Overview
Get started
Implementation guides
Secure your Internet traffic and SaaS apps
Replace your VPN
Deploy Zero Trust Web Access
Identity
One-time PIN login
SSO integration

Generic OIDC
Generic SAML 2.0
Active Directory® (SAML)
Amazon Cognito
AWS IAM (SAML)
Azure AD®
Centrify
Centrify (SAML)
Citrix ADC (SAML)
Facebook
GitHub
Google
Google Workspace
Jumpcloud (SAML)
Keycloak (SAML)
LinkedIn
Okta
Okta (SAML)
OneLogin
OneLogin (SAML)
PingFederate®
PingOne®
PingOne® (SAML)
Signed AuthN requests (SAML)
Yandex

Device posture

WARP client checks

Application check
Carbon Black
Client certificate
Device serial numbers
Device UUID
Disk encryption
Domain joined
File check
Firewall
OS version
Require Gateway
Require WARP
SentinelOne

Service providers

CrowdStrike
Kolide
Microsoft Endpoint Manager
SentinelOne
Uptycs
Workspace ONE

Access integrations

Mutual TLS
Tanium

User management

Access groups
Session management
Seat management
Short-lived certificates
SCIM provisioning

Service tokens
Authorization cookie

Validate JWTs
Application token
CORS
Connections
Cloudflare Tunnel

Get started

Create a remotely-managed tunnel (dashboard)
Create a locally-managed tunnel (CLI)
Useful terms

Downloads

Update cloudflared
License
Copyrights

Configure a tunnel

Remotely-managed tunnel
Locally-managed tunnel

Configuration file
Run as a service

Linux
macOS
Windows

Useful commands
Tunnel permissions

Origin configuration
Tunnel run parameters

Deploy a tunnel

Tunnel with firewall
Tunnel availability and failover
System requirements
Environments

Ansible
AWS
Azure
GCP
Kubernetes
Terraform

Use cases

SSH
RDP
SMB

Private networks

Connect private networks

Private DNS
Virtual networks

Peer-to-peer connectivity
Site-to-site connectivity

Public hostnames

DNS records
Load balancers

Monitor tunnels

Logs
Notifications
Metrics

Troubleshoot tunnels

Private network connectivity
Common errors

Do more with Tunnel

Migrate legacy tunnels
Quick Tunnels

Connect devices

WARP

First-time setup
Download WARP

Update WARP
Migrate 1.1.1.1 app

User-side certificates

Install certificate using WARP
Install certificate manually
Deploy custom certificate

Deploy WARP

Managed deployment

Partners

Hexnode
Intune
Jamf
JumpCloud
Kandji

Parameters
Switch between Zero Trust organizations

Manual deployment
Device enrollment permissions
WARP with firewall
WARP with legacy VPN

Configure WARP

Device profiles
WARP modes

Enable Device Information Only

WARP settings

Captive portal detection

Managed networks
Route traffic

Local Domain Fallback
Split Tunnels
WARP architecture

WARP sessions

Troubleshoot WARP

Common issues
Client errors
Debug logs
Known limitations

Remove WARP

Agentless options

DNS

Add locations

DNS resolver IPs and hostnames

DNS over HTTPS
DNS over TLS

HTTP
Applications
Add web applications

SaaS applications

Generic OIDC application
Generic SAML application
Area 1
Atlassian Cloud
AWS
Digicert
DocuSign
Google Cloud
Google Workspace
Hubspot
Jamf Pro
Salesforce (OIDC)
Salesforce (SAML)
ServiceNow (OIDC)
ServiceNow (SAML)
Slack
Tableau Cloud (SAML)
Zendesk

Self-hosted applications
Cloudflare dashboard SSO application

Add non-HTTP applications

Arbitrary TCP
Connect using cloudflared

Scan SaaS applications

Manage findings
Available integrations

Atlassian Confluence
Atlassian Jira
Box
Dropbox
GitHub
Google Workspace

Google Drive
Gmail
Google Admin
Google Calendar

Microsoft 365

Admin Center
OneDrive
SharePoint
Outlook

Salesforce
ServiceNow
Slack

Scan for sensitive data
Troubleshoot integrations

Login page
Block page
Add bookmarks
App Launcher
Policies
Secure Web Gateway

Get started

DNS filtering
Network filtering
HTTP filtering

DNS policies

Common policies
Test DNS filtering
Scheduled DNS policies

Network policies

Common policies
Protocol detection
SSH proxy and command logs

HTTP policies

Common policies
HTTP/3
TLS decryption
Tenant control
AV scanning
WebSocket traffic

Egress policies

Dedicated egress IPs

Resolver policies
Global policies
Applications and app types
Domain categories
Identity-based policies
Block page
Order of enforcement
Lists
Proxy

Access

Manage Access policies
Require Purpose Justification
External Evaluation rules
Isolate self-hosted application
Application paths
Enforce MFA
Temporary authentication

Browser Isolation

Setup

Clientless Web Isolation
Non-identity on-ramps

Isolation policies
Extensions
Accessibility
Browser Isolation with firewall
Known limitations

Data Loss Prevention

Scan HTTP traffic

Common policies
Log the payload of matched rules

Configure a DLP profile

Predefined profiles
Integration profiles
Profile settings

DLP datasets
Insights
Analytics

Shadow IT Discovery
Gateway analytics

Digital Experience Monitoring

Fleet status
Tests

HTTP test
Traceroute test
View test results

Notifications

Logs

User logs
Access audit logs
Gateway activity logs

Manage PII

Tunnel audit logs
Posture logs
Logpush integration

RData

Risk score
API and Terraform
Access API examples

Access group
Any valid service token
Authentication method
Azure® Group
Common name
Country Code
Email
Email domain
Everyone
G Suite® Group
GitHub™ Organization
IP range
mTLS certificate
Okta® Group
SAML Attribute
Service token

Gateway API examples

DNS policy
Network policy
HTTP policy

Scoped API tokens
Terraform
Reference architecture
Tutorials
Account limits
Roles and permissions
Glossary
Changelog
Access
Browser Isolation
CASB
Data Loss Prevention
Digital Experience Monitoring
Gateway
Risk score
Zero Trust WARP Client
FAQ

Connect devices

Configure devices to send DNS queries to Cloudflare, or proxy all traffic leaving the device through Cloudflare’s network.