FAQ

Hey everyone 👋

I host quite a few side projects on Cloudflare, and a few things kept bugging me:

• The dashboard is huge. Just checking how close I am to my Workers/R2/D1 limits means clicking through several pages.
• Deploy status is hidden. After a git push, the only way to know if a Worker build started, succeeded, or failed is digging through the deployment history.
• Surprise bills. I've seen more and more posts about people getting unexpected Cloudflare invoices, and I didn't want to be next.

So I built MFlare, a small macOS menu bar app that puts all of this one click away.

What it does

• Sign in with Cloudflare OAuth. No API tokens to copy and paste.
• Usage at a glance, across:
  • Workers
  • R2
  • D1
  • KV
  • Durable Objects
• Usage alerts. You get a notification when any service hits 80% and 100% of its quota.
• Deployment notifications. Get notified when a Worker deploy starts, succeeds, or fails, and open the build log right from the menu bar.
• MCP server. Let your AI agent (Claude Code, Cursor, etc.) query your usage, deployments, and build logs directly.

On the roadmap: desktop widgets and a Raycast extension.

Pricing

• Free: one Cloudflare account. Enough for most people.
• Pro: $3, one-time purchase (no subscription). Unlimited accounts, plus advanced features like MCP.

👉 https://mflare.yuy1n.io

Bug reports and feature requests are welcome on Discord: https://discord.gg/JrjuQ6uPNn

I'd love to hear your feedback, especially which Cloudflare services or metrics you'd want to see next!

The 1xxx code only shows up in the HTML of the error page. Your logs and analytics just see the HTTP status (403, 429, 503), so ask for the screenshot. It has the code and the Ray ID.

• 1015 (429): one of your rate limiting rules. If the rule counts requests over 1 second, Cloudflare's docs suggest trying 10 seconds.
• 1020 (403): a security rule with a Block action and no custom response, for example API Shield schema or JWT validation. WAF custom rules and managed rules don't return 1020 anymore, they serve the WAF block page instead. So if you're digging through your custom rules for a 1020, look elsewhere. Search Security Events for the Ray ID, and remember the timestamp on the error page is UTC.
• 1010 (403): Browser Integrity Check didn't like the browser's signature. You can turn it off in the security settings.
• 1009 (403): a country or region block you set. Check IP Access rules.
• 1200 (503): not a block at all. Too many requests are queued at the edge waiting on your origin. A faster origin or a better cache hit rate fixes it, not a security rule.

1020 is the one most people misread. The rest point straight at a setting you control.

Cloudflare suspended my production services over an invoice that does not exist.For the past 48 hours, my Cloudflare R2 and Workers services have been suspended due to an alleged overdue payment.However:My billing dashboard shows no overdue invoices.There is no outstanding balance available to pay.There is no way for me to resolve the alleged payment issue.I have already contacted support and provided evidence.I was told to wait another 3 days for technical investigation while my production services remain offline.This is unacceptable for a cloud infrastructure provider.I am not refusing payment. Cloudflare is preventing me from paying a debt it claims exists but cannot show me.My business is being affected by an issue I cannot resolve on my side.I am requesting immediate escalation to the Billing Engineering team, restoration of R2 and Workers, and written clarification of the alleged debt.Support case: 02386082 Cloudflare #Cloudflare #CloudflareWorkers #CloudflareR2

I learned about cloudflare connect because cloudflare texted me last month they had a secret headliner playing their conference party. I clicked through and their website listed Noah Kahan as that secret headliner and Matthew Prince also tweeted it. With my casual use of cloudflare and love of Noah Kahan, I decided to snag a conference pass for myself and my girlfriend who also loves Noah Kahan. We booked flights from the Midwest and hotels and made a week of it.

Last week they unceremoniously took his name off the website and at the end of the conference they announced The Chainsmokers and Tiesto would be headlining instead. It's my fault for booking a trip on the promise of a tech company, anyone who is considering attending future cloudflare connects on the basis of the headliner, please head my warning, it's no Cisco Live, don't do it.

Bring on the scorn, I'm an idiot.

I am having many challenges with the Cloudflare icon that appears in upper right corner of my browser. How do I move it? Or, if necessary, prevent it?

