Before you start
You need a Guarita account and access to the Cloudflare account that owns your domain's zone. Connecting does not require a paid Guarita plan.
- The domain on Cloudflare — the app must sit under a zone in your Cloudflare account — the zone is what attests ownership.
- Permission to authorize — whoever connects must be able to authorize applications in the Cloudflare account. On the Guarita side, any workspace member can connect and disconnect — you do not have to be the owner.
- Testing authority — only connect zones for apps you own or have permission to assess.
Connect Cloudflare
From the integrations screen to connected zones, in five steps. You never paste a token into Guarita.
- 01Open Settings → Integrations → Cloudflare and click “Connect Cloudflare”.
- 02Guarita sends you to the Cloudflare dashboard to authorize. The application is a public client using PKCE: the proof that the code is redeemed by whoever started the flow stays with us, not in a shared secret.
- 03You come back to Guarita with a single-use ticket in the URL fragment — it never reaches server logs and is discarded as soon as you confirm or cancel.
- 04Choose which zones to connect. All of them are pre-selected, and each one shows its Cloudflare plan (Free, Pro, Business, Enterprise).
- 05Tick the authorization — you are confirming that you control those domains and that Guarita may create and remove a temporary rule in your WAF (the web application firewall on your zone) — and confirm the connection.
On confirmation, apps you already registered under those zones are verified right away. An app registered later is picked up by the next connection reconciliation — not instantly.
Permissions used
Guarita requests only what it needs to confirm the zone, open and close the exception in the WAF — Cloudflare's web application firewall — and, if you use domain-wide monitoring, see your subdomains.
| Scope | Access | Why |
|---|---|---|
| zone.read | Read | List the zones you granted, match the app hostname to one of them, and read the zone plan — the plan decides how Bot Fight Mode (the anti-bot filter Cloudflare turns on by default on free zones) is handled. |
| zone-waf.read · zone-waf.write | Read / Write | Create the temporary rule when a scan starts and remove it when the scan ends. Zone custom rules only — nothing about the account, billing, or certificates. |
| bot-management.read · bot-management.write | Read / Write | Free Cloudflare plans only: read Bot Fight Mode, turn it off for the scan, and restore its previous state afterwards. |
| dns.read | Read | Read the names of A, AAAA, and CNAME records so domain-wide monitoring can discover subdomains. No DNS writes. |
You can uncheck the optional scopes on the Cloudflare screen. Guarita reads what was actually granted and works with it: without the bot scope it never touches Bot Fight Mode, and without dns.read DNS discovery is reported as an unavailable source — never as “nothing found”.
Verification through zone ownership
Whoever controls the zone controls the domain's DNS. That makes zone ownership proof that the app is yours, replacing the TXT record, the published file, and the meta tag.
What it unlocks
With the app verified, the full scan opens up: 40 checks, against the 18 that run before Guarita knows the app is yours. It is also the precondition for WAF liberation — that never fires for an unverified app.
Validity and renewal
The attestation is valid for 24 hours. A tick every 5 minutes reconciles connections and renews it well before it expires — Cloudflare sends no webhook, so reconciling is the only way to know the access still stands.
WAF liberation during a scan
This is why Cloudflare is worth more than an ordinary connection: with the app behind a WAF — the web application firewall that stops suspicious requests before they reach your server — a scan hits the block and comes back incomplete. Here Guarita opens the way, runs, and closes it.
Before any traffic leaves
Guarita mints a one-time secret for that scan and creates a custom rule in your zone with the “skip” action.
During the scan
The rule’s action is “skip”: it takes only the requests carrying that secret in the x-guarita-token header out of the WAF checks. Your rules keep applying to all other traffic. On a free-plan zone there is one more exception, Bot Fight Mode — right below.
When it ends
Guarita removes the rule and turns Bot Fight Mode back on as the scan finishes — on success, on error, or on timeout. Undoing it is our obligation, but both are best-effort with a cap of five attempts: if Cloudflare keeps refusing, it is recorded on our side and you can undo it from your Cloudflare dashboard.
When it fires
- • Only for an app with proven ownership
- • Only under a zone you connected, with an active connection
- • One rule per scan, described as “Guarita scan … (auto, temporária)”
- • If the zone already has custom rules, ours is appended — yours are untouched
What the rule skips
For secret-carrying requests only: the managed WAF rulesets and the security products that would block the scan — waf, bic, uaBlock, hot, securityLevel, rateLimit, and zoneLockdown.
