Cloudflare Security Services
Cloudflare can stop most of the attacks that reach your applications and users, but only if it is configured for your environment. Many organizations put their domains behind Cloudflare, keep the default settings, and assume they are protected. We assess, harden and then test your Cloudflare configuration the way an attacker would.
Starting at $2,900 for one Cloudflare zone. Final price depends on scope.
Application security
WAF
Managed rulesets enabled in blocking mode, plus custom rules for your applications and known attack patterns.
DDoS protection and rate limiting
Limits per path for logins, password resets, search and other abuse-prone endpoints.
Bot management
Separating legitimate automation from credential stuffing, scraping and fake account creation.
API Shield
Schema validation, mTLS for machine clients, and discovery of API endpoints you may not know are exposed.
Client-side security (formerly Page Shield)
Monitoring the third-party scripts that run in your users' browsers, to detect card-skimming and other client-side attacks.
We configure and tune the Cloudflare application security features available on your plan:
Zero Trust with Cloudflare One
Access
Identity-based access to internal applications, with SSO and device posture checks.
Cloudflare Tunnel
Publishing internal services without opening inbound ports on your firewall.
Secure Web Gateway
DNS and HTTP filtering, including TLS inspection planned so it does not break business applications.
Cloudflare One Client (formerly WARP)
Device enrollment and health checks used by Access and Gateway policies.
CASB, DLP and Email security
Visibility into SaaS misconfigurations, sensitive data in transit, and phishing.
We design and implement Cloudflare One to replace or reduce VPN use and to protect users wherever they work:
Common gaps we fix
Origin servers reachable directly, which lets attackers bypass the WAF entirely. We close this with Cloudflare Tunnel, origin allowlisting or Authenticated Origin Pulls.
Managed WAF rules left in log mode, or disabled for paths that were never revisited.
DNS-only (unproxied) records that reveal origin IP addresses.
API endpoints without schema validation or rate limits.
Access policies that are too broad, such as allowing any address from a public email domain, or no device posture checks.
Who it's for
Companies that already use Cloudflare and want to know whether it is really protecting them, and companies adopting Cloudflare One to replace VPNs or legacy web proxies.
How we work
01
Assessment: we review your Cloudflare account against your actual exposure: DNS, proxied and unproxied records, origin servers, WAF and Zero Trust policies.
02
Hardening: we implement the agreed changes in stages, starting in log mode where a change could block legitimate traffic.
03
Validation: as penetration testers, we test the result: can the WAF be bypassed, can the origin be reached directly, are Access policies broader than intended?
04
Ongoing support (optional): periodic reviews as your applications, plan and threat landscape change.
FAQ
Do I need to buy anything from you?
No. We work inside your existing Cloudflare account and tell you when a feature requires a different plan.
Can you work with our internal team or MSP?
Yes. We can implement the changes ourselves or guide your team and validate the result.
Will hardening break our applications?
We roll out changes in stages, starting in log mode where possible, and agree on change windows for anything that could affect production.