureTable, Render } from "~/components"; Cloudflare Firewall Rules allows you to create rules that inspect incoming traffic and block, challenge, log, or allow specific requests. ## Main features - **Rule-based protection**: Use pre-defined rulesets provided by Cloudflare, or define your own firewall rules. Create rules in the Cloudflare dashboard or via API. - **Complex custom rules**: Each rule's expression can reference multiple fields from all the available HTTP request parameters and fields, allowing you to create complex rules. ## Availability This table outlines the Firewall Rules features and entitlements available with each customer plan: ## Next steps - Unless you are already an advanced user, refer to [Expressions](/ruleset-engine/rules-language/expressions/) and [Actions](/firewall/cf-firewall-rules/actions/) to learn more about the basic elements of firewall rules. - To start building your own firewall rules, refer to one of the following pages: - [Manage firewall rules in the dashboard](/firewall/cf-dashboard/create-edit-delete-rules/) - [Manage firewall rules via the APIs](/firewall/api/) - You can also manage firewall rules through Terraform. For more information, refer to [Getting Started with Terraform](https://blog.cloudflare.com/getting-started-with-terraform-and-cloudflare-part-1/). ## Related resources - [Cloudflare Rules language](/ruleset-engine/rules-language/) --- # Google tag gateway for advertisers URL: https://developers.cloudflare.com/google-tag-gateway/ ## Get started Google tag gateway for advertisers allows website owners using Cloudflare as a CDN to get the most out of ad measurement tools with just a few clicks. Note: setting this up [directly in Google Tag Manager](https://support.google.com/analytics/answer/16061641) is the fastest way to use this feature. ### Configure Google tag gateway for advertisers in the dashboard :::note Your Cloudflare dashboard user must have one of the following [Account Roles](/fundamentals/manage-members/roles/#account-scoped-roles): Super Administrator, Administrator or Zaraz Admin. If you are using Domain Scoped Roles, your [Domain Role](/fundamentals/manage-members/roles/#domain-scoped-roles) must be Domain Administrator. ::: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account. 2. Go to **Tag Management** > **Google tag gateway**. 3. Select your domain. 4. Enable the toggle for **Turn on and configure Google tag gateway**. ![Google tag gateway for advertisers configuration](~/assets/images/google-tag-gateway/google-tag-configuration.png) 5. Add your Google tag ID and the path on your website reserved for the Google tag. The [Google tag ID](https://support.google.com/analytics/answer/9539598?hl=en) can be found in the Google Tag Experience dashboard. The measurement path is an unused path on your site that will load Google Tag Manager and all subsequent measurement requests. ![Add to ID and path](~/assets/images/google-tag-gateway/google-tag-id-path.png) 6. Once you click **Save**, Google tag gateway for advertisers will be enabled on your zone. If you already have a GTM script on your website, this First Party Tag will override the existing script. Now that you have authenticated into your Cloudflare account and configured GTM in first-party mode, your Google Tags will be loaded using `https://your-domain/measurement-path/...`and subsequent measurement requests will be served by Cloudflare. --- # Cloudflare Fundamentals URL: https://developers.cloudflare.com/fundamentals/ import { Render } from "~/components"; Before you get started, we recommend reviewing [Concepts](/fundamentals/concepts/) to learn about key concepts related to using different Cloudflare products. ## Additional resources --- # Get started URL: https://developers.cloudflare.com/health-checks/get-started/ This guide will get you started with creating and managing configured Health Checks. ## Create a Health Check 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account and domain. 2. Go to **Traffic** > **Health Checks**. 3. Select **Create** and fill out the form, paying special attention to: * The values for **Interval** and **Check regions**, because decreasing the **Interval** and increasing **Check regions** may increase the load on your origin server. * **Retries**, which specify the number of retries to attempt in case of a timeout before marking the origin as unhealthy. 4. Select **Save and Deploy**. ## Manage Health Checks 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and domain. 2. Go to **Traffic** > **Health Checks**. 3. Navigate to your health check and select **Edit**. 4. Edit your Health Check. 5. Select **Save**. :::note You can also enable, disable, or delete configured Health Checks. ::: :::note Authenticated origin pull is not supported by Standalone Health Checks. ::: --- # Health Checks Analytics URL: https://developers.cloudflare.com/health-checks/health-checks-analytics/ import { AvailableNotifications, Render } from "~/components" Once you have set up a standalone Health Check including notification emails, use Health Check Analytics to debug possible origin issues. To access health check analytics: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and domain. 2. Go to **Traffic** > **Health Check Analytics**. You can evaluate origin uptime, latency, failure reason, and specific event logs: * **Health Checks By Uptime**: Shows the percentage of uptime for individual origins over time. * **Health Checks By Failure Reason**: Shows a breakdown of failures by the specific reason. See [common error code causes and solutions below](/health-checks/health-checks-analytics/#common-error-codes). * **Health Checks By Latency**: Shows average latency – measured in round trip time — for individual origins over time. * **Event Log**: Shows individual health check data. * Select each record for additional details on **Round trip time**, the **Failure Reason**, the **Average Waterfall** (showing chronological data about request stages), **Response status code**, and more. * Note that **Global** is not a configured region; it represents the aggregated data from all enabled regions. ## Set up alerts You can configure alerts to notify you of any changes in your health check status. ## Common error codes ### TCP connection failed #### Cause Health Checks failed to establish a TCP connection to your origin server. #### Solution This typically occurs when there is a network failure between Cloudflare and your origin, and/or a firewall refuses to allow our connection. Ensure your network and firewall configurations are not interfering with traffic. ### HTTP timeout occurred #### Cause The origin failed to return an HTTP response within the timeout configured. This happens if you have the timeout set to a low number. For example, one to two seconds. #### Solution Cloudflare recommends increasing the HTTP response timeout to allow the origin server to respond. ### Response code mismatch error #### Cause Cloudflare receives an HTTP status code that does not match the values defined in the `expected_codes` property of your Health Check configuration. #### Solution Response codes must match the `expected_codes`. Confirm the values are correct by comparing the expected response codes and the status code received in the Event Log. #### ​​Alternate cause You may also see this issue if you have a Health Check configured to use HTTP connections and your origin server is redirecting to HTTPS. In this case, the response code will often be `301`, `302`, or `303`. #### Solution Change your Cloudflare Health Check configuration to use HTTPS or set the value of `follow_redirect` to `true` so that Cloudflare can resolve the correct status code. ### Response body mismatch error #### Cause The response body returns from your origin server and does not include the (case-insensitive) value of `expected_body` configured in your Health Check. :::note We only read the first 10 KB of the response. If you return a larger response, and the `expected_body` is not in the first 10 KB, the Health Check will fail. ::: #### Solution Ensure the `expected_body` is in the first 10 KB of the response body. ​​ ### TLS untrusted certificate error #### Cause The certificate is not trusted by a public Certificate Authority (CA). #### Solution If you’re using a self-signed certificate, Cloudflare recommends either using a publicly trusted certificate or setting the `allow_insecure` property on your Health Check to `true`. ### TLS name mismatch error #### Cause Our Health Check (client) was not able to match a name on the server certificate to the hostname of the request. #### Solution Inspect your Health Check configuration to confirm that the `header` value set in the Cloudflare Health Check is correct. ### TLS protocol error #### Cause This error can occur if you are using an older version of TLS or your origin server is not configured for HTTPS. #### Solution Ensure that your origin server supports TLS 1.2 or greater and is configured for HTTPS. ### TLS unrecognized name error #### Cause The server did not recognize the name provided by the client. When a host header is set, this is set as the ServerName in the initial TLS handshake. If it is not set, Cloudflare will not provide a ServerName, which can cause this error. #### Solution Set the host header in your Health Check object. ### ​​No route to host error #### Cause The IP address cannot be reached from Cloudflare’s network. Common causes are ISP or hosting provider network issues (e.g. BGP level), or that the IP does not exist. #### Solution Ensure IP is accurate, and check if there is an ISP or hosting provider network issue. ### TCP Timeout #### Cause Data transmission was not acknowledged and the retransmit of data did not succeed. #### Solution Confirm whether the SYN-ACK for the handshake takes place at your origin and contact [Cloudflare support](/support/contacting-cloudflare-support/). ### ​​Network Unreachable #### Cause Cloudflare cannot connect to the origin web server due to network unavailability. This is usually caused by a network issue or incorrect origin IP. #### Solution Check the IP entered for the origin in Cloudflare’s Health Checks configuration or the IP returned via DNS for the origin hostname. ### HTTP Invalid Response #### Cause Usually caused by an HTTP 502 error or bad gateway. #### Solution Ensure the origin web server responds to requests and that no applications have crashed or are under high load. ### DNS Unknown Host #### Cause The origin web server hostname does not exist. #### Solution Confirm the origin web server resolves to an IP address. ### Connection Reset by Peer #### Cause A network error occurred while the client received data from the origin web server. #### Solution Confirm whether the origin web server is experiencing a high amount of traffic or an error. ### Monitor Configuration Error #### Cause There was a configuration error in the Health Check and no checks were run against the origin. #### Solution Review your Health Check configuration to ensure it matches an expected request to your origin. ### ​​DNS Internal #### Cause The origin web server’s hostname resolves to an internal or restricted address. No checks are run against this origin. #### Solution Cloudflare does not allow use of an origin web server hostname that resolves to a Cloudflare IP. ### Other Failure #### Cause If the failure cannot be classified as any other type of failure mentioned above. #### Solution Contact [Cloudflare support](/support/contacting-cloudflare-support/). --- # Health Checks URL: https://developers.cloudflare.com/health-checks/ import { Feature, FeatureTable, GlossaryTooltip, RelatedProduct } from "~/components" Standalone Health Checks monitors an IP address or hostname for origin servers or applications and notifies you in near real-time if there happens to be a problem. A Health Check is a service that runs on Cloudflare’s edge network to monitor whether an origin server is online. This allows you to view the health of your origin servers even if there is only one origin or you do not yet need to balance traffic across your infrastructure. Standalone Health Checks support various configurations to hone in on what you can check, including response codes, protocol types, and intervals. You can specify a particular path if an origin server serves multiple applications or check a larger subset of response codes for your staging environment. All of these options allow you to properly target your Health Check, providing a precise picture of what is wrong with an origin server. :::note Standalone Health Checks are different from health monitors associated with load balancers. For more details about health monitors, refer to the [Load Balancing documentation](/load-balancing/monitors/). ::: *** ## Features You can use Health Checks Analytics to evaluate origin uptime, latency, failure reason, and specific event logs to debug possible origin issues. *** ## Related products Cloudflare Load Balancing distributes traffic across your endpoints, which reduces endpoint strain and latency and improves the experience for end users. *** ## Availability --- # Demos and architectures URL: https://developers.cloudflare.com/hyperdrive/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector } from "~/components" Learn how you can use Hyperdrive within your existing application and architecture. ## Demos Explore the following demo applications for Hyperdrive. ## Reference architectures Explore the following reference architectures that use Hyperdrive: --- # Getting started URL: https://developers.cloudflare.com/hyperdrive/get-started/ import { Render, PackageManagers, Tabs, TabItem } from "~/components"; Hyperdrive accelerates access to your existing databases from Cloudflare Workers, making even single-region databases feel globally distributed. By maintaining a connection pool to your database within Cloudflare's network, Hyperdrive reduces seven round-trips to your database before you can even send a query: the TCP handshake (1x), TLS negotiation (3x), and database authentication (3x). Hyperdrive understands the difference between read and write queries to your database, and caches the most common read queries, improving performance and reducing load on your origin database. This guide will instruct you through: - Creating your first Hyperdrive configuration. - Creating a [Cloudflare Worker](/workers/) and binding it to your Hyperdrive configuration. - Establishing a database connection from your Worker to a public database. :::note Hyperdrive currently works with PostgreSQL, MySQL and many compatible databases. This includes CockroachDB and Materialize (which are PostgreSQL-compatible), and Planetscale. Learn more about the [databases that Hyperdrive supports](/hyperdrive/reference/supported-databases-and-features). ::: ## Prerequisites Before you begin, ensure you have completed the following: 1. Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up/workers-and-pages) if you have not already. 2. Install [`Node.js`](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm). Use a Node version manager like [nvm](https://github.com/nvm-sh/nvm) or [Volta](https://volta.sh/) to avoid permission issues and change Node.js versions. [Wrangler](/workers/wrangler/install-and-update/) requires a Node version of `16.17.0` or later. 3. Have **a publicly accessible** PostgreSQL/MySQL (or compatible) database. ## 1. Log in Before creating your Hyperdrive binding, log in with your Cloudflare account by running: ```sh npx wrangler login ``` You will be directed to a web page asking you to log in to the Cloudflare dashboard. After you have logged in, you will be asked if Wrangler can make changes to your Cloudflare account. Scroll down and select **Allow** to continue. ## 2. Create a Worker :::note[New to Workers?] Refer to [How Workers works](/workers/reference/how-workers-works/) to learn about the Workers serverless execution model works. Go to the [Workers Get started guide](/workers/get-started/guide/) to set up your first Worker. ::: Create a new project named `hyperdrive-tutorial` by running: This will create a new `hyperdrive-tutorial` directory. Your new `hyperdrive-tutorial` directory will include: - A `"Hello World"` [Worker](/workers/get-started/guide/#3-write-code) at `src/index.ts`. - A [`wrangler.jsonc`](/workers/wrangler/configuration/) configuration file. `wrangler.jsonc` is how your `hyperdrive-tutorial` Worker will connect to Hyperdrive. ### Enable Node.js compatibility [Node.js compatibility](/workers/runtime-apis/nodejs/) is required for database drivers, and needs to be configured for your Workers project. ## 3. Connect Hyperdrive to a database Hyperdrive works by connecting to your database, pooling database connections globally, and speeding up your database access through Cloudflare's network. It will provide a secure connection string that is only accessible from your Worker which you can use to connect to your database through Hyperdrive. This means that you can use the Hyperdrive connection string with your existing drivers or ORM libraries without needing significant changes to your code. To create your first Hyperdrive database configuration, change into the directory you just created for your Workers project: ```sh cd hyperdrive-tutorial ``` To create your first Hyperdrive, you will need: - The IP address (or hostname) and port of your database. - The database username (for example, `hyperdrive-demo`). - The password associated with that username. - The name of the database you want Hyperdrive to connect to. For example, `postgres` or `mysql`. Hyperdrive accepts the combination of these parameters in the common connection string format used by database drivers: ```txt postgres://USERNAME:PASSWORD@HOSTNAME_OR_IP_ADDRESS:PORT/database_name ``` Most database providers will provide a connection string you can copy-and-paste directly into Hyperdrive. To create a Hyperdrive connection, run the `wrangler` command, replacing the placeholder values passed to the `--connection-string` flag with the values of your existing database: ```sh npx wrangler hyperdrive create --connection-string="postgres://user:password@HOSTNAME_OR_IP_ADDRESS:PORT/database_name" ``` ```txt mysql://USERNAME:PASSWORD@HOSTNAME_OR_IP_ADDRESS:PORT/database_name ``` Most database providers will provide a connection string you can copy-and-paste directly into Hyperdrive. To create a Hyperdrive connection, run the `wrangler` command, replacing the placeholder values passed to the `--connection-string` flag with the values of your existing database: ```sh npx wrangler hyperdrive create --connection-string="mysql://user:password@HOSTNAME_OR_IP_ADDRESS:PORT/database_name" ``` :::note[Manage caching] By default, Hyperdrive will cache query results. If you wish to disable caching, pass the flag `--caching-disabled`. Alternatively, you can use the `--max-age` flag to specify the maximum duration (in seconds) for which items should persist in the cache, before they are evicted. Default value is 60 seconds. Refer to [Hyperdrive Wrangler commands](/hyperdrive/reference/wrangler-commands/) for more information. ::: If successful, the command will output your new Hyperdrive configuration: ```json { "hyperdrive": [ { "binding": "HYPERDRIVE", "id": "" } ] } ``` Copy the `id` field: you will use this in the next step to make Hyperdrive accessible from your Worker script. :::note Hyperdrive will attempt to connect to your database with the provided credentials to verify they are correct before creating a configuration. If you encounter an error when attempting to connect, refer to Hyperdrive's [troubleshooting documentation](/hyperdrive/observability/troubleshooting/) to debug possible causes. ::: ## 4. Bind your Worker to Hyperdrive ## 5. Run a query against your database Once you have created a Hyperdrive configuration and bound it to your Worker, you can run a query against your database. ### Install a database driver To connect to your database, you will need a database driver which allows you to authenticate and query your database. For this tutorial, you will use [node-postgres (pg)](https://node-postgres.com/), one of the most widely used PostgreSQL drivers. To install `pg`, ensure you are in the `hyperdrive-tutorial` directory. Open your terminal and run the following command: If you are using TypeScript, you should also install the type definitions for `pg`: With the driver installed, you can now create a Worker script that queries your database. To connect to your database, you will need a database driver which allows you to authenticate and query your database. For this tutorial, you will use [mysql2](https://github.com/sidorares/node-mysql2), one of the most widely used MySQL drivers. To install `mysql2`, ensure you are in the `hyperdrive-tutorial` directory. Open your terminal and run the following command: With the driver installed, you can now create a Worker script that queries your database. ### Write a Worker After you have set up your database, you will run a SQL query from within your Worker. Go to your `hyperdrive-tutorial` Worker and open the `index.ts` file. The `index.ts` file is where you configure your Worker's interactions with Hyperdrive. Populate your `index.ts` file with the following code: ```typescript // pg 8.13.0 or later is recommended import { Client } from "pg"; export interface Env { // If you set another name in the Wrangler config file as the value for 'binding', // replace "HYPERDRIVE" with the variable name you defined. HYPERDRIVE: Hyperdrive; } export default { async fetch(request, env, ctx): Promise { // Create a client using the pg driver (or any supported driver, ORM or query builder) // with the Hyperdrive credentials. These credentials are only accessible from your Worker. const sql = new Client({ connectionString: env.HYPERDRIVE.connectionString, }); try { // Connect to the database await sql.connect(); // Sample query const results = await sql.query(`SELECT * FROM pg_tables`); // Clean up the client after the response is returned, before the Worker is killed ctx.waitUntil(sql.end()); // Return result rows as JSON return Response.json(results.rows); } catch (e) { console.error(e); return Response.json( { error: e instanceof Error ? e.message : e }, { status: 500 }, ); } }, } satisfies ExportedHandler; ``` Upon receiving a request, the code above does the following: 1. Creates a new database client configured to connect to your database via Hyperdrive, using the Hyperdrive connection string. 2. Initiates a query via `await sql.query()` that outputs all tables (user and system created) in the database (as an example query). 3. Returns the response as JSON to the client. After you have set up your database, you will run a SQL query from within your Worker. Go to your `hyperdrive-tutorial` Worker and open the `index.ts` file. The `index.ts` file is where you configure your Worker's interactions with Hyperdrive. Populate your `index.ts` file with the following code: ```typescript // mysql2 v3.13.0 or later is required import { createConnection } from 'mysql2/promise'; export interface Env { // If you set another name in the Wrangler config file as the value for 'binding', // replace "HYPERDRIVE" with the variable name you defined. HYPERDRIVE: Hyperdrive; } export default { async fetch(request, env, ctx): Promise { // Create a connection using the mysql2 driver (or any support driver, ORM or query builder) // with the Hyperdrive credentials. These credentials are only accessible from your Worker. const connection = await createConnection({ host: env.HYPERDRIVE.host, user: env.HYPERDRIVE.user, password: env.HYPERDRIVE.password, database: env.HYPERDRIVE.database, port: env.HYPERDRIVE.port // The following line is needed for mysql2 compatibility with Workers // mysql2 uses eval() to optimize result parsing for rows with > 100 columns // Configure mysql2 to use static parsing instead of eval() parsing with disableEval disableEval: true }); try{ // Sample query const [results, fields] = await connection.query( 'SHOW tables;' ); // Clean up the client after the response is returned, before the Worker is killed ctx.waitUntil(connection.end()); // Return result rows as JSON return new Response(JSON.stringify({ results, fields }), { headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*', }, }); } catch(e){ console.error(e); return Response.json( { error: e instanceof Error ? e.message : e }, { status: 500 }, ); } }, } satisfies ExportedHandler; ``` Upon receiving a request, the code above does the following: 1. Creates a new database client configured to connect to your database via Hyperdrive, using the Hyperdrive connection string. 2. Initiates a query via `await connection.query` that outputs all tables (user and system created) in the database (as an example query). 3. Returns the response as JSON to the client. ## 6. Deploy your Worker You can now deploy your Worker to make your project accessible on the Internet. To deploy your Worker, run: ```sh npx wrangler deploy # Outputs: https://hyperdrive-tutorial..workers.dev ``` You can now visit the URL for your newly created project to query your live database. For example, if the URL of your new Worker is `hyperdrive-tutorial..workers.dev`, accessing `https://hyperdrive-tutorial..workers.dev/` will send a request to your Worker that queries your database directly. By finishing this tutorial, you have created a Hyperdrive configuration, a Worker to access that database and deployed your project globally. ## Next steps - Learn more about [how Hyperdrive works](/hyperdrive/configuration/how-hyperdrive-works/). - How to [configure query caching](/hyperdrive/configuration/query-caching/). - [Troubleshooting common issues](/hyperdrive/observability/troubleshooting/) when connecting a database to Hyperdrive. If you have any feature requests or notice any bugs, share your feedback directly with the Cloudflare team by joining the [Cloudflare Developers community on Discord](https://discord.cloudflare.com). --- # Hyperdrive URL: https://developers.cloudflare.com/hyperdrive/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Tabs, TabItem, LinkButton, } from "~/components"; Turn your existing regional database into a globally distributed database. Hyperdrive is a service that accelerates queries you make to existing databases, making it faster to access your data from across the globe from [Cloudflare Workers](/workers/), irrespective of your users' location. Hyperdrive supports any Postgres or MySQL database, including those hosted on AWS, Google Cloud, Azure, Neon and Planetscale. Hyperdrive also supports Postgres-compatible databases like CockroachDB and Timescale. You do not need to write new code or replace your favorite tools: Hyperdrive works with your existing code and tools you use. Use Hyperdrive's connection string from your Cloudflare Workers application with your existing Postgres drivers and object-relational mapping (ORM) libraries: ```ts import postgres from 'postgres'; export default { async fetch(request, env, ctx): Promise { // Hyperdrive provides a unique generated connection string to connect to // your database via Hyperdrive that can be used with your existing tools const sql = postgres(env.HYPERDRIVE.connectionString); try { // Sample SQL query const results = await sql`SELECT * FROM pg_tables`; // Close the client after the response is returned ctx.waitUntil(sql.end()); return Response.json(results); } catch (e) { return Response.json({ error: e instanceof Error ? e.message : e }, { status: 500 }); } }, } satisfies ExportedHandler<{ HYPERDRIVE: Hyperdrive }>; ```` ```json { "$schema": "node_modules/wrangler/config-schema.json", "name": "WORKER-NAME", "main": "src/index.ts", "compatibility_date": "2025-02-04", "compatibility_flags": [ "nodejs_compat" ], "observability": { "enabled": true }, "hyperdrive": [ { "binding": "HYPERDRIVE", "id": "", "localConnectionString": "" } ] } ```` ```ts import { createConnection } from 'mysql2/promise'; export default { async fetch(request, env, ctx): Promise { const connection = await createConnection({ host: env.DB_HOST, user: env.DB_USER, password: env.DB_PASSWORD, database: env.DB_NAME, port: env.DB_PORT // This is needed to use mysql2 with Workers // This configures mysql2 to use static parsing instead of eval() parsing (not available on Workers) disableEval: true }); const [results, fields] = await connection.query( 'SHOW tables;' ); return new Response(JSON.stringify({ results, fields }), { headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '\*', }, }); }, } satisfies ExportedHandler; ```` ```json { "$schema": "node_modules/wrangler/config-schema.json", "name": "WORKER-NAME", "main": "src/index.ts", "compatibility_date": "2025-02-04", "compatibility_flags": [ "nodejs_compat" ], "observability": { "enabled": true }, "hyperdrive": [ { "binding": "HYPERDRIVE", "id": "", "localConnectionString": "" } ] } ```` Get started --- ## Features Connect Hyperdrive to your existing database and deploy a [Worker](/workers/) that queries it. Hyperdrive allows you to connect to any PostgreSQL or PostgreSQL-compatible database. Hyperdrive allows you to connect to any MySQL database. Default-on caching for your most popular queries executed against your database. --- ## Related products Build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. Deploy dynamic front-end applications in record time. --- ## More resources Learn about Hyperdrive's pricing. Learn about Hyperdrive limits. Learn more about the storage and database options you can build on with Workers. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Developer Platform. --- # Demos and architectures URL: https://developers.cloudflare.com/images/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector } from "~/components" Learn how you can use Images within your existing architecture. ## Demos Explore the following demo applications for Images. ## Reference architectures Explore the following reference architectures that use Images: --- # Getting started URL: https://developers.cloudflare.com/images/get-started/ In this guide, you will get started with Cloudflare Images and make your first API request. ## Prerequisites Before you make your first API request, ensure that you have a Cloudflare Account ID and an API token. Refer to [Find zone and account IDs](/fundamentals/account/find-account-and-zone-ids/) for help locating your Account ID and [Create an API token](/fundamentals/api/get-started/create-token/) to learn how to create an access your API token. ## Make your first API request ```bash curl --request POST \ --url https://api.cloudflare.com/client/v4/accounts//images/v1 \ --header 'Authorization: Bearer ' \ --header 'Content-Type: multipart/form-data' \ --form file=@./ ``` ## Enable transformations on your zone You can dynamically optimize images that are stored outside of Cloudflare Images and deliver them using [transformation URLs](/images/transform-images/transform-via-url/). Cloudflare will automatically cache every transformed image on our global network so that you store only the original image at your origin. To enable transformations on your zone: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account. 2. Go to **Images** > **Transformations**. 3. Go to the specific zone where you want to enable transformations. 4. Select **Enable for zone**. This will allow you to optimize and deliver remote images. :::note With **Resize images from any origin** unchecked, only the initial URL passed will be checked. Any redirect returned will be followed, including if it leaves the zone, and the resulting image will be transformed. ::: :::note If you are using transformations in a Worker, you need to include the appropriate logic in your Worker code to prevent resizing images from any origin. Unchecking this option in the dash does not apply to transformation requests coming from Cloudflare Workers. ::: --- # Cloudflare Images URL: https://developers.cloudflare.com/images/ import { CardGrid, Description, Feature, LinkTitleCard, Plan } from "~/components" Store, transform, optimize, and deliver images at scale Cloudflare Images provides an end-to-end solution designed to help you streamline your image infrastructure from a single API and runs on [Cloudflare's global network](https://www.cloudflare.com/network/). There are two different ways to use Images: - **Efficiently store and deliver images.** You can upload images into Cloudflare Images and dynamically deliver multiple variants of the same original image. - **Optimize images that are stored outside of Images** You can make transformation requests to optimize any publicly available image on the Internet. Cloudflare Images is available on both [Free and Paid plans](/images/pricing/). By default, all users have access to the Images Free plan, which includes limited usage of the transformations feature to optimize images in remote sources. :::note[Image Resizing is now available as transformations] All Image Resizing features are available as transformations with Images. Each unique transformation is billed only once per 30 days. If you are using a legacy plan with Image Resizing, visit the [dashboard](https://dash.cloudflare.com/) to switch to an Imagesplan. ::: *** ## Features Use Cloudflare’s edge network to store your images. Accept uploads directly and securely from your users by generating a one-time token. Add up to 100 variants to specify how images should be resized for various use cases. Control access to your images by using signed URL tokens. *** ## More resources Engage with other users and the Images team on Cloudflare support forum. --- # Pricing URL: https://developers.cloudflare.com/images/pricing/ By default, all users are on the Images Free plan. The Free plan includes access to the transformations feature, which lets you optimize images stored outside of Images, like in R2. The Paid plan allows transformations, as well as access to storage in Images. Pricing is dependent on which features you use. The table below shows which metrics are used for each use case. | Use case | Metrics | Availability | |----------|---------|--------------| | Optimize images stored outside of Images | Images Transformed | Free and Paid plans | | Optimized images that are stored in Cloudflare Images | Images Stored, Images Delivered | Only Paid plans | ## Images Free On the Free plan, you can request up to 5,000 unique transformations each month for free. Once you exceed 5,000 unique transformations: - Existing transformations in cache will continue to be served as expected. - New transformations will return a `9422` error. If your source image is from the same domain where the transformation is served, then you can use the [`onerror` parameter](/images/transform-images/transform-via-url/#onerror) to redirect to the original image. - You will not be charged for exceeding the limits in the Free plan. To request more than 5,000 unique transformations each month, you can purchase an Images Paid plan. ## Images Paid When you purchase an Images Paid plan, you can choose your own storage or add storage in Images. | Metric | Pricing | |--------|---------| | Images Transformed | First 5,000 unique transformations included + $0.50 / 1,000 unique transformations / month | | Images Stored | $5 / 100,000 images stored / month | | Images Delivered | $1 / 100,000 images delivered / month | If you optimize an image stored outside of Images, then you will be billed only for Images Transformed. Alternatively, Images Stored and Images Delivered apply only to images that are stored in your Images bucket. When you optimize an image that is stored in Images, then this counts toward Images Delivered — not Images Transformed. ## Metrics ### Images Transformed A unique transformation is a request to transform an original image based on a set of [supported parameters](/images/transform-images/transform-via-url/#options). This metric is used only when optimizing images that are stored outside of Images. For example, if you transform `thumbnail.jpg` as 100x100, then this counts as 1 unique transformation. If you transform the same `thumbnail.jpg` as 200x200, then this counts as a separate unique transformation. You are billed for the number of unique transformations that are counted during each billing period. Unique transformations are counted over a 30-day sliding window. For example, if you request `width=100/thumbnail.jpg` on June 30, then this counts once for that billing period. If you request the same transformation on July 1, then this will not count as a billable request, since the same transformation was already requested within the last 30 days. The `format` parameter counts as only 1 billable transformation, even if multiple copies of an image are served. In other words, if `width=100,format=auto/thumbnail.jpg` is served to some users as AVIF and to others as WebP, then this counts as 1 unique transformation instead of 2. #### Example A retail website has 1,000 original product images that get served in 5 different sizes each month. This results in 5,000 unique transformations — or a cost of $2.50 per month. ### Images Stored Storage in Images is available only with an Images Paid plan. You can purchase storage in increments of $5 for every 100,000 images stored per month. You can create predefined variants to specify how an image should be resized, such as `thumbnail` as 100x100 and `hero` as 1600x500. Only uploaded images count toward Images Stored; defining variants will not impact your storage limit. ### Images Delivered For images that are stored in Images, you will incur $1 for every 100,000 images delivered per month. This metric does not include transformed images that are stored in remote sources. Every image requested by the browser counts as 1 billable request. #### Example A retail website has a product page that uses Images to serve 10 images. If the page was visited 10,000 times this month, then this results in 100,000 images delivered — or $1.00 in billable usage. --- # Demos and architectures URL: https://developers.cloudflare.com/kv/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector } from "~/components" Learn how you can use KV within your existing application and architecture. ## Demo applications Explore the following demo applications for KV. ## Reference architectures Explore the following reference architectures that use KV: --- # Key Transparency Auditor URL: https://developers.cloudflare.com/key-transparency/ import { CardGrid, Description, Feature, LinkTitleCard, RelatedProduct } from "~/components" Secure the distribution of public keys in your end-to-end encrypted (E2EE) messaging systems Cloudflare's Key Transparency Auditor aims to secure the distribution of public keys for end-to-end encrypted (E2EE) messaging systems like [WhatsApp](https://engineering.fb.com/2023/04/13/security/whatsapp-key-transparency/). It achieves this by building a verifiable append-only data structure called a Log, similar to [Certificate Transparency](https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency). Cloudflare acts as an auditor of Key Transparency Logs to ensure the transparency of end-to-end encrypted messaging public keys. Cloudflare provides an API for anyone to monitor the verification work we perform, and verify the state of its associated Logs locally. ## Related products Certificate Transparency (CT) Monitoring is an opt-in feature in public beta that aims to improve security by allowing you to double-check any SSL/TLS certificates issued for your domain. Privacy Gateway is a managed service deployed on Cloudflare's global network that implements part of the [Oblivious HTTP (OHTTP) IETF](https://www.ietf.org/archive/id/draft-thomson-http-oblivious-01.html) standard. The goal of Privacy Gateway and Oblivious HTTP is to hide the client's IP address when interacting with an application backend. --- # Getting started URL: https://developers.cloudflare.com/kv/get-started/ import { Render, PackageManagers, Steps, FileTree, Details, Tabs, TabItem, WranglerConfig, GitHubCode } from "~/components"; Workers KV provides low-latency, high-throughput global storage to your [Cloudflare Workers](/workers/) applications. Workers KV is ideal for storing user configuration data, routing data, A/B testing configurations and authentication tokens, and is well suited for read-heavy workloads. This guide instructs you through: - Creating a KV namespace. - Writing key-value pairs to your KV namespace from a Cloudflare Worker. - Reading key-value pairs from a KV namespace. You can perform these tasks through the Wrangler CLI or through the Cloudflare dashboard. ## Quick start If you want to skip the setup steps and get started quickly, click on the button below. [![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/cloudflare/docs-examples/tree/update/kv/kv/kv-get-started) This creates a repository in your GitHub account and deploys the application to Cloudflare Workers. Use this option if you are familiar with Cloudflare Workers, and wish to skip the step-by-step guidance. You may wish to manually follow the steps if you are new to Cloudflare Workers. ## Prerequisites ## 1. Create a Worker project :::note[New to Workers?] Refer to [How Workers works](/workers/reference/how-workers-works/) to learn about the Workers serverless execution model works. Go to the [Workers Get started guide](/workers/get-started/guide/) to set up your first Worker. ::: Create a new Worker to read and write to your KV namespace. 1. Create a new project named `kv-tutorial` by running: This creates a new `kv-tutorial` directory, illustrated below. - kv-tutorial/ - node_modules/ - test/ - src - **index.ts** - package-lock.json - package.json - testconfig.json - vitest.config.mts - worker-configuration.d.ts - **wrangler.jsonc** Your new `kv-tutorial` directory includes: - A `"Hello World"` [Worker](/workers/get-started/guide/#3-write-code) in `index.ts`. - A [`wrangler.jsonc`](/workers/wrangler/configuration/) configuration file. `wrangler.jsonc` is how your `kv-tutorial` Worker accesses your kv database. 2. Change into the directory you just created for your Worker project: ```sh cd kv-tutorial ``` :::note If you are familiar with Cloudflare Workers, or initializing projects in a Continuous Integration (CI) environment, initialize a new project non-interactively by setting `CI=true` as an [environmental variable](/workers/configuration/environment-variables/) when running `create cloudflare@latest`. For example: `CI=true npm create cloudflare@latest kv-tutorial --type=simple --git --ts --deploy=false` creates a basic "Hello World" project ready to build on. ::: 1. Log in to your Cloudflare dashboard and select your account. 2. Go to [your account > **Workers & Pages** > **Overview**](https://dash.cloudflare.com/?to=/:account/workers-and-pages). 3. Select **Create**. 4. Select **Create Worker**. 5. Name your Worker. For this tutorial, name your Worker `kv-tutorial`. 6. Select **Deploy**. ## 2. Create a KV namespace A [KV namespace](/kv/concepts/kv-namespaces/) is a key-value database replicated to Cloudflare's global network. You can use [Wrangler](/workers/wrangler/) to create a new KV namespace. You can also use it to perform operations such as put, list, get, and delete within your KV namespace. :::note KV operations are scoped to your account. ::: To create a KV namespace via Wrangler: 1. Open your terminal and run the following command: ```sh npx wrangler kv namespace create ``` The `npx wrangler kv namespace create ` subcommand takes a new binding name as its argument. A KV namespace is created using a concatenation of your Worker's name (from your Wrangler file) and the binding name you provide. A `` is randomly generated for you. For this tutorial, use the binding name `USERS_NOTIFICATION_CONFIG`. ```sh ins="USERS_NOTIFICATION_CONFIG" npx wrangler kv namespace create USERS_NOTIFICATION_CONFIG ``` ```sh output 🌀 Creating namespace with title "USERS_NOTIFICATION_CONFIG" ✨ Success! Add the following to your configuration file in your kv_namespaces array: { "kv_namespaces": [ { "binding": "USERS_NOTIFICATION_CONFIG", "id": "" } ] } ``` 1. Go to [**Storage & Databases** > **KV**](https://dash.cloudflare.com/?to=/:account/workers/kv/namespaces). 2. Select **Create a namespace**. 3. Enter a name for your namespace. For this tutorial, use `kv_tutorial_namespace`. 4. Select **Add**. ## 3. Bind your Worker to your KV namespace You must create a binding to connect your Worker with your KV namespace. [Bindings](/workers/runtime-apis/bindings/) allow your Workers to access resources, like KV, on the Cloudflare developer platform. :::note[Bindings] A binding is how your Worker interacts with external resources such as [KV namespaces](/kv/concepts/kv-namespaces/). A binding is a runtime variable that the Workers runtime provides to your code. You can declare a variable name in your Wrangler file that binds to these resources at runtime, and interact with them through this variable. Every binding's variable name and behavior is determined by you when deploying the Worker. Refer to [Environment](/kv/reference/environments/) for more information. ::: To bind your KV namespace to your Worker: 1. In your Wrangler file, add the following with the values generated in your terminal from [step 2](/kv/get-started/#2-create-a-kv-namespace): ```toml [[kv_namespaces]] binding = "USERS_NOTIFICATION_CONFIG" id = "" ``` Binding names do not need to correspond to the namespace you created. Binding names are only a reference. Specifically: - The value (string) you set for `binding` is used to reference this KV namespace in your Worker. For this tutorial, this should be `USERS_NOTIFICATION_CONFIG`. - The binding must be [a valid JavaScript variable name](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Grammar_and_types#variables). For example, `binding = "MY_KV"` or `binding = "routingConfig"` would both be valid names for the binding. - Your binding is available in your Worker at `env.` from within your Worker. For this tutorial, the binding is available at `env.USERS_NOTIFICATION_CONFIG`. 1. Go to [**Workers & Pages** > **Overview**](https://dash.cloudflare.com/?to=/:account/workers-and-pages). 2. Select the `kv-tutorial` Worker you created in [step 1](/kv/get-started/#1-create-a-worker-project). 3. Select **Settings**. 4. Scroll to **Bindings**, then select **Add**. 5. Select **KV namespace**. 