Overview
Safely test, deploy, and roll back changes to your zone configurations using Version Management.
Enterprise-only
By using Version Management, you can:
- Create independent versions to make changes with no risk of impacting live traffic.
- Safely deploy changes to staging environments ahead of deploy to production.
- Quickly roll back deployed changes when issues occur.
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
Availability | No | No | No | Yes |
For access, enable Zone Versioning in the Cloudflare dashboard.
Version Management does not currently support or have limited support for the following products or features:
API Shield
- Some API Shield configurations are not cloned when a new zone version is created.
- Customers are allowed to opt-in to remove the UI block that prevents enabling Version Management.
Authenticated Origin Pull
- Authenticated Origin Pull does not work with Zone Versioning.
- Accessing your domain from an allowlisted IP returns a Cloudflare 520 error.
Cache
- Cache Reserve is intended for production use only.
- Tiered Cache does not support versioning.
Cache Rules when used with Cloudflare Images
- Image Resizing does not work with the
additional_cacheable_portsCache Rule setting and Zone Versioning. - If you use
additional_cacheable_portswith Image Resizing, the image will be resized every time it is requested and will result in low performance.
Workers Cache API
- Workers Cache API does not work with Version Management.
- If you use the Workers Cache API with Zone Versioning, you might encounter unexpected caching behaviours.
China Network
- Regardless of the version deployed to production, traffic in China will always target the root zone.
- Other incompatibility issues with Access and ICP licenses.
Cloudflare API
- Zone Version Management does not currently expose a public API.
- Customers can only use Version Management through the Cloudflare dashboard ↗.
Domain-scoped Roles
- Domain-scoped Roles apply only to your root zone.
- Once a new version is created, these roles do not copy over and they lose access to versions.
Image Transformations
- Changes made to Image Transformations are not cloned when a new zone version is created.
Network Error Logging
- Network Error Logging configurations are not cloned when a new version is created.
Page Shield
- Page Shield is not available for versioning and is only configurable under your Global Configuration.
Security Insights
- Security Insights are not shown when Zone Versioning is enabled and the first version is deployed to production.
Terraform
- Zone Version Management does not currently support Terraform.
- Customers should either use Terraform or Version Management.
WAF Attack Score
- WAF Attack Score configurations are not cloned when a new zone version is created.
Waiting Room
- Waiting Room users active on the site may be placed back in the queue.
- Waiting Room users in the queue may lose their place in line.
- Traffic may exceed limits.
Wrangler
- If a version has a Worker route, it might disappear when a Worker is deployed via Wrangler.
- If two versions have the same custom domains, the Worker might randomly choose between them.
To use Version Management, the following must all be true:
- Your zone is on an Enterprise plan.
- Your zone is in an active state.
- Your zone uses WAF managed rules.
- Your zone has migrated to use Custom Rules instead of Firewall Rules (deprecated).
- Your account uses the new WAF ↗ (if not, contact your account team).
- Your user account must have an API Key provisioned (if not, view your API Key).
- Your user account must have API Access enabled. Refer to control API Access for more information.
- You must use the dashboard to manage versioning.