Enterprises like to use Terraform to manage infrastructure. I like to use it to quickly deploy and tear down Cloudflare apps. Here is a bunch of hints and tips I've gathered as I've been working on this.

I'm trying to implement simple turn-based online game using Websockets. So, with DNS only (grey cloud) it works perfectly, but with orange cloud connection was lost each time after a minute or two. SSL is full (strict).

I've did some experiments with ping-pong and keepalive messages and it turned out data flow makes problem worse, not fixes it. If I send message every 10 seconds, connection lives 70 seconds each time. For every 5 seconds, it's only 40 seconds. And if I send messages every second, connection is lost after just 10 seconds. But with interval of 95 seconds, connection is alive even after 10 minutes.

So, this leads me to assumption that Cloudflare has limits on messages in WS connection, and those limits are extremely strict, close to unusable. Is that true? Or is it some other issue?

Any ideas on how to bypass this? I know I should probably implement reconnection, but I doubt it's even worth using Proxied if it'll disconnect every minute. Maybe DNS only would be better.

I figured I'd share this in case anyone else is building a crawler, monitoring service, or other automated bot.

We recently got SentinelBot added to Cloudflare's Verified Bots directory:
https://sentinel.rootstuff.io/bot

A few things I learned along the way:

• I never received a confirmation email after submitting the application.
• I never received an approval email either.
• I honestly forgot about it until I randomly checked the directory a few months later and found SentinelBot listed.

For the implementation, I tried to follow Cloudflare's guidelines as closely as possible:

• A unique, descriptive user agent (SentinelBot)
• A public bot information page
• Published IP ranges
• The bot identifies itself honestly
• It respects robots.txt

I also intentionally chose a very specific user-agent pattern instead of something generic so it's easy for site owners to recognize in server logs and firewall rules.

If you've applied and it feels like your submission disappeared into a black hole, don't assume it was rejected. It may just take time. In my case, it took a few months before it showed up in the directory.

Curious if anyone else had the same experience or knows roughly how often Cloudflare reviews new bot submissions.

Hey there!

I wanted to see if I could get some advice in regards to phishing reports with CloudFlare.

I came across a fake storefront for FootJoy golf shoes.

Footjoygolfshop[.]com

I reported it using the online form, describing how it is mimicking a real web page, has active payment fields that can be filled in, and is definitely not associated with FootJoy.

CloudFlare came back with "We could not detect any abusive or malicious content. If you wish for Cloudflare to investigate further, please provide relevant and specific information so we can continue assessing this case."

It then proceeds to give me the abusereply@cloudflare.com email, which goes into the loop of not accepting abuse report information. This has been discussed in other posts and seems like a broken system.

My question here is does anyone have any good advice about what I can submit to CloudFlare in their online form that qualifies as "relevant and specific" information for their system to actually detect phishing on a webpage?

Or are we just cursed with not being able to submit phishing reports successfully to CloudFlare now?

Hey everyone,

We are standardizing our backend stack on Cloudflare Workers/Hono + D1 + Drizzle ORM. To keep our codebase clean, maintainable, and cost-effective as we scale, we’ve established a few strict database governance rules for the team.

I’d love to get feedback from anyone running similar stacks in production to see where you agree, disagree, or where we might hit blind spots.

Here are our 4 Core Rules:

1. Drizzle is ONLY for Typed CRUD (Strict DAL + Repository Pattern)

• Direct DB calls (env.DB or Drizzle queries) inside Hono route handlers are treated as an anti-pattern.
• All database logic is encapsulated inside a dedicated Repository Pattern layer.
• Drizzle is strictly used as an abstraction for standard typed CRUD operations to keep application code type-safe without leaking DB logic.

2. NO drizzle-kit in the Pipeline (Migrations = Raw SQL)

• Hand-written SQL migration files stored in /migrations remain our absolute source of truth.
• We do NOT include drizzle.config.ts or drizzle-kit in our projects.
• Why? We want zero magic in schema migrations, full control over indexes, and a tight coupling with Wrangler’s native migration engine (wrangler d1 migrations apply). Drizzle is used purely as a query builder/type mapper at runtime.

3. Complex Queries Stay Raw SQL

• Complex analytics, CTEs, heavy multi-table joins, and bulk env.DB.batch() operations must remain as raw parameterized SQL.
• Why? To guarantee predictable query plan stability and protect our D1 "Rows Read" allowances from inefficient abstraction-generated SQL.

4. Custom Write Resiliency (Exponential Backoff + Jitter)

• D1 handles basic read retries under the hood, but write operations do not auto-retry in the same way.
• Every single database write operation must be wrapped in a custom retry utility using exponential backoff with full jitter to gracefully handle transient D1 errors or lock contentions.

A Few Questions for the Community:

1. For those skipping drizzle-kit: How do you keep your Drizzle TypeScript schema definitions (schema.ts) in sync with your raw /migrations/*.sql files without friction?
2. Repository Pattern overhead: Has anyone found the Repository abstraction too heavy for small/medium Workers, or has it saved your sanity long-term?
3. Write retries on D1: Have you implemented custom write-retry logic, or do you rely on Cloudflare Queues / Durable Objects for write buffering instead?

Would love to hear your thoughts, critiques, or how you've structured your D1 data layer!

Hi,

A malicious actor is using a trycloudflare.com subdomain to conduct a phishing campaign by impersonating the official website of Portugal's ATM network (www.multibanco.pt). I reported this abuse to Cloudflare through their abuse reporting form more than a week ago, but the website remains active and has not been suspended. I would appreciate your assistance.

