CCshould still redirect clients. If you want to have less clients you need to redirect, enable HSTS within CF with a length of 12 months and then go to hsts preload and get your website hsts preloaded
Cpretty normal yea. You get spikes of traffic from Certs being renewed/issues and bots stalking CT logs and picking up on it/scanning the site. For example, here's the traffic on one of my zones blocked by a rule which simply blocks all
.php and wp- requests
Cthere's never been any php or wp on that site so no chance of being legit, and those are purely the silly bots trying exploits/scanning being flagged there, mostly in spikes. They say the internet is more bots then humans in overall requests these days lol
TThank you all for the answers, I will look more into it these days. Until then if you have any links to tutorials that explain what settings you should turn on or common WAF rules to add for cloudflare pages I would appreciate it.
AI'm beginning to suspect that a fetch call being made by my next/pages app is being cached... Is this a possibility?
AIf so. How do I stop it
AIf I rebuild the app it doesn't even correct it.. but if I alter the fetch(query) slightly i get correct results
AI wonder if this is the issue. https://developers.cloudflare.com/workers/reference/how-the-cache-works/#:~:text=%E2%80%8B%E2%80%8B%20fetch,zone's%20cache%20(or%20Worker).
Cloudflare Docs
How Workers interacts with the Cloudflare cache.
BI was reading a few Community posts about 500s being served for random .js files. They were older posts, but apparently the issue is back for some customers. I know Walshy was in here asking for details from some folks - was a fix or cause ever discovered?
Cthere was this thread: I get 500 response from pages without any functions and escalation https://discord.com/channels/595317990191398933/1105165969032220752/1245885676273008641 about it, idk what went from there. Might just have to ask the blob
BI found the escalation. Nothing of note yet.
MHello! I had a question regarding cloudflare pages. When adding a subdomain to a cloudflare pages project, we get the option to add it with CNAME or add DNS to cloudflare.
We're thinking of using cloudflare for our multi-tenant cloudflare pages project however domains are hosted outside of cloudflare and cannot be brought in cloudflare. How do we enable WAF on custom domains this way?
We can ask our customers to allow us to add their subdomain to our cloudflare account but that requires business plan for every domain we add (that's $250/domain/month). Is there any other way?
We're thinking of using cloudflare for our multi-tenant cloudflare pages project however domains are hosted outside of cloudflare and cannot be brought in cloudflare. How do we enable WAF on custom domains this way?
We can ask our customers to allow us to add their subdomain to our cloudflare account but that requires business plan for every domain we add (that's $250/domain/month). Is there any other way?
Phey guys - still getting an warning using cloudflare pages-action - that it uses an outdated node.js 16 - seems there was no new version in a year.
Shttps://www.cloudflarestatus.com/incidents/5t270n2ndf0h This has been up for 3 days. Can I expect this to be semi fixed soonish because I need to upgrade my workers plan and it wouldn’t let me.
CIf you don't have any unpaid invoices that you can pay (per the instructions on there), I would make a ticket if you haven't already
CIs there any other way?Sure, there's one other option. You can use CF for SaaS/SSL/TLS -> Custom Hostnames on your own account. You can then leverage WAF on that zone (would need Pro or higher just on that one), it just runs through it like normal. You get 100 Custom Hostnames for free and then pay 10 cents per month per hostname over. The tricky bit is that you can't point your fallback domain at Pages since Pages itself uses CF for SaaS, so you have to use a Worker (and pay for each invocation) or wait for Snippets to roll out further/come out of alpha which have no execution costs, ex:
customer.com -> cname -> yourzone.com -> worker/snippet -> pages.dev
You can even use Custom Metadata attached to each hostname to configure security level and such in your zone's Custom Rules: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/waf-for-saas/.
Cloudflare Docs
Web Application Firewall (WAF) allows you to create additional security measures through Cloudflare. As a SaaS provider, you can link custom rules, …
SHello, I've problem on pages build
I'm using nextjs, and the build are fine until the last deployment.
Today I'm pushing a small changes, but somehow it won't build.
I got the size limit error, but the size are not much different from the previous deployment. (which is over 1MiB)
<= Prev deployment (currently deployed) | New deployment (failed to build) =>
Is it a bug on next-on-pages? or something else?
I'm using nextjs, and the build are fine until the last deployment.
Today I'm pushing a small changes, but somehow it won't build.
I got the size limit error, but the size are not much different from the previous deployment. (which is over 1MiB)
<= Prev deployment (currently deployed) | New deployment (failed to build) =>
Is it a bug on next-on-pages? or something else?
