Make the origin disappear
Cloudflare-native architecture
Tunnel, WAF, Turnstile, Zero Trust, and cache rules configured as one defensive edge, with no inbound origin ports left open.
A firewall rule that allows Cloudflare IP ranges is not the same as having no open ports. The first is a list to maintain and eventually get wrong; the second removes the attack surface.
We deploy behind a tunnel, verify from outside that the origin does not answer, and hand you the runbook.
What is included
-
Cloudflare Tunnel: the origin makes outbound connections only
-
Zero Trust access on admin and staging, with one-time-PIN or SSO
-
WAF rules and bot management tuned to your traffic, not left on defaults
-
Turnstile on every public form
-
Cache rules that actually cache, with a correct purge strategy
-
Origin firewall closed and verified from outside
What you get
-
The full configuration, documented
-
An external scan showing the origin is unreachable
-
A runbook for adding hostnames and rotating credentials
See it working