6. Name your binding (`BINDING_NAME`) in **Variable name**, then select the KV namespace (`kv_tutorial_namespace`) you created in [step 2](/kv/get-started/#2-create-a-kv-namespace) from the dropdown menu. 7. Select **Deploy** to deploy your binding. ## 4. Interact with your KV namespace You can interact with your KV namespace via [Wrangler](/workers/wrangler/install-and-update/) or directly from your [Workers](/workers/) application. ### 4.1. Write a value To write a value to your empty KV namespace using Wrangler: 1. Run the `wrangler kv key put` subcommand in your terminal, and input your key and value respectively. `` and `` are values of your choice. ```sh npx wrangler kv key put --binding= "" "" ``` In this tutorial, you will add a key `user_1` with value `enabled` to the KV namespace you created in [step 2](/kv/get-started/#2-create-a-kv-namespace). ```sh npx wrangler kv key put --binding=USERS_NOTIFICATION_CONFIG "user_1" "enabled" ``` ```sh output Writing the value "enabled" to key "user_1" on namespace . ``` :::note[Using `--namespace-id`] Instead of using `--binding`, you can also use `--namespace-id` to specify which KV namespace should receive the operation: ```sh "--namespace-id=" npx wrangler kv key put --namespace-id= "" "" ``` ```sh output Writing the value "" to key "" on namespace . ``` ::: :::note[Storing values in remote KV namespace] By default, the values are written locally. To create a key and a value in your remote KV namespace, add the `--remote` flag at the end of the command: ```sh ins="--remote" npx wrangler kv key put --namespace-id=xxxxxxxxxxxxxxxx "" "" --remote ``` ::: 1. Go to [**Storage & Databases** > **KV**](https://dash.cloudflare.com/?to=/:account/workers/kv/namespaces). 2. Select the KV namespace you created (`kv_tutorial_namespace`), then select **View**. 3. Select **KV Pairs**. 4. Enter a `` of your choice. 5. Enter a `` of your choice. 6. Select **Add entry**. ### 4.2. Get a value To access the value from your KV namespace using Wrangler: 1. Run the `wrangler kv key get` subcommand in your terminal, and input your key value: ```sh npx wrangler kv key get --binding= "" ``` In this tutorial, you will get the value of the key `user_1` from the KV namespace you created in [step 2](/kv/get-started/#2-create-a-kv-namespace). :::note To view the value directly within the terminal, you use the `--text` flag. ::: ```sh npx wrangler kv key get --binding=USERS_NOTIFICATION_CONFIG "user_1" --text ``` Similar to the `put` command, the `get` command can also be used to access a KV namespace in two ways - with `--binding` or `--namespace-id`: :::caution Exactly **one** of `--binding` or `--namespace-id` is required. ::: Refer to the [`kv bulk` documentation](/kv/reference/kv-commands/#kv-bulk) to write a file of multiple key-value pairs to a given KV namespace. You can view key-value pairs directly from the dashboard. 1. Go to your account > **Storage & Databases** > **KV**. 2. Go to the KV namespace you created (`kv_tutorial_namespace`), then select **View**. 3. Select **KV Pairs**. ## 5. Access your KV namespace from your Worker :::note When using [`wrangler dev`](/workers/wrangler/commands/#dev) to develop locally, Wrangler defaults to using a local version of KV to avoid interfering with any of your live production data in KV. This means that reading keys that you have not written locally returns null. To have `wrangler dev` connect to your Workers KV namespace running on Cloudflare's global network, call `wrangler dev --remote` instead. This uses the `preview_id` of the KV binding configuration in the Wrangler file. Refer to the [KV binding docs](/kv/concepts/kv-bindings/#use-kv-bindings-when-developing-locally) for more information. ::: 1. In your Worker script, add your KV binding in the `Env` interface. If you have bootstrapped your project with JavaScript, this step is not required. ```ts interface Env { USERS_NOTIFICATION_CONFIG: KVNamespace; // ... other binding types } ``` 2. Use the `put()` method on `USERS_NOTIFICATION_CONFIG` to create a new key-value pair. You will add a new key `user_2` with value `disabled` to your KV namespace. ```ts let value = await env.USERS_NOTIFICATION_CONFIG.put("user_2", "disabled"); ``` 3. Use the KV `get()` method to fetch the data you stored in your KV namespace. You will fetch the value of the key `user_2` from your KV namespace. ```ts let value = await env.USERS_NOTIFICATION_CONFIG.get("user_2"); ``` Your Worker code should look like this: The code above: 1. Writes a key to your KV namespace using KV's `put()` method. 2. Reads the same key using KV's `get()` method. 3. Checks if the key is null, and returns a `404` response if it is. 4. If the key is not null, it returns the value of the key. 5. Uses JavaScript's [`try...catch`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Statements/try...catch) exception handling to catch potential errors. When writing or reading from any service, such as Workers KV or external APIs using `fetch()`, you should expect to handle exceptions explicitly. 1. Go to **Workers & Pages** > **Overview**. 2. Go to the `kv-tutorial` Worker you created. 3. Select **Edit Code**. 4. Clear the contents of the `workers.js` file, then paste the following code. The code above: 1. Writes a key to `BINDING_NAME` using KV's `put()` method. 2. Reads the same key using KV's `get()` method, and returns an error if the key is null (or in case the key is not set, or does not exist). 3. Uses JavaScript's [`try...catch`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch) exception handling to catch potential errors. When writing or reading from any service, such as Workers KV or external APIs using `fetch()`, you should expect to handle exceptions explicitly. The browser should simply return the `VALUE` corresponding to the `KEY` you have specified with the `get()` method. 2. Select **Save**. ## 6. Deploy your Worker Deploy your Worker to Cloudflare's global network. 1. Run the following command to deploy KV to Cloudflare's global network: ```sh npm run deploy ``` 2. Visit the URL for your newly created Workers KV application. For example, if the URL of your new Worker is `kv-tutorial..workers.dev`, accessing `https://kv-tutorial..workers.dev/` sends a request to your Worker that writes (and reads) from Workers KV. 1. Go to **Workers & Pages** > **Overview**. 2. Select your `kv-tutorial` Worker. 3. Select **Deployments**. 4. From the **Version History** table, select **Deploy version**. 5. From the **Deploy version** page, select **Deploy**. This deploys the latest version of the Worker code to production. ## Summary By finishing this tutorial, you have: 1. Created a KV namespace 2. Created a Worker that writes and reads from that namespace 3. Deployed your project globally. ## Next steps If you have any feature requests or notice any bugs, share your feedback directly with the Cloudflare team by joining the [Cloudflare Developers community on Discord](https://discord.cloudflare.com). - Learn more about the [KV API](/kv/api/). - Understand how to use [Environments](/kv/reference/environments/) with Workers KV. - Read the Wrangler [`kv` command documentation](/kv/reference/kv-commands/). --- # Glossary URL: https://developers.cloudflare.com/kv/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's KV documentation. --- # Cloudflare Workers KV URL: https://developers.cloudflare.com/kv/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Tabs, TabItem, LinkButton, } from "~/components"; Create a global, low-latency, key-value data storage. Workers KV is a data storage that allows you to store and retrieve data globally. With Workers KV, you can build dynamic and performant APIs and websites that support high read volumes with low latency. For example, you can use Workers KV for: - Caching API responses. - Storing user configurations / preferences. - Storing user authentication details. Access your Workers KV namespace from Cloudflare Workers using [Workers Bindings](/workers/runtime-apis/bindings/) or from your external application using the REST API: ```ts export default { async fetch(request, env, ctx): Promise { // write a key-value pair await env.KV.put('KEY', 'VALUE'); // read a key-value pair const value = await env.KV.get('KEY'); // list all key-value pairs const allKeys = await env.KV.list(); // delete a key-value pair await env.KV.delete('KEY'); // return a Workers response return new Response( JSON.stringify({ value: value, allKeys: allKeys, }), ); }, } satisfies ExportedHandler<{ KV: KVNamespace }>; ``` ```json { "$schema": "node_modules/wrangler/config-schema.json", "name": "", "main": "src/index.ts", "compatibility_date": "2025-02-04", "observability": { "enabled": true }, "kv_namespaces": [ { "binding": "KV", "id": "" } ] } ``` See the full [Workers KV binding API reference](/kv/api/read-key-value-pairs/). ``` curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/storage/kv/namespaces/$NAMESPACE_ID/values/$KEY_NAME \ -X PUT \ -H 'Content-Type: multipart/form-data' \ -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \ -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \ -d '{ "value": "Some Value" }' curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/storage/kv/namespaces/$NAMESPACE_ID/values/$KEY_NAME \ -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \ -H "X-Auth-Key: $CLOUDFLARE_API_KEY" ``` ```ts const client = new Cloudflare({ apiEmail: process.env['CLOUDFLARE_EMAIL'], // This is the default and can be omitted apiKey: process.env['CLOUDFLARE_API_KEY'], // This is the default and can be omitted }); const value = await client.kv.namespaces.values.update('', 'KEY', { account_id: '', value: 'VALUE', }); const value = await client.kv.namespaces.values.get('', 'KEY', { account_id: '', }); const value = await client.kv.namespaces.values.delete('', 'KEY', { account_id: '', }); // Automatically fetches more pages as needed. for await (const namespace of client.kv.namespaces.list({ account_id: '' })) { console.log(namespace.id); } ``` See the full Workers KV [REST API and SDK reference](/api/resources/kv/) for details on using REST API from external applications, with pre-generated SDK's for external TypeScript, Python, or Go applications. Get started --- ## Features Learn how Workers KV stores and retrieves data. The Workers command-line interface, Wrangler, allows you to [create](/workers/wrangler/commands/#init), [test](/workers/wrangler/commands/#dev), and [deploy](/workers/wrangler/commands/#publish) your Workers projects. Bindings allow your Workers to interact with resources on the Cloudflare developer platform, including [R2](/r2/), [Durable Objects](/durable-objects/), and [D1](/d1/). --- ## Related products Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. Cloudflare Durable Objects allows developers to access scalable compute and permanent, consistent storage. Built on SQLite, D1 is Cloudflare’s first queryable relational database. Create an entire database by importing data or defining your tables and writing your queries within a Worker or through the API. --- ### More resources Learn about KV limits. Learn about KV pricing. Ask questions, show off what you are building, and discuss the platform with other developers. Learn about product announcements, new tutorials, and what is new in Cloudflare Developer Platform. --- # Log Explorer API URL: https://developers.cloudflare.com/log-explorer/api/ Configuration and Log searches are also available via a public API. ## Authentication Log Explorer is available to users with the following permissions: - **Logs Edit**: users with Logs Edit permissions can enable datasets. - **Logs Read**: users with Logs Read permissions can run queries via the UI or API. Note that these permissions exist at the account and zone level and you need the appropriate permission level for the datasets you wish to query. Authentication with the API can be done via an API token or API key with an email. Refer to [Create API token](/fundamentals/api/get-started/create-token/) for further instructions. ## Query data Log Explorer includes a SQL API for submitting queries. For example, to find an HTTP request with a specific [Ray ID](/fundamentals/reference/cloudflare-ray-id/), use the following SQL query: ```bash curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/explorer/query/sql \ --header "Authorization: Bearer " \ --url-query query="SELECT clientRequestScheme, clientRequestHost, clientRequestMethod, edgeResponseStatus, clientRequestUserAgent FROM http_requests WHERE RayID = '806c30a3cec56817' LIMIT 1" ``` This command returns the following HTTP request details: ```json { "result": [ { "clientrequestscheme": "https", "clientrequesthost": "example.com", "clientrequestmethod": "GET", "clientrequestuseragent": "curl/7.88.1", "edgeresponsestatus": 200 } ], "success": true, "errors": [], "messages": [] } ``` As another example, you could find Cloudflare Access requests with selected columns from a specific timeframe by performing the following SQL query: ```bash curl https://api.cloudflare.com/client/v4/account/{account_id}/logs/explorer/query/sql \ --header "Authorization: Bearer " \ --url-query query="SELECT CreatedAt, AppDomain, AppUUID, Action, Allowed, Country, RayID, Email, IPAddress, UserUID FROM access_requests WHERE Date >= '2025-02-06' AND Date <= '2025-02-06' AND CreatedAt >= '2025-02-06T12:28:39Z' AND CreatedAt <= '2025-02-06T12:58:39Z'" ``` This command returns the following request details: ```json { "result": [ { "createdat": "2025-01-14T18:17:55Z", "appdomain": "example.com", "appuuid": "a66b4ab0-ccdf-4d60-a6d0-54a59a827d92", "action": "login", "allowed": true, "country": "us", "rayid": "90fbb07c0b316957", "email": "user@example.com", "ipaddress": "1.2.3.4", "useruid": "52859e81-711e-4de0-8b31-283336060e79" } ], "success": true, "errors": [], "messages": [] } ``` --- # Changelog URL: https://developers.cloudflare.com/log-explorer/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-11-21 **Import cloud resources for VMs and LBs** Cloud network discovery now includes cloud native virtual machine (VM) and load-balancer (LB) resources. ## 2024-11-21 **Export resource catalog** Customers can export their resource catalog including all discovered resource metadata to a downloadable JSON file, suitable for offline analysis. ## 2024-10-01 **Cost visibility for managed cloud configuration** Customers can now see the cloud provider list price of discovered network resources and will be informed of total cost and delta cost when deploying managed configuration. ## 2024-08-14 **GCP on-ramps** Magic Cloud Networking supports Google Cloud Platform. ## 2024-07-01 **Closed beta launch** The Magic Cloud Networking closed beta release is available, with the managed cloud on-ramps feature. --- # Get started URL: https://developers.cloudflare.com/magic-cloud-networking/get-started/ To get started with Magic Cloud Networking (beta) you need to give Cloudflare permission to interact with cloud providers on your behalf. You might have multiple provider accounts for the same cloud provider — for example, you might want Cloudflare to manage virtual private clouds (VPCs) belonging to two different AWS accounts. Once Cloudflare has the credentials required to access your cloud environments, Magic Cloud Networking will automatically begin discovering your cloud resources — like routing tables and virtual private networks. Discovered resources appear in your [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog). ## Set up Amazon AWS ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **AWS integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Amazon AWS. ### 2. Create IAM policy 1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered. Then, paste the following [JSON code](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html) in the JSON tab: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:AcceptTransitGatewayPeeringAttachment", "ec2:CreateTransitGatewayPeeringAttachment", "ec2:DeleteTransitGatewayPeeringAttachment", "ec2:DescribeRegions", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:RejectTransitGatewayPeeringAttachment", "ec2:GetManagedPrefixListEntries", "ec2:CreateManagedPrefixList", "ec2:ModifyManagedPrefixList", "ec2:DeleteManagedPrefixList", "ec2:CreateTransitGatewayPrefixListReference", "ec2:DeleteTransitGatewayPrefixListReference", "ec2:GetTransitGatewayPrefixListReferences", "ec2:ModifyTransitGatewayPrefixListReference" ], "Resource": "*" } ] } ``` ### 3. Authorize access to your AWS account 1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered. 2. Create an [AWS role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html) with the following settings: - **Trusted entity type**: Select **Custom trust policy**, and paste the custom trust policy returned by the Cloudflare dashboard. - **Permissions**: Add the IAM policy created in step 1, along with these AWS-managed policies: - `NetworkAdministrator` - `AmazonEC2ReadOnlyAccess` - `AmazonVPCReadOnlyAccess` - `IAMReadOnlyAccess` - **ARN**: Copy the ARN for your newly created user. :::note The trust policy may take several minutes to propagate to all regions. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect. ::: 3. Select **I authorize Cloudflare to access my AWS account.** 4. Select **Authorize**. The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Set up Microsoft Azure ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **Azure integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Microsoft Azure. ### 2. Authorize access to your Azure account :::caution Magic Cloud does not support personal Microsoft accounts. Please sign in using a work or school account that is part of an Azure Entra Tenant. ::: 1. Select **Create service principal**. You will be redirected to Microsoft's login page. 2. Enter your Azure credentials. If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 3. The next screen lists Cloudflare required permissions to access your account. Select **Accept**. 4. [Add a role assignment](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal). The purpose of this step is to give the app that you registered in step 1 permission to access your Azure Subscription. - In step 3 of the linked document, select the **Contributor** role from the **Privileged administrator roles** tab. - In step 4 of the linked document, search for `mcn-provider-integrations-bot-prod` when selecting members. 5. In **Provide account information**, enter the **Tenant ID** and **Subscription ID** you copied from step 4. 6. In **Verify account ownership**, [add the tags displayed in the Cloudflare dashboard](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources-portal). :::note The tags may take several minutes to propagate and become readable to Cloudflare. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect. ::: 7. Select **I authorize Cloudflare to access my AWS account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 8. Select **Authorize**. The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Set up Google Cloud ### 1. Create integration 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Integrations** and select **Connect integration**. 4. Select **Google integration**. 5. Give a descriptive name to your integration. Optionally, you can also add a description for it. 6. Select **Create integration**. 7. Select **Authorize access** to start the process of connecting your Cloudflare account to Google Cloud. ### 2. Authorize access to your Google account 1. Create a new [GCP service account](https://cloud.google.com/iam/docs/service-accounts-create) in your **Google account** > **GCP Console** > **IAM & Admin** > **Service Accounts**. 2. Grant the new service account these roles: - `Compute Network Admin` - `Compute Viewer` 3. Under **IAM & Admin** > **Service Accounts**, select the service account you just created, and navigate to the **Permissions** tab. 4. Grant the **Service Account Token Creator** role to our bot account to allow it to impersonate this service account. Learn how to grant a specific role [in Google's documentation](https://cloud.google.com/iam/docs/manage-access-service-accounts#grant-single-role): - `mcn-integrations-bot-prod@mcn-gcp-01.iam.gserviceaccount.com` 5. In the **service account email field**, enter the email account that you used to create the GCP service account. 6. In the **Project ID field**, enter the [project ID](https://support.google.com/googleapi/answer/7014113?hl=en) associated with your project. 7. [Add the label](https://cloud.google.com/resource-manager/docs/creating-managing-labels#create-labels) displayed on the dash to your project. 8. Select **I authorize Cloudflare to access my GCP account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges. 9. Select **Authorize**. You have successfully connected your cloud provider to Magic Cloud Networking. Cloud resources found by Magic Cloud Networking are available in the [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog). The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering. ## Next steps - [Set up Magic WAN](/magic-cloud-networking/cloud-on-ramps/) as an on-ramp to your cloud. - [Manage resources](/magic-cloud-networking/manage-resources/) found by Magic Cloud Networking. - [Edit](/magic-cloud-networking/manage-resources/#edit-cloud-integrations) cloud integrations. --- # Cloud on-ramps URL: https://developers.cloudflare.com/magic-cloud-networking/cloud-on-ramps/ import { Render } from "~/components" --- # Manage resources URL: https://developers.cloudflare.com/magic-cloud-networking/manage-resources/ ## Cloud resource catalog Your cloud environment is built from individual cloud resources, like virtual private clouds (VPCs), subnets, virtual machines (VMs), route tables, and routes. Magic Cloud Networking (beta) discovers all of your cloud resources and stores their configuration and status in the Cloud resource catalog, a read-only snapshot of your cloud environment. Discovery runs regularly in the background, keeping your catalog up to date as your environment changes. When Magic Cloud Networking creates or modifies configurations in the cloud provider - for example, to deploy a managed IPsec on-ramp for Magic WAN - the created resources will be labeled as **Managed** in the resource catalog. To browse the resources in your catalog: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Resource catalog**. 4. Select a resource to inspect its details. ## Edit Cloud integrations 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Select the integration you want to edit > **Edit**. 4. In **Credentials**, select **I would like to update my credentials**, and make the required changes to your credentials. 5. Select **Save** when you are finished. 6. (Optional) You can also select **Delete** to delete your cloud integration. ## Download cloud resource catalog You can download a JSON file containing metadata and configuration for all your cloud resources: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account. 2. Select **Manage Account** > **Cloud integrations**. 3. Go to **Resource catalog**. 4. Select **Download catalog**. After your browser finishes downloading the ZIP file, expand it to access the JSON with the information about your cloud resources. --- # Magic Cloud Networking (beta) URL: https://developers.cloudflare.com/magic-cloud-networking/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Automate resource discovery, and reduce management burden when connecting to your public cloud. Magic Cloud Networking (beta) simplifies the process of connecting to your public cloud infrastructure, like Amazon Web Services, Google Cloud Platform, or Azure. With Magic Cloud Networking you can automatically discover your cloud resources through Cloudflare's dashboard, and effortlessly combine your cloud networks with your office and data center networks. Magic Cloud Networking allows you to connect, accelerate, and manage your virtual private clouds securely through Cloudflare. Grow your multi-cloud network architecture in a consistent and scalable manner, centered on Cloudflare's connectivity cloud services. Magic Cloud Networking is currently in closed beta. If you would like to be among the first customers to try it out, [fill out this form](https://www.cloudflare.com/lp/cloud-networking/). Learn how to [get started](/magic-cloud-networking/get-started/). --- ## Features Discover your cloud resources like virtual private clouds (VPCs), subnets, virtual machines (VMs), route tables, and routes automatically, and easily set up your integrations. Automatically build VPN tunnels between cloud networks and Magic WAN. --- ## Related products Secure your network from incoming Internet traffic, and improve performance at Cloudflare scale. --- # Cloudflare Magic Firewall URL: https://developers.cloudflare.com/magic-firewall/ import { Description, Feature, GlossaryTooltip, Plan, RelatedProduct } from "~/components" Protect your cloud infrastructure or network offices with advanced, scalable firewall-as-a-service protection. Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, scalable protection. With Magic Firewall, you can apply filter rules on a variety of criteria, such as protocol and packet length, to filter unwanted traffic before it reaches your network. Magic Firewall uses Wireshark syntax, a domain-specific language (DSL) common in the networking world and the same syntax used across our other products. With this syntax, you can easily craft powerful rules to precisely allow or deny any traffic in or out of your network. Magic Firewall is available with the purchase of [Magic Transit](/magic-transit/) or [Magic WAN](/magic-wan/). *** ## Features Actively monitor for a wide range of known threat signatures in your traffic. *** ## Related products Secure your network from incoming Internet traffic, and improve performance at Cloudflare scale. Improve security and performance for your entire corporate networking, reducing cost and operation complexity. --- # Reference URL: https://developers.cloudflare.com/magic-cloud-networking/reference/ Refer to this page for details about how Cloudflare orchestrates VPN connectivity to your cloud networks. ## Cloud on-ramps ### AWS ![Diagram showing how Cloudflare creates on-ramps to AWS](~/assets/images/magic-cloud-networking/reference/aws.png) When using Magic Cloud Networking (beta) to automatically create on-ramps to your AWS account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will create a new customer-managed prefix list named **Magic WAN and Cloudflare Edge** populated with your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) prefixes and the IPv4 address ranges for Cloudflare's global network servers (the latter prefixes are necessary if you use any Cloudflare L7 processing features). You must create rules in your Network Security Groups (NSGs) allowing traffic to/from this prefix list in order to have connectivity with Magic WAN. (The prefix list will contain around 15 to 25 entries, which each count against the rules-per-security-group quota for NSGs in your AWS account.) - Cloudflare will create a Virtual Private Gateway and attach it to your Virtual Private Cloud (VPC). If an existing Virtual Private Gateway is already attached to the VPC, on-ramp creation will fail. - Cloudflare will enable route propagation from the Virtual Private Gateway into all route tables in your VPC. This will result in a route for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) targeting the gateway. - Cloudflare will add a route in Magic WAN for each IPv4 CIDR block in your VPC. ### Azure ![Diagram showing how Cloudflare creates on-ramps to AWS](~/assets/images/magic-cloud-networking/reference/azure.png) When using Magic Cloud Networking to automatically create on-ramps to your Azure account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will create a Virtual Network Gateway in your Virtual Network (VNet). Virtual Network Gateways in Azure require a subnet named `GatewaySubnet`. Cloudflare will create a `GatewaySubnet` if one does not already exist in your VNet. If there is not enough unused address space left in your VNet to create a `/27` subnet for the`GatewaySubnet`, or if a `GatewaySubnet` exists but does not have enough address space left for a Virtual Network Gateway, on-ramp creation will fail. - Cloudflare will enable gateway route propagation on all route tables in your VNet. This will result in a route for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) pointing to the gateway. If your VNet has other Virtual Network Gateways, their routes will also propagate to your route tables. If you delete the on-ramp, route propagation will not be disabled. - By default, Network Security Groups in Azure contain Allow rules for outbound/inbound traffic to/from the `VirtualNetwork` service tag, which includes Virtual Network Gateway address space (and therefore your Magic WAN Address Space). If you do not want all resources in your VNet to be accessible from Magic WAN, add the appropriate Deny rules to your Network Security Groups (NSGs). - Cloudflare will add a route in Magic WAN for each IPv4 address range in your VNet. ### GCP ![Diagram showing how Cloudflare creates on-ramps to GCP](~/assets/images/magic-cloud-networking/reference/gcp.png) When using Magic Cloud Networking to automatically create on-ramps to your Google Cloud Platform (GCP) account, you should be aware of the following configuration changes Cloudflare will make on your behalf: - Cloudflare will reserve a public Internet routable IP address from GCP. - Cloudflare will create a VPN Gateway and two VPN Tunnels in the region you specify. - Cloudflare will create routes for each prefix in your [Magic WAN Address Space](/magic-cloud-networking/cloud-on-ramps/#magic-wan-address-space) within your VPC pointing to the VPN Tunnels. - Cloudflare will add routes in Magic WAN for all subnet CIDR prefixes in your VPC. This includes all regions within the VPC. Traffic bound for a region other than the VPN Gateway's region will be subject to GCP's [Inter-region Pricing](https://cloud.google.com/vpc/network-pricing#inter-region-data-transfer). - Traffic sent to and from your VM instances through the VPN Tunnels is still subject to VPC firewall rules, and may [require further configuration](https://cloud.google.com/network-connectivity/docs/vpn/how-to/configuring-firewall-rules#firewall_rules). ## Supported resources Magic Cloud Networking discovers the following resource types. ### AWS - AWS Customer Gateway - AWS EC2 Managed Prefix List - AWS EC2 Transit Gateway - AWS EC2 Transit Gateway Prefix List - AWS EC2 Transit Gateway VPC Attachment - AWS Egress Only Internet Gateway - AWS Internet Gateway - AWS Instance - AWS Network Interface - AWS Route Table - AWS Route Table Association - AWS Security Group - AWS Subnet - AWS VPC - AWS VPC IPv4 CIDR Block Association - AWS VPC Security Group Egress Rule - AWS VPC Security Group Ingress Rule - AWS VPN Connection - AWS VPN Connection Route - AWS VPN Gateway ### Azure - Azure Application Security Group - Azure Load Balancer - Azure Load Balancer Backend Address Pool - Azure Load Balancer NAT Pool - Azure Load Balancer NAT Rule - Azure Load Balancer Rule - Azure Local Network Gateway - Azure Network Interface - Azure Network Interface Application Security Group Association - Azure Network Interface Backend Address Pool Association - Azure Network Interface Security Group Association - Azure Network Security Group - Azure Public IP - Azure Route - Azure Route Table - Azure Subnet - Azure Subnet Route Table Association - Azure Virtual Machine - Azure Virtual Machine Gateway Connection - Azure Virtual Network - Azure Virtual Network Gateway - Azure Virtual Network Gateway Connection ### GCP - Google Compute Address - Google Compute Forwarding Rule - Google Compute Global Address - Google Compute HA VPN Gateway - Google Compute Interconnect Attachment - Google Compute Network - Google Compute Network Firewall Policy - Google Compute Network Firewall Policy Rule - Google Compute Route - Google Compute Router - Google Compute Subnetwork - Google Compute VPN Gateway - Google Compute VPN Tunnel --- # Changelog URL: https://developers.cloudflare.com/magic-firewall/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-09-12 **New UI improvements** The dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page. ## 2024-08-16 **Magic Firewall Analytics Rule Log Enhancement** Customers who create a rule in a disabled mode will see the rule as **Log (rule disabled)**. --- # Plans URL: https://developers.cloudflare.com/magic-firewall/plans/ import { GlossaryTooltip } from "~/components" If you are a [Magic Transit](/magic-transit/) or [Magic WAN](/magic-wan/) user, you are automatically provided with a standard list of Magic Firewall features. For additional features available for purchase, refer to the list of advanced features below. ## Standard features * Filtering rules based on protocol, port, IP addresses, packet length, and bit field match. * Fast propagation of rule changes in less than a minute. * Single dashboard to manage firewall and network configuration. * Programmable API for automated deployment and management — compatible with infrastructure-as-code platforms like [Terraform](/terraform/). * Traffic analytics per rule in the dashboard and using the [GraphQL API](/analytics/graphql-api/). * Integration with [Magic WAN network-as-a-service](/magic-wan/). * Included DDoS protection with [Magic Transit](/magic-transit/). ## Advanced features All standard features are included with the purchase of the advanced features below: * Customizable IP lists. * Managed threat intelligence IP lists (Anonymizer, Botnet, Malware, Open Proxies, VPNs). * Geoblocking based on user location by country. * Block or allow packets based on Autonomous System Number (ASN). * Packet captures on demand for network troubleshooting. * [Protocol validation rules](/magic-firewall/about/protocol-validation-rules/) to inspect traffic validity and enforce a positive security model. * [Secure Web Gateway](/cloudflare-one/policies/gateway/) filtering for outbound Internet traffic (network and HTTP policies). The Secure Web Gateway supports all TCP and UDP ports, as well as traffic sourced from RFC. Gateway will proxy BYOIP traffic to egress via the default Cloudflare IPs or your assigned [dedicated egress IPs](/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips/). * Intrusion Detection System (IDS). --- # API URL: https://developers.cloudflare.com/magic-network-monitoring/api/ Use Magic Network Monitoring's API to configure your [account](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) and [rules](/api/resources/magic_network_monitoring/subresources/rules/methods/list/). ## Account configuration Refer to [account configuration](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) to: - Create, list, update, and delete Magic Network Monitoring configurations - List default sampling, router IPs, and rules for an account ## Rules configuration Refer to [rules configuration](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) to: - Create, list, update, and delete rules - Update advertisement for a rule --- # Cloud flow logs (beta) URL: https://developers.cloudflare.com/magic-network-monitoring/cloud-flow-logs/ Customers using Magic Network Monitoring can export virtual private cloud (VPC) flow logs from their cloud environment to Cloudflare's network. Cloudflare will then process these VPC flow logs and display analytics on your cloud traffic in the dashboard. Customers can also ingest data on their cloud traffic via our public GraphQL API which powers the cloud traffic analytics in the dashboard. Currently, Magic Network Monitoring only supports AWS VPC flow logs via AWS Firehose. AWS VPC flow logs can only be configured via Cloudflare's API for Magic Network Monitoring. To learn how to set up this feature, refer to [VPC flow log guide (beta)](/magic-network-monitoring/get-started/#vpc-flow-log-guide). --- # Changelog URL: https://developers.cloudflare.com/magic-network-monitoring/changelog/ import { ProductChangelog } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/magic-network-monitoring/faq/ Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. ## I am getting an "Invalid account settings request body: account name format contains illegal characters or is not supported" error when trying to create a rule. This probably means that your account name has unsupported characters. Make sure your account name does not have characters like, for example, `&`, `<`, `>`, `"`, `'`, ``` ` ```. Refer to [Account name](/fundamentals/account/create-account/#account-name) to learn how to change your account name. ## Can I send NetFlow/sFlow data to Cloudflare in a secure, encrypted way? Yes. Both enterprise and free customers can send encrypted network flow data to Cloudflare. Enterprise customers with Magic Transit or Magic WAN are able to send encrypted network flow data via an IPsec tunnel to Cloudflare's network. You can achieve this by: 1. Configuring your [NetFlow](/magic-network-monitoring/routers/netflow-ipfix-config/) or [sFlow](/magic-network-monitoring/routers/sflow-config/) data to be sent to Cloudflare's network for parsing. 2. Directing that network flow data to be sent over [Magic Transit IPsec tunnels](/magic-transit/how-to/configure-tunnels/) or [Magic WAN IPsec tunnels](/magic-wan/configuration/manually/how-to/configure-tunnels/) to Cloudflare's network. Cloudflare's network will then identify this traffic via the destination IP address/port, and direct the network flow traffic to Magic Network Monitoring for parsing. Free customers can route their network flow traffic through a device that is running the WARP client. Then, network flow traffic can be forwarded from the WARP enabled device to Cloudflare's network flow endpoints. You can learn more about this in the [Encrypt network flow data tutorial](/magic-network-monitoring/tutorials/encrypt-network-flow-data). ## I have Auto-Advertisement enabled and it was triggered by an attack. Do I have to turn Magic Transit off manually? Once Auto-Advertisement is activated for an IP prefix that is under attack, the IP prefix will continue to be advertised by Cloudflare even if the attack ends. You will then need to manually disable advertisement for that IP prefix. Refer to [Configure dynamic advertisement](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement) to learn how to withdraw your prefixes, and stop using Magic Transit. ## If Auto-Advertisement is enabled, and the threshold has been triggered, will the IP prefix show as advertised in the dashboard? Yes, the IP prefix will show as advertised under the [IP Prefixes tab](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement). ## Does Auto-advertisement also work with BGP-controlled advertisements? No. Auto-advertisement only works with API-controlled advertisement, not BGP-controlled advertisement. ## In the API, Magic Network Monitoring rules have a `bandwidth_threshold` data field. Does the value for this field refer to bytes transferred or current throughput? The threshold for a [Magic Network Monitoring (MNM) rule](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) has two values. The first value is `bandwidth_threshold`. This value is a measure of the total ingress throughput on a network at any given moment. The second value is `duration`. The `duration`value refers to the amount of time that `bandwidth_threshold` must be exceeded before an alert is sent to the customer. For example, you create a MNM rule with the following parameters: ```txt "bandwidth_threshold": 50000000 "duration": "1m0s" ``` With this rule, your network needs to receive a throughput greater than 50,000,000 bits per second (50 Gigabits per second or Gbps) for 60 seconds. If both of these conditions are met, then MNM will send you an alert. ## My router's public IP address is different from the IP address of my network flow `agent-ip`. I cannot change my network flow `agent-ip`, and I am not seeing my router's traffic in MNM analytics It is recommended that you set your router's public IP address and network flow `agent-ip` to the same value. However, if you are unable to do this, you can register both your router's public IP and your network flow `agent-ip` in the Magic Network Monitoring (MNM) [router configuration](/magic-network-monitoring/get-started/). This will prevent MNM from blocking network traffic received from any unknown IP addresses, and will show your router's network flow data underneath the router's `agent-ip`. ## What is Magic Network Monitoring's data retention policy for Netflow/sFlow received from customer's routers? Currently, all data received from a customer's router goes to our servers in the US. If you enable data sovereignty in Europe, you cannot currently use Magic Network Monitoring. GraphQL analytics is retained for 90 days for enterprise customers. For non-enterprise customers, data retention is seven days. Cloudflare also retains data for six hours in the US, for threshold crossing detection. --- # Get started URL: https://developers.cloudflare.com/magic-network-monitoring/get-started/ import { APIRequest, Badge, GlossaryTooltip } from "~/components"; Magic Network Monitoring includes an onboarding workflow that guides you step-by-step through the product configuration process. If you are unable to complete the configuration in one session, you can exit the workflow and resume it at any time. To begin using Magic Network Monitoring for network and/or cloud traffic visibility, complete the list of tasks below. - [NetFlow and sFlow guide](#netflow-and-sflow-guide) - [VPC flow log guide (beta)](#vpc-flow-log-guide) If you are an Enterprise customer, Cloudflare can significantly accelerate the onboarding timeline during active-attack scenarios. Enterprise customers that would like to use Magic Network Monitoring and Magic Transit On Demand together can begin by [configuring Magic Transit](/magic-transit/get-started/). ## NetFlow and sFlow guide ### 1. Verify NetFlow or sFlow capabilities Verify your routers are capable of exporting NetFlow or sFlow to an IP address on Cloudflare's network. Magic Network Monitoring supports NetFlow v5, NetFlow v9, IPFIX, and sFlow. Refer to [Supported routers](/magic-network-monitoring/routers/supported-routers) to view a list of supported routers. The list is not exhaustive. ### 2. Register your router with Cloudflare When you register your router with Cloudflare, your router links your NetFlow or sFlow data to your Cloudflare account. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. 3. In **Magic Network Monitoring Analytics**, select **Configure Magic Network Monitoring**. 4. Select the **Configure routers** tab. 5. (Optional) Under **IP Address**, enter your router's public IP address. 6. Under **Default router sampling rate**, enter a value for the sampling rate. The value should match the sampling rate of your NetFlow or sFlow configuration. 7. Select **Next**. ### 3. Configure your router Next, configure your router to send NetFlow/SFlow data to Cloudflare. For this step, you will also need to have your router's configuration menu open to input the values shown in the Cloudflare dashboard. Refer to the [NetFlow/IPFIX configuration](/magic-network-monitoring/routers/netflow-ipfix-config/) or the [sFlow configuration guide](/magic-network-monitoring/routers/sflow-config/) for more information. 1. From **Configure routers** in the dashboard, select either **NetFlow Configuration** or **sFlow configuration**. 2. Follow the configuration steps for the selected configuration type. 3. Enter the values shown in your router's configuration. 4. Select **Next**. ### 4. Check your router configuration After setting up your router, confirm the configuration was successfully set up. From the **Check routers** page on the dashboard, you can view the status of your routers. Keep in mind that router data takes five to ten minutes to be sent to Cloudflare. Refer to **Router status description** to confirm whether data is successfully being sent. When you are done with router configuration, select **Finish onboarding**. :::note This will only be visible during the onboarding process. When you are finished onboarding, this page will no longer be visible. ::: ### 5. Create rules Create rules to analyze data for a specific set of destinations or to implement thresholds. Refer to [Rules](/magic-network-monitoring/rules/) for more information. ## VPC flow log guide ### 1. Verify cloud flow log capabilities Verify that your AWS account is capable of exporting AWS VPC flow logs via AWS Firehose. Currently, Magic Network Monitoring only supports VPC flow log ingestion for AWS. ### 2. Set up AWS Firehose to export VPC flow logs to Cloudflare :::note AWS VPC flow logs can only be configured via the Cloudflare API for Magic Network Monitoring. There are no inputs in the dashboard for configuring AWS VPC flow logs. ::: 1. Create an authorization token via [Cloudflare's API for Magic Network Monitoring](/api/resources/magic_network_monitoring/subresources/vpc_flows/subresources/tokens/methods/create/). This authorization token allows Cloudflare to identify and verify the account sending VPC flow logs to our endpoint. 2. Set the `HTTP Headers - X-Amz-Firehose-Access-Key` in the stream configuration for the authorization token generated in the previous step. 3. Send your AWS Firehose VPC flow log stream towards `https://aws-flow-logs.cloudflare.com/`. 4. Select all of the AWS VPC flow log data fields that you want to send to Cloudflare. You should select the highest number AWS VPC flow log version that supports all the fields you want to export to Cloudflare (refer to [AWS flow log documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html) for more information). For example, if you need a version 8 field like `reject-reason`, you must export all fields from versions 1 through 8. Cloudflare supports all seven templates for AWS VPC Flow logs. ### 3. Verify your cloud traffic via analytics After setting up AWS Firehose to send VPC flow logs to Magic Network Monitoring, you can confirm that Cloudflare is receiving the logs as expected by searching for your cloud traffic data in the analytics page of the Magic Network Monitoring dashboard. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. The default view will be the analytics dashboard for Magic Network Monitoring. --- # Glossary URL: https://developers.cloudflare.com/magic-network-monitoring/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic Network Monitoring documentation. --- # Cloudflare Magic Network Monitoring URL: https://developers.cloudflare.com/magic-network-monitoring/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Improve your network and cloud traffic visibility. Customers with public IPs can also detect DDoS attacks based on their traffic flows. Magic Network Monitoring provides visibility into your network traffic and cloud traffic by analyzing network flow data sent from a customer's routers or cloud environment. Magic Network Monitoring supports NetFlow v5, NetFlow v9, IPFIX, and sFlow. In cloud environments, Magic Network Monitoring supports AWS VPC flow logs via AWS Firehose. Magic Network Monitoring is generally available to everyone with a Cloudflare account by default. You can log in to your Cloudflare dashboard, select your account, then go to **Analytics & Logs** > **Magic Monitoring** to get started. Everyone can use the [free version](/magic-network-monitoring/magic-network-monitoring-free/) of Magic Network Monitoring in a home network, network lab, or business to get end to end visibility across their network traffic. Potential enterprise customers are encouraged to use the free version to run a proof of concept. Enterprise customers can use Magic Network Monitoring with [Magic Transit on-demand](/magic-transit/on-demand/) to monitor their network, identify volumetric DDoS attacks, and activate Magic Transit on-demand to mitigate those attacks. Learn how to [get started](/magic-network-monitoring/get-started/). --- ## Features Create rules to configure the threshold for data flowing from your network. Magic Transit On Demand customers can use Magic Network Monitoring to enable DDoS mitigation when a DDoS attack is detected. Set up notifications to learn about an attack. --- ## Related products Mitigates L7, L4, and L3 DDoS attacks with Magic Network Monitoring with Magic Transit on-demand. Provides HTTP DDoS attack protection for zones onboarded to Cloudflare in addition to L3 and L4 DDoS attack protection. Connects your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. ## More resources Connect with the Magic Network Monitoring community on Discord to ask questions, and share feedback. --- # Free version URL: https://developers.cloudflare.com/magic-network-monitoring/magic-network-monitoring-free/ The free version of Magic Network Monitoring (MNM) is generally available to everyone with a Cloudflare account by default. All free customers are encouraged to join [Cloudflare's Discord server](https://discord.com/invite/cloudflaredev) to discuss the use cases, configuration, and troubleshooting of Magic Network Monitoring. Free customers are always welcome to provide product feedback and discuss feature requests. The product and engineering team that works on Magic Network Monitoring regularly engages with the Discord community. You can find the channel by joining the Cloudflare Developers Discord server. Then scroll down in the side bar navigation to the **Cloudflare One** category and select **magic-network-monitoring**. ## Access the free version of MNM The free version includes all the features of the enterprise version, but has network flow volume and configuration limitations. These limits are detailed below. 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account. 2. Go to **Analytics & Logs** > **Magic Monitoring**. 3. Complete the onboarding wizard to configure Magic Network Monitoring. Refer to [Get started](/magic-network-monitoring/get-started/) for more information. ## Limitations | Limitation Type | Value | | ------------------------------------ | ----- | | Number of registered routers | 10 | | Number of rules | 25 | | Network flows per second per account | 250 | --- # Magic Transit integration URL: https://developers.cloudflare.com/magic-network-monitoring/magic-transit-integration/ import { Render } from "~/components" --- # About URL: https://developers.cloudflare.com/magic-transit/about/ import { GlossaryTooltip } from "~/components" Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Magic Transit delivers its connectivity, security, and performance benefits by serving as the front door to your IP network. This means it accepts IP packets destined for your network, processes them, and then outputs them to your origin infrastructure. The Cloudflare network uses [Border Gateway Protocol (BGP)](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/) to announce your company's IP address space, extending your network presence globally, and anycast to ingest your traffic. Today, Cloudflare's anycast global network spans [hundreds of cities worldwide](https://www.cloudflare.com/network/). Once [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) hit Cloudflare's network, traffic is inspected for attacks, filtered, steered, accelerated, and sent onward to your origin. Magic Transit connects to your origin infrastructure using anycast Generic Routing Encapsulation (GRE) tunnels over the Internet or, with [Cloudflare Network Interconnect (CNI)](/network-interconnect/), via physical or virtual interconnect. Magic Transit users have two options for their implementation: ingress traffic or ingress and [egress traffic](/magic-transit/reference/egress/). Users with an egress implementation will need to set up policy-based routing (PBR) or ensure default routing on their end forwards traffic to Cloudflare via tunnels. ```mermaid flowchart LR accTitle: Magic Transit accDescr: Diagram showing how Magic Transit protects traffic on the customer's network. A(DDoS