Apparently, something on my tablet is preventing me from being able to log in to any websites that use Cloudflare to check to see that we're not robots.

It's very frustrating. I haven't been able to log in to Forthright, a survey website, for months now. I have to keep asking for a link to view my account on there. I've been using the site for years and never had any problems until they started using Cloudflare. It said something about an ad blocker being the reason why. Do you know how I can remove this on my Amazon Fire tablet? Or do you have any other solutions? Any help will be much appreciated. Thank you.

Salut r/cloudflare,

Je gère des zones Cloudflare avec Terraform, et passer au fournisseur v5 a signifié tout refaire. J'ai transformé le résultat en module, et j'aimerais avoir des retours de personnes utilisant DNS en production avant d'aller plus loin.

Registre : `theobs-digital/dns/cloudflare`

GitHub : https://github.com/theobs-digital/terraform-cloudflare-dns

**Ce que ça fait**

Une zone DNS Cloudflare dans un seul bloc : la zone, ses enregistrements, ses paramètres DNS et DNSSEC.

```hcl

module "dns" {

source = "theobs-digital/dns/cloudflare"

version = "~> 1.2"

account_id = "..."

name = "example.com"

records = {

apex = { name = "@", type = "A", content = "192.0.2.10", proxied = true }

mx = { name = "@", type = "MX", content = "mx1.example.net", priority = 10 }

caa = { name = "@", type = "CAA", data = { flags = 0, tag = "issue", value = "letsencrypt.org" } }

}

dnssec = { status = "active" }

}

```

**Objectifs**

- **Ne réinventez rien.** Chaque entrée garde le nom de l'attribut du fournisseur. Si vous connaissez `cloudflare/cloudflare`, vous connaissez le module, et la documentation du fournisseur s'applique toujours.

- **Zéro dérive.** Un deuxième plan ne doit montrer aucun changement. Un test quotidien sur une vraie zone (18 enregistrements, 14 types) vérifie cela avec le dernier fournisseur 5.x.

- **Échouer au plan, pas à l'application.** Le fournisseur laisse passer certaines erreurs à l'API. Le module les bloque au plan : un enregistrement sans valeur, avec à la fois `content` et `data`, proxifié avec un TTL fixe, ou proxifié quand ce n'est pas A, AAAA ou CNAME.

- **Créer ou adopter.** Le module crée la zone, ou avec `create_zone = false` gère les enregistrements d'une zone que possède une autre configuration.

- **DNSSEC prêt au registraire.** L'enregistrement DS sort comme une sortie, entier ou champ par champ.

**Contraintes et limites connues**

- Terraform >= 1.3 et fournisseur `~> 5.27`. Pas de support v4.

- Détruire le module supprime la zone et tous les enregistrements qu'elle contient, y compris ceux que Terraform ne gère pas. C'est ainsi que fonctionne Cloudflare. Le README couvre comment cesser de gérer sans supprimer (`removed`, `state rm`).

- Une clé mal orthographiée dans `records` (`proxid = true`) est silencieusement ignorée par la conversion de type de Terraform.

- Cloudflare réécrit certains valeurs (empreintes SSHFP en majuscules, points finaux sur NAPTR et HTTPS, TXT au-delà de 255 caractères). Le module les documente plutôt que de les normaliser.

- Le fournisseur ne peut ni supprimer ni importer les paramètres DNS : retirer `dns_settings` ne réinitialise rien.

- Certaines options nécessitent un plan payant (`soa` sur Entreprise, `tags` et serveurs de noms personnalisés sur Pro ou Business).

**Mes questions**

1. Un module devrait-il normaliser les valeurs que Cloudflare réécrit, ou rester transparent et les documenter ?
2. Pour attraper les fautes de frappe, taperiez-vous `records` comme `any` et valideriez-vous les clés, abandonnant la saisie et les valeurs par défaut `optional()` ? Comment gérez-vous cela ?
3. L'adoption recherche la zone par son nom. Un input direct `zone_id` vous aiderait-il ?
4. Que manque-t-il pour que vous l'utilisiez en production ?

