Cloudflare for Web Infrastructure

Use Cloudflare DNS, reverse proxy, edge security, and Tunnel with clear trust boundaries.

Cloudflare can provide authoritative DNS, proxy public web traffic, apply edge security controls, and connect services without opening inbound ports. These are separate capabilities. Configure and verify each one explicitly.

Terminal

public web request
  └─ authoritative DNS
       └─ Cloudflare edge: TLS → DDoS → WAF → cache
            └─ restricted origin or outbound Tunnel
                 └─ application

private user
  └─ identity + device context
       └─ Access policy
            └─ Tunnel → private service

Learning path

1 · FoundationDNS and reverse proxyChoose proxied or DNS-only records, validate TLS, and prevent direct origin access.2 · IntermediateWAF and DDoSDeploy managed rules, endpoint-aware rate limits, and a practical response workflow.3 · IntermediateTunnel and AccessPublish services through outbound connections and protect private applications by identity.

Know which control is active

Capability	What it does	What it does not prove
Authoritative DNS	Answers queries for the zone	Traffic passes through Cloudflare
Proxied record	Routes eligible web traffic through Cloudflare	The origin rejects direct traffic
WAF	Evaluates matching HTTP requests	The application has no vulnerabilities
DDoS protection	Detects and mitigates attack traffic at the edge	The origin cannot be reached directly
Tunnel	Connects Cloudflare to a service over outbound connections	A user is authorized to access it
Access	Applies identity and device-aware policy	The application’s own authorization is correct

Recommended baseline

Proxy eligible public web hostnames; keep mail, verification, and unsupported services DNS-only.
Use Full (strict) TLS with a valid certificate at the origin.
Restrict the origin to Cloudflare traffic, or remove public ingress by using Tunnel.
Enable an appropriate managed WAF ruleset and review its events before adding exceptions.
Add rate limits for login, authentication, expensive search, upload, and API paths based on normal traffic.
Put internal applications behind Access policies or private-network routes; do not publish them first and add identity later.
Alert on origin errors, security events, tunnel health, DNS changes, and policy changes.
Keep a tested path to the origin for incident response that does not bypass normal authorization.

The edge is one layer

Cloudflare reduces exposure and absorbs traffic before it reaches your service. Keep application authentication, authorization, input validation, patching, logging, backups, and incident response in place.

Cloudflare for Web Infrastructure

Learning path

Know which control is active

Recommended baseline

References

On this page