Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use these 12 authenticated Cloudflare API GET requests to inspect a zone’s operational state, TLS settings, security rules, DNSSEC, origin authentication, and client-side security without changing configuration. The responses show configured values at the time of the request; they are not a penetration test or proof that every request receives the intended protection.
Prepare a narrowly scoped read-only token
Set ZONE_ID to the zone’s ID and CLOUDFLARE_API_TOKEN to a token restricted to that zone and the read permissions needed for the checks you plan to run. Cloudflare separates read and edit permissions across products; do not grant write access just to make these GET requests. Check the current permission picker for the exact read permissions accepted by each endpoint, especially where product permission names have changed.
As an Amazon Associate I earn from qualifying purchases.
export ZONE_ID='your-zone-id'
export CLOUDFLARE_API_TOKEN='your-read-only-token'These examples use Cloudflare’s documented bearer-token header format. Do not put a live token in a shared transcript or publish it; shell history can also retain commands containing secrets. If a request returns a permission error, investigate token scope and endpoint availability. That error does not show that a control is disabled.
Free tools Windows power users keep installed
One-click scans. No signup required.
Cloudflare documents separate GET and PATCH operations for zone settings. The commands below use GET only and are inspection templates, not requests run against a live zone.
#1 Best Overall
Check zone state before judging its protections
1. Zone status and paused state
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Inspect result.status and result.paused. Cloudflare notes that a paused zone receives no Cloudflare security or performance benefits. An active status by itself does not prove that every hostname is proxied or that traffic is routed as intended.
Inspect visitor-facing and origin TLS settings
2. SSL/TLS encryption mode
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/ssl"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Read the returned value. The mode describes how Cloudflare connects to the origin, not a single end-to-end security score. Flexible can leave the edge-to-origin connection unencrypted. Full encrypts that connection when the visitor uses HTTPS, but does not validate the origin certificate. Full (strict) requires a valid origin certificate. Cloudflare describes Flexible as common for origins that do not support TLS, while recommending an origin upgrade whenever possible. Confirm the origin’s actual TLS configuration before changing modes.
3. Minimum TLS version
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/hostnames/settings/min_tls_version"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Inspect the returned TLS value and deployment status. Documented values include TLS 1.0, 1.1, 1.2, and 1.3. Raising the minimum can exclude older clients, so choose a protocol floor that fits your compatibility requirements rather than treating one value as universally correct.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. TLS 1.3 setting
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/tls_1_3"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Record value and, when present, editable and modified_on. Documented values include on, off, and zrt. A configured value does not establish that every client negotiated TLS 1.3.
5. HSTS configuration
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/security_header"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Review the strict_transport_security object, including enabled, max_age, include_subdomains, preload, and nosniff. Enabling HSTS for subdomains or using preload has consequences across the affected scope; first confirm that HTTPS is ready throughout it. The response does not verify deployment on every application endpoint.
6. TLS cipher configuration
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/hostnames/settings/ciphers"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Inspect the configured ciphers and deployment status. This is a hostname TLS setting; verify the endpoint’s accepted permission and response shape for your account. Do not infer an ideal cipher list without considering current Cloudflare guidance and client compatibility.
Review edge security controls
7. Security level
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/security_level"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Record the returned profile value. Cloudflare documents a range from off through under_attack; the selected profile adjusts security settings. The appropriate setting depends on the site’s audience, traffic, and operational needs, so under_attack is not a default target.
Recommended Free Tools
8. WAF rulesets
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Inspect listed rulesets and phases, especially HTTP request firewall managed rules. A listed ruleset alone does not prove effective coverage: examine its phase, rule contents, enabled state, and deployment context. Cloudflare labels the older waf zone setting as a previous or deprecated setting, so it is not a substitute for reviewing current rulesets.
Check DNS and origin authentication
9. DNSSEC status
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dnssec"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Read the DNSSEC response fields, including DS or digest details and DNSSEC options, in light of the zone’s setup. Cloudflare documents DNS Read among the accepted permissions. This response alone does not establish end-to-end DNSSEC validity; validate that the parent-side delegation and DS record are correct using an appropriate DNS validation method.
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
10. Authenticated Origin Pulls
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/origin_tls_client_auth/settings"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"This endpoint reports whether zone-level Authenticated Origin Pulls is enabled. Cloudflare documents the setting as false by default and lists SSL and Certificates Read as accepted permissions. Interpret the result against origin exposure and certificate configuration; it is not a universal pass/fail test.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Review browser-side security visibility
11. Client-side security status
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/page_shield"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Current Cloudflare documentation calls this feature Client-side security; it was previously named Page Shield. The GET example returns enablement status. Use a read permission from the live permission picker, since permission names in documentation may use legacy or current terminology.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems12. Detected client-side scripts
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/page_shield/scripts?hosts=example.com&page=1&per_page=15"
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Replace example.com with a hostname in your zone. Cloudflare documents this endpoint for listing detected scripts; without a status filter, the results include active-status scripts by default. Treat the result as what the feature detected, not a complete inventory of browser code across every page and user flow.
Interpret the checklist as distinct controls, not a score
When comparing zones or reviewing a change, keep these dimensions separate:
- Encryption on the visitor-to-edge and edge-to-origin connections.
- TLS protocol minimum and configured ciphers.
- WAF ruleset phases, rules, enabled state, and deployment context.
- DNSSEC delegation and origin authentication.
- Client-side script visibility and feature availability.
- Token permissions and account or plan availability.
A successful configuration response is a point-in-time view. It does not establish runtime TLS negotiation, complete ruleset coverage, or protection of every traffic path. Some settings are plan-dependent: a setting may be readable even when the zone cannot edit it, so check account-level availability before planning a change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