attack) B[("Cloudflare global
anycast network
(DDoS protection +
network firewall)")] C[Customer
network] D((User)) E([BGP
announcement]) A --x B E --- B B-- Anycast
GRE tunnel ---C B-- Cloudflare
Network
Interconnect ---C C-- Egress via
Direct Server
Return --> D D -- Ingress --> B style A stroke: red,fill: red,color: white style B stroke: orange,fill: orange,color: black style C stroke: #ADD8E6,fill: #ADD8E6,color: black style D stroke: blue,fill: blue,color: white linkStyle 0 stroke-width:3px,stroke:red linkStyle 1 stroke-width:2px,stroke:orange linkStyle 2 stroke-width:2px,stroke:#ADD8E6 linkStyle 3 stroke-width:2px,stroke:gray linkStyle 4 stroke-width:3px,stroke:green ``` :::note Magic Transit is not yet supported on Cloudflare's China Network. ::: For detailed information on Magic Transit architecture, refer to the [Reference section](/magic-transit/reference/). --- # Alerts URL: https://developers.cloudflare.com/magic-transit/alerts/ import { AvailableNotifications, Render } from "~/components" You can configure alerts to receive notifications for changes in your network. --- # Cloudflare IPs URL: https://developers.cloudflare.com/magic-transit/cloudflare-ips/ import { Render } from "~/components" --- # Changelog URL: https://developers.cloudflare.com/magic-transit/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-10-01 **Early access testing for BGP on CNI 2.0 circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. --- # DDoS protection URL: https://developers.cloudflare.com/magic-transit/ddos/ Cloudflare DDoS protection automatically detects and mitigates Distributed Denial of Service (DDoS) attacks using its Autonomous Edge. Magic Transit customers have access to additional features, such as: - [Advanced TCP protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) (disabled by default) - [Advanced DNS protection (beta)](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) Refer to [Cloudflare DDoS documentation](/ddos-protection/) for more information. --- ## Execution order The execution order of the different mitigation systems for Magic Transit customers is the following: 1. [DDoS managed rulesets](/ddos-protection/managed-rulesets/) 2. [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) 3. [Advanced DNS Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) 4. [Magic Firewall](/magic-firewall/) --- # Get started URL: https://developers.cloudflare.com/magic-transit/get-started/ import { Render } from "~/components" --- # Glossary URL: https://developers.cloudflare.com/magic-transit/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic Transit documentation. --- # Cloudflare Magic Transit URL: https://developers.cloudflare.com/magic-transit/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Secure your network and improve performance at Cloudflare scale. Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. - **DDoS mitigation and protection**: Instead of relying on local infrastructure that can be overwhelmed by large DDoS attacks, Magic Transit uses the [global Cloudflare Network](https://www.cloudflare.com/network/) to ingest and mitigate attacks close to their source. - **Traffic acceleration**: Magic Transit takes advantage of the Cloudflare global network to reduce latency and ensure that requests always have a data center nearby. Learn more [about how Magic Transit works](/magic-transit/about/) and how to [get started](/magic-transit/get-started/). --- ## Features Magic Transit sends health check probes to monitor network status and the health of specific network components. Magic Transit steers traffic along tunnel routes based on priorities you define during the onboarding process. Use Cloudflare-owned IP addresses if you want to protect a smaller network and do not meet Magic Transit's `/24` prefix length requirements. Use BGP peering between your networks and Cloudflare to automate the process of adding or removing networks and subnets, and take advantage of failure detection and session recovery features. --- ## Related products Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, scalable protection. Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. Cloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised. With Bringing Your Own IPs (BYOIP), Cloudflare announces your IPs in all our locations. Use your IPs with Magic Transit, Spectrum, or CDN services. --- ## More resources Deep dive into the key architecture, functionalities, and network deployment options of Cloudflare Magic Transit. --- # Magic Network Monitoring URL: https://developers.cloudflare.com/magic-transit/magic-network-monitoring/ import { Render } from "~/components" --- # Network Interconnect (CNI) URL: https://developers.cloudflare.com/magic-transit/network-interconnect/ import { Render } from "~/components"; --- # Magic Transit on-demand URL: https://developers.cloudflare.com/magic-transit/on-demand/ Customers with access to the Magic Transit on-demand option can [configure prefix advertisement](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement) from the **IP Prefixes** page in their Cloudflare account home or via the [Cloudflare API](/api/resources/addressing/subresources/prefixes/subresources/advertisement_status/methods/edit/). A common workflow is to enable prefix advertisement during an attack so that you can take advantage of Cloudflare protection and then disable advertisement once the incident is resolved. Prefixes using BGP-controlled advertisements cannot be used in conjunction with dynamic advertisement (via dashboard/API). Please specify your preferred on-demand advertisement method during the prefix onboarding. To ensure smooth operation in general and simplify the advertisement process during an attack scenario, refer to [Dynamic advertisement: Best practices](/byoip/concepts/dynamic-advertisement/best-practices/). :::note Magic Transit on-demand cannot be used with Cloudflare leased IPs. ::: --- # Changelog URL: https://developers.cloudflare.com/magic-wan/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2025-02-14 **Sites feature available to all Magic WAN customers** All Magic WAN customers now have full access to the Magic WAN sites feature. Customers can configure a Magic WAN site either with or without a Magic WAN connector. ## 2024-12-17 **Magic WAN Connector configurable health checks** Health check rate on Magic WAN Connector IPsec tunnels are now configurable. ## 2024-12-17 **BGP support for Cloudflare Network Interconnect (CNI)** Magic WAN customers can now establish BGP peering over Direct CNI circuits. Customers can now dynamically exchange routes and path availability status between their router device and the Magic WAN table. ## 2024-12-12 **LAN Policy improvements for the Magic WAN Connector** Magic WAN Connector LAN Policy now supports unidirectional traffic flows and port-ranges. ## 2024-10-01 **Early access testing for BGP on CNI 2.0 circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. ## 2024-09-27 **Magic WAN Connector sends WARP client traffic to Internet** All Magic WAN Connectors now route WARP client traffic directly to the Internet, bypassing IPsec tunneling, to prevent double encapsulation of WARP traffic. ## 2024-07-17 **Updates to High Availability on the Magic WAN Connector** The High Availability feature on Magic WAN Connector now supports additional failover conditions, DHCP lease syncing, and staggered upgrades. ## 2024-06-23 **ICMP support for traffic sourced from private IPs** Magic WAN will now support ICMP traffic sourced from private IPs going to the Internet via Gateway. ## 2024-06-05 **Application based prioritization** The Magic WAN Connector can now prioritize traffic on a per-application basis. ## 2024-05-31 **WARP virtual IP addresses** Customers using Gateway to filter traffic to Magic WAN destinations will now see traffic from Cloudflare egressing with WARP virtual IP addresses (CGNAT range), rather than public Cloudflare IP addresses. This simplifies configuration and improves visibility for customers. ## 2024-01-23 **Network segmentation** You can define policies in your Connector to either allow traffic to flow between your LANs without it leaving your local premises or to forward it via the Cloudflare network where you can add additional security features. --- # Get started URL: https://developers.cloudflare.com/magic-wan/get-started/ import { GlossaryTooltip, Render } from "~/components"; Magic WAN allows you to achieve any-to-any connectivity across branch and retail sites and data centers, with Cloudflare connectivity cloud. ## Before you begin Magic WAN is an Enterprise-only product. [Contact Cloudflare](https://www.cloudflare.com/magic-wan/) to acquire Magic WAN. If you plan on using Magic WAN Connector to automatically onboard your locations to Cloudflare, you will need to purchase Magic WAN first. ## Set up method Magic WAN supports an automatic setup and a manual setup. The automatic setup through Magic WAN Connector is the preferred method. ### Automatic set up Setting up Magic WAN automatically is done through Magic WAN Connector, and is the preferred method. You can choose between the hardware version and the virtual version of the Magic WAN Connector. The virtual version can be installed on your own machines. If you plan on using Magic WAN Connector, you can skip the prerequisites below, and refer to [Configure with Connector](/magic-wan/configuration/connector/) for more information on how to continue. ### Manual set up Setting up Magic WAN manually is done through a combination of third-party devices in your premises and the Cloudflare dashboard. To be successful, you need to: 1. Read the [Prerequisites](#prerequisites) below. 2. Follow the steps in [Manual configuration](/magic-wan/configuration/manually/how-to/configure-tunnels/). ## Prerequisites :::note The list of prerequisites below is only for customers planning to connect manually to Cloudflare with a third-party device. If you plan on using Magic WAN Connector, skip this section and refer to [Configure with Connector](/magic-wan/configuration/connector/). ::: ### Use compatible tunnel endpoint routers Magic WAN relies on GRE and IPsec tunnels to transmit [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) from Cloudflare's global network to your origin network. To ensure compatibility with Magic WAN, the routers at your tunnel endpoints must: - Allow configuration of at least one tunnel per Internet service provider (ISP). - Support maximum segment size (MSS) clamping. - Support the configuration parameters for IPsec mentioned in [IPsec tunnels](/magic-wan/reference/tunnels/#supported-configuration-parameters). ### Set maximum segment size #### MSS clamping recommendations ##### GRE tunnels as off-ramp ##### IPsec tunnels :::caution[Important] Refer to your device documentation to check if it sets IPsec MSS clamping automatically. If that is not the case and you are using IPsec inside GRE, you have to set MSS clamp manually. ::: Refer to [Maximum transmission unit and maximum segment size](/magic-wan/reference/mtu-mss/) for more details. ### Follow router vendor guidelines --- # Glossary URL: https://developers.cloudflare.com/magic-wan/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Magic WAN documentation. --- # Cloudflare Magic WAN URL: https://developers.cloudflare.com/magic-wan/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Improve security and performance for your entire corporate networking, reducing cost and operation complexity. Magic WAN provides secure, performant connectivity and [routing](https://www.cloudflare.com/learning/network-layer/what-is-routing/) for your entire corporate networking, reducing cost and operation complexity. [Magic Firewall](/magic-firewall/) integrates smoothly with Magic WAN, enabling you to enforce network firewall policies at Cloudflare's global network, across traffic from any entity within your network. With Magic WAN, you can securely connect any traffic source - data centers, offices, devices, cloud properties - to Cloudflare's network and configure routing policies to get the bits where they need to go, all within one SaaS solution. Magic WAN supports a variety of on-ramps including any device that supports anycast GRE or IPsec tunnels. To make it easier to onboard your cloud properties, you can use [Magic Cloud Networking](/magic-wan/configuration/magic-cloud-networking/), which automates the process of creating on-ramps from your cloud networks. Refer to [On-ramps](/magic-wan/on-ramps/) for a full list of supported on-ramps. Learn how to [get started](/magic-wan/get-started/). --- ## Features Use Magic WAN Connector to automatically connect, steer, and shape any IP traffic. Magic WAN is compatible with a host of third-party devices. If you do not have Magic WAN Connector, start here to learn how to set up Magic WAN manually. Automate resource discovery, and reduce management burden when connecting to your public cloud. Learn how you can use Magic WAN with other Cloudflare Zero Trust products. Use BGP peering between your networks and Cloudflare to automate the process of adding or removing networks and subnets, and take advantage of failure detection and session recovery features. --- ## Related products Cloudflare Zero Trust replaces legacy security perimeters with our global edge, making the Internet faster and safer for teams around the world. Magic Firewall is a firewall-as-a-service (FWaaS) delivered from the Cloudflare global network to protect office networks and cloud infrastructure with advanced, and scalable protection. Simplify and automate cloud resource discovery, and reduce your management burden when connecting to your public cloud. Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. Cloudflare Load Balancing distributes traffic across your endpoints, which reduces endpoint strain and latency and improves the experience for end users. --- ## More resources Deep dive into key architecture and functionalities aspects of Cloudflare One, and learn more about Magic WAN and its structure. --- # Load Balancing URL: https://developers.cloudflare.com/magic-wan/load-balancing/ You can use Cloudflare Load Balancing with Magic WAN to distribute traffic across endpoints, reducing strain and improving the performance of your network. This works through Private Network Load Balancing, which supports both on-ramping and off-ramping traffic to Magic WAN tunnels. Refer to [Private Network Load Balancing](/load-balancing/private-network/) for more information about the feature and how to set it up. You will need to [enable Load Balancing](/load-balancing/) before you can use this feature. --- # Network Interconnect (CNI) URL: https://developers.cloudflare.com/magic-wan/network-interconnect/ import { Render } from "~/components"; --- # On-ramps URL: https://developers.cloudflare.com/magic-wan/on-ramps/ To on-ramp your network traffic to Magic WAN, you can use [Magic WAN Connector](/magic-wan/configuration/connector/), a lightweight software package you can install in corporate network locations to automatically connect, steer, and shape any IP traffic. You can also use any device that supports [GRE or IPsec](/magic-wan/configuration/manually/third-party/) tunnels with the supported configuration parameters. Additional compatible on-ramps include: - [Cloudflare Network Interconnect (CNI)](/magic-wan/network-interconnect/): Connect your network infrastructure directly with Cloudflare - rather than using the public Internet - for a more reliable and secure experience. - [Cloudflare Tunnel](/magic-wan/zero-trust/cloudflare-tunnel/): Magic WAN can be used together with Cloudflare Tunnel for easy access between your networks and applications. - [WARP](/cloudflare-one/connections/connect-devices/warp/): Protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where Cloudflare Gateway can apply advanced web filtering. - [Magic Cloud Networking](/magic-wan/configuration/magic-cloud-networking/): Automatically create on-ramps from your cloud networks to Magic WAN. - [Network on-ramp partnerships](https://www.cloudflare.com/network-onramp-partners/): Refer to our [third-party integration tutorials](/magic-wan/configuration/manually/third-party/) for guidance on configuring the most asked for third-party products. --- # Security filters URL: https://developers.cloudflare.com/magic-wan/security/ Magic WAN customers have [automatic access to Magic Firewall](/magic-firewall/plans/). Magic Firewall is Cloudflare's firewall-as-a-service solution that allows you to protect your infrastructure. Magic Firewall supports layers three and four of the [OSI model](https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/), and enables you to allow or block traffic on a variety of packet characteristics. Refer to [Magic Firewall](/magic-firewall/) for more information about this product. As a Magic WAN customer, you can also use Cloudflare Gateway to set up policies to inspect network and HTTP traffic to the Internet or your private network infrastructure. Refer to [Connect to Cloudflare Gateway with Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/) to learn how to filter Magic WAN traffic with Gateway policies. --- # Get started URL: https://developers.cloudflare.com/network-error-logging/get-started/ Network Error Logging is available to users on all plan types. To enable Network Error Logging for Free and Pro zones: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/). 2. Select **Network** and locate **Network Error Logging Monitoring**. 3. Select the toggle to enable Network Error Logging. To enable this for Business and Enterprise, contact support or your account team. --- # Migration guides URL: https://developers.cloudflare.com/migration-guides/ import { CardGrid, Description, LinkTitleCard } from "~/components" Content designed to help you migrate from another provider to Cloudflare. This section is still in work. Expect more guides soon. *** ## More resources High-level overviews of Cloudflare's network and platform. Read articles and announcements about the latest Cloudflare products and features. Module-based guidance on Cloudflare product workflows. --- # How to URL: https://developers.cloudflare.com/network-error-logging/how-to/ Use NEL reports to view information such as: * Why a request failed * The country a request failed from * The last mile network a request failed from * The Cloudflare data center the request was most likely meant for 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/). 2. Select **Analytics & Logs** > **Edge Reachability**. Click a tab under **Reachability summary** to view specific information related to your Origin ASN, Origin, IP, or data center. Hover over a location on the map to view the number of reachable requests. Under **Reachability by data center**, click a location under Data Centers to filter reachability by a specific location. To view the log fields available for NEL, refer to [NEL reports](/logs/reference/log-fields/zone/nel_reports/). --- # Network Error Logging URL: https://developers.cloudflare.com/network-error-logging/ Network Error Logging (NEL) is a browser-based reporting system that allows users to report their own failures to an external endpoint. You can use Network Error Logging to gain insight into connectivity issues on the Internet to learn when and where an incident is happening, who is impacted, and how they are being impacted. ## The last mile The last mile is the path from a user to the first point of ingress to the resource, whether that be a network like Cloudflare or directly to the origin server. The last mile is important because it is in the critical path of the request for a resource: if the last mile has issues, users cannot connect to their resources. When Network Error Logging is enabled, you can receive alerts about issues in the last mile — which are typically difficult to detect — to learn what the problem is and how to fix it. ![The last mile diagram, showing the steps involved in delivering data to a customer](~/assets/images/network-error-logging/last-mile.png) ## How NEL affects requests The Report-To header is present in all requests to Cloudflare zones that have NEL enabled:   ```txt report-to: {"group":"cf-nel","max_age":31536000,"endpoints":[{"url":"`[`https://a.nel.cloudflare.com/report?lkg-colo=lhr&lkg-time=1600338181`](https://gcp.nel.cloudflare.com/report?lkg-colo=lhr&lkg-time=1600338181&lkg-ip=1.1.1.1)`"}]} ``` A sample Network Error Report payload appears as follows: ```json { "age": 20, "type": "network-error", "url": "https://example.com/previous-page", "body": { "elapsed_time": 18, "method": "POST", "phase": "dns", "protocol": "http/1.1", "referrer": "https://example.com/previous-page", "sampling_fraction": 1, "server_ip": "", "status_code": 0, "type": "dns.name_not_resolved", "url": "https://example-host.com/" } } ``` ## Privacy Cloudflare uses geolocation lookups to extract the following information from every client IP in a NEL report: * Client ASN * Client country * Client metro area Cloudflare uses internal lookups to associate the above data with a customer domain and customer account. Cloudflare does not store any PII or user-specific data, and any IP data is only kept for the duration of the request as it is processed. After the report is processed through the NEL pipeline, all PII data is purged from the system. The client IP address is only stored in volatile memory for the lifetime of the request to Cloudflare’s NEL endpoint (order of milliseconds) and is dropped immediately after the request completes. Cloudflare does not log the client IP address anywhere in the Network Error Logging pipeline. Customers can opt out of having their end users consume the NEL headers by [contacting Cloudflare support](/support/contacting-cloudflare-support/). --- # Reference URL: https://developers.cloudflare.com/network-error-logging/reference/ If a user is able to connect to Cloudflare and the site they connect to has NEL enabled, Cloudflare passes back two headers to the browser indicating that they should report any network failures to an endpoint specified in the headers. The browser will operate as usual, and if something happens that prevents the browser from connecting to the site, the browser will log the failure as a report and send it to the endpoint. Network Error Logging failures can occur for different reasons which are outlined below. ## Internet Service Provider (ISP) outage An ISP outage appears to NEL users as failures from one particular last-mile network. By examining NEL data to look at the client autonomous system number (ASN) view, you can see which networks are causing the most impact. For customers, this scenario appears as an influx of `tcp.timed_out errors`, as well as `tcp.failed`, `h2.protocol_error` and `h3.protocol_error`. In the event of a last-mile outage, the best course of action is to contact the provider to investigate. ## Transit Flap Transit flaps look like momentary outages caused by transits re-establishing BGP sessions. To customers, this will appear as `tcp.timed_out` reports from a variety of ASNs over a short period of time. This could happen for several reasons: - Maintenance in the transit network necessitated a reset of the session. - Maintenance or reboots in Cloudflare necessitated a reset of the BGP session. - Packet loss in the network caused the session to flap. Heavy packet loss in the network will likely result in a series of flaps over time. Maintenance is typically one impact period that lasts no more than two minutes. ## Infrastructure outage Infrastructure outages occur at shared peering points, such as Internet exchanges. These outages appear to customers as an increase in `tcp.timed_out`, `tcp.failed`, and `tcp.aborted reports`. These failures will likely appear across multiple networks for an extended period of time. Depending on the severity of the report volume, Cloudflare may declare an incident to track remediation. Alternatively, Cloudflare may deactivate peering from these shared points until the issue is resolved. ## Cloudflare outage Cloudflare outages consist of issues within Cloudflare’s data-center fabric. These outages appear to customers as an increase in `tcp.timed_out`, `tcp.failed`, and `tcp.aborted` reports and will likely appear across multiple networks for a short period of time. By pivoting by data center, customers can track the impact across Cloudflare points of presence. Cloudflare-based incidents will always be tracked through a status page, which will indicate whether or not there are issues within the impacted region. ## Provider sending traffic through scrubbing center/blocking traffic This type of outage manifests as TLS errors, such as `tls.cert.authority_invalid`, `tls.cert.name_invalid,` or others and may also present with `tcp.aborted errors`. Customers may uncover this behavior by looking at which last-mile ASNs are displaying increased failures, as it will typically be only one. Customers can seek remediation by contacting the provider that they believe is scrubbing their traffic. ## Certificate issues Certificate issues are also detectable through NEL. The `TLS.version`, `cipher_mismatch`, or other errors may present across multiple ISPs in multiple Cloudflare locations. If this is detected in NEL, the issue can be remediated by deploying new certificates or using [Cloudflare’s SSL management suite](/ssl/edge-certificates/advanced-certificate-manager/) to automatically deploy new certificates. --- # gRPC connections URL: https://developers.cloudflare.com/network/grpc-connections/ import { FeatureTable, Render } from "~/components" Cloudflare offers support for gRPC to protect your APIs on any [proxied gRPC endpoints](/dns/proxy-status/). The gRPC protocol helps build efficient APIs with smaller payloads for reduced bandwidth usage, decreased latency, and faster implementations. ## Availability Charges may occur for gRPC traffic over add-on products such as [Argo Smart Routing](/argo-smart-routing/), [WAF](/waf/), and [Bot Management](/bots/). ## Limitations Running gRPC traffic on Cloudflare is compatible with most Cloudflare products. However, the following products have limited capabilities with gRPC requests: * The [Cloudflare WAF](/waf/) will only run for header inspection during the connection phase. WAF Managed Rules will not run on the content of a gRPC stream. * * [Cloudflare Access](/cloudflare-one/policies/access/) does not support gRPC traffic sent through Cloudflare’s reverse proxy. gRPC traffic will be ignored by Access if gRPC is enabled in Cloudflare. We recommend disabling gRPC for any sensitive origin servers protected by Access or enabling another means of authenticating gRPC traffic to your origin servers. ## Enable gRPC ### Requirements * Your gRPC endpoint must listen on port 443.  * Your gRPC endpoint must support TLS and HTTP/2. * HTTP/2 must be advertised over ALPN. * Use `application/grpc` or `application/grpc+ Manage network settings for your website. *** ## Features Include the country code of the visitor location with all requests to your website. Enable IPv6 support and gateway. Allow WebSockets connections to your origin server. *** ## Related products The Cloudflare China Network is a package of selected Cloudflare’s performance and security products running on data centers located in mainland China and operated by Cloudflare’s partner JD Cloud. Managed Transforms allow you to perform common adjustments to HTTP request and response headers with the click of a button. --- # IP geolocation URL: https://developers.cloudflare.com/network/ip-geolocation/ import { FeatureTable, TabItem, Tabs } from "~/components"; IP geolocation adds the [`CF-IPCountry` header](/fundamentals/reference/http-headers/#cf-ipcountry) to all requests to your origin server. Cloudflare automatically updates its IP geolocation database from several data sources, typically twice a week. ## Availability ## Add IP geolocation information The recommended procedure to enable IP geolocation information is to [enable the **Add visitor location headers** Managed Transform](/rules/transform/managed-transforms/reference/#add-visitor-location-headers). This Managed Transform adds HTTP request headers with location information for the visitor's IP address, such as city, country, continent, longitude, and latitude. If you only want the request header for the visitor's country, you can enable **IP Geolocation**. To enable **IP Geolocation** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **IP Geolocation**, switch the toggle to **On**. To enable **IP Geolocation** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `ip_geolocation` as the setting name in the URI path, and the `value` parameter set to `"on"`. :::note In order to use this data, you will need to then retrieve it from the [`CF-IPCountry` header](/fundamentals/reference/http-headers/#cf-ipcountry). ::: --- ## Report an incorrect IP location If you find an incorrect IP location, consider the following: - If the IP is part of the [current Cloudflare IP ranges](https://www.cloudflare.com/ips/), report to `ip-corrections@cloudflare.com`. - If the IP is **not** listed within the [current Cloudflare IP ranges](https://www.cloudflare.com/ips/), [report to IPinfo](https://ipinfo.io/corrections). --- # IPv6 compatibility URL: https://developers.cloudflare.com/network/ipv6-compatibility/ import { FeatureTable, TabItem, Tabs } from "~/components"; Cloudflare enables IPv6 on all domains without requiring additional configuration or hardware (as long as your host provides IPv6 support). When both IPv4 and IPv6 connections are available, Cloudflare prefers IPv4. ## Availability ## Enable IPv6 compatibility By default, IPv6 compatibility is enabled on your domain and will apply to all domains and subdomains covered by [proxied DNS records](/dns/proxy-status/). :::note If you have signed up for Cloudflare through a [Cloudflare hosting partner](http://www.cloudflare.com/hosting-partners) or by use [partial setup](/dns/zone-setups/partial-setup/), IPv6 compatibility does not apply to your apex domain. ::: ## Disable IPv6 compatibility If your origin web server only understands IPv4 formatted IP addresses, non-Enterprise customers should [enable **Pseudo IPv4**](/network/pseudo-ipv4/). Alternatively, customers with an Enterprise account can disable Cloudflare's IPv6 compatibility. To disable **IPv6 Compatibility** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **IPv6 Compatibility**, switch the toggle to **Off**. To disable **IPv6 Compatibility** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `ipv6` as the setting name in the URI path, and the `value` parameter set to `"off"`. :::note Even when IPv6 is disabled, domains can still receive IPv6 traffic via the Tor network. To completely disable all IPv6 traffic: - Disable [**Onion Routing**](/network/onion-routing/). - Use a [WAF custom rule](/waf/custom-rules/create-dashboard/) to block `0:0:0:0:0:0:0:0/0` using the filter `ip.src in {::/0}`. ::: --- ## Troubleshoot an IPv6 network issue Provide the following information to [Cloudflare Support](/support/contacting-cloudflare-support/) if you experience issues with IPv6 connectivity: - A [traceroute](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#perform-a-traceroute) that demonstrates the IPv6 connection issues, - the [Cloudflare data center serving your request](/support/troubleshooting/general-troubleshooting/gathering-information-for-troubleshooting-sites/#identify-the-cloudflare-data-center-serving-your-request) when the IPv6 issues occur, and - confirmation of whether [disabling IPv6 Compatibility](#disable-ipv6-compatibility) resolves the issue. --- # Onion Routing and Tor support URL: https://developers.cloudflare.com/network/onion-routing/ import { FeatureTable, TabItem, Tabs } from "~/components"; Improve the Tor user experience by enabling Onion Routing, which enables Cloudflare to serve your website’s content directly through the Tor network and without requiring exit nodes. ## Availability ## How it works Onion Routing helps improve Tor browsing as follows: - Tor users no longer access your site via exit nodes, which can sometimes be compromised, and may snoop on user traffic. - Human Tor users and bots can be distinguished by our Onion services, such that interactive challenges are only served to malicious bot traffic. [Tor Browser](https://tb-manual.torproject.org/about/) users receive an [alt-svc header](https://httpwg.org/specs/rfc7838.html#alt-svc) as part of the response to the first request to your website. The browser then creates a Tor Circuit to access this website using the `.onion` TLD service provided by this header. You should note that the visible domain in the user interface remains unchanged, as the host header and the SNI are preserved. However, the underlying connection changes to be routed through Tor, as the [UI denotes on the left of the address bar](https://tb-manual.torproject.org/managing-identities/#managing-identities) with a Tor Circuit. Cloudflare does not provide a certificate for the `.onion` domain provided as part of alt-svc flow, which therefore cannot be accessed via HTTPS. ## Enable Onion Routing To enable **Onion Routing** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com), and select your account and domain. 2. Go to **Network**. 3. For **Onion Routing**, switch the toggle to **On**. To enable **Onion Routing** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `opportunistic_onion` as the setting name in the URI path, and the `value` parameter set to `"on"`. --- # Pseudo IPv4 URL: https://developers.cloudflare.com/network/pseudo-ipv4/ import { FeatureTable, Render, TabItem, Tabs } from "~/components"; Cloudflare customers can use **Pseudo IPv4** if their origin web server only understands IPv4 formatted IP addresses (meaning it would not support Cloudflare's default [IPv6 compatibility](/network/ipv6-compatibility/)). ## Availability ## Background Some older origin server analytics and fraud detection software expect IP addresses in an IPv4 format and do not support IPv6 addresses. **Pseudo IPv4** uses the [Class E IPv4 address space](https://tools.ietf.org/html/rfc1112#section-4) to provide as many unique IPv4 addresses corresponding to IPv6 addresses as possible. - Example Class E IPv4 address: `240.16.0.1` - Example IPv6 address: `2400:cb00:f00d:dead:beef:1111:2222:3333` :::note Class E IPv4 addresses are designated as experimental and are not used for production Internet traffic. ::: ## Configure Pseudo IPv4 Cloudflare offers three options for configuring **Pseudo IPv4**: - **Off**: Default value. - **Add Header**: Cloudflare automatically adds the `Cf-Pseudo-IPv4` header with a Class E IPv4 address hashed from the original IPv6 address. - **Overwrite Headers**:  :::note When using _Overwrite Headers_, no software changes are necessary in your origin web server. ::: To configure **Pseudo IPv4**: To change the **Pseudo IPv4** setting in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **Pseudo IPv4**, choose your desired setting. To change **Pseudo IPv4** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `pseudo_ipv4` as the setting name in the URI path, and the `value` parameter set to your desired value: `"off"`, `"add_header"`, or `"overwrite_header"`. --- # Response Buffering URL: https://developers.cloudflare.com/network/response-buffering/ import { FeatureTable, TabItem, Tabs } from "~/components"; If your domain sends many small packets, it may be faster to buffer the file and deliver the full payload all at once (instead of streaming it). ## Availability ## How it works By default, Cloudflare **streams** traffic data, meaning that each packet is sent as it becomes available. This can improve the delivery of large files. However, this streaming behavior only applies to dynamic traffic; cacheable traffic (that is, **any** status noted in [Cloudflare cache responses](https://developers.cloudflare.com/cache/concepts/cache-responses/) with the exception of **DYNAMIC**) is buffered and this behavior cannot be changed. If your domain sends many small packets, however, it might be faster to **buffer** the file. This approach waits to send the full file until all packets are ready, preventing a client browser from having to re-assemble packets. ## Enable Response Buffering To enable **Response Buffering** in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **Response Buffering**, switch the toggle to **On**. To enable **Response Buffering** with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `response_buffering` as the setting name in the URI path, and the `value` parameter set to `"on"`. --- # WebSockets URL: https://developers.cloudflare.com/network/websockets/ import { FeatureTable, TabItem, Tabs } from "~/components"; Cloudflare supports proxied WebSocket connections without additional configuration. ## Background WebSockets are open connections sustained between the client and the origin server. Inside a WebSockets connection, the client and the origin can pass data back and forth without having to reestablish sessions. This makes exchanging data within a WebSockets connection fast. WebSockets are often used for real-time applications such as live chat and gaming. ## Enable WebSockets To enable **WebSockets** connections to your origin server in the dashboard: 1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain. 2. Go to **Network**. 3. For **WebSockets**, switch the toggle to **On**. To enable **WebSockets** connections to your origin server with the API, send a [`PATCH`](/api/resources/zones/subresources/settings/methods/edit/) request with `websockets` as the setting name in the URI path, and the `value` parameter set to `"on"`. ## Compatibility notes | Product | Compatible | Notes | | ---------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [SSL](/ssl/) | Yes | | | [WAF](/waf/) | Yes\* | The initial HTTP 101 request is subject to WAF managed rules, custom rules, rate limiting rules, and other WAF features like any other WebSockets connection. However, once a connection has been established, the WAF does not perform any further inspections. | | [Workers](/workers/examples/websockets/) | Yes | You can also use [Durable Objects](/durable-objects/) as an endpoint for WebSocket sessions, giving you full control over messages sent to and from clients. | :::note Cloudflare also supports [ASP.NET SignalR](http://signalr.net/), which helps negotiate which transport method to use (long polling or WebSockets). ::: ## Availability WebSockets are supported on all Cloudflare plans. ## Requests and Bandwidth measurement Given the nature of WebSocket connections, you may notice they differ from typical HTTP traffic in terms of requests and bandwidth usage. If you are an Enterprise customer, it is important to consider how Cloudflare measures requests and bandwidth to accurately estimate your usage. Cloudflare measures a single WebSocket connection in the following way: - **Requests**: Cloudflare recognizes only the initial upgrade request per WebSocket connection as an HTTP request. Even though you can send a bidirectional message stream through the established WebSocket connection, it will be counted as a single long-lived HTTP request. - **Bandwidth**: Cloudflare measures data transfer sent from Cloudflare to the client. This typically means that messages from the WebSocket server behind Cloudflare to the WebSocket client are counted towards bandwidth usage. Once a WebSocket connection is closed, you can view your aggregated WebSocket usage through [Traffic Analytics](/analytics/account-and-zone-analytics/zone-analytics/#traffic), the [GraphQL Analytics API](/analytics/graphql-api/), and [HTTP requests logs](/logs/reference/log-fields/zone/http_requests/). ## Technical note When Cloudflare releases new code to its global network, we may restart servers, which terminates WebSockets connections. ### Best practices - Implement a [keepalive](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_servers#pings_and_pongs_the_heartbeat_of_websockets). - Review and then remove or extend timeout settings on the origin and/or on the client. ### Troubleshooting Investigating issues with Websocket can be facilitated with client tools like [wscat](https://github.com/websockets/wscat). Being able to reproduce an issue on a single URL with a minimalistic tool helps narrowing down the issue. The `EdgeStartTimestamp` and `EdgeStopTimestamp` fields in [HTTP requests logs](/logs/reference/log-fields/zone/http_requests/) represent the duration of the WebSocket connection (they do not represent the initial HTTP connection). --- # About URL: https://developers.cloudflare.com/network-interconnect/about/ Cloudflare supports a variety of options to connect your network to Cloudflare: - Direct CNI, for Magic WAN and Magic Transit. - Classic CNI, for Magic Transit. - Cloud CNI, for Magic WAN and Magic Transit. - Peering via either an Internet exchange, or a private network interconnect (PNI). Below is a brief overview of the options to help you decide which method best fits your network. | Network interconnect mode | Use cases | Capabilities | | --- | --- | --- | | [Direct CNI](/network-interconnect/express-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with on-premise locations. | - 10, 100 Gbps
- Available at Direct CNI-capable Cloudflare locations
- No tunnel required
- Set up via dashboard in less than three minutes. | | [Classic CNI](/network-interconnect/classic-cni/) | Use for Magic Transit, interconnecting directly or via a partner with on-premise locations. | - 10, 100 Gbps
- Available at classic CNI capable Cloudflare data centers
- Overlay GRE tunnel required for egress
- BGP route reflector signaling
- Setup facilitated by account team. | | [Cloud CNI](/network-interconnect/cloud-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with virtual networks (VPCs) from public cloud providers. | - Speed depends on cloud provider
- Available at Cloud CNI capable Cloudflare locations
- Setup facilitated by account team. | | [Peering, or private network interconnect (PNI)](/network-interconnect/pni-and-peering/) | Use for connecting your users to any Cloudflare services, via a more direct, performant and potentially cost-effective network path. | - No requirement to be a customer
- Speed depends on IX or PNI
- Available at PNI capable Cloudflare locations (PNI) and any Internet Exchange (IX) where Cloudflare peers today.
