Checks

Cloudflare zones are assessed for HTTP Strict Transport Security (HSTS) by checking if it is enabled with a max-age of at least 6 months (15768000 seconds) and includes subdomains to instruct browsers to always use HTTPS across the entire domain.

Cloudflare zones are assessed for Always Use HTTPS setting by checking if it is enabled to automatically redirect all HTTP requests to HTTPS, enforcing encrypted transport for all visitors.

Cloudflare zones are assessed for IP Geolocation configuration by checking if it is enabled to add the CF-IPCountry header to requests, enabling geographic-based access controls, firewall rules, and analytics.

Cloudflare zones are assessed for minimum TLS version configuration by checking if the version is set to at least TLS 1.2 to ensure connections use secure, modern cryptographic protocols.

Cloudflare zones are assessed for Rate Limiting configuration by checking if rules are configured to protect against DDoS attacks, brute force attempts, and API abuse.

Cloudflare zones are assessed for CAA (Certificate Authority Authorization) DNS records by checking if they exist with issue or issuewild tags that specify which certificate authorities are permitted to issue SSL/TLS certificates for the domain.

Cloudflare zones are assessed for DKIM (DomainKeys Identified Mail) records by checking if TXT records exist at *._domainkey subdomains containing a cryptographically valid public key in the p= parameter used to verify email signatures.

Cloudflare zones are assessed for DMARC (Domain-based Message Authentication, Reporting, and Conformance) records by checking if a TXT record exists at _dmarc subdomain with an enforcement policy (p=reject or p=quarantine) to actively block or quarantine spoofed emails.

Cloudflare zones are assessed for SPF (Sender Policy Framework) records by checking if a TXT record exists that specifies which mail servers are authorized to send email on behalf of the domain, and verifies that the record uses a strict policy (-all) to reject unauthorized senders.

Cloudflare zones are assessed for Under Attack Mode configuration by checking if it is disabled during normal operations, as this mode performs additional security checks including an interstitial JavaScript challenge page that significantly impacts user experience.

Cloudflare zones are assessed for SSL/TLS encryption mode by checking if the mode is set to Full (Strict) to ensure end-to-end encryption with certificate validation.

Cloudflare zones are assessed for TLS 1.3 configuration by checking if it is enabled to benefit from improved security through simplified cipher suites and faster handshakes with zero round-trip time resumption.

Cloudflare zones are assessed for Universal SSL configuration by checking if it is enabled to provide free SSL/TLS certificates for the domain and its subdomains, enabling secure HTTPS connections.

Cloudflare zones are assessed for Web Application Firewall (WAF) configuration by checking if it is enabled to protect against common web vulnerabilities including SQL injection, XSS, and OWASP Top 10 threats.

Cloudflare zones are assessed for OWASP managed rulesets by checking if they are enabled to protect against common web application vulnerabilities including SQL injection, XSS, and other OWASP Top 10 threats.