Security settings

This page describes the security settings available in the new security dashboard for a given domain.

To access security settings in the new security dashboard, go to the Settings page.

Security settings and detection tools are categorized by the type of threat that they detect and mitigate.

In the Web application exploits security category you can manage the following settings:

• Detection tools:
  • Leaked credentials detection
  • Malicious uploads detection
  • Sensitive data detection
  • Cloudflare managed ruleset
  • OWASP Core ruleset
  • AI Security for Apps
• Under Attack mode in Security Level
• Managed security.txt

Refer to each linked page for details.

The DDoS attacks security category shows the multiple mitigation services against DDoS attacks provided by Cloudflare.

You can create rules to override DDoS attack protection tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription.

To learn more about DDoS protection overrides, refer to the following resources:

• HTTP DDoS attack protection overrides
• Network-layer DDoS attack protection overrides

Additionally, you can manage the following settings:

• Block AI Bots
• Bot Management (depending on your Enterprise subscriptions)
• Browser Integrity Check
• Challenge Passage
• Cloudflare managed ruleset
• AI Security for Apps
• Schema learning
• Schema validation (requires an uploaded schema)
• Under Attack mode (under Security Level)
• SSL/TLS DDoS attack protection

In the Bot traffic security category you can manage the following settings:

• AI Labyrinth
• Block AI Bots
• Bot fight mode (depending on your Cloudflare plan)
• Super Bot fight mode (depending on your Cloudflare plan)
• Bot Management (depending on your Enterprise subscriptions)
• AI bot traffic management with robots.txt
• API sequence detection (requires you to configure a session identifier)

In the API abuse security category you can manage the following settings:

• Developer portal creation
• Web asset discovery (always enabled if included in your Enterprise subscriptions. For Enterprise subscriptions, API endpoint discovery is also included, which requires you to configure a session identifier)
• Endpoint labels
• JWT validation (requires you to add a JWT configuration)

In the Client-side abuse security category you can manage the following settings:

• Continuous script monitoring:
  • Reporting endpoint to use your hostname instead of a Cloudflare-owned endpoint (only for Enterprise customers with a paid add-on)
  • Data logged in client-side abuse reports (only the hostname or the full URI)
• Email Address Obfuscation
• Hotlink Protection

The following table links to additional information about each available setting: