The Edge Guardian

Three settings: minimum TLS version 1.2 or 1.3, always-use-HTTPS on, and TLS 1.3 on. The guardian reads all three on every active zone. If any is wrong it writes the fix, then reads the values again and believes those, not the write. It also deploys Cloudflare's free managed WAF ruleset to any zone without it, keeping whatever rules the zone already has.

It only auto-applies settings that can't break a working site. The SSL mode is reported and never changed, because strict mode can take a site down. Proxy status on sensitive hostnames is alerted on and never flipped, since that can break the origin's certificate renewal. No blocking rules are applied on their own.

The guardian used to send its fixes and throw the response away.

The baseline used to be two settings. On October 16 a vulnerability assessment found that the most sensitive zone we run was the only one with TLS 1.3 off. The guardian had reported it protected the whole time, because it never read that setting.

So TLS 1.3 went into the baseline, defined in one function, and the function got an offline self-test. Another job counts its PASS and FAIL lines, so a script gutted to an empty success exit reads as broken.

None of the checks above answers "is this zone being checked at all." A zone in an account the token can't see isn't an error: the API returns success with zero rows. One zone sat like that, with no audit, no WAF and no alert.

Now the guardian loads every Cloudflare token it holds, audits each zone with the token that can manage it, and checks the result against a list of zones it must audit. An accepted shortfall goes in a register with a reason and a review date, and the date is checked too, so an exception can't become permanent by being forgotten.

A sweep of 31 zones in August found two with no managed WAF: one serving live traffic, one about to. The guardian now deploys the ruleset on every run, a daily sweep checks again, and a zone where the deploy fails reads zero until someone fixes it.

Some sites are hosted on a site-builder's own Cloudflare edge, where our zone settings never apply. An hourly probe checks a rotating sample of those names: TLS 1.0 must be refused and plain HTTP must redirect.

The managed WAF is a baseline, not full application-layer protection. File integrity monitoring on the origin covers what it misses.

Logins to the admin surfaces reach the SIEM within a minute. Configuration-change auditing at the edge is a known gap, stated on the security page, and the guardian works the same way: when a check fails or can't run, it reports the gap instead of a green.