# Cloudflare

> Read your Vigilbase Shield or Cloudflare Enterprise service in One: zones, traffic, posture checkups, the Rule Analyzer, reports and account settings.

Source: https://docs.vigilbase.com/one/services/cloudflare

Vigilbase manages web protection for your sites on Cloudflare: WAF, DDoS protection, DNS and related settings. In Vigilbase One the service appears under one of two names, depending on your contract:

- **Vigilbase Shield**: web application firewall and DDoS protection powered by Cloudflare, at https://one.vigilbase.com/services/shield.
- **Cloudflare Enterprise**: Enterprise-grade Cloudflare protection, reporting and management, at https://one.vigilbase.com/services/cloudflare.

Both open the same workspace with the same tabs. If you open the address for the variant you do not have, One sends you to the one you do. Older links to https://one.vigilbase.com/dashboard/services/managed-waf also forward to your service.

Vigilbase is a Preferred Cloudflare Partner. Your Vigilbase team links your Cloudflare accounts to One and keeps their zones in sync.

## Open the service

:::steps
1. **Open the sidebar entry.** Under **Services**, click **Vigilbase Shield** or **Cloudflare Enterprise**.
2. **Choose an account.** If your organisation has more than one Cloudflare account, choose one with the account selector. Some tabs need a selected account and stay disabled until you pick one.
3. **Pick a tab.** **Overview**, **Zones**, **Posture**, **Reports** or **Settings**.
:::

Each tab has its own address, for example https://one.vigilbase.com/services/shield/zones.

> [!NOTE]
> The Cloudflare workspace is read-only for your organisation. Your Vigilbase team makes configuration changes. To ask for one, open a [change request](https://docs.vigilbase.com/one/requests/change-requests).

## Overview

**Overview** summarises the service:

- **Zones**: how many zones are linked, and how many are active.
- **Accounts**: shown when you have more than one Cloudflare account.
- **Reports**: how many Cloudflare reports exist, and the latest period.
- **Traffic**: traffic and security analytics for the selected account, or across accounts.
- **Recent reports** and your latest checkup result.
- **Add-ons**: Cloudflare add-ons on these zones, checked live against your contract.

If your accounts are linked but no zones have synced yet, the page says **No zones synced yet**. Your Vigilbase team runs the sync.

## Zones

**Zones** lists every zone (domain) in the selected account, or in all your accounts, with its status and plan. Zone status is one of **Active**, **Pending**, **Initializing**, **Paused**, **Moved** or **Deleted**.

Click a zone to open its details. The zone page has these tabs:

| Tab | What it shows |
|---|---|
| **Overview** | Status, plan and nameservers. |
| **Analytics** | Traffic, bandwidth, cache and threats. |
| **DNS** | Records served by Cloudflare for this zone. |
| **Security** | SSL/TLS, HTTPS and security level defaults. |
| **Speed** | Compression, protocols, images and cache purge. |
| **WAF** | Firewall rules, hit counts and suggestions. |

**Open in Cloudflare** opens the same zone in the Cloudflare dashboard.

## Posture

**Posture** grades the configuration of a Cloudflare account with a Cloudflare Checkup and lists rule problems with the **Rule Analyzer**. Both need a selected account.

### Run a checkup

:::steps
1. **Open Posture.** Choose an account if asked.
2. **Click Run checkup.** Progress shows while it runs. The result is saved to your tool runs.
3. **Read the report.** **AI suggestions** generates suggestions from the displayed result. Review them before acting on them.
:::

**Checkup history** lists every checkup of the account, newest first. Click a row to show that result, and **Show latest** to go back.

A checkup runs on accounts Vigilbase manages or that have a stored read-only API key. If an account has neither, the page shows **Connect Cloudflare credentials**. Click **Connect Cloudflare**, enter the **Cloudflare email**, **Global API key** and **Account ID**, then click **Save credentials**. The key must allow read access to zone settings, DNS and firewall APIs, and is stored encrypted. Credentials you added can be changed or removed from **Manage credentials** in the more-actions menu.

> [!NOTE]
> If your service covers only some zones of a shared Cloudflare account, the checkup is zone-scoped: it reads and grades only those zones, and account-wide checks (members, MFA, account rules) are not run.

### Rule Analyzer

The **Rule Analyzer** reads the custom WAF rules on the account's synced zones and groups findings by severity:

| Severity | Meaning |
|---|---|
| **Critical** | Rules that leave traffic unprotected. Fix these first. |
| **High** | Rules that weaken protection or hide attacks. |
| **Medium** | Rules worth reviewing at the next change window. |
| **Low** | Housekeeping: stale, paused or duplicate rules. |
| **Info** | Context about rule coverage and observability. |

**Custom WAF rules** lists every rule the analyzer read, with 30-day usage where Cloudflare reports it. Use **Refresh** to re-read the rules, **CSV** to export the findings and **JSON** to export the full report.

## Reports

**Reports** lists your monthly reports that include a Cloudflare section, newest first. Until one is generated, the tab says **No Cloudflare reports yet**.

## Settings

**Settings** shows the selected Cloudflare account:

- **Account details**: name, ID, subscription tier and creation date.
- **Security policy**: controls applied to every member of the account, such as whether 2FA is required.
- **API tokens**: Vigilbase API tokens with access to the account.
- **Audit log**: actions taken within the account.
- **Members**: the account's members and their roles.

## Related

- [Billing](https://docs.vigilbase.com/one/billing) covers invoices and usage.
- Free public checks are available under [Tools](https://docs.vigilbase.com/tools).