Section 13 · Observability
Infrastructure Security
Verify all environments are protected behind Cloudflare, origin servers are not directly exposed, security headers are properly configured, and SSL certificate issuance is monitored.
This guide walks you through auditing a project's infrastructure security setup, ensuring all environments are protected behind Cloudflare, origin servers are not directly exposed, security headers are properly configured, and SSL certificate issuance is monitored.
The Goal: Hidden and Hardened
Your origin servers should be invisible to attackers. Defense in depth means multiple layers: Cloudflare absorbs attacks, origins reject direct connections, headers reveal nothing useful, and certificate monitoring catches rogue issuance.
- Proxied — All public-facing environments behind Cloudflare with DNS records showing only Cloudflare IPs
- Origin-protected — Firewalls restrict traffic to Cloudflare IP ranges; direct origin access fails
- Header-hardened — HSTS enforced, technology-revealing headers stripped, no stack fingerprinting
- Script-verified — External CDN scripts use SRI; GTM access controlled and audited
- Certificate-monitored — CT logs watched for unauthorized certificate issuance
Before You Start
- Have Cloudflare API token with read access (Zone:Read, DNS:Read)
- Know all environment domains (production, staging, dev)
- Have access to web server configuration (nginx, Apache, or app-level)
- Know what third-party scripts are loaded (GTM, CDN libraries, etc.)
Cloudflare Protection
All public-facing environments (production, staging, dev) should be proxied through Cloudflare for DDoS protection, WAF, and edge caching.
“Is staging actually behind Cloudflare, or just prod?”
Origin server IPs should not be publicly accessible. All traffic must flow through Cloudflare to prevent bypass attacks.
“Could someone bypass Cloudflare and hit your origin directly?”
Cloudflare should respect the origin server's cache-control headers rather than overriding them, unless explicitly configured otherwise.
“Is Cloudflare caching responses it shouldn't be?”
Security Headers
Response headers should not leak technology stack information. Remove or sanitize headers that expose server software, versions, or frameworks.
“What does your Server header reveal about your stack?”
Strict-Transport-Security header must be present to ensure browsers always use HTTPS, preventing downgrade attacks.
“Can your app still be reached over plain HTTP?”
External scripts from CDNs must have integrity hashes (SRI). If Google Tag Manager is used, access must be controlled since GTM cannot have SRI.
“Who has access to inject scripts via GTM right now?”