Cloudflare

Last updated: Nov 3, 2026

---

Rationale

Cloudflare is the SaaS provider of Fluid Attacks for some infrastructure solutions, for example, DNSSEC, DDoS Protection, Rate limiting, Auto-Renewable SSL certificates, Content delivery network, Web Application Firewall, Anti-bot capabilities, and Zero Trust Network Access.

These are the primary reasons why Fluid Attacks selected it and not other alternatives:

• It is very easy to make network and security solutions, because all its components connect without problems.
• You can fully manage it with Terraform.
• It gives very detailed analytics about site traffic, for performance and for security.
• It has the fastest privacy-focused DNS service in the market.
• It supports DNSSEC.
• It has SSL certificates that are easy to implement, and that renew and validate automatically.
• It gives a Web Application Firewall with preconfigured rules, DDoS mitigation, rate limiting, anti-bot capabilities, and more.
• It has a CDN with special routing protocols, HTTP/3 support, Customizable cache TTL, and datacenters all over the world. The cache is configured automatically, and you can change it if you change its default settings.
• It gives Workers, a serverless approach to develop applications. Fluid Attacks uses it to serve MTA-STS policies, to redirect some URLs, and to set the security headers of some sites.
• It has Page rules that make it easy to implement HTTP redirections, cache rules, and encryption rules, and more.
• It gives Zero Trust features. These features are necessary for the Connector and Egress access mechanisms of Fluid Attacks. With them, the Fluid Attacks talent can also go on the Internet safely with Cloudflare WARP.
• It is the first hop in front of each public HTTPS endpoint at *.fluidattacks.com. It is in front of Amazon CloudFront, which is the origin-side CDN. Read Public hosting.
• It supports Authenticated Origin Pulls. With this function, Cloudflare gives a client certificate for each zone to the origin on each connection. Fluid Attacks uses this function to prove cryptographically that the traffic came from its own Cloudflare zone (not from a different Cloudflare tenant or a CF Worker). The trust stores that do this check are on the integrates ALB and on the CloudFront distributions. This replaces the fragile model of allowlisting the published IP ranges of Cloudflare.

Alternatives

Fluid Attacks examined these alternatives, but it did not select them for these reasons:

• Akamai: A smaller number of persons use it. Thus, it has less community support. It is much more expensive, and its services seem harder to set up than the services of Cloudflare.
• AWS Certificate Manager: To make digital certificates, Fluid Attacks also had to manage DNS validation records.
• AWS CloudFront: It was very slow to make distributions. It was necessary to connect them to an S3 bucket and maintain this connection. A Lambda was necessary to support access to URLs without index.html at the end. In general, it was necessary to do too much work to make things operate.
• AWS Route53: This service does not support DNSSEC. It is not as fast or as flexible as the DNS of Cloudflare.
• AWS Web Application Firewall: You must connect it to a load balancer that serves an application. It does not operate for static sites. It is not as flexible as the Web Application Firewall of Cloudflare.
• Tailscale: It is only a ZTNA solution, but Cloudflare does many other things (DDoS mitigation, rate limiting, anti-bot, DNS, and more). It did not support Egress IPs. These IPs are necessary for the Egress access mechanism. They are also necessary for the platform of Fluid Attacks to show ZTNA navigation logs. It does not give a client to go on the Internet safely.
• NoPorts: It is only a ZTNA solution, but Cloudflare does many other things (DDoS mitigation, rate limiting, anti-bot, DNS, and more). Its installation process was much harder. It did not support Egress IPs. These IPs are necessary for the Egress access mechanism. It did not support navigation logging. This logging is necessary for the platform of Fluid Attacks to show ZTNA navigation logs. In general, it seems to be a very basic solution to make SSH, SFTP, or RDP connections to personal devices through the Internet. It does not give a client to go on the Internet safely.
• ZeroTier: It is only a ZTNA solution, but Cloudflare does many other things (DDoS mitigation, rate limiting, anti-bot, DNS, and more). It did not support Egress IPs. These IPs are necessary for the Egress access mechanism. It did not support navigation logging. This logging is necessary for the platform of Fluid Attacks to show ZTNA navigation logs. In general, it seems to be a very basic solution to make SSH, SFTP, or RDP connections to personal devices through the Internet. It does not give a client to go on the Internet safely.
• Genians: It is only a ZTNA solution, but Cloudflare does many other things (DDoS mitigation, rate limiting, anti-bot, DNS, and more). It did not support Egress IPs. These IPs are necessary for the Egress access mechanism. It did not support navigation logging. This logging is necessary for the platform of Fluid Attacks to show ZTNA navigation logs. It is for on-premise architectures, and it uses servers or virtual machines that only manage the ZTNA network. This increases complexity and adds a single point of failure. Its documentation is much harder to understand than the documentation of other alternatives. Its implementation is much harder than the implementation of other alternatives. It does not give a client to go on the Internet safely.

Usage

Fluid Attacks uses Cloudflare for these tasks:

• Overall network configurations
• DNS Records
• HTTP Redirections
• Managing security headers
• Managing digital certificates
• Managing rate limiting
• Managing CDN Cache
• Hosting the .com and .io TLDs that it supports, with Cloudflare Registrar
• Access of Fluid Attacks to the applications that its clients own, through the Connector or Egress access mechanisms (the Connector uses Cloudflare Tunnel)
• Safe Internet navigation for Fluid Attacks employees with Cloudflare WARP

Fluid Attacks does not use these Cloudflare services:

• Railgun: It supports only apt and yum.
• Domain hosting for .co and .la, because Cloudflare does not support these TLDs. For these domains, Fluid Attacks uses GoDaddy.