Score every part of your Cloudflare estate.
Tap a category to see its top finding.
Gaps · 11 findings
API security
API Shield, schema validation, mTLS, rate limits per endpoint.
On this page
Nanosek provides Cloudflare environment audit services that review account governance, DNS, CDN, WAF, DDoS protection, Bot Management, API Shield, Zero Trust, certificates, logging, and rulesets. The audit produces a prioritized findings report with severity classifications, evidence, remediation recommendations, and a roadmap suitable for Nanosek-led or internal team remediation.
Who this is for
Why organizations get a Cloudflare environment audit
Reduce security risk and attack surface
Cloudflare environments accumulate stale rules, wide bypasses, weak WAF enforcement, and missing security controls over time. An audit identifies the highest-risk gaps before they are exploited.
Find misconfiguration before it matters
Misconfigured cache behavior, incorrect TLS settings, broken redirect chains, exposed origins, and orphaned DNS records create silent risk. Structured review surfaces these before they cause incidents.
Validate compliance and governance posture
Compliance frameworks and internal audits may require evidence of access control, logging coverage, encryption standards, and change management. Nanosek produces structured evidence alongside findings.
Reduce rule sprawl and operational debt
WAF rulesets, rate limits, bot policies, Zero Trust rules, and redirect lists grow without governance. An audit identifies duplicates, conflicts, stale entries, and rules that no longer serve their original purpose.
Assess readiness before migration or expansion
Organizations migrating additional properties, enabling new Cloudflare products, or expanding Zero Trust need a baseline review to ensure the current environment can support growth safely.
Recover after an incident or near-miss
After a WAF bypass, bot attack, DDoS event, or Zero Trust misconfiguration, an audit provides structured root-cause evidence and identifies gaps that contributed to the incident.
Understand what you have inherited
Teams taking over a Cloudflare environment from a previous team, vendor, or acquisition often have limited documentation. An audit produces an authoritative inventory with risk context.
Improve operational confidence and handover quality
Audits improve documentation, runbooks, and team understanding of what is deployed, why it exists, and what the operational implications of changes are.
Prepare for managed services engagement
Organizations moving to managed Cloudflare operations benefit from a baseline audit that establishes the current state before Nanosek takes on ongoing responsibility.
Get a second opinion on a specific concern
Security teams sometimes need expert validation of a specific area such as WAF tuning, Zero Trust policy, Bot Management rollout, or certificate coverage before accepting risk.
Our Cloudflare environment audit methodology
Scope and access
- Define audit scope including accounts, zones, Zero Trust organizations, and product areas to review.
- Establish read-only access using Cloudflare API tokens, account audit roles, or temporary audit credentials.
Configuration inventory
- Extract and document the current state of DNS records, rulesets, WAF policies, certificates, logging configuration, Zero Trust applications, and account settings.
- Build an inventory that serves as both an audit artifact and a baseline for future change tracking.
Risk assessment
- Evaluate each configuration area against security best practices, Cloudflare guidance, and the organization's risk tolerance and compliance requirements.
- Identify misconfigurations, missing controls, stale entries, overly permissive exceptions, and operational gaps.
Evidence and findings documentation
- Document each finding with evidence, severity classification, business impact description, and specific remediation steps.
- Classify findings by severity using Critical, High, Medium, Low, and Informational categories.
Remediation roadmap
- Prioritize findings into a structured roadmap with recommended action order, effort estimates, and dependency notes.
- Separate quick wins from longer remediation efforts and identify findings that require business owner input before action.
Findings presentation and workshop
- Present findings to the security, infrastructure, and operations teams with an opportunity to review, challenge, and prioritize.
- Discuss remediation trade-offs and agree on a realistic action plan with owners and timelines.
Optional remediation support
- Nanosek can execute remediations directly or work alongside the internal team to close findings.
- Remediation work follows change management process with documentation, testing, rollback preparation, and sign-off.
How findings are classified
What we audit
Account and governance
Account structure, IAM, roles, API token scope, audit log configuration, change management workflows, and Terraform or API governance.
DNS
Zone records, proxy status, TTLs, DNS-only records, CNAME flattening, email authentication records (SPF, DKIM, DMARC), DNSSEC, and orphaned or stale entries.