- Setup facilitated by `peering@cloudflare.com` | --- # Alerts URL: https://developers.cloudflare.com/network-interconnect/alerts/ import { AvailableNotifications, Render } from "~/components" You can configure alerts to receive notifications for changes in your network. --- # Changelog URL: https://developers.cloudflare.com/network-interconnect/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-10-01 **Early access testing for BGP on Direct CNI circuits** Customers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity. ## 2024-09-02 **Interconnect portal displays all available locations in a list** Customers can now see all available Direct CNI locations when searching for a Cloudflare site in the Interconnects interface. --- # Understanding the True-Client-IP Header URL: https://developers.cloudflare.com/network/true-client-ip-header/ import { FeatureTable } from "~/components"; Enabling the True-Client-IP Header adds the [`True-Client-IP` header](/fundamentals/reference/http-headers/#true-client-ip-enterprise-plan-only) to all requests to your origin server, which includes the end user's IP address. ## Availability ## Add True-Client-IP Header The recommended procedure to access client IP information is to [enable the **Add "True-Client-IP" header** Managed Transform](/rules/transform/managed-transforms/reference/#add-true-client-ip-header). :::note To use this data, you will need to then retrieve it from the [`True-Client-IP` header](/fundamentals/reference/http-headers/#cf-ipcountry). ::: ## Additional resources For additional guidance on using True-Client-IP Header with Cloudflare, refer to the following resources: - [Available Managed Transforms](/rules/transform/managed-transforms/reference/#add-true-client-ip-header) - [Cloudflare HTTP headers](/fundamentals/reference/http-headers/#true-client-ip-enterprise-plan-only) - [Restoring original visitor IPs](/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/) --- # Cloud CNI URL: https://developers.cloudflare.com/network-interconnect/cloud-cni/ Cloud Interconnect allows you to connect your virtual private cloud (VPC) virtual networks directly with Cloudflare — for a more reliable and secure experience. Connecting to Cloudflare directly with a Cloud Interconnect reduces latency, makes your network more stable by bypassing Internet performance potential bottlenecks, and will often reduce your cloud provider network egress bandwidth charges. The use case for Cloud Interconnect is Magic WAN. ## Supported cloud providers Cloudflare supports interconnect with: - Amazon Web Services (AWS) Direct Connect - Google Cloud (GCP) Interconnect Azure ExpressRoute support is coming soon. ## Cloud Interconnect Setup To create a new cloud interconnect, contact your customer success manager to get started with the set up. --- # Cloudflare Network Interconnect URL: https://developers.cloudflare.com/network-interconnect/ import { Description, Plan, RelatedProduct } from "~/components" Connect your network infrastructure directly to Cloudflare Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience. With CNI, you can bring Cloudflare's full suite of network functions to your physical network edge. *** ## Related products Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks. Improve security and performance for your entire corporate network, reducing cost and operation complexity. --- # PNI and peering setup URL: https://developers.cloudflare.com/network-interconnect/pni-and-peering/ Cloudflare has an [open peering policy](https://www.cloudflare.com/peering-policy/). There is no requirement to be a Cloudflare customer for public peering, or a Private Network Interconnect (PNI). You can use BGP to peer with Cloudflare at any of the Public Internet Exchanges listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/net/4224). If you have many users accessing websites protected and proxied by Cloudflare, then peering with Cloudflare may help you remove bandwidth from your Internet transit links, and increase performance by reducing latency to Cloudflare. You may also optionally sign up for the [Cloudflare Peering Portal](https://www.cloudflare.com/partners/peering-portal/), which allows operators of public BGP Autonomous System Number (ASN) listed on PeeringDB to view where their network exchanges traffic with Cloudflare. Finally, if our networks exchange more than 1 Gbps of traffic in a single location, we can move your peering from the Internet Exchange to a Private Network Interconnect (PNI). If you operate a public autonomous system on the BGP table, and would like to peer with Cloudflare at a Public Internet Exchange listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/asn/13335), you can request peering by emailing `peering@cloudflare.com`. ## PNI and peering setup You can use a peering portal, such as PeeringDB, to view and maintain your database of peering locations. Before you begin using PeeringDB, you must create an account and affiliate with Cloudflare. ### Log in to the PeeringDB portal :::note You must first [create PeeringDB portal account](https://www.peeringdb.com/register) before you can log in. ::: 1. [Log in](https://www.peeringdb.com/account/login/?next=/register) to your account. 2. Ensure your email address is affiliated with the ASN you want to request access for. Select the **OIDC PeeringDB** and follow the log in process. If you receive a message stating your account has not been affiliated with an organization, you will need to request affiliation. ![Error message about missing organization affiliation](~/assets/images/network-interconnect/peeringdb-request-affiliation.png) When your affiliation is approved, **Cloudflare, Inc.** appears under **Existing affiliations** on your profile. ![List of existing affiliations](~/assets/images/network-interconnect/peeringdb-affiliation-approved.png) ### Request peer sessions Before you can request a peering session for an ASN, you must be an admin for that ASN. 1. On the **ASN** page on [PeeringDB](https://www.peeringdb.com/), select **Users**. Confirm your email address in the **Admin** group. 2. From the **Peering Portal**, locate **Peering Locations**. 3. From the **Sessions** toggle, select **Potential**. The **Peer** button under **Peering Request** only appears active to admins. ![Admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-admin-view.png) Non-admin users will be unable to select **Peer** and hovering over the button will display a message about the need for admin access. ![Non-admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-nonadmin-view.png) --- # Notifications URL: https://developers.cloudflare.com/notifications/ import { Plan } from "~/components" Cloudflare Notifications help you stay up to date with your Cloudflare account. Manage your Notifications to define what you want to be warned about and how, be it a denial-of-service attack or an issue with your server. The available Notification features vary according to your plan: - Free plans can set up email-based Notifications. - Business and higher plans can also [access PagerDuty](/notifications/get-started/configure-pagerduty/). - Professional and higher plans can also [use webhooks](/notifications/get-started/configure-webhooks/). The notification service only works on the [proxied](/dns/proxy-status/) domains because Cloudflare needs enough information necessary to decide if we need to trigger a notification or not. :::note The availability of delivery methods like PagerDuty and webhooks in Free or Professional zones depends on the highest zone plan in your Cloudflare account: - PagerDuty is available in zones on a Free/Professional plan if your Cloudflare account has at least one zone in a Business plan (or higher). - Webhooks are available in zones on a Free plan if your Cloudflare account has at least one zone in a Professional plan (or higher). ::: --- # Available Notifications URL: https://developers.cloudflare.com/notifications/notification-available/ import { AvailableNotifications } from "~/components" Available Notifications depend on your Cloudflare plan. Cloudflare offers a variety of Notifications for our products and services, such as [Billing](/billing/), [Denial of Service protection](/ddos-protection/), [Magic Transit](/magic-transit/), and [SSL/TLS](/ssl/). Depending on your plan, you can also configure webhooks, allowing you to connect your account with external services such as Slack and Google Chat, and PagerDuty to receive Cloudflare Notifications. ## Actions available on receiving a Notification Each Notification carries different types of information about the status of your Cloudflare account, or the type of action you can take. Refer to information below to understand what each Notification does and what to do when receiving one. --- # Notification History URL: https://developers.cloudflare.com/notifications/notification-history/ Notification History is a log of notifications that have been sent to your account via the Notifications service. Information contained in Notification History includes the notification itself, when the notification was sent, and who the notification was sent to. ## How to access Notification History Currently, customers can access Notification History [via the Cloudflare API](/api/resources/alerting/subresources/history/methods/list/). Using `GET`, customers can retrieve a list of history records for notifications sent to an account. The records are displayed for the last 30 or 90 days, based on the type of plan. ```txt title="Syntax" GET accounts/{account_id}/alerting/v3/history ``` ```bash title="Example" curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/alerting/v3/history?page=1&per_page=25" \ --header "Authorization: Bearer " ``` ## Availability Notification History is available on all plans. The amount of history clients have access to depends on the type of plan: - **Free, Pro, and Business**: History from the past 30 days. - **Enterprise**: History from the past 90 days. :::note Customers will not be able to access Notification History from before 2021-10-11. ::: --- # Changelog URL: https://developers.cloudflare.com/page-shield/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/page-shield/get-started/ import { Tabs, TabItem, Render } from "~/components"; ## Activate client-side resource monitoring To enable client-side resource monitoring: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Security** > **Page Shield**. 3. Select **Enable Page Shield**. If you do not have access to Page Shield in the Cloudflare dashboard, check if your user has one of the [necessary roles](/page-shield/reference/roles-and-permissions/). 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. 2. Go to **Security** > **Settings** and filter by **Client side abuse**. 3. Next to **Continuous script monitoring**, set the toggle to **On**. If you do not have access to resource monitoring in the Cloudflare dashboard, check if your user has one of the [necessary roles](/page-shield/reference/roles-and-permissions/). ## Review detected scripts When you enable client-side resource monitoring, it may take a while to get the list of detected scripts in your domain. Review the scripts displayed in the [resource monitoring dashboard](/page-shield/detection/monitor-connections-scripts/), checking them for signs of malicious activity. Depending on your plan, you may be able to also review the connections made by scripts in your domain's pages and check them for malicious activity. ## Configure alerts ## Define policies :::note Only available to Enterprise customers with a paid add-on. ::: [Policies](/page-shield/policies/), called content security rules in the [new security dashboard](/security/), define allowed resources on your websites. Create policies to implement a positive security model [^1]. 1. [Create a policy](/page-shield/policies/create-dashboard/) with the _Log_ action. 2. After some time, [review the list of policy violations](/page-shield/policies/violations/) to make sure the policy is correct. Update the policy if needed. 3. Change the policy action to _Allow_ to start blocking resources not covered by the policy. [^1]: A positive security model is one that defines what is allowed and rejects everything else. In contrast, a negative security model defines what will be rejected and accepts the rest. --- # Cloudflare Page Shield URL: https://developers.cloudflare.com/page-shield/ import { Description, Feature, FeatureTable, Plan } from "~/components"; Ensures the safety and privacy of your website visitors' browsing environment. Page Shield helps manage resources loaded by your website visitors — including scripts, their connections, and cookies — and triggers alert notifications when resources change or are considered malicious. Learn how to [get started](/page-shield/get-started/). --- ## Features Displays information about client-side resources loaded in your domain's pages. Find in which page a resource first appeared, and view a list of the latest occurrences of the resource in your pages. Detects malicious scripts in your pages using threat intelligence and machine learning. Detects any changes in the scripts loaded in your pages. Receive notifications about newly detected scripts, scripts loaded from unknown domains, new scripts considered malicious, or code changes in your existing scripts. Policies define allowed resources on your websites. Use policies to enforce an allowlist of resources, effectively blocking resources not included in your policies. ## Availability --- # Troubleshooting URL: https://developers.cloudflare.com/page-shield/troubleshooting/ import { GlossaryTooltip } from "~/components"; ## Cloudflare does not show any client-side resources after activation Cloudflare does not collect data on every single page view. Instead, it uses a sampling approach to gather information efficiently. This means that domains with lower traffic might take longer to generate initial reports, as these domains need more page views to accumulate enough samples. To speed up the reporting process, it is recommended that you actively generate traffic to your application after [activating client-side resource monitoring](/page-shield/get-started/). This will provide Cloudflare with more data to work with, leading to faster report generation. ## The dashboard shows scripts and connections that I do not recognize Scripts often reference other scripts outside your application. But, if you see unexpected scripts on your resource monitoring dashboard, check them for signs of malicious activity. ## I get warnings in my browser's developer tools related to Content Security Policy (CSP) Cloudflare uses a Content Security Policy (CSP) report-only directive to gather a list of all scripts running on your application. Some browsers display scripts being reported as warnings in the console pane of their developer tools. For example: ```txt [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='), or a nonce ('nonce-...') is required to enable inline execution. ``` You can safely ignore these warnings, since they are related to the reports that Cloudflare requires to detect loaded scripts. For more information, refer to [How Page Shield works](/page-shield/how-it-works/). ## I get policy violation reports for a domain I allowlisted Policy violations reported via CSP's [report-only directive](/page-shield/reference/csp-header/) do not take into consideration any redirects or redirect HTTP status codes. This is [by design](https://www.w3.org/TR/CSP3/#create-violation-for-request) for security reasons. Some third-party services you may want to cover in your allow policies perform redirects. An example of such a service is Google Ads, which [does not work well with CSP policies](https://support.google.com/adsense/thread/102839782?hl=en&msgid=103611259). For example, if you add the `adservice.google.com` domain to an allow policy, you could get policy violation reports for this domain due to redirects to a different domain (not present in your allow policy). In this case, the violation report would still mention the original domain, and not the domain of the redirected destination, which can cause some confusion. To try to solve this issue, add the domain of the redirected destination to your allow policy. You may need to add several domains to your policy due to redirects. --- # Demos and architectures URL: https://developers.cloudflare.com/pages/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector, } from "~/components"; Learn how you can use Pages within your existing application and architecture. ## Demos Explore the following demo applications for Pages. ## Reference architectures Explore the following reference architectures that use Pages: --- # Cloudflare Pages URL: https://developers.cloudflare.com/pages/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct, Render, Aside, } from "~/components"; Create full-stack applications that are instantly deployed to the Cloudflare global network. Deploy your Pages project by connecting to [your Git provider](/pages/get-started/git-integration/), uploading prebuilt assets directly to Pages with [Direct Upload](/pages/get-started/direct-upload/) or using [C3](/pages/get-started/c3/) from the command line. --- ## Features Use Pages Functions to deploy server-side code to enable dynamic functionality without running a dedicated server. Rollbacks allow you to instantly revert your project to a previous production deployment. Set up redirects for your Cloudflare Pages project. --- ## Related products Cloudflare Workers provides a serverless execution environment that allows you to create new applications or augment existing ones without configuring or maintaining infrastructure. Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. D1 is Cloudflare’s native serverless database. Create a database by importing data or defining your tables and writing your queries within a Worker or through the API. Offload third-party tools and services to the cloud and improve the speed and security of your website. --- ## More resources Learn about limits that apply to your Pages project (500 deploys per month on the Free plan). Deploy popular frameworks such as React, Hugo, and Next.js on Pages. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. --- # Getting started URL: https://developers.cloudflare.com/pipelines/getting-started/ import { Render, PackageManagers, Details } from "~/components"; Cloudflare Pipelines allows you to ingest load high volumes of real time streaming data, and load into [R2 Object Storage](/r2/), without managing any infrastructure. By following this guide, you will: 1. Setup an R2 bucket. 2. Create a pipeline, with HTTP as a source, and an R2 bucket as a sink. 3. Send data to your pipeline's HTTP ingestion endpoint. 4. Verify the output delivered to R2. :::note Pipelines is in **public beta**, and any developer with a [paid Workers plan](/workers/platform/pricing/#workers) can start using Pipelines immediately. ::: *** ## Prerequisites To use Pipelines, you will need: ## 1. Set up an R2 bucket Create a bucket by following the [get started guide for R2](/r2/get-started/), or by running the command below: ```sh npx wrangler r2 bucket create my-bucket ``` Save the bucket name for the next step. ## 2. Create a Pipeline To create a pipeline using Wrangler, run the following command in a terminal, and specify: - The name of your pipeline - The name of the R2 bucket you created in step 1 ```sh npx wrangler pipelines create my-clickstream-pipeline --r2-bucket my-bucket --batch-max-seconds 5 --compression none ``` After running this command, you will be prompted to authorize Cloudflare Workers Pipelines to create an R2 API token on your behalf. These tokens used by your pipeline when loading data into your bucket. You can approve the request through the browser link which will open automatically.
Choosing a pipeline name When choosing a name for your pipeline: - Ensure it is descriptive and relevant to the type of events you intend to ingest. You cannot change the name of the pipeline after creating it. - The pipeline name must be between 1 and 63 characters long. - The name cannot contain special characters outside dashes (`-`). - The name must start and end with a letter or a number.
You will notice two optional flags are set while creating the pipeline: `--batch-max-seconds` and `--compression`. These flags are added to make it faster for you to see the output of your first pipeline. For production use cases, we recommend keeping the default settings. Once you create your pipeline, you will receive a summary of your pipeline's configuration, as well as an HTTP endpoint which you can post data to: ```sh 🌀 Authorizing R2 bucket "my-bucket" 🌀 Creating pipeline named "my-clickstream-pipeline" ✅ Successfully created pipeline my-clickstream-pipeline Id: [PIPELINE-ID] Name: my-clickstream-pipeline Sources: HTTP: Endpoint: https://[PIPELINE-ID].pipelines.cloudflare.com/ Authentication: off Format: JSON Worker: Format: JSON Destination: Type: R2 Bucket: my-bucket Format: newline-delimited JSON Compression: GZIP Batch hints: Max bytes: 100 MB Max duration: 300 seconds Max records: 100,000 🎉 You can now send data to your Pipeline! Send data to your Pipeline's HTTP endpoint: curl "https://[PIPELINE-ID].pipelines.cloudflare.com/" -d '[{ ...JSON_DATA... }]' To send data to your Pipeline from a Worker, add the following configuration to your config file: { "pipelines": [ { "pipeline": "my-clickstream-pipeline", "binding": "PIPELINE" } ] } ``` ## 3. Post data to your pipeline Use a curl command in your terminal to post an array of JSON objects to the endpoint you received in step 1. ```sh curl -H "Content-Type:application/json" \ -d '[{"event":"viewedCart", "timestamp": "2025-04-03T15:42:30Z"},{"event":"cartAbandoned", "timestamp": "2025-04-03T15:42:37Z"}]' \ ``` Once the pipeline successfully accepts the data, you will receive a success message. You can continue posting data to the pipeline. The pipeline will automatically buffer ingested data. Based on the batch settings (`--batch-max-seconds`) specified in step 2, a batch will be generated every 5 seconds, turned into a file, and written out to your R2 bucket. ## 4. Verify in R2 Open the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/overview), and navigate to the R2 bucket you created in step 1. You will see a directory, labeled with today's date (such as `event_date=2025-04-05`). Click on the directory, and you'll see a sub-directory with the current hour (such as `hr=04`). You should see a newline delimited JSON file, containing the data you posted in step 3. Download the file, and open it in a text editor of your choice, to verify that the data posted in step 2 is present. *** ## Next steps * Learn about how to [setup authentication, or CORS settings](/pipelines/build-with-pipelines/sources/http), on your HTTP endpoint. * Send data to your Pipeline from a Cloudflare Worker using the [Workers API documentation](/pipelines/build-with-pipelines/sources/workers-apis). If you have any feature requests or notice any bugs, share your feedback directly with the Cloudflare team by joining the [Cloudflare Developers community on Discord](https://discord.cloudflare.com). --- # Overview URL: https://developers.cloudflare.com/pipelines/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components"; Ingest real time data streams and load into R2, using Cloudflare Pipelines. Cloudflare Pipelines lets you ingest high volumes of real time data, without managing any infrastructure. Ingested data is automatically batched, written to output files, and delivered to an [R2 bucket](/r2/) in your account. You can use Pipelines to build a data lake of clickstream data, or to store events from a Worker. ## Create your first pipeline You can setup a pipeline to ingest data via HTTP, and deliver output to R2, with a single command: ```sh $ npx wrangler@latest pipelines create my-clickstream-pipeline --r2-bucket my-bucket 🌀 Authorizing R2 bucket "my-bucket" 🌀 Creating pipeline named "my-clickstream-pipeline" ✅ Successfully created pipeline my-clickstream-pipeline Id: 0e00c5ff09b34d018152af98d06f5a1xvc Name: my-clickstream-pipeline Sources: HTTP: Endpoint: https://0e00c5ff09b34d018152af98d06f5a1xvc.pipelines.cloudflare.com/ Authentication: off Format: JSON Worker: Format: JSON Destination: Type: R2 Bucket: my-bucket Format: newline-delimited JSON Compression: GZIP Batch hints: Max bytes: 100 MB Max duration: 300 seconds Max records: 100,000 🎉 You can now send data to your pipeline! Send data to your pipeline's HTTP endpoint: curl "https://0e00c5ff09b34d018152af98d06f5a1xvc.pipelines.cloudflare.com/" -d '[{ ...JSON_DATA... }]' To send data to your pipeline from a Worker, add the following configuration to your config file: { "pipelines": [ { "pipeline": "my-clickstream-pipeline", "binding": "PIPELINE" } ] } ``` Refer to the [getting started guide](/pipelines/getting-started) to start building with pipelines. :::note While in beta, you will not be billed for Pipelines usage. You will be billed only for [R2 usage](/r2/pricing/). ::: *** ## Features Each pipeline generates a globally scalable HTTP endpoint, which supports authentication and CORS settings. Send data to a pipeline directly from a Cloudflare Worker. Define batch sizes and enable compression to generate output files that are efficient to query. *** ## Related products Cloudflare R2 Object Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. Cloudflare Workers allows developers to build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. *** ## More resources Learn about pipelines limits. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. --- # Get started URL: https://developers.cloudflare.com/privacy-gateway/get-started/ Privacy Gateway implementation consists of three main parts: 1. Application Gateway Server/backend configuration (operated by you). 2. Client configuration (operated by you). 3. Connection to a Privacy Gateway Relay Server (operated by Cloudflare). *** ## Before you begin Privacy Gateway is currently in closed beta. If you are interested, [contact us](https://www.cloudflare.com/lp/privacy-edge/). *** ## Step 1 - Configure your server As a customer of the Privacy Gateway, you also need to add server support for OHTTP by implementing an application gateway server. The application gateway is responsible for decrypting incoming requests, forwarding the inner requests to their destination, and encrypting the corresponding response back to the client. The [server implementation](#resources) will handle incoming requests and produce responses, and it will also advertise its public key configuration for clients to access. The public key configuration is generated securely and made available via an API. Refer to the [README](https://github.com/cloudflare/privacy-gateway-server-go#readme) for details about configuration. Applications can also implement this functionality themselves. Details about [public key configuration](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-3), HTTP message [encryption and decryption](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-4), and [server-specific details](https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp-05#section-5) can be found in the OHTTP specification. ### Resources Use the following resources for help with server configuration: * **Go**: * [Sample gateway server](https://github.com/cloudflare/privacy-gateway-server-go) * [Gateway library](https://github.com/chris-wood/ohttp-go) * **Rust**: [Gateway library](https://github.com/martinthomson/ohttp/tree/main/ohttp-server) * **JavaScript / TypeScript**: [Gateway library](https://github.com/chris-wood/ohttp-js) *** ## Step 2 - Configure your client As a customer of the Privacy Gateway, you need to set up client-side support for the gateway. Clients are responsible for encrypting requests, sending them to the Cloudflare Privacy Gateway, and then decrypting the corresponding responses. Additionally, app developers need to [configure the client](#resources-1) to fetch or otherwise discover the gateway’s public key configuration. How this is done depends on how the gateway makes its public key configuration available. If you need help with this configuration, [contact us](https://www.cloudflare.com/lp/privacy-edge/). ### Resources Use the following resources for help with client configuration: * **Objective C**: [Sample application](https://github.com/cloudflare/privacy-gateway-client-demo) * **Rust**: [Client library](https://github.com/martinthomson/ohttp/tree/main/ohttp-client) * **JavaScript / TypeScript**: [Client library](https://github.com/chris-wood/ohttp-js) *** ## Step 3 - Review your application After you have configured your client and server, review your application to make sure you are only sending intended data to Cloudflare and the application backend. In particular, application data should not contain anything unique to an end-user, as this would invalidate the benefits that OHTTP provides. * Applications should scrub identifying user data from requests forwarded through the Privacy Gateway. This includes, for example, names, email addresses, phone numbers, etc. * Applications should encourage users to disable crash reporting when using Privacy Gateway. Crash reports can contain sensitive user information and data, including email addresses. * Where possible, application data should be encrypted on the client device with a key known only to the client. For example, iOS generally has good support for [client-side encryption (and key synchronization via the KeyChain)](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys). Android likely has similar features available. *** ## Step 4 - Relay requests through Cloudflare Before sending any requests, you need to first set up your account with Cloudflare. That requires [contacting us](https://www.cloudflare.com/lp/privacy-edge/) and providing the URL of your application gateway server. Then, make sure you are forwarding requests to a mutually agreed URL with the following conventions. ```txt https://.privacy-gateway.cloudflare.com/ ``` --- # Cloudflare Privacy Gateway URL: https://developers.cloudflare.com/privacy-gateway/ import { Description, Feature, Plan } from "~/components" Implements the Oblivious HTTP IETF standard to improve client privacy. [Privacy Gateway](https://blog.cloudflare.com/building-privacy-into-internet-standards-and-how-to-make-your-app-more-private-today/) is a managed service deployed on Cloudflare’s global network that implements part of the [Oblivious HTTP (OHTTP) IETF](https://www.ietf.org/archive/id/draft-thomson-http-oblivious-01.html) standard. The goal of Privacy Gateway and Oblivious HTTP is to hide the client's IP address when interacting with an application backend. OHTTP introduces a trusted third party between client and server, called a relay, whose purpose is to forward encrypted requests and responses between client and server. These messages are encrypted between client and server such that the relay learns nothing of the application data, beyond the length of the encrypted message and the server the client is interacting with. *** ## Availability Privacy Gateway is currently in closed beta – available to select privacy-oriented companies and partners. If you are interested, [contact us](https://www.cloudflare.com/lp/privacy-edge/). *** ## Features Learn how to set up Privacy Gateway for your application. Learn about the different parties and data shared in Privacy Gateway. Learn about how to query Privacy Gateway metrics. --- # FAQs URL: https://developers.cloudflare.com/pub-sub/faq/ ## What messaging systems are similar? Messaging systems that also implement or strongly align to the "publish-subscribe" model include AWS SNS (Simple Notification Service), Google Cloud Pub/Sub, Redis' PUBLISH-SUBSCRIBE features, and RabbitMQ. If you have used one of these systems before, you will notice that Pub/Sub shares similar foundations (topics, subscriptions, fan-in/fan-out models) and is easy to migrate to. ## How is Pub/Sub priced? Cloudflare is still exploring pricing models for Pub/Sub and will share more with developers prior to GA. Users will be given prior notice and will require beta users to explicitly opt-in. ## Does Pub/Sub show data in the Cloudflare dashboard? Pub/Sub today does not support the Cloudflare dashboard. You can set up Pub/Sub through Wrangler by following [these steps](/pub-sub/guide/). ## Where can I speak with other like-minded developers about Pub/Sub? Try the #pubsub-beta channel on the [Cloudflare Developers Discord](https://discord.com/invite/cloudflaredev). ## What limits does Pub/Sub have? Refer to [Limits](/pub-sub/platform/limits) for more details on client, broker, and topic-based limits. --- # Get started URL: https://developers.cloudflare.com/pub-sub/guide/ import { Render, PackageManagers } from "~/components"; :::note Pub/Sub is currently in private beta. You can [sign up for the waitlist](https://www.cloudflare.com/cloudflare-pub-sub-lightweight-messaging-private-beta/) to register your interest. ::: Pub/Sub is a flexible, scalable messaging service built on top of the MQTT messaging standard, allowing you to publish messages from tens of thousands of devices (or more), deploy code to filter, aggregate and transform messages using Cloudflare Workers, and/or subscribe to topics for fan-out messaging use cases. This guide will: - Instruct you through creating your first Pub/Sub Broker using the Cloudflare API. - Create a `..cloudflarepubsub.com` endpoint ready to publish and subscribe to using any MQTT v5.0 compatible client. - Help you send your first message to the Pub/Sub Broker. Before you begin, you should be familiar with using the command line and running basic terminal commands. ## Prerequisite: Create a Cloudflare account In order to use Pub/Sub, you need a [Cloudflare account](/fundamentals/account/). If you already have an account, you can skip this step. ## 1. Enable Pub/Sub During the Private Beta, your account will need to be explicitly granted access. If you have not, sign up for the waitlist, and we will contact you when you are granted access. ## 2. Install Wrangler (Cloudflare CLI) :::note Pub/Sub support in Wrangler requires wrangler `2.0.16` or above. If you're using an older version of Wrangler, ensure you [update the installed version](/workers/wrangler/install-and-update/#update-wrangler). ::: Installing `wrangler`, the Workers command-line interface (CLI), allows you to [`init`](/workers/wrangler/commands/#init), [`dev`](/workers/wrangler/commands/#dev), and [`publish`](/workers/wrangler/commands/#publish) your Workers projects. To install [`wrangler`](https://github.com/cloudflare/workers-sdk/tree/main/packages/wrangler), ensure you have [`npm` installed](https://docs.npmjs.com/getting-started), preferably using a Node version manager like [Volta](https://volta.sh/) or [nvm](https://github.com/nvm-sh/nvm). Using a version manager helps avoid permission issues and allows you to easily change Node.js versions. Then run: Validate that you have a version of `wrangler` that supports Pub/Sub: ```sh wrangler --version ``` ```sh output 2.0.16 # should show 2.0.16 or greater - e.g. 2.0.17 or 2.1.0 ``` With `wrangler` installed, we can now create a Pub/Sub API token for `wrangler` to use. ## 3. Fetch your credentials To use Wrangler with Pub/Sub, you'll need an API Token that has permissions to both read and write for Pub/Sub. The `wrangler login` flow does not issue you an API Token with valid Pub/Sub permissions. :::note This API token requirement will be lifted prior to Pub/Sub becoming Generally Available. ::: 1. From the [Cloudflare dashboard](https://dash.cloudflare.com), click on the profile icon and select **My Profile**. 2. Under **My Profile**, click **API Tokens**. 3. On the [**API Tokens**](https://dash.cloudflare.com/profile/api-tokens) page, click **Create Token** 4. Choose **Get Started** next to **Create Custom Token** 5. Name the token - e.g. "Pub/Sub Write Access" 6. Under the **Permissions** heading, choose **Account**, select **Pub/Sub** from the first drop-down, and **Edit** as the permission. 7. Select **Add More** below the newly created permission. Choose **User** > **Memberships** from the first dropdown and **Read** as the permission. 8. Select **Continue to Summary** at the bottom of the page, where you should see _All accounts - Pub/Sub:Edit_ as the permission. 9. Select **Create Token** and copy the token value. In your terminal, configure a `CLOUDFLARE_API_TOKEN` environmental variable with your Pub/Sub token. When this variable is set, `wrangler` will use it to authenticate against the Cloudflare API. ```sh export CLOUDFLARE_API_TOKEN="pasteyourtokenhere" ``` :::caution[Warning] This token should be kept secret and not committed to source code or placed in any client-side code. ::: With this environmental variable configured, you can now create your first Pub/Sub Broker! ## 4. Create your first namespace A namespace represents a collection of Pub/Sub Brokers, and they can be used to separate different environments (production vs. staging), infrastructure teams, and in the future, permissions. Before you begin, consider the following: - **Choose your namespace carefully**. Although it can be changed later, it will be used as part of the hostname for your Brokers. You should not use secrets or other data that cannot be exposed on the Internet. - Namespace names are global; they are globally unique. - Namespaces must be valid DNS names per RFC 1035. In most cases, this means only a-z, 0-9, and hyphens are allowed. Names are case-insensitive. For example, a namespace of `my-namespace` and a broker of `staging` would create a hostname of `staging.my-namespace.cloudflarepubsub.com` for clients to connect to. With this in mind, create a new namespace. This example will use `my-namespace` as a placeholder: ```sh wrangler pubsub namespace create my-namespace ``` ```json output { "id": "817170399d784d4ea8b6b90ae558c611", "name": "my-namespace", "description": "", "created_on": "2022-05-11T23:13:08.383232Z", "modified_on": "2022-05-11T23:13:08.383232Z" } ``` If you receive an HTTP 403 (Forbidden) response, check that your credentials are correct and that you have not pasted erroneous spaces or characters. ## 5. Create a broker A broker, in MQTT terms, is a collection of connected clients that publish messages to topics, and clients that subscribe to those topics and receive messages. The broker acts as a relay, and with Cloudflare Pub/Sub, a Cloudflare Worker can be configured to act on every message published to it. This broker will be configured to accept `TOKEN` authentication. In MQTT terms, this is typically defined as username:password authentication. Pub/Sub uses JSON Web Tokens (JWT) that are unique to each client, and that can be revoked, to make authentication more secure. Broker names must be: - Chosen carefully. Although it can be changed later, the name will be used as part of the hostname for your brokers. Do not use secrets or other data that cannot be exposed on the Internet. - Valid DNS names (per RFC 1035). In most cases, this means only `a-z`, `0-9` and hyphens are allowed. Names are case-insensitive. - Unique per namespace. To create a new MQTT Broker called `example-broker` in the `my-namespace` namespace from the example above: ```sh wrangler pubsub broker create example-broker --namespace=my-namespace ``` ```json output { "id": "4c63fa30ee13414ba95be5b56d896fea", "name": "example-broker", "authType": "TOKEN", "created_on": "2022-05-11T23:19:24.356324Z", "modified_on": "2022-05-11T23:19:24.356324Z", "expiration": null, "endpoint": "mqtts://example-broker.namespace.cloudflarepubsub.com:8883" } ``` In the example above, a broker is created with an endpoint of `mqtts://example-broker.my-namespace.cloudflarepubsub.com`. This means: - Our Pub/Sub (MQTT) Broker is reachable over MQTTS (MQTT over TLS) - port 8883 - The hostname is `example-broker.my-namespace.cloudflarepubsub.com` - [Token authentication](/pub-sub/platform/authentication-authorization/) is required to clients to connect. ## 6. Create credentials for your broker In order to connect to a Pub/Sub Broker, you need to securely authenticate. Credentials are scoped to each broker and credentials issued for `broker-a` cannot be used to connect to `broker-b`. Note that: - You can generate multiple credentials at once (up to 100 per API call), which can be useful when configuring multiple clients (such as IoT devices). - Credentials are associated with a specific Client ID and encoded as a signed JSON Web Token (JWT). - Each token has a unique identifier (a `jti` - or `JWT ID`) that you can use to revoke a specific token. - Tokens are prefixed with the broker name they are associate with (for example, `my-broker`) to make identifying tokens across multiple Pub/Sub brokers easier. :::note Ensure you do not commit your credentials to source control, such as GitHub. A valid token allows anyone to connect to your broker and publish or subscribe to messages. Treat credentials as secrets. ::: To generate two tokens for a broker called `example-broker` with a 48 hour expiry: ```sh wrangler pubsub broker issue example-broker --namespace=NAMESPACE_NAME --number=2 --expiration=48h ``` You should receive a success response that resembles the example below, which is a map of Client IDs and their associated tokens. ```json { "01G3A5GBJE5P3GPXJZ72X4X8SA": "eyJhbGciOiJFZERTQSIsImtpZCI6IkpEUHVZSnFIT3Zxemxha2tORlE5a2ZON1dzWXM1dUhuZHBfemlSZG1PQ1UifQ. not-a-real-token.ZZL7PNittVwJOeMpFMn2CnVTgIz4AcaWXP9NqMQK0D_iavcRv_p2DVshg6FPe5xCdlhIzbatT6gMyjMrOA2wBg", "01G3A5GBJECX5DX47P9RV1C5TV": "eyJhbGciOiJFZERTQSIsImtpZCI6IkpEUHVZSnFIT3Zxemxha2tORlE5a2ZON1dzWXM1dUhuZHBfemlSZG1PQ1UifQ.also-not-a-real-token.WrhK-VTs_IzOEALB-T958OojHK5AjYBC5ZT9xiI_6ekdQrKz2kSPGnvZdUXUsTVFDf9Kce1Smh-mw1sF2rSQAQ", } ``` Each token allows you to publish or subscribe to the associated broker. ## 7. Subscribe and publish messages to a topic Your broker is now created and ready to accept messages from authenticated clients. Because Pub/Sub is based on the MQTT protocol, there are client libraries for most popular programming languages. Refer to the list of [recommended client libraries](/pub-sub/learning/client-libraries/). :::note You can view a live demo available at [demo.mqtt.dev](http://demo.mqtt.dev) that allows you to use your own Pub/Sub Broker and a valid token to subscribe to a topic and publish messages to it. The `JWT` field in the demo accepts a valid token from your Broker. ::: The example below uses [MQTT.js](https://github.com/mqttjs/MQTT.js) with Node.js to subscribe to a topic on a broker and publish a very basic "hello world" style message. You will need to have a [supported Node.js](https://nodejs.org/en/download/current/) version installed. ```sh # Check that Node.js is installed which node # Install MQTT.js npm i mqtt --save ``` Set your environment variables. ```sh export CLOUDFLARE_API_TOKEN="YourAPIToken" export CLOUDFLARE_ACCOUNT_ID="YourAccountID" export DEFAULT_NAMESPACE="TheNamespaceYouCreated" export BROKER_NAME="TheBrokerYouCreated" ``` We can now generate an access token for Pub/Sub. We will need both the client ID and the token (a JSON Web Token) itself to authenticate from our MQTT client: ```sh curl -s -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" -H "Content-Type: application/json" "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pubsub/namespaces/namespace/brokers/is-it-broken/credentials?type=TOKEN&topicAcl=#" | jq '.result | to_entries | .[0]' ``` This will output a `key` representing the `clientId`, and a `value` representing our (secret) access token, resembling the following: ```json { "key": "01HDQFD5Y8HWBFGFBBZPSWQ22M", "value": "eyJhbGciOiJFZERTQSIsImtpZCI6IjU1X29UODVqQndJbjlFYnY0V3dzanRucG9ycTBtalFlb1VvbFZRZDIxeEUifQ....NVpToBedVYGGhzHJZmpEG1aG_xPBWrE-PgG1AFYcTPEBpZ_wtN6ApeAUM0JIuJdVMkoIC9mUg4vPtXM8jLGgBw" } ``` Copy the `value` field and set it as the `BROKER_TOKEN` environmental variable: ```sh export BROKER_TOKEN="" ``` Create a file called `index.js `, making sure that: - `brokerEndpoint` is set to the address of your Pub/Sub broker. - `clientId` is the `key` from your newly created access token - The `BROKER_TOKEN` environmental variable populated with your access token. :::note Your `BROKER_TOKEN` is sensitive, and should be kept secret to avoid unintended access to your Pub/Sub broker. Avoid committing it to source code. ::: ```js const mqtt = require("mqtt"); const brokerEndpoint = "mqtts://my-broker.my-namespace.cloudflarepubsub.com"; const clientId = "01HDQFD5Y8HWBFGFBBZPSWQ22M"; // Replace this with your client ID const options = { port: 8883, username: clientId, // MQTT.js requires this, but Pub/Sub does not clientId: clientId, // Required by Pub/Sub password: process.env.BROKER_TOKEN, protocolVersion: 5, // MQTT 5 }; const client = mqtt.connect(brokerEndpoint, options); client.subscribe("example-topic"); client.publish( "example-topic", `message from ${client.options.clientId}: hello at ${Date.now()}`, ); client.on("message", function (topic, message) { console.log(`received message on ${topic}: ${message}`); }); ``` Run the example. You should see the output written to your terminal (stdout). ```sh node index.js ``` ```sh output > received message on example-topic: hello from 01HDQFD5Y8HWBFGFBBZPSWQ22M at 1652102228 ``` Your client ID and timestamp will be different from above, but you should see a very similar message. You can also try subscribing to multiple topics and publishing to them by passing the same topic name to `client.publish`. Provided they have permission to, clients can publish to multiple topics at once or as needed. If you do not see the message you published, or you are receiving error messages, ensure that: - The `BROKER_TOKEN` environmental variable is not empty. Try echo `$BROKER_TOKEN` in your terminal. - You updated the `brokerEndpoint` to match the broker you created. The **Endpoint** field of your broker will show this address and port. - You correctly [installed MQTT.js](https://github.com/mqttjs/MQTT.js#install). ## Next Steps What's next? - [Connect a worker to your broker](/pub-sub/learning/integrate-workers/) to programmatically read, parse, and filter messages as they are published to a broker - [Learn how PubSub and the MQTT protocol work](/pub-sub/learning/how-pubsub-works) - [See example client code](/pub-sub/examples) for publishing or subscribing to a PubSub broker --- # Pulumi URL: https://developers.cloudflare.com/pulumi/ import { CardGrid, Description, Feature, LinkTitleCard, RelatedProduct } from "~/components" Create, deploy, and manage Cloudflare resources in various programming languages. Provision and manage Cloudflare using infrastructure as code through [Pulumi](https://www.pulumi.com/). With the [Pulumi Cloudflare package](https://www.pulumi.com/registry/packages/cloudflare/), you can build, deploy, and manage Cloudflare resources using standard programming languages (TypeScript, JavaScript, Python, .NET, Java, Go, and YAML). You can define the desired state for your infrastructure in code and leverage language features like loops, functions, classes, and package management. *** ## Features [Pulumi](https://github.com/pulumi/pulumi) is open source and uses the Apache 2.0 license. Use TypeScript, JavaScript, Python, Go, .Net, Java, or YAML to write Pulumi programs. Each language is as capable as the other and supports the entire [Pulumi Registry](https://www.pulumi.com/registry/). *** ## Related products Pulumi Cloud fully manages infrastructure state and secrets, provides rich search capabilities, and more. Pulumi AI is an experimental feature that lets you use natural-language prompts to generate Pulumi infrastructure-as-code programs in any language. Pulumi ESC provides centralized management of environments, secrets, and configurations. *** ## More resources To learn more about Pulumi. Report Pulumi configuration issues via GitHub. --- # Pub/Sub URL: https://developers.cloudflare.com/pub-sub/ :::note Pub/Sub is currently in private beta. Browse the documentation to understand how Pub/Sub works and integrates with our broader Developer Platform, and [sign up for the waitlist](https://www.cloudflare.com/cloudflare-pub-sub-lightweight-messaging-private-beta/) to get access in the near future. ::: Pub/Sub is Cloudflare's distributed MQTT messaging service. MQTT is one of the most popular messaging protocols used for consuming sensor data from thousands (or tens of thousands) of remote, distributed Internet of Things clients; publishing configuration data or remote commands to fleets of devices in the field; and even for building notification or messaging systems for online games and mobile apps. Pub/Sub is ideal for cases where you have many (from a handful to tens of thousands of) clients sending small, sub-1MB messages — such as event, telemetry or transaction data — into a centralized system for aggregation, or where you need to push configuration updates or remote commands to remote clients at scale. Pub/Sub: * Scales automatically. You do not have to provision "vCPUs" or "memory", or set autoscaling parameters to handle spikes in message rates. * Is global. Cloudflare's Pub/Sub infrastructure runs in [hundreds of cities worldwide](https://www.cloudflare.com/network/). Every edge location is part of one, globally distributed Pub/Sub system. * Is secure by default. Clients must authenticate and connect over TLS, and clients are issued credentials that are scoped to a specific broker. * Allows you to create multiple brokers to isolate clients or use cases, for example, staging vs. production or customers A vs. B vs. C — as needed. Each broker is addressable by a unique DNS hostname. * Integrates with Cloudflare Workers to enable programmable messaging capabilities: parse, filter, aggregate, and re-publish MQTT messages directly from your serverless code. * Supports MQTT v5.0, the most recent version of the MQTT specification, and one of the most ubiquitous messaging protocols in use today. If you are new to the MQTT protocol, visit the [How Pub/Sub works](/pub-sub/learning/how-pubsub-works/) to better understand how MQTT differs from other messaging protocols. --- # Get started URL: https://developers.cloudflare.com/pulumi/installing/ Follow the recommended steps for your operating system below. For official instructions on installing Pulumi and other install options, refer to [Install Pulumi](https://www.pulumi.com/docs/install/). :::note Pulumi is free, open source, and optionally pairs with the [Pulumi Cloud](https://www.pulumi.com/product/pulumi-cloud/) to make managing infrastructure secure, reliable, and hassle-free. ::: :::caution To avoid resource management conflicts, it’s **always** recommended to manage Pulumi-controlled resources via Pulumi. ::: ## Installation ### Mac Install via Homebrew package manager. ```sh brew install pulumi/tap/pulumi ``` ### Linux Use the installation script. ```sh curl -fsSL https://get.pulumi.com | sh ``` ### Windows 1. Download the latest installer from the [Pulumi Repository](https://github.com/pulumi/pulumi-winget/releases/latest) 2. Double click the MSI file and complete the wizard. ## Verify installation To verify your installation, run the following in the terminal: ```sh pulumi version ``` :::note[Note] For upgrades and installation alternatives, refer to [Install Pulumi](https://www.pulumi.com/docs/install/). ::: ## Next steps Follow the [Hello World tutorial](/pulumi/tutorial/hello-world/) to write a simple Pulumi program. It takes about 10 minutes to complete. --- # Demos and architectures URL: https://developers.cloudflare.com/queues/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector } from "~/components" Learn how you can use Queues within your existing application and architecture. ## Demos Explore the following demo applications for Queues. ## Reference architectures Explore the following reference architectures that use Queues: --- # Getting started URL: https://developers.cloudflare.com/queues/get-started/ import { Render, PackageManagers, WranglerConfig } from "~/components"; Cloudflare Queues is a flexible messaging queue that allows you to queue messages for asynchronous processing. By following this guide, you will create your first queue, a Worker to publish messages to that queue, and a consumer Worker to consume messages from that queue. ## Prerequisites To use Queues, you will need: ## 1. Create a Worker project You will access your queue from a Worker, the producer Worker. You must create at least one producer Worker to publish messages onto your queue. If you are using [R2 Bucket Event Notifications](/r2/buckets/event-notifications/), then you do not need a producer Worker. To create a producer Worker, run: This will create a new directory, which will include both a `src/index.ts` Worker script, and a [`wrangler.jsonc`](/workers/wrangler/configuration/) configuration file. After you create your Worker, you will create a Queue to access. Move into the newly created directory: ```sh cd producer-worker ``` ## 2. Create a queue To use queues, you need to create at least one queue to publish messages to and consume messages from. To create a queue, run: ```sh npx wrangler queues create ``` Choose a name that is descriptive and relates to the types of messages you intend to use this queue for. Descriptive queue names look like: `debug-logs`, `user-clickstream-data`, or `password-reset-prod`. Queue names must be 1 to 63 characters long. Queue names cannot contain special characters outside dashes (`-`), and must start and end with a letter or number. You cannot change your queue name after you have set it. After you create your queue, you will set up your producer Worker to access it. ## 3. Set up your producer Worker To expose your queue to the code inside your Worker, you need to connect your queue to your Worker by creating a binding. [Bindings](/workers/runtime-apis/bindings/) allow your Worker to access resources, such as Queues, on the Cloudflare developer platform. To create a binding, open your newly generated `wrangler.jsonc` file and add the following: ```toml [[queues.producers]] queue = "MY-QUEUE-NAME" binding = "MY_QUEUE" ``` Replace `MY-QUEUE-NAME` with the name of the queue you created in [step 2](/queues/get-started/#2-create-a-queue). Next, replace `MY_QUEUE` with the name you want for your `binding`. The binding must be a valid JavaScript variable name. This is the variable you will use to reference this queue in your Worker. ### Write your producer Worker You will now configure your producer Worker to create messages to publish to your queue. Your producer Worker will: 1. Take a request it receives from the browser. 2. Transform the request to JSON format. 