Compare security policies across Cloudflare zones and identify configuration deltas
requests library (auto-installed on first run)| Permission | Level | Needed For |
|---|---|---|
| Zone WAF Read | Zone | WAF rules, custom/managed rules |
| Zone Settings Read | Zone | Security settings comparison |
| Firewall Services Read | Zone | IP access rules |
| Zone Read | Zone | Zone listing and details |
# Compare all zones in your account python cf_zone_security_compare.py --token YOUR_TOKEN --account YOUR_ACCOUNT_ID # Compare specific zones python cf