MYes thanks! Just discovered cloudflare for saas after writing that message. Amazing product, thanks!
かWe have the same problem and have read the thread. Should we create another support thread for our case, or just watch the thread to see how it goes?
Si don’t have any unpaid tickets. I didn’t know that i was supposed to make a ticket. Thanks! As a UX designer, I would recommend tweaking the language on the error messages because it’s unclear (even with the full page long version) that the recommendation for people without unpaid ticket is to open one 
Hfacing the same issue. deployment id: 9e4ea0f3-58ef-4827-87e7-1a7f4b5b3f72
D@Brandon | Cloudflare TSE Same here. 500 for random css and js files. dep id 5061f269-5303-41c1-883e-ad980bc52114
This is my first experience with CF and first impressions matter. Just hope this can get resolved quickly, or that it will be addressed at least.
This is my first experience with CF and first impressions matter. Just hope this can get resolved quickly, or that it will be addressed at least.
DGot an update to this. My original build had ~2500 files and everything was uploaded successfully through wrangler. Several random js and css files got 500-error however when accessing them. The amount of files are due to articles on the site.
I did a test now and only prerendered part of the articles, ending up with 1050 files, and deployed that. Now everything on CF works and there are no 500-errors, but I need to be able to publish all my articles.
I did a test now and only prerendered part of the articles, ending up with 1050 files, and deployed that. Now everything on CF works and there are no 500-errors, but I need to be able to publish all my articles.
HNumber of files shouldn't be an issue. CF Pages allows up to 20,000 files (https://developers.cloudflare.com/pages/platform/limits/#files)
HI had to roll back to a previous deployment since all new deployments have this issue, but i need to deploy ASAP
W(actually moving to forum, easier to track - https://canary.discord.com/channels/595317990191398933/1249285733416439838)
THello everybody I am a little bit confused. I have this WAF rule to bloc all requests from HTTP/1.0 and HTTP/1.1 but I see some events first went through bot fight mode, cloudflare gave the managed challenge and then passed my WAF even though the request came from HTTP/1.1. Is there any way to block this?
WThat's only blocking HTTP rather than HTTPS
WYou can use HTTPS over HTTP/1.1
W(HTTP just means HTTP requests over plain text while HTTPS is HTTP encrypted)
WThere's probably a protocol version field or something you can use
Wah yeah:
W
W"HTTP Version"
Wdo a rule like that and you can block /1.0 and /1.1
W(also, this is not the right channel for WAF stuff - this is for the Pages product -- general-discussions )
TYou are right, thank you. Yes, my bad, I've asked here because I am trying to set up the security for a cloudflare page 
. I will use the other channel.
. I will use the other channel.
CHello everyone, I have a question to ask.
How to make r2 become a resource folder in page?
For example, my page is "example.page.dev", and I want to access the r2 files under "example.page.dev/asset"
How to make r2 become a resource folder in page?
For example, my page is "example.page.dev", and I want to access the r2 files under "example.page.dev/asset"
HIIRC the confirmation phase is just issuing the cert
HSo you can’t really skip it
BAny ideas on why
devdeploy
Dprobably because wrangler is still using an ancient esbuild version :/
BThanks for pointing me in that direction - that is indeed the issue. Looks like getting on
0.19.x
DIs there any issue where this is being tracked yet?
DThere is an issue (https://github.com/cloudflare/workers-sdk/issues/5222), and there used to be an experimental PR but they closed that (https://github.com/cloudflare/workers-sdk/pull/5361)
AI'm reading Pages' docs and I can't find a way to make the server return a proper 404 http code in an asset that doesn't exist is requested.
According to https://developers.cloudflare.com/pages/configuration/serving-pages/#not-found-behavior I can create a custom 404.html that can display a "404 not found" message to the user, but the actual http code is still 200.
And according to https://developers.cloudflare.com/pages/configuration/serving-pages/#single-page-application-spa-rendering if I don't provide any 404.html, cloudflare will return the index.html for all requests that don't match any file.
So... how can I make Pages return a real 404 http code?
According to https://developers.cloudflare.com/pages/configuration/serving-pages/#not-found-behavior I can create a custom 404.html that can display a "404 not found" message to the user, but the actual http code is still 200.
And according to https://developers.cloudflare.com/pages/configuration/serving-pages/#single-page-application-spa-rendering if I don't provide any 404.html, cloudflare will return the index.html for all requests that don't match any file.
So... how can I make Pages return a real 404 http code?