Check ID: zone_always_online_disabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: resilience
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Always Online configuration by checking if it is disabled to prevent serving stale cached content when the origin server is unavailable, which could expose outdated or sensitive information.

​
Risk

With Always Online enabled, Cloudflare serves cached pages when the origin is unavailable.
  • Confidentiality: stale cache may expose sensitive information that was subsequently removed
  • Integrity: outdated content may contain incorrect or superseded information
  • Availability: reliance on cached content masks origin failures requiring attention

​
Recommendation

Disable Always Online and implement proper high availability solutions.
  • Use redundant origins or load balancing for genuine high availability
  • Stale cached content may contain outdated security information
  • Origin failures should be detected and addressed, not masked
  • Consider Cloudflare Workers for custom failover logic if needed

​
Remediation

# Disable Always Online to prevent serving stale cached content
resource "cloudflare_zone_settings_override" "always_online" {
  zone_id = "<ZONE_ID>"
  settings {
    always_online = "off" # Critical: prevents serving potentially stale or sensitive cached content
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_always_online_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks