Safety

Every firm can manage the protection standing in front of its website — the attack switch, bot filtering, blocking rules and rate limits — from one page in its own back office. The protection itself runs at the edge provider (Cloudflare); this page is your hands on it.

Back office → Configuration → Safety.

What you see first: the origin verdict

At the top of the page, above every switch, stands one question: can the world reach your server directly, around the shield?

• 🟥 Open — the server answers direct requests. Every rule below is decoration until this is closed: an attacker who knows the address simply skips the shield. The verdict says what to do.
• 🟩 Closed — the shield stands in the path.
• 🟧 Cannot verify — the check could not tell. Unknown is never shown as safe.

Connecting your zone

The page needs one credential from Cloudflare — an API token scoped to your domain and to protection only.

Where the token is created

The token lives under your profile, not in the domain's own menu (that is where everybody looks first and it is not there):

1. Open dash.cloudflare.com/profile/api-tokens — or click the profile icon (top right) → My Profile → API Tokens.
2. Create Token → scroll to the bottom → Create Custom Token → Get started. Do not use the templates at the top — they carry rights this token must not have.
3. Name it, then add five permission rows (three dropdowns each, left to right):

Rows are added with + Add more. If Bot Management is not offered on your plan, skip it — everything else still works.

1. Zone Resources: Include → Specific zone → your domain.
2. Continue to summary → Create Token. The token is shown once — copy it and paste it into the Safety page immediately.

What happens on save

The token is verified before it is stored: a dead token, or one that does not reach your domain's zone, is refused and nothing is kept. What is stored is encrypted and write-only — no screen, tool or export can read it back; it can only be replaced or deleted.

The switches

Everything on the page is the provider's live state — read fresh on every load, written straight back. A change made in the Cloudflare dashboard shows here on the next reload; there is no local copy that could disagree.

• Attack mode — the emergency handle. While it is on, every visitor is challenged before your server sees a request. Flip it on when the site is being hammered, off when it is over.
• Bot filtering — challenges known bots automatically.
• Human check (Turnstile) — Cloudflare's CAPTCHA without picture puzzles. Create a Turnstile widget in your Cloudflare account for your domain, paste the site key and the secret here (the secret is never shown again), tick require — and the customer sign-in, registration and password doors demand a passed challenge, verified server-side with YOUR secret. WHY it fails open: if Cloudflare's verify service is briefly unreachable, the doors stay open with a log line — locking every customer out because a third party hiccuped would be the worse failure, and the flood control plus the login shield still stand. This widget is the platform's one sanctioned external script; it loads only on the auth pages of firms that enabled it.
• Login shield — one switch that caps the customer sign-in doors (login, registration, password reset, verification) at eight requests per ten seconds per address — the edge refuses a brute-force before your server hears of it. The platform's own flood control still stands on every door regardless; the shield removes the load, not the last line of defense. Like every rule here, it protects nothing while the origin verdict above says OPEN. WHY one switch instead of a form: the auth doors are a fixed, known set — a shield you have to configure is a shield half the firms never turn on.
• Access rules — block, challenge or always-allow an IP address, IPv6 address or range.
• Country rules — block or challenge a whole country by its two-letter code. (These are WAF custom rules under the hood — the door every plan has.)
• Rate limits — cap how often one address may hit a path, e.g. thirty requests to /login per period. The free plan allows one rule with a 10-second period and 10-second block.

Every change lands in the activity trail — who, what, old → new, when, and whether it was done through Claudia.

Setting up the human check (Turnstile), step by step

Turnstile is Cloudflare's CAPTCHA without picture puzzles. It lives at the account level of Cloudflare, not under the domain — which is why it is not found where the DNS is.

1. In the Cloudflare dashboard open the left menu → Turnstile → Add widget.
2. Widget name: your firm (e.g. coldexpress). Hostname: add your website's domain (coldexpress.sk; www is not needed, it redirects). Widget mode: Managed.
3. Create. Cloudflare shows two keys: - Site Key — public, starts with 0x4AAA…. It is rendered into the page for the widget to load. - Secret Key — private. It is shown once; copy it now.
4. In the back office open Safety with your organization open in the toolbar, find Human check (Turnstile), paste the Site key and the Secret, tick require, save. The secret is stored encrypted and write-only: no screen reads it back, it can only be replaced.
5. Open your site's customer sign-in page: the widget appears above the button. Sign-in, registration, password reset and verification now demand a passed challenge, verified on the server with your secret.

Two things to know:

• The widget only works on a domain that already serves your site over HTTPS. Set it up before the DNS switch if you like; it starts working the moment the site answers.
• If Cloudflare's verification service is briefly unreachable, the doors stay open with a log line (the flood control and the login shield still stand). Locking every customer out because a third party hiccuped would be the worse failure.

Claudia

The assistant can read the shield's state and flip every switch — under your rights, in the firm you have open, with the trail marking it was done via her. She cannot read or connect the token; pasting the credential is a human act on the page.

Say: "turn on attack mode", "block the IP 203.0.113.7", "what is the protection status?" — in whatever language you talk to her.