The Cloudflare Checkup is a read-only review of a Cloudflare account and every zone it can see. It gives an A+ to F grade for the account and for each domain, and lists the fixes that matter most first. Run it at vigilbase.com/tools/cloudflare-checkup.
What it checks
The checkup groups its checks into these categories:
| Category | Question it answers |
|---|---|
| Account Governance | Are account-wide controls such as MFA enforcement configured? |
| Zone Status | Is each zone active and configured as expected? |
| SSL & Encryption | Is traffic encrypted correctly? |
| DNS Security | Is DNS protected, for example with DNSSEC? |
| Web Application Firewall | Are WAF rulesets and managed rules in place? |
| DDoS Protection | Are DDoS managed rulesets in place? |
| Bot Management | Are bots handled? |
| API Protection | Are API surfaces protected? |
| Zero Trust | Is Cloudflare One (Access, Gateway, Tunnels) configured? |
| Legacy Configuration | Are deprecated Cloudflare features still in use? |
| Performance | Are speed features set up? |
| Security Settings | Are zone security settings configured correctly? |
Free and full report
| Report | Includes |
|---|---|
| Free report | Account inventory, MFA enforcement and the essential checks for every domain (zone status, SSL/TLS mode, Always Use HTTPS, DNSSEC and Development Mode), with full details. |
| Full report | Adds the premium account and domain checks, WAF, bot and DDoS analysis, your Cloudflare One (Zero Trust) posture, an AI summary and a 30-minute call with a Cloudflare-certified engineer. It is an optional one-time purchase after your scan; the price is shown on the page. |
Choose how to run it
The page offers three ways to run the checkup. Continue with Cloudflare is the default; the others are under Other ways to run it.
Sign in with Cloudflare. There is no API token to create and no email code.
- Select Continue with Cloudflare. Sign in to Cloudflare and approve read-only access.
- Choose the account. Pick a Cloudflare account from the list. Results go to the email address of your Cloudflare login.
- Select Start the checkup. Most scans finish in about 2 minutes.
The access is read-only, nothing in your account is changed, and Vigilbase revokes it as soon as the scan finishes. Your Cloudflare login verifies your email for this one run only; it does not unlock other tools such as Website Security.
Collect your configuration on your own machine with Cloudflare's own cf CLI. Your Cloudflare login never leaves your computer.
npx @vigilbase/cli cloudflare-checkup
The command verifies your work email with a 6-digit code, installs cf if needed (it asks first), signs in to Cloudflare read-only, lets you choose the account, shows what it collected and uploads it. It then prints the link to your results and emails it to you.
This option is in beta and appears only while local checkups are switched on. See Cloudflare Checkup from the CLI for every step.
Paste a read-only Cloudflare API token, then confirm your email.
- Create a token. Select Create a new API token with required permissions. It opens Cloudflare's token form with a read-only template named
Vigilbase Cloudflare Checkup. You can narrow it before you create it. - Paste the token. Enter it in Cloudflare API token and select Validate.
- Select the account. Choose it under Select account.
- Enter your work email. Select Send Verification Code.
- Enter the 6-digit code. Select Verify & Start Scan.
The token needs at least Account > Account Settings: Read and Zone > Zone: Read. Further read-only permissions improve the premium findings; checks the token cannot read are reported as skipped. The token is used only for this scan and is not stored.
How the grade is calculated
Each zone starts at 100 and loses points for its failed checks; the account score works the same way for account-wide checks. Scores are clamped between 0 and 100.
The account-wide score combines three parts:
| Part | Weight |
|---|---|
| Account score | 35% |
| Average domain score | 50% |
| Weakest domain score | 15% |
An account with no domains counts 100 for both domain parts. A checkup that covers only some zones on a shared account has no account score, so it uses the two domain parts alone (50/65 average, 15/65 weakest).
| Grade | Score |
|---|---|
| A+ | 95-100 |
| A | 85-94 |
| B | 70-84 |
| C | 55-69 |
| D | 40-54 |
| F | 0-39 |
Each domain also gets its own grade from the same bands. The report lists domains from the lowest score up.
Checks that cannot be evaluated are not scored as passing. Deprecated Cloudflare features, such as Auto Minify, are reported but not scored.
Self-reported results
Results collected with the CLI are labelled Self-reported: Vigilbase evaluated the uploaded data with the same scanner but did not verify it against Cloudflare. They are excluded from badges and verified-scan evidence, the share page title and link preview leave out the grade, and the PDF file name ends in -self-reported.
Some inputs cannot be collected with cf and are shown as Not collected locally, for example legacy Firewall Rules, WAF traffic analytics and plan add-ons. Run the checkup with Continue with Cloudflare or an API token to include them.
Common findings
| Finding | What to do |
|---|---|
| Account MFA enforcement is off | In Cloudflare, require two-factor authentication for every member of the account. |
| DNSSEC is not enabled | Turn on DNSSEC for the zone and add the DS record at your registrar. Check the result with the DNSSEC checker. |
| Always Use HTTPS is off | Turn on Always Use HTTPS so plain HTTP requests are redirected. |
| SSL/TLS mode is Off, Flexible or Full | Set it to Full (Strict) so traffic to your origin is encrypted and its certificate is validated. |
| Development Mode is on | Turn it off when you have finished testing; it bypasses the cache. |
Each finding in your report has its own recommendation; follow that first.