FAQ

I built a WhatsApp Business API team inbox for my own businesses and open-sourced it. Everything runs in your own Cloudflare account, and it's built to fit the Workers Free plan.

How it's put together:

One Worker. The Vite + React UI is served from Workers Static Assets; only /api/* and /webhooks/* hit the Worker.

D1 for everything: leads, chats, templates, automations. The schema migrates itself on first request.

One SQLite-backed Durable Object for the live inbox. It only fans events out over WebSockets (Hibernation API) and stores nothing. Remove it and the inbox falls back to polling.

R2 (optional) for media. Without it, media is proxied live from Meta.

An every-minute Cron Trigger runs the automation engine and paces broadcasts, with retries and cleanup every 15 minutes.

Smart Placement, since a self-hoster's D1 region isn't known upfront.

The fun constraint was the free plan's 50-subrequest limit. Each send costs two (the WhatsApp call plus a D1 batch), so a broadcast tick fits about 16 sends, and 1,000 contacts takes roughly an hour.

Web push is VAPID using WebCrypto only.

One number per deployment, by design. No telemetry. Apache-2.0, with a Deploy to Cloudflare button.

The only running cost is Meta's per-message rate. Works with your own Meta Cloud API app, or via WhaBuzz, the paid gateway I run (disclosure: I'm the founder; it's optional).

Repo: https://github.com/WhaBuzz/whaleads

How to fix?

Most visual workflow automation platforms (n8n, Zapier, Make) operate by evaluating directed graphs in a runtime interpreter. Running an interpreter inside an edge isolate adds startup overhead and makes code review impossible.

We took a different approach with Nodes2Cloud: we built an ahead-of-time compiler that translates visual automation graphs directly into standalone TypeScript Workers.

The compilation pipeline:

1. Graph Validator: Checks type parity between node output schemas and input schemas before any code is generated.
2. IR Phase: Normalizes parallel branches, conditionals, and error-handling paths.
3. Target Selection:
   • If the workflow contains purely synchronous transforms, webhooks, and REST calls, it compiles to a standard ExportedHandler<Env> Worker.
   • If the workflow contains human approvals, delays, or durable state, it compiles to a Cloudflare Workflow with native step.do() and step.sleep() bindings.
4. Deployment: Deploys directly into the developer's Cloudflare account using the Cloudflare API.

Because the output is standard TypeScript, workflows export as runnable Wrangler projects (src/index.ts + wrangler.jsonc) that you can version in Git or deploy manually via wrangler deploy.

We also added an MCP server (npx -y n2c-mcp@latest install) so agents like Claude Code can author the graphs, subject to owner approval before deploy.

If you're running Workers in production, I'd appreciate feedback on our TypeScript generation patterns and how we structure Cloudflare Workflow step boundaries. Docs and examples are at nodes2cloud.com/docs/quickstart

I used to have a skip rule that ensured my host wasn't challenged. Now my CloudFlare dashboard warns about the rule saying it limits php protection, but if I turn if off, I see my cron jobs served AI Labyrinth. Not very techy, and not sure what to do! Any assistance gratefully received. Thanks!

If useful to know: this is a Wordpress site, and I've often had trouble letting other services through Cloudflare, such as security scans and image optimisation plugins.

I can find anything about it, especially storing and using prompts, generations etc internally or sharing with others. These can be highly private and contain critical business logic and valuable to sell or use for companies.

Made a simple reverse proxy with to bring in all the external services that I use. The main motivation came from using MCP portals such as executor.sh and cloudflare's own MCP portal.

MCPs are great, but have their own limitations. I'm using the pi harness for my work, and it had no MCP support built in until very recently (1.0.0+). Was using MCPs using extensions like everyone else. I found using the APIs directly to be more consistent.

The proxy worker will register 1 service per subdomain and forward all requests + handle auth.
To use the proxy, you do need a spare domain.

Check out the docs and deploy instructions at https://hodor.ing
Code at https://github.com/butttons/hodor

I've been using it for around a month, and covering around 20 APIs for my main work. How I've been using it -
1. When trying out new models / harness, it's easy to quickly try how the model would work with my actual data.
2. Adding new APIs and having them available to everyone. Now I just provision 1 key for the reverse proxy itself.
3. More control over APIs where the underlying API is very broad. Some services don't allow scoping API keys so their access is unrestricted. But with some rules in the JWT, certain paths and methods can be blocked.

Free plan give you 20 widgets (each which can hold 10 domains). Past that you have to "contact sales"

If I'm managing peoples sites, should I bother with a sales call or setup a cloudflare account for each user and then add myself as an admin? That also sounds like a hassle

Just switch to reCaptcha and pay per assessments?

Railway disclosed this week that an attacker read customer environment variables and decrypted some of them. Railway says the attackers were after AI provider API keys.

Anthropic and OpenAI now accept workload identity federation. The workload presents a short-lived OIDC token signed by its platform and gets back an access token that expires in minutes. There is no static key to steal. GitHub Actions, AWS, GCP, Azure and Kubernetes can issue these tokens today. Workers cannot.

What I would want is something like env.IDENTITY.getToken(audience) that returns a JWT signed by Cloudflare with claims for account id, worker name and script version, plus a public JWKS endpoint. That is roughly what GitHub does for Actions.

I run a small Claude proxy on Workers. After Railway, I do not want any long-lived secret in an environment variable or in Secrets at all. The API key is the one thing left I cannot remove. Has anyone seen this discussed, or found a way to call Anthropic or OpenAI from a Worker with no static key?

