Services in this catalog
dns
4 checks.| Check ID | Title | Severity |
|---|---|---|
dns_record_cname_target_valid | DNS records pointing to hostnames have valid targets without takeover risk | HIGH |
dns_record_no_internal_ip | DNS records do not expose internal IP addresses | HIGH |
dns_record_no_wildcard | DNS records do not use wildcard entries | MEDIUM |
dns_record_proxied | Cloudflare proxy is enabled for applicable DNS records | MEDIUM |
zone
25 checks.| Check ID | Title | Severity |
|---|---|---|
zone_always_online_disabled | Always Online is disabled | HIGH |
zone_automatic_https_rewrites_enabled | Automatic HTTPS Rewrites is enabled | MEDIUM |
zone_bot_fight_mode_enabled | Bot Fight Mode is enabled | MEDIUM |
zone_browser_integrity_check_enabled | Cloudflare Zone Browser Integrity Check Is Enabled | LOW |
zone_challenge_passage_configured | Cloudflare Zone Challenge Passage Is Configured Between 15 and 45 Minutes | LOW |
zone_development_mode_disabled | Development mode is disabled for production zones | LOW |
zone_dnssec_enabled | DNSSEC is enabled | HIGH |
zone_email_obfuscation_enabled | Email Obfuscation is enabled | LOW |
zone_firewall_blocking_rules_configured | Cloudflare Zone Firewall Rules Use Blocking Actions to Protect Against Threats | MEDIUM |
zone_hotlink_protection_enabled | Hotlink Protection is enabled | LOW |
zone_hsts_enabled | HSTS is enabled with recommended max-age and includes subdomains | HIGH |
zone_https_redirect_enabled | Always Use HTTPS is enabled | MEDIUM |
zone_ip_geolocation_enabled | IP Geolocation is enabled | LOW |
zone_min_tls_version_secure | Minimum TLS version is set to 1.2 or higher | HIGH |
zone_rate_limiting_enabled | Rate limiting is configured for the zone | HIGH |
zone_record_caa_exists | CAA record exists with issue or issuewild tag | LOW |
zone_record_dkim_exists | DKIM record exists with valid public key | MEDIUM |
zone_record_dmarc_exists | DMARC record exists with enforcement policy (p=reject or p=quarantine) | MEDIUM |
zone_record_spf_exists | SPF record exists with strict policy (-all) | MEDIUM |
zone_security_under_attack_disabled | Under Attack Mode is disabled during normal operations | LOW |
zone_ssl_strict | SSL/TLS encryption mode is set to Full (Strict) | HIGH |
zone_tls_1_3_enabled | TLS 1.3 is enabled | MEDIUM |
zone_universal_ssl_enabled | Universal SSL is enabled | HIGH |
zone_waf_enabled | WAF is enabled | HIGH |
zone_waf_owasp_ruleset_enabled | Cloudflare Zone OWASP Managed WAF Rulesets Are Enabled | HIGH |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.