Audit every client's Cloudflare zone from one place
Ten, fifty, two hundred zones across separate accounts. Who changed the WAF rule? Which zones still lack HSTS or managed rules? Zone Audit snapshots each zone daily with read-only tokens, diffs the changes, checks a baseline you define, and emails a weekly report you can forward to the client.
Drift
DNS, WAF, Page/Transform rules, Access policies — daily diff per zone.
Baseline
Your checklist (HSTS, TLS 1.2+, managed rules, bot fight mode…) evaluated everywhere.
Report
Weekly PDF/HTML per client. Audit trail for compliance questions.
What should a Cloudflare zone security baseline check?
The list I use has 12 read-only checks: minimum TLS 1.2, Always Use HTTPS, HSTS, WAF managed rules, Bot Fight Mode, rate limiting on forms, DNSSEC, SPF, DKIM and DMARC, no orphaned records, admin paths behind Access, scoped API tokens and a reviewed audit log. By hand it's about 10 minutes per zone.
Does Cloudflare show who changed a zone setting?
Yes, in the account audit log, which records configuration changes and who made them. The catch is that it lives per account and few people read it. Across many client accounts you'd open each one separately, and nothing tells you when a change moved a zone away from the baseline you agreed on.
Why would a zone audit need only read-only tokens?
Because every check is a read: settings, rulesets, DNS records and the audit log all come back from GET calls with scoped read permissions. Zone Audit is planned to snapshot each zone daily with tokens you create and can revoke, diff today against yesterday, and email only on change. It isn't running yet; this page is a waitlist.
Pricing (planned)
$29 / month up to 20 zones · $79 / month up to 100 zones.
Also exploring
Paying for Workers and wary of a surprise invoice? See Usage Guard — per-metric spike alerts and an optional stop switch.
Routing support@ through Cloudflare and reading it in Gmail? See Routed Inbox — a small shared inbox on Email Routing, no seat pricing.