Every hardening step from the ebook Cloudflare for Website Owners, gathered into one list you can tick through for each site you protect. Your progress is saved in your browser, on this device only. Free to use, no sign-up.

Foundation: Connection, Encryption, DNS, and Origin

Covered in chapters 3 to 6 of the ebook.

The site is connected to Cloudflare with web records on the orange cloud (proxied).
The SSL/TLS mode is set to Full (Strict), with HTTPS forced through Always Use HTTPS.
The minimum TLS version is set to 1.2, and HSTS is considered once HTTPS is stable.
DNSSEC is enabled and dangling DNS records have been deleted.
The Cloudflare, registrar, and primary email accounts are protected with two-factor authentication.
The origin server is hidden, and the origin firewall is locked to Cloudflare IPs only.

Active and Advanced Defense

Covered in chapters 7 to 14 of the ebook.

The managed WAF rules are enabled, with custom rules protecting important paths.
Rate limiting is set up on the login page and other points prone to abuse.
Automatic DDoS protection is active, and you know where Under Attack Mode lives.
Bot management is enabled, with verified bots still allowed.
The admin page is protected with Zero Trust Access where possible.
Important forms are protected with Turnstile, with server-side token verification.
Security headers are added and Scrape Shield is enabled.

Scalability, Reliability, and Monitoring

Covered in chapters 15 to 19 of the ebook.

Caching runs well, with dynamic paths such as the cart and admin always bypassed.
Compression, modern protocols, and Tiered Cache are enabled for performance.
Always Online is enabled as a safety net for when the server is down.
Load Balancing or Waiting Room is considered according to the site's scale and needs.
Security Events and Analytics are reviewed regularly, with notifications for important events.

The Routine Maintenance Rhythm

A defense that goes unwatched slowly weakens. A few minutes of regular review is far more valuable than a large fix made hastily after a problem happens.

Frequency	Task
Weekly	Review Security Events and Analytics to recognize unusual patterns
Monthly	Update software, themes, and plugins; audit DNS records
Monthly	Review firewall and rate limiting rules, adjust as needed
Periodically	Test backups by restoring them in a separate environment
Periodically	Check that the Cloudflare IP list on the origin firewall is current

Every line above is a chapter in the book

The checklist tells you what to do. The ebook Cloudflare for Website Owners shows you how, click by click: 22 chapters with real dashboard screenshots, honest free-versus-paid flags, and case studies including a full WordPress hardening walkthrough. See the overview, browse the free guides, or start with the free preview chapter.

Adapted from chapter 22 of the ebook. Cloudflare is a trademark of Cloudflare, Inc.; this page is by 8grams and is not affiliated with Cloudflare, Inc.

The Cloudflare Hardening Checklist

Foundation: Connection, Encryption, DNS, and Origin

Active and Advanced Defense

Scalability, Reliability, and Monitoring

The Routine Maintenance Rhythm

Every line above is a chapter in the book