Cloudflare Connector.

Cloudflare sits in front of a site for caching and security. Protuno uses a token you scope yourself to read it, and changes things only when you allow it.

Hosting and CDNDocumented by CloudflareConnectable
  • API token
Run Free AuditOpen Cloudflare (opens in a new tab)

No install needed for the audit. We suggest connecting a staging copy of your site first, before your live site.

Protuno connects to Cloudflare. 5 reads, 2 writes.
5 on its own · 2 ask first

Permissions.

Reads can run on their own. Writes ask you first by default.

Reads

5 reads

Zones, traffic and cache stats, firewall events, certificate and zone settings.

  • Read zones
  • Read traffic and cache stats
  • Read firewall events
  • Read the edge certificate
  • + 1 more
Writes

2 writes

Purge cache or change the security level. Both ask first.

  • Purge cache
  • Change the security level
All 7 capabilities

Showing 7 of 7 capabilities

Read

  • Read zonescloudflare.zone.read

    Lists the zones the token can see and reads each zone's status.

    Needs: Zone Read

    On its own

  • Read traffic and cache statscloudflare.analytics.read

    Reads a zone's traffic and cache statistics.

    Needs: Analytics Read

    On its own

  • Read firewall eventscloudflare.firewall_events.read

    Reads the firewall events recorded for a zone. It cannot change any firewall rule.

    Needs: Firewall Services Read

    On its own

  • Read the edge certificatecloudflare.ssl.read

    Reads a zone's edge certificate and SSL/TLS status.

    Needs: SSL and Certificates Read

    On its own

  • Read zone settingscloudflare.zone_settings.read

    Reads a zone's settings, such as its security level and SSL/TLS mode.

    Needs: Zone Settings Read

    On its own

Write

  • Purge cachecloudflare.cache.purge

    Purges cached content for a zone, by URL, by tag or everything.

    Undo: There is no true undo. Nothing is stored to roll back, and cache entries regenerate on the next request to the purged URL.

    Needs: Cache Purge

    Ask first

  • Change the security levelcloudflare.security_level.write

    Changes a zone's security level, for example to Under Attack mode.

    Undo: Set the level back to the value it had before.

    Needs: Zone Settings Edit

    Ask first
What It Does

What Protuno Does With Cloudflare.

Protuno reads the zones your token can see, along with their traffic, firewall events, certificate and settings, to spot drift or mistakes. Reads run on their own and writes ask you first by default.

Zones and settings read

Reads zone status and zone settings for the zones your token can see.

Reads

Traffic and firewall read

Reads traffic and cache statistics and the firewall events recorded for a zone.

Reads

Certificate read

Checks the edge certificate and SSL/TLS status for a zone.

Reads

Purge cache

Purges cached content for a zone when stale content is flagged. The cache refills on the next request, and there is no stored-state rollback.

Ask first

Change the security level

Changes a zone's security level, for example to Under Attack mode. Protuno can set it back to the value it had before.

Ask first

Playbooks 3 planned

Protuno's docs plan these playbooks to use it.

  • Uptime CheckerPlanned

  • WP HardeningPlanned

  • WP Malware ScanPlanned

Set Up · 5 steps

You See The Full List Before Anything Is Granted.

How it connects: you create a limited API token in Cloudflare and paste it into Protuno. It carries only the permissions you choose. A user token starts cfut_, and an account token starts cfat_. Cloudflare says an account token only works with the endpoints that support it. It is never your account's Global API Key.

  1. Step 1

    Create a scoped API token in Cloudflare

    In Cloudflare, go to My Profile > API Tokens > Create Token and build a custom token.

    Add the Zone Read, Analytics Read, Firewall Services Read, SSL and Certificates Read and Zone Settings Read permissions. Add Cache Purge to purge cache, and Zone Settings Edit to change the security level. Under Zone Resources, include the zones Protuno should see. Never use your Global API Key.

    you see: A token summary listing the permissions you added and the zones they cover, then a one-time secret to copy.

  2. Step 2

    Paste the token into Protuno

    Paste the token.

    Protuno asks Cloudflare to verify that it is active.

    you see: A spinner, then a confirmation that the token is valid.

  3. Step 3

    See what it can do

    Protuno reads the token's permission groups and shows reads on the left and the writes it allows on the right.

    you see: Reads on the left: zones, traffic and cache stats, firewall events, the edge certificate and zone settings.

  4. Step 4

    Choose what runs

    Reads run on their own.

    Writes ask you first by default, so purge cache and the security level change each wait for your yes.

    you see: A row for each capability, with reads running and writes set to ask first.

  5. Step 5

    Confirm what you grant

    Confirm    Protuno states the grant as one plain sentence for you to agree to.

    you see: A plain sentence and a confirm button.

Before You Connect It

Questions.

What Cloudflare plan do I need for API access?

Creating and using a scoped API token is available on every plan, including Free. Which permission groups are useful depends on which Cloudflare features the zone's plan has enabled.

What are the exact rate limits?

Cloudflare's API limits page gives 1,200 requests per 5 minutes per user or account token, and 200 requests per second per IP. Specific endpoints like cache purge publish their own separate limits.

What can't Protuno do in Cloudflare?

It cannot delete a zone, change nameservers, edit firewall or WAF rules, or manage API tokens. Its only changes are purging the cache and setting the security level, and both ask you first by default.

How fresh is the data?

Reads reflect Cloudflare's current configuration at call time. A cache purge is accepted almost immediately, but full propagation across edge locations can take a short time.

A write failed. Why?

A 403 on a specific action usually means the token's permission groups or Zone Resources scope does not include that capability or that zone. Recreate or edit the token to add it.

How do I revoke access?

In Cloudflare, go to My Profile > API Tokens and roll or delete the token. For an account token, go to Manage Account > API Tokens. Disconnecting in Protuno does not revoke the key at Cloudflare. Delete it there to cut access for good.

Capability names and default settings (on its own or ask first) are Protuno's own, and they can change as the product develops. Playbook plan, schedule and date come from Protuno's agent pages. Protuno last confirmed this connector's build status on 13 Oct 2026. Vendor limits and permissions on this page follow the vendor's public documentation as reviewed on 13 Oct 2026. The vendor's own page is the final word.

Free Site Audit

Do You Use Cloudflare?

The free audit looks at the site from the outside. Connect tools afterwards, one capability at a time.

We suggest connecting a staging copy of your site first, before your live site.

85 Site ChecksNo Credit Card100% Free