WAF exceptions have accumulated
Rules were bypassed over time and it is no longer clear which exceptions are still required or safe to remove.
Cloudflare / Edge Security Review
Find the edge risks before the next WAF, DNS or TLS change finds them for you.
A focused review of Cloudflare WAF behavior, exceptions, DNS, TLS, certificate lifecycle, origin exposure and production rollout practices.
When to use it
Useful when Cloudflare is already critical, but nobody has a complete picture of the edge configuration.
The review is intended for production environments where WAF, DNS and TLS changes can directly affect application availability or security posture.
A security review is approaching
You need an independent view of edge controls, origin exposure and change risk before formal review or remediation work.
DNS changes feel high-risk
Zones, records, proxy state or nameserver changes affect production services and rollback behavior is not well documented.
TLS ownership is unclear
Certificate issuance, renewal, wildcard usage or origin certificates depend on tribal knowledge rather than an explicit lifecycle.
Origins may be exposed
Public origin access, inconsistent proxying or weak origin controls can allow traffic to bypass Cloudflare protections.
Previous edge changes caused incidents
You need better validation, acceptance criteria, traffic evidence and rollback conditions before the next production change.
Review scope
Cloudflare is reviewed as an operating system for internet traffic, not as a collection of isolated rules.
The exact depth depends on the number of zones, applications and edge policies. The review focuses on the controls that materially affect production traffic and security.
Rules, exceptions and enforcement
- Custom WAF rules and exception logic
- Managed rules and override behavior
- Path, hostname and service-specific bypasses
- Action choice: log, challenge or block
- Potential broad or stale exclusions
DNS and proxy behavior
- Production DNS record structure
- Proxied versus DNS-only records
- Origin routing and hostname dependencies
- Cutover and rollback considerations
- Records that may bypass intended edge controls
TLS and certificate lifecycle
- Edge and origin TLS configuration
- Certificate ownership and renewal paths
- Wildcard and SAN certificate usage
- Expiry and operational dependency risks
- Certificate change and rollback planning
Origin protection
- Direct origin reachability
- Controls preventing Cloudflare bypass
- Host-header and routing assumptions
- Public services that should be edge-only
- Trust boundaries between Cloudflare and origin
Change process and validation
- Acceptance criteria for edge changes
- Application-owner validation
- Production traffic evidence
- Rollback conditions and sequencing
- Separation of policy change from unrelated changes
Logs and operational visibility
- Availability of WAF and request evidence
- Ability to distinguish expected blocks from regressions
- Relevant monitoring and alerting gaps
- Evidence needed before tightening enforcement
- Operational ownership of investigation paths
Deliverables
You get a decision document, not a screenshot tour of the Cloudflare dashboard.
The output is designed to support remediation work, security review and safer production changes.
Risk register
Findings grouped by impact, likelihood and operational urgency.
Quick wins
Low-risk changes that can reduce exposure or remove obvious configuration debt.
WAF recommendations
Specific areas where rules, exceptions or enforcement behavior should be tightened, narrowed or validated.
DNS and TLS findings
Routing, proxying, certificate lifecycle and ownership gaps that can affect production behavior.
Rollout plan
Recommended sequencing, validation checkpoints and rollback conditions for higher-risk changes.
Findings review
A focused walkthrough of the findings, tradeoffs and recommended next action.
Commercial scope
Start with a fixed review, then decide whether remediation is worth doing.
The initial review starts at €1,250. Final price is confirmed before access is granted and depends on the number of zones, applications, rules and certificate relationships in scope.
From €1,250
Fixed-scope assessment
- Scope confirmation
- Read-only review where practical
- Risk register and recommendations
- Findings review call
Remediation
Scoped separately from €2,500
- WAF rule changes
- DNS or routing changes
- TLS lifecycle improvements
- Controlled rollout and validation
Case study
Real production engineering scope
- WAF hardening
- DNS migration
- TLS lifecycle planning
- Safer production rollout
Boundaries
This is an engineering review, not a generic security badge.
The scope is deliberately clear so the engagement does not imply services that are not being provided.
What this review is
- Configuration and architecture review
- Operational risk analysis
- Change and rollout recommendations
- Evidence-based remediation priorities
What this review is not
- A penetration test
- A 24/7 SOC or managed WAF service
- Guaranteed incident response
- Unlimited implementation work
Need an independent review before the next Cloudflare change?
Share the zones, applications and the edge problem you need to reduce.