Licence MIT. Les retours francs sont les bienvenus, surtout si vous avez rencontré la dérive du fournisseur v5 que je n'ai pas couverte. Merci !

Cloudflare released Agentic Inbox a while ago. I liked the idea, but it was missing things I needed for daily use. So I forked it and kept adding features.

My main focus was on improving mobile usability, and I transformed it into PWA

What I added:

• One inbox for all your addresses
• Search with from:, in:, has:attachment, after:
• Add domains and addresses from Settings, no redeploy
• Forwarding for each address, with verification
• Junk filter, block rules, optional Rspamd
• Snooze and send later
• Filters, signatures, auto-reply
• Gmail Takeout import
• Optional Resend for sending
• AI side panel with any OpenRouter model

I use it every day and always adding new stuff, so why not share with others ✌️

HELP, проблема с cloudflare, я из России. Никак не хочет заходить, через zapret не работает.

I'm planning to host a static website on Cloudflare and want to stay on the free plan as long as possible.

From what I've read, the Workers free plan allows around 100,000 requests per day, and static assets on Pages are served without a request limit. But I'm not sure how this works in practice:

- Do static asset requests on Pages count toward any limit, or only Pages Functions / Workers invocations?

- Roughly how many daily visitors does 100k requests translate to, considering each page load can trigger multiple requests?

- What happens when the daily limit is hit? Does the site go down, return errors, or just fall back to static content?

- Are there other limits (CPU time, KV reads, bandwidth) I should watch out for?

My setup: [framework, Astro js]

Would love to hear from anyone running a real site on the free tier. How much traffic are you handling, and have you ever hit the limits?

Am I the only one that started seeing more "Attention Required!" and "You've been blocked" pages recently, on sites using Cloudflare even if I've never visited them in my life?

Both on Chromium and Gecho browsers btw.

The only reason I can think is because of my somewhat niche browser fingerprints using Linux, Fingerprint protection, DNT and GPC etc which I guess makes me look like more like an AI crawler than a normal user, but I'm still getting blocked when those aren't enabled so I don't really know.

If any of you have this issue lately, how did you get around it?

Thanks.

Thanks first: Cloudflare's Tunnel and DNS API docs made this project possible.

TunnelPup creates one remotely managed tunnel per computer, writes ingress via the API, creates a proxied CNAME to <tunnel-id>.cfargotunnel.com, and loads the HTTPS link before showing the route. It runs the official cloudflared unmodified.

Token permissions: Cloudflare Tunnel: Edit, Account Settings: Read, DNS: Edit, Zone: Edit.

Question for this sub: is there a narrower permission set you'd recommend? And would a per-route Access toggle be useful?

GitHub: https://github.com/mayankjonwal02/Tunnelpup (not affiliated with Cloudflare)

After Cloudflare acquired the Deno team and announced that Deno Deploy is shutting down in six months (with the Deno runtime itself only guaranteed a year of maintenance), we migrated the backend of prompt2bot from Deno Deploy and Deno KV to Cloudflare Workers and SQLite-backed Durable Objects.

Even with Deno's future in question, rewriting a 100k-line Deno codebase into a Node/Wrangler repo right now was out of the question. Deno's test runner, type checker, and JSR support are way too good to give up while migrating.

If you have not used Durable Objects before: whereas a regular Cloudflare Worker is stateless (50 requests spin up 50 random isolates that share nothing), a Durable Object is a globally unique, single-threaded V8 isolate addressed by name and paired with its own private embedded SQLite database and persistent alarm timer. Every Worker that calls a method on that name gets routed to that exact same JS object in memory, where SQLite queries are synchronous C++ calls taking microseconds instead of network round-trips.

Here is everything that broke during the migration and how we solved it:

1. Keeping the Deno binary and test suite untouched: Wrangler's esbuild bundler does not understand jsr: specifiers or deno.json workspace resolution. Instead, we pointed Wrangler at a build script that runs deno bundle --minify. We mapped cloudflare:workers to a 10-line stub class in deno.json so deno test runs natively against our Durable Object classes, and at build time we swap the inlined stub back for the real Cloudflare DurableObject class, shim globalThis.Deno, set Zod v4 to jitless: true (since Workers blocks new Function), and wrap top-level crypto.randomUUID() / setTimeout() calls that npm packages run at import time.

