How to secure your Cloudflare install (or other WAF)

If you’re even tangentially responsible for running a server on the Internet, you’ll probably have heard the advice to put that server behind Cloudflare (or another web application firewall—other vendors exist like Fastly or Bunny). You’ll almost definitely have heard that advice in the last week 😅 If you’re setting up Cloudflare, or someone else set it up, or you set it up a long time ago when you were less knowledgeable (hint: that’s me) then make sure you verify that all traffic hitting your origin server is actually coming through your CDN/WAF provider. If you don’t do this, it’s trivial for an attacker to simply route around your firewall. Podia—like every server on the Internet—has been attacked by bots, scanners, scripts, DDoS attacks etc just about every hour for the past few years and Cloudflare has done a good job protecting us. But it turns out that past-me was dumb: I just pointed our DNS records to podia.herokuapp.com, turned on the orange cloud, and configured our WAF…