Cloudflare Hygiene

Periodic posture sweep over live zones: preflight -> sweep (read-only) -> report -> confirm -> apply -> verify. Optimization = real wins only: TLS strict, HTTPS forced, modern protocols on, DNS proxied + mail auth complete. No theater (no settings churned that already match optimal, no proxying records that must stay direct). Building on Cloudflare (Workers/Pages/KV/D1) -> cloudflare, hand off.

Preflight

1. Enumerate zones - GET /zones (paginate). List name · id · plan. Warn: full sweep across N zones takes a moment
2. Permission scope - this skill mutates zone settings + DNS, needs an authorized session that can write them. Probe once against the first zone: GET /zones/{firstZoneId}/settings/ssl. 9109/10000 (Unauthorized) -> scope too narrow, stop and surface the upgrade path (see Access setup below) before sweeping. Don't limp through a settings-blind run

3. All work goes through mcp__cloudflare__execute, which runs a JS async arrow function - not a plain REST caller. Every call in this skill is shorthand for that shape:

   async () => cloudflare.request({ method: "GET", path: `/zones/${zoneId}/settings/ssl` })

   accountId is pre-injected; zone ids come from step 1. Returns {success, status, result, errors, result_info} - read errors[0].code for the 9109 probe, result_info.total_pages to paginate. Batch a whole category's GETs into one execute call (loop inside the function, return an object) - one round-trip per category beats one per setting. mcp__cloudflare__search (OpenAPI spec, refs resolved) for endpoint/body shapes; mcp__cloudflare__docs for product behavior

Sweep (Read-Only)

Per zone, every category below - each shows in the report, clean ones as "ok", never silently dropped. GETs only here; no mutation. Full endpoint + optimal-value matrix lives in references/best-practices.md; scripts/audit.mjs is the reference read-only sweep logic (GETs + verdict classifier).

1. SSL/TLS - settings/ssl (want strict); settings/always_use_https (on); settings/min_tls_version (≥1.2); settings/tls_1_3 (on); settings/automatic_https_rewrites (on); settings/security_header HSTS (enabled, max-age ≥6mo, includeSubDomains; preload = opt-in only)
2. Security / WAF / bot - rulesets phases (http_request_firewall_managed deployed? ddos_l7 present?); settings/security_level (medium); bot_management (Bot Fight Mode on - Free tier); settings/email_obfuscation (on); settings/browser_check (on); custom firewall ruleset (http_request_firewall_custom - any bespoke rules?); rate limiting ruleset (http_ratelimit phase - login/API endpoints protected?); IP access rules / Zone Lockdown (firewall/access_rules/rules - stale allowlists?); Page Shield (page_shield - client-side/Magecart, plan-gated); Authenticated Origin Pulls (settings/tls_client_auth - mTLS edge->origin so origin only trusts CF); Leaked Credential Check (leaked-credential-checks - alerts on breached creds, plan-gated). Under Attack mode = situational (incident only), never default-on
3. Performance / caching - settings/brotli (on); settings/early_hints (on); settings/cache_level (aggressive/standard); settings/browser_cache_ttl; settings/rocket_loader (case-by-case - can break JS, report don't force)
4. Network protocols - settings/http3 (on); settings/0rtt (on, idempotent-GET caveat); settings/ipv6 (on); settings/websockets (on). HTTP/2 is automatic with the proxy - no readable setting, don't hunt for one
5. DNS hygiene - dns_records: proxiable A/AAAA/CNAME should be proxied (orange) unless intentionally direct (flag grey-cloud = origin exposed); dnssec (active); parse TXT for SPF (root v=spf1), DKIM (*._domainkey), DMARC (_dmarc.<zone> - flag missing as action); dangling CNAMEs -> takeover risk; low TTLs on stable records
6. Analytics / observability - Web Analytics (/accounts/{acct}/rum/site_info/list - privacy-first, free; enabled for this zone?); Security Events summary (GraphQL firewallEventsAdaptive - last 24h threats blocked, top rules/countries -> posture context, not a setting); Logpush (logpush/jobs - paid/Enterprise, report gap only). Pull the security-events summary read-only so the report shows what the WAF is actually catching, not just whether it's on

Report

Table per zone × category: check · current · optimal · verdict (ok / attention = watch / action = fix available, named). Lead per zone: "Zone X: N ok, N attention, N actions". Then AskUserQuestion multiSelect over the actions only. Anything that can break traffic gets its own option, side effects stated first.

