Cloudflare
Connect Cloudflare with an API token so Safeguard can check your zones' TLS, HTTPS, DNSSEC and WAF settings and your API tokens.
Connect Cloudflare
Safeguard reads your Cloudflare zones and account with read-only access: SSL/TLS mode and minimum TLS version, Always Use HTTPS, HSTS, DNSSEC, the managed WAF rules, whether API tokens expire, and whether the account's logs are exported.
Use the API token method for the compliance checks. Cloudflare's OAuth sign-in connects Cloudflare's MCP server, and the token it issues works only with that server, not with the Cloudflare API the checks read. An OAuth connection still works for Search. If your card was connected with OAuth, the checks report an error asking you to reconnect with an API token.
1. Create the API token in Cloudflare
- In the Cloudflare dashboard, open My Profile › API Tokens (or create an account-owned token) and choose Create Token › Create Custom Token.
- Add these permissions, all Read:
| Type | Permission |
|---|---|
| Account | Account Settings |
| Account | Account API Tokens |
| Zone | Zone |
| Zone | Zone Settings |
| Zone | DNS |
| Zone | Zone WAF |
- Under Zone Resources, include the zones you want checked, for example All zones or specific zones.
- Create the token and copy it. Cloudflare shows it once.
Optional: the audit-log export check lists your Logpush jobs, which Cloudflare documents only under the Logs permission with write (Edit) access. That is broader than read-only. Without it, that one check reports an error naming the permission, and every other check still runs.
2. Connect it in Safeguard
- Open Compliance › Connectors, search for Cloudflare and click Connect.
- Choose API token:
| Field | What to enter |
|---|---|
| API token | The token |
| Account ID (optional) | Your Cloudflare account ID, to limit the checks to that account's zones. It is on the right of any zone's overview page. |
- Click Connect with token. The card shows Verified once Cloudflare accepts the token.
Several accounts
Cloudflare can be connected more than once, one connection per account. When multiple accounts are switched on for your workspace, open the connected card and choose Add another account.
What Safeguard checks
- SSL/TLS encryption mode is Full (strict)
- Minimum TLS version
- Always Use HTTPS and HSTS
- DNSSEC
- The managed WAF ruleset is deployed and blocking
- API tokens have an expiry
- Account audit logs are exported
If you use Cloudflare Access, connect the Cloudflare Access card too; it checks that your Access applications require MFA.
Troubleshooting
- Not working, mentioning the MCP server: the card was connected with OAuth. Use Reconnect and enter an API token.
- Not working, naming a permission: add that Read permission to the token in Cloudflare, then use Re-check.