Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesStaged rollout and automatic rollbackBackup and point-in-time restoreUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settingsAlways Online, 0-RTT and 103 Early HintsTiered origin (L2)Stream forwarding (Layer 4)
Security
Security overview and big screenWebsite checkupAttack logCC protectionWAFLists and access controlBots and scannersJA4 / TLS fingerprintXDP kernel-level filteringPaid features
Analytics and alerts
StatisticsAccess logsAlerts and notificationsAlert channels
Accounts and licensing
Users and plansLicenses and add-onsOnline top-up and identity verification

Website checkup

About 6 minApplies to v2.3.1Updated 2026-11-02

Website checkup examines each site's security configuration item by item, scores it, lists the concrete problems and tells you how to fix them. Open Security Center › Website Checkup.

What it checks

There are currently 20 checks, graded Critical or Medium. Typical ones:

  • Origin reachable directly: when the origin can be hit without going through the CDN, WAF and CC protection are bypassed.
  • HTTPS not enforced, or TLS 1.0 / 1.1 still allowed.
  • Missing security response headers.
  • Directory listing enabled, or sensitive files accessible.
  • Application version with known vulnerabilities (judged together with what the vulnerability protection has seen probed).
  • Overly broad allowlist, or uploads without signature scanning.
  • Admin login page without rate limiting.
  • Protection not fully set up for the site type: the site type and the enabled protection scheme do not match.

How to read the results

  • By site: one row per site with the score and issue count; expand for details.
  • By issue: groups the same kind of problem across sites, ideal for fixing them in one pass.
  • Every issue has "View how to fix"; items that can be handled automatically can be fixed directly.
  • Check a site's score for the last 8 weeks to see whether remediation is working.
  • "Export PDF" produces a report to hand to the site owner or keep on file.

Recheck and schedule

"Recheck all" runs the checks immediately. By default the checkup runs every Monday at 03:00; in Checkup settings you can change the checkup frequency to daily at 03:00 or manual only. Turn on the critical-issue alert to be notified when a critical problem is found (see Alert channels).

Batch fix and revoke

You can select multiple sites and fix them in a batch of up to 100 sites at a time; sites you uncheck are left alone. Within 7 days you can revoke a fix with "Revoke" at the top right of the item; settings you changed manually afterwards are kept.

Ignore an item

When a finding is intentional (for example the business really needs an old TLS version), ignore that item for the site. Ignored items do not count towards the score, and you can stop ignoring them at any time.

Tip Start with the Critical "origin reachable directly" item: make the origin accept only node IPs. Until that is fixed, WAF and CC protection can be bypassed.
Caution A batch fix changes the configuration of many sites. For sites with special requirements, ignore the relevant item first and then batch-fix the rest.

Protection items are configured as described in Paid features, WAF and CC protection.