Skip to content

Refine compliance and security documentation #22221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
May 7, 2025
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ Cloudflare's [bot products](/bots/) identify and mitigate automated traffic to p

This cookie expires after 30 minutes of continuous inactivity by the end user. The cookie contains information related to the calculation of Cloudflare's proprietary bot score and, when Anomaly Detection is enabled on Bot Management, a session identifier. The information in the cookie (other than time-related information) is encrypted and can only be decrypted by Cloudflare.

A separate `__cf_bm` cookie is generated for each site that an end user visits, as Cloudflare does not track users from site to site or from session to session. The `__cf_bm` cookie is generated independently by Cloudflare, and does not correspond to any user ID or other identifiers in a customers web application.
A separate `__cf_bm` cookie is generated for each site that an end user visits, as Cloudflare does not track users from site to site or from session to session. The `__cf_bm` cookie is generated independently by Cloudflare, and does not correspond to any user ID or other identifiers in a customer's web application.

:::note
Bot Management is available to Enterprise customers as an add-on service. Contact your Cloudflare account team to enable Bot Management for your site. Non-Enterprise customers can enable [Bot Fight Mode or Super Bot Fight Mode](/bots/).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Project Cybersafe Schools grants eligible schools with free access to Cloudflare

## Children’s Internet Protection Act (CIPA)

<Render file='cybersafe-description' product='fundamentals' />
<Render file="cybersafe-description" product="fundamentals" />

### CIPA Requirements

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ title: Delivering Videos with Cloudflare

## Using Cloudflare's Services

Cloudflare launched in 2010 believing everyone deserves a secure, fast, reliable web presence. We did not think you should have to pay more when you came under cyber attack, so we offered free and fixed-rate pricing for websites. That worked because most websites don't consume much bandwidth, and so we could provide our services in an affordable way to everyone. From the beginning, we prohibited streaming video content using our bandwidth. While you could embed a video from another provider, we limited your ability to use our services to deliver video bits from our network to your visitors. This is because every second of a typical video requires as much bandwidth as loading a full web page.
Cloudflare launched in 2010 believing everyone deserves a secure, fast, reliable web presence. We did not think you should have to pay more when you came under cyber attack, so we offered free and fixed-rate pricing for websites. That worked because most websites don't consume much bandwidth, and so we could provide our services in an affordable way to everyone. From the beginning, we prohibited streaming video content using our bandwidth. While you could embed a video from another provider, we limited your ability to use our services to deliver video bits from our network to your visitors. This restriction exists because every second of a typical video requires as much bandwidth as loading a full web page.

Over time we recognized that some of our customers wanted to stream video using our network. To accommodate them, we developed our [Stream](https://www.cloudflare.com/products/cloudflare-stream/) product. Stream delivers great performance at an affordable rate charged based on how much load you place on our network.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ You may encounter a challenge loop where the challenge keeps reappearing without
- **JavaScript disabled**: Turnstile relies on JavaScript to function properly.
- **Detection errors**: If Turnstile suspects bot-like behavior, you may encounter repeated challenges for verification.

Most challenges are quick and should take only a few seconds to complete. If it takes longer, ensure your network is stable and follow the [troubleshooting steps](#troubleshooting).
Most challenges are quick to complete and typically take only a few seconds. If it takes longer, ensure your network is stable and follow the [troubleshooting steps](#troubleshooting).

:::note
If the issue persists, try switching to a different network or device to rule out any issues with your browser environment.
Expand All @@ -32,4 +32,4 @@ Follow the steps below to ensure that your environment is properly configured.

<Render file="troubleshooting-steps" product="turnstile"/>

If none of the above resolves your issue, contact the website administrator with the [error code](/turnstile/troubleshooting/client-side-errors/error-codes/) and Ray ID or submit a [feedback report](/turnstile/troubleshooting/feedback-reports/) through the Turnstile widget by selecting **Submit Feedback**.
If none of the above resolves your issue, contact the website administrator with the [error code](/turnstile/troubleshooting/client-side-errors/error-codes/) and Ray ID or submit a [feedback report](/turnstile/troubleshooting/feedback-reports/) through the Turnstile widget by selecting **Submit Feedback**.
4 changes: 3 additions & 1 deletion src/content/docs/fundamentals/security/pci-scans.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,9 @@ PCI scanners are tools used to identify security weaknesses. When a business und

### Open ports versus blocked traffic

There is a difference between open ports and blocked traffic. Due to the nature of how Cloudflare’s anycast network works, ports other than 80 and 443 are always open so that Cloudflare can serve traffic for other customers on these ports. However, customers can easily block all unwanted traffic to these ports by using Cloudflare [WAF Managed Rules](/fundamentals/reference/network-ports/#how-to-block-traffic-on-additional-ports) or [custom rules](/waf/custom-rules/). The PCI scan will show the ports being open, but the traffic would not reach your origin server. This is an often misunderstood concern.
Cloudflare's anycast network operates in a way that keeps ports other than 80 and 443 open, allowing it to serve traffic for other customers on these ports.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.... or multiple


However, customers can easily block all unwanted traffic to these ports by using Cloudflare [WAF Managed Rules](/fundamentals/reference/network-ports/#how-to-block-traffic-on-additional-ports) or [custom rules](/waf/custom-rules/). The PCI scan will show the ports being open, but the traffic would not reach your origin server. This is an often misunderstood concern.

## Additional resources

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Common signs that you are under DDoS attack include:

* Your site is offline or slow to respond to requests.
* Unexpected spikes appear in the graph of **Requests Through Cloudflare** or **Bandwidth** in your Cloudflare **Analytics** app.
* There are strange requests in your origin web server logs that do not match normal visitor behavior.
* Strange requests appear in your origin web server logs that do not match normal visitor behavior.

