Cloudflare Integration

Connect Cloudflare’s Web Application Firewall for automated enforcement driven by Response Actions.

Rule pushes are temporarily paused

Cloudflare retired the legacy Firewall Rules API this integration used for pushing block rules, and WebDecoy’s rebuild on Cloudflare’s newer Rulesets API is in progress. You can still connect and verify the integration, but rule pushes to Cloudflare are paused until the rebuild ships. AWS WAF rule pushes are unaffected — and so is session clearance, which runs as its own Cloudflare Worker and is live today.

Prerequisites

• A Cloudflare account
• Your website proxied through Cloudflare
• An API token with appropriate permissions

Creating a Cloudflare API Token

1. Log into Cloudflare Dashboard

2. Go to My Profile → API Tokens

3. Click Create Token

4. Use Custom Token with these permissions:

   Resource	Permission
   Zone > Firewall Services	Edit

   Scope Zone Resources to the specific zone you’re protecting.

5. Copy the generated token (shown only once)

Setting Up the Integration

1. Go to Integrations → Cloudflare

2. Click Add Cloudflare Integration

3. Enter your credentials:

   Field	Description
   API Token	Your Cloudflare API token
   Account ID	Your Cloudflare account ID
   Zone ID	The zone (domain) to protect
   Zone Name	Domain name (e.g., yoursite.com)

4. Click Connect

5. WebDecoy verifies the connection

Finding Your Account ID and Zone ID

Account ID:

1. Go to any domain in Cloudflare dashboard
2. Look in the right sidebar under “API”
3. Copy the “Account ID”

Zone ID:

1. Go to the specific domain
2. Look in the right sidebar under “API”
3. Copy the “Zone ID”

How Enforcement Works

The legacy per-decoy blocking rules were retired — enforcement is now driven by Response Actions on the Enforcement page:

• Block actor at WAF (block_actor) — for a confirmed rotating actor, pushes a composite fingerprint rule (the actor’s JA4 and its network anchor — never a bare fingerprint) so the block follows the attacker across every IP it rotates through.
• Block IP (block_ip) — blocks the detection’s IP address with an automatic expiry.

While Cloudflare rule pushes are paused (see the notice above), configure your response actions anyway: WebDecoy records what it would enforce in Monitor mode, the zone preflight check works today, and pushes resume automatically when the Rulesets rebuild ships. If you need live rule pushes now, connect AWS WAF. Session clearance — the Cloudflare Worker edge validator — is fully live and independent of rule pushes.

Best Practices

Do’s

• ✅ Use a dedicated API token (not global API key)
• ✅ Review Monitor-mode would-enforce data before flipping to Enforce
• ✅ Set reasonable block durations (24h is a good default)
• ✅ Test with a known IP before production use

Don’ts

• ❌ Use your global Cloudflare API key
• ❌ Set block duration to “forever” (IPs change hands)
• ❌ Block without monitoring results

Troubleshooting

”Invalid API Token” Error

1. Verify token was copied correctly (no extra spaces)
2. Check token hasn’t expired
3. Ensure token has required permissions
4. Try creating a new token

”Zone Not Found” Error

1. Verify Zone ID is correct
2. Ensure token has access to that zone
3. Check zone is active in Cloudflare

Rules Not Appearing in Cloudflare

Expected for now — rule pushes are paused pending the Rulesets rebuild (see the notice at the top). Verify your setup with the zone preflight check on the Enforcement page instead.

---

Next Steps

• Webhooks - Custom event processing
• Slack - Real-time notifications
• Overview - All integrations