Production checklist
Cloudflare production checklist: 5 checks before launch
5 checks for running Cloudflare in production: 3 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (3)
Use SSL mode Full (strict)
Flexible mode sends traffic from Cloudflare to your origin unencrypted.
How to verify
SSL/TLS → Overview: the encryption mode is Full (strict), and the origin has a valid certificate (a Cloudflare Origin CA certificate works).
Turn on Always Use HTTPS
Redirects every plain-HTTP request before it reaches your app.
Verify with a request
A plain-HTTP request should get a 301 redirect to https://.
curl -sI http://<your-domain> | head -3
Add rate limiting rules for login, sign-up and API routes
Blocks credential stuffing and scraping at the edge.
How to verify
Security → WAF → Rate limiting rules has a rule covering login, sign-up and API paths. A burst of requests to one of them should start returning 429.
Good to have (2)
Enable the WAF managed rules
Blocks common exploit traffic before it reaches your origin.
How to verify
Security → WAF → Managed rules: the Cloudflare managed ruleset is deployed for the zone.
Only accept origin traffic from Cloudflare IPs
When you run your own origin server (not a managed host like Vercel)Otherwise attackers can bypass Cloudflare by hitting the origin directly.
Verify from the command line
Connect to the origin’s IP directly, skipping Cloudflare. A pass: the connection is refused or times out.
curl -sI --max-time 10 --resolve <your-domain>:443:<origin-ip> https://<your-domain>
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.