Cloudflare Security Checklist: Score Your Account

Two-factor authentication is required for every member (2FA Enforcement), and security keys are used for administrators.

Each person has at least two second factors or two security keys, and backup codes are stored safely.

Super Administrator is held by as few people as the business needs; others use narrower roles such as Administrator Read Only, Cloudflare Access or Audit Logs Viewer.

Membership is reviewed on a schedule and leavers and contractors are removed the same day.

Staff reach internal tools through your identity provider rather than separate local logins.

No integration uses the Global API key; it has been replaced by API tokens.

CI/CD and integrations use account API tokens rather than tokens tied to one person.

Each token has only the permissions it needs on only the zones or accounts it needs.

Tokens carry an expiry and client IP address filtering where the caller's address is known.

Repositories and pipelines are scanned for leaked Cloudflare tokens, and you know how to revoke one.

Internal web applications are behind Cloudflare Access with Allow policies that name the people or groups allowed.

Bypass policies are rare, scoped to one path, tested before production and reviewed; Service Auth is used where possible.

Applications behind Access validate the Cf-Access-Jwt-Assertion token and refresh the signing keys when they rotate.

Sensitive applications require a healthy managed device through the Cloudflare One Client and device posture checks, verified before enforcement.

Machine access uses Service Auth (service tokens or client certificates) and not shared user logins.

Public hostnames are proxied, and DNS-only records (SPF, TXT and others) have been checked for origin addresses.

Origin IP addresses were rotated after onboarding, since historical DNS records may contain the old ones.

Where possible, origins connect through Cloudflare Tunnel with inbound traffic blocked at the firewall.

Origins that are not behind a tunnel use Full (strict) encryption and Authenticated Origin Pulls, with your own certificate where you need account-level assurance.

The firewall allows only Cloudflare address ranges as an additional layer.

DNSSEC is enabled on zones that use Cloudflare DNS and the DS record is published at the registrar.

When onboarding a domain, DNSSEC was disabled at the previous provider before nameservers changed.

Zones use Full or Full (strict) encryption mode; none is on Flexible or Off.

Changes to DNS records are visible in a log someone reviews, and ownership of the registrar account is protected like the Cloudflare account.

You have a written step list for a hijacked record or a changed nameserver.

The Cloudflare Managed Ruleset is deployed on public applications and its matches are reviewed in Security Events.

Custom rules protect sensitive paths (admin, login, APIs) and their order has been checked.

Login, password-reset and expensive API endpoints have rate limiting rules with sensible characteristics, thresholds and mitigation timeouts.

Applications still enforce their own limits, lockouts and MFA behind the edge.

Account audit logs are exported to your SIEM or logging system (Logpush or API) so you can look back beyond 90 days.