Checks

Cloudflare DNS records (CNAME, MX, NS, SRV) that point to hostnames are assessed for dangling record vulnerabilities by checking if the target domain resolves to a valid address, preventing subdomain takeover, mail interception, and service hijacking attacks.

Cloudflare DNS records are assessed for internal IP exposure by checking if A or AAAA records point to private, loopback, or reserved IP addresses which could leak internal network structure.

Cloudflare DNS records are assessed for wildcard usage by checking if A, AAAA, CNAME, MX, or SRV records use wildcard entries (*.example.com) which can increase attack surface, expose unintended services, or allow mail interception.

Cloudflare DNS records are assessed for proxy configuration by checking if A, AAAA, and CNAME records are proxied through Cloudflare to benefit from DDoS protection, WAF, and caching capabilities.

Cloudflare zones are assessed for Always Online configuration by checking if it is disabled to prevent serving stale cached content when the origin server is unavailable, which could expose outdated or sensitive information.

Cloudflare zones are assessed for Automatic HTTPS Rewrites configuration by checking if it is enabled to automatically rewrite insecure HTTP links to HTTPS, resolving mixed content issues and enhancing site security.

Cloudflare zones are assessed for Bot Fight Mode configuration by checking if it is enabled to detect and mitigate automated bot traffic targeting the zone through browser integrity checks.

Cloudflare zones are assessed for Browser Integrity Check configuration by verifying that HTTP headers are analyzed to identify requests from bots or clients with missing/invalid browser signatures.

Cloudflare zones are assessed for Challenge Passage (challenge TTL) configuration by checking if it is set between 15 minutes and 45 minutes to balance security with user experience.

Cloudflare zones are assessed for Development Mode configuration by checking if it is disabled to ensure caching, security features, and performance optimizations are active in production environments.

Cloudflare zones are assessed for DNSSEC configuration by checking if it is enabled to cryptographically sign DNS responses and protect against DNS spoofing and cache poisoning attacks.

Cloudflare zones are assessed for Email Obfuscation (Scrape Shield) configuration by checking if it is enabled to protect email addresses on the website from automated harvesting by bots and spammers.

Cloudflare zones are assessed for firewall blocking rules by checking if custom rules use block, challenge, js_challenge, or managed_challenge actions to actively protect against threats rather than only logging.

Cloudflare zones are assessed for Hotlink Protection (Scrape Shield) configuration by checking if it is enabled to prevent other websites from directly linking to images and media, consuming bandwidth without authorization.

Cloudflare zones are assessed for HTTP Strict Transport Security (HSTS) by checking if it is enabled with a max-age of at least 6 months (15768000 seconds) and includes subdomains to instruct browsers to always use HTTPS across the entire domain.

Cloudflare zones are assessed for Always Use HTTPS setting by checking if it is enabled to automatically redirect all HTTP requests to HTTPS, enforcing encrypted transport for all visitors.

Cloudflare zones are assessed for IP Geolocation configuration by checking if it is enabled to add the CF-IPCountry header to requests, enabling geographic-based access controls, firewall rules, and analytics.

Cloudflare zones are assessed for minimum TLS version configuration by checking if the version is set to at least TLS 1.2 to ensure connections use secure, modern cryptographic protocols.

Cloudflare zones are assessed for Rate Limiting configuration by checking if rules are configured to protect against DDoS attacks, brute force attempts, and API abuse.

Cloudflare zones are assessed for CAA (Certificate Authority Authorization) DNS records by checking if they exist with issue or issuewild tags that specify which certificate authorities are permitted to issue SSL/TLS certificates for the domain.

Cloudflare zones are assessed for DKIM (DomainKeys Identified Mail) records by checking if TXT records exist at *._domainkey subdomains containing a cryptographically valid public key in the p= parameter used to verify email signatures.

Cloudflare zones are assessed for DMARC (Domain-based Message Authentication, Reporting, and Conformance) records by checking if a TXT record exists at _dmarc subdomain with an enforcement policy (p=reject or p=quarantine) to actively block or quarantine spoofed emails.

Cloudflare zones are assessed for SPF (Sender Policy Framework) records by checking if a TXT record exists that specifies which mail servers are authorized to send email on behalf of the domain, and verifies that the record uses a strict policy (-all) to reject unauthorized senders.

Cloudflare zones are assessed for Under Attack Mode configuration by checking if it is disabled during normal operations, as this mode performs additional security checks including an interstitial JavaScript challenge page that significantly impacts user experience.