Cloudflare + Security
Posts matching all selected tags.
Category
All Categories
Tags
7 more tagsFewer tags
Newsletter
New posts land in your inbox when they publish. No spam, unsubscribe anytime.
You're in. New posts head your way.
9 posts
Cloudflare Virtual Wallets are the subaccount for APIs
Cloudflare Virtual Wallets are the API-key subaccount. Claim the handle this week, pick three spending caps, and never hand the Account Wallet to an agent.
MCP went stateless and the session just moved
Stateless MCP deleted the protocol session. Continuity now rides in requestState on retry. Delete sticky routing, keep the store for carts and tokens.
Agents request every OAuth scope they might need
MCP oauth scopes arrive as a catalog because the next call is unknown. Check the issued token, hide tools you did not get, and keep the agent running.
Bot Preference Sync admits robots.txt never enforced
Bot Preference Sync writes your Search, Agent, and Training policy into robots.txt. A mismatch is an argument to keep crawling. The WAF is still the lock.
MCP is now traffic a firewall can name
MCP traffic detection now matches protocol headers, not mcp in the hostname. Treat the next remote MCP install as a named network event, not a config tweak.
Isolate sharing is a Spectre channel on Workers
Workers Spectre is isolate sharing on the edge. A JWT in neighbor heap leaked at 12 bit/s in production. Keep secrets on env rather than module scope.
Web Scraping in the AI Age: What Actually Changed
Web scraping in the AI age broke twice over: LLMs killed the CSS selector, and AI crawlers exploded while referral traffic collapsed. Here is what changed.
How to Block AI Crawlers From Destroying Your Site
AI crawlers from OpenAI, Meta, and Anthropic are hammering sites with millions of requests per month. robots.txt alone does not stop them. Here are the 4 layers that actually work.
Cloudflare Is the Biggest Man-in-the-Middle in History (And You're OK With It)
Cloudflare terminates TLS for roughly 20% of all web traffic. Every proxied HTTPS request is decrypted and re-encrypted on their servers. Here's what that means, why we accept it, and what the alternatives actually look like.