Questions
Cloudflare Checkup FAQ
What does the Cloudflare Checkup inspect?
It reviews the selected Cloudflare account and accessible zones for account governance, DNS, SSL/TLS, WAF and related configuration, plus supported Cloudflare One settings such as Access, Gateway and Tunnels.Coverage depends on the token permissions and features available in the account. A skipped check is not evidence that the setting is secure; review the reported gaps before drawing a conclusion.Managed WAF operations and change controlInternal access and Zero Trust
What access do I need to run a Cloudflare Checkup?
Choose Continue with Cloudflare and approve read-only access, or paste a Cloudflare API token with the requested read permissions. Either way, the checkup reads only the accounts and zones you are authorized to review.Continue with Cloudflare sends results to your Cloudflare account email and revokes Vigilbase’s access when the scan finishes. With an API token, limit it to the intended resources and confirm your email. Neither grants permission to inspect someone else’s account.Tool access and verification requirementsPrivacy and data handling
Does the Cloudflare Checkup change my configuration?
No. The checkup reads configuration and produces findings; it does not apply the recommended changes to your account.Review proposed changes with the account and application owners. Agree the scope, approval, rollback and verification steps before implementing a recommendation.How we run Cloudflare after go-liveCompare Core, Priority and Critical
What is included in the free Cloudflare Checkup?
The free scan provides an initial grade and the available free findings. Additional account and domain findings, analysis and consultation options are shown in the report’s upgrade flow.Review the options shown for your report before purchasing. Neither a grade nor an upgraded report certifies the account or replaces ongoing monitoring and authorized configuration review.Compare the public security checksCompare Core, Priority and Critical
Can I run the checkup without giving Vigilbase a Cloudflare token?
Yes. In local mode you run one command on your own computer. It collects your configuration with Cloudflare’s cf CLI, shows you a summary, then uploads the file. Your Cloudflare login stays on your machine.The command asks for your work email and emails you a code to confirm it, so there is nothing to fill in on the page. cf signs in to Cloudflare with a read-only login; the Vigilbase CLI never reads, stores or uploads that credential.Tool access and verification requirementsPrivacy and data handling
What does the local mode upload?
Only the snapshot file the command saves on your machine, which you can inspect first. It holds the configuration values the checkup evaluates, with no credentials, and origin IP addresses are pseudonymised.Before it uploads, the command shows the zones, read counts and data categories and asks you to confirm. Vigilbase evaluates the file with its scanner and does not keep the uploaded file.Privacy and data handlingTool access and verification requirements
Why are some checks 'Not collected locally'?
Cloudflare’s cf CLI cannot yet read legacy Firewall Rules, legacy Filters, previous-version WAF packages, previous-version Rate Limiting or WAF traffic analytics. Checks that need them are shown as Not collected locally and are never scored as passing. Plan add-ons and Smart Shield are not collected locally either.Run the checkup with a read-only API token in the browser to include those checks. A read that cf could not complete on your machine is labelled the same way.Compare the public security checksTool access and verification requirements
Is a local result verified?
No. A local result is labelled self-reported: Vigilbase evaluated the uploaded data but did not verify it against Cloudflare.Self-reported results are excluded from security badges and verified-scan evidence. Use the token-based checkup when you need a result that Vigilbase collected itself.Compare the public security checksPrivacy and data handling
Vigilbase is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare and the Cloudflare logo are trademarks of Cloudflare, Inc.
