cloudflare-hygiene

Cloudflare Hygiene

Periodic posture sweep over live zones: preflight -> sweep (read-only) -> report -> confirm -> apply -> verify. Optimization = real wins only: TLS strict, HTTPS forced, modern protocols on, DNS proxied + mail auth complete. No theater (no settings churned that already match optimal, no proxying records that must stay direct). Building on Cloudflare (Workers/Pages/KV/D1) -> cloudflare, hand off.

Preflight

1. Permission scope — this skill mutates zone settings + DNS, needs an authorized session that can write them. Probe once: GET /zones/{id}/settings/ssl. 9109/10000 (Unauthorized) -> scope too narrow, STOP and surface the upgrade path (see Access setup below) before sweeping. Don't limp through a settings-blind run.

2. Enumerate zones — GET /zones (paginate). List name · id · plan. Warn: full sweep across N zones takes a moment.

3. All work goes through mcp__cloudflare__execute, which runs a JS async arrow function — not a plain REST caller. Every call in this skill is shorthand for that shape:

   async () => cloudflare.request({ method: "GET", path: `/zones/${zoneId}/settings/ssl` })
   

   accountId is pre-injected; zone ids come from step 2. Returns {success, status, result, errors, result_info} — read errors[0].code for the 9109 probe, result_info.total_pages to paginate. Batch a whole category's GETs into one execute call (loop inside the function, return an object) — one round-trip per category beats one per setting. mcp__cloudflare__search (OpenAPI spec, refs resolved) for endpoint/body shapes; mcp__cloudflare__docs for product behavior.

Sweep (read-only)

Per zone, every category below — each shows in the report, clean ones as "ok", never silently dropped. GETs only here; no mutation. Full endpoint + optimal-value matrix lives in references/best-practices.md; scripts/audit.mjs is the reference read-only sweep logic (GETs + verdict classifier).

1. SSL/TLS — settings/ssl (want strict); settings/always_use_https (on); settings/min_tls_version (≥1.2); settings/tls_1_3 (on); settings/automatic_https_rewrites (on); settings/security_header HSTS (enabled, max-age ≥6mo, includeSubDomains; preload = opt-in only).
2. Security / WAF / bot — rulesets phases (http_request_firewall_managed deployed? ddos_l7 present?); settings/security_level (medium); bot_management (Bot Fight Mode on — Free tier); settings/email_obfuscation (on); settings/browser_check (on); custom firewall ruleset (http_request_firewall_custom — any bespoke rules?); rate limiting ruleset (http_ratelimit phase — login/API endpoints protected?); IP access rules / Zone Lockdown (firewall/access_rules/rules — stale allowlists?); Page Shield (page_shield — client-side/Magecart, plan-gated); Authenticated Origin Pulls (settings/tls_client_auth — mTLS edge->origin so origin only trusts CF); Leaked Credential Check (leaked-credential-checks — alerts on breached creds, plan-gated). Under Attack mode = situational (incident only), never default-on.
3. Performance / caching — settings/brotli (on); settings/early_hints (on); settings/cache_level (aggressive/standard); settings/browser_cache_ttl; settings/rocket_loader (case-by-case — can break JS, report don't force).
4. Network protocols — settings/http3 (on); settings/0rtt (on, idempotent-GET caveat); settings/ipv6 (on); settings/websockets (on); HTTP/2 (on).
5. DNS hygiene — dns_records: proxiable A/AAAA/CNAME should be proxied (orange) unless intentionally direct (flag grey-cloud = origin exposed); dnssec (active); parse TXT for SPF (root v=spf1), DKIM (*._domainkey), DMARC (_dmarc.<zone> — flag missing as action); dangling CNAMEs -> takeover risk; low TTLs on stable records.
6. Analytics / observability — Web Analytics (/accounts/{acct}/rum/site_info/list — privacy-first, free; enabled for this zone?); Security Events summary (GraphQL firewallEventsAdaptive — last 24h threats blocked, top rules/countries -> posture context, not a setting); Logpush (logpush/jobs — paid/Enterprise, report gap only). Pull the security-events summary read-only so the report shows what the WAF is actually catching, not just whether it's on.