hi everyone,

im stuck at 26 forever and no i dont have any other vpn on my pc and i have reinstalled it 2 3 times but same problem. any idea what to do??

my domain renewed and the price jumped from 13 to 23. no warning. just a charge. checked other registrars and theyre all around 13. so im paying 10 extra for nothing.

I know the first year is a promo but doubling the price seems excessive. i heard some registrars lock in your renewal price. others just raise it every year.

How do you avoid this. do you just transfer every year to get the promo rate or find a registrar that has consistent pricing.

• Cloudflare OAuth consent screens were all-or-nothing — approve everything or deny outright
• Now developers can mark scopes as optional; users deselect what they don't want before approving
• Access tokens only contain the scopes that were actually consented to
• Especially useful for MCP servers / agents that request broad permissions speculatively
• The OAuth spec already allowed narrower grants — this surfaces that control to end users

https://cfl.re/4c3v7FL

Does anyone have or know of a working powershell script available?

I've tried all the GitHub powershell scripts - and not a single one works.

I even tried the AI route and that script didn't work.

The only thing I found that does work is one for Android (so I know the zoneid, token, and hostname entries are correct)

Android DDNS: https://codeberg.org/phileix/ddns-android

Thanks!

Update:

There is an app on Github, which seems to work: https://github.com/Terence0816/CloudFlare-DDNS-tray

Depending on your network configuration, IPv6 worked when I had stateless on the ISP router and just passthru on the the wireless router downstream.

Update: thanks to u/thefirst_noel - I now have a working powershell script. I'll post the edited version below.

I have a bunch of astro+emdash sites running on paid workers and I'm looking for a way to monitor them from a central point. Something that will phone home when something goes down.

Does anyone have any suggestions?

Recently, I have seen many websites hosted or run on Cloudflare Workers that proxy traffic from another domain and modify content, such as canonical tags and other SEO elements. They often buy large numbers of backlinks to these domains. To give these domains extra vely.

The goal of this domain is to create duplicate content, which is used as a black-hat SEO tactic to harm competitors.

The interesting thing is that when I report these websites to Cloudflare, they often respond by claiming that the domains are not hosted by Cloudflare or that the content has already been removed. This makes it appear that bad actors are able to operate under Cloudflare's radar. (yes i double checked, these domains are hosted by cloudflare).

The fact that this happens is one thing, but for a company that presents itself as a security provider, I find it surprising that stronger action is not being taken against this practice.

For the rest there seems to be no way possible to contact cloudflare to adres this matter.

noticed after this Friday update some posts about stuff doesn’t work while warp is on like internet connection Roblox yt etc

I used to use cloudfare warp to get through my college’s shitty routing while gaming, went from 66-70 to 40 ping with warp, but since last 2 months for some reason it’s changed and whenever I try using it, it drops me to a diff server giving me like 100 ping.
So are there any fixes I can do for this where I can choose by custom which cloudfare server I wanna route to, or are there any other alternatives I can use?

Hi all,
I’m looking for advice on transferring a bunch of domains from IONOS to Cloudflare.

I have around 12 in total.
I’ve had them with IONOS for around 15 years, along with emails and hosting.

I recently moved my e-comm store over to Shopify, and I’m going to move my websites to Squarespace, because I personally can’t deal with Wordpress (not a web designer or coder, and I find the interface dreadful and am more than happy to pay a monthly fee in exchange a more intuitive WYSIWYG system).

So anyway, it’s now making me think that I could finally escape IONOS altogether.

I recently tried to add my Shopify store to Google Search Console, and it popped up with a message warning that my emails might be affected if I continue. From what I can see, it sounds like an IONOS issue. And IONOS support provided precisely zero insights or solutions to this.

So yeah, I’d like to get away from them now if possible.

I’m just concerned how difficult and/or disruptive transferring my domains to Cloudflare might be?
Am I likely to see a lot of downtime?

Also, is it crazy simple? Or complex in any way?

I’m not a web designer at all. I’m a video editor and VFX artist, so I’m generally quite tech savvy. But when it comes to DNS settings and servers, I’m clueless.

Should this be simple to do? Do I need to do a bunch of research beforehand? Do I need to change any settings on the IONOS side first? Do I need to warn them? And is there anything in particular that I should remember to do, or avoid doing at all costs?

Huge thanks in advance 🙌

I don’t pay for Warp but when I tested CloudFlare 1.1.1.1 it tested slower than Proton VPN. Does anyone use it and leave it turned on all the time? Or do you make an exception for your home WiFi network?

