FindIP Shield for Cloudflare

• A free FindIP account and a Shield site for the domain.
• A Cloudflare zone on any plan (Free included).
• The hostname you want to protect must be proxied through Cloudflare (orange cloud). A Worker can only run on proxied hostnames; the wizard greys out unproxied ones.
• No existing Worker route may already cover that hostname. Shield checks before installing and refuses if anything overlaps, rather than risk interfering with your setup.
• Workers capacity on your Cloudflare plan. On the Free plan, Workers requests are capped at 100,000 per day shared across all your Workers, so size the hostname's traffic accordingly.
• Someone with permission to authorize OAuth apps for the Cloudflare account (Super Administrator or Administrator). If your account administrator has turned off Public OAuth App access, see Troubleshooting.

1. Sign in at findip.net/shield and open the Shield site for your domain (or create one).
2. In the site's sidebar, open Cloudflare and click Connect Cloudflare.
3. A Cloudflare consent window opens. It shows FindIP as a domain-verified publisher (findip.net) and lists exactly four permission groups (see Permissions). Choose the Cloudflare account that owns the zone and click Authorize.
4. The window closes itself and the Shield page updates to connected.

If you click Cancel on the consent screen, nothing is connected and no access is granted. Shield shows a declined notice with a retry button; no state is left behind on either side.

1. Pick your domain. Shield lists the zones the authorization can see.
2. Pick the exact address to protect. Shield lists the hostnames on that zone. Only proxied hostnames can be selected. Start with one non-critical hostname rather than the apex on day one.
3. Review. The review screen states exactly what will happen: the Worker name prefix, the single route <hostname>/* (created last), the starting mode (Monitor), the metadata-only data line, the fail-open guarantee, and a warning listing any existing Worker routes on that hostname. Nothing is changed until you click Activate.

If another Worker route already covers the hostname, Shield refuses with a route conflict before touching anything. Remove or narrow that route in your Cloudflare dashboard (Workers Routes), or choose a different hostname, then retry. If the conflicting route belongs to another Shield site of yours, remove it from that site first.

Activate

Activation deploys the Worker, then creates the route. Within about a minute the management view shows the deployed route, script, and build, and edge activity starts to appear. Activation is safe to retry; a retry resumes the same operation rather than creating duplicates.

Monitor mode (default)

Monitor never blocks anyone. "Observe and report every visitor. Never blocks. The dashboard shows what balanced mode would have blocked."

The Activity tab shows every screened visit with its outcome (allow, monitor, or block), the visitor IP, path, and the policy reason. A Balanced preview shows how many of the last days' visits Balanced mode would have blocked, so you can judge the policy on your real traffic before arming anything. We recommend at least a week in Monitor mode before deciding.

Balanced mode (explicit opt-in)

Balanced blocks high-confidence bad traffic at the edge and lets everything else pass. "Block high-confidence threats at the edge: known-malicious IPs, Tor exits, scanners, and risk scores of 80+. Everything else passes."

Turning it on requires an explicit confirmation. Turning it off is one click and takes effect within about a minute. A blocked visitor receives a plain 403 response; that is the only response Shield can ever author.

Balanced never blocks without intelligence. If the FindIP lookup is unavailable or slow, the decision is monitor, never block.

Every site has one policy, edited in the Access rules section of the Cloudflare page. Each saved change increments the policy version and edge caches converge within about a minute.

Setting	What it does	Limit
Always-allow list	IPs or CIDRs that are never blocked, in any mode. Wins over everything else.	200 entries
Blocklist	IPs or CIDRs blocked in every mode, including Monitor. This is your explicit instruction, not Shield's judgment.	200 entries
Verified bots	Allows published search and service crawler ranges before any risk evaluation. On by default.	on/off
Path rules	Override the site mode by path prefix, longest match wins. Example: Balanced on /login and /signup only, Monitor everywhere else. A path rule can apply a plain mode or a named custom rule.	50 rules
Sensitivity	How aggressive Balanced blocking is: lenient, balanced, or strict thresholds.	preset
Networks to block	Which categories block in Balanced mode: Tor, VPN, proxy, hosting. Known-malicious addresses and scanners always block.	per category
Country block	Visitors from listed countries are blocked in every mode.	100 countries
Country allow-only	When set, only visitors from listed countries may enter; everyone else is blocked in every mode. Verified bots and the always-allow list still win.	100 countries
AI crawlers	Verified AI crawlers (GPTBot, ChatGPT-User, PerplexityBot, and others) can be allowed (never blocked), treated like any other visitor (risk), or blocked in every mode. Independent of search-engine crawlers.	one choice
Custom access rules	Named, reusable bundles that override mode, sensitivity, categories, countries, AI-crawler policy, and add path-scoped blocklist entries. Attach them to paths with path rules.	20 rules

Dual-stack note: many visitors reach Cloudflare over IPv6. A list holding only an IPv4 address will not match that visitor's IPv6 visits. Add both, or the IPv6 /64.

IP-rotation defense

Shield watches for storms of brand-new IP addresses hitting the same paths, the pattern of credential stuffing and scraping through rotating proxies. When it finds one, live or within the past 24 hours, the Cloudflare page shows a banner with the networks involved and two one-click remedies:

• Block the subnets: review the networks, then add them to the blocklist.
• Protect the path: attach a rotation-defense rule (Balanced, strict sensitivity, all categories) to the targeted path only, leaving every other path untouched.

Both remedies are ordinary policy changes: editable and reversible in Access rules afterwards.