Actions (Each Confirmed, Side Effects Stated First)

• SSL mode -> Full (strict): PATCH settings/ssl {value:"strict"} - breaks if origin lacks a valid cert. Confirm origin has a cert (Cloudflare Origin CA or real CA) before flipping
• Always Use HTTPS / Auto HTTPS Rewrites / min TLS 1.2 / TLS 1.3 on: PATCH each - low risk; min-TLS bump can lock out ancient clients, name it
• HSTS: PATCH settings/security_header {value:{strict_transport_security:{enabled,max_age,include_subdomains}}} (single-setting body wraps in value; nosniff also available). Hard to undo - browsers cache it; preload is near-permanent. Default no preload unless user explicitly opts in
• Brotli / Early Hints / HTTP/3 / 0-RTT / IPv6 / WebSockets on: PATCH settings/{id} {value:"on"} each - safe, idempotent
• Email obfuscation / browser check on: PATCH settings/{id} {value:"on"} - safe
• Bot Fight Mode on: PUT bot_management {fight_mode:true} (whole-object PUT, not a setting PATCH) - safe; can challenge some automation
• Rate limiting rule: PUT rulesets/phases/http_ratelimit/entrypoint - protect login/API/expensive endpoints. Set thresholds from real traffic (use the analytics summary) - too tight = legit 429s. Confirm the matched path + threshold
• Authenticated Origin Pulls: PATCH settings/tls_client_auth {value:"on"} - origin must be configured to require the CF client cert first, else all traffic 502s. Two-step, origin-side change owned by user
• Page Shield: PUT page_shield {enabled:true} - plan-gated (Pro+); if Free errors, report the gap, don't churn
• Leaked Credential Check: POST leaked-credential-checks {enabled:true} - plan-gated; same fallback
• Prune stale IP access rules: DELETE firewall/access_rules/rules/{id} - confirm each; an old allow-rule can be a bypass hole
• Enable Web Analytics: POST /accounts/{acct}/rum/site_info for the zone - free, privacy-first, no cookie banner; gives RUM without GA. Safe
• Enable DNSSEC: PATCH dnssec {status:"active"} -> returns DS record; incomplete until user adds the DS record at the registrar - give them the DS values, it's a two-step
• Proxy a grey-cloud record: PATCH dns_records/{id} {proxied:true} - never proxy mail (MX/its A), verification, or services needing direct origin. Confirm per record
• Add DMARC: propose _dmarc.<zone> TXT (start v=DMARC1; p=none; rua=mailto:... for monitoring), confirm value, POST dns_records

Access Setup (When Preflight Fails)

The cloudflare MCP is a remote OAuth server (https://mcp.cloudflare.com/mcp) - there is no API token in its config to widen. A 9109/10000 means the authorized Cloudflare account lacks the permission, not that a token needs editing. Two ways out:

• Fix the account - the OAuth'd user needs Zone.Settings:Edit + DNS:Edit + Zone:Read on the target zones (plus Bot Management / SSL where the plan allows). Change the member's role in the Cloudflare dashboard -> Manage Account -> Members, then reconnect the MCP (/mcp) so the session picks up the new scope. Re-run preflight after
• Fall back to the script - scripts/audit.mjs takes CLOUDFLARE_API_TOKEN directly, so a scoped token (My Profile -> API Tokens) gets a read-only sweep without touching the MCP session. Read-only: applies still need the MCP path above

Rules

• Sweep = read-only. Change state only via confirmed actions, one at a time -> verify (re-GET, confirm new value) -> next
• Side effects before confirm, always: SSL-mode origin break, min-TLS client lockout, HSTS/preload permanence, DNSSEC two-step, proxying a direct-only record
• No churn: a setting already at optimal is ok, not an action - don't PATCH it to look busy. Clean zone -> "posture optimal", stop
• Never report a finding this file predicts - the verdict comes from the run, not from here. Baked-in findings are how an audit skill rots
• Report-only is valid - fixing is optional, never assumed
• Free-plan limits: some managed-WAF rules, Bot Management depth, and Page Rules count are plan-gated - report the gap, don't pretend it's fixable on Free
• Boundaries: Workers/Pages/KV/D1/R2/Terraform -> cloudflare; registrar-side DNS, origin-server config, email DNS content policy -> out of scope, name it