Cloudflare Zone Security: 12 Read-Only Checks via Curl

Automating Cloudflare Zone Security Audits

Maintaining robust security for your online presence is paramount, and Cloudflare offers a powerful suite of tools to achieve this. However, ensuring these tools are configured correctly across all your zones can be a tedious, manual process. This checklist provides a streamlined approach for developers and security professionals to perform essential, read-only security checks on Cloudflare zones using simple curl commands. The goal is to reduce the time spent on manual verification from minutes per zone to mere seconds, allowing for more frequent and thorough audits.

The impetus for this checklist came from a real-world scenario: a forgotten WAF custom rule unexpectedly blocking legitimate curl traffic on a zone that hadn't been intentionally configured that way. This highlights how easily misconfigurations can occur and the need for a quick, reliable method to verify settings. Each of the twelve checks is designed to be executed with a single curl command, returning a specific numerical value or status that can be easily interpreted. This transforms a potentially time-consuming manual review into a rapid, scriptable audit.

To facilitate these checks, a read-only API token is essential. This token should be set as an environment variable, CF_TOKEN. The necessary permissions for this token are: Zone Read, Zone Settings Read, DNS Read, and Firewall Read. This ensures that the token can gather the required information without the risk of making any unintended changes to your zone’s configuration.

Setting the token once for your shell session is sufficient:

export CF_TOKEN=<YOUR_READ_ONLY_API_TOKEN>

DNSSEC Status Check

Domain Name System Security Extensions (DNSSEC) is crucial for protecting your domain from DNS spoofing and cache poisoning attacks. Verifying its status ensures that your DNS records are digitally signed, adding a layer of integrity and authenticity to your domain’s DNS resolution process.

Check: DNSSEC status

API Endpoint: /zones/:zone_identifier/dnssec

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dnssec" 
  -H "Authorization: Bearer $CF_TOKEN"

A successful response will indicate whether DNSSEC is enabled or disabled for the zone. The key piece of information is the status field, which should ideally be "active".

HTTP/3 (QUIC) Status Check

HTTP/3 is the latest major version of the Hypertext Transfer Protocol, designed to improve performance and security by leveraging the QUIC transport protocol. Enabling HTTP/3 can significantly speed up website loading times, especially on networks with high latency.

Check: HTTP/3 status

API Endpoint: /zones/:zone_identifier/ளர்/http3

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/http3" 
  -H "Authorization: Bearer $CF_TOKEN"

The response will contain a "value" field, which should be "on" if HTTP/3 is enabled.

Always Use HTTPS Status Check

The "Always Use HTTPS" setting ensures that all connections to your website are automatically redirected from HTTP to HTTPS. This is a fundamental security practice that encrypts traffic between the client and Cloudflare, protecting against man-in-the-middle attacks and ensuring data privacy.

Check: Always Use HTTPS setting

API Endpoint: /zones/:zone_identifier/ளர்/always_use_https

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/always_use_https" 
  -H "Authorization: Bearer $CF_TOKEN"

Look for the "value" field, which should be "on" to confirm this setting is active.

Automatic HTTPS Rewrites Status Check

Automatic HTTPS Rewrites fix mixed content issues by changing http:// to https:// for resources (like images, CSS, and JavaScript) on your site. This complements "Always Use HTTPS" by ensuring that even if your site’s HTML references insecure resources, Cloudflare attempts to serve them securely.

Check: Automatic HTTPS Rewrites setting

API Endpoint: /zones/:zone_identifier/ளர்/automatic_https_rewrites

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/automatic_https_rewrites" 
  -H "Authorization: Bearer $CF_TOKEN"

The "value" should be "on".

Web Application Firewall (WAF) Status Check

The WAF is a critical layer of defense against common web exploits like SQL injection and cross-site scripting (XSS). Ensuring it is enabled and properly configured is vital for protecting your application from malicious traffic.

Check: WAF status

API Endpoint: /zones/:zone_identifier/firewall/waf/

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/waf" 
  -H "Authorization: Bearer $CF_TOKEN"

The response will include an "enabled" field. This should be true.