Action	Effect
Pause	Shield stops making decisions; every visitor is allowed. Takes effect within about a minute. Nothing changes in your Cloudflare account, so pause cannot fail at Cloudflare.
Resume	Decisions resume under the current mode and policy.
Update Worker	Deploys the newest Shield Worker build. The route is untouched.
Roll back	Returns to the previous Worker build, verified at the edge.
Check & repair	Compares Shield's records with your account's live inventory and repairs any interrupted operation. Safe to run at any time.
Remove	Deletes the route, then the Worker. Your hostname's previous behavior is restored and verified externally.
Disconnect	After removal, revokes FindIP's access token at Cloudflare. Your dashboard history stays.

You can always remove Shield yourself, without FindIP: in your Cloudflare dashboard, delete the <hostname>/* route under Workers Routes, then delete the findip-shield-… Worker. Route first. This works even if all of FindIP is down. You can also revoke FindIP's authorization at any time from your Cloudflare profile under Manage OAuth authorizations.

The Worker is built to fail open: no FindIP failure can deny service to your origin. Enforcement is best effort by explicit policy; availability is guaranteed by construction. Blocking in Balanced mode is a risk-reduction layer, not a security boundary.

Failure	Monitor mode	Balanced mode
Risk lookup exceeds the 750 ms deadline	Forward	Forward (fail open)
FindIP returns an error or is unreachable	Forward	Forward (fail open)
Invalid or unexpected response	Forward	Forward (fail open)
Worker credential invalid (for example during an upgrade)	Forward	Forward (fail open)
Per-site rate limit reached	Forward	Forward (fail open)
Circuit breaker open (3 consecutive failures → 30 s)	Forward, no lookup attempted	Forward, no lookup attempted
FindIP intelligence unavailable or slow	Decision is monitor	Decision is monitor, never block
No stable visitor IP	monitor, cache bypassed	monitor
Telemetry outage	No effect on traffic	No effect on traffic
Worker exception	Plain forwarding	Plain forwarding
Your origin is down	Your origin's own error is shown	Same

Decisions are cached at the Cloudflare edge for 30 seconds (block) or 60 seconds (allow and monitor). Requests with a cached decision add effectively nothing to response time; an uncached lookup adds up to the deadline on that one request.

The consent screen requests exactly these, all as required scopes so a partial grant can never create a half-authorized integration:

Permission	Used for
Zone — read	Listing your zones so you can pick one
DNS — read	Finding the hostnames on that zone and confirming yours is proxied
Workers Scripts — write	Deploying and removing the one Shield Worker
Workers Routes — write	Creating and removing the one route. Cloudflare requires this scope even to read routes, which Shield does for the conflict check
Offline access	A refresh token so the connection survives without re-authorizing

There are no optional extras and no account-level write permissions. FindIP will never ask you for an API token or Global API Key; if anyone claiming to be FindIP does, it is not us. Shield only ever modifies resources it created itself, recognizable by the findip-shield- prefix.

Per visitor request, the Worker sends FindIP only:

• visitor IP address (from Cloudflare's CF-Connecting-IP header)
• hostname
• URL path, with the query string removed
• HTTP method

That is the complete list. The Worker never reads request bodies, cookies, Authorization headers, or query strings, and never adds anything to the request that reaches your origin. Responses from your origin pass through untouched, including streaming, WebSocket, and range responses.

The Worker also reports aggregate operating counters (request counts, cache hits, error counts) so both you and FindIP can see integration health. Counters only, nothing per visitor. Edge decision caches use a pseudonymized (secret-hashed) key; raw IPs are never used as cache keys.

Your Cloudflare refresh token is encrypted at rest and stored in a database that is isolated from FindIP's internet-facing event ingest. Per-visitor decision records in your dashboard follow your site's event retention window (30 days by default); aggregate counters follow your site's aggregate retention window. Deleting the site removes all Worker-related records and credentials.

Symptom	Check
The consent screen says the app is not allowed, or authorization fails immediately	An account administrator has turned off Public OAuth App access (Cloudflare dashboard → Manage Account → Members → Settings). Ask them to enable it, then connect again. There is no token-based workaround, by design.
Hostname is greyed out in the wizard	It is not proxied. Turn on the orange cloud for that DNS record in Cloudflare, wait a minute, then reload the wizard.
"Route conflict" when activating	Another Worker route covers the hostname. Remove or narrow it under Workers Routes, or pick another hostname. If it is Shield's own route from another of your sites, remove it there first.
No activity after activation	Send a request to the hostname yourself and wait a minute. Confirm the route exists under Workers Routes and that traffic actually reaches that hostname (not a different subdomain).
A visitor I allow-listed is still flagged	Check the Recent decisions table for their actual IP; dual-stack visitors often arrive over IPv6. Add both addresses.
Provision, cleanup, or upgrade fails with an authorization error	The authorization was revoked from the Cloudflare side. Reconnect (fresh consent), then retry. The deployed Worker keeps failing open in the meantime.
An operation looks stuck	Run Check & repair on the maintenance tab.
Cloudflare reports Workers quota exceeded	Your plan's Workers request cap was reached. Pause Shield or remove it from a high-traffic hostname, or upgrade the Cloudflare plan.
"Get it off my site right now"	Pause (instant), then Remove. Without FindIP: delete the route, then the Worker, in your Cloudflare dashboard.

Email [email protected] with the hostname, a timestamp window with timezone, what visitors saw, and whether the issue persists while Shield is paused. We aim to respond within two business days. Never send API keys or tokens; Shield has no use for them. Security reports: [email protected].

FindIP Shield for Cloudflare is free. Your Cloudflare plan's own Workers limits still apply. Shield's risk output consists of informational signals; decisions you take based on them, including turning on Balanced mode, are yours. Free Shield sites are governed by the Shield Free Preview Terms in addition to the FindIP Terms of Service.