Cloudflare Integration
Overview
Section titled “Overview”The Cloudflare integration connects your Cloudflare account to Fencer, enabling automated security assessments of your DNS zones, WAF configuration, SSL/TLS settings, and Zero Trust infrastructure. Once connected, Fencer continuously monitors your Cloudflare environment and raises findings when it detects misconfigurations or security gaps.
Cloudflare has two catalog entries on Admin > Integrations: Cloudflare (Scan), described first on this page, and Cloudflare (Monitor), which ingests audit logs and firewall events into Security Monitoring (see Monitor (SIEM)).
Prerequisites
Section titled “Prerequisites”- A Cloudflare account with at least one zone configured.
- An Account-scoped API token with Read All Resources permissions. Profile-scoped tokens are not supported.
- The Administrator role in your Fencer organization.
- An active Fencer subscription.
How it works
Section titled “How it works”When you connect a Cloudflare account, Fencer uses the Cloudflare API to discover your account resources — zones, DNS records, WAF rulesets, page rules, rate limiting rules, API tokens, Turnstile widgets, and Zero Trust resources. It then runs a set of built-in security checks against these resources and creates vulnerabilities for any issues found. Fencer rescans the account daily, or weekly on plans without daily scheduled scans.
Fencer also syncs Cloudflare account members into the identity management system, tracking each member’s email, role, MFA status, and membership state. The integration links to the architecture graph so you can see how your Cloudflare zones relate to other assets.
Usage / Configuration
Section titled “Usage / Configuration”Generating a Cloudflare API token
Section titled “Generating a Cloudflare API token”- Log in to the Cloudflare Dashboard at
https://dash.cloudflare.com/. - In the top-left corner, select the account you want to connect.
- Navigate to Manage Account → Account API Tokens.
- Click Create Token.
- Choose the Read All Resources template.
- In the Zone Resources section, select Include → All zones from an account, then choose the account you picked above.
- Click Continue to summary, review the settings, and click Create Token.
- Copy the generated token — you will not be able to see it again.
Connecting Cloudflare in Fencer
Section titled “Connecting Cloudflare in Fencer”- Go to Admin > Integrations.
- Under Available Integrations, click the Cloudflare card.
- Review the getting-started information and click Continue. The token instructions are shown beside the form.
- Select the Environment (Production, Development, Test, or Mixed).
- Paste your API token into the Cloudflare API token field.
- Click Connect.
Fencer validates the token by listing the accounts it can reach and detects your account automatically. If successful, it creates a cloud account asset named after your Cloudflare account, and triggers an architecture scan, an identity sync, and a cloud infrastructure scan automatically. Connecting an account that was connected before restores its existing connection.
Editing a connection
Section titled “Editing a connection”- Go to Admin > Integrations.
- Click Edit on your Cloudflare connection.
- Update the Name (leave it blank to use the Cloudflare account’s name), Environment, or Cloudflare API token (leave it blank to keep the stored token). A new token must belong to the same Cloudflare account.
- Click Save changes.
Disconnecting
Section titled “Disconnecting”- Go to Admin > Integrations.
- Click Remove on the Cloudflare connection and confirm with Remove.
This soft-deletes the connection and its associated cloud account asset. The linked vendor record is also removed.
Security checks
Section titled “Security checks”Fencer runs the following security checks against your Cloudflare configuration.
Account and API tokens
| Check | Severity | Description |
|---|---|---|
| Two-factor authentication not enforced | High | Account does not enforce 2FA for members. |
| API token excessive permissions | Medium | Active API tokens with access to all zones or all accounts. |
| API token never expires | Medium | Active API tokens with no expiration date. |
| Turnstile not configured | Low | Account has no Turnstile widgets for CAPTCHA protection. |
Zone security and traffic
| Check | Severity | Description |
|---|---|---|
| Zone flagged for phishing | High | Cloudflare has flagged the zone for phishing. |
| WAF not configured | Medium | Zone has no managed or custom WAF rulesets. |
| Rate limiting not configured | Medium | Zone has no rate limiting rules to protect against abuse. |
| Rate limiting rules all disabled | Medium | Zone has rate limiting rules, but every rule is disabled. |
| Bot management not enabled | Medium | Zone does not have bot management enabled. |
| Authenticated Origin Pulls disabled | Medium | Zone allows direct connections to the origin server bypassing Cloudflare. |
| Development mode enabled | Medium | Zone has development mode on, which disables caching and security features. |
| Security level off | Medium | Zone security level is off or essentially_off. |
| Zone paused | Medium | Zone is paused, so Cloudflare is not proxying its traffic. |
| Insecure page rules | Medium | Active page rules that redirect to HTTP, disable SSL, or disable security. |
| Under Attack mode on | Low | Zone is in Under Attack mode. |
| Browser Integrity Check disabled | Low | Zone has Browser Integrity Check turned off. |
| Email Address Obfuscation disabled | Low | Zone has Email Address Obfuscation turned off. |
| IP Geolocation disabled | Low | Zone has IP Geolocation turned off. |
| Always Online enabled | Low | Zone can keep serving a stale copy of the site. |
