导航|地址|刷新
Cloudflare Security Architecture

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/reference-architecture/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Reference Architecture

/

Overview

How to use

Find by solution

Reference Architectures

Cloudflare SASE with CrowdStrike

Cloudflare SASE with Microsoft

Cloudflare SASE with SentinelOne

Content Delivery Network (CDN)

Load Balancing

Magic Transit

Multi-Vendor Architecture

Secure Access Service Edge (SASE)

Security Architecture

AI Security for Apps

Email Security Deployments

Reference Architecture Diagrams

Artificial Intelligence (AI)

AI Vibe Coding Platform

Automatic captioning for video uploads

Composable AI architecture

Content-based asset creation

Enterprise AI Vibe Coding Platform

Ingesting BigQuery Data into Workers AI

Multi-vendor AI observability and control

Retrieval Augmented Generation (RAG)

Enterprise AI agent workspace

Bots

Bot management

Content Delivery

Optimizing image delivery

Distributed web performance

Internet of Things (IoT)

Connected transportation systems

Network

BYOIP to Cloudflare

Device roaming with geolocated IPs

Protect data center networks

Protect hybrid cloud networks

Protect ISP and telecommunications networks from DDoS attacks

Protect public networks

Secure Access Service Edge (SASE)

Access to private apps without having to deploy client agents

Cloudflare One Appliance deployment

DNS filtering solution for Internet service providers

Protective DNS for governments

Secure access to SaaS applications

Self-hosted VoIP for hybrid users

Zero Trust and Virtual Desktop Infrastructure

ZTNA with external authorization

Security

FIPS 140 level 3 compliance with Cloudflare Application Services

Securing data at rest

Securing data in transit

Securing data in use

Serverless

A/B-testing using Workers

Fullstack applications

Programmable Platforms

Serverless ETL pipelines

Serverless global APIs

Serverless image content management

Storage

Control and data plane architectural pattern for Durable Objects

Egress-free object storage in multi-cloud setups

Event notifications for storage

On-demand Object Storage Data Migration

Storing user generated content

Design Guides

Cloudflare's benefits for SaaS providers

Leveraging Cloudflare for your SaaS applications

Zero Trust for SaaS applications

Designing ZTNA access policies

Network-focused VPN migration

Secure application delivery

Securing guest wireless networks

Streamlined WAF deployment across zones and applications

Zero trust architecture for startups

Implementation Guides

Zero Trust

Secure your Internet traffic and SaaS apps ↗

Replace your VPN ↗

Secure your email with Email security ↗

Deploy clientless access ↗

Holistic AI Security with Cloudflare One ↗

Application Security

Use mTLS with Cloudflare protected resources ↗

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Reference Architecture llms.txt ↗

Reference Architecture llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Reference Architecture

/Reference Architectures

/Security Architecture

Cloudflare Security Architecture

Last updated Apr 17, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewIntroduction Who is this document for and what will you learn?Secure global network Architecture Operational securityUsing Cloudflare to protect your business Securing public and private resources Protecting public resources Protecting private resources ObservabilityDeveloper platformSummary

Introduction

Today, everything and everyone needs to be connected to everything everywhere, all the time, and everything must be secure. However, many businesses are not built on infrastructure that supports this reality. Historically, employees worked in an office where most business systems (file servers, printers, applications) were located on and accessible only from the private office network. A security perimeter was created around the network to protect against outsider threats, most of which came from the public Internet.

However, as Internet bandwidth increased and more people needed to do work outside of the office, VPNs allowed employees access to internal systems from anywhere they could get an Internet connection. Applications then started to move beyond the office network, living in the cloud either as SaaS applications or hosted in IaaS platforms. Companies rushed to expand access to their networks and invest in new, dynamic methods to detect, protect, and manage the constantly evolving security landscape. But this has left many businesses with complex policies and fragile networks with many point solutions trying to protect different points of access.

Since 2010, Cloudflare has been building a unique, large-scale network on which we run a set of security services that allow organizations to build improved connectivity and better protect their public and private networks, applications, users, and data. This document provides insight into how this network and platform are architected from a security perspective, how they are operated, and what services are available for businesses to address their own security challenges. The document comprises two main sections:

How Cloudflare builds and operates its secure global network.

How to protect your business infrastructure and assets using Cloudflare services built on the network.

Who is this document for and what will you learn?

This document is designed for IT and security professionals who are looking at using Cloudflare to secure aspects of their businesses. It is aimed primarily at Chief Information Security Officers (CSO/CISO) and their direct teams who are responsible for the overall security program at their organizations. Because the document covers the security of the entire Cloudflare platform it does not go into deep details about any particular service. Instead, please visit our Architecture Center ↗ to find specific information for a service or product.

To build a stronger baseline understanding of Cloudflare, we recommend the following resources:

What is Cloudflare? | Website ↗ (5 minute read) or video ↗ (2 minutes)

How Cloudflare strengthens security everywhere you do business ↗ (10 minutes)

Secure global network

Any cloud security solution needs to be fast and always available. Our network protects over 20% of Internet web properties, operates in over 330 cities, and is 50 ms away from 95% of the Internet-connected population. Each server in each data center runs every service, so that traffic is inspected in one pass and acted upon close to the end user. These servers are connected together by over 13,000 network peers with over 405 Tbps network capacity. Cloudflare’s network is also connected to every Internet exchange ↗ (more than Microsoft, AWS, and Google) to ensure that we are able to peer traffic from any part of the Internet.

