Development mode is disabled for production zones

​

What this check verifies

Cloudflare zones are assessed for Development Mode configuration by checking if it is disabled to ensure caching, security features, and performance optimizations are active in production environments.

​

Risk

With Development Mode enabled, Cloudflare bypasses caching and some optimizations.

• Confidentiality: some security features may be affected or bypassed
• Integrity: performance optimizations are disabled impacting site reliability
• Availability: origin server is exposed to increased load without caching protection

​

Recommendation

Disable Development Mode for production environments.

• Use only temporarily during active development when cache bypassing is necessary
• Development Mode auto-expires after 3 hours
• Ensure it is manually disabled after development work completes
• Consider using cache purge or page rules for targeted cache invalidation instead

​

Remediation

Dashboard steps

1. Log in to the Cloudflare dashboard and select your account and domain
2. Go to Caching > Configuration
3. Scroll to Development Mode
4. Ensure Development Mode is Off
5. Note: Development Mode auto-expires after 3 hours if left enabled

​

References

• https://developers.cloudflare.com/cache/reference/development-mode/

​

Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_development_mode_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Cloudflare checks