:::note

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ Adding any users to these groups will grant them the role. Removing the users fr

1. Go to your Microsoft Entra ID instance and select **Enterprise Applications**.
2. Select **Create your own application** and name your application.
3. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
3. Select **Integrate any other application you do not find in the gallery (Non-gallery)**.
4. Select **Create**.

### Provision the Microsoft Entra ID Enterprise application
Expand Down
6 changes: 3 additions & 3 deletions src/content/docs/fundamentals/setup/troubleshooting.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,14 @@ When you [set up Cloudflare](/fundamentals/setup/), you may experience the follo
* [DNS FAQ](/dns/troubleshooting/faq/)
* [SSL/TLS FAQ](/ssl/troubleshooting/faq/)

## Is Cloudflare attacking me?
## Is Cloudflare attacking me

There are two common scenarios where Cloudflare is falsely perceived to attack your site:
Two common scenarios falsely lead to the perception that Cloudflare is attacking your site:

* Unless you [restore the original visitor IP addresses](/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/), Cloudflare IP addresses appear in your server logs for all proxied requests.
* The attacker is spoofing Cloudflare's IPs. Cloudflare only [sends traffic to your origin web server over a few specific ports](/fundamentals/reference/network-ports/) unless you use [Cloudflare Spectrum](/spectrum/).

Ideally, because Cloudflare is a reverse proxy, your hosting provider observes attack traffic connecting from [Cloudflare IP addresses](https://www.cloudflare.com/ips/). In contrast, if you notice connections from IP addresses that do not belong to Cloudflare, the attack is direct to your origin web server. Cloudflare cannot stop attacks directly to your origin IP address because the traffic bypasses Cloudflares network.
Ideally, because Cloudflare is a reverse proxy, your hosting provider observes attack traffic connecting from [Cloudflare IP addresses](https://www.cloudflare.com/ips/). In contrast, if you notice connections from IP addresses that do not belong to Cloudflare, the attack is direct to your origin web server. Cloudflare cannot stop attacks directly to your origin IP address because the traffic bypasses Cloudflare's network.

:::note

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ To disable a subscription:

To alter your plan, select **Change** under **Active Subscriptions** and choose a new plan type. If you would like to cancel your paid plan, select **Free**.

FEES ARE NONREFUNDABLE. YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM. Following any cancellation, however, you will continue to have access to the Paid Services through the end of your current Subscription Term (except with respect to Services subject to usage-based billing). We may, in our sole discretion, provide a refund, discount, or credit (Credits) to you in a specific instance, however the provision of Credits in a specific instance does not entitle you to Credits in the future for similar instances or obligate us to provide additional Credits.
FEES ARE NONREFUNDABLE. YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM. Following any cancellation, however, you will continue to have access to the Paid Services through the end of your current Subscription Term (except with respect to Services subject to usage-based billing). We may, in our sole discretion, provide a refund, discount, or credit ("Credits") to you in a specific instance, however the provision of Credits in a specific instance does not entitle you to Credits in the future for similar instances or obligate us to provide additional Credits.



Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ You may cancel at any time before the 30 days ends by reaching out to your sales

## Available features and products

To enable a preview service, use the **Dashboard link** in the following table. Then, select **Enable**. And that is it. You will have instant access to the product or feature you selected so you can begin determining if it is right for your business needs.
To enable a preview service, use the **Dashboard link** in the following table. Then, select **Enable**. And that is it. You will have instant access to the product or feature you selected so you can begin determining if it is right for your business' needs.

| Name | Dashboard link | Docs | Community |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
Expand All @@ -25,7 +25,7 @@ To enable a preview service, use the **Dashboard link** in the following table.
| Load Balancing | [Load Balancing dashboard](https://dash.cloudflare.com/?to=/:account/:zone/traffic/load-balancing) | [Load Balancing docs](/load-balancing/) | [Load Balancing community](https://community.cloudflare.com/tag/loadbalancing) |
| Advanced Rate Limiting | [Rate Limiting dashboard](https://dash.cloudflare.com/?to=/:account/:zone/security/waf/rate-limiting-rules) | [Rate Limiting docs](/waf/rate-limiting-rules/) | [Rate Limiting community](https://community.cloudflare.com/c/security/6) |
| Stream | [Stream dashboard](https://dash.cloudflare.com/?to=/:account/stream) | [Stream docs](/stream/) | [Stream community](https://community.cloudflare.com/tag/cloudflarestream) |
| Waiting Room | [Waiting Room Room dashboard](https://dash.cloudflare.com/?to=/:account/:zone/traffic/waiting-rooms) | [Waiting Room docs](/waiting-room/) | [Waiting Room community](https://community.cloudflare.com/) |
| Waiting Room | [Waiting Room dashboard](https://dash.cloudflare.com/?to=/:account/:zone/traffic/waiting-rooms) | [Waiting Room docs](/waiting-room/) | [Waiting Room community](https://community.cloudflare.com/) |
| Web3 | [Web3 dashboard](https://dash.cloudflare.com/?to=/:account/:zone/web3) | [Web3 docs](/web3/) | [Web3 discord](https://discord.cloudflare.com) |
| Workers | [Workers dashboard](https://dash.cloudflare.com/?to=/:account/workers) | [Workers docs](/workers/) | [Workers discord](https://discord.com/invite/cloudflaredev) |
| Zero Trust | [Zero Trust dashboard](https://one.dash.cloudflare.com/) | [Zero Trust docs](/cloudflare-one/) | [Zero Trust community](https://community.cloudflare.com/c/security/access/51) |
Expand Down