# Cloudflare connections, Analytics and Auto Setup > Connect a Cloudflare account once, then monitor zones with the Analytics product and harden them with the 9-phase Auto Setup pipeline. > > Canonical: https://xdp.network/docs/products/cloudflare · Updated 2026-08-17 Cloudflare accounts connect once from the dashboard overview and are shared by every Cloudflare-based product — L7 Shield's DNS cutover, the Analytics console, and Auto Setup. This page covers connecting an account and the two Cloudflare products. ## Connect a Cloudflare account On the dashboard overview, choose **Connect a service** → **Connect with Cloudflare**. Two ways to connect: - **One-click OAuth** — authorize the platform on Cloudflare's consent screen and you're done. This is the recommended path. - **API token** — paste a label and a token (create one at `dash.cloudflare.com/profile/api-tokens`; a zone-scoped token is fine). The token is validated against the Cloudflare API before saving. Credentials are encrypted at rest and never shown again after saving. Product pages only consume your connections through their own pickers — you never paste credentials into a product. If an OAuth connection's authorization expires or is revoked, it shows a **reconnect** badge. Click **Reconnect** to re-run the OAuth dance against the same connection — no duplicate is created, and attached zones keep working afterwards. ## Analytics The Analytics product is seat-based monitoring: each zone you attach consumes one seat from your plan. Choose **Attach zone**, pick a connection, and select from its zones (listed live, with plan and status). Detaching a zone frees its seat immediately and never touches Cloudflare itself. When every seat is used, contact support to add more. Click a monitored zone to open its dashboard. The controls set the zone, the range (last 24 hours, 7 days or 30 days) and a refresh cadence (off, 30s, 60s or 5m). - **Stat tiles** — requests (with page views), bandwidth (with the cached share), cache hit ratio, threats blocked, and unique visitors for the range. - **Traffic chart** — requests, bandwidth, cached volume and threats over time (hourly points for the 24h range, daily otherwise). - **Traffic by country** — an interactive globe plus the top-10 countries table with an "other" rollup. - **Top paths** — the most requested host + path pairs, ranked. - **Response status split** — 2xx / 3xx / 4xx / 5xx edge responses as a stacked bar. - **Threat mitigation** — a donut of firewall actions (block, challenge, …), the most targeted paths, and the firing rule IDs. Threat breakdowns cover the trailing 24 hours. - **User agents** — the top user agents, badged bot or browser. :::note Breakdown panels follow the selected range but cap at a trailing 7-day window — on the 30-day range the globe, paths, status and user-agent panels show the last week. ::: ## Auto Setup Auto Setup applies a full Cloudflare security baseline to a zone in one click. From the product page, **Browse zones** on a connection and **Protect selected** — plans are auto-detected and you can override a zone's plan with its dropdown. Hitting **Apply** first saves a snapshot of the zone's current configuration, then runs nine phases: 1. **Zone security & TLS** — minimum TLS 1.2, Always-HTTPS, HTTP/3, Brotli, minify and the rest of the safe baseline. 2. **HSTS** — 6 months, includeSubDomains, nosniff. 3. **HTTP DDoS protection** — the managed DDoS ruleset overridden to block at High sensitivity. 4. **WAF managed rulesets** — Cloudflare Managed + OWASP Core on paid plans, the Free Managed Ruleset on the free plan. 5. **Bot protection** — Super Bot Fight Mode (detect-only default) on paid plans, Bot Fight Mode on free, plus blocking AI bots where the plan supports it. 6. **Custom WAF rules** — nine rules on paid plans, five on free: exploit and dotfile probes, scanner user-agents, non-standard HTTP methods, SQLi/XSS probes, threat-score and headless-browser challenges, credential-stuffing endpoints. 7. **Rate limiting** — a global per-IP flood cap (429s), plus login brute-force protection on paid plans. 8. **Managed transforms** — security response headers and visitor-IP request headers. 9. **DNSSEC** — activated. Only rules tagged `CFS:` are managed — your existing rules and settings are preserved, and anything stricter than the baseline (for example SSL strict mode) is never downgraded. The run modal shows each phase's steps as ok, failed or skipped; **History** lists every apply and rollback run for the zone. ### Fix plan rule-limit conflicts with "Replace & apply" Cloudflare caps rules per phase by plan (free zones get five custom rules, for example). If your own existing rules already fill a phase, that step fails or is skipped with a conflict — plan rule limit, rule already exists, or a not-authorized override. Conflicted steps are flagged in the run log and offer **Replace & apply**: it deletes that phase's pre-existing non-`CFS:` rules on the zone, then re-applies ours. :::warning Replace & apply is destructive to the rules it removes. The pre-apply snapshot can bring them back: open **Templates** on the zone and roll back. ::: ## Roll back a zone from Templates Every apply saves a snapshot template first. Open **Templates** on the zone, pick a snapshot and **Roll back** — settings, WAF rules, rate limits, bot config, transforms and DNSSEC return to the snapshotted state, and your own rules come back exactly as they were. Removing a connection from the Auto Setup page also deletes its protected zones, run history and snapshot templates. Settings already applied on Cloudflare stay as they are. ## Next steps - [L7 Shield](/docs/products/l7-shield) - [L4 Tunnel](/docs/products/l4-tunnel) - [Alerts](/docs/servers/alerts)