Checks
29 articles
- Ensure DNS records pointing to hostnames have valid targets without takeover risk
- Ensure DNS records do not use wildcard entries
- Ensure DNS records do not expose internal IP addresses
- Ensure Cloudflare proxy is enabled for applicable DNS records
- Ensure WAF is enabled
- Ensure Cloudflare Zone Challenge Passage Is Configured Between 15 and 45 Minutes
- Ensure DKIM record exists with valid public key
- Ensure Universal SSL is enabled
- Ensure Rate limiting is configured for the zone
- Ensure Cloudflare Zone Firewall Rules Use Blocking Actions to Protect Against Threats
- Ensure Bot Fight Mode is enabled
- Ensure IP Geolocation is enabled
- Ensure Cloudflare Zone OWASP Managed WAF Rulesets Are Enabled
- Ensure SSL/TLS encryption mode is set to Full (Strict)
- Ensure SPF record exists with strict policy (-all)
- Ensure DMARC record exists with enforcement policy (p=reject or p=quarantine)
- Ensure CAA record exists with issue or issuewild tag
- Ensure Automatic HTTPS Rewrites is enabled
- Ensure Always Use HTTPS is enabled
- Ensure DNSSEC is enabled
- Ensure Always Online is disabled
- Ensure HSTS is enabled with recommended max-age and includes subdomains
- Ensure Under Attack Mode is disabled during normal operations
- Ensure Email Obfuscation is enabled
- Ensure Minimum TLS version is set to 1.2 or higher
- Ensure TLS 1.3 is enabled
- Ensure Development mode is disabled for production zones
- Ensure Cloudflare Zone Browser Integrity Check Is Enabled
- Ensure Hotlink Protection is enabled