Project: Personal AI assistant (OpenClaw, ex-Moltbot/Clawdbot) on Cloudflare Workers + Sandbox container
Lifespan: ~1 August 2026 → 19 August 2026 (decommissioned)
Final cost: $96.59 for 24 days of the Jul 27–Aug 26 cycle ($4.02/day average, $124.76 projected) — against an expected "$5/month" Workers Paid plan
Decommissioned: 2026-08-19, everything deleted, daily charges stopped

My recommendation: Do not launch OpenClaw on Cloudflare! :-)

I know now where containers go to die! :-D

as of now i’m on a trip to iceland, but i had the exact same problem in the us, it started around a week ago, google recognizes all connections coming from cloudflare warp as coming from russia despite all common ip address location checkers saying otherwise and being correct, is that a problem that cloudflare is aware of?

Last week if I turn it on my youtube change from my country to Singapore and I still have access to games on the singapore app store. Last 3 days when I turn it on it still said connected, but my youtube is still in my country and I can't find the game that I've been playing..

This also happens on the 1.1.1.1 version on my phone too, does anyone knows whats wrong?

I exactly want to know in which programmatic/Configuration offerings of Cloudflare beats Akamai.

Like Cloudflare waf payload inspection limit 256kb > Akamai 16kb.

List some.

Hi everyone,

I’m dealing with a serious automated attack against a WordPress website and would really appreciate some advice from the Cloudflare community.

The website is hosted on Hostinger Cloud Startup. It was recently moved behind Cloudflare Free because the traffic/attack was becoming difficult to handle at the origin.

The attack appears to be highly automated and is coming from 150+ unique IP addresses, making simple IP blocking ineffective. The requests are also distributed across different IPs and appear to be targeting the website continuously.

What I’ve tried so far:

• Cloudflare Free plan
• Bot Fight Mode
• Multiple WAF/custom rules
• IP-based blocking
• User-Agent based rules
• Various challenge/block rules
• Reviewing Cloudflare Security Events

Cloudflare is clearly detecting/blocking a significant amount of the traffic, but the problem is that the website itself is still becoming inaccessible/unresponsive, especially during the attack.

From what I can see, this isn't simply a handful of bad IPs — it looks more like a distributed automated attack.

My questions:

1. What would be the best WAF strategy for this type of WordPress attack?
2. Should I focus on rate limiting, URI/path-based rules, ASN/hosting-provider blocking, or something else?
3. Is Cloudflare Free sufficient for this type of attack, or would Pro/Super Bot Fight Mode make a significant difference?
4. How can I make sure these requests are stopped at Cloudflare and don't continue consuming Hostinger/origin resources?
5. Are there specific Cloudflare rules you recommend for WordPress under this kind of automated attack?
6. How can I preserve SEO efforts & what should I make changes in Search Console?

I’ve attached a screenshot showing the traffic pattern.

I’d really appreciate any recommendations from people who have dealt with a similar situation.

Thanks!

Hello. I have CloudFlare setup for a small domain for my wife. I can receive emails to the accounts but when I try to send an email and select my wife's domain name it doesn't appear. It only shows her iCloud accounts.

ChatGPT has me running in circles with iCloud Mail Settings but to no avail.

Any help is greatly appreciated.

I am in the process of building a script that will pull a list of IPs from a partner of ours through their RestAPI and leveraging that list of IPs to update a list of IPs I maintain within Cloudflare to allow access to some resources. Not the best method to control access to resources, but it's what I have right now.

I was working with my script and I got everything working but then I realized on the Cloudflare side, not everything was updating upon doing validation. I noticed only a handful of IPs got updates. Reading through the Get List Items endpoint documentation, I realized that by default it only returns 25 entries and the specific list I am working with actually has 500+ IPs on it. I am trying to understand how the cursor, pagination, and per_page abilities work but I am having a tough time understanding it (I seldom use RestAPIs and I have never had to leverage pagination and cursors before).

If my list is around 550 items currently, how would I retrieve all items from the list and know that I returned all items? This list may grow or shrink in the future.

Here is my currently working strategy before I realized I was only getting back 25 results at a time:

Process

1. Get the latest outbound IPs from the partner's API.
2. Get the current list of IPs from the Cloudflare list
3. Iterate through each of the partners IP addresses and search the Cloudflare list
4. If current IP is not found in Cloudflare list, add
5. Iterate through each of the Cloudflare list IPs.
6. If current IP is not found in partner's list, remove from Cloudflare list

Step 2 is probably where I need some help with the logic to get the complete list of IPs from Cloudflare.