3. Write the request directly to your queue. In your Worker project directory, open the `src` folder and add the following to your `index.ts` file: ```ts null {8} export default { async fetch(request, env, ctx): Promise { let log = { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), }; await env..send(log); return new Response('Success!'); }, } satisfies ExportedHandler; ``` Replace `MY_QUEUE` with the name you have set for your binding from your `wrangler.jsonc` file. Also add the queue to `Env` interface in `index.ts`. ```ts null {2} export interface Env { : Queue; } ``` If this write fails, your Worker will return an error (raise an exception). If this write works, it will return `Success` back with a HTTP `200` status code to the browser. In a production application, you would likely use a [`try...catch`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch) statement to catch the exception and handle it directly (for example, return a custom error or even retry). ### Publish your producer Worker With your Wrangler file and `index.ts` file configured, you are ready to publish your producer Worker. To publish your producer Worker, run: ```sh npx wrangler deploy ``` You should see output that resembles the below, with a `*.workers.dev` URL by default. ``` Uploaded (0.76 sec) Published (0.29 sec) https://..workers.dev ``` Copy your `*.workers.dev` subdomain and paste it into a new browser tab. Refresh the page a few times to start publishing requests to your queue. Your browser should return the `Success` response after writing the request to the queue each time. You have built a queue and a producer Worker to publish messages to the queue. You will now create a consumer Worker to consume the messages published to your queue. Without a consumer Worker, the messages will stay on the queue until they expire, which defaults to four (4) days. ## 4. Create your consumer Worker A consumer Worker receives messages from your queue. When the consumer Worker receives your queue's messages, it can write them to another source, such as a logging console or storage objects. In this guide, you will create a consumer Worker and use it to log and inspect the messages with [`wrangler tail`](/workers/wrangler/commands/#tail). You will create your consumer Worker in the same Worker project that you created your producer Worker. :::note Queues also supports [pull-based consumers](/queues/configuration/pull-consumers/), which allows any HTTP-based client to consume messages from a queue. This guide creates a push-based consumer using Cloudflare Workers. ::: To create a consumer Worker, open your `index.ts` file and add the following `queue` handler to your existing `fetch` handler: ```ts null {11} export default { async fetch(request, env, ctx): Promise { let log = { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), }; await env..send(log); return new Response('Success!'); }, async queue(batch, env): Promise { let messages = JSON.stringify(batch.messages); console.log(`consumed from our queue: ${messages}`); }, } satisfies ExportedHandler; ``` Replace `MY_QUEUE` with the name you have set for your binding from your `wrangler.jsonc` file. Every time messages are published to the queue, your consumer Worker's `queue` handler (`async queue`) is called and it is passed one or more messages. In this example, your consumer Worker transforms the queue's JSON formatted message into a string and logs that output. In a real world application, your consumer Worker can be configured to write messages to object storage (such as [R2](/r2/)), write to a database (like [D1](/d1/)), further process messages before calling an external API (such as an [email API](/workers/tutorials/)) or a data warehouse with your legacy cloud provider. When performing asynchronous tasks from within your consumer handler, use `waitUntil()` to ensure the response of the function is handled. Other asynchronous methods are not supported within the scope of this method. ### Connect the consumer Worker to your queue After you have configured your consumer Worker, you are ready to connect it to your queue. Each queue can only have one consumer Worker connected to it. If you try to connect multiple consumers to the same queue, you will encounter an error when attempting to publish that Worker. To connect your queue to your consumer Worker, open your Wrangler file and add this to the bottom: ```toml [[queues.consumers]] queue = "" # Required: this should match the name of the queue you created in step 3. # If you misspell the name, you will receive an error when attempting to publish your Worker. max_batch_size = 10 # optional: defaults to 10 max_batch_timeout = 5 # optional: defaults to 5 seconds ``` Replace `MY-QUEUE-NAME` with the queue you created in [step 2](/queues/get-started/#2-create-a-queue). In your consumer Worker, you are using queues to auto batch messages using the `max_batch_size` option and the `max_batch_timeout` option. The consumer Worker will receive messages in batches of `10` or every `5` seconds, whichever happens first. `max_batch_size` (defaults to 10) helps to reduce the amount of times your consumer Worker needs to be called. Instead of being called for every message, it will only be called after 10 messages have entered the queue. `max_batch_timeout` (defaults to 5 seconds) helps to reduce wait time. If the producer Worker is not sending up to 10 messages to the queue for the consumer Worker to be called, the consumer Worker will be called every 5 seconds to receive messages that are waiting in the queue. ### Publish your consumer Worker With your Wrangler file and `index.ts` file configured, publish your consumer Worker by running: ```sh npx wrangler deploy ``` ## 5. Read messages from your queue After you set up consumer Worker, you can read messages from the queue. Run `wrangler tail` to start waiting for our consumer to log the messages it receives: ```sh npx wrangler tail ``` With `wrangler tail` running, open the Worker URL you opened in [step 3](/queues/get-started/#3-set-up-your-producer-worker). You should receive a `Success` message in your browser window. If you receive a `Success` message, refresh the URL a few times to generate messages and push them onto the queue. With `wrangler tail` running, your consumer Worker will start logging the requests generated by refreshing. If you refresh less than 10 times, it may take a few seconds for the messages to appear because batch timeout is configured for 10 seconds. After 10 seconds, messages should arrive in your terminal. If you get errors when you refresh, check that the queue name you created in [step 2](/queues/get-started/#2-create-a-queue) and the queue you referenced in your Wrangler file is the same. You should ensure that your producer Worker is returning `Success` and is not returning an error. By completing this guide, you have now created a queue, a producer Worker that publishes messages to that queue, and a consumer Worker that consumes those messages from it. ## Related resources - Learn more about [Cloudflare Workers](/workers/) and the applications you can build on Cloudflare. --- # Glossary URL: https://developers.cloudflare.com/queues/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Queues documentation. --- # Cloudflare Queues URL: https://developers.cloudflare.com/queues/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Send and receive messages with guaranteed delivery and no charges for egress bandwidth. Cloudflare Queues integrate with [Cloudflare Workers](/workers/) and enable you to build applications that can [guarantee delivery](/queues/reference/delivery-guarantees/), [offload work from a request](/queues/reference/how-queues-works/), [send data from Worker to Worker](/queues/configuration/configure-queues/), and [buffer or batch data](/queues/configuration/batching-retries/). *** ## Features Cloudflare Queues allows you to batch, retry and delay messages. Redirect your messages when a delivery failure occurs. Configure pull-based consumers to pull from a queue over HTTP from infrastructure outside of Cloudflare Workers. *** ## Related products Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. Cloudflare Workers allows developers to build serverless applications and deploy instantly across the globe for exceptional performance, reliability, and scale. *** ## More resources Learn about pricing. Learn about Queues limits. Try Cloudflare Queues which can run on your local machine. Follow @CloudflareDev on Twitter to learn about product announcements, and what is new in Cloudflare Workers. Connect with the Workers community on Discord to ask questions, show what you are building, and discuss the platform with other developers. Learn how to configure Cloudflare Queues using Wrangler. Learn how to use JavaScript APIs to send and receive messages to a Cloudflare Queue. --- # Demos and architectures URL: https://developers.cloudflare.com/r2/demos/ import { ExternalResources, GlossaryTooltip, ResourcesBySelector, } from "~/components"; Learn how you can use R2 within your existing application and architecture. ## Demos Explore the following demo applications for R2. ## Reference architectures Explore the following reference architectures that use R2: --- # How R2 works URL: https://developers.cloudflare.com/r2/how-r2-works/ import { Render, LinkCard } from "~/components"; Cloudflare R2 is an S3-compatible object storage service with no egress fees, built on Cloudflare’s global network. It is [strongly consistent](/r2/reference/consistency/) and designed for high [data durability](/r2/reference/durability/). R2 is ideal for storing and serving unstructured data that needs to be accessed frequently over the internet, without incurring egress fees. It’s a good fit for workloads like serving web assets, training AI models, and managing user-generated content. ## Architecture R2’s architecture is composed of multiple components: - **R2 Gateway:** The entry point for all API requests that handles authentication and routing logic. This service is deployed across Cloudflare’s global network via [Cloudflare Workers](/workers/). - **Metadata Service:** A distributed layer built on [Durable Objects](/durable-objects/) used to store and manage object metadata (e.g. object key, checksum) to ensure strong consistency of the object across the storage system. It includes a built-in cache layer to speed up access to metadata. - **Tiered Read Cache:** A caching layer that sits in front of the Distributed Storage Infrastructure that speeds up object reads by using [Cloudflare Tiered Cache](/cache/how-to/tiered-cache/) to serve data closer to the client. - **Distributed Storage Infrastructure:** The underlying infrastructure that persistently stores encrypted object data. ![R2 Architecture](public/images/r2/r2-architecture.png) R2 supports multiple client interfaces including [Cloudflare Workers Binding](/r2/api/workers/workers-api-usage/), [S3-compatible API](/r2/api/s3/api/), and a [REST API](/api/resources/r2/) that powers the Cloudflare Dashboard and Wrangler CLI. All requests are routed through the R2 Gateway, which coordinates with the Metadata Service and Distributed Storage Infrastructure to retrieve the object data. ## Write data to R2 When a write request (e.g. uploading an object) is made to R2, the following sequence occurs: 1. **Request handling:** The request is received by the R2 Gateway at the edge, close to the user, where it is authenticated. 2. **Encryption and routing:** The Gateway reaches out to the Metadata Service to retrieve the [encryption key](/r2/reference/data-security/) and determines which storage cluster to write the encrypted data to within the [location](/r2/reference/data-location/) set for the bucket. 3. **Writing to storage:** The encrypted data is written and stored in the distributed storage infrastructure, and replicated within the region (e.g. ENAM) for [durability](/r2/reference/durability/). 4. **Metadata commit:** Finally, the Metadata Service commits the object’s metadata, making it visible in subsequent reads. Only after this commit is an `HTTP 200` success response sent to the client, preventing unacknowledged writes. ![Write data to R2](public/images/r2/write-data-to-r2.png) ## Read data from R2 When a read request (e.g. fetching an object) is made to R2, the following sequence occurs: 1. **Request handling:** The request is received by the R2 Gateway at the edge, close to the user, where it is authenticated. 2. **Metadata lookup:** The Gateway asks the Metadata Service for the object metadata. 3. **Reading the object:** The Gateway attempts to retrieve the [encrypted](/r2/reference/data-security/) object from the tiered read cache. If it’s not available, it retrieves the object from one of the distributed storage data centers within the region that holds the object data. 4. **Serving to client:** The object is decrypted and served to the user. ![Read data to R2](public/images/r2/read-data-to-r2.png) ## Performance The performance of your operations can be influenced by factors such as the bucket's geographical location, request origin, and access patterns. To further optimize R2 performance for object read requests, you can enable [Cloudflare Cache](/cache/) when using a [custom domain](/r2/buckets/public-buckets/#custom-domains). When caching is enabled, [read requests](/r2/how-r2-works/#read-data-from-r2) can bypass the R2 Gateway Worker and be served directly from Cloudflare’s edge cache, reducing latency. However, note that it may cause consistency trade-offs since cached data may not reflect the latest version immediately. ![Read data to R2 with Cloudflare Cache](public/images/r2/read-data-to-r2-with-cloudflare-cache.png) ## Learn more --- # Getting started URL: https://developers.cloudflare.com/r2/get-started/ import { Render, PackageManagers } from "~/components"; Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services.
## 1. Install and authenticate Wrangler :::note Before you create your first bucket, you must purchase R2 from the Cloudflare dashboard. ::: 1. [Install Wrangler](/workers/wrangler/install-and-update/) within your project using npm and Node.js or Yarn. 2. [Authenticate Wrangler](/workers/wrangler/commands/#login) to enable deployments to Cloudflare. When Wrangler automatically opens your browser to display Cloudflare's consent screen, select **Allow** to send the API Token to Wrangler. ```txt wrangler login ``` ## 2. Create a bucket To create a new R2 bucket from the Cloudflare dashboard: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select **R2**. 2. Select **Create bucket**. 3. Enter a name for the bucket and select **Create bucket**. ## 3. Upload your first object 1. From the **R2** page in the dashboard, locate and select your bucket. 2. Select **Upload**. 3. Choose to either drag and drop your file into the upload area or **select from computer**. You will receive a confirmation message after a successful upload. ## Bucket access options Cloudflare provides multiple ways for developers to access their R2 buckets: - [R2 Workers Binding API](/r2/api/workers/workers-api-usage/) - [S3 API compatibility](/r2/api/s3/api/) - [Public buckets](/r2/buckets/public-buckets/) --- # Cloudflare R2 URL: https://developers.cloudflare.com/r2/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Object storage for all your data. Cloudflare R2 Storage allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. You can use R2 for multiple scenarios, including but not limited to: - Storage for cloud-native applications - Cloud storage for web content - Storage for podcast episodes - Data lakes (analytics and big data) - Cloud storage output for large batch processes, such as machine learning model artifacts or datasets Get started Browse the examples --- ## Features Location Hints are optional parameters you can provide during bucket creation to indicate the primary geographical location you expect data will be accessed from. Configure CORS to interact with objects in your bucket and configure policies on your bucket. Public buckets expose the contents of your R2 bucket directly to the Internet. Create bucket scoped tokens for granular control over who can access your data. --- ## Related products A [serverless](https://www.cloudflare.com/learning/serverless/what-is-serverless/) execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure. Upload, store, encode, and deliver live and on-demand video with one API, without configuring or maintaining infrastructure. A suite of products tailored to your image-processing needs. --- ## More resources Understand pricing for free and paid tier rates. Ask questions, show off what you are building, and discuss the platform with other developers. Learn about product announcements, new tutorials, and what is new in Cloudflare Workers. --- # Pricing URL: https://developers.cloudflare.com/r2/pricing/ import { InlineBadge } from "~/components"; R2 charges based on the total volume of data stored, along with two classes of operations on that data: 1. [Class A operations](#class-a-operations) which are more expensive and tend to mutate state. 2. [Class B operations](#class-b-operations) which tend to read existing state. For the Infrequent Access storage class, [data retrieval](#data-retrieval) fees apply. There are no charges for egress bandwidth for any storage class. All included usage is on a monthly basis. :::note To learn about potential cost savings from using R2, refer to the [R2 pricing calculator](https://r2-calculator.cloudflare.com/). ::: ## R2 pricing | | Standard storage | Infrequent Access storage | | ---------------------------------- | ------------------------ | ------------------------------------------------------- | | Storage | $0.015 / GB-month | $0.01 / GB-month | | Class A Operations | $4.50 / million requests | $9.00 / million requests | | Class B Operations | $0.36 / million requests | $0.90 / million requests | | Data Retrieval (processing) | None | $0.01 / GB | | Egress (data transfer to Internet) | Free [^1] | Free [^1] | ### Free tier You can use the following amount of storage and operations each month for free. The free tier only applies to Standard storage. | | Free | | ---------------------------------- | --------------------------- | | Storage | 10 GB-month / month | | Class A Operations | 1 million requests / month | | Class B Operations | 10 million requests / month | | Egress (data transfer to Internet) | Free [^1] | ### Storage usage Storage is billed using gigabyte-month (GB-month) as the billing metric. A GB-month is calculated by averaging the _peak_ storage per day over a billing period (30 days). For example: - Storing 1 GB constantly for 30 days will be charged as 1 GB-month. - Storing 3 GB constantly for 30 days will be charged as 3 GB-month. - Storing 1 GB for 5 days, then 3 GB for the remaining 25 days will be charged as `1 GB * 5/30 month + 3 GB * 25/30 month = 2.66 GB-month` For objects stored in Infrequent Access storage, you will be charged for the object for the minimum storage duration even if the object was deleted or moved before the duration specified. ### Class A operations Class A Operations include `ListBuckets`, `PutBucket`, `ListObjects`, `PutObject`, `CopyObject`, `CompleteMultipartUpload`, `CreateMultipartUpload`, `LifecycleStorageTierTransition`, `ListMultipartUploads`, `UploadPart`, `UploadPartCopy`, `ListParts`, `PutBucketEncryption`, `PutBucketCors` and `PutBucketLifecycleConfiguration`. ### Class B operations Class B Operations include `HeadBucket`, `HeadObject`, `GetObject`, `UsageSummary`, `GetBucketEncryption`, `GetBucketLocation`, `GetBucketCors` and `GetBucketLifecycleConfiguration`. ### Free operations Free operations include `DeleteObject`, `DeleteBucket` and `AbortMultipartUpload`. ### Data retrieval Data retrieval fees apply when you access or retrieve data from the Infrequent Access storage class. This includes any time objects are read or copied. ### Minimum storage duration For objects stored in Infrequent Access storage, you will be charged for the object for the minimum storage duration even if the object was deleted, moved, or replaced before the specified duration. | Storage class | Minimum storage duration | | ------------------------------------------------------ | ------------------------ | | Standard storage | None | | Infrequent Access storage | 30 days | ## R2 Data Catalog pricing R2 Data Catalog is in **public beta**, and any developer with an [R2 subscription](/r2/pricing/) can start using it. Currently, outside of standard R2 storage and operations, you will not be billed for your use of R2 Data Catalog. We will provide at least 30 days' notice before we make any changes or start charging for usage. To learn more about our thinking on future pricing, refer to the [R2 Data Catalog announcement blog](https://blog.cloudflare.com/r2-data-catalog-public-beta). ## Data migration pricing ### Super Slurper Super Slurper is free to use. You are only charged for the Class A operations that Super Slurper makes to your R2 bucket. Objects with sizes < 100MiB are uploaded to R2 in a single Class A operation. Larger objects use multipart uploads to increase transfer success rates and will perform multiple Class A operations. Note that your source bucket might incur additional charges as Super Slurper copies objects over to R2. Once migration completes, you are charged for storage & Class A/B operations as described in previous sections. ### Sippy Sippy is free to use. You are only charged for the operations Sippy makes to your R2 bucket. If a requested object is not present in R2, Sippy will copy it over from your source bucket. Objects with sizes < 200MiB are uploaded to R2 in a single Class A operation. Larger objects use multipart uploads to increase transfer success rates, and will perform multiple Class A operations. Note that your source bucket might incur additional charges as Sippy copies objects over to R2. As objects are migrated to R2, they are served from R2, and you are charged for storage & Class A/B operations as described in previous sections. ## Pricing calculator To learn about potential cost savings from using R2, refer to the [R2 pricing calculator](https://r2-calculator.cloudflare.com/). ## R2 billing examples ### Data storage example 1 If a user writes 1,000 objects in R2 for 1 month with an average size of 1 GB and requests each 1,000 times per month, the estimated cost for the month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | ------------------------------------------- | ------------ | ----------------- | ---------- | | Class B Operations | (1,000 objects) \* (1,000 reads per object) | 10 million | 0 | $0.00 | | Class A Operations | (1,000 objects) \* (1 write per object) | 1 million | 0 | $0.00 | | Storage | (1,000 objects) \* (1 GB per object) | 10 GB-months | 990 GB-months | $14.85 | | **TOTAL** | | | | **$14.85** | | | | | | | ### Data storage example 2 If a user writes 10 objects in R2 for 1 month with an average size of 1 GB and requests 1,000 times per month, the estimated cost for the month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | ------------------------------------------- | ------------ | ----------------- | --------- | | Class B Operations | (1,000 objects) \* (1,000 reads per object) | 10 million | 0 | $0.00 | | Class A Operations | (1,000 objects) \* (1 write per object) | 1 million | 0 | $0.00 | | Storage | (10 objects) \* (1 GB per object) | 10 GB-months | 0 | $0.00 | | **TOTAL** | | | | **$0.00** | | | | | | | ### Asset hosting If a user writes 100,000 files with an average size of 100 KB object and reads 10,000,000 objects per day, the estimated cost in a month would be: | | Usage | Free Tier | Billable Quantity | Price | | ------------------ | --------------------------------------- | ------------ | ----------------- | ----------- | | Class B Operations | (10,000,000 reads per day) \* (30 days) | 10 million | 290,000,000 | $104.40 | | Class A Operations | (100,000 writes) | 1 million | 0 | $0.00 | | Storage | (100,000 objects) \* (100KB per object) | 10 GB-months | 0 GB-months | $0.00 | | **TOTAL** | | | | **$104.40** | | | | | | | ## Cloudflare billing policy To learn more about how usage is billed, refer to [Cloudflare Billing Policy](/billing/billing-policy/). ## Frequently asked questions ### Will I be charged for unauthorized requests to my R2 bucket? No. You are not charged for operations when the caller does not have permission to make the request (HTTP 401 `Unauthorized` response status code). [^1]: Egressing directly from R2, including via the [Workers API](/r2/api/workers/), [S3 API](/r2/api/s3/), and [`r2.dev` domains](/r2/buckets/public-buckets/#enable-managed-public-access) does not incur data transfer (egress) charges and is free. If you connect other metered services to an R2 bucket, you may be charged by those services. --- # Videos URL: https://developers.cloudflare.com/r2/video-tutorials/ import { CardGrid, LinkCard } from "~/components"; --- # Glossary URL: https://developers.cloudflare.com/radar/glossary/ This page provides a list of terms and concepts to help you understand Radar and the information shown. ## AI bot and crawler traffic HTTP request activity from user agents associated with AI assistants, AI data scrapers, and AI search crawlers. This information is normalized to show trends in traffic volume, providing insights into the activity levels of AI-driven web interactions over time. User agents included in this analysis are derived from the AI-focused user agents listed in the [ai.robots.txt](https://github.com/ai-robots-txt/ai.robots.txt) repository. ## Application-level attacks Layer 7 attack information based on mitigated requests, including the most frequent mitigation techniques as well as the trend of mitigated request volume over time. For the "Application layer attack volume" and "Mitigated traffic sources" graphs, the selected location or ASN is the source of the mitigated requests. For the "Application layer attack distribution" graph, the Origin Location graph shows where attacks targeting the selected location are coming from and the Target Location graph shows the target locations of attacks coming from the selected location. "Application layer attack distribution" insights are not available at an ASN level. ## Authentication methods [SPF](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#spf), [DKIM](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#dkim), and [DMARC](https://developers.cloudflare.com/dns/manage-dns-records/reference/dns-record-types/#dmarc) are policy-driven email authentication methods and when used together, they help prevent spammers, phishers, and other unauthorized parties from sending emails on behalf of a domain they do not own. PASS is the share of processed messages that pass the associated checks. FAIL is the share of processed messages that fail the associated checks. NONE is the share of processed messages for which no associated policy could be found. Data for these metrics comes from Cloudflare’s email routing service. ## Autonomous systems The Internet is a network of networks, and autonomous systems are the networks that make up the Internet. More specifically, an autonomous system (AS) is a large network or group of networks that has a unified routing policy - the process by which a path through one or more networks is chosen. Data packets hop from one AS to another until they reach their final destination. Every computer or device that connects to the Internet is connected to an AS. ISPs have one or more ASes, and each AS is assigned an official Autonomous System Number (ASN) for use in Border Gateway Protocol (BGP) routing. For example, Cloudflare's ASN is AS13335. Learn more in the [Cloudflare Learning Center](https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/). ## BGP announcements Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most efficient routes for delivering Internet traffic. A BGP announcement is a way for an AS to say to another, "When you receive traffic to this network prefix, please send it to me". That message is then processed and (possibly) forwarded to other ASes, allowing for every AS in the path to learn where to send traffic to that network prefix. Learn more in the [Cloudflare Learning Center](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/). On Cloudflare Radar, we provide time series charts for both the volume of BGP messages announced by ASes and the total size of their announced IP address space. BGP message volume shows the level of overall routing activity for a given AS, while announced IP address space indicates the size of the networks a given AS operates over time. We represent the IP address space size with the number of minimum routable network prefix sizes, which are the number of /24 prefixes for IPv4 and /48s for IPv6. Correspondingly, a /24 prefix represents 256 IP addresses while a /48 represents 2^80 IP addresses. ## BGP route leaks [BGP route leaks](https://www.rfc-editor.org/rfc/rfc7908.html) are defined as the propagation of routing announcements beyond their intended scope. In Cloudflare Radar, you can inspect the detected route leak events on the corresponding autonomous system number (ASN) pages. The columns in the table are defined as follows: * `From`: The autonomous system (AS) from which the routes are learned from. * `By`: The AS that leaked the routes, or the leaker. * `To`: The AS that received and propagated the leaked routes. * `Start` and `End`: The starting and ending time of a route leak event. * `BGP Msgs.`: The number of BGP announcements that contain leaked routes. * `Prefixes`: The number of IP prefixes a route leak event affects. * `Origins`: The number of origin ASes a route leak event affects. * `Vantage Points`: The number of route collectors that observed a route leak event. Learn more about our route leak detection system design and usages in [How we detect route leaks and our new Cloudflare Radar route leak service](https://blog.cloudflare.com/route-leak-detection-with-cloudflare-radar/) blog post. ## BGP origin hijacks [BGP origin hijack](https://www.cloudflare.com/learning/security/glossary/bgp-hijacking/) is one type of BGP anomaly where networks falsely announce ownership for groups of IP addresses (prefixes) that they do not own, control, or route to. A BGP origin hijack can redirect Internet traffic to the hijacker from its legitimate destination, causing data loss with potential leak of private/confidential information. In Cloudflare Radar, you can inspect the detected BGP origin hijack events in the "BGP Origin Hijacks" table. The columns of the table are defined as follows: * `ID`: Event ID, clickable and navigates to the event details page. * `Detected Origin`: The AS that originated the prefixes at the time of detection, potentially being a BGP hijacker. * `Expected Origin(s)`: The AS(es) that are expected to originate the corresponding prefixes based on various evidences. * `Start Time (UTC)` and `Duration`: The detected timestamp in UTC with a human-readable time duration for how long the event lasted. Ongoing events will not have a duration value, indicated by the `--` sign. * `BGP Messages`: The number of BGP messages that contain the detected anomaly. * `Prefixes`: The prefixes hijacked during the event, showing only one full prefix due to table space limitation. * `Confidence`: The level of confidence that we have on the event being a true hijacks. Values can be `High`, `Medium`, or `Low`. * `Tags`: The relevant evidence presented as short tags, presenting key facts we compiled using additional data sources, such as RPKI validation results or network relationship. You can also access the detection result programmatically via our [public API](/api/resources/radar/subresources/bgp/subresources/hijacks/subresources/events/methods/list/) ([CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/) license). ## BGP real-time routes Cloudflare Radar's prefix routing page displays real-time BGP routes as a [Sankey diagram][sankey]. This visualization is built using MRT data from [RouteViews][route-views] and [RIPE RIS][ripe-ris], combined with real-time streams from RouteViews' Kafka instance and [RIS Live][ris-live]. By default, the route visualization shows paths from the originating AS to [Tier-1 networks][tier-1], omitting the segments from Tier-1 networks to BGP route collectors for clarity. Users can choose to see the complete paths using the "Show full paths" toggle. Above the visualization, a table details the prefix origin, including the originating AS, its visibility percentage across route collectors, and [RPKI][rpki] validation status (`valid`, `invalid`, `unknown`). Hovering over a link in the diagram reveals a tooltip with the connected ASNs, the observing BGP route collectors (from [RIPE RIS][ris-collectors] and [RouteViews][route-views-collectors]), and the last update timestamp. [route-views]: https://www.routeviews.org/routeviews/ [route-views-collectors]: https://www.routeviews.org/routeviews/collectors/ [ripe-ris]: https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ [ris-live]: https://ris-live.ripe.net/ [ris-collectors]: https://ris.ripe.net/docs/route-collectors/ [sankey]: https://en.wikipedia.org/wiki/Sankey_diagram [rpki]: https://blog.cloudflare.com/rpki-details/ [tier-1]: https://en.wikipedia.org/wiki/Tier_1_network ## Certificates Encryption is a critical part of a safe Internet. SSL/TLS is the standard security technology for establishing an encrypted link between a client and a server. In Cloudflare Radar, you can view all certificates issued for a given domain by a trusted Certificate Authority that are listed in active certificate transparency logs. You can review the certificates issued for your domain name to ensure that there have been no incorrect or fraudulent issuances of certificates associated with your domains. You can also sign up to receive alerts from our certificate transparency monitor in the [Cloudflare Dashboard](https://dash.cloudflare.com/). ## Connection characteristics Share of inbound connections to Cloudflare from mail transfer agents with the given characteristics. “IP Version” breaks down connections made over IPv4 and IPv6. “Encryption” breaks down connections made over an encrypted connection using TLS, and those made over an unencrypted connection, in the clear. Data for these metrics comes from Cloudflare’s email routing service. ## Connection quality Connection quality metrics include download and upload speed, latency (round-trip time), and latency jitter (round-trip time stability), reflecting the best expected performance for specific countries or ASNs. These metrics are derived from speed tests initiated by end users on the [Cloudflare Speed Test website](https://speed.cloudflare.com/), aggregated over the previous 90 days. The underlying raw data is freely accessible for analysis through [Measurement Lab's BigQuery](https://blog.cloudflare.com/aim-database-for-internet-quality/). In speed, latency, and jitter rankings, only countries where users run speed tests with sufficient regularity are included. Consequently, certain countries may be excluded from the rankings, even though their data can be found in other sections of Radar. Cloudflare Speed Test measures latency multiple times over the course of the test. Measurements taken before a download or upload begins are aggregated into idle latency and jitter, while measurements taken while a download or upload is in progress are aggregated as loaded latency and jitter. ## Content categories Cloudflare uses a variety of data sources to categorize domains. Using Cloudflare Radar, you can view the content categories associated with a given domain. Cloudflare customers using Cloudflare Gateway or [1.1.1.1 for Families](/1.1.1.1/setup/#1111-for-families) can decide to block certain categories, like "Adult Content", in addition to security threats like malware and phishing. In some cases, a domain may be miscategorized. For example, a social media site might be categorized as "Shopping & Auctions". If you believe a domain is miscategorized, or a domain has not yet been categorized, please provide your suggested category using [this form](https://radar.cloudflare.com/domains/feedback) to bring it to our attention. ## DNS The [Domain Name System (DNS)](https://www.cloudflare.com/learning/dns/what-is-dns/) is a network service that is most commonly used to translate human-readable domain names into numerical IP addresses that computers can use to talk to each other. It is an essential Internet service, and is also used to look up other network-related information. The data displayed on Radar for DNS is based on aggregated and anonymized DNS lookups to Cloudflare's [1.1.1.1](/1.1.1.1/) public resolver service. ## Domain rankings Domain Rankings is based on our anonymized and aggregated [1.1.1.1 DNS resolver](/1.1.1.1/) data, complies with our [privacy policy](https://www.cloudflare.com/en-gb/privacypolicy/), and aims to identify the top most popular domains that reflect how people use the Internet globally. Domain Rankings’ popularity metric is best described as the estimated number of unique users that access a domain over some period of time. Trending domains are domains which are currently experiencing an increase in popularity. Domains Trending Today are domains spiking in popularity, reflecting increased interest potentially related to a particular event or a topic. Domains Trending This Week are domains that have steadily grown in popularity, reflecting an increase of their user base over the week. ## Geographical distribution Countries contributing traffic to this AS, and their relative contribution as percentage of the total AS traffic seen by Cloudflare. ## Internet outages Internet connectivity can experience outages or disruptions due to a number of factors. These factors include power outages, damage to fiber optic cables, severe weather, natural disasters, or government directed shutdowns. Outages may be sub-national or national in geographic scope, or may impact one or more [ASNs](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-an-autonomous-system/). Some outages may be brief, lasting just a few minutes, while others can stretch on for months — the duration can be related, in part, to the underlying cause. Internet outages listed in the Cloudflare Radar Outage Center are notable drops in traffic that have generally been corroborated with third party-information, which may include a social media or status page post from a telecommunications provider, a news report, or industry/community mailing lists. An early warning signal that an Internet outage may be underway on a given network or in a given country is an anomalous drop in traffic as compared to historical traffic patterns and trends. Internet anomalies listed in the Cloudflare Radar Outage Center represent an algorithmically-observed anomalous drop in traffic for the listed entity. If a given entry is marked as verified, it means that we have manually corroborated the observed drop in traffic across multiple Cloudflare data sources and/or third-party sources such as [IODA](https://ioda.inetintel.cc.gatech.edu/), or third-party sources of information, such as those listed above. In the case of the latter, an associated Internet outage event will be opened, with the event listed in the Internet Outages table (and API). ## Internet services ranking Internet services ranking is based on our anonymized and aggregated [1.1.1.1 DNS resolver](/1.1.1.1/) data, complies with our [privacy policy](https://www.cloudflare.com/en-gb/privacypolicy/), and aims to identify the top most popular Internet services that reflect how people use the Internet globally. A service represents one or more domains aggregated together. Ranking popularity metric is best described as the estimated number of unique users that access domains associated with a service, over some period of time. ## Internet traffic trends Trends observed in Internet traffic originating globally or within a given location or autonomous system within the selected time range, based on aggregated data from our network. ## IP address geolocation IP address geolocation is the term used for the process of associating an IP address with a location in the physical world. IP geolocation used on Cloudflare Radar comes from a third-party database. Note that a number of factors may affect the accuracy of the geolocation information, including mobile network architecture, the use of VPN services, and the use of privacy-protecting proxy services. Learn more from [IPinfo](https://ipinfo.io/corrections) about how to suggest a correction if you believe the location provided is incorrect. ## IPv6 adoption The IPv4 vs. IPv6 graph shows the distribution of traffic by IP version, and is intended to highlight IPv6 adoption trends. Note that prior to January 23, 2023, the IPv6 percentage shown in the chart was calculated as (IPv6 requests / IPv4+IPv6 requests). After that date, the IPv6 percentage is calculated as (IPv6 requests / requests for dual-stacked content). ## IQI The Internet Quality Index estimates connection performance under average utilization, such as web browsing. It is based on end user measurements against a fixed set of Cloudflare and third-party targets, providing numbers for bandwidth, round-trip time (latency), and DNS response time, aggregated by continent, country, or ASN. The IQI methodology requires a minimum number of measurements to generate estimates. As a result, graphs for smaller countries and ASNs may display occasional gaps, especially during nighttime. These gaps do not indicate outages. The number of measurements underlying IQI does not necessarily correlate with the volume of traffic observed by Cloudflare in a specific country or ASN. ## Leaked credentials [Leaked credentials detection](/waf/detections/leaked-credentials/) scans incoming HTTP requests for known authentication patterns from common web apps and any custom detection locations that were configured. Cloudflare Radar provides visibility into aggregate trends in authentication requests, including the detection of leaked credentials. ## Mobile operating systems The Mobile Operating Systems graph shows the distribution of mobile device requests by operating system, representing trends observed in Internet traffic originating globally or within a given location or autonomous system within the selected time range, based on aggregated data from our network. "Mobile device" includes phones and tablets only, and does not include other types of devices, such as those classified as desktops/laptops, smart TVs, or gaming consoles. ## Most observed TLDs [Top-level domains, also known as TLDs](https://www.cloudflare.com/learning/dns/top-level-domain/), are found in the right-most portion of a hostname. As of February 2024, there are nearly 1600 Top Level Domains listed in the [IANA Root Zone Database](https://www.iana.org/domains/root/db). On Radar, we are sharing our own perspective on these TLDs, highlighting those with the largest shares of spam and malicious emails. The analysis is based on the sending domain’s TLD, found in the `From:` header of an email message. Data for this metric comes from Cloudflare’s cloud email security service. ## Network-level DDoS attacks Attacks mitigated by our Level 3 and 4 Denial of Service Attack prevention systems. We show the most used attack vectors as well as the change in attack volume over the selected time range. Selected location is the location of the data center(s) where the attacks were mitigated. Target industry and vertical categories are associated with the customers being attacked. Industry categories include business types grouped by their primary activities, such as information technology and services, retail, or telecommunications. Vertical categories are high-level groupings that incorporate related industries, such as the "Internet and Telecom" vertical, which includes industries such as "Internet" and "Telecommunications". Network-level DDoS attacks graphs are based on traffic measured in bytes. ## Post-quantum encryption adoption The Post-Quantum Encryption Adoption graph shows the share of HTTPS requests to Cloudflare that are encrypted with post-quantum (PQ) cryptography. Additional details about Cloudflare's support for PQ cryptography can be found at [Cloudflare Research](https://pq.cloudflareresearch.com/). ## Robots.txt A [robots.txt](https://www.cloudflare.com/learning/bots/what-is-robots-txt/) file contains instructions for bots that tell them which webpages they can and cannot access. The data displayed for robots.txt is based on successfully parsed robots.txt files from the top 10,000 domains. From these files, we count the occurrences of each user agent under the `Allow` and `Disallow` directives. A user agent is classified as "fully allowed" or "fully disallowed" if the directive value is `*`. Otherwise, if the user agent is only allowed or disallowed to crawl specific paths, it is classified as "partially allowed" or "partially disallowed." Currently, we only include AI-focused user agents listed in the [ai.robots.txt](https://github.com/ai-robots-txt/ai.robots.txt) repository. ## TCP resets and timeouts In the Transmission Control Protocol (TCP), client-initiated connection resets (via the RST flag, TCP's "panic button") are atypical, and indicate to the server that *something went wrong* requiring the connection to be closed immediately. Similarly, connection timeouts (where the server closes a connection due to an unresponsive client) should not happen in conventional data exchanges. For comparison, a typical TCP connection consists of a 3-way handshake initiated by a client with a SYN packet to the server, then a data exchange moderated with ACK and PSH flags in the data packets, and finally a graceful close initiated from either side with a FIN packet. A FIN close is considered graceful because it ensures both sides complete their data transfer before closing the connection. In contrast, a timeout or RST flag triggers a hard stop, even if data is waiting to be sent or acknowledged. See [RFC 9293](https://datatracker.ietf.org/doc/html/rfc9293) for more details on the TCP protocol. A TCP server may see timed-out or reset connections for a variety of reasons. Some are benign, such as client applications that lose connectivity or abruptly shut down (e.g., browsers cleaning up closed tabs or port scanners). Others are more concerning, such as [DoS attacks](https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/) or third-party interference. In some cases, a close examination of the packets in a connection can help to shed light on the reason for termination. For example, [Global, Passive Detection of Connection Tampering](https://research.cloudflare.com/publications/SundaraRaman2023/) finds that certain packet patterns can be linked to middlebox connection tampering. On Cloudflare Radar’s [Security & Attacks page](https://radar.cloudflare.com/security-and-attacks), you can view statistics on resets and timeouts from a sample of TCP connections to Cloudflare’s servers, broken down by how far the connection progressed before termination. The plot lines are defined as follows: * **Post-SYN (mid-handshake)**: Connection resets or timeouts after the server received only a single SYN packet. * **Post-ACK (immediately post-handshake)**: Connection resets or timeouts after the server received both a SYN packet and an ACK packet, meaning the connection was successfully established. * **Post-PSH (after first data packet)**: Connection resets or timeouts after the server received a packet with PSH flag set, following connection establishment. The PSH flag indicates that the TCP packet contains data (such as a TLS Client Hello message) ready to deliver to the application. * **Later (after multiple data packets)**: Connection resets within the first 10 packets from the client, but after the server has received multiple data packets. * **None**: All other connections. Learn more about the TCP resets and timeouts dataset in our [blog post](https://blog.cloudflare.com/tcp-resets-timeouts). ## Threat categories Attackers use multiple types of techniques when carrying out email-based attacks, including links or attachments leading to malware; identity deception, where the message appears to be coming from a trusted contact; and brand impersonation, where the message appears to be coming from a trusted brand. Categories are assigned to the various types of threats found during the analysis of a malicious email message, and a single message can have multiple categories. These categories are aggregated into “Link”, “Attachment”, “Impersonation”, and “Other” groupings. “Link” groups individual threat types where the attacker is trying to get the user to click on something, “Attachment” groups individual threat types where the attacker has attached a file to the email message, and “Impersonation” groups individual threat types where the attacker is impersonating a trusted brand or contact. The “Other” grouping includes other threat types not covered by the previous three. The percentages represent the share of malicious email messages where the given threat categories have been found. Data for this metric comes from Cloudflare’s cloud email security service. ## Threat classification Malicious email messages may be part of a phishing campaign, where recipients are tricked into sharing personal information like login details, or they are an attempt to spread malware through embedded images, links, or attachments. The percentage shown represents the share of processed messages that are classified as malicious. Data for this metric comes from Cloudflare’s cloud email security service. ## Traffic type filter * **Human Only Traffic**: Traffic that our algorithms determine as being generated by human activity. * **Automated Only Traffic**: Traffic that our algorithms determine as being generated by bot or automated script activity. * **All Traffic**: Use all traffic, which includes both human activity and automated activity. ## Trends Based on the aggregated HTTP/s metadata we see, we are able to show trends about a diverse set of metrics, including the distribution of mobile device vs. desktop traffic, the percentage of traffic detected as coming from bots, and the distribution of user agents/browsers. We also provide insights into the usage of HTTPS and IPv6. ## Verified bots Bot traffic describes any non-human traffic to a website or an app. Some bots are useful, such as search engine bots that index content for search or customer service bots that help users. Other bots may be used to perform malicious activities, such as break into user accounts or scan the web for contact information to send spam. Verified bots, such as the ones from search engines, are usually transparent about who they are. Cloudflare manually approves well-behaved services that benefit the broader Internet and honor robots.txt. Each entry on the Verified Bots list exists because a corresponding IP address was seen associated with a verified bot in the last 30 days. A verified bot is not necessarily good or bad. ## Visitor location The data displayed on domain-specific geographic traffic patterns is based solely on data from our recursive DNS services. All data displayed is in accordance with our privacy policies and commitments. This data may include attack traffic and cross-origin requests. ## Web crawlers [Web crawlers](https://www.cloudflare.com/learning/bots/what-is-a-web-crawler/) are a type of bot that browses the Internet to collect and index website content. They are used by search engines like Google or Bing to make pages discoverable in search results. They are also used by AI platforms, either to gather content for training large language models, or to retrieve up-to-date information for AI assistants. In both search and AI cases, crawlers work by following links from one page to another, creating a map of online content. Radar's crawl-to-refer ratio metric is calculated by first mapping crawl requests for HTML pages based on the `User-Agent` header, and referral requests for HTML pages based on the `Referer` header, by platform (e.g., the ratio for Google is based on crawl requests from Googlebot, and referral requests from Google platforms). As with other traffic metrics on Radar, the aggregation resolution for the ratio data is based on the length of the selected timeframe. Additionally, note that traffic referred by native apps may not include a `Referer` header. As such, because the referral counts only include traffic from Web-based tools, these calculations may overstate the respective ratios, but it is unclear by how much. ## WHOIS WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar's WHOIS service to reveal the data behind a given domain. ## Workers AI [Workers AI](/workers-ai/) allows you to run machine learning models, on the Cloudflare network, from your own code -- whether that be from Workers, Pages, or anywhere via the Cloudflare API. The data displayed for Workers AI is based on the number of Cloudflare accounts using a model during a specific time interval. --- # Cloudflare Radar URL: https://developers.cloudflare.com/radar/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Plan, } from "~/components"; Get access to Cloudflare's data on global Internet traffic. [Cloudflare Radar](https://radar.cloudflare.com) is a hub that showcases global Internet traffic, attacks, and technology trends and insights. It is powered by data from [Cloudflare’s global network](https://www.cloudflare.com/network/), as well as aggregated and [anonymized data](/1.1.1.1/privacy/public-dns-resolver/) from Cloudflare’s [1.1.1.1 public DNS resolver](/1.1.1.1/). Using [Radar's API](/api/resources/radar/) you can access Cloudflare's data on global Internet traffic. Radar's API is free, allowing academics, technology professionals, and other web enthusiasts to investigate Internet usage across the globe. Data available via Radar API endpoints is made available under the [CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/) license. Get started Radar website --- ## Features Start learning how to use Radar's API by making your first request. What to know before making comparisons between locations, [autonomous systems](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-an-autonomous-system/), and more. Understand the security, performance, technology, and network details of a URL with a publicly shareable report. --- ## More resources Explore the diverse data available in Cloudflare Radar, including NetFlows, HTTP requests, DNS queries, and much more. Follow @CloudflareRadar on X to learn about Internet trends, as seen by the Cloudflare global network. Follow @cloudflareradar on Mastodon to learn about Internet trends, as seen by the Cloudflare global network. Follow @radar.cloudflare.com on Bluesky to learn about Internet trends, as seen by the Cloudflare global network. Read articles about the latest trends and updates on Cloudflare Radar. Enable any MCP client to access and explore trends and insights on Cloudflare Radar. --- # Release notes URL: https://developers.cloudflare.com/radar/release-notes/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Cloudflare Randomness Beacon URL: https://developers.cloudflare.com/randomness-beacon/ drand (pronounced "dee-rand") is a distributed randomness beacon daemon written in Golang. Servers running drand can be linked to each other to produce collective, publicly verifiable, unbiased, unpredictable random values at fixed intervals using bilinear pairings and threshold cryptography. drand is meant to be an Internet infrastructure level service that provides randomness to applications, similar to how NTP provides timing information and Certificate Transparency Logs provide certificate issuance information. For the most up-to-date documentation on drand, please visit [drand.love](https://drand.love). --- # Changelog URL: https://developers.cloudflare.com/realtime/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Realtime vs Regular SFUs URL: https://developers.cloudflare.com/realtime/calls-vs-sfus/ ## Cloudflare Realtime vs. Traditional SFUs Cloudflare Realtime represents a paradigm shift in building real-time applications by leveraging a distributed real-time data plane. It creates a seamless experience in real-time communication, transcending traditional geographical limitations and scalability concerns. Realtime is designed for developers looking to integrate WebRTC functionalities in a server-client architecture without delving deep into the complexities of regional scaling or server management. ### The Limitations of Centralized SFUs Selective Forwarding Units (SFUs) play a critical role in managing WebRTC connections by selectively forwarding media streams to participants in a video call. However, their centralized nature introduces inherent limitations: - **Regional Dependency:** A centralized SFU requires a specific region for deployment, leading to latency issues for global users except for those in proximity to the selected region. - **Scalability Concerns:** Scaling a centralized SFU to meet global demand can be challenging and inefficient, often requiring additional infrastructure and complexity. ### How is Cloudflare Realtime different? Cloudflare Realtime addresses these limitations by leveraging Cloudflare's global network infrastructure: - **Global Distribution Without Regions:** Unlike traditional SFUs, Cloudflare Realtime operates on a global scale without regional constraints. It utilizes Cloudflare's extensive network of over 250 locations worldwide to ensure low-latency video forwarding, making it fast and efficient for users globally. - **Decentralized Architecture:** There are no dedicated servers for Realtime. Every server within Cloudflare's network contributes to handling Realtime, ensuring scalability and reliability. This approach mirrors the distributed nature of Cloudflare's products such as 1.1.1.1 DNS or Cloudflare's CDN. ## How Cloudflare Realtime Works ### Establishing Peer Connections To initiate a real-time communication session, an end user's client establishes a WebRTC PeerConnection to the nearest Cloudflare location. This connection benefits from anycast routing, optimizing for the lowest possible latency. ### Signaling and Media Stream Management - **HTTPS API for Signaling:** Cloudflare Realtime simplifies signaling with a straightforward HTTPS API. This API manages the initiation and coordination of media streams, enabling clients to push new MediaStreamTracks or request these tracks from the server. - **Efficient Media Handling:** Unlike traditional approaches that require multiple connections for different media streams from different clients, Cloudflare Realtime maintains a single PeerConnection per client. This streamlined process reduces complexity and improves performance by handling both the push and pull of media through a singular connection. ### Application-Level Management Cloudflare Realtime delegates the responsibility of state management and participant tracking to the application layer. Developers are empowered to design their logic for handling events such as participant joins or media stream updates, offering flexibility to create tailored experiences in applications. ## Getting Started with Cloudflare Realtime Integrating Cloudflare Realtime into your application promises a straightforward and efficient process, removing the hurdles of regional scalability and server management so you can focus on creating engaging real-time experiences for users worldwide. --- # DataChannels URL: https://developers.cloudflare.com/realtime/datachannels/ DataChannels are a way to send arbitrary data, not just audio or video data, between client in low latency. DataChannels are useful for scenarios like chat, game state, or any other data that doesn't need to be encoded as audio or video but still needs to be sent between clients in real time. While it is possible to send audio and video over DataChannels, it's not optimal because audio and video transfer includes media specific optimizations that DataChannels do not have, such as simulcast, forward error correction, better caching across the Cloudflare network for retransmissions. ```mermaid graph LR A[Publisher] -->|Arbitrary data| B[Cloudflare Realtime SFU] B -->|Arbitrary data| C@{ shape: procs, label: "Subscribers"} ``` DataChannels on Cloudflare Realtime can scale up to many subscribers per publisher, there is no limit to the number of subscribers per publisher. ### How to use DataChannels 1. Create two Realtime sessions, one for the publisher and one for the subscribers. 2. Create a DataChannel by calling /datachannels/new with the location set to "local" and the dataChannelName set to the name of the DataChannel. 3. Create a DataChannel by calling /datachannels/new with the location set to "remote" and the sessionId set to the sessionId of the publisher. 4. Use the DataChannel to send data from the publisher to the subscribers. ### Unidirectional DataChannels Cloudflare Realtime SFU DataChannels are one way only. This means that you can only send data from the publisher to the subscribers. Subscribers cannot send data back to the publisher. While regular MediaStream WebRTC DataChannels are bidirectional, this introduces a problem for Cloudflare Realtime because the SFU does not know which session to send the data back to. This is especially problematic for scenarios where you have multiple subscribers and you want to send data from the publisher to all subscribers at scale, such as distributing game score updates to all players in a multiplayer game. To send data in a bidirectional way, you can use two DataChannels, one for sending data from the publisher to the subscribers and one for sending data the opposite direction. ## Example An example of DataChannels in action can be found in the [Realtime Examples github repo](https://github.com/cloudflare/calls-examples/tree/main/echo-datachannels). --- # Demos URL: https://developers.cloudflare.com/realtime/demos/ import { ExternalResources, GlossaryTooltip } from "~/components" Learn how you can use Realtime within your existing architecture. ## Demos Explore the following demo applications for Realtime. --- # Example architecture URL: https://developers.cloudflare.com/realtime/example-architecture/
![Example Architecture](~/assets/images/realtime/video-calling-application.png)
