Back to Checks
cloudflare

Always Online is disabled

zone_always_online_disabled
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Zone

Cloudflare zones are assessed for Always Online configuration by checking if it is disabled to prevent serving stale cached content when the origin server is unavailable, which could expose outdated or sensitive information.

Prowler logoProwlerprowler-provider-cloudflare

Risk

With Always Online enabled, Cloudflare serves cached pages when the origin is unavailable.

  • Confidentiality: stale cache may expose sensitive information that was subsequently removed
  • Integrity: outdated content may contain incorrect or superseded information
  • Availability: reliance on cached content masks origin failures requiring attention

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_always_online_disabled

Recommendation

Disable Always Online and implement proper high availability solutions.

  • Use redundant origins or load balancing for genuine high availability
  • Stale cached content may contain outdated security information
  • Origin failures should be detected and addressed, not masked
  • Consider Cloudflare Workers for custom failover logic if needed

Remediation

Terraform

# Disable Always Online to prevent serving stale cached content
resource "cloudflare_zone_settings_override" "always_online" {
  zone_id = "<ZONE_ID>"
  settings {
    always_online = "off" # Critical: prevents serving potentially stale or sensitive cached content
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Caching > Configuration
3Scroll to Always Online
4Toggle the setting to Off
5Implement proper high availability through redundant origins or load balancing

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_always_online_disabled(Check):
    """Ensure that Always Online is disabled for Cloudflare zones.

    Always Online serves stale cached content when the origin server is unavailable.
    While this maintains availability, it can expose outdated or potentially sensitive
    information. For security-sensitive applications, it is recommended to disable
    this feature to ensure users always receive current, accurate content or an
    appropriate error message when the origin is down.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Always Online disabled check.

        Iterates through all Cloudflare zones and verifies that Always Online
        is disabled. When enabled, this feature may serve stale cached content
        that could contain outdated or sensitive information.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Always
            Online is disabled, or FAIL status if it is enabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            always_online = (zone.settings.always_online or "").lower()

            if always_online == "off":
                report.status = "PASS"
                report.status_extended = (
                    f"Always Online is disabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Always Online is enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References