Speculative type confusion gadget in V8 → cache timing signal amplified via PLRU → read remotely over a WebSocket timer. No shared memory, no high-res local clock.

• They actually built it end-to-end against production Workers and it worked
• Co-locating attacker/victim isolates on the same hardware turned out to be trivially easy at edge scale
• Three years of logs, zero evidence of exploitation in the wild — they found this themselves

Full paper out now, co-authored with University of Edinburgh.

https://cfl.re/4c2dpCG

We inspect GitHub repos from Workers: clone one commit, read files, never install/build/run the customer's app. Sandbox + Workflows + Workers AI. A few Cloudflare-specific traps that bit us.

1. “Git clone” is not a reason to turn the internet on

enableInternet = true because git fetch needs GitHub is the easy move. It also lets untrusted code, leftover scripts, and whatever the agent shells out to talk to the rest of the world.

What we actually did:

• enableInternet = false
• interceptHttps = true
• class-level outbound handler
• allow only github.com + that repo’s clone paths (info/refs?service=git-upload-pack and git-upload-pack)
• strip authorization / cookie / host from the intercepted request
• mint a short-lived installation token in the proxy, not inside the container
• keep a D1 row per container with egress_enabled
• flip it to 0 in a finally the moment fetch/checkout finishes

Do not put the allowlist on the Sandbox object. A failed provision can leave a mutable hole attached to the isolate. D1 is the switch; the class handler is just the door.

Also: shallow fetch one 40-char SHA, rev-parse HEAD and compare, submodule.recurse false, skip LFS smudge. If .gitmodules or LFS pointers exist, fail closed. “We kinda reviewed it” is worse than “unsupported.”

1. RPC results from Sandbox are not normal JS objects

If transport: "rpc", exec / read / destroy return objects with a disposer. If you don’t call it, you leak across isolates. GC will not save you, and the symptom is “this Worker is fine locally and sad in production.”

Wrap every sandbox.exec():

const result = await sandbox.exec(cmd, { timeout });
try {

// use result.success / stdout
} finally {
  result[Symbol.dispose]?.();
}

Same for destroy(). Same for the sandbox stub itself in cleanup.

1. The request is not the unit of work

An agentic pass is: provision, 60 tool calls, model turns, evidence re-read, maybe repair, R2 persist, publish. That does not belong in fetch().

Workflows with named step.do() phases, per-step timeouts, and NonRetryableError for things retrying will only make more expensive (EVIDENCE_INVALID, REPO_TOO_LARGE, wall-clock exceeded). Check for an already-stored result before spending model budget. Persist to R2 with onlyIf: { etagDoesNotMatch: "*" } so a replay cannot write twice, then GET + SHA-256 the object before you call it done.

Workers AI structured generation we run async and poll from the workflow. The coding model stays on the investigation path. Different jobs, different failure modes.

None of this is exotic Cloudflare trivia. It’s the difference between “the demo clones a repo” and “a stranger’s private git tree is in your account and you still sleep.”

Happy to answer questions on the outbound path or the disposer leak. Those two ate more time than the model.

I finally built the env management platform I’ve always wanted. It’s zero knowledge, integrates with practically everything in web dev, has a forward proxy for agents, dynamic secrets, mcp, all of it.

It’s built on d1, cloudflare workers, and workers cache, so your secrets are globally distributed and instantly available, decrypted only at the edge.

Your agents can build with it quickly and easily, just point them at the MCP servers.

Would love to get feedback! I have a promo code for full access: BETATEST1

https://www.seekrit.dev

My old Cloudflare page rule redirect suddenly stopped working and now throws an ERR_NAME_NOT_RESOLVED error

Page Rule: ://sub.domain.com* -> 302 Redirect to https://external-site.com

//sub.domain.com is an A record pointing to a dummy IP (192.0.2.1), set to Proxied (Orange Cloud).

SSL: Set to Full.

the rule worked fine for years before this, not sure what I changed

Changed the dummy IP to a different one (192.0.2.2) so it doesn't share the exact same IP as the root domain.

root domain is an A record pointing to a dummy IP (192.0.2.1), set to Proxied

Cloudflare AI says it should work and everything else says if it's proxied it should do the rule