1. Clients connect to the backend service 2. Backend service manages the relationship between the clients and the tracks they should subscribe to 3. Backend service contacts the Cloudflare Realtime API to pass the SDP from the clients to establish the WebRTC connection. 4. Realtime API relays back the Realtime API SDP reply and renegotiation messages. 5. If desired, headless clients can be used to record the content from other clients or publish content. 6. Admin manages the rooms and room members. --- # Cloudflare Realtime URL: https://developers.cloudflare.com/realtime/ import { Description, LinkButton } from "~/components"; Build real-time serverless video, audio and data applications. Cloudflare Realtime is infrastructure for real-time audio/video/data applications. It allows you to build real-time apps without worrying about scaling or regions. It can act as a selective forwarding unit (WebRTC SFU), as a fanout delivery system for broadcasting (WebRTC CDN) or anything in between. Cloudflare Realtime runs on [Cloudflare's global cloud network](https://www.cloudflare.com/network/) in hundreds of cities worldwide. Get started Realtime dashboard Orange Meets demo app --- # Quickstart guide URL: https://developers.cloudflare.com/realtime/get-started/ :::note[Before you get started:] You must first [create a Cloudflare account](/fundamentals/account/create-account/). ::: ## Create your first app Every Realtime App is a separate environment, so you can make one for development, staging and production versions for your product. Either using [Dashboard](https://dash.cloudflare.com/?to=/:account/calls), or the [API](/api/resources/calls/subresources/sfu/methods/create/) create a Realtime App. When you create a Realtime App, you will get: * App ID * App Secret These two combined will allow you to make API Realtime from your backend server to Realtime. --- # Connection API URL: https://developers.cloudflare.com/realtime/https-api/ Cloudflare Realtime simplifies the management of peer connections and media tracks through HTTPS API endpoints. These endpoints allow developers to efficiently manage sessions, add or remove tracks, and gather session information. ## API Endpoints - **Create a New Session**: Initiates a new session on Cloudflare Realtime, which can be modified with other endpoints below. - `POST /apps/{appId}/sessions/new` - **Add a New Track**: Adds a media track (audio or video) to an existing session. - `POST /apps/{appId}/sessions/{sessionId}/tracks/new` - **Renegotiate a Session**: Updates the session's negotiation state to accommodate new tracks or changes in the existing ones. - `PUT /apps/{appId}/sessions/{sessionId}/renegotiate` - **Close a Track**: Removes a specified track from the session. - `PUT /apps/{appId}/sessions/{sessionId}/tracks/close` - **Retrieve Session Information**: Fetches detailed information about a specific session. - `GET /apps/{appId}/sessions/{sessionId}` [View full API and schema (OpenAPI format)](/realtime/static/calls-api-2024-05-21.yaml) ## Handling Secrets It is vital to manage App ID and its secret securely. While track and session IDs can be public, they should be protected to prevent misuse. An attacker could exploit these IDs to disrupt service if your backend server does not authenticate request origins properly, for example by sending requests to close tracks on sessions other than their own. Ensuring the security and authenticity of requests to your backend server is crucial for maintaining the integrity of your application. ## Using STUN and TURN Servers Cloudflare Realtime is designed to operate efficiently without the need for TURN servers in most scenarios, as Cloudflare exposes a publicly routable IP address for Realtime. However, integrating a STUN server can be necessary for facilitating peer discovery and connectivity. - **Cloudflare STUN Server**: `stun.cloudflare.com:3478` Utilizing Cloudflare's STUN server can help the connection process for Realtime applications. ## Lifecycle of a Simple Session This section provides an overview of the typical lifecycle of a simple session, focusing on audio-only applications. It illustrates how clients are notified by the backend server as new remote clients join or leave, incorporating video would introduce additional tracks and considerations into the session. ```mermaid sequenceDiagram participant WA as WebRTC Agent participant BS as Backend Server participant CA as Realtime API Note over BS: Client Joins WA->>BS: Request BS->>CA: POST /sessions/new CA->>BS: newSessionResponse BS->>WA: Response WA->>BS: Request BS->>CA: POST /sessions//tracks/new (Offer) CA->>BS: newTracksResponse (Answer) BS->>WA: Response WA-->>CA: ICE Connectivity Check Note over WA: iceconnectionstatechange (connected) WA-->>CA: DTLS Handshake Note over WA: connectionstatechange (connected) WA<<->>CA: *Media Flow* Note over BS: Remote Client Joins WA->>BS: Request BS->>CA: POST /sessions//tracks/new CA->>BS: newTracksResponse (Offer) BS->>WA: Response WA->>BS: Request BS->>CA: PUT /sessions//renegotiate (Answer) CA->>BS: OK BS->>WA: Response Note over BS: Remote Client Leaves WA->>BS: Request BS->>CA: PUT /sessions//tracks/close CA->>BS: closeTracksResponse BS->>WA: Response Note over BS: Client Leaves WA->>BS: Request BS->>CA: PUT /sessions//tracks/close CA->>BS: closeTracksResponse BS->>WA: Response ``` --- # Introduction URL: https://developers.cloudflare.com/realtime/introduction/ Cloudflare Realtime can be used to add realtime audio, video and data into your applications. Cloudflare Realtime uses WebRTC, which is the lowest latency way to communicate across a broad range of platforms like browsers, mobile, and native apps. Realtime integrates with your backend and frontend application to add realtime functionality. ## Why Cloudflare Realtime exists * **It is difficult to scale WebRTC**: Many struggle scaling WebRTC servers. Operators run into issues about how many users can be in the same "room" or want to build unique solutions that do not fit into the current concepts in high level APIs. * **High egress costs**: WebRTC is expensive to use as managed solutions charge a high premium on cloud egress and running your own servers incur system administration and scaling overhead. Cloudflare already has 300+ locations with upwards of 1,000 servers in some locations. Cloudflare Realtime scales easily on top of this architecture and can offer the lowest WebRTC usage costs. * **WebRTC is growing**: Developers are realizing that WebRTC is not just for video conferencing. WebRTC is supported on many platforms, it is mature and well understood. ## What makes Cloudflare Realtime unique * **Unopinionated**: Cloudflare Realtime does not offer a SDK. It instead allows you to access raw WebRTC to solve unique problems that might not fit into existing concepts. The API is deliberately simple. * **No rooms**: Unlike other WebRTC products, Cloudflare Realtime lets you be in charge of each track (audio/video/data) instead of offering abstractions such as rooms. You define the presence protocol on top of simple pub/sub. Each end user can publish and subscribe to audio/video/data tracks as they wish. * **No lock-in**: You can use Cloudflare Realtime to solve scalability issues with your SFU. You can use in combination with peer-to-peer architecture. You can use Cloudflare Realtime standalone. To what extent you use Cloudflare Realtime is up to you. ## What exactly does Cloudflare Realtime do? * **SFU**: Realtime is a special kind of pub/sub server that is good at forwarding media data to clients that subscribe to certain data. Each client connects to Cloudflare Realtime via WebRTC and either sends data, receives data or both using WebRTC. This can be audio/video tracks or DataChannels. * **It scales**: All Cloudflare servers act as a single server so millions of WebRTC clients can connect to Cloudflare Realtime. Each can send data, receive data or both with other clients. ## How most developers get started 1. Get started with the echo example, which you can download from the Cloudflare dashboard when you create a Realtime App or from [demos](/realtime/demos/). This will show you how to send and receive audio and video. 2. Understand how you can manipulate who can receive what media by passing around session and track ids. Remember, you control who receives what media. Each media track is represented by a unique ID. It is your responsibility to save and distribute this ID. :::note[Realtime is not a presence protocol] Realtime does not know what a room is. It only knows media tracks. It is up to you to make a room by saving who is in a room along with track IDs that unique identify media tracks. If each participant publishes their audio/video, and receives audio/video from each other, you have got yourself a video conference! ::: 3. Create an app where you manage each connection to Cloudflare Realtime and the track IDs created by each connection. You can use any tool to save and share tracks. Check out the example apps at [demos](/realtime/demos/), such as [Orange Meets](https://github.com/cloudflare/orange), which is a full-fledged video conferencing app that uses [Workers Durable Objects](/durable-objects/) to keep track of track IDs. --- # Limits, timeouts and quotas URL: https://developers.cloudflare.com/realtime/limits/ Understanding the limits and timeouts of Cloudflare Realtime is crucial for optimizing the performance and reliability of your applications. This section outlines the key constraints and behaviors you should be aware of when integrating Cloudflare Realtime into your app. ## Free * Each account gets 1,000GB/month of data transfer from Cloudflare to your client for free. * Data transfer from your client to Cloudflare is always free of charge. ## Limits * **API Realtime per Session**: You can make up to 50 API calls per second for each session. There is no ratelimit on a App basis, just sessions. * **Tracks per API Call**: Up to 64 tracks can be added with a single API call. If you need to add more tracks to a session, you should distribute them across multiple API calls. * **Tracks per Session**: There's no upper limit to the number of tracks a session can contain, the practical limit is governed by your connection's bandwidth to and from Cloudflare. ## Inactivity Timeout * **Track Timeout**: Tracks will automatically timeout and be garbage collected after 30 seconds of inactivity, where inactivity is defined as no media packets being received by Cloudflare. This mechanism ensures efficient use of resources and session cleanliness across all Sessions that use a track. ## PeerConnection Requirements * **Session State**: For any operation on a session (e.g., pulling or pushing tracks), the PeerConnection state must be `connected`. Operations will block for up to 5 seconds awaiting this state before timing out. This ensures that only active and viable sessions are engaged in media transmission. ## Handling Connectivity Issues * **Internet Connectivity Considerations**: The potential for internet connectivity loss between the client and Cloudflare is an operational reality that must be addressed. Implementing a detection and reconnection strategy is recommended to maintain session continuity. This could involve periodic 'heartbeat' signals to your backend server to monitor connectivity status. Upon detecting connectivity issues, automatically attempting to reconnect and establish a new session is advised. Sessions and tracks will remain available for reuse for 30 seconds before timing out, providing a brief window for reconnection attempts. Adhering to these limits and understanding the timeout behaviors will help ensure that your applications remain responsive and stable while providing a seamless user experience. --- # Pricing URL: https://developers.cloudflare.com/realtime/pricing/ Cloudflare Realtime billing is based on data sent from Cloudflare edge to your application. Cloudflare Realtime SFU and TURN services cost $0.05 per GB of data egress. There is a free tier of 1,000 GB before any charges start. This free tier includes usage from both SFU and TURN services, not two independent free tiers. Cloudflare Realtime billing appears as a single line item on your Cloudflare bill, covering both SFU and TURN. Traffic between Cloudflare Realtime TURN and Cloudflare Realtime SFU or Cloudflare Stream (WHIP/WHEP) does not get double charged, so if you are using both SFU and TURN at the same time, you will get charged for only one. ### TURN Please see the [TURN FAQ page](/realtime/turn/faq), where there is additional information on speficially which traffic path from RFC8656 is measured and counts towards billing. ### SFU Only traffic originating from Cloudflare towards clients incurs charges. Traffic pushed to Cloudflare incurs no charge even if there is no client pulling same traffic from Cloudflare. --- # Sessions and Tracks URL: https://developers.cloudflare.com/realtime/sessions-tracks/ Cloudflare Realtime offers a simple yet powerful framework for building real-time experiences. At the core of this system are three key concepts: **Applications**, **Sessions** and **Tracks**. Familiarizing yourself with these concepts is crucial for using Realtime. ## Application A Realtime Application is an environment within different Sessions and Tracks can interact. Examples of this could be production, staging or different environments where you'd want separation between Sessions and Tracks. Cloudflare Realtime usage can be queried at Application, Session or Track level. ## Sessions A **Session** in Cloudflare Realtime correlates directly to a WebRTC PeerConnection. It represents the establishment of a communication channel between a client and the nearest Cloudflare data center, as determined by Cloudflare's anycast routing. Typically, a client will maintain a single Session, encompassing all communications between the client and Cloudflare. * **One-to-One Mapping with PeerConnection**: Each Session is a direct representation of a WebRTC PeerConnection, facilitating real-time media data transfer. * **Anycast Routing**: The client connects to the closest Cloudflare data center, optimizing latency and performance. * **Unified Communication Channel**: A single Session can handle all types of communication between a client and Cloudflare, ensuring streamlined data flow. ## Tracks Within a Session, there can be one or more **Tracks**. * **Tracks map to MediaStreamTrack**: Tracks align with the MediaStreamTrack concept, facilitating audio, video, or data transmission. * **Globally Unique Ids**: When you push a track to Cloudflare, it is assigned a unique ID, which can then be used to pull the track into another session elsewhere. * **Available globally**: The ability to push and pull tracks is central to what makes Realtime a versatile tool for real-time applications. Each track is available globally to be retrieved from any Session within an App. ## Realtime as a Programmable "Switchboard" The analogy of a switchboard is apt for understanding Realtime. Historically, switchboard operators connected calls by manually plugging in jacks. Similarly, Realtime allows for the dynamic routing of media streams, acting as a programmable switchboard for modern real-time communication. ## Beyond "Rooms", "Users", and "Participants" While many SFUs utilize concepts like "rooms" to manage media streams among users, this approach has scalability and flexibility limitations. Cloudflare Realtime opts for a more granular and flexible model with Sessions and Tracks, enabling a wide range of use cases: * Large-scale remote events, like 'fireside chats' with thousands of participants. * Interactive conversations with the ability to bring audience members "on stage." * Educational applications where an instructor can present to multiple virtual classrooms simultaneously. ### Presence Protocol vs. Media Flow Realtime distinguishes between the presence protocol and media flow, allowing for scalability and flexibility in real-time applications. This separation enables developers to craft tailored experiences, from intimate calls to massive, low-latency broadcasts. --- # Simulcast URL: https://developers.cloudflare.com/realtime/simulcast/ Simulcast is a feature of WebRTC that allows a publisher to send multiple video streams of the same media at different qualities. For example, this is useful for scenarios where you want to send a high quality stream for desktop users and a lower quality stream for mobile users. ```mermaid graph LR A[Publisher] -->|Low quality| B[Cloudflare Realtime SFU] A -->|Medium quality| B A -->|High quality| B B -->|Low quality| C@{ shape: procs, label: "Subscribers"} B -->|Medium quality| D@{ shape: procs, label: "Subscribers"} B -->|High quality| E@{ shape: procs, label: "Subscribers"} ``` ### How it works Simulcast in WebRTC allows a single video source, like a camera or screen share, to be encoded at multiple quality levels and sent simultaneously, which is beneficial for subscribers with varying network conditions and device capabilities. The video source is encoded into multiple streams, each identified by RIDs (RTP Stream Identifiers) for different quality levels, such as low, medium, and high. These simulcast streams are described in the SDP you send to Cloudflare Realtime SFU. It's the responsibility of the Cloudflare Realtime SFU to ensure that the appropriate quality stream is delivered to each subscriber based on their network conditions and device capabilities. Cloudflare Realtime SFU will automatically handle the simulcast configuration based on the SDP you send to it from the publisher. The SFU will then automatically switch between the different quality levels based on the subscriber's network conditions, or the qaulity level can be controlled manually via the API. You can control the quality switching behavior using the `simulcast` configuration object when you send an API call to start pulling a remote track. ### Quality Control The `simulcast` configuration object in the API call when you start pulling a remote track allows you to specify: - `preferredRid`: The preferred quality level for the video stream (RID for the simulcast stream. [RIDs can be specified by the publisher.](https://developer.mozilla.org/en-US/docs/Web/API/RTCRtpSender/setParameters#encodings)) - `priorityOrdering`: Controls how the SFU handles bandwidth constraints. - `none`: Keep sending the preferred layer, set via the preferredRid, even if there's not enough bandwidth. - `asciibetical`: Use alphabetical ordering (a-z) to determine priority, where 'a' is most desirable and 'z' is least desirable. - `ridNotAvailable`: Controls what happens when the preferred RID is no longer available, for example when the publisher stops sending it. - `none`: Do nothing. - `asciibetical`: Switch to the next available RID based on the priority ordering, where 'a' is most desirable and 'z' is least desirable. You will likely want to order the asciibetical RIDs based on your desired metric, such as higest resoltion to lowest or highest bandwidth to lowest. ### Bandwidth Management across media tracks Cloudflare Realtime treats all media tracks equally at the transport level. For example, if you have multiple video tracks (cameras, screen shares, etc.), they all have equal priority for bandwidth allocation. This means: 1. Each track's simulcast configuration is handled independently 1. The SFU performs automatic bandwidth estimation and layer switching based on network conditions independently for each track ### Layer Switching Behavior When a layer switch is requested (through updating `preferredRid`) with the `/tracks/update` API: 1. The SFU will automatically generate a Full Intraframe Request (FIR) 2. PLI generation is debounced to prevent excessive requests ### Publisher Configuration For publishers (local tracks), you only need to include the simulcast attributes in your SDP. The SFU will automatically handle the simulcast configuration based on the SDP. For example, the SDP should contain a section like this: ```txt a=simulcast:send f;h;q a=rid:f send a=rid:h send a=rid:q send ``` If the publisher endpoint is a browser you can include these by specifying `sendEncodings` when creating the transceiver like this: ```js const transceiver = peerConnection.addTransceiver(track, { direction: "sendonly", sendEncodings: [ { scaleResolutionDownBy: 1, rid: "f" }, { scaleResolutionDownBy: 2, rid: "h" }, { scaleResolutionDownBy: 4, rid: "q" } ] }); ``` ## Example Here's an example of how to use simulcast with Cloudflare Realtime: 1. Create a new local track with simulcast configuration. There should be a section in the SDP with `a=simulcast:send`. 2. Use the [Cloudflare Realtime API](/realtime/https-api) to push this local track, by calling the /tracks/new endpoint. 3. Use the [Cloudflare Realtime API](/realtime/https-api) to start pulling a remote track (from another browser or device), by calling the /tracks/new endpoint and specifying the `simulcast` configuration object along with the remote track ID you get from step 2. For more examples, check out the [Realtime Examples GitHub repository](https://github.com/cloudflare/calls-examples/tree/main/echo-simulcast). --- # Find by solution URL: https://developers.cloudflare.com/reference-architecture/by-solution/ import { CardGrid, LinkTitleCard, Render } from "~/components"; Use the list below for reference architecture documentation that relates to a solution area you are interested in. ### Cloudflare Connectivity Cloud Content that pertains to the Cloudflare platform in general. #### Reference architectures - [Cloudflare security reference architecture](/reference-architecture/architectures/security/) - [Multi-vendor Application Security and Performance Reference Architecture](/reference-architecture/architectures/multi-vendor/) - [Protect network infrastructure with Magic Transit](/reference-architecture/architectures/magic-transit/) - [Protect Hybrid Cloud Networks with Cloudflare Magic Transit](/reference-architecture/diagrams/network/protect-hybrid-cloud-networks-with-cloudflare-magic-transit/) #### Reference architecture diagrams - [Protecting ISP and telecommunications networks from DDoS attacks](/reference-architecture/diagrams/network/protecting-sp-networks-from-ddos/) #### Design guides - [Extend Cloudflare's Benefits to SaaS Providers' End-Customers](/reference-architecture/design-guides/extending-cloudflares-benefits-to-saas-providers-end-customers/) ### Zero Trust / SASE Architecture documentation related to using Cloudflare for Zero Trust, SSE and SASE initiatives for protecting your applications, data, employees and the corporate network. #### Reference architectures - [Evolving to a SASE architecture with Cloudflare](/reference-architecture/architectures/sase/) - [Using Cloudflare SASE with Microsoft](/reference-architecture/architectures/cloudflare-sase-with-microsoft/) #### Reference architecture diagrams - [Access to private apps without having to deploy client agents](/reference-architecture/diagrams/sase/sase-clientless-access-private-dns/) - [Securing data at rest](/reference-architecture/diagrams/security/securing-data-at-rest/) - [Securing data in transit](/reference-architecture/diagrams/security/securing-data-in-transit/) - [Securing data in use](/reference-architecture/diagrams/security/securing-data-in-use/) - [Extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/) - [DNS filtering solution for Internet service providers](/reference-architecture/diagrams/sase/gateway-dns-for-isp/) - [Magic WAN Connector deployment options](/reference-architecture/diagrams/sase/magic-wan-connector-deployment/) - [Deploy self-hosted VoIP services for hybrid users](/reference-architecture/diagrams/sase/deploying-self-hosted-voip-services-for-hybrid-users/) #### Design guides - [Designing ZTNA access policies for Cloudflare Access](/reference-architecture/design-guides/designing-ztna-access-policies/) - [Building zero trust architecture into your startup](/reference-architecture/design-guides/zero-trust-for-startups/) - [Network-focused migration from VPN concentrators to Zero Trust Network Access](/reference-architecture/design-guides/network-vpn-migration/) - [Using a zero trust framework to secure SaaS applications](/reference-architecture/design-guides/zero-trust-for-saas/) #### Implementation guides - [Secure your Internet traffic and SaaS apps](/learning-paths/secure-internet-traffic/concepts/) - [Replace your VPN](/learning-paths/replace-vpn/concepts/) - [Deploy clientless access](/learning-paths/clientless-access/concepts/) - [Secure Microsoft 365 email with Email Security](/learning-paths/secure-o365-email/concepts/) ### Networking #### Reference architecture diagrams - [Protect public networks with Cloudflare](/reference-architecture/diagrams/network/protect-public-networks-with-cloudflare/) - [Bring your own IP space to Cloudflare](/reference-architecture/diagrams/network/bring-your-own-ip-space-to-cloudflare/) - [Protect hybrid cloud networks with Cloudflare Magic Transit](/reference-architecture/diagrams/network/protect-hybrid-cloud-networks-with-cloudflare-magic-transit/) - [Protect ISP and telecommunications networks from DDoS attacks](/reference-architecture/diagrams/network/protecting-sp-networks-from-ddos/) ### Application Performance Content related to DNS, caching, load balancing and other Cloudflare services designed to improve application reliability and performance. #### Reference architectures - [Content Delivery Network](/reference-architecture/architectures/cdn/) - [Load Balancing](/reference-architecture/architectures/load-balancing/) ### Application Security Content related to protecting your applications from threats such as DDoS attack, SQL injection, exploiting application vulnerabilities, scraping API data and more. #### Reference architecture diagrams - [Bot management](/reference-architecture/diagrams/bots/bot-management/) #### Design guides - [Secure application delivery](/reference-architecture/design-guides/secure-application-delivery/) #### Implementation guides - [Use mTLS with Cloudflare protected resources](/learning-paths/mtls/concepts/) ### Developer Platform Architecture content for our developer platform. #### Reference architecture diagrams ##### AI - [Automatic captioning for video uploads](/reference-architecture/diagrams/ai/ai-video-caption/) - [Composable AI architecture](/reference-architecture/diagrams/ai/ai-composable/) - [Content-based asset creation](/reference-architecture/diagrams/ai/ai-asset-creation/) - [Multi-vendor AI observability and control](/reference-architecture/diagrams/ai/ai-multivendor-observability-control/) - [Retrieval Augmented Generation (RAG)](/reference-architecture/diagrams/ai/ai-rag/) - [Ingesting BigQuery Data into Workers AI](/reference-architecture/diagrams/ai/bigquery-workers-ai/) ##### Serverless - [Optimizing Image Delivery with Cloudflare Image Resizing and R2](/reference-architecture/diagrams/content-delivery/optimizing-image-delivery-with-cloudflare-image-resizing-and-r2/) - [A/B-testing using Workers](/reference-architecture/diagrams/serverless/a-b-testing-using-workers/) - [Fullstack Applications](/reference-architecture/diagrams/serverless/fullstack-application/) - [Serverless ETL pipelines](/reference-architecture/diagrams/serverless/serverless-etl/) - [Serverless global APIs](/reference-architecture/diagrams/serverless/serverless-global-apis/) - [Serverless image content management](/reference-architecture/diagrams/serverless/serverless-image-content-management/) ##### Storage - [Egress-free object storage in multi-cloud setups](/reference-architecture/diagrams/storage/egress-free-storage-multi-cloud/) - [On-demand Object Storage Data Migration](/reference-architecture/diagrams/storage/on-demand-object-storage-migration/) - [Event notifications for storage](/reference-architecture/diagrams/storage/event-notifications-for-storage/) - [Storing User Generated Content](/reference-architecture/diagrams/storage/storing-user-generated-content/) --- # How to use URL: https://developers.cloudflare.com/reference-architecture/how-to-use/ import { CardGrid, Description, LinkTitleCard, Render } from "~/components"; The reference architecture content in our documentation is designed to help you understand how Cloudflare has been designed and built, and how our products and services integrate with your current IT architecture. Below are the different types of architecture content and information is organized from high level reference architectures, to design guides with best practices and guidelines to implementation guides which provide detailed steps to deploy a specific solution. ## Reference architectures [Reference architectures](/reference-architecture/architectures/) provide a foundational knowledge of the Cloudflare platform and products while offering a description for how they relate to your existing infrastructure and business challenges. They are high-level, conceptual documents that walk through the concepts of an area of our platform, mapping our network, products and features to the typical architecture of a customer's environment. Detailed diagrams with supporting content explain how our technology works and how it can be integrated with your own infrastructure. The goal of a reference architecture is: - Present thought leadership for a broad technology area - Visualize the architecture of Cloudflare and understand how it's been designed - Explain integration points between Cloudflare and your infrastructure ## Reference architecture diagrams A [reference architecture diagram](/reference-architecture/diagrams/) focusses on a specific solution or use case where Cloudflare can be used. One or more diagrams are the primary content with supporting introduction and summary. These can focus on sections from a reference architecture that are not fully developed. The goal of this type of document is: - Visualize the components of a specific solution's architecture - Provide a quick answer to a specific question around a use case ## Design guides These [guides](/reference-architecture/design-guides/) are typically aimed at architects, developers, and IT professionals who are tasked with designing and deploying systems that leverage the company's technologies. They typically focus on a specific solution that would be a subset of the greater architecture. For example, if you have read our [SASE Reference Architecture](/reference-architecture/architectures/sase/), but are a startup, you may want to understand the details of using a [SASE approach for a small startup](/reference-architecture/design-guides/zero-trust-for-startups/). These documents are: - Helping you think through how to design a deployment of Cloudflare as part of an overall solution. - More prescriptive than reference architectures, sharing best practices and guidelines. - Focused on a solution design that you are trying to achieve, such as connecting private networks to Cloudflare, or using a web application firewall to secure a public website. - Not a replacement for product documentation and do not describe specific product configuration or commands to run. ## Implementation guides Implementation guides provide [step-by-step instructions](/reference-architecture/implementation-guides/) and practical guidance for how to effectively deploy and configure specific solutions or services. Implementation guides are focused on a specific implementation goal. While a design guide provides the overall best practices for designing a solution, an implementation guide details the actual steps to deploy in the context of a specific job-to-be-done. These documents are: - Focused on a specific implementation outcome, such as connecting a remote office using the Magic WAN Connector. - Provide information about the exact commands and configuration steps to take. --- # Reference Architectures URL: https://developers.cloudflare.com/reference-architecture/ import { CardGrid, Description, LinkTitleCard, Render, DirectoryListing, } from "~/components"; ![Hero image](~/assets/images/reference-architecture/reference-architecture-hero.svg) All the documents in this section are designed to help you understand how Cloudflare and its products are designed and architected. These documents describe how you can leverage our platform to create solutions based on your business needs. No matter if you know Cloudflare well, or if you are just starting out. These documents help you understand how our connectivity cloud is architectured and how the services can be integrated with your own infrastructure. Read [How to use](/reference-architecture/how-to-use/) to understand how the documentation is structured, and either navigate by type from the menu or [find by solution](/reference-architecture/by-solution/) area. --- ## More resources Read articles and announcements about the latest Cloudflare products and features. Module-based guidance on Cloudflare product workflows. --- # About URL: https://developers.cloudflare.com/registrar/about/ Cloudflare Registrar offers several advantages over other [registrars](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name-registrar/), such as domain name registration renewal [without markups fees](https://www.cloudflare.com/products/registrar/). You only pay what is charged by registries and [ICANN](https://www.icann.org/). Cloudflare Registrar also offers additional security features, such as free, one-click activation for [Domain Name System Security Extensions (DNSSEC)](/registrar/get-started/enable-dnssec/), [custom domain protection](/registrar/custom-domain-protection/), and [WHOIS redaction](/registrar/account-options/whois-redaction/). You can buy your domain from Cloudflare Registrar or from a third party. Even when you buy it from a third party, you can manage your domain with Cloudflare to benefit from all the features Cloudflare offers. --- # Cloudflare Custom Domain Protection URL: https://developers.cloudflare.com/registrar/custom-domain-protection/ Cloudflare offers [Custom Domain Protection](https://www.cloudflare.com/products/registrar/custom-domain-protection/) to customers with a Cloudflare Enterprise plan and high-profile domains who need the highest level of security against domain hijacking. Custom Domain Protection offers additional safeguard features for registered domains, including: * **Registry lock**: Cloudflare applies Registry Lock, when available, to all domains registered through Custom Domain Protection. Any changes to a domain requires Cloudflare to first unlock the domain at the registry level. * **Out-of-band authentication**: All changes to domain ownership or nameserver information are verified and executed manually based on an authentication process defined by the customer. * **No interface**: Custom Domain Protection does not offer an interface, to remove the possibility of domain hijack through a compromised account. Contact your account team if you are interested in Cloudflare's Custom Domain Protection. --- # FAQ URL: https://developers.cloudflare.com/registrar/faq/ Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources. * [Domain transfers](#domain-transfers) * [Domain registrations](#domain-registrations) * [Billing](#billing) ## Domain transfers ### Why did my transfer fail? Domain transfers sometimes fail. Refer to [Registrar: troubleshoot stalled domain transfers](/registrar/troubleshooting/) for more information on what might have happened and how to solve the issue. If you cannot solve the issue, open a support ticket or contact your account team. ### ​​Why did my domain’s expiration date change after transferring it to Cloudflare? ICANN requires that any transfer also extends the expiration date of your domain by at least one year — that is one year from your current expiration date, not one year from the date of transfer. For example, if you transfer a domain on October 10, 2021, but it expires on March 10, 2022, your new expiration date will be March 10, 2023. Whenever a domain is first registered, the registrant purchases control of that domain for some number of years — up to 10 years. For example, a domain registered on October 8, 2020 will have an expiration date of October 8th in some year between 2021 and 2030, depending on the amount of years originally purchased. Transferring a domain adds time to the current expiration date, unless your domain already has [10 years on the term](#if-i-registered-my-domain-for-10-years-at-another-registrar-will-i-gain-another-year-if-i-transfer-it-to-cloudflare). ### ​​What happens to my nameservers when I transfer my domain to Cloudflare? Cloudflare Registrar only supports transfers of domains that are active on a Cloudflare [full setup](/dns/zone-setups/full-setup/). Domains on Cloudflare use [nameservers assigned by Cloudflare](/dns/zone-setups/reference/nameserver-assignment/) to the associated account and those nameservers must remain in place for the domain to be Active. ### How can I see the status of my domain transfer? Once you initiate a domain transfer, your previous registrar has five days to release the domain. In most cases, they will send you an email to confirm you want to transfer. If you actively acknowledge that email (through a link or the registrar's dashboard), they can process it immediately. To see the progress of your transfer, log in to the Cloudflare dashboard and select your account. Then, select **Domain Registration** > **Transfer Domains** to see a list of domain transfers that are in progress. To accelerate the process, be sure to check with your old registrar how you can approve the transfer out. Once successful, you will receive an email from Cloudflare and be able to manage the domain in the dashboard under **Overview** of that site. ### ​​Why am I not allowed to transfer my domain? ICANN prohibits domain transfers within 60 days of a change to the WHOIS data or registrar of a domain. If you modified your contact information, transferred registrars, or registered your domain in the last 60 days, Cloudflare will be unable to process your transfer immediately. You can leave the domain **In Progress** and Cloudflare will wait until after the 60-day window passes to attempt to process the transfer. :::note[Note] This information does not apply to `.uk` domains. ::: ### Why am I not able to start a transfer? If you have an [unverified email address](/fundamentals/user-profiles/verify-email-address/), you might experience issues when initiating a domain transfer. ### What happens if I enter the wrong auth code? If you enter an incorrect auth code (also referred to as authentication code or authorization code), return to the **Domain Registration** page or the **Overview** for your site. You can use the available input field to reenter your authentication code. ### ​​If I registered my domain for 10 years at another registrar, will I gain another year if I transfer it to Cloudflare? No. A domain cannot have more than 10 years on the term. If you registered your domain for 10 years, you will get 10 years upon transferring it to Cloudflare. *** ## Domain registrations ### My domain’s registration was not extended by one year after transferring to Cloudflare When you transfer your domain to Cloudflare, the registry will extend your registration by one year. However, in one specific circumstance your transfer could result in you keeping your original expiration date. When a domain expires, the registration enters the auto-renew grace period. During that time, you can renew the domain at your registrar to avoid losing it. If your domain expires at your current registrar, you renew it and then transfer to Cloudflare within 45 days, the registry can restrict the addition of an extra year. Say you have `example.com` registered and it expires on December 10, 2021. You decide to renew it during the auto-renew grace period on December 20, 2021. That renewal extends the registration to December 20, 2022. You then transfer to Cloudflare on December 30, 2021. Since that transfer is within 45 days of the expiration, the registry may not add the year to your registration. When you transfer to Cloudflare or any registrar in this circumstance, your expiration can still remain December 20th, 2022. If a year is not added to your registration, you have effectively paid twice for the same added year. Per ICANN rules, you are entitled to request a refund at your previous registrar. ### What Happens When a Domain Expires? In summary, here is what will happen after a domain expires: * **Day 0**: Expiration Date. * **Day 1 - 30**: Grace Period (domain resolves normally). * **Day 31 - 40**: Suspension Period (domains resolves to suspension page). * **Day 41 - 70**: Redemption Period. * **Day 71 - 75**: Pending Delete Period. Cloudflare currently offers a 40-day grace period for most top-level domains (TLDs). During this period you may renew/extend the domain at any time from within the dashboard but no further auto-renew attempts will be made. For the first 30 days of the grace period, the domain will continue to resolve as normal. On the 30th day after the expiration date, the domain will be suspended and a parked suspension page will be displayed. You may still renew the domain at any time during this suspension period. On the 40th day, the domain will enter the Redemption Period and will no longer resolve to any web page. The redemption period lasts for 30 days. During this time, it may be possible to restore and renew the domain. A restore fee may apply in addition to the renewal fee. At the end of the 30 day redemption period, the domain will be placed in pending delete status for a period of five days, after which it will be released and made available for re-registration. The domain cannot be restored or renewed during this period. If the domain is in a state where it can be restored, the Manage Domain page in the Registrar section of dash will display a message indicating the domain is restorable. You will then will be able to initiate the restore process directly from the dashboard. Cloudflare does not guarantee against domain loss in the sense of fully indemnifying you for business losses if you lose your domain. However, mechanisms are in place to alert you of domain expiration and redemption grace periods should your domain expire. You can also elect to set up your domain registration to renew automatically. For an additional layer of control over your domains, refer to [Domain Protection Service](https://www.cloudflare.com/products/registrar/custom-domain-protection/). *** ## Domain restoration ### Which domains are eligible to be restored? Domains that are in the Redemption Period and have an EPP status of redemptionPeriod may be restored. For most TLDs this will include domains that are between 40 and 70 days past expiration. Currently `.uk` domains cannot be restored using this process. We are working on an alternative process for `.uk` domains and will provide additional information at a later date. ### ​​Is there a fee to restore a domain? Yes, in most cases there is a restore fee. The amount varies depending on the TLD. The restore fee is separate from the renewal fee. You will be presented with both the restore and renewal fees before confirming they wish to proceed. ### Will the domain be renewed after the restore has completed? Yes. We will attempt to renew the domain after the restore has been completed. While not common, it is possible for the renewal transaction to fail. In the event of a failure, we will make several retry attempts. If we are unable to process the renewal after several retries, you will be presented with a message that you should contact support for assistance. ### ​​How long does the restore process take? The entire process can take a few minutes to complete. There are multiple steps to the restore process, and each step must be completed in a specific sequence. These steps are performed automatically by the system. The UI will continue to poll for an updated status and will provide feedback as each step completes. ### What happens if the domain renewal fails? The restore and the renewal are two distinct processes that happen sequentially. In rare cases the domain may be successfully restored but the renewal fails. We will make several attempts to renew the domain. However, should all the renewals fail the customer may attempt to manually renew the domain or contact support so we may investigate the cause of the failure. ### ​​Can a restore be reversed or refunded? No. Once a restore has been completed it can not be reversed. It may be possible to delete the domain again but there are no refunds. :::note[Note] Domain names should be released after a period of 75 days, although the exact deletion timeline is ultimately determined by the domain's registry. You should monitor the domain status to ascertain when it will become available for registration once again. ::: *** ## Domain deletions ### Why am I unable to delete my Registrar domain? A domain can only be deleted if all the following conditions are met: * The user initiating the action is a Super Admin or Read/Write Administrator. * The domain is not delete locked at the registry with either `clientDeleteProhibited` or `serverDeleteProhibited`. * The domain is not already in `pendingDelete`, `redemptionPeriod`, or in `pendingTransfer`. * The domain has not been administratively locked by Cloudflare. This typically occurs for legal reasons such as a UDRP filing or court order, but may also be the result of an abuse or payment investigation. * The domain is NOT a .UK domain. .UK domains currently cannot be deleted at the registry. If any of the above conditions are not met, the domain cannot be deleted. ### ​​Who has permission to delete a domain registration? Only Super Admins and Administrators with Read/Write access can initiate the deletion of a domain. Note that only Super Admins will receive the email with the delete token. ### Will I receive a refund for my deleted domain registration? No. Refunds will not be issued for costs incurred by a domain registration. ### How do I get the domain deletion token? The delete token is only sent to the Super Admins of the account. If the user requesting the deletion is not a Super Admin they will need to obtain the delete token from one of the Super Admins of the account. ### ​​How long is the domain deletion token valid for? The delete token is valid for 30 minutes. After the 30 minutes the code will expire and the user must restart the process. ### Will the domain be deleted immediately from my account? If the domain is within 5 days of the initial registration, the domain will be immediately released by the registry and made available for re-registration. In this scenario the domain will be immediately removed from the registrar section of the account. You may need to refresh the page to force an update of the data. If the domain is more than 5 days old, it will enter the redemption period and will remain in account until the redemption period expires and the registry releases the domain. *** ## Domain management ### How can I update my telephone number, email, name or address? You can update both your default contact information and any individual Registrant, Administrator, Technical or Billing contact for your domain registrations by following [Registrant contact updates](/registrar/account-options/domain-contact-updates/). Details that may be updated include name, email, address, organization and telephone number. *** ## Billing ### How much does Cloudflare Registrar cost? Refer to [What is Cloudflare Registrar](https://www.cloudflare.com/learning/dns/what-is-cloudflare-registrar/) for more information on pricing. ### When will I be billed? You will be billed when you input your authorization code and initiate the transfer of your domain to Cloudflare. Currently, Cloudflare Registrar only uses the primary payment method for any associated transaction. Make sure to copy and paste the code to avoid mistakes. The transfer will not initiate if the code is incorrect. ### ​​Is there a fee to transfer a .UK domain? No, there is no fee to transfer a `.uk` domain. Also, an additional year is NOT added during the transfer process. However, if the domain is nearing the expiration date and is set to auto-renew, it may be automatically renewed shortly after the completion of the transfer. --- # Cloudflare Registrar URL: https://developers.cloudflare.com/registrar/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Buy and renew your domain at cost with Cloudflare Registrar. Buy and manage your domain with Cloudflare Registrar, and add an additional layer of security to your DNS records for free. Cloudflare Registrar also offers redacted WHOIS information by default and will only charge you what is paid to the registry for your domain. No markup. No surprise fees. *** ## Features Buy and renew domains through Cloudflare Registrar at cost, without markup fees. You only pay what is charged by [registries and ICANN](https://www.cloudflare.com/products/registrar/). Cloudflare Registrar enrolls your domain to auto-renew by default. Unlike other registrars, your domain will only renew at the list price set by the registry. Cloudflare Registrar offers one-click DNSSEC activation. DNSSEC secures DNS records with cryptographic signatures, and is free to all Cloudflare customers. *** ## Related products When you use Cloudflare DNS, all DNS queries for your domain are answered by Cloudflare’s global anycast network. This network delivers performance and global availability. --- # Troubleshoot failed domain transfers URL: https://developers.cloudflare.com/registrar/troubleshooting/ After you start the transfer process to Cloudflare Registrar, your previous registrar has five days to release the domain after a successful transfer request. If your transfer has not been completed within that time frame, something has likely gone wrong. Most issues with a stalled transfer can be solved by checking the following details and [restarting the transfer](#restart-your-transfer). ## Registrar lock reapplied You have reapplied the registrar lock at your current registrar since requesting the transfer. You will need to remove it again to restart the transfer process. ## Transfer rejected Your transfer has been rejected by your previous registrar. There are several reasons for this to happen: * You actively rejected the transfer request in the email you received from your registrar or on your registrar’s interface. * Your registrar determined the domain is not eligible for transfer. * Some registrars allow customers to enable a setting to reject all transfer requests. * In some instances, registrars may reject the transfer if they suspect malicious behavior. You will need to restart the transfer and approve the request or contact your current registrar to solve this issue. ## Auth code invalid Your auth code (also referred to as authentication code and authorization code) has since changed or been deprecated, and Cloudflare cannot complete the transfer. Confirm the code with your current registrar again. To avoid mistakes, copy and paste the auth code provided by your current registrar. ## WHOIS Guard / privacy protection Some registrars may prohibit transfer requests if you have WHOIS privacy services enabled. You need to first disable those services at your current registrar before you can proceed with the transfer process. ## Restart your transfer :::note This solution does not apply to `.uk` domains. ::: 1. Log in to [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account. 