CDN and caching
Cache rules, cache eligibility, edge TTL, browser TTL, bypass logic, custom cache keys, Tiered Cache, Cache Reserve, and path-specific behavior correctness.
WAF and application security
Managed ruleset selection and tuning, custom rules, exception scope, enforcement modes, rate limiting thresholds, and rule conflict or overlap analysis.
DDoS protection
HTTP DDoS mitigation level, L3/L4 Magic Transit or Spectrum configuration if applicable, override rules, sensitivity settings, and incident response readiness.
Bot Management
Bot score policy coverage by path, enforcement mode (log, challenge, block), verified bot handling, rate limiting alignment, and known false-positive risks.
API Shield
API discovery, endpoint inventory, schema validation coverage, mTLS deployment, API-specific rate limits, and authentication controls.
Zero Trust and Access
Access policy coverage, identity provider integration, service token scoping, application onboarding gaps, split tunnel design, WARP enrollment, and Gateway policy review.
Certificates
Universal SSL, Advanced Certificate Manager, custom certificates, hostname coverage, expiry monitoring, TLS minimum version, and cipher suite configuration.
Logging and observability
Logpush dataset coverage, destination configuration, field selection, Security Analytics usage, alert configuration, dashboard coverage, and SIEM integration.
Rulesets and rule governance
Phase rule ordering, ruleset inheritance, wildcard scope, redundant or conflicting rules, and stale bypass or exception entries with no documented owner or expiry.
| Audit area | What we review |
|---|---|
| Account and governance | Account structure, IAM, roles, API token scope, audit log configuration, change management workflows, and Terraform or API governance. |
| DNS | Zone records, proxy status, TTLs, DNS-only records, CNAME flattening, email authentication records (SPF, DKIM, DMARC), DNSSEC, and orphaned or stale entries. |
| CDN and caching | Cache rules, cache eligibility, edge TTL, browser TTL, bypass logic, custom cache keys, Tiered Cache, Cache Reserve, and path-specific behavior correctness. |
| WAF and application security | Managed ruleset selection and tuning, custom rules, exception scope, enforcement modes, rate limiting thresholds, and rule conflict or overlap analysis. |
| DDoS protection | HTTP DDoS mitigation level, L3/L4 Magic Transit or Spectrum configuration if applicable, override rules, sensitivity settings, and incident response readiness. |
| Bot Management | Bot score policy coverage by path, enforcement mode (log, challenge, block), verified bot handling, rate limiting alignment, and known false-positive risks. |
| API Shield | API discovery, endpoint inventory, schema validation coverage, mTLS deployment, API-specific rate limits, and authentication controls. |
| Zero Trust and Access | Access policy coverage, identity provider integration, service token scoping, application onboarding gaps, split tunnel design, WARP enrollment, and Gateway policy review. |
| Certificates | Universal SSL, Advanced Certificate Manager, custom certificates, hostname coverage, expiry monitoring, TLS minimum version, and cipher suite configuration. |
| Logging and observability | Logpush dataset coverage, destination configuration, field selection, Security Analytics usage, alert configuration, dashboard coverage, and SIEM integration. |
| Rulesets and rule governance | Phase rule ordering, ruleset inheritance, wildcard scope, redundant or conflicting rules, and stale bypass or exception entries with no documented owner or expiry. |
Common issues we find
Audit coverage matrix
Account and IAM
Roles, API tokens, audit log, change governance
Token scope inventory, role review, audit log configuration check
DNS
Record accuracy, proxy status, authentication records
Zone record inventory, SPF/DKIM/DMARC gap report, TTL review
CDN and caching
Cache behavior correctness, bypass accuracy
Cache rule map, bypass audit, edge and browser TTL review
WAF
Rule coverage, enforcement mode, exception scope
Ruleset inventory, bypass review, managed rule tuning assessment
DDoS protection
Mitigation level, override rules, incident readiness
DDoS config review, override scope, response workflow check
Bot Management
Bot policy coverage, enforcement mode, false-positive risk
Path coverage map, enforcement mode report, crawl allowlist review
API Shield
Endpoint inventory, schema validation, mTLS coverage
API discovery summary, schema validation coverage, mTLS status
Zero Trust and Access
Policy coverage, IdP integration, service token scope
Application policy audit, service token inventory, IdP validation
