11 posts
A practical, opinionated walkthrough for rolling out Cloudflare's Web Application Firewall on a real domain — start in monitor mode, layer in protections, set up alerting on spikes, and why OWASP Core Ruleset is usually a mistake.
Cloudflare runs both a recursive resolver (1.1.1.1) and an authoritative DNS service, and they do completely different jobs. This is the clearest way to explain the difference between the two halves of every DNS lookup.
How to wire up a new site on Cloudflare with Git-triggered auto-deploys, then hand Claude a scoped GitHub token so AI-assisted edits flow from a chat conversation straight to production — without ever opening a terminal.
A step-by-step guide to enabling DNSSEC on parent and child domains in Cloudflare — why order matters, how DS records connect the chain of trust, and why using Cloudflare as both your registrar and DNS provider makes this dramatically easier.
A clear, high-level breakdown of DNSSEC — the problem it solves, how cryptographic signing creates a chain of trust from the root zone down to your domain, and why every DNS owner should understand it.
How Cloudflare's Advanced Bot Protection works, what automated threats it stops, and best practices for deploying it without blocking legitimate bots or real users.
What sets Cloudflare's Advanced WAF apart from a standard WAF, the protection it provides at Layer 7, and best practices for deploying it effectively.
What Magic Firewall does, how it fits into your network security stack, and best practices for writing effective firewall rules at Cloudflare's edge.
What Magic Transit is, how it protects your IP infrastructure at the network layer, and best practices for onboarding your prefixes.
How Cloudflare Tunnel lets you expose internal services securely without punching holes in your firewall.
A breakdown of the latest DDoS trends — record-breaking volumetric attacks, HTTP/2 exploits, and how AI is shifting both offense and defense.