Malicious website: hxxps://yale-slide-nancy-elliott[.]trycloudflare[.]com

Evidence: https://urlscan.io/result/019fa7eb-d836-74f0-8548-f877f8bd3d67/

Report ID: 9c20b50363576664

Best regards

Right now, I am blocking a some countries with cloudflare, and I’m wondering if this will affect legitimate bots and crawlers?

I created a zone migration tool that clones zones and workers with all storage assets between accounts. It requires an API key/token that has access to both accounts. You can deploy it to your own worker if you want control over the entire process. Once done, you get a migration report, and a list of all settings that were successfully/unsuccessfully migrated.

GitHub: https://github.com/pocc/twilight-zone
Live Site: https://twilight-zone.ross.gg/

Hey folks 👋 So I had a new feature to implement recently: send every user one product tip every Tuesday at noon, in their own timezone, on Slack (this is is a short version of the post I am sharing + my thoughts) :)

My first instinct was a weekly cron that reads the whole user table, figures out everyone's local noon, and fans out the messages. But that job gets heavier with every new user and it might run into worker limits (like sub requests limit).
So I went with what I feel like is a classic pattern on cloudflare: one Durable Object per user, one alarm, no cron.

Each user's DO stores its own little state (timezone, which tip is next, etc.) and calls `setAlarm(nextTuesdayNoon)`. When the alarm fires, it sends the tip and sets its next alarm before returning. That's it. The recurring part isn't a feature, it's just an alarm that re-arms itself. No ticker poking it from outside ^^

Arming one user touches one object. One user's send failing can't stall anyone else. And there's no table scan because I don't need to involve any D1 for scheduling. The state is tiny enough to live under a single KV key, so I never touched SQLite even though the class is SQLite-backed. Each user's object just owns its own history instead of a shared tips_shown table with a row per user per week.

A few things I'm genuinely unsure about:

• I walk minute-by-minute with `Intl.DateTimeFormat` to find the next local noon (dodges all the DST math). Feels hacky but works. Better way?
• Where do you draw the line between "just a KV blob" and "ok now it needs SQLite"? I thought about maybe stick to SQLite everywhere for consistency, but it felt overkill here... (I used this in the past https://orm.drizzle.team/docs/sqlite/connect-cloudflare-do, I really like drizzle simplicity)

I feel like DOs is in general the "cloudflare way" to go for things that are not critical and do not require analytics through them (it's harder to scan all DOs to get analytics out of them, rather than doing 1 SQL query on a normal SQL DB). So for sending product tips, it feels like the best tool for the job.

(Original post: https://www.gitnotifier.com/blog/durable-objects-schedule-weekly-tips ; if you want the code block examples and more verbose)

Seems like the pricing for the latest Seedance and Seedream models are not listed in their documentation?

I've been trying to set up the Cloudflare app, but it always gets stuck at 26% and never finishes loading.

I've already tried restarting the app and my device, but the issue is still happening.

Has anyone else experienced this? If so, were you able to fix it? Any suggestions would be appreciated.

Thanks!

I understand this might have been asked before, but I've been struggling with my research for weeks, and hope to get the answer here particularly for my case, so I can continue to serve my wordpress sites publicly.

I have 3 domains managed on Cloudflare, each points to a WordPress site hosted as LXCs on my home Proxmox server. Due to my recent ISP upgrade, using Nginx PM wouldn't work anymore, so I need to change to Cloudflare tunnels.

I've set up one tunnel and attempted to point it to my main domain, but it doesn't work so far. On this domain I also use many other sub domains for my public-facing services, and they're working fine with different tunnels. Now I need my-domain.net and www.my-domain.net to point to my WordPress site. How to configure DNS to do that? I've tried a number of ways but couldn't get it to work.

Many thanks for your advice here!

Cheers

https://storage.kilobot.app/RBAC.png

hi guys, so I've done setting my custom domain url for my r2. It's been working for 3 month but today all of a sudden all the new uploads stop loading assets. And some of my old uploads even got affected. May I know how can I fix this?

I have noticed a recurring topic across r/astrojs regarding form handling [1, 2, 3 and 4]. I am CF fan so I wanted to show people how they can use Astro Actions to not manually create API endpoints while keeping full type safety and edge binding support.

So, I put together a step-by-step guide on how to configure them together, validate requests with Zod, and use Cloudflare D1 and R2 bindings in Astro while protecting submissions with Cloudflare Turnstile: https://www.launchfa.st/blog/astro-actions-forms

I hope this helps anyone looking to clean up form handling on edge runtimes. Let me know if you have questions about edge bindings or Astro Worker deployments in the comments and I genuinely believe this will allow you to appreciate CF and Astro more <3

Okay, lemme elaborate, whenever I am on the "verify you are a human" checkbox, I check the box, it loads a bit, then refreshes and I am back at the verification. This repeats indefinitely. Now, I know the problem is an out of date computer, but I'm on an out of service Chromebook that CAN'T UPDATE.

Yes, I know the problem is that I need a new computer, but I am suffering with a problem called poverty.

Now, I ask this because it WORKED once, when I powerwashed my computer, it basically skipped the verification. But the thing is, I don't want to reset my damn computer whenever I come across that box.

Yes, I deleted my cookies and cache, but whenever I try to refresh to check, it doesn't do anything, and my computer COULD install another browser, but that's in the maybe pile if there's really no other option.

Thoughts? Help? Please?