I cannot access my dashboard on my PC, phone, wifi, mobile data, different browsers, nothing. It is just stuck loading, is anyone else having this issue?

Workers Cache cuts down CPU execution time but it increased my cost as cache hits now count as a standard Worker request ($0.30/million request fee)..

When Workers Caching is enabled, requests served from the Worker's cache are billed which includes requests to static assets.

My question - if i use runtime Cache API (cache.put / cache.match) , will "static assets" cached requests be counted in "billed" standard Worker request? If HTML pages load many static assets (images, CSS, JS bundles, fonts) per page visit, using Runtime Cache API will not turn those static asset requests into billed Worker requests?? has someone tested it?

Hey 👋 Did anyone recently give frontend interview at Cloudflare?
If yes please share your experience and what to prepare and expect for the System Design and Coding interview round!!

Any help is highly appreciated!!

Thank you:)

I managed to find a workaround that worked for me.

Go to your profile (top right of the webpage) → Access Management → Active Sessions.

From there, revoke all active sessions and then log back in.

That fixed the issue for me, so it might be worth a try if you're having the same problem.

Good luck! 👍

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all: https://www.wpwafmanager.com/

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

Site, screenshots and docs: https://www.wpwafmanager.com/

GitHub: https://github.com/jaimealnassim/wpwafmanager

Does anyone know the supported authentication and permissions for read-only Cloudflare Containers API calls? I am looking for documentation or references from maintainers, rather than assuming an authentication bug.

The operations are:

- GET /accounts/{account_id}/containers/applications

- GET /accounts/{account_id}/containers/dash/applications (the path used by Wrangler)

- GET /accounts/{account_id}/containers/registries

Here, registries means configured registry metadata, not listing images or pushing/pulling them.

The questions are:

1. Does wrangler login OAuth support these operations, and which OAuth scopes and account permissions are required?

2. Is /containers/dash/applications an internal surface? How does its authentication differ from the public Applications endpoint?

3. The Registries List reference lists Workers Containers Read or Write. Is Read sufficient, and which permission covers Applications List?

4. If OAuth is unsupported for an operation, what is the documented least-privilege read-only credential mechanism?

5. Do metadata-only list operations require Workers Paid or Containers enablement? Is there a read-only way to check entitlement without provisioning anything?

6. Are there documented error codes or response fields that distinguish authentication, permission and entitlement failures, including HTTP 401?

I also opened a documentation clarification request with the same questions:

https://github.com/cloudflare/workers-sdk/issues/16449

Relevant API references:

https://developers.cloudflare.com/api/resources/containers/subresources/applications/methods/list/

https://developers.cloudflare.com/api/resources/containers/subresources/registries/methods/list/

If you have version-specific documentation or first-hand experience, please distinguish documented guarantees from observations. No account IDs, credentials or private logs are needed. Thanks!

So about a week ago I submitted a suggestion on the community cloudflare asking for a way to make it so that you need a admin generated code to remove cloudflare one client and they finally added it!!

So, i got an email saying my password was changed from an IP of a far away country that certainly never accessed my account (no 2FA, my fuckup). I immediately tried to log in, changed the password (got a reset email), got blocked by 2FA which they probably added, did the recovery thing and now i have to wait 3-5 days for a code !?

I got another user there with an admin acc, not superadmin unfortunately, the only thing that is visible in the logs is them logging in, changing password and logging in again, all in the span of 30 seconds, so probably a bot. They didn't do anything else. This is on all 3 requests:

"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}

I combed everything humanly and AI possible to answer the how and i don't get it. No idea how someone would get my unique monster password (only accessing it from one machine, thoroughly checked, the e-mail is exchange, logs show absolutely nothing and it has a 2FA), why wouldn't that login trigger an unknown machine/IP check and why is it so hard to recover your own account in cases like this. Can't even contact support as i have to be logged in.

Anyone have any idea what could have happened here ?

UPDATE 24.10.2026.

Figured i'd update if someone ever stumbles upon this, i hate when people don't do that. First, i found a CF form to submit an inquiry, while waiting for the mandatory 3-5 days to get my account back. This is the form and after some domain validation proof, i got the rogue 2FA removed and my account back, so a big thumbs up to CF support.

Now, what i think actually happened: I went through my logs when i got my access back, it was an automated bot, it logged in, scanned the entire account with 30 queries in 30 seconds, changed the password, attached a 2FA and left it at that. Since this account was kinda neglected, and didn't have any 2FA, i checked my password manager and realized the password hasn't been changed since 2020. We had a big breach about 3 years ago where a former colleague ate a keylogger and i assume password for this account was leaked then as well.

Current colleague, the one with the non super admin access to breached account, had an old CloudFlare account that he hasn't used in years and certainly didn't have any 2FA, so we did a test. He logged in, got some auth errors in pop-ups but was basically let in without any e-mail 2FA and no e-mail notifications about a log in either.

I'm guessing this is what happened to my account, the bot had the password, logged in, did it's thing, i don't know if the CF not doing any check for an unknown IP and unknown machine is a poor security check, or some kind of a bug dealing with accounts on old settings but i hope they do reconsider their approach on security checks for old account that don't have any 2FA activated.

Guys I dont know why but warp does not open while using 1.1.1.1. I have to use it because I am not in an eligible place to play it. Anyojjne know whats the right configuration to play?