2. Select **Domain Registration** > **Manage Domains**. 3. Find the correct domain and select **Manage**. 4. Select **Cancel Transfer and Retry**. After you initiate the retry, you must re-enter your auth code and confirm your WHOIS information. --- # Changelog URL: https://developers.cloudflare.com/rules/changelog/ import { ProductChangelog } from "~/components"; {/* */} ## 2024-09-20 **Automatic DNS Validation for Cloudflare Rules** The Cloudflare dashboard now automatically validates [DNS records](https://developers.cloudflare.com/dns/proxy-status/) and [Cloudflare for SaaS custom hostnames](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/) for rules targeting specific hostnames or URLs. To prevent misconfigured rules and ensure smoother deployments, you will get proactive warnings for missing or misconfigured DNS records and custom hostnames. ## 2024-09-17 **Compression Rules available to all plans with Zstandard support** [Compression Rules](https://developers.cloudflare.com/rules/compression-rules/) now support Zstandard compression and are available in all Cloudflare plans. Users in the Free plan will gradually get access throughout 2024. ## 2024-09-13 **Snippets now available in beta** [Cloudflare Snippets](https://developers.cloudflare.com/rules/snippets/) have transitioned from alpha to beta. ## 2024-09-10 **wildcard\_replace() function now supported in URL rewrites** You can now use the [`wildcard_replace()`](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace) function in rewrite expressions of [URL rewrites](https://developers.cloudflare.com/rules/transform/url-rewrite/). ## 2024-09-05 **New Rules Templates for one-click rule creation** The new **Rules** > **Templates** page in the Cloudflare dashboard allows you to create common rules with a single click, featuring dozens of pre-built templates. You can also access these templates directly from each product's rule builder. Also, explore the [Examples gallery](https://developers.cloudflare.com/rules/examples/) in the developer docs for real-world use cases and inspiration. ## 2024-08-22 **Simplified UI for Single Redirects with wildcard support** The simplified UI for [Single Redirects](https://developers.cloudflare.com/rules/url-forwarding/single-redirects/) is now available to all users, making URL redirects easier and more intuitive. This update builds on the recent [wildcard support](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace) in Ruleset Engine products. Access the new UI under **Rules > Redirect Rules**. Learn more about wildcard support and our open-source Rust crate in the [blog post](https://blog.cloudflare.com/wildcard-rules). ## 2024-08-20 **Cloud Connector now available to all customers** Cloud Connector (beta) is now available to all customers. For setup details, refer to the [documentation](https://developers.cloudflare.com/rules/cloud-connector/), explore [examples](https://developers.cloudflare.com/rules/cloud-connector/examples/), and check out the [blog post](https://blog.cloudflare.com/cloud-connector). ## 2024-08-16 **Cloud Connector now available to all free customers** Cloud Connector (beta) is now available to all free and a subset of paid customers. This rollout will be [gradually extended](https://developers.cloudflare.com/rules/cloud-connector/#availability) to all Cloudflare users, simplifying multi-cloud management and enhancing integration with Cloudflare's Connectivity Cloud. For more information, refer to the [blog post](https://blog.cloudflare.com/cloud-connector). ## 2024-08-12 **Cloudflare Snippets limits have been upgraded** Cloudflare Snippets (alpha) now allow multiple subrequests depending on your plan. For more information, refer to the [Availability](https://developers.cloudflare.com/rules/snippets/#availability). ## 2024-07-31 **Wildcard support added to Ruleset Engine products** Wildcards are now supported across our Ruleset Engine-based products, including Single Redirects, Cache Rules, Transform Rules, WAF, Waiting Room, and more: * You can now use the `wildcard` and `strict wildcard` operators with any string field in the Ruleset Engine, such as full URI, host, headers, cookies, user-agent, and country. For more details, refer to [Operators](https://developers.cloudflare.com/ruleset-engine/rules-language/operators/) and [Wildcard matching](https://developers.cloudflare.com/ruleset-engine/rules-language/operators/#wildcard-matching). * In [Single Redirects](https://developers.cloudflare.com/rules/url-forwarding/single-redirects/), the `wildcard_replace()` function allows you to use segments matched by the `wildcard` and `strict wildcard` operators in redirect URL targets. For more information, refer to [Functions](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#wildcard_replace). ## 2024-07-01 **Cloudflare Snippets now available to all paid customers** Cloudflare Snippets (alpha) are now available to all paid customers. ## 2024-06-03 **Cloudflare Snippets now available to all Enterprise customers** Cloudflare Snippets (alpha) are now available to all Enterprise customers. Customers in other paid plans will gradually get access throughout 2024. ## 2024-05-14 **Page Rules migration** The [Page Rules migration guide](https://developers.cloudflare.com/rules/reference/page-rules-migration/) is now available for users interested in transitioning to modern Rules features instead of Page Rules. Explore the guide for detailed instructions on migrating your configurations. ## 2024-05-13 **New Configuration Rules setting for Web Analytics (RUM)** You can now turn off Cloudflare Web Analytics, also known as Real User Monitoring (RUM), for specific requests using a configuration rule. ## 2024-04-29 **New Configuration Rules setting for Cloudflare Fonts** You can now turn on or off Cloudflare Fonts for specific requests using a configuration rule. ## 2024-03-22 **New TLS fields in rule expressions** Customers can now use new fields `cf.tls_client_hello_length` (the length of the client hello message sent in a TLS handshake), `cf.tls_client_random` (the value of the 32-byte random value provided by the client in a TLS handshake), and `cf.tls_client_extensions_sha1` (the SHA-1 fingerprint of TLS client extensions) in various products built on Ruleset Engine. ## 2024-03-20 **Origin Rules now allow port numbers in Host Header Override** Customers can now use arbitrary port numbers in Host Header Override in Origin Rules. Previously, only hostname was allowed as a value (for example, `example.com`). Now, you can set the value to `hostname:port` (for example, `example.com:1234`) as well. --- # Examples URL: https://developers.cloudflare.com/rules/examples/ import { ListExamples, GlossaryTooltip } from "~/components"; Explore the following examples for Rules. --- # Cloudflare Rules URL: https://developers.cloudflare.com/rules/ import { CardGrid, Feature, LinkTitleCard, Plan, RelatedProduct, Render, } from "~/components"; Rules features require that you [proxy the DNS records](/dns/proxy-status/) of your domain (or subdomain) through Cloudflare. --- ## Features Customize Cloudflare configuration settings for matching incoming requests. Customize the behavior of your website or application using short pieces of JavaScript code. Adjust the URI path, query string, and HTTP headers of requests and responses on the Cloudflare global network. Redirect visitors from a source URL to a target URL with a specific HTTP status code. Use Single Redirects or Bulk Redirects depending on your use case. Customize where the incoming traffic will go and with which parameters. Override request properties such as `Host` header, destination hostname, and destination port. Route matching incoming traffic from your website to a public cloud provider such as AWS, Google Cloud, and Azure. Customize the compression applied to responses from Cloudflare's global network to your website visitors, based on the file extension and content type. Trigger certain actions when a request matches a URL pattern. Modify the URLs of incoming requests so that they conform to a consistent formatting standard. Define what custom content to serve for errors returned by an origin server or by a Cloudflare product, including Workers. --- ## Related products Control incoming traffic by filtering requests to a zone. You can block or challenge incoming requests according to rules you define. Define rate limits for requests matching an expression, and the action to perform when those rate limits are reached. Customize the cache properties of your HTTP requests. Cloudflare Workers provides a serverless execution environment that allows you to create new applications or augment existing ones without configuring or maintaining infrastructure. --- ## More resources Compare available Cloudflare plans --- # Cloudflare Ruleset Engine URL: https://developers.cloudflare.com/ruleset-engine/ import { LinkButton } from "~/components"; The Cloudflare Ruleset Engine allows you to create and deploy rules and rulesets in different Cloudflare products using the same basic syntax. ## Main features - **Powerful syntax**: Rule expressions use a powerful Rules language similar to the wirefilter syntax that allows you to create complex rules. - **High-performance rule evaluation**: Allows you to have many rules in different Cloudflare products with almost no impact on performance. - **Engine powering different Cloudflare products**: Cloudflare keeps building products on top of the Ruleset Engine, which means that you can use the same API methods for configuring different products, with the same customization possibilities. Additionally, the Ruleset Engine supports the different phases of the request life cycle at Cloudflare. ## Availability The Ruleset Engine supports different Cloudflare products. Refer to [Phases list](/ruleset-engine/reference/phases-list/) and to each product's documentation for details. --- # Secrets Store access control URL: https://developers.cloudflare.com/secrets-store/access-control/ Secrets Store allows security administrators to have more control by implementing role-based access. For details about roles at Cloudflare, refer to [Fundamentals](/fundamentals/manage-members/). :::note[Availability] While all Cloudflare accounts will have access to the Secrets Store section on the dashboard, only users with the necessary permissions will be able to interact with it, as described below. ::: ## Relevant roles for Secrets Store Refer to the list below for default role definitions. - **Super Administrator**: Can create, edit, duplicate, delete, and view secrets metadata. Can also [add a Secrets Store binding to a Worker](/secrets-store/integrations/workers/). - **Secrets Store Admin**: Can create, edit, duplicate, delete, and view secrets metadata. - **Secrets Store Deployer**: Can view secrets metadata but cannot create, edit, duplicate, nor delete secrets. Can also [add a Secrets Store binding to a Worker](/secrets-store/integrations/workers/). - **Secrets Store Reporter**: Can view secrets metadata. Cannot perform any actions (create, edit, duplicate, delete secrets), nor add a Secrets Store binding to a Worker. ## API token permissions The following API token permissions can also be used to grant access to Secrets Store resources. - **Account Secrets Store Edit**: Allows a user to create, edit, duplicate, or delete secrets. - **Account Secrets Store Read**: Allows a user to view secrets metadata. --- # Audit logs URL: https://developers.cloudflare.com/secrets-store/audit-logs/ [Audit logs](/fundamentals/account/account-security/review-audit-logs/) provide a comprehensive summary of changes made within your Cloudflare account. This page lists the actions that are logged for Secrets Store. - Access - Create - Duplicating a secret is presented as a `create` log with a field `duplicated_from_id`. - Update - A boolean `"value_modified": true` is presented when the secret value is edited. - Delete For information on how to access and use audit logs, refer to [Fundamentals](/fundamentals/account/account-security/review-audit-logs/). --- # Cloudflare Secrets Store URL: https://developers.cloudflare.com/secrets-store/ import { Description, Plan } from "~/components"; Encrypt and store sensitive information as secrets that are securely reusable across your account. Cloudflare Secrets Store is a secure, centralized location in which account-level secrets are stored and managed. The secrets are securely encrypted and stored across all [Cloudflare data centers](https://www.cloudflare.com/network/). Secrets Store is currently [compatible with Cloudflare Workers](/secrets-store/integrations/workers/). Integrations with other products will be added in the future. :::note[China availability] Secrets Store is unavailable in the [Cloudflare China Network](/china-network/), operated by Cloudflare's partner JD Cloud. ::: --- # Security analytics (new dashboard) URL: https://developers.cloudflare.com/security/analytics/ import { GlossaryTooltip } from "~/components"; Security analytics shows information about all incoming HTTP requests or only about requests mitigated by Cloudflare. Use Security analytics as your starting point to understand and analyze traffic patterns, and to create security rules based on the filters you applied. By default, Security Analytics queries filter on `requestSource = 'eyeball'`, which represents requests from end users. Note that requests from Cloudflare Workers (subrequests) are not visible in Security Analytics. Security analytics is available in **Security** > **Analytics**. ## Traffic The **Traffic** tab displays information about all incoming HTTP requests for your domain, including requests not handled by Cloudflare security products. In this tab you can perform several tasks: - View the traffic distribution for your domain. - Understand which traffic is being mitigated by Cloudflare security products, and where non-mitigated traffic is being served from (Cloudflare global network or [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/)). - Analyze suspicious traffic and create tailored custom [security rules](/security/rules/) based on applied filters. - [Find an appropriate rate limit](/waf/rate-limiting-rules/find-rate-limit/) for incoming traffic. For information on how to use the **Traffic** tab, refer to [Security Analytics](/waf/analytics/security-analytics/#adjusting-displayed-data). If you need to modify existing security-related rules you already configured, consider also using the [Events](#events) tab. This tab displays information about requests affected by Cloudflare security products. :::note The **Traffic** tab includes functionality available in the [Security Analytics](/waf/analytics/security-analytics/) page in the previous dashboard navigation structure. ::: ## Events Use the **Events** tab to review mitigated requests and to tailor your security configurations. The **Events** tab displays information about requests actioned or flagged by Cloudflare security products. Each incoming HTTP request might generate one or more security events. The tab only shows these events, not the HTTP requests themselves. To obtain information on all incoming HTTP requests, use the [Traffic](#traffic) tab. Users on a Free plan can view summarized events by date in sampled logs. Customers on paid plans have access to additional graphs and dashboards that summarize the most relevant information about the current behavior of Cloudflare's security features on your domain. For more information on the **Events** tab, refer to [Security Events](/waf/analytics/security-events/). :::note The **Events** tab corresponds to the [Security Events](/waf/analytics/security-events/) page in the previous dashboard navigation structure. ::: --- # Application security dashboard (beta) URL: https://developers.cloudflare.com/security/ import { Card, CardGrid, Feature, LinkTitleCard, RelatedProduct, } from "~/components"; The application security dashboard (beta) is your starting point to better understand the security posture of your web applications, and to configure rules to protect them. The new **Security** navigation in the Cloudflare dashboard is currently available in beta for users that opt in to the new user interface. To opt in: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. 2. Open any page under **Security**. 3. In the top right-hand corner of the page, select **Try new dashboard**. You can swap back to the previous dashboard at any time by selecting **Return to old dashboard** in the same page location. ## Features Get a high-level overview of your domain's security posture. Shows information about all incoming HTTP requests or mitigated requests (rule matches). Tailor your security configurations based on sampled logs. Discover your web assets (including API endpoints) and instruct Cloudflare how to best protect them. Perform security actions on incoming requests that match specified filters. --- ## More resources Compare available Cloudflare plans --- # Security overview URL: https://developers.cloudflare.com/security/overview/ Security overview provides a high-level overview of your domain. It allows you to identify security action items and review the security posture of your domain. The Security overview page displays the following information: - If you are on a Free plan, the dashboard will display **Traffic last 24 hours**, which allows you to review traffic from the 24 hours that has been mitigated by Cloudflare. If you are on a Business, Pro, or Enterprise plan, the dashboard will display **Traffic last 7 days**, which allows you to review traffic from the last seven days that has been mitigated by Cloudflare. - **Modules**: The dashboard will display suggestions categorized on your security module. - **All suggestions**: The dashboard displays a list of suggestions to improve your security posture. Suggestions include: - Web application exploits - DDoS attacks - Bot traffic - API abuse - Client-side abuse - Domain settings - Web assets and endpoints - Rule templates - Detections --- # Security rules URL: https://developers.cloudflare.com/security/rules/ Security rules perform security-related actions on incoming requests that match specified filters. Rules are evaluated and executed in order, from first to last. Security rules are available in the new security dashboard in **Security** > **Security rules**. ## Security rules The **Security rules** tab includes a list of different types of rules configured in your domain / zone to protect your applications and resources. To create a security rule: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account and domain. 2. Go to **Security** > **Security rules**. 3. (Optional) Select **Templates**, and then select a template from the list. You can customize the default configuration of the template before deploying the new rule. Refer to the resources listed in the next step. 4. Select **Create rule** > select the type of rule you want to create. Refer to the following resources about each rule type: - [Custom rules](/waf/custom-rules/create-dashboard/#rule-form) - [Rate limiting rules](/waf/rate-limiting-rules/create-zone-dashboard/#rule-form) - [API sequence rules](/api-shield/security/sequence-mitigation/#rule-form) - [API JWT validation rules](/api-shield/security/jwt-validation/#rule-form) (requires a [token configuration](/security/settings/#all-settings)) - [Managed rules exceptions](/waf/managed-rules/waf-exceptions/define-dashboard/#2-define-basic-exception-parameters) - [Content security rules](/page-shield/policies/create-dashboard/#rule-form) (previously known as Page Shield policies) :::note[Notes] The **Security rules** tab includes functionality available in different products in the previous dashboard navigation structure, such as the [WAF](/waf/), [API Shield](/api-shield/), and [Page Shield](/page-shield/). The tab may show additional rule types if you have configured at least one of the following: - [IP access rules](/waf/tools/ip-access-rules/) - [User agent blocking rules](/waf/tools/user-agent-blocking/) - [Zone lockdown rules](/waf/tools/zone-lockdown/) ::: ## DDoS protection The **DDoS Protection** tab shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription. To learn more about DDoS protection overrides, refer to the following resources: - [HTTP DDoS attack protection overrides](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/) - [Network-layer DDoS attack protection overrides](/ddos-protection/managed-rulesets/network/network-overrides/override-expressions/) :::note You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level in Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**. ::: --- # Security settings URL: https://developers.cloudflare.com/security/settings/ This page describes the settings available in **Security** > **Settings** for a given domain. ## Security modules ### Web application exploits module In the **Web application exploits** security module you can enable and configure the following managed rulesets and detections: - [Cloudflare Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) - [Cloudflare OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/) - [Leaked credentials detection](/waf/detections/leaked-credentials/) - [Malicious upload detection](/waf/detections/malicious-uploads/) - [Sensitive data detection ruleset](/waf/managed-rules/reference/sensitive-data-detection/) - [Firewall for AI](/waf/detections/firewall-for-ai/) Refer to each linked page for details. :::note The web application exploits module includes features and settings from the [Cloudflare WAF](/waf/) in the previous dashboard navigation structure. ::: ### DDoS attacks module The **DDoS protection** security module shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription. To learn more about DDoS protection overrides, refer to the following resources: - [HTTP DDoS attack protection overrides](/ddos-protection/managed-rulesets/http/http-overrides/override-expressions/) - [Network-layer DDoS attack protection overrides](/ddos-protection/managed-rulesets/network/network-overrides/override-expressions/) :::note You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level in Account Home > **L3/4 DDoS** > **Network-layer DDoS Protection**. ::: ### Bot traffic module In the **Bot traffic** security module you can perform the following tasks: - Enable [Bot fight mode](/bots/get-started/bot-fight-mode/) (depending on your Cloudflare plan). - Enable [Super Bot fight mode](/bots/get-started/super-bot-fight-mode/) (depending on your Cloudflare plan). - Review information about [Bot Management](/bots/get-started/bot-management/) (always enabled if included in your Enterprise subscriptions). - Turn on [Block AI Bots](/bots/concepts/bot/#ai-bots). - Turn on [AI Labyrinth](/bots/additional-configurations/ai-labyrinth/). :::note The bot traffic module includes features and settings from [Bots](/bots/) in the previous dashboard navigation structure. ::: ### API abuse module In the **API abuse** security module you can perform the following tasks: - Review information about [Endpoint Discovery](/api-shield/security/api-discovery/) (always enabled if included in your Enterprise subscriptions). - Enable [Sequence Discovery](/api-shield/security/sequence-analytics/) (requires that you configure a session identifier). - Enable [Schema Validation](/api-shield/security/schema-validation/) (requires that you upload a schema or apply a learned schema). - Enable [JWT Validation](/api-shield/security/jwt-validation/) (requires that you add a [JWT configuration](/api-shield/security/jwt-validation/api/#token-configurations)). :::note The API abuse module includes features and settings from [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ### Client-side abuse module In the **Client-side abuse** security module you can perform the following tasks: - Turn [continuous script monitoring](/page-shield/how-it-works/) on or off (previously you turned [Page Shield](/page-shield/) on or off). - Create a [client-side resource alert](/page-shield/alerts/) (also known as a Page Shield alert). - Set the [reporting endpoint](/page-shield/reference/settings/#reporting-endpoint) to use your hostname instead of a Cloudflare-owned endpoint (only for Enterprise customers with a paid add-on). - Adjust the [data logged in client-side abuse reports](/page-shield/reference/settings/#connection-target-details) (only the hostname or the full URI). :::note The client-side abuse module includes features and settings from [Page Shield](/page-shield/) in the previous dashboard navigation structure. ::: ## All settings This section allows you to configure multiple security-related settings. The following table links to additional information about each setting: | Setting | Location in previous dashboard navigation | | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Endpoint labels](/api-shield/management-and-monitoring/endpoint-labels/) | **Security** > **Settings** > **Labels** | | [Session identifiers](/api-shield/management-and-monitoring/session-identifiers/#rule-form) | **Security** > **API Shield** > **Settings** | | [Schemas default action](/api-shield/security/schema-validation/#change-the-global-default-action-of-schema-validation) | **Security** > **API Shield** > **Schema Validation** | | [Uploaded schemas](/api-shield/security/schema-validation/) | **Security** > **API Shield** > **Schema Validation** | | [Learned schemas](/api-shield/security/schema-validation/) | **Security** > **API Shield** > **Schema Validation** | | [Token configuration](/api-shield/security/jwt-validation/#add-a-token-validation-configuration) | **Security** > **API Shield** > **Settings** | | [Client-side resource alerts](/page-shield/alerts/configure/) | **Security** > **Page Shield** > **Settings**
Account Home > **Notifications** | | [Reporting endpoint](/page-shield/reference/settings/#reporting-endpoint) | **Security** > **Page Shield** > **Settings** | | [Data processing](/page-shield/reference/settings/#connection-target-details) | **Security** > **Page Shield** > **Settings** | | [IP lists](/waf/tools/lists/custom-lists/#ip-lists) | Account Home > **Manage Account** > **Configurations** | | [Custom username and password location](/waf/detections/leaked-credentials/#custom-detection-locations) | **Security** > **Settings** | | [Custom content location](/waf/detections/malicious-uploads/#custom-scan-expressions) | **Security** > **Settings** | | [Custom sensitive data deployment](/waf/managed-rules/reference/sensitive-data-detection/#configure-in-the-dashboard) | **Security** > **Sensitive Data** | | [Block definitely automated traffic](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Block likely bots](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Managed `robots.txt`](/bots/additional-configurations/managed-robots-txt/) | **Security** > **Bots** > **Configure Bot Fight Mode
Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Allow verified bots](/bots/get-started/super-bot-fight-mode/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Static resource protection](/bots/additional-configurations/static-resources/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Optimize for WordPress](/bots/troubleshooting/wordpress-loopback-issue/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [JavaScript detections](/bots/additional-configurations/javascript-detections/) | **Security** > **Bots** > **Configure Super Bot Fight Mode
Security** > **Bots** > **Configure Bot Management** | | [Auto-update machine learning model](/bots/reference/machine-learning-models/) | **Security** > **Bots** > **Configure Bot Management** | | [Enable Security.txt](/security-center/infrastructure/security-file/) | **Security** > **Settings** | | [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/challenge-passage/) | **Security** > **Settings** | | [Browser Integrity Check](/waf/tools/browser-integrity-check/) | **Security** > **Settings** | | [Replace insecure JavaScript libraries](/waf/tools/replace-insecure-js-libraries/) | **Security** > **Settings** | | [Security Level](/waf/tools/security-level/) | **Security** > **Settings** | --- # Web assets URL: https://developers.cloudflare.com/security/web-assets/ Discover web assets such as your API endpoints and instruct Cloudflare how to best protect them. ## Endpoints Use the **Endpoints** tab to manage endpoints available on your domain and monitor their health. You can save endpoints directly from [API Discovery](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-api-discovery), [manually](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-manually) by method, path, and host, or via [Schema Validation](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-schema-validation). This will add the specified endpoints to your list of managed endpoints. You can view your list of managed endpoints in the **Endpoints** tab. For saved endpoints: - Cloudflare will start collecting [performance data](/api-shield/management-and-monitoring/endpoint-management/#endpoint-analysis) per endpoint. - You can use the [labeling service](/api-shield/management-and-monitoring/endpoint-labels/) to organize your endpoints by use case. For more information on how to manage your endpoints, refer to the following resources. - [Endpoint Management](/api-shield/management-and-monitoring/endpoint-management/) - [Schema learning](/api-shield/management-and-monitoring/endpoint-management/schema-learning/) - [Endpoint Analysis](/api-shield/management-and-monitoring/endpoint-management/#endpoint-analysis) ## Discovery **Discovery** continuously finds your active API endpoints via path normalization. [Add endpoints](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-api-discovery) to produce recommendations and analytics of your APIs. Your [session identifiers](/api-shield/management-and-monitoring/session-identifiers/) must match your API traffic. Otherwise, API endpoints are also discoverable via [Machine Learning](/api-shield/security/api-discovery/#machine-learning-based-discovery). :::note **Discovery** is only available for Enterprise customers. If you are an Enterprise customer and interested in this product, contact your account team. ::: ## Sequences Use **Sequences** to discover how users interact with your API, by tracking the order of API session requests over time. Sequences will group and highlight popular user journeys across your API. Once you configure [session identifiers](/api-shield/management-and-monitoring/session-identifiers/), the **Sequences** tab will start grouping and highlighting important user journeys (sequences) across your API. To configure session identifiers, go to **Security** > **Settings** > **All settings** tab and select **Edit** next to **Session identifiers**. For more information on how Cloudflare identifies API sequences and how you can configure API sequence rules, refer to the following resources: - [Sequence analytics](/api-shield/security/sequence-analytics/) - [Sequence mitigation](/api-shield/security/sequence-mitigation/) :::note The **Sequences** tab includes functionality available in [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ## Schema validation Use **Schema validation** to check if your incoming traffic complies with a previously supplied API Schema. API Schemas are defined by the validity of the API request's properties such as target endpoint, path or query variable format, and HTTP method. A rule is created for incoming traffic and defines which traffic is allowed and which traffic is logged or blocked based on the API schema that you provide or select from the list of learned schemas. You can add schema validation by: - [Uploading a schema](/api-shield/security/schema-validation/#add-validation-by-uploading-a-schema) - [Applying a learned schema to a single endpoint](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-a-single-endpoint) - [Applying a learned schema to an entire hostname](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-an-entire-hostname) - [Adding a fallthrough rule](/api-shield/security/schema-validation/#add-validation-by-adding-a-fallthrough-rule) :::note The **Schema validation** tab includes functionality available in [API Shield](/api-shield/) in the previous dashboard navigation structure. ::: ## Client-side resources Use **Client-side resources** to [monitor scripts, connections, and cookies](/page-shield/detection/monitor-connections-scripts/) on your domain. If you notice unexpected scripts or connections on the dashboard, check them for signs of malicious activity. You should also check for any new or unexpected cookies. Enterprise customers with a paid add-on will have their connections and scripts [classified as potentially malicious](/page-shield/how-it-works/malicious-script-detection/) based on threat feeds. :::note The **Client-side resources** tab includes functionality available in [Page Shield](/page-shield/) in the previous dashboard navigation structure. ::: --- # Security reports URL: https://developers.cloudflare.com/security-center/app-security-reports/ :::note Currently, this feature is only available to Enterprise customers. ::: Application security reports provide visibility into requests blocked or challenged by the Cloudflare Application Security suite of products. These reports allow you to get insights and analyze trends for all the zones in your account on a monthly basis, covering the mitigation actions performed by all Cloudflare layer 7 (application layer) security products. Each report includes an overview section and a per-product breakdown. Cloudflare automatically generates a report every month, usually within the first five days of the month. To dive deeper into the mitigations performed by Cloudflare security products, use the [Security Analytics](/waf/analytics/security-analytics/) dashboard. ## Download a report To download a monthly application security report: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com) and select your account. 2. Go to **Security Center** > **Security Reports**. 3. For a given month and year, select **Download** to download the report for that particular month. :::caution Due to limitations in the current reporting solution, some customers do not have access to reports from the past few months. We are working on a new version of app security reports without the current limitations. ::: *** ## Required roles A Cloudflare user must have one of the following [roles](/fundamentals/manage-members/roles/) to download application security reports: * Super Administrator * Administrator ## Number of mitigated requests As of the April 2023 report, the number of mitigated requests in each report is a sum of the following requests: * Blocked requests * Challenged requests that were not solved or bypassed (that is, not issued again because the visitor had previously passed a similar challenge) --- # Blocked Content URL: https://developers.cloudflare.com/security-center/blocked-content/ If your domain has content that has been blocked, Blocked Content on the dashboard gives you the ability to request the Trust and Safety team to remove a block. To view Blocked Content on the dashboard: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Security Center** > **Blocked Content**. :::note You must have Admin, Super Admin, or Trust and Safety [role](/fundamentals/manage-members/roles/) to access Blocked Content. ::: The Security Center dashboard displays three statuses for blocked content: active, pending, or resolved blocks. ## Active blocks An active block is a block that is in effect on blocking content. When you select **Request Review**, the status changes to **In Review**, and the block will be reviewed by the Trust and Safety team. ## Pending blocks A pending block represents a blocking action Cloudflare will take at the scheduled time. You can view all your pending blocks by selecting **Pending** on the dashboard. Selecting **Request Review** cancels the pending delayed action. This means that the block will not be placed. ## Resolved blocks Resolved blocks list your recently resolved blocks. Resolved blocks are limited to 30 days of recently resolved blocks. Resolved blocks require no action. You can only sort and/or filter the list. --- # Brand Protection URL: https://developers.cloudflare.com/security-center/brand-protection/ import { AvailableNotifications, Render } from "~/components" :::note[User permission] While the Brand Protection tool is in beta, all Cloudflare Enterprise customers have automatic access to Brand Protection, including five saved queries. Only Admin, Super Admin and users with a Brand Protection role can access Brand Protection ::: ## Domain search To start searching for new domains that might be trying to impersonate your brand: 1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to **Security Center** > **Brand Protection**. 3. In **String query**, provide a name for your query. You can add multiple brand phrases on the same query, and the results will generate matches for all of those. Once you entered the string queries, select **Search matches**. 4. In the **Character distance**, select from `0-3`. The number of characters the results can differ from your domain. :::note If a brand phrase or search term has less than five characters, you can only choose a max distance of `0` (zero). ::: 5. You can select **Save query** to monitor it in the future and perform other actions, such as delete, clone and set up alerts, according to your Paid plan limits. 6. To export all matches from a saved query, select your **Query name** > select the three dots > **Export matches**. In the section **Monitor Strings**, you can check all the string queries that you selected to monitor. You can delete, clone, or create notifications for a string query. Refer to [Brand Protection Alerts](#brand-protection-alerts) to set up notifications. ### Report abuse :::note[Submit abuse report] You can only submit an abuse report if your domain is with [Cloudflare Registrar](https://www.cloudflare.com/products/registrar/), or if the IP used by the domain is hosted by Cloudflare. ::: To submit abuse reports directly from the dashboard: 1. Go to the **Query name** you want to report. 2. Select **Report to Cloudflare**. 3. Fill in the details to submit an abuse report. 4. Select **Submit**. ## Logo queries To set up a new logo query: 1. Go to **Security Center** > **Monitor Logos** and select **Add logo**. 2. Add a name for your query and upload your logo. Only the `.png`, `.jpeg`, and `.jpg` file extensions are supported. 3. Select **Save logo**. The browser will return to the **Monitor Images** overview page, where you can access your query and configure notifications. ## Investigate a query In this section, the dashboard displays: - **Domain overview** where you can request to [change categorization](/security-center/investigate/change-categorization/) and view the resolution history of your domain for up to seven days. - **WHOIS** that provides details about the date the domain was created, registrant and nameservers. - **Domain history** that provides information on the domain category and when it was last changed. Refer to [Investigate threats](/security-center/investigate/investigate-threats/) for more details. - **URL Reports** that provides information on any reported URL. To investigate a string query: 1. Go to the **Monitor Strings** or **Monitor Logos** section to view all your queries. 2. Select a monitored query to inspect all the domains that matched your query. 3. Next to the domain, select **Domain** or **URL**. This will trigger a search on the [**Investigate**](/security-center/investigate/) section in a separate tab. URL scanner will also be triggered from **Brand Protection** through **Security Center** > **Investigate**. You will also have access to a report which will be generated automatically. The report will display screenshots of the matched domain, and the registrar of your domain. ## Brand Protection Alerts To set up a Brand Protection Alert: 1. Go to **Monitor Strings** and locate the query for which you would like to create notifications. 2. Select **alerts**. This should redirect you to the **Add Notification** page, where you can configure what you want to be notified about, and how. :::note You can also set up the alerts from your [Notifications](/notifications/) menu. ::: 3. Create a notification name, add a description (optional), and select the monitored queries. You can also add a Webhook, and a notification email. You can add multiple email addresses. 4. Select **Save**. Manage your notifications in the **All notifications** tab. You can disable, edit, delete, or test them. ## Limitations * While this product is in beta, all Enterprise customers and Cloudforce One subscribers have access to Brand Protection. Enterprise customers are entitled to five saved queries for their account. * You may only use the Brand Protection search tools to search for domains that may be attempting to impersonate your brand or a brand that has authorized you to conduct such search on its behalf. --- # Changelog URL: https://developers.cloudflare.com/security-center/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Cloudflare Security Center URL: https://developers.cloudflare.com/security-center/ import { LinkButton, Render } from "~/components" ## Main features Get started *** ## Availability Cloudflare Security Center is available to customers on all plans. If you have any comments, questions, or bugs to report, create a post in the [Cloudflare Community forum](https://community.cloudflare.com/c/security/security-center/65). The frequency of security scans depends on your Cloudflare plan. Refer to [Scan frequency](/security-center/security-insights/how-it-works/#scan-frequency) for more information. ## Limitations * Users with an [Administrator Read Only](/fundamentals/manage-members/roles/#account-scoped-roles) role cannot access the Cloudflare Security Center. * Only Cloudflare accounts with at least one Business or Enterprise zone, or accounts on the Teams Standard or Teams Enterprise plans, can manually start a new scan. --- # Get started URL: https://developers.cloudflare.com/security-center/get-started/ import { Render } from "~/components" This guide covers the steps you need to take to set up Security Center in your Cloudflare account for the first time. ## Prerequisites * A Cloudflare account * At least one zone onboarded to Cloudflare ## Enable Security Insights and start initial scan ### Start a new scan To manually start a scan: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account. 2. Go to Account Home > **Security Center** > **Infrastructure**. 3. Select **Scan now**. ### Scan Frequency Once you enable Security Insights, Cloudflare performs scans at a [regular frequency](/security-center/security-insights/how-it-works/#scan-frequency), according to your Cloudflare plan. --- # Custom Indicator Feeds URL: https://developers.cloudflare.com/security-center/indicator-feeds/ import { Render } from "~/components"; Cloudflare's threat intelligence team crowdsources attack trends and protects users automatically, such as from zero-day vulnerabilities like the [HTTP/2 Rapid Reset attack](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/). However, in some cases, Cloudflare will partner with external entities that have their own feeds which can be shared with eligible Cloudflare users. With Custom Indicator Feeds, Cloudflare provides a threat intelligence feed based on data received from various Cyber Defense Collaboration groups. The security filtering capabilities are available to eligible public and private sector organizations. ## Publicly available feeds Cloudflare provides some feeds to Gateway users without the need to establish a provider relationship. | Name | Description | Availability | | ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | | [Treasury Early Indicator Feed](https://www.cloudflare.com/press-releases/2024/us-department-of-treasury-pnnl-finserv-threat-intel-feed/) | Threat data for financial institutions provided by the US Department of Treasury and Pacific Northwest National Laboratory (PNNL). For more information, contact your account team. | Approved financial services organizations | | [UK NCSC Public Threat Indicators](https://www.ncsc.gov.uk/information/pdns) | Recursive DNS service supplied by the UK National Cyber Security Centre (NCSC) to block DNS-based malware. | All users | | Cloudforce One - Public Feed | Feed of indicators. | All users | ## Get started If your organization is interested in becoming a provider or a subscriber, contact your account team. ### Create a Custom Indicator Feed Providers can create and manage a Custom Indicator Feed with the [Custom Indicator Feeds API endpoints](/api/resources/intel/subresources/indicator_feeds/methods/list/): 1. Contact your account team to configure your account as an indicator feed provider. 2. Create a feed with the [Create new indicator feed endpoint](/api/resources/intel/subresources/indicator_feeds/methods/create/). Make note of the `feed_id` generated for your feed. For example: ```bash title="Create new indicator feed" curl "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds" \ --header 'Content-Type: application/json' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --data '{ "description": "Custom indicator feed to detect threats", "name": "threat_indicator_feed" }' ``` ```json output {3} { "result": { "id": 10, "name": "threat_indicator_feed", "description": "Custom indicator feed to detect threats", "created_on": "2024-09-17T21:16:09.412Z", "modified_on": "2024-09-17T21:16:09.412Z" }, "success": true, "errors": [], "messages": [] } ``` 3. Upload data to the feed with the [Update indicator feed data endpoint](/api/resources/intel/subresources/indicator_feeds/subresources/snapshots/methods/update/). Uploaded indicator data must be in a [`.stix2`](https://oasis-open.github.io/cti-documentation/stix/intro) formatted file. ```bash title="Update indicator feed data" curl --request PUT \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//snapshot" \ --header 'Content-Type: multipart/form-data' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --form 'source=@/path/to/file' ``` ```json output { "result": { "file_id": 1, "filename": "snapshot_file.unified", "status": "unified" }, "errors": [], "messages": [], "success": true } ``` :::note Indicator feeds use a snapshot system. To update feeds with new data, providers must upload a file containing all previous and new indicators. ::: 4. (Optional) Verify the status of your feed upload with the [Get indicator feed data endpoint](/api/resources/intel/subresources/indicator_feeds/methods/data/). For example: ```bash title="Get indicator feed data" curl --request GET \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//data" \ --header 'Content-Type: application/json' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' ``` ```json output {8} { "result": { "id": 10, "name": "threat_indicator_feed", "description": "Custom indicator feed to detect threats", "created_on": "2023-08-01T18:00:26.65715Z", "modified_on": "2023-08-01T18:00:26.65715Z", "latest_upload_status": "Complete" }, "success": true, "errors": [], "messages": [] } ``` 5. Grant access to subscribers with the [Grant permission to indicator feed endpoint](/api/resources/intel/subresources/indicator_feeds/subresources/permissions/methods/create/). You can add subscribers to the feed's allowed subscribers list using their [account IDs](/fundamentals/account/find-account-and-zone-ids/). For example: ```bash title="Update indicator feed data" curl --request PUT \ "https://api.cloudflare.com/client/v4/accounts//intel/indicator-feeds//snapshot" \ --header 'Content-Type: multipart/form-data' \ --header 'X-Auth-Email: ' \ --header 'X-Auth-Key: ' \ --data '{ "account_tag": "823f45f16fd2f7e21e1e054aga4d2859", "feed_id": 10 }' ``` ### Use a feed in Gateway Once an account is granted access to a feed, it will be available to match traffic as a [selector in Gateway DNS policies](/cloudflare-one/policies/gateway/dns-policies/#indicator-feeds). 1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**. Select **DNS**. 2. To create a new DNS policy, select **Add a policy**. 3. Name your policy. 4. In **Traffic**, add a condition with the **Indicator Feeds** selector. If your account has been granted access to a Custom Indicator Feed, Gateway will list the feed in **Value**. For example, you can block sites that appear in a feed: | Selector | Operator | Value | Action | | --------------- | -------- | ------------------- | ------ | | Indicator Feeds | in | _Threat Intel Feed_ | Block | 5. Select **Create policy**. For more information on creating Gateway policies, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/). --- # Changelog URL: https://developers.cloudflare.com/spectrum/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # Get started URL: https://developers.cloudflare.com/spectrum/get-started/ import { Details, Render, APIRequest } from "~/components" Spectrum is available on all paid plans. Pro and Business support selected protocols only, whereas Enterprise supports all TCP and UDP based traffic. Refer to [Configuration options](/spectrum/reference/configuration-options/) for more configuration details. To create a Spectrum application, you can either use an IP address, a CNAME Record or a load balancer. Independently of the method you use, you can create the application through the dashboard or via [API](/api/resources/spectrum/subresources/apps/methods/list/). Certain fields in Spectrum request and response bodies require an Enterprise plan. Refer to the [Settings by plan](/spectrum/reference/settings-by-plan/) page for more details. ## Create a Spectrum application using an IP address To create a Spectrum application using an IP address, Cloudflare normally assigns you an arbitrary IP from Cloudflare’s IP pool to your application. If you want to use your own IP addresses, you can use [BYOIP](/spectrum/about/byoip/) or you can also use a [Static IP](/spectrum/about/static-ip/). In these two last cases, you need to create your Spectrum application through the API, as these features are not available via dash. When using the API, the field `origin_direct` takes as input the IP address.
