What we find most often
Three mistakes come up again and again. The connection between Cloudflare and the actual server still runs unencrypted, although the visitor sees a valid certificate. The address of the server is still public, so any attacker simply walks past Cloudflare — the whole firewall is then decoration. And the bot protection is switched on but not set up: it stops scanners, but equally the callback from the payment provider, the synchronisation with the ERP or the monitoring. Whoever does not know this spends days looking for the reason why payments are not confirmed.
Add cache rules that, in a shop, deliver one customer’s basket to the next, convenience features that silently break storefronts, and an “Under Attack” mode that was never switched off after the attack. All of these look fine from the outside. That is exactly why we look first, before we touch anything.
Foundation: encryption, and a server that only Cloudflare can reach
We start with the zone itself: which records run through Cloudflare and which do not, whether encryption reaches all the way to the server, whether DNS is protected against manipulation, and whether the server address is somewhere it does not belong. That sounds like basics — these are the points where a setup stays open despite Cloudflare.
Then the server is sealed off: it accepts requests only from Cloudflare’s networks, and on request Cloudflare additionally identifies itself to the server with a certificate. We also make sure that logs, login throttles and statistics still see real visitors instead of Cloudflare addresses — a detail that is missing surprisingly often, and without which every server-side throttle runs into nothing.
Firewall and Bot Fight Mode: rules that hit attacks, not customers
Our web application firewall works in layers: first Cloudflare’s managed rulesets against known attack patterns, on top custom rules that fit your system — admin access only for those who need it, requests for files that do not exist on your site dropped immediately, paths for interfaces and payment providers explicitly allowed. Rate limiting caps login attempts, search queries and form submissions per sender without a normal visitor ever noticing.
For bot protection the plan decides the tools. The simple Bot Fight Mode has no exceptions; wherever interfaces, webhooks or monitoring are involved — that is, in practically every shop — you need Super Bot Fight Mode with verified bots on the allow list and custom rules that exclude certain paths from bot protection. We set this up so that the scanner sees the challenge page and the payment provider does not.
Rules are never finished. After going live we read the security events: what was blocked, what was only challenged, and was there anything that should have passed? False positives become exceptions, new patterns become rules. For forms we use Turnstile instead of classic captchas — no picture puzzles, verified on the server, as on this website.
Cache, operation and your account
Static files can be held by Cloudflare for a long time — this is where the biggest gain in load time and server load lies. For page content the system decides: a TYPO3 or WordPress page can be cached at the edge if publishing clears the cache deliberately; a shop needs rules that always bypass basket, checkout and customer account and work together with Shopware’s own cache. We tie cache clearing to your workflows so that neither editors nor the shop ever deliver stale content.
The Cloudflare account belongs to you — we work with access, not ownership, exactly as with ad accounts. Every setting is documented and justified so that someone else can understand it later. And because attack patterns, your interfaces and Cloudflare’s features change, the zone is part of the regular review cycle of our support.
A note for context: Cloudflare is a US provider, and your visitors’ traffic passes through its network. Using it belongs in your privacy policy and requires a data processing agreement, which Cloudflare provides. We supply the technical details — the data protection assessment stays with you or your data protection officer.