Cloudflare Security Best Practices
Behind Cloudflare? The edge stops a lot of traffic. It cannot stop your app returning the wrong user's data.
Verify your app follows these best practices automatically.
These best practices are derived from the actual security findings we see in Cloudflare apps — not a generic OWASP list. Priority ordered: critical items close data-exposure gaps, high items prevent compromise, medium items reduce attack surface. Stack-specific guidance for Supabase included.
Quick Wins
Security Best Practices
#1Edge protection does not cover application
highlayer authorization
Implementation
Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
#2Origin server reachable directly if its IP leaks
mediumA common failure mode in Cloudflare applications: origin server reachable directly if its ip leaks. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse.
Implementation
Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.
#3Harden authentication
highA common failure mode in Cloudflare applications: workers and pages functions shipping without auth checks. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse.
Implementation
Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
#4Security headers assumed to be handled by the proxy
mediumA common failure mode in Cloudflare applications: security headers assumed to be handled by the proxy. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse.
Implementation
Configure Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options in your hosting platform's config.
Common Mistakes to Avoid
Edge protection does not cover application
layer authorization
Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
Origin server reachable directly if its IP leaks
A common failure mode in Cloudflare applications: origin server reachable directly if its ip leaks. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse.
Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.
Workers and Pages Functions shipping without auth checks
A common failure mode in Cloudflare applications: workers and pages functions shipping without auth checks. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse.
Enforce email verification, minimum password requirements, and rate limiting on auth endpoints. Test auth flows as unauthenticated and cross-user to verify access controls.
Verify Your Cloudflare App Security
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Frequently Asked Questions
What's the minimum security I need for a Cloudflare app?
The critical-priority items above are non-negotiable for any Cloudflare app that handles user data: . Everything else is iterative.
Should I run a security scan before launching a Cloudflare app?
Yes — unconditionally. The mitigations above are specific enough that a scan proves they're implemented correctly. "I followed the checklist" isn't evidence; "the scan came back clean" is.
Is Cloudflare secure by default?
Cloudflare provides secure infrastructure, but the application-layer configuration (listed above) is the developer's job. The default state of a Cloudflare app before any security work typically has at least one critical-priority issue open.
Related Cloudflare Security Resources
Similar Platforms
More on Cloudflare Security
Every angle of Cloudflare security, from the specific findings we detect to step-by-step fixes.
Cloudflare Security Scanner
Hub page: scan your Cloudflare app for vulnerabilities.
Cloudflare Security Risks
Specific risks we find in Cloudflare apps, with real-world examples.
Cloudflare Security Issues
Issues grouped by severity with detection and fix steps.
Is Cloudflare Safe?
Honest assessment of Cloudflare's production readiness.
Cloudflare Security Checklist
Pre-launch checklist covering every finding class for Cloudflare.
How to Secure Cloudflare Apps
Step-by-step hardening guide for Cloudflare deployments.
Last updated: April 2026