L7 Shield

Put a domain behind the managed L7 edge — WAF, rate limits, bot challenges and load-balanced origins, with the Cloudflare DNS cutover handled for you.

Last updated

On this page

L7 Shield puts one of your hostnames behind a managed layer-7 edge node: the edge terminates TLS, filters attacks (WAF, per-IP rate limits, bot challenges) and load-balances what's left across your origin backends. You connect a domain from the product page; the platform installs the site on an edge node and can cut your Cloudflare DNS over for you.

You need a connected Cloudflare account (added once from the dashboard overview) and at least one running origin the edge can reach.

Connect a domain

Open the L7 Shield product page and choose Connect a domain. The wizard walks through:

  1. Cloudflare account — pick one of your connected accounts. The edge reads DNS through it to cut the hostname over; credentials never leave the platform.
  2. Zone — the domain the hostname lives under, listed live from the Cloudflare API.
  3. Hostname — a subdomain of the zone, or @ for the zone root.
  4. Node — pick an edge node, or leave Automatic (recommended) to be placed on a node with headroom. Only nodes your plan may use are listed; when none are user-selectable the step is skipped and placement is always automatic.
  5. Backends — 1–16 origin URLs (http(s)://host[:port]) with weights, plus a balance policy: round robin, random, least connections, or weighted.
  6. SSL certificate — Self-signed on the edge (recommended; browsers never see it while DNS is proxied through Cloudflare) or Paste my own fullchain + private key, stored encrypted and only ever sent to your edge node.
  7. Protection — per-IP rate limit (requests per window), the over-limit action (block with 429, or a JS challenge), an optional repeat-offender ban duration, the WAF toggle, and the challenge mode (off, auto, or always).
  8. DNS — leave the cutover on and the platform points the hostname at the edge with a proxied A record, stashing any existing record first. Turn it off to manage the record yourself.
  9. Review — confirm, then watch the live progress (edge install, DNS cutover, live). A failed step offers Retry.

The site detail page

Click a site to open its detail page. Three tabs:

  • Overview — current status with actions (re-apply the config, retry a failed DNS cutover, delete), the backend list, protection summary, site details (zone, node, edge site id, certificate type), the DNS card, and a status timeline built from the install jobs.
  • Analytics — see the next section.
  • Control — edit backends, the balance policy and protection settings, then Save + re-apply (the node picks the change up on its next heartbeat). The DNS card here applies or rolls back the cutover, and the danger zone deletes the site.

Analytics

The Analytics tab reads per-minute rollups the edge piggybacks on its heartbeats (48h retention). It opens with a checks strip — pass/warn/fail chips for site status, DNS cutover, backends and mitigation, computed from signals the platform already has.

  • Toggle Live to refresh every 5 seconds (the range locks to 1 hour); otherwise pick 1 or 24 hours.
  • The metric filter switches the headline chart between Requests (req/min + rps), Threats (blocked vs challenged per minute) and Connections (active). A second chart always shows the mitigation share — blocked/challenged as a percentage of requests.
  • RPS range stats summarize the range: latest, p95 and peak.
  • Top countries breaks requests, blocked and challenged down per country over the selected range, and the attack-origins map below plots the same GeoIP data with live, 1h, 24h and 48h ranges.
  • Per-backend stats shows each origin's in-flight requests, cumulative failures (with a +/min rate) and state — a backend that fails repeatedly cools down for a 10-second passive failover.

DNS cutover and rollback

With managed DNS on, cutover stashes your existing A/AAAA/CNAME record and replaces it with a proxied A record pointing at the edge node's IP. Roll back restores the stashed record exactly (or deletes the record if the platform created it). You can cut over and roll back at any time from the Control tab or the Overview's DNS card.

Transfers between nodes

Support staff can move a site to a different edge node — for capacity, latency or a node drain. The move keeps your spec and certificate, re-points the managed DNS record at the new node's IP, and shows as a transferring status while it runs.

Deleting a site

Delete offers two modes:

  • Graceful (default) — rolls the DNS record back (best-effort), then the edge tears the site down on its next heartbeat. The row stays as "torn down" until the edge confirms; deleting a torn-down site removes the row and its metrics.
  • Force delete — removes the row and its metrics immediately, with DNS rollback and the edge teardown only best-effort. Use it when the node is offline or the site is stuck.

Next steps