| Challenge passage TTL out of range | Low | Challenge passage TTL is outside the 15 to 45 minute range. |
SSL/TLS
| Check | Severity | Description |
|---|---|---|
| SSL disabled or set to Flexible | High / Medium | Zone SSL mode is off (High) or flexible (Medium), allowing unencrypted traffic. |
| Minimum TLS version below 1.2 | High | Zone accepts TLS 1.0 or 1.1. |
| SSL mode not strict | Medium | Zone uses SSL mode full, which does not validate the origin certificate. |
| Always Use HTTPS disabled | Medium | Zone does not redirect HTTP to HTTPS. |
| TLS 1.3 disabled | Medium | Zone has TLS 1.3 turned off. |
| HSTS not configured | Medium | HSTS is off, includeSubDomains is off, or max-age is below six months. |
| TLS 1.3 0-RTT enabled | Low | Zone enables 0-RTT, which can replay early data. |
| Automatic HTTPS Rewrites disabled | Low | Zone has Automatic HTTPS Rewrites turned off. |
DNS and email
| Check | Severity | Description |
|---|---|---|
| SPF record missing | Medium | A zone that accepts mail has no SPF record. |
| SPF policy permissive | Medium / Low | SPF record ends in +all (Medium) or does not end with -all (Low). |
| DMARC record missing | Medium | A zone that accepts mail has no DMARC record. |
| DMARC policy not enforced | Low | DMARC record does not enforce quarantine or reject. |
| DKIM record missing | Medium | A zone that accepts mail has no usable DKIM record. |
| Wildcard DNS record | Medium | Zone has a wildcard (*.) DNS record. |
| DNS record points at private IP | Medium | A DNS record points at a non-public address. |
| CAA record missing | Low | Zone publishes DNS records but has no CAA record. |
| DNS records not proxied | Low | A, AAAA, or CNAME records not proxied through Cloudflare, exposing the origin IP. |
The TLS and zone-setting checks that read a zone’s settings (such as Always Use HTTPS, HSTS, and security level) run only on zones Cloudflare is actively proxying. A zone “accepts mail” when it has an MX or SPF record.
Examples
Section titled “Examples”After connecting a Cloudflare account named “Acme Corp Production”, Fencer might create findings such as:
- High severity: “Two factor authentication is not enabled for Acme Corp Production” — navigate to your Cloudflare account settings and enable Enforce 2FA for all members.
- Medium severity: “SSL mode is set to ‘flexible’ for zone ‘example.com’ in account ‘Acme Corp Production’” — change the SSL mode to Full (Strict) in the Cloudflare dashboard under SSL/TLS → Overview.
- Low severity: “DNS record ‘api.example.com’ (A) in zone ‘example.com’ is not proxied through Cloudflare” — toggle the proxy status to Proxied (orange cloud) in your DNS settings.
Monitor (SIEM)
Section titled “Monitor (SIEM)”The Cloudflare (Monitor) integration ingests your Cloudflare account’s audit logs and firewall events into Security Monitoring, where detection rules and threat hunting can use them. It reads the Audit Logs and GraphQL Analytics APIs, which are available on all Cloudflare plans (it does not use the Enterprise-only Logpull), and pulls new events every five minutes. It requires a plan that includes Security Monitoring; without it the card shows Upgrade.
Creating a token for the monitor
Section titled “Creating a token for the monitor”Create either a User API Token (My Profile → API Tokens, starting from the Read analytics and logs template) or, if you have the Super Administrator role, an Account-Owned Token (Manage Account → Account API Tokens → Create Custom Token). Account-Owned tokens keep working if the person who created them leaves. Either way, the token needs these account-level permissions:
- Account → Account Settings: Read (audit logs)
- Account → Account Analytics: Read (account-level GraphQL firewall events)
- Account → Account Firewall Access Rules: Read (recommended for firewall event enrichment, on an Account-Owned token)
Scope the token to the account you want Fencer to monitor.
Connecting the monitor
Section titled “Connecting the monitor”- Go to Admin > Integrations, click the Cloudflare (Monitor) card, and click Continue.
- Enter an Integration name (for example,
Prod edge). - Paste the token into Cloudflare API token. Fencer loads the accounts the token can reach.
- Choose the account from Cloudflare account, then click Connect.
To edit the connection, click Edit on it: you can change the Integration name and the Cloudflare API token (leave it blank to keep the stored token). The Cloudflare account ID is read-only; to monitor a different account, connect it as a new integration. Click Remove to stop ingestion and delete the connection.
Troubleshooting
Section titled “Troubleshooting”- “Unable to connect your Cloudflare account. Please check your API token.” — Verify that the API token is correct, active, and has Read All Resources permissions scoped to the target account.
- “It looks like you have connected Profile scoped API token. Please use Account scoped API token instead.” — The token returns multiple accounts. Create an Account-scoped token instead of a Profile-scoped one.
- “This API token is for a different Cloudflare account.” — When you edit a connection, the new token must belong to the account you originally connected.
- Connection shows an issue — Before each scan, Fencer tests the connection by listing accounts and then zones. If listing accounts fails (for example, the token is revoked), the connection shows Issue; if only listing zones fails, it shows Needs attention. Update the token on the edit page to restore it.
- “Unable to validate the Cloudflare API token…” (monitor) — The monitor token is missing the Account Settings: Read or Account Analytics: Read permission.