Visitor arrives
The request reaches Cloudflare's edge for your proxied hostname.
FindIP Shield for Cloudflare · New · Free
Protect your Cloudflare site at the edge. No code, nothing to maintain.
Authorize FindIP Shield with your Cloudflare account, pick one hostname, and watch VPN, proxy, Tor, hosting and malicious traffic in watch-only mode. Block only what you choose, only where you choose. If FindIP is ever down, your traffic flows as if Shield were not there.
- Deploys in under a minute
- No API tokens, no DNS changes
- Starts in watch-only mode
- One click to undo
1
Connect CloudflareStandard OAuth consent. Domain-verified publisher, four permissions.
Authorized2
Pick the exact address to protectexample.com · proxied · no route conflicts
Ready3
Watch every visit at the edgeAllow · monitor · would-block, with the reason for each.
Monitor mode
Exactly what gets installed
Two things in your Cloudflare account. Both visible at all times.
FindIP Shield for Cloudflare installs one Worker and one route binding it to the hostname you picked. Traffic to any other hostname in your zone is never touched. Before installing, Shield inspects your existing Worker routes and refuses to install if anything already covers that hostname, rather than risk interfering with your setup.
The route is always created last and deleted first, so there is never a half-installed state affecting traffic. Removal is one click and deletes the route, then the Worker. You can also delete both yourself in your Cloudflare dashboard, even if FindIP is unreachable.
Your Cloudflare accountZone: example.com
findip-shield-a1b2c3Worker · one script, prefixed so you always recognize it
www.example.com/*Worker route · only the hostname you chose
Nothing else. No DNS changes, no WAF rules, no page rules, no account-level settings.
How a request moves through Shield
The Worker stays deliberately small. It asks FindIP how risky the visitor's IP is, applies the answer, and forwards the request. Decisions are cached at the edge so repeat visitors cost nothing.
Shield Worker
Reads the visitor IP, hostname, path and method. Nothing else.
Cached or decided
A cached decision is used instantly; otherwise FindIP answers within a hard 750 ms deadline.
Allow, monitor, or block
Monitor mode records. Balanced mode blocks only high-confidence bad traffic with a plain 403.
Fails open
If FindIP is slow, wrong or down, the request is forwarded to your origin unchanged.
Watch first. Then decide.
Every site starts in Monitor mode. The dashboard shows what Balanced mode would have blocked on your real traffic, so you judge the policy before arming anything.
Monitor
Observe and report every visitor. Never blocks. The dashboard shows what Balanced mode would have blocked, with the reason for each decision.
Nothing is ever blocked in Monitor mode. Not even known-malicious traffic, unless you add it to your own blocklist.
Balanced
Block high-confidence threats at the edge: known-malicious IPs, Tor exits, scanners, and risk scores of 80 and above. Everything else passes. Turning it on requires a confirmation; turning it off is one click.
Balanced never blocks without intelligence. If the FindIP lookup is unavailable, the decision is monitor, never block.
Access rules you actually control
Fine-tune what blocks, where it blocks, and who is always welcome. Every change converges at the edge within about a minute and is reversible.
Path rules
Balanced on /login and /checkout only, Monitor everywhere else. Longest prefix wins.
Networks and sensitivity
Choose which categories block in Balanced mode: Tor, VPN, proxy, hosting. Pick a lenient, balanced or strict threshold.
Country fence
Block listed countries, or allow only listed countries, in every mode. Verified bots and your allow list still win.
AI crawlers
Welcome verified AI crawlers, treat them like anyone else, or turn them away, site-wide or per path, independently of search engines.
Allow and block lists
IPs and CIDRs that are always welcome, or blocked in every mode. Your explicit instruction, not Shield's judgment.
Rotation defense
Shield spots storms of rotating IP addresses on the same paths and offers one-click remedies: block the subnets, or protect the path.
Built to fail open
No FindIP failure can deny service to your origin. Enforcement is best effort by policy; availability is guaranteed by construction. Blocking is a risk-reduction layer, not a security boundary, and we say so.
| If this happens | Monitor mode | Balanced mode |
|---|---|---|
| Risk lookup exceeds the deadline | Forward | Forward (fail open) |
| FindIP returns an error or is unreachable | Forward | Forward (fail open) |
| Circuit breaker open after repeated failures | Forward, no lookup attempted | Forward, no lookup attempted |
| FindIP intelligence unavailable or slow | Monitor | Monitor, never block |
| Worker exception | Plain forwarding | Plain forwarding |
750 msHard deadline for a risk decision. Past it, the request is forwarded.
