Starter engagement

Cloudflare Security Baseline

A read-first review of agreed Cloudflare zones and edge controls, followed by prioritized, rollback-aware configuration recommendations.

Isometric edge ring of DNS, TLS, WAF and Access controls in front of an origin server, with a read-first review document and rollback arrow.

Questions this engagement should answer

Are DNS, TLS, WAF, Access and routing settings aligned with the intended architecture?
Which controls are absent, conflicting, stale or broader than required?
Could a proposed edge change interrupt legitimate traffic or remove the recovery path?
Which changes can be tested and deployed in safe stages?

What the work includes

Inventory of agreed accounts, zones, hostnames, routes and relevant controls
Read-only review of selected DNS, certificate, WAF, Access and edge settings
Validation of representative public behaviour where authorized
Prioritized recommendations with prerequisites and rollout safeguards

Deliverables

Current-state edge and dependency summary
Findings with control-plane and live-behaviour evidence
Prioritized configuration improvement register
Staged implementation and rollback notes for approved follow-on changes

Who it is for

Organizations that adopted Cloudflare incrementally
Teams preparing a DNS, WAF, Access or TLS change
Owners who need one evidence-based view of edge configuration and operational risk

Engagement boundaries

The baseline does not make production changes unless implementation is separately authorized
Origin, application and identity-provider testing is limited to the agreed scope
A passing public scan is not treated as proof that every application path is secure
Tokens and exported configurations require an approved restricted exchange method

How to prepare

Identify the Cloudflare account, zones and business-critical hostnames in scope
Name owners for DNS, applications, identity and change approval
List planned migrations, certificate events or maintenance windows
Prepare read-only access or supervised evidence collection where practical

Client responsibilities

Confirm the systems, decision and evidence in scope
Provide an accountable owner and approved access or supervised evidence collection
Authorize any testing or change activity separately
Review findings and own production, legal and risk decisions

Timeline framing

A proposed schedule is confirmed after scope, access, evidence availability and operational constraints are understood. No work begins until responsibilities and commercial terms are agreed.

Scope, timing and commercial terms are confirmed before work begins. This page is not a fixed quote or authorization to access systems or make changes.

Free initial consultation

Need a second set of eyes on a security or infrastructure decision?

Describe the environment, the risk and the outcome you need. The first conversation is a free initial consultation, with no obligation to go further.

Contact HAI Consulting