Certificates
Coverage gaps, expiry, TLS version and cipher settings
Certificate inventory, expiry timeline, TLS minimum version report
Logging and observability
Logpush coverage, SIEM integration, alert gaps
Logpush dataset review, field selection audit, alert configuration check
Rulesets
Rule ordering, conflicts, stale entries
Ruleset conflict analysis, stale entry list, ordering recommendations
| Audit area | What we review | Example output |
|---|---|---|
| Account and IAM | Roles, API tokens, audit log, change governance | Token scope inventory, role review, audit log configuration check |
| DNS | Record accuracy, proxy status, authentication records | Zone record inventory, SPF/DKIM/DMARC gap report, TTL review |
| CDN and caching | Cache behavior correctness, bypass accuracy | Cache rule map, bypass audit, edge and browser TTL review |
| WAF | Rule coverage, enforcement mode, exception scope | Ruleset inventory, bypass review, managed rule tuning assessment |
| DDoS protection | Mitigation level, override rules, incident readiness | DDoS config review, override scope, response workflow check |
| Bot Management | Bot policy coverage, enforcement mode, false-positive risk | Path coverage map, enforcement mode report, crawl allowlist review |
| API Shield | Endpoint inventory, schema validation, mTLS coverage | API discovery summary, schema validation coverage, mTLS status |
| Zero Trust and Access | Policy coverage, IdP integration, service token scope | Application policy audit, service token inventory, IdP validation |
| Certificates | Coverage gaps, expiry, TLS version and cipher settings | Certificate inventory, expiry timeline, TLS minimum version report |
| Logging and observability | Logpush coverage, SIEM integration, alert gaps | Logpush dataset review, field selection audit, alert configuration check |
| Rulesets | Rule ordering, conflicts, stale entries | Ruleset conflict analysis, stale entry list, ordering recommendations |
Deployment steps
- 01 Define audit scope, confirm accounts and zones, establish read-only access, and agree on compliance or risk focus areas.
- 02 Extract and inventory the current configuration state across all in-scope Cloudflare products and zones.
- 03 Evaluate each configuration area for misconfiguration, missing controls, risky bypasses, and operational gaps.
- 04 Document findings with evidence, severity classification, business impact, and remediation steps.
- 05 Build a prioritized remediation roadmap with effort estimates, dependency notes, and business owner actions.
- 06 Present findings and discuss remediation priorities with security, infrastructure, and operations stakeholders.
- 07 Support or execute remediation work with change management process, testing, rollback preparation, and documentation.
Risks and mitigations
Access scope not sufficient for full audit.
Agree access requirements and credential model during scoping. Nanosek uses read-only API tokens and documents the minimum access required.
Live environment changes during audit.
Take configuration snapshots at the start of the engagement. Flag configuration changes during the audit that may affect findings.
Findings require urgent remediation that conflicts with change freeze.
Triage Critical and High findings on delivery. Work with business owners to fast-track remediations that address immediate risk within change governance.
Audit scope expands beyond original agreement.
Define scope with explicit boundaries before engagement starts. Handle out-of-scope findings as addendum items or scope extensions with agreed timeline and cost impact.
Remediation recommendations conflict with existing business requirements.
Document the business context for exceptions. Nanosek marks accepted risks with owner and rationale so they are not re-surfaced in future audits without review.
Configuration exported during audit becomes outdated before remediation.
Re-validate configuration before remediation begins for Critical and High findings. Use Terraform or API to confirm current state.
Audit output shared too broadly.
Handle all audit findings under data handling agreements. Restrict distribution of the findings report to stakeholders with a need to know.
Internal team lacks capacity to execute remediation roadmap.
Nanosek can provide remediation support alongside the internal team or take on execution with change management governance.
New risk introduced during remediation.
Apply change management process to all remediations. Test in staging or low-traffic context where possible, prepare rollback steps, and validate after change.
Audit findings not actioned over time.
