Cloudflare Security Audit: Automate 100+ Checks

Security audits are a critical component of any cybersecurity defense strategy. However, manual execution is often a tedious, time-consuming, and human error-prone process. In complex environments with hundreds or thousands of configurations to check, the possibility of overlooking crucial details is high, leaving doors open to potential attacks.

To address this challenge, Cloudflare released an open-source tool, the “Security Audit Skill,” designed to automate the verification of over 100 security best practices via the platform’s APIs. This tool rapidly identifies misconfigurations or suboptimal settings in Cloudflare services like WAF, DNS, CDN, and Zero Trust, transforming a manual activity into an efficient and repeatable process. Read also: MFA Admin: Unblocking Operations

Tested on: Cloudflare API · Python 3.9 · September 2026

Prerequisites / Test Environment

To use the Cloudflare Security Audit Skill, you need a Cloudflare account and valid API credentials (API Token or API Key). The tool is written in Python, so a Python 3.x installation and pip for dependency management are required. I recommend creating a virtual environment to isolate project dependencies. I tested the tool on Ubuntu 24.04 LTS.

# Install prerequisites
sudo apt update
sudo apt install python3 python3-pip -y

# Create and activate a virtual environment
python3 -m venv venv_audit
source venv_audit/bin/activate

# Clone the repository and install dependencies
git clone https://github.com/cloudflare/security-audit-skill.git
cd security-audit-skill
pip install -r requirements.txt

It is crucial to configure environment variables for Cloudflare credentials. For security reasons, I do not recommend embedding credentials directly into configuration files.

export CF_API_EMAIL="your_cloudflare_email@example.com"
export CF_API_KEY="your_global_api_key"
# OR (preferable for tokens with granular permissions)
export CF_API_TOKEN="your_api_token"

Ensure that your API Token has the necessary permissions to read the configurations of the services you intend to audit (e.g., Zone Settings, DNS, WAF).

1. Executing the Security Audit

Once the environment and credentials are configured, running the tool is straightforward. The main command initiates the audit on all configured services or specific ones. The tool queries Cloudflare APIs and compares current configurations against predefined best practices.

# Run a full audit
python3 audit.py

# Run an audit on a specific account or zone
# Replace <ACCOUNT_ID> and <ZONE_ID> with your values
python3 audit.py --account-id <ACCOUNT_ID>
python3 audit.py --zone-id <ZONE_ID>

# Run an audit only for specific categories (e.g., WAF)
python3 audit.py --category waf

The output displays a summary of checks, indicating which best practices are met and which are not. For each non-conformance, details about the issue are provided, and in some cases, remediation suggestions. This approach drastically reduces investigation time, allowing teams to focus on problem resolution rather than identification. Read also: VMware to Proxmox: Initial Assessment for Public Sector

Output and Reporting

The tool generates human-readable console output, but you can redirect it to a file for later analysis or integration with other reporting systems. The output includes details such as the best practice ID, the affected service, status (pass/fail), and a brief description of the issue. This is fundamental for tracking non-conformances over time and demonstrating security posture improvement.

# Redirect output to a JSON file
python3 audit.py --output-format json > audit_report.json

# Redirect output to a readable text file
python3 audit.py > audit_report.txt

The ability to generate reports in JSON format facilitates integration with custom dashboards or SIEM/EDR systems, providing a centralized view of the security status. Read also: eBPF Network Monitoring: Agentless Gods-Eye-View

2. Integration with CI/CD and Automation

One of the biggest advantages of the Cloudflare Security Audit Skill is its ability to integrate into CI/CD pipelines or automation scripts. This enables automatic and periodic audits, ensuring security configurations remain compliant over time and promptly detecting any deviations.

Consider a scenario where a DevOps team frequently releases updates to DNS or WAF configurations. Including a security audit step in the deployment pipeline can prevent insecure configurations from reaching production.

# Example of integration into a GitLab CI/CD pipeline (or GitHub Actions)
stages:
  - deploy
  - security_audit

deploy_app:
  stage: deploy
  script:
    - # ... deployment commands ...

security_audit_cloudflare:
  stage: security_audit
  image: python:3.9-slim
  script:
    - pip install -r security-audit-skill/requirements.txt
    - cd security-audit-skill
    - python3 audit.py --zone-id $CF_ZONE_ID --output-format json > audit_results.json
    - python3 -c "import json; data = json.load(open('audit_results.json')); assert all(result['status'] == 'pass' for result in data['results']), 'Security audit failed!'"
  # If the audit fails, the pipeline stops
  # Add Slack/email notifications here
  only:
    - main

This example shows how a simple Python script can check the audit status and, if it fails, block the pipeline, forcing remediation before deployment. A similar approach can be implemented with Ansible to perform audits across multiple environments or to apply corrections automatically. Read also: TeamAI-CLI: AI Automation for Devs

Common Errors and Troubleshooting

Invalid API Credentials: Ensure that the environment variables CF_API_EMAIL, CF_API_KEY, or CF_API_TOKEN are set correctly and that the API Token has adequate permissions. A common mistake is using a token with insufficient permissions. Read also: Ever Gauzy: Open Source Business Management Suite
Missing Python Dependencies: If you encounter errors related to missing modules, verify that you have installed all dependencies with pip install -r requirements.txt within your virtual environment.
Incorrect Zone or Account IDs: If you specify --zone-id or --account-id, ensure they are correct. You can retrieve them from your Cloudflare dashboard.
Network Connectivity: The tool requires access to api.cloudflare.com. Verify that no firewalls or proxies are blocking the connection.

FAQ — Frequently Asked Questions

Can I use this tool for non-Cloudflare services?

No, the Cloudflare Security Audit Skill is designed specifically to interact with Cloudflare APIs and verify configurations of Cloudflare services (WAF, DNS, CDN, Zero Trust). It cannot be used to audit services from other providers or on-premise infrastructure.

Is it possible to customize the security best practices?

Currently, the tool uses a predefined set of best practices provided by Cloudflare. The project documentation suggests that future versions might introduce features for customizing or extending audit rules. For now, it is a standardized evaluation tool.

What types of issues does the tool detect?

It detects a wide range of issues, including suboptimal DNS configurations (e.g., missing SPF/DKIM records), overly permissive or outdated WAF rules, insecure caching settings, and incomplete or misconfigured Zero Trust policies. It focuses on configurations that can expose your environment to risks.

Does the tool make changes to my Cloudflare configurations?

No, the tool is designed to be “read-only.” It only queries existing configurations via Cloudflare APIs and generates a report. It does not make any modifications, ensuring the audit process is non-invasive and safe for your production environment.

Conclusions with Operational Takeaways

The Cloudflare Security Audit Skill represents a significant step towards security automation. By reducing the manual workload for audits, it allows IT and security teams to focus on higher-value activities, such as remediation and implementing new defensive strategies. Integration into CI/CD pipelines or automation scripts ensures continuous vigilance over configurations, maintaining a strong security posture. For any organization using Cloudflare, adopting this tool can translate into significant improvements in operational efficiency and resilience against cyber threats.

Sources

Updated: September 2026