WAF Rule Groups Status Check

Beyond the general WAF status, it’s important to verify that individual WAF rule groups (e.g., SQLi, XSS, Remote File Inclusion) are enabled. This ensures comprehensive protection against a wide range of threats.

Check: WAF rule groups status

API Endpoint: /zones/:zone_identifier/firewall/waf/rulesets

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/waf/rulesets" 
  -H "Authorization: Bearer $CF_TOKEN"

You will receive a list of rule groups. For each group, check the "enabled" field. All relevant groups should be true.

Firewall Bot Fight Mode Status Check

Bot Fight Mode helps to automatically detect and block malicious bots. Enabling this feature provides an essential layer of defense against automated attacks that can consume resources and compromise security.

Check: Bot Fight Mode status

API Endpoint: /zones/:zone_identifier/ளர்/bot_fight_mode

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/bot_fight_mode" 
  -H "Authorization: Bearer $CF_TOKEN"

The "value" should be "on".

Firewall Managed Challenge Status Check

Managed Challenges present visitors with a JavaScript challenge to solve, helping to distinguish between human users and bots. This is a powerful tool for mitigating sophisticated bot traffic.

Check: Managed Challenge status

API Endpoint: /zones/:zone_identifier/ளர்/managed_challenge

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/managed_challenge" 
  -H "Authorization: Bearer $CF_TOKEN"

Ensure the "value" is "on".

Firewall Rate Limiting Status Check

Rate limiting protects your application from brute-force attacks and API abuse by restricting the number of requests a user can make within a specific time period. It’s crucial for preventing denial-of-service and credential stuffing attacks.

Check: Rate Limiting status

API Endpoint: /zones/:zone_identifier/ளர்/rate_limiting

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/rate_limiting" 
  -H "Authorization: Bearer $CF_TOKEN"

The "value" should be "on".

Security Level Status Check

Cloudflare’s Security Level setting helps protect your site from various types of malicious traffic. Setting it to "medium" or higher provides a good baseline protection against threats like SQL injection and cross-site scripting.

Check: Security Level

API Endpoint: /zones/:zone_identifier/ளர்/security_level

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ளர்/security_level" 
  -H "Authorization: Bearer $CF_TOKEN"

The "value" should be "medium" or higher.

Access Rules Check

Access Rules allow you to allow or block traffic from specific IP addresses, countries, or regions. Reviewing these rules ensures that only legitimate traffic is permitted and unauthorized access is blocked.

Check: Access Rules count

API Endpoint: /zones/:zone_identifier/firewall/access_rules

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/access_rules" 
  -H "Authorization: Bearer $CF_TOKEN"

The response will contain a "result_info" object with a "total_count" field. This number indicates how many access rules are configured.

Custom SSL Certificate Status Check

While Cloudflare provides Universal SSL, many users opt for custom SSL certificates for specific needs. Ensuring these are active and correctly configured is vital for maintaining encrypted connections and trust.

Check: Custom SSL Certificate status

API Endpoint: /zones/:zone_identifier/custom_ssl_certificates

Command:

curl -s -X GET 
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_ssl_certificates" 
  -H "Authorization: Bearer $CF_TOKEN"

The response will list any custom SSL certificates. The presence of active certificates and their expiration dates (if available in the response) is key.

Scaling Security Audits

Performing these twelve checks manually for each zone can still be time-consuming if you manage a large number of zones. The next logical step is to script these commands. By iterating through a list of zone IDs and executing each curl command, you can generate a comprehensive security report for all your zones automatically. This allows for daily or even hourly checks, significantly improving your security posture and reducing the risk of misconfigurations going unnoticed.

Consider building a simple script that:

• Retrieves all zone IDs for your account.
• For each zone ID, executes the 12 curl commands.
• Parses the JSON output to extract the relevant status for each check.
• Logs the results to a file or a dashboard.
• Alerts on any deviations from expected secure configurations.

This approach transforms security verification from a manual chore into an automated process, enabling proactive management of your Cloudflare security settings at scale.

The surprising detail here is not the complexity of the checks themselves, but how many distinct security features can be toggled and verified via simple API calls. What nobody has addressed yet is the optimal frequency for these automated checks across different types of applications and threat landscapes.