Nanosek recommends a follow-up review cycle of 6 to 12 months and can provide managed Cloudflare operations to maintain ongoing configuration hygiene.
| Risk | Mitigation |
|---|---|
| Access scope not sufficient for full audit. | Agree access requirements and credential model during scoping. Nanosek uses read-only API tokens and documents the minimum access required. |
| Live environment changes during audit. | Take configuration snapshots at the start of the engagement. Flag configuration changes during the audit that may affect findings. |
| Findings require urgent remediation that conflicts with change freeze. | Triage Critical and High findings on delivery. Work with business owners to fast-track remediations that address immediate risk within change governance. |
| Audit scope expands beyond original agreement. | Define scope with explicit boundaries before engagement starts. Handle out-of-scope findings as addendum items or scope extensions with agreed timeline and cost impact. |
| Remediation recommendations conflict with existing business requirements. | Document the business context for exceptions. Nanosek marks accepted risks with owner and rationale so they are not re-surfaced in future audits without review. |
| Configuration exported during audit becomes outdated before remediation. | Re-validate configuration before remediation begins for Critical and High findings. Use Terraform or API to confirm current state. |
| Audit output shared too broadly. | Handle all audit findings under data handling agreements. Restrict distribution of the findings report to stakeholders with a need to know. |
| Internal team lacks capacity to execute remediation roadmap. | Nanosek can provide remediation support alongside the internal team or take on execution with change management governance. |
| New risk introduced during remediation. | Apply change management process to all remediations. Test in staging or low-traffic context where possible, prepare rollback steps, and validate after change. |
| Audit findings not actioned over time. | Nanosek recommends a follow-up review cycle of 6 to 12 months and can provide managed Cloudflare operations to maintain ongoing configuration hygiene. |
Cloudflare environment audit checklist
- Audit scope agreed and documented
- All Cloudflare accounts and zones in scope identified
- Read-only audit access provisioned
- Zero Trust and Access organizations in scope confirmed
- Current Terraform or IaC state provided if available
- Recent incident or change history reviewed
- Compliance requirements or specific controls in scope confirmed
- Account IAM and role inventory extracted
- API token inventory and scope documented
- DNS zone records exported and reviewed
- Email authentication records (SPF, DKIM, DMARC) evaluated
- Certificate inventory and expiry timeline reviewed
- WAF ruleset configuration extracted
- WAF exceptions and bypass list reviewed
- DDoS protection configuration reviewed
- Bot Management policy and enforcement mode reviewed
- Rate limiting rule inventory and thresholds reviewed
- API Shield endpoint inventory and schema validation reviewed
- Zero Trust application policy inventory reviewed
- Zero Trust service token inventory and scope reviewed
- WARP and Gateway policy configuration reviewed
- Logpush configuration and dataset coverage reviewed
- Alert configuration and coverage reviewed
- Cache rule and cache bypass logic reviewed
Deliverables
- Audit scope and access documentation
- Cloudflare configuration inventory across all in-scope zones and products
- DNS and email authentication records review
- WAF ruleset and bypass audit report
- Bot Management policy coverage and enforcement report
- DDoS protection configuration review
- API Shield endpoint and schema validation coverage report
- Zero Trust application and policy audit
- Zero Trust service token and WARP configuration review
- Certificate inventory and expiry timeline
- Logging and observability coverage report
- Ruleset conflict and stale rule analysis
- Prioritized findings report with severity, evidence, and remediation steps
- Remediation roadmap with effort estimates and ownership guidance
- Executive summary of key risks and quick wins
- Optional findings presentation and workshop
- Optional remediation support with documentation and change management
When Nanosek should help
Frequently asked questions
What does a Cloudflare environment audit cover?
How long does an audit take?
What access does Nanosek need for the audit?
Will the audit disrupt our Cloudflare environment?
What is included in the findings report?
Can Nanosek remediate findings after the audit?
How should we prioritize the remediation roadmap?
How is the audit different from a Cloudflare security audit?
How often should we run a Cloudflare environment audit?
Understand and improve your Cloudflare environment
Nanosek delivers a structured, evidence-based review of your Cloudflare configuration with prioritized findings, severity classifications, and a remediation roadmap your team can act on.