Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take a real (or test) website and front it with Cloudflare. Add the domain, set the web record to proxied (orange-cloud), and configure: HTTPS with the SSL/TLS mode set to Full (Strict) — NOT Flexible — so the edge<->origin leg is encrypted and validated; sensible caching (Cache Rules / Cache-Control for static assets, with HTML left uncached or short-TTL); and a basic security baseline (the managed WAF ruleset on, a custom firewall rule, and confirm always-on DDoS protection). Verify cache HIT headers and that the origin IP is hidden. Document each setting and why.
Record proxied (orange-cloud); SSL mode Full (Strict) with a valid origin cert (not Flexible, whose origin leg is plaintext); origin IP hidden.
Static assets cached with sensible TTL; HTML handled correctly; cache HIT verified via response headers.
Managed WAF on, a working custom firewall rule, DDoS protection confirmed.
Each setting documented with the reason; understands orange vs grey cloud.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Put a site behind Cloudflare, secured and cached ## Goal Take a real (or test) website and front it with Cloudflare. Add the domain, set the web record to proxied (orange-cloud), and configure: HTTPS with the SSL/TLS mode set to Full (Strict) — NOT Flexible — so the edge<->origin leg is encrypted and validated; sensible caching (Cache Rules / Cache-Control for static assets, with HTML left uncached or short-TTL); and a basic security baseline (the managed WAF ruleset on, a custom firewall rule, and confirm always-on DDoS protection). Verify cache HIT headers and that the origin IP is hidden. Document each setting and why. ## Acceptance criteria - [ ] Proxy & TLS: Record proxied (orange-cloud); SSL mode Full (Strict) with a valid origin cert (not Flexible, whose origin leg is plaintext); origin IP hidden. - [ ] Caching: Static assets cached with sensible TTL; HTML handled correctly; cache HIT verified via response headers. - [ ] Security baseline: Managed WAF on, a working custom firewall rule, DDoS protection confirmed. - [ ] Understanding: Each setting documented with the reason; understands orange vs grey cloud. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.