3 → 30 sThree consecutive failures open the circuit breaker for 30 seconds.
≈ 60 sEvery pause, mode flip or policy change converges at the edge.
Permissions and data, in full
The consent screen shows FindIP as a domain-verified publisher and asks for exactly four permission groups. We never ask for an API token or Global API Key.
What the consent screen requests
| Permission | Used for |
|---|---|
| Zone · read | Listing your zones so you can pick one |
| DNS · read | Finding the hostnames on that zone and confirming yours is proxied |
| Workers Scripts · write | Deploying and removing the one Shield Worker |
| Workers Routes · write | Creating and removing the one route. Cloudflare requires this scope even to read routes for the conflict check |
Plus offline access so the connection survives without re-authorizing. You can revoke it any time from your Cloudflare profile.
What the Worker sends to FindIP, per visit
- visitor IP address
- hostname
- URL path (query string removed)
- HTTP method
That is the complete list. The Worker never reads request bodies, cookies, authorization headers or query strings. Responses from your origin pass through untouched. Raw IPs are never used as cache keys.
Requirements
Any Cloudflare plan works, including Free.
A proxied hostname
The hostname must be orange-cloud proxied through Cloudflare. A Worker can only run on proxied hostnames, so the wizard greys out the rest.
Workers capacity
Worker requests count against your Cloudflare plan's Workers quota (100,000 per day on Free, shared across your Workers). Size the hostname's traffic accordingly.
Someone who can authorize
A Super Administrator or Administrator on the Cloudflare account. If an administrator has turned off Public OAuth App access, they need to enable it first.
Questions before authorizing
Everything below describes the deployed integration as it behaves today.
What does FindIP Shield install in my Cloudflare account?
Exactly two things: one Worker named with the findip-shield- prefix and one route binding it to the hostname you chose. Nothing else in your zone is touched, and both are visible in your Cloudflare dashboard at all times.
Can it take my site down?
No FindIP failure can deny service to your origin. If a risk lookup is slow, wrong, or unavailable, the Worker forwards the request unchanged. The only response Shield can ever author is a plain 403, and only in Balanced mode.
Does Monitor mode block anything?
Never. It observes and reports every visitor and shows what Balanced mode would have blocked, so you can judge the policy on your real traffic before arming it.
What data does the Worker send to FindIP?
The visitor IP address, hostname, URL path, and HTTP method. It does not read request bodies, cookies, authorization headers, or query strings. Responses from your origin pass through untouched.
Which permissions does it ask for, and why?
Zone read to list your zones; DNS read to find proxied hostnames; Workers Scripts write to deploy and remove the one Worker; Workers Routes write to create and remove the one route (Cloudflare requires this scope even to read routes for the conflict check).
What if I already run Workers on that hostname?
Shield inspects existing routes first and refuses to install if anything overlaps, rather than risk interfering with your setup. Pick another hostname or remove the conflicting route, then retry.
How do I remove it?
One click in the Shield dashboard deletes the route, then the Worker. Disconnect additionally revokes FindIP's access at Cloudflare. You can also delete both yourself in your Cloudflare dashboard, route first, even if FindIP is unreachable.
Does it work on the Cloudflare Free plan?
Yes, on any plan, as long as the hostname is proxied (orange cloud). Worker requests count against your plan's Workers quota (100,000 per day on Free, shared across your Workers), so size the hostname's traffic accordingly.
The consent screen says my account does not allow this app. Why?
A Cloudflare account administrator can turn off "Public OAuth App access" for the whole account. Ask an administrator to enable it under Manage Account → Members → Settings, then connect again. FindIP never needs an API token or Global API Key as a workaround.
Can I control AI crawlers?
Yes. Verified AI crawlers can be allowed, treated like any other visitor, or blocked, site-wide or per path, independently of search-engine crawlers.
What does it cost?
FindIP Shield for Cloudflare is free. Your Cloudflare plan's own Workers limits still apply. Free Shield sites are governed by the Shield Free Preview Terms.
Watch one hostname for a week. Decide with evidence.
Connect Cloudflare, pick a hostname, and see every visit screened at the edge. Nothing is blocked until you turn on Balanced mode. Remove in one click.
Connect Cloudflare — freeQuestions before authorizing? Ask us first · Read the documentation · Terms apply