Cloudflare (Web Performance & Security) - Revision history

Sebastian at 07:20, 19 March 2021

2021-03-19T07:20:18Z

← Older revision		Revision as of 07:20, 19 March 2021
Line 66:		Line 66:

	Mandatory: On		Mandatory: On








	==Recommended Settings==		==Recommended Settings==

Sebastian at 07:20, 19 March 2021

2021-03-19T07:20:02Z

← Older revision		Revision as of 07:20, 19 March 2021
Line 1:		Line 1:
	==Cloudflare Debugging==		===Cloudflare Debugging===
	Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):		Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):

Line 18:		Line 18:
	\|}		\|}

	==Mandatory Settings==		===Mandatory Settings===
	===SSL-TLS===		===SSL-TLS===
	====Edge Certificates====		====Edge Certificates====

Sebastian at 07:15, 19 March 2021

2021-03-19T07:15:03Z

← Older revision		Revision as of 07:15, 19 March 2021
Line 5:		Line 5:

	{\| class="wikitable"		{\| class="wikitable"
	~~\|+ Caption text~~
	\|-
	! {DESCRIPTION} !! Description		! {DESCRIPTION} !! Description
	\|-		\|-

Sebastian at 07:14, 19 March 2021

2021-03-19T07:14:44Z

← Older revision		Revision as of 07:14, 19 March 2021
Line 1:		Line 1:
			==Cloudflare Debugging==
	Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):		Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):

Sebastian at 07:13, 19 March 2021

2021-03-19T07:13:48Z

← Older revision		Revision as of 07:13, 19 March 2021
Line 1:		Line 1:
			Cloudflare caches all img, js, css, ... Files. Version Strings are important here to invalidate old code. For debugging the following headers are set (By Cloudflare):

			cf-cache-status: {DESCRIPTION}

			{\| class="wikitable"
			\|+ Caption text
			\|-
			! {DESCRIPTION} !! Description
			\|-
			\| HIT \|\| Your resource was found in Cloudflare’s cache. This means that it has been previously accessed from your original server and loaded into Cache. It has all not expired.
			\|-
			\| MISS \|\| Cloudflare looked for your resource in cache but did not find it. Cloudflare went back to your origin server to retrieve the resource. The next time this resource is accessed its status should be HIT.
			\|-
			\| BYPASS \|\| Cloudflare has been instructed to not cache this asset. It has been served directly from the origin. This is usually because something like a existing NO-CACHE header is being respected.
			\|-
			\| EXPIRED \|\| Cloudflare has previously retrieved this resource, but it’s cache has expired. Cloudflare will go back to the origin to retrieve this resource again. The next this resource is access its status should be HIT.
			\|-
			\| DYNAMIC \|\| This resource is not cached by default and there are no explicit settings configured to cache it. You will see this frequently when Cloudflare is handling a POST request. This request will always go to the origin.
			\|}

	==Mandatory Settings==		==Mandatory Settings==

Sebastian: Created page with " ==Mandatory Settings== ===SSL-TLS=== ====Edge Certificates==== =====Always Use HTTPS===== ''Redirect all requests with scheme “http” to “https”. This applies to all..."

2021-03-02T07:34:08Z

Created page with " ==Mandatory Settings== ===SSL-TLS=== ====Edge Certificates==== =====Always Use HTTPS===== ''Redirect all requests with scheme “http” to “https”. This applies to all..."

New page

==Mandatory Settings==
===SSL-TLS===
====Edge Certificates====

=====Always Use HTTPS=====
''Redirect all requests with scheme “http” to “https”. This applies to all http requests to the zone.''

Mandatory: On

=====HTTP Strict Transport Security (HSTS)=====
''Enforce web security policy for your website.''

Mandatory: On with the following settings:

'''Enable HSTS (Strict-Transport-Security)'''<br>
''Serve HSTS headers with all HTTPS requests''

Mandatory: On

'''Max Age Header (max-age)'''<br>
''Specify the duration HSTS headers are cached in browsers''

Mandatory: 6 Months

'''No-Sniff Header'''<br>
''Send the “X-Content-Type-Options: nosniff” header to prevent Internet Explorer and Google Chrome from MIME-sniffing away from the declared Content-Type.''

Mandatory: On

=====Minimum TLS Version=====
''Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer.''

Mandatory: 1.2

=====Opportunistic Encryption=====
''Opportunistic Encryption allows browsers to benefit from the improved performance of HTTP/2 by letting them know that your site is available over an encrypted connection. Browsers will continue to show “http” in the address bar, not “https”.''

Mandatory: On

=====TLS 1.3=====
''Enable the latest version of the TLS protocol for improved security and performance.''

Mandatory: On

=====Automatic HTTPS Rewrites=====
''Automatic HTTPS Rewrites helps fix mixed content by changing “http” to “https” for all resources or links on your web site that can be served with HTTPS.''

Mandatory: On

==Recommended Settings==