Cloudflare connections, Analytics and Auto Setup

Connect a Cloudflare account once, then monitor zones with the Analytics product and harden them with the 9-phase Auto Setup pipeline.

Last updated

On this page

Cloudflare accounts connect once from the dashboard overview and are shared by every Cloudflare-based product — L7 Shield's DNS cutover, the Analytics console, and Auto Setup. This page covers connecting an account and the two Cloudflare products.

Connect a Cloudflare account

On the dashboard overview, choose Connect a service → Connect with Cloudflare. Two ways to connect:

  • One-click OAuth — authorize the platform on Cloudflare's consent screen and you're done. This is the recommended path.
  • API token — paste a label and a token (create one at dash.cloudflare.com/profile/api-tokens; a zone-scoped token is fine). The token is validated against the Cloudflare API before saving.

Credentials are encrypted at rest and never shown again after saving. Product pages only consume your connections through their own pickers — you never paste credentials into a product.

If an OAuth connection's authorization expires or is revoked, it shows a reconnect badge. Click Reconnect to re-run the OAuth dance against the same connection — no duplicate is created, and attached zones keep working afterwards.

Analytics

The Analytics product is seat-based monitoring: each zone you attach consumes one seat from your plan. Choose Attach zone, pick a connection, and select from its zones (listed live, with plan and status). Detaching a zone frees its seat immediately and never touches Cloudflare itself. When every seat is used, contact support to add more.

Click a monitored zone to open its dashboard. The controls set the zone, the range (last 24 hours, 7 days or 30 days) and a refresh cadence (off, 30s, 60s or 5m).

  • Stat tiles — requests (with page views), bandwidth (with the cached share), cache hit ratio, threats blocked, and unique visitors for the range.
  • Traffic chart — requests, bandwidth, cached volume and threats over time (hourly points for the 24h range, daily otherwise).
  • Traffic by country — an interactive globe plus the top-10 countries table with an "other" rollup.
  • Top paths — the most requested host + path pairs, ranked.
  • Response status split — 2xx / 3xx / 4xx / 5xx edge responses as a stacked bar.
  • Threat mitigation — a donut of firewall actions (block, challenge, …), the most targeted paths, and the firing rule IDs. Threat breakdowns cover the trailing 24 hours.
  • User agents — the top user agents, badged bot or browser.

Auto Setup

Auto Setup applies a full Cloudflare security baseline to a zone in one click. From the product page, Browse zones on a connection and Protect selected — plans are auto-detected and you can override a zone's plan with its dropdown. Hitting Apply first saves a snapshot of the zone's current configuration, then runs nine phases:

  1. Zone security & TLS — minimum TLS 1.2, Always-HTTPS, HTTP/3, Brotli, minify and the rest of the safe baseline.
  2. HSTS — 6 months, includeSubDomains, nosniff.
  3. HTTP DDoS protection — the managed DDoS ruleset overridden to block at High sensitivity.
  4. WAF managed rulesets — Cloudflare Managed + OWASP Core on paid plans, the Free Managed Ruleset on the free plan.
  5. Bot protection — Super Bot Fight Mode (detect-only default) on paid plans, Bot Fight Mode on free, plus blocking AI bots where the plan supports it.
  6. Custom WAF rules — nine rules on paid plans, five on free: exploit and dotfile probes, scanner user-agents, non-standard HTTP methods, SQLi/XSS probes, threat-score and headless-browser challenges, credential-stuffing endpoints.
  7. Rate limiting — a global per-IP flood cap (429s), plus login brute-force protection on paid plans.
  8. Managed transforms — security response headers and visitor-IP request headers.
  9. DNSSEC — activated.

Only rules tagged CFS: are managed — your existing rules and settings are preserved, and anything stricter than the baseline (for example SSL strict mode) is never downgraded. The run modal shows each phase's steps as ok, failed or skipped; History lists every apply and rollback run for the zone.

Fix plan rule-limit conflicts with "Replace & apply"

Cloudflare caps rules per phase by plan (free zones get five custom rules, for example). If your own existing rules already fill a phase, that step fails or is skipped with a conflict — plan rule limit, rule already exists, or a not-authorized override. Conflicted steps are flagged in the run log and offer Replace & apply: it deletes that phase's pre-existing non-CFS: rules on the zone, then re-applies ours.

Roll back a zone from Templates

Every apply saves a snapshot template first. Open Templates on the zone, pick a snapshot and Roll back — settings, WAF rules, rate limits, bot config, transforms and DNSSEC return to the snapshotted state, and your own rules come back exactly as they were.

Removing a connection from the Auto Setup page also deletes its protected zones, run history and snapshot templates. Settings already applied on Cloudflare stay as they are.

Next steps