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login). 2. Select **Spectrum**. 3. Select **Create an Application**. If this is your first time using Spectrum, the **Create an Application** modal appears. 4. Select your **Application Type**. 5. Under **Domain**, enter the domain that will use Spectrum. 6. Under **Edge Port**, enter the port Cloudflare should use for your application. 7. Under **Origin**, enter your application's origin IP and port. 8. If your application requires the client IP and supports [Proxy Protocol](https://www.haproxy.com/blog/haproxy/proxy-protocol/), enable **Proxy Protocols**. Proxy Protocol is a method for a proxy like Cloudflare to send the client IP to the origin application. 9. Select **Add**.
Below is a curl example and the associated data being posted to the API. **API example:** **Example data:** ```json { "success": true, "errors": [], "messages": [], "result": { "id": "ea95132c15732412d22c1476fa83f27a", "protocol": "tcp/22", "dns": { "type": "CNAME", "name": "ssh.example.com" }, "origin_direct": [ "tcp://192.0.2.1:22" ], "proxy_protocol": "off", "ip_firewall": true, "tls": "full", "edge_ips": { "type": "dynamic", "connectivity": "all" }, "traffic_type": "direct", "argo_smart_routing": true, "created_on": "2014-01-02T02:20:00Z", "modified_on": "2014-01-02T02:20:00Z" } } ```
## Create a Spectrum application using a CNAME record To create a Spectrum application using a CNAME record, you will need to create a [CNAME record](https://www.cloudflare.com/learning/dns/dns-records/dns-cname-record/) on your Cloudflare hosted zone that points to your origin's hostname. This is required to resolve to your hostname origin. Refer to [Create DNS records](/dns/manage-dns-records/how-to/create-dns-records/#create-dns-records), for more information. When using a CNAME as an origin, note that Cloudflare needs to be authoritative for that zone. When using the API, the `origin_dns` field takes as input the CNAME record.
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login). 2. Select **Spectrum**. 3. Select **Create an Application**. If this is your first time using Spectrum, the **Create an Application** modal appears. 4. Select your **Application Type**. 5. Under **Domain**, enter the domain that will use Spectrum. 6. Under **Edge Port**, enter the port Cloudflare should use for your application. 7. Under **Origin**, enter your `CNAME` record name. 8. Select **Add**.
Below is a curl example and the associated data being posted to the API. **API example:** **Example data:** ```json { "dns": { "type": "CNAME", "name": "spectrum-cname.example.com" }, "ip_firewall": false, "protocol": "tcp/22", "proxy_protocol": "off", "tls": "off", "origin_dns": { "name": "cname-to-origin.example.com", "ttl": 1200 }, "origin_port": 22 } ```
## Create a Spectrum application using a load balancer To create a Spectrum application using a load balancer, you will need to generate a load balancer from the dashboard or via the API. Refer to the [Load Balancing documentation](/load-balancing/additional-options/spectrum/#1-configure-your-load-balancer) for more details. :::note To prevent issues with DNS resolution for a Spectrum application, do not use the same Spectrum hostname as a current Load Balancing hostname. :::
## View traffic You can now proxy traffic through Cloudflare without additional configuration. As you run traffic through Cloudflare, you will see the last minute of traffic from **Spectrum** in the dashboard. If you have any feedback, please [let us know](https://community.cloudflare.com/c/website-application-performance/spectrum/48). --- # Glossary URL: https://developers.cloudflare.com/spectrum/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Spectrum documentation. --- # Cloudflare Spectrum URL: https://developers.cloudflare.com/spectrum/ import { CardGrid, Description, Feature, GlossaryTooltip, LinkTitleCard, Plan, RelatedProduct, } from "~/components"; Spectrum provides security and acceleration for any [TCP](https://www.cloudflare.com/learning/ddos/glossary/tcp-ip/) or [UDP](https://www.cloudflare.com/learning/ddos/glossary/user-datagram-protocol-udp/) based application. Spectrum allows you to route MQTT, email, file transfer, version control, games, and more over TCP or UDP through Cloudflare to mask the origin and protect it from [DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/). --- ## Features Use a proxy protocol for Cloudflare to pass on the client IP to your service. Learn more about what L3/4 DDoS Protection is included as part of the Spectrum service. --- ## Related products Cloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised. With Bringing Your Own IPs (BYOIP), Cloudflare announces your IPs in all our locations. Cloudflare Load Balancing distributes traffic across your{" "} endpoints, which reduces endpoint strain and latency and improves the experience for end users. Cloudflare's global DNS platform provides speed and resilience. DNS customers also benefit from free DNSSEC, and protection against route leaks and hijacking. --- ## More resources Compare available Cloudflare plans. --- # Protocols per plan URL: https://developers.cloudflare.com/spectrum/protocols-per-plan/ import { FeatureTable } from "~/components" On this table, you have information about which protocols are available per plan. --- # Aggregated Internet Measurement URL: https://developers.cloudflare.com/speed/aim/ Aggregated Internet Measurement (AIM) helps you understand your Internet quality to identify scenarios that your Internet connection is good or bad for. Typically, an Internet speed test provides you with upload and download speeds, which may not always provide a holistic view of your Internet quality. AIM uses a scoring rubric that assigns point values based on speed tests to help you understand how your Internet quality will perform for streaming, gaming, and webchat/real-time communication (RTC). ## Scoring Rubric AIM analyzes the following metrics to generate your score: * Latency * Packet Loss * Download * Upload * Loaded Latency * Jitter After the test is run and a point value is assigned to each metric, the points are translated to a network score for streaming, gaming, and webchat/RTC. These scores will indicate how good your Internet is in each of these scenarios. The possible network scores are: * Bad * Poor * Average * Good * Great ## Improve your network score You have a few options to help improve network scores. * **Switch to a wired connection.** When possible, switch to a wired connection instead of wireless to avoid performance issues due to radio interference and signal strength. * **Move closer to your router.** If you are unable to use a wired connection, try to move closer to your wireless router. Signal strength drops as you move away from your wireless router and a weaker signal means poorer connectivity. Keep in mind that any objects or materials between you and your wireless router can also have a negative impact on signal strength. * **Upgrade your router.** Ensure you are using a router capable of handling smarter queueing with hardware that will not fall over under load. * **Contact your ISP.** If you’re using a wired connection or have a good connection to your wireless router and are still seeing issues, you may have issues with your Internet connection and should reach out to your ISP. --- # Glossary URL: https://developers.cloudflare.com/speed/glossary/ import { Glossary } from "~/components" Review the definitions for terms used across Cloudflare's Speed documentation. --- # Speed URL: https://developers.cloudflare.com/speed/ import { CardGrid, Description, Feature, LinkTitleCard, Plan, RelatedProduct } from "~/components" Improve the performance of your website or web application. Speed allows you to assess the performance of your website and get recommendations of Cloudflare products to enhance the website performance. *** ## Features Use Observatory to conduct tests with both synthetic and real user data to identify potential website performance enhancements. Get recommendations of Cloudflare products and settings to improve your website’s performance. Understand your Internet quality to identify scenarios that your Internet connection is good or bad for. *** ## Related products Customize the cache properties of your HTTP requests. Understand the performance of your webpages as experienced by your site visitors. Transform images on Cloudflare's edge platform: resize, adjust quality, and convert images to WebP or AVIF format on demand. Take advantage of "server think time" to asynchronously send instructions to the browser to begin loading resources while the origin server is compiling the full response. *** ## More resources Learn about the quota limits for the number of tests you can run per month. Engage with other users and explore more resources on Cloudflare support forum. --- # Troubleshooting URL: https://developers.cloudflare.com/speed/troubleshooting/ import { TroubleshootingList } from "~/components" The following topics are useful for troubleshooting Speed issues. --- # Changelog URL: https://developers.cloudflare.com/ssl/changelog/ import { ProductChangelog } from "~/components"; {/* B((Cloudflare))<--Origin certificate--> C[(Origin server)] ``` ### Origin certificate [Origin certificates](/ssl/origin-configuration/) guarantee the security and authentication on the other side of the network, between Cloudflare and the origin server of your website or application. Origin certificates are managed on your origin server. [SSL/TLS encryption modes](/ssl/origin-configuration/ssl-modes/) control whether and how Cloudflare will use both these ceritifcates, and you can choose between different modes on the [SSL/TLS overview page](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls). ## Validity period One common aspect of every SSL/TLS certificate is that they must have a fixed expiration date. If a certificate is expired, clients - such as your visitor's browser - will consider that a secure connection cannot be established, resulting in warnings or errors. Different [certificate authorities (CAs)](#certificate-authority-ca) support different validity periods. Cloudflare works with them to guarantee that both [Universal](/ssl/edge-certificates/universal-ssl/) and [Advanced](/ssl/edge-certificates/advanced-certificate-manager/) edge certificates are always renewed. ## Certificate authority (CA) A [certificate authority (CA)](/ssl/reference/certificate-authorities/) is a trusted third party that generates and gives out SSL/TLS certificates. The CA digitally signs the certificates with their own private key, allowing client devices - such as your visitor's browser - to verify that the certificate is trustworthy. As explained in the article about [what is an ssl certificate](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/), this means that, besides not being expired, an SSL/TLS certificate should be issued by a certificate authority (CA) in order to avoid warnings or errors. ## Validation level SSL/TLS certificates vary in terms of the level to which a CA has validated them. As explained in the article about [types of certificates](https://www.cloudflare.com/learning/ssl/types-of-ssl-certificates/), SSL/TLS certificates can be DV (Domain Validated), OV (Organization Validated) or EV (Extended Validation).
## Origin pull When visitors request content from your website or application, Cloudflare first attempts to [serve content from the cache](https://www.cloudflare.com/learning/cdn/what-is-caching/). If this attempt fails, Cloudflare sends a request back to your origin web server to get the content. This request between Cloudflare and your origin web server is called origin pull. This relates to the difference between [edge certificates](#edge-certificate) and [origin certificates](#origin-certificate), and also explains why some specifications such as [cipher suites](#cipher-suites) can be set differently depending on whether they refer to the connection between Cloudflare and your visitor's browser or between Cloudflare and your origin server. ## Cipher suites Besides the authentication and integrity aspects that valid certificates guarantee, the other important aspect of SSL/TLS certificates is encryption. Cipher suites determine the set of algorithms that can be used for encryption/decryption and that will be negotiated during an [SSL/TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/). For the purpose of this documentation, keep in mind that [cipher suites supported at Cloudflare's network](/ssl/edge-certificates/additional-options/cipher-suites/supported-cipher-suites/) may not be the same as [cipher suites presented by Cloudflare to your origin server](/ssl/origin-configuration/cipher-suites/). ## Trust store The list of [certificate authority (CA)](#certificate-authority-ca) and intermediate certificates that are trusted by operating systems, web browsers or other software that interacts with SSL/TLS certificates is called trust store. Cloudflare maintains its trust store on a public [GitHub repository](https://github.com/cloudflare/cfssl_trust). While for most cases you do not have to worry about this list or how it is used when a client checks your SSL/TLS certificate, some features such as [Custom Origin Trust Store](/ssl/origin-configuration/custom-origin-trust-store/), and processes such as [bundle methodologies](/ssl/edge-certificates/custom-certificates/bundling-methodologies/), are directly related to it. ## Chain of trust Depending on your organization requirements, or if you have to troubleshoot an issue with your certificates, for example, you might come across the terms root certificate, intermediate certificate and leaf certificate. These terms refer to the way in which the certificate presented to a client - the leaf certificate - has to be traceable back to a trusted certificate authority (CA) certificate - the [root certificate](https://en.wikipedia.org/wiki/Root_certificate). This process is structured around a [chain of trust](https://en.wikipedia.org/wiki/Chain_of_trust). --- # Get started URL: https://developers.cloudflare.com/ssl/get-started/ import { GlossaryDefinition, Render } from "~/components" Follow the steps below to enable SSL/TLS protection for your application. ## Before you begin * [Create an account and register an application](/fundamentals/account/) ## Choose an edge certificate As explained in the [concepts page](/ssl/concepts/#ssltls-certificate), edge certificates are the SSL/TLS certificates that Cloudflare presents to your visitors. Cloudflare offers a variety of options for your application's edge certificates: * [**Universal certificates**](/ssl/edge-certificates/universal-ssl/): * [**Advanced certificates**](/ssl/edge-certificates/advanced-certificate-manager/): * [**Custom certificates**](/ssl/edge-certificates/custom-certificates/): * [**Keyless certificates**](/ssl/keyless-ssl/) (Enterprise only): Refer to [Edge certificates](/ssl/edge-certificates/) for more information on how different certificate types can respond to common use cases. :::note[For SaaS providers] For more details, refer to [Cloudflare for SaaS (managed hostnames)](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/). ::: ## Choose your encryption mode Once you have chosen your edge certificate, [choose an encryption mode](/ssl/origin-configuration/ssl-modes/). Encryption modes specify how Cloudflare encrypts connections between (a) visitors and Cloudflare, and (b) Cloudflare and your origin server. For more context about this two-part process refer to the [concepts page](/ssl/concepts/#ssltls-certificate). Note that some encryption modes will require you to have a valid [origin certificate](/ssl/concepts/#origin-certificate), which is managed on your origin server. Each encryption mode setup page lists out this and other requirements and you can also [consider other Cloudflare options to use with your origin server](/ssl/origin-configuration/), such as [Origin CA certificates](/ssl/origin-configuration/origin-ca/). ## Enforce HTTPS connections ## Optional - Enable additional features --- # Cloudflare SSL/TLS URL: https://developers.cloudflare.com/ssl/ import { Description, Feature, Plan, RelatedProduct } from "~/components" Encrypt your web traffic to prevent data theft and other tampering. Through [Universal SSL](/ssl/edge-certificates/universal-ssl/), Cloudflare is the first Internet performance and security company to offer free SSL/TLS protection. Cloudflare SSL/TLS also provides a number of other features to meet your encryption requirements and certificate management needs. Refer to [Get started](/ssl/get-started/) for more. *** ## Features Extending the protection offered by Universal SSL, Total TLS is an easy way to automatically issue certificates for all levels of subdomains that you have. Even if you use a different provider for authoritative DNS, you can delegate domain control validation (DCV) to Cloudflare, reducing the need of manual intervention. Cloudflare also allows you to specify the minimum TLS version that visitors must use to connect to your website or application, and [restrict cipher suites](/ssl/edge-certificates/additional-options/cipher-suites/customize-cipher-suites/) according to your security requirements.
Refer to [features and availability](/ssl/reference/all-features/) for a complete list of SSL/TLS features and their availability according to different Cloudflare plans. *** ## Related products When you use Cloudflare DNS, all DNS queries for your domain are answered by Cloudflare's global anycast network. This network delivers performance and global availability. Cloudflare for SaaS allows you to extend the security and performance benefits of Cloudflare's network to your customers via their own custom or vanity domains. --- # Style Guide URL: https://developers.cloudflare.com/style-guide/ import { DirectoryListing } from "~/components"; Use this guide when writing any content for product, including the dashboard and documentation. Understanding Cloudflare style is the first step in being able to write, review, and edit documentation. Adhering to Cloudflare style ensures consistency across the company's documentation and promotes the following benefits: - A professional and reliable product image - A seamless customer experience across Cloudflare products - Minimized customer confusion - Simplified translation process Visit the [Cloudflare Docs](https://github.com/cloudflare/cloudflare-docs) repository to contribute to developer documentation. ## Available resources --- # Changelog URL: https://developers.cloudflare.com/stream/changelog/ import { ProductReleaseNotes } from "~/components"; {/* */} --- # FAQ URL: https://developers.cloudflare.com/stream/faq/ import { GlossaryTooltip } from "~/components" ## Stream ### What formats and quality levels are delivered through Cloudflare Stream? Cloudflare decides on which bitrate, resolution, and codec is best for you. We deliver all videos to industry standard H264 codec. We use a few different adaptive streaming levels from 360p to 1080p to ensure smooth streaming for your audience watching on different devices and bandwidth constraints. ### Can I download original video files from Stream? You cannot download the *exact* input file that you uploaded. However, depending on your use case, you can use the [Downloadable Videos](/stream/viewing-videos/download-videos/) feature to get encoded MP4s for use cases like offline viewing. ### Is there a limit to the amount of videos I can upload? * By default, a video upload can be at most 30 GB. * By default, you can have up to 120 videos queued or being encoded simultaneously. Videos in the `ready` status are playable but may still be encoding certain quality levels until the `pctComplete` reaches 100. Videos in the `error`, `ready`, or `pendingupload` state do not count toward this limit. If you need the concurrency limit raised, [contact Cloudflare support](/support/contacting-cloudflare-support/) explaining your use case and why you would like the limit raised. :::note The limit to the number of videos only applies to videos being uploaded to Cloudflare Stream. This limit is not related to the number of end users streaming videos. ::: * An account cannot upload videos if the total video duration exceeds the video storage capacity purchased. Limits apply to Direct Creator Uploads at the time of upload URL creation. Uploads over these limits will receive a [429 (Too Many Requests)](/support/troubleshooting/http-status-codes/4xx-client-error/error-429/) or [413 (Payload too large)](/support/troubleshooting/http-status-codes/4xx-client-error/error-413/) HTTP status codes with more information in the response body. Please write to Cloudflare support or your customer success manager for higher limits. ### Can I embed videos on Stream even if my domain is not on Cloudflare? Yes. Stream videos can be embedded on any domain, even domains not on Cloudflare. ### What input file formats are supported? Users can upload video in the following file formats: MP4, MKV, MOV, AVI, FLV, MPEG-2 TS, MPEG-2 PS, MXF, LXF, GXF, 3GP, WebM, MPG, QuickTime ### Does Stream support High Dynamic Range (HDR) video content? When HDR videos are uploaded to Stream, they are re-encoded and delivered in SDR format, to ensure compatibility with the widest range of viewing devices. ### What frame rates (FPS) are supported? Cloudflare Stream supports video file uploads for any FPS, however videos will be re-encoded for 70 FPS playback. If the original video file has a frame rate lower than 70 FPS, Stream will re-encode at the original frame rate. If the frame rate is variable we will drop frames (for example if there are more than 1 frames within 1/30 seconds, we will drop the extra frames within that period). ### What browsers does Stream work on? You can embed the Stream player on the following platforms: | Browser | Version | | ------- | ----------------------------------- | | Chrome | Supported since Chrome version 88+ | | Firefox | Supported since Firefox version 87+ | | Edge | Supported since Edge 89+ | | Safari | Supported since Safari version 14+ | | Opera | Supported since Opera version 75+ | :::note[Note] Cloudflare Stream is not available on Chromium, as Chromium does not support H.264 videos. ::: | Mobile Platform | Version | | --------------------- | ------------------------------------------------------------------------ | | Chrome on Android | Supported on Chrome 90 | | UC Browser on Android | Supported on version 12.12+ | | Samsung Internet | Supported on 13+ | | Safari on iOS | Supported on iOS 13.4+. Speed selector supported when not in fullscreen. | ### What are the recommended upload settings for video uploads? If you are producing a brand new file for Cloudflare Stream, we recommend you use the following settings: * MP4 containers, AAC audio codec, H264 video codec, 30 or below frames per second * moov atom should be at the front of the file (Fast Start) * H264 progressive scan (no interlacing) * H264 high profile * Closed GOP * Content should be encoded and uploaded in the same frame rate it was recorded * Mono or Stereo audio (Stream will mix audio tracks with more than 2 channels down to stereo) Below are bitrate recommendations for encoding new videos for Stream: | Resolution | Recommended bitrate | | ---------- | ------------------- | | 1080p | 8 Mbps | | 720p | 4.8 Mbps | | 480p | 2.4 Mbps | | 360p | 1 Mbps | ### If I cancel my stream subscription, are the videos deleted? Videos are removed if the subscription is not renewed within 30 days. ### I use Content Security Policy (CSP) on my website. What domains do I need to add to which directives? If your website uses Content Security Policy (CSP) directives, depending on your configuration, you may need to add Cloudflare Stream's domains to particular directives, in order to allow videos to be viewed or uploaded by your users. If you use the provided [Stream Player](/stream/viewing-videos/using-the-stream-player/), `videodelivery.net` and `*.cloudflarestream.com` must be included in the `frame-src` or `default-src` directive to allow the player's ` ``` The embed code above can also be found in the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream).
### Next steps * [Edit your video](/stream/edit-videos/) and add captions or watermarks * [Customize the Stream player](/stream/viewing-videos/using-the-stream-player/) ## Start your first live stream ### Step 1: Create a live input You can create a live input via the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs/create) or using the API. To use the API, replace the `API_TOKEN` and `ACCOUNT_ID` values with your credentials in the example below. ```bash title="Request" curl -X POST \ -H "Authorization: Bearer " \ -D '{"meta": {"name":"test stream"},"recording": { "mode": "automatic" }}' \ https://api.cloudflare.com/client/v4/accounts//stream/live_inputs ``` ```json title="Response" { "uid": "f256e6ea9341d51eea64c9454659e576", "rtmps": { "url": "rtmps://live.cloudflare.com:443/live/", "streamKey": "MTQ0MTcjM3MjI1NDE3ODIyNTI1MjYyMjE4NTI2ODI1NDcxMzUyMzcf256e6ea9351d51eea64c9454659e576" }, "created": "2021-09-23T05:05:53.451415Z", "modified": "2021-09-23T05:05:53.451415Z", "meta": { "name": "test stream" }, "status": null, "recording": { "mode": "automatic", "requireSignedURLs": false, "allowedOrigins": null } } ``` ### Step 2: Copy the RTMPS URL and key, and use them with your live streaming application. We recommend using [Open Broadcaster Software (OBS)](https://obsproject.com/) to get started. ### Step 3: Play the live stream in your website or app Live streams can be played on any device and platform, from websites to native apps, using the same video players as videos uploaded to Stream. See [Play videos](/stream/viewing-videos) for details and examples of video playback across platforms. To play the live stream you just started on your website with the [Stream Player](/stream/viewing-videos/using-the-stream-player/), copy the `uid` of the live input from the request above, along with your unique customer code, and replace `` and `` in the embed code below: ```html ``` The embed code above can also be found in the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/stream). ### Next steps * [Secure your stream](/stream/viewing-videos/securing-your-stream/) * [View live viewer counts](/stream/getting-analytics/live-viewer-count/) ## Accessibility considerations To make your video content more accessible, include [captions](/stream/edit-videos/adding-captions/) and [high-quality audio recording](https://www.w3.org/WAI/media/av/av-content/). --- # Pricing URL: https://developers.cloudflare.com/stream/pricing/ Cloudflare Stream lets you broadcast, store, and deliver video using a simple, unified API and simple pricing. Stream bills on two dimensions only: - **Minutes of video stored:** the total duration of uploaded video and live recordings - **Minutes of video delivered:** the total duration of video delivered to end users On-demand and live video are billed the same way. Ingress (sending your content to us) and encoding are always free. Bandwidth is already included in "video delivered" with no additional egress (traffic/bandwidth) fees. ## Minutes of video stored Storage is a prepaid pricing dimension purchased in increments of $5 per 1,000 minutes stored, regardless of file size. You can check how much storage you have and how much you have used on the [Stream](https://dash.cloudflare.com/?to=/:account/stream) page in Dash. Storage is consumed by: - Original videos uploaded to your account - Recordings of live broadcasts - The reserved `maxDurationSeconds` for Direct Creator and TUS uploads which have not been completed. After these uploads are complete or the upload link expires, this reservation is released. Storage is not consumed by: - Videos in an unplayable or errored state - Expired Direct Creator upload links - Deleted videos - Downloadable files generated for [MP4 Downloads](/stream/viewing-videos/download-videos/) - Multiple quality levels that Stream generates for each uploaded original Storage consumption is rounded up to the second of video duration; file size does not matter. Video stored in Stream does not incur additional storage fees from other storage products such as R2. :::note If you run out of storage, you will not be able to upload new videos or start new live streams until you purchase more storage or delete videos. Enterprise customers _may_ continue to upload new content beyond their contracted quota without interruption. ::: ## Minutes of video delivered Delivery is a post-paid, usage-based pricing dimension billed at $1 per 1,000 minutes delivered. You can check how much delivery you have used on the [Billable Usage](https://dash.cloudflare.com/?to=/:account/billing/billable-usage) page in Dash or the [Stream Analytics](https://dash.cloudflare.com/?to=/:account/stream/analytics) page under Stream. Delivery is counted for the following uses: - Playback on the web or an app using [Stream's built-in player](/stream/viewing-videos/using-the-stream-player/) or the [HLS or DASH manifests](/stream/viewing-videos/using-own-player/) - MP4 Downloads - Simulcasting via SRT or RTMP live outputs Delivery is counted by HTTP requests for video segments or parts of the MP4. Therefore: - Client-side preloading and buffering is counted as billable delivery. - Content played from client-side/browser cache is _not_ billable, like a short looping video. Some mobile app player libraries do not cache HLS segments by default. - MP4 Downloads are billed by percentage of the file delivered. Minutes delivered for web playback (Stream Player, HLS, and DASH) are rounded to the _segment_ length: for uploaded content, segments are four seconds. Live broadcast and recording segments are determined by the keyframe interval or GOP size of the original broadcast. ## Example scenarios **Two people each watch thirty minutes of a video or live broadcast. How much would it cost?** This will result in 60 minutes of Minutes Delivered usage (or $0.06). Stream bills on total minutes of video delivered across all users. **I have a really large file. Does that cost more?** The cost to store a video is based only on its duration, not its file size. If the file is within the [30GB max file size limitation](/stream/faq/#is-there-a-limit-to-the-amount-of-videos-i-can-upload), it will be accepted. Be sure to use an [upload method](/stream/uploading-videos/) like Upload from Link or TUS that handles large files well. **If I make a Direct Creator Upload link with a maximum duration (`maxDurationSeconds`) of 600 seconds which expires in 1 hour, how is storage consumed?** - Ten minutes (600 seconds) will be subtracted from your available storage immediately. - If the link is unused in one hour, those 10 minutes will be released. - If the creator link is used to upload a five minute video, when the video is uploaded and processed, the 10 minute reservation will be released and the true five minute duration of the file will be counted. - If the creator link is used to upload a five minute video but it fails to encode, the video will be marked as errored, the reserved storage will be released, and no storage use will be counted. **I am broadcasting live, but no one is watching. How much does that cost?** A live broadcast with no viewers will cost $0 for minutes delivered, but the recording of the broadcast will count toward minutes of video stored. If someone watches the recording, that will be counted as minutes of video delivered. If the recording is deleted, the storage use will be released. **I want to store and deliver millions of minutes a month. Do you have volume pricing?** Yes, contact our [Sales Team](https://www.cloudflare.com/plans/enterprise/contact/). --- # Cloudflare Stream URL: https://developers.cloudflare.com/stream/ import { CardGrid, Description, Feature, LinkButton, LinkTitleCard, Render } from "~/components" Serverless live and on-demand video streaming Cloudflare Stream lets you or your end users upload, store, encode, and deliver live and on-demand video with one API, without configuring or maintaining infrastructure. You can use Stream to build your own video features in websites and native apps, from simple playback to an entire video platform. Cloudflare Stream runs on [Cloudflare’s global cloud network](https://www.cloudflare.com/network/) in hundreds of cities worldwide. Get started Stream dashboard *** ## Features Restrict access to paid or authenticated content with signed URLs. Let users in your app upload videos directly to Stream with a unique, one-time upload URL. Play on-demand and live video on websites, in native iOS and Android apps, and dedicated streaming devices like Apple TV. Understand and analyze which videos and live streams are viewed most and break down metrics on a per-creator basis. *** ## More resources Join the Stream developer community --- # WebRTC URL: https://developers.cloudflare.com/stream/webrtc-beta/ import { Badge, InlineBadge } from '~/components'; Sub-second latency live streaming (using WHIP) and playback (using WHEP) to unlimited concurrent viewers. WebRTC is ideal for when you need live video to playback in near real-time, such as: * When the outcome of a live event is time-sensitive (live sports, financial news) * When viewers interact with the live stream (live Q\&A, auctions, etc.) * When you want your end users to be able to easily go live or create their own video content, from a web browser or native app :::note WebRTC streaming is currently in beta, and we'd love to hear what you think. Join the Cloudflare Discord server [using this invite](https://discord.com/invite/cloudflaredev/) and hop into our [Discord channel](https://discord.com/channels/595317990191398933/893253103695065128) to let us know what you're building with WebRTC! ::: ## Step 1: Create a live input [Use the Stream Dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs/create), or make a POST request to the [`/live_inputs` API endpoint](/api/resources/stream/subresources/live_inputs/methods/create/) ```json title="API response from a POST request to /live_inputs" {5} { "uid": "1a553f11a88915d093d45eda660d2f8c", ... "webRTC": { "url": "https://customer-.cloudflarestream.com//webRTC/publish" }, "webRTCPlayback": { "url": "https://customer-.cloudflarestream.com//webRTC/play" }, ... } ``` ## Step 2: Go live using WHIP Every live input has a unique URL that one creator can be stream to. This URL should *only* be shared with the creator — anyone with this URL has the ability to stream live video to this live input. Copy the URL from the `webRTC` key in the API response (see above), or directly from the [Cloudflare Dashboard](https://dash.cloudflare.com/?to=/:account/stream/inputs). Paste this URL into the example code. ```javascript title="Simplified example code" {4} // Add a