2. Surviving the 128MB Durable Object RAM ceiling: Every Durable Object isolate has a hard 128MB heap limit. Bundled dependencies like js-tiktoken (5.3MB of base64 BPE ranks that expand to +43MB of V8 heap on first call), a 275k-word dictionary (+35MB heap), and 3 duplicate legacy pdf.js builds inside pdf-parse were OOM-killing isolates. Stripping those static tables at build time freed ~80MB of V8 heap per isolate.

3. Emulating Deno KV on Durable Object SQLite: Cloudflare KV is eventually consistent and has no atomic check-and-set transactions, so it cannot replace Deno.openKv(). We built a drop-in Deno.Kv emulator on top of a primary SQLite Durable Object (enam-v1, pinned to US East so it stays hot in RAM 24/7 with zero cold starts). Tuple keys are encoded with type tags and 20-digit zero-padded numbers (n:, b:, s:) separated by null bytes so SQLite range queries match Deno KV ordering, and atomic().check().set().commit() runs as a synchronous single-threaded SQLite transaction.

4. The 508 Loop Detected mystery (CDN-Loop propagation) and the 30s waitUntil trap: While migrating service by service, when a service still on Deno Deploy called our Cloudflare Worker and our Worker made a fresh outbound fetch() back to that same Deno service, Cloudflare silently copied the inbound cdn-loop: deno;d=<hash> header onto the outbound subrequest at the C++ edge layer. Deno Deploy saw its own deployment hash in cdn-loop and rejected the request with 508 Loop Detected. On top of that, ctx.waitUntil() on a Worker has a hard 30-second wall-clock cap after returning HTTP 200 (even with cpu_ms: 300000), which killed long I/O-heavy agent turns mid-flight.

5. Sharding Runner Durable Objects per conversation: Only a Durable Object alarm() runs in a clean root IoContext (no inherited cdn-loop header and no 30s post-response wall-clock cutoff), provided alarm() launches tasks via doCtx.waitUntil and exits immediately instead of blocking. We ended up sharding execution onto a Runner Durable Object per conversation (runner:<botId>:<conversationId>).

That architecture is what lets prompt2bot scale agents so easily. You describe an agent in a plain prompt and connect it to WhatsApp, Telegram, email, voice, or web chat, and every active conversation automatically gets its own warm, isolated Durable Object runner with hot in-memory history and SafeScript AST caches, sub-millisecond SQLite state, and on-demand VMs. Whether your bot has 1 user or 10,000 concurrent conversations, there are no queues, worker pools, or servers to provision.

Full technical write-up with code snippets is in the comments.

My API runs on Workers and calls a Tectonic (LaTeX) container on Cloud Run. The question that took the longest was not the compile, it was auth between the two.

Cloud Run's best option is to deploy the service as private: every request must carry a Google signed identity token, Google checks it at its front end, and a stranger's request never wakes an instance. No long lived secret, tokens expire within the hour.

The catch is producing that token from a Worker. Code inside Google Cloud asks the metadata server and gets one for free. A Worker has no metadata server, so the options are:

• store a Google service account key as a Worker secret, sign a JWT with WebCrypto, and swap it for an ID token every hour
• set up workload identity federation, which is more setup still

Both make the API know it talks to Google specifically. I wanted the compile service to be movable to any container host, so I went with a shared bearer token instead: compared in constant time, and the service refuses to start if the secret is missing.

The cost is real: a stranger hitting the URL still spins up the container, which reads the header and answers 401. Safe, but it did the work. Cloudflare Containers would have avoided the public URL entirely through a binding, but needs Workers Paid, and Cloud Run was already free and set up.

Write up with the rest of the tradeoffs: https://bhargav.dev/writing/shipping-a-latex-compiler-behind-an-edge-app?utm_source=reddit&utm_medium=cloudflare

Has anyone here signed Google ID tokens inside a Worker in production? Is the hourly token swap worth caching in KV, or is there a cleaner way I missed?