Cloudflare (Web Performance & Security)

Cloudflare Debugging

Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):

cf-cache-status: {DESCRIPTION}

{DESCRIPTION}	Description
HIT	Your resource was found in Cloudflare’s cache. This means that it has been previously accessed from your original server and loaded into Cache. It has all not expired.
MISS	Cloudflare looked for your resource in cache but did not find it. Cloudflare went back to your origin server to retrieve the resource. The next time this resource is accessed its status should be HIT.
BYPASS	Cloudflare has been instructed to not cache this asset. It has been served directly from the origin. This is usually because something like a existing NO-CACHE header is being respected.
EXPIRED	Cloudflare has previously retrieved this resource, but it’s cache has expired. Cloudflare will go back to the origin to retrieve this resource again. The next this resource is access its status should be HIT.
DYNAMIC	This resource is not cached by default and there are no explicit settings configured to cache it. You will see this frequently when Cloudflare is handling a POST request. This request will always go to the origin.

SSL-TLS

Edge Certificates

Always Use HTTPS

Redirect all requests with scheme “http” to “https”. This applies to all http requests to the zone.

Mandatory: On

HTTP Strict Transport Security (HSTS)

Enforce web security policy for your website.

Mandatory: On with the following settings:

Enable HSTS (Strict-Transport-Security)
Serve HSTS headers with all HTTPS requests

Mandatory: On

Max Age Header (max-age)
Specify the duration HSTS headers are cached in browsers

Mandatory: 6 Months

No-Sniff Header
Send the “X-Content-Type-Options: nosniff” header to prevent Internet Explorer and Google Chrome from MIME-sniffing away from the declared Content-Type.

Mandatory: On

Minimum TLS Version

Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer.

Mandatory: 1.2

Opportunistic Encryption

Opportunistic Encryption allows browsers to benefit from the improved performance of HTTP/2 by letting them know that your site is available over an encrypted connection. Browsers will continue to show “http” in the address bar, not “https”.

Mandatory: On

TLS 1.3

Enable the latest version of the TLS protocol for improved security and performance.

Mandatory: On

Automatic HTTPS Rewrites

Automatic HTTPS Rewrites helps fix mixed content by changing “http” to “https” for all resources or links on your web site that can be served with HTTPS.

Mandatory: On