Cloudflare Security Review · Read-only · Checked by a person
We review your websites, email records, API tokens, Worker secrets, and AI settings. A person checks every finding and explains it in plain English.
See a sample report The sample uses made-up, redacted example data.
Read-only access.A 7-day token you can revoke.No changes without your written OK.
Cloudflare accounts grow over time. Someone adds a zone, a Worker, an AI Gateway, or an API token. Often nobody writes it down.
Cloudflare's built-in Security Insights helps. It does not show everything.
Website and DNS settings are easy to see. Account settings are easy to miss.
Most findings are cleanup items. That is normal. The goal is a clean account that you understand.
You won't see any of these by visiting your website. Our report shows where each one is and how to fix it.
We run 41 configuration checks across your Cloudflare account. Then we run 9 outside-in verifications from the public internet.
Free tools are a good place to start. We tested two popular free scanners and Cloudflare Security Insights on our own accounts.
The account layer. Our review found issues with API tokens, Worker secrets, and AI spend limits. Neither free scanner found these on our test account.
A person checks every finding. Scanners give you a list. We check each finding by hand before it reaches you. Then we explain what it means and how to fix it.
The numbers, with the fine print.
We look. We do not touch.
Each item shows what we found, the evidence, and how to fix it. It also shows how risky the fix is and how to undo it.
Each item notes whether Security Insights also shows it. It also notes whether our outside checks confirm it.
We go through the report with you and answer questions. You decide what to fix and when.
See a sample report The sample uses made-up, redacted example data.
Want help with the fixes? We can guide you through a pre-agreed set of simple fixes, up to 3 analyst hours.
Prefer to make the fixes yourself? The report tells you how.
This is a configuration review. It is not a penetration test. We do not attack your apps or try to log in.
All prices in US dollars.
Resell the review at a wholesale price of $850 per review. Your first review is $600, then $850 wholesale per review. You handle the authorization letter, the client's token, and the client call. We run the review and deliver the report.
Scope per review: 1 Cloudflare account, 5 zones, 10 public hosts, 10 Workers, 2 AI Gateways, and 1 mail tenant. Larger accounts are quoted separately.
workers.dev, which bypasses Access and WAF.We don't check SSL "Full" versus "Full (strict)" yet. R2, D1, and Zero Trust Gateway policies are not covered yet.
Next step: Talk to Ed about a partner setup.
Security Insights is useful, and it comes with every Cloudflare plan, even Free. It does not include an analyst-led report or help with fixes. On one account we tested, it showed 6 suggestions. Our review found 30 items, and 22 of those were not in Security Insights. That was one account, so yours will differ. Our report also notes whether Security Insights shows each item.
You can keep running it. On our test account, one popular free scanner matched us on basic zone settings. It also flags SSL "Full" versus "Full (strict)," which we don't check yet. Neither free scanner found our API token, Worker secret, or AI spend limit issues on that account. Our review covers that account layer. A person also checks each finding before it reaches you.
The token is read-only, so it cannot change anything. You create it yourself, with a 7-day expiry and an IP limit if possible. You can revoke it at any time. We never ask for a token that can make changes. We also sign a scope and authorization letter before we start.
No. It is a configuration review. We do not attack your apps, run scans, or try to log in.
They are light. We run public DNS lookups, a few TLS handshakes, and one web request per proxied host. That is about the same as a browser visiting your homepage.
Only if you want us to. With the fixes add-on, you approve each change in writing. We walk your team through each fix on a live screen-share, with step-by-step instructions. We never need write access. Each change has an undo step and a check afterward. You can also make the fixes yourself using the report.
Our email checks cover Microsoft 365, Google, Zoho, and Proton. Some Microsoft 365 records are unproxied on purpose. We list those apart so they don't count as problems.
No. "Works with Cloudflare" describes the platform we review. Secure Data Solutions is not affiliated with or endorsed by Cloudflare, Inc.
Eddie Espino is the founder of Secure Data Solutions, based in West Palm Beach, Florida. He has more than 20 years of experience in firewall, network security, and penetration testing work.
Secure Data Solutions does hands-on security work for small and mid-size businesses. We also work with the MSPs that serve them. We work read-only by default and explain what we find in plain English. Nothing changes without your written OK.
Email Ed to get started. We will send you the authorization letter and the token steps.