Surface discovery from zone DNS
In domain-wide monitoring (Business only), your zone records are the most reliable source of subdomains.
Why zone DNS
With a wildcard certificate — Cloudflare's default — public certificate logs reveal no subdomain at all. Zone DNS does: Guarita reads the names of A, AAAA, and CNAME records and merges them with the other discovery sources.
What monitoring requires
The apex domain must be verified, or its Cloudflare zone connected with an active connection. Monitoring watches up to 200 hosts per account — not per domain. Above that cap, a discovered host stays on observation-only scanning.
Without the dns.read scope, Cloudflare is reported as an unavailable source for that discovery run. Guarita never turns “I could not look” into “there is nothing here”.
Manage or disconnect
Everything lives in Settings → Integrations → Cloudflare.
Reconcile
Every 5 minutes Guarita reconciles the connections approaching expiry: it re-lists the authorized zones and renews the attestation.
Review zones
Reconciliation never widens consent: to include a new zone, reconnect and select it.
Disconnect
Removes any open rules in your account first, revokes attestations immediately, and closes the connection.
When you disconnect, apps verified through the zone stop being verified — a manual proof (DNS, file, or meta tag), if you have one, still stands. Scan history is preserved, subject to your plan's retention period.
Troubleshooting
The connection did not complete
If you declined the authorization on Cloudflare, nothing was connected — just try again. If Cloudflare rejected the requested permissions or was unstable, no zone was connected; retry in a few minutes and tell support if it persists.
I connected, but not every app got verified
Your plan's verified-app quota decides: the ones that fit are verified right away, and the rest stay unverified in your app list. The connection screen does not list who was left out — compare your app list against the zones you connected, and whatever is still unverified is what did not fit. Upgrade or free a slot, then reconnect to verify the rest.
The connection shows “needs reconnecting”
Cloudflare refused this connection's access — expired token or permission revoked on their side. There is no automatic renewal: reconnect. Until then, apps relying on that attestation fall back to the 18-check scan and WAF liberation does not fire.
The scan still hits a block
Check three things: the app has proven ownership; the zone covering that domain is connected and active; and, on a free zone, the bot scope was kept (without it Bot Fight Mode stays on during the scan). If the block comes from another web application firewall in front of Cloudflare, use the manual header allowlist.
Monitoring finds no subdomains from DNS
DNS discovery depends on the dns.read scope. If the connection does not carry it — you unchecked it on the Cloudflare screen, or it was revoked later — Cloudflare shows up as an unavailable source for that discovery run, never as “nothing found”. The fix is to reconnect with dns.read kept ticked.
Is there a rule left over in my zone?
Removal runs as every scan ends. If it fails, a cleanup routine retries — with a grace window longer than the maximum scan time, so it never deletes the rule of a scan still in flight — up to a cap of five attempts. Once the cap is spent, the case is raised as an alert in our own logs; no automatic notice goes out to you, so it is worth checking the zone. Guarita's rules are identifiable by the description “Guarita scan … (auto, temporária)”; if you find one left over, you can delete it and let us know.
Data and security
Guarita keeps the minimum needed to operate the integration — and keeps a trail of everything it creates in your account, because the trail is what makes the change reversible.
Guarita uses
- • Connection and granted-zone identifiers (id, name, and plan)
- • OAuth credentials, encrypted and never returned to the browser
- • Attestation evidence per hostname, with validity and revocation
- • The trail of every rule created and of the previous Bot Fight Mode state
- • The names of A, AAAA, and CNAME records, when monitoring is on
Guarita does not
- • Change your DNS records or the firewall (WAF) rules that are already yours
- • Leave the scan rule standing on purpose — removing it is our obligation and runs as every scan ends
- • Disable any protection beyond free-plan Bot Fight Mode, which it turns back on at the end
- • Let through anyone who is not carrying that scan's secret
- • Touch a zone you did not select during consent
Removing the rule and turning Bot Fight Mode back on are both best-effort, with a cap of five attempts. If Cloudflare refuses every time, the case is raised as an alert in our own logs — no automatic notice reaches you — and the rule stays identifiable by the description “Guarita scan … (auto, temporária)”: you can delete it and turn Bot Fight Mode back on from your Cloudflare dashboard at any time.
Still blocked?
Send the zone name, the app address, the approximate time, and the exact error. Never send a Cloudflare token or a scan secret.