Cloudflare audit and configuration by our experts
Cloudflare can be switched on in minutes, but a poor setup lets attacks through or slows your site down. Our experts audit your account, rank the gaps by severity and fix the configuration, then can run it for you up to 24/7.
Cloudflare experts, every day
Gaps ranked by severity
Remediation and operations
/ Our Clients
/
The 3 most common Cloudflare configuration mistakes
None of them triggers an alert. The dashboard stays green, and the gap stays open.
Protection that can be bypassed
Security rules that block nothing
Poorly controlled account and cache
What we check in your Cloudflare account
Eight areas reviewed, from your server’s exposure to access to your account.
DNS and origin exposure
Proxied records, subdomains revealing the server address, DNSSEC, origin access restricted to Cloudflare.
SSL/TLS encryption
Full (strict) mode, minimum TLS version, HSTS and origin authentication.
Web application firewall (WAF)
Active managed rules, blocking or log-only mode, exceptions, outdated custom rules.
Bots and rate limiting
Login pages, forms and APIs protected against credential theft and content scraping.
Cache and performance
Cache rules, cache hit ratio, dynamic content cached by mistake, legacy Page Rules to migrate.
Account access
Members, roles, two-factor authentication, API tokens and audit log.
Zero Trust
If you use it: Access, Tunnel and access policies for your internal applications.
Logs and monitoring
Who reads the security events, and their export to your SIEM or our SOC.
/ How the audit works
Four steps, from access to your account through to acceptance testing of the fixes.
Scoping and access
Scope (zones, domains, Cloudflare plan) and creation of a dedicated named account. No changes without your approval.
Analysis and external tests
Point-by-point review of the settings, then checks from the internet: origin reachability, headers, encryption.
Report and debrief
Gaps ranked by severity, risk explained in plain language, fix to apply. Verbal debrief with your teams.
Remediation and acceptance
By your teams following our plan, or by ours. Observation before any blocking, then acceptance testing of every fix.
/
What you receive at the end of the audit
A report built to be used, not filed away: every gap is linked to a specific action.
- An executive summary your leadership can read
- The list of gaps, ranked: critical, important, improvement
- For each gap: the risk, the fix to apply and the estimated effort
- A prioritised remediation plan
- Acceptance testing after remediation, to check every gap is closed
/ What happens after the audit?
The audit tells you what to fix. We can also do it for you, then make sure the configuration stays healthy over time.
Configuration remediation
We apply the plan rule by rule, in observation before any blocking, then verify every fix in acceptance testing.
Operations up to 24/7
Monitoring, rule tuning and incident handling, from business hours to 24/7 on-call.
SOC integration
Cloudflare security events analysed by our analysts, with an effective response to attacks.
Broader security audit
Penetration testing and architecture review, to cover what Cloudflare cannot see.
/
Why entrust your Cloudflare to Castelis?
Many of our managed infrastructure services clients run on Cloudflare. Our engineers configure and operate it every day: we know where the settings that let attacks through are hiding.
- Over 25 years of experience and more than 500 projects delivered
- Over 80 people at Castelis, a hunik group company bringing together 7 specialist firms
- Castelis is ISO 27001:2022 certified
Using another CDN as well? We also audit bunny.net and Akamai.
/ Related technologies
Cloudflare fits into a wider chain: hosting, monitoring and threat detection.
Stack tailored to your architecture and compliance obligations.
/
Frequently asked questions
Because an active Cloudflare is not necessarily an effective Cloudflare. An origin server reachable directly, encryption in Flexible mode or a firewall left in log-only mode trigger no alert: the dashboard stays green while the protection can be bypassed. The audit checks every setting and tells you exactly what to fix, and in what order.
No. During the audit, we analyse the configuration and run checks from the internet, without changing anything. No fix is applied without your approval, and new security rules first run in observation mode to measure their effect before any blocking.
A dedicated named account for our experts on your Cloudflare account, with the permissions needed for the audit and then, if you ask us to handle remediation, for its implementation. Our actions are recorded in the Cloudflare audit log and access is removed at the end of the engagement.
No. The audit applies to every plan, from Free to Enterprise. Some protections, such as advanced firewall rules, fine-grained bot management or log export, depend on your plan: the audit also tells you whether yours really covers your needs, or whether you are paying for features you do not use.
Most often because of false positives: a firewall rule that is too strict, a security level set too high or a bot challenge applied to the whole site. Blocking real customers costs as much as an attack. The audit identifies the rules involved and tunes them to stop attacks without getting in your visitors’ way.
It depends on the number of domains and zones, and on the Cloudflare products in use. The initial scoping sets the scope and the schedule before any commitment.
The audit is quoted after an initial scoping call, based on the number of zones, the products in use and the depth of analysis required. Remediation and operations are covered by a separate proposal, if you would like us to handle them.
No. When properly configured, Cloudflare effectively protects your exposed web perimeter: application firewall, DDoS attacks, bots and encryption. It does not cover flaws in your application, your workstations or your internal network. It is one layer of defence, to be complemented by penetration testing and security monitoring.
Get your Cloudflare configuration checked