With millions of customers using Cloudflare, the network serves over 57 million HTTP requests ↗ per second on average, with more than 77 million HTTP requests per second at peak. As we analyze all this traffic, we detect and block an average of 209 billion cyber threats each day ↗. This network runs at this massive scale to ensure that customers using our security products experience low latency, access to high bandwidth, and a level of reliability that ensures the ongoing security of their business. (Note metrics are correct as of June 2024.)

Architecture

Network

The Cloudflare network is not like a traditional enterprise network. It has been designed from the ground up using a service isolation, least privilege, and zero trust architecture. Public-facing edge servers, and the data centers they reside in, can be seen as islands in a vast lake of connectivity — where nothing trusts anything without strong credentials and tight access policies.

A unique aspect of the network's security architecture is how we use anycast networking. In every data center we broadcast the entire Cloudflare network range (IPv6 and IPv4) for both UDP and TCP. Border Gateway Protocol ↗ (BGP) ensures routers all around the Internet provide the shortest possible path for any user to the nearest Cloudflare server where traffic is inspected. From a security perspective, this is very important. During distributed denial-of-service (DDoS) attacks to customers behind our network, a combination of high bandwidth capacity and distribution of requests across thousands of local servers helps ensure our network stays performant and available, even during some of the largest attacks in Internet history ↗.

Server updates, such as access policies, rate limiting, and firewall rules, are performed by our Quicksilver service ↗. Customer changes are reflected across the entire network in seconds, allowing customers to respond to changing business requirements and ensuring policies are quickly implemented globally.

Every level of the network conforms to strict hardened security controls. Processes running on the edge are designed with a need-to-know basis and run with least privilege. We have our own key management system to ensure keys are secured at rest and in transit and that the right access to keys is given at the right time. To ensure tight control over and detailed visibility of changes to the network, all infrastructure is managed via code (IaC ↗).

Servers

Cloudflare designs and owns all the servers in our network. There are two main types.

Private core servers: The control plane where all customer configuration, logging, and other data lives.

Public edge servers: Where Internet and privately tunneled traffic terminates to the Cloudflare network, to be inspected and then routed to its destination.

Server hardware is designed by Cloudflare and built by industry-respected manufacturers that complete a comprehensive supply chain and security review. Every server runs an identical software stack, allowing for consistent hardware design. The operating system on edge servers is also a single design and built from a highly modified Linux distribution, tailored for the scale and speed of our platform. Cloudflare is a significant contributor to the Linux kernel, and we regularly share information on how we secure our servers and services ↗, helping the Linux community and the rest of the Internet benefit from our engineering ↗.

Services

Every server runs all Cloudflare products and services that customers use to secure their networks and applications. Later in this document we provide an overview of these services, but for the moment it's important to provide insight into the development of the software. From the initial design of every product, the engineering team works hand in hand with security, compliance, and risk teams to review all aspects of the service. These teams can be viewed as part of the engineering and product teams, not an external group. They are essential to the development of everything we do at Cloudflare and we have some of the most respected professionals in the industry. Code is reviewed by security teams at every stage of development, and we implement many automated systems to analyze software looking for vulnerabilities. Threat modeling and penetration testing frameworks such as OWASP ↗, STRIDE ↗, and DREAD ↗ are used during design, development, and the release process.

Many of our products run on our serverless runtime environment, which leverages the very latest techniques in service isolation. We anticipated this secure runtime environment could be very valuable to our customers, so we productized it, allowing them to build and run ↗ their own applications on our network. More about that at the very end of this document.

Innovation

To ensure we are delivering the most secure network and platform possible, we are always innovating. New technologies need to be created to solve the ever-increasing range of security threats and challenges. Cloudflare leads many initiatives, such as further securing BGP using RPKI ↗, and we regularly contribute to working IETF groups on many common Internet security protocols. We strive to help increase and monitor IPv6 adoption ↗, which inherently creates a more secure Internet, and we stay ahead of future challenges by deploying technologies such as post-quantum cryptography ↗ before any increase in computing power from quantum computers threatens existing cryptographic techniques.

Operational security

Not only must the design of the network be secure, but so should how we run and maintain it. We operate at a massive scale, and the common design of our servers helps optimize software deployments and monitoring. Defining who has access to maintain the network is fully automated, following infrastructure-as-code practices with role-based access controls (RBAC) and least privilege controls used everywhere.

Customers send sensitive information to our products and services. The mission for the Cloudflare compliance team is to ensure the underlying infrastructure that supports these services meets industry compliance standards ↗ such as FedRAMP, SOC II, ISO, PCI certifications, C5, privacy, and regulatory frameworks. The compliance team works with all engineering organizations to help integrate these requirements as part of the way we work. From a compliance perspective, our areas of focus include:

Privacy and security of customer data

Maintaining compliance validations

Helping customers with their own compliance

Monitoring the changes to the regulatory landscape

Providing feedback to regulatory bodies on upcoming changes

We also run a bug bounty program ↗, giving incentives for the community to find and report vulnerabilities to us for financial reward.

In summary, Cloudflare not only has built the right technology to secure our network, but also has well-staffed and mature teams ensuring that the right processes are created, followed, and monitored. As Cloudflare has grown over the past decade, we've accrued some of the best security knowledge in the industry, which in turn has attracted top talent to come work with us. This effect compounds each year, bringing our security skills and knowledge to greater heights. We are also very transparent about how Cloudflare runs and secures its network, and we often blog ↗ about our processes and evolving approach to security.
…(内容过长已截断)

------
导航页打开网址