# Cloudflare
All DNS zones managed through Cloudflare. Provides DNS, CDN proxying, SSL, and WAF.
## Account
- Account email: [email protected] - Account ID: 3b9022223ff5a6ea1018b3645324dbea - Zones: kaburu.co and all client domains
## API Token
IMPORTANT: Must use a USER-scoped token (dash.cloudflare.com/profile/api-tokens) NOT an account-scoped token. Account tokens cannot edit zones owned by the user profile.
Token name: Hermes-CARO-cfut File: /root/.secrets/cloudflare (kaburusvr) IP lock: 49.13.202.144 AND 2a01:4f8:1c18:91ab::1 (both IPv4 and IPv6 required) Permissions: Account WAF:Edit, Account Rulesets:Edit, Firewall Services:Edit, DNS:Edit, Zone:Edit, Zone Settings:Edit, Cache Rules:Edit, Config Rules:Edit
⚠️ Do NOT confuse with the “Hermes” token (DNS-only, no WAF/firewall perms). The correct token name is Hermes-CARO-cfut.
The legacy IP Access Rules API (`/firewall/access_rules/rules`) returns 403 even with this token. Use the WAF custom rules endpoint instead: ```bash curl -s -X PUT “https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint” \
- H “Authorization: Bearer $CF_TOKEN” \
- H “Content-Type: application/json” \
- d '{“rules”:[{“action”:“block”,“expression”:“(ip.src eq X.X.X.X)”,“description”:“reason”}]}'
```
Verify token: ```bash curl -s -X GET “https://api.cloudflare.com/client/v4/accounts/ACCOUNT_ID/tokens/verify” \
- H “Authorization: Bearer TOKEN”
```
## DNS update procedure
```bash CF_TOKEN=“TOKEN” ZONE_ID=“zone-id-from-api” SERVER_IP=“49.13.202.144”
# Get zone ID curl -s “https://api.cloudflare.com/client/v4/zones?name=domain.com” \
- H “Authorization: Bearer $CF_TOKEN”
# Update A record curl -s -X PATCH “https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID” \
- H “Authorization: Bearer $CF_TOKEN” \
- H “Content-Type: application/json” \
- -data '{“content”:“IP_ADDRESS”}'
```
## Known quirks
- kaburusvr connects over IPv6 — CF token MUST have IPv6 address in IP filter - Account API tokens (cfat_) vs user API tokens (cfut_) are different — zones need user tokens - Cloudflare proxying (orange cloud) means SSL cert on origin can be self-signed initially - After DNS cutover, re-issue SSL via CyberPanel for proper Let's Encrypt cert
## ⚠️ CRITICAL: Do NOT use Page Rules for WordPress caching
Cache Everything page rules with wp-admin/wp-login bypass are dangerous and broken. The bypass rules don't catch AJAX, REST API, or other admin endpoints — cached admin sessions get served to other visitors, exposing full admin access.
Instead: - Rely on LiteSpeed cache + Redis at the origin for WordPress caching - If you need edge caching, use Cloudflare Cache Rules (new UI), not Page Rules - Cache Rules support negative conditions (match everything EXCEPT admin paths) which actually work - Page Rules are deprecated by Cloudflare and should be avoided for new configurations
Cleanup history: 78 Page Rules deleted across 26 zones on 2026-06-21.
## UK-Only Geo-Blocking (2026-08-20)
Applied to: 21 zones via CF WAF custom rulesets API Excluded (global access): jafricasafari, womenunlimited, myretonmarquees, ggsgenerators, l8waterhygiene (owner in Spain), kaburu.cc/casa/xyz, kaburusvr.uk, rvweb.co.uk
Rule logic: - Rule 1 (skip): All non-browser traffic passes through: WP API paths (`/wp-json/`, `/wc-api/`, `/wp-admin/`, `/wp-login.php`, `/admin-ajax.php`, `/wp-cron.php`, `/xmlrpc.php`, `/wp-content/`), bots (Google, Bing, Baidu, UptimeRobot, Wordfence, ShortPixel, FastPixel, Ahrefs, RankMath, Rankwatch), server IP (49.13.202.144) - Rule 2 (managed_challenge): Non-UK browsers get Cloudflare CAPTCHA
Effect: Real browser page views from outside UK get challenged. All API/webhook/plugin/bot traffic passes through regardless of origin. Catches AI scrapers (ChatGPT, Anthropic) disguised as browsers.
To add more zones: Edit `/tmp/cf-geoblock-update.py` on kaburusvr (EXCLUDED_ZONES set), run `python3 /tmp/cf-geoblock-update.py`
To add more bots/paths: Edit BOT_EXPRESSION in the script, run update on all zones