Skip to main content

RUN A SECURITY AUDIT OF A CLOUDFLARE ZONE

This guide shows you how to run the @webframp/cloudflare-audit workflow against one zone and produce a report with severity-rated findings. The audit checks SSL mode, HTTPS enforcement, development mode, zone status, firewall rules, WAF managed rulesets, DNS proxying, dangling CNAMEs, CAA records, Worker routes, cache level and hit rate. The audit only reads from Cloudflare. It changes nothing.

Prerequisites

  • A Cloudflare API token that can read zones, DNS, firewall, Workers and cache settings, stored in a vault named cloudflare under the key CLOUDFLARE_API_TOKEN (see Storing Secrets)
  • The ID of the zone to audit and the ID of its Cloudflare account

Pull the extensions

Pull the extension that provides the Cloudflare behavior types:

swamp extension pull @webframp/cloudflare

The output looks like:

INF extension·pull: Pulling "@webframp/cloudflare"@"2026.10.14.1"
INF extension·pull: Identity verified: "@webframp/cloudflare"@"2026.10.14.1"
INF extension·pull: Pulled "@webframp/cloudflare"@"2026.10.14.1"
INF extension·pull: Extracted 14 files:

Then pull the audit workflow and its report:

swamp extension pull @webframp/cloudflare-audit

The output looks like:

INF extension·pull: Pulling "@webframp/cloudflare-audit"@"2026.10.14.1"
INF extension·pull: Identity verified: "@webframp/cloudflare-audit"@"2026.10.14.1"
INF extension·pull: Pulled "@webframp/cloudflare-audit"@"2026.10.14.1"
INF extension·pull: Extracted 6 files:

Define the five behaviors the audit reads

The workflow expects these behavior names. Create each behavior with its type and required global arguments (see Create and Run a Behavior):

  • cf-zone of type @webframp/cloudflare/zone, with apiToken
  • cf-dns of type @webframp/cloudflare/dns, with apiToken and zoneId
  • cf-waf of type @webframp/cloudflare/waf, with apiToken and zoneId
  • cf-worker of type @webframp/cloudflare/worker, with apiToken and accountId
  • cf-cache of type @webframp/cloudflare/cache, with apiToken and zoneId

Set apiToken to the vault reference in every behavior. A zone-scoped behavior such as cf-dns looks like this:

globalArguments:
  apiToken: "${{ vault.get('cloudflare', 'CLOUDFLARE_API_TOKEN') }}"
  zoneId: "023e105f4ecef8ad9ca31a8372d0c353"

cf-worker is scoped to the account, so it takes accountId: "01a7362d577a6c3019a474fd6f485823" instead of zoneId.

Run the audit

Pass the zone to audit as the zoneId input:

swamp workflow run @webframp/cloudflare-audit \
  --input zoneId=023e105f4ecef8ad9ca31a8372d0c353

The workflow calls the five behaviors against the Cloudflare API and records what each one reads as Swamp data. It then generates a report that rates each finding by severity and gives a recommendation.

Repeat the audit

To audit another zone, change zoneId in cf-dns, cf-waf and cf-cache and pass the same ID as the workflow input. To repeat the audit and catch configuration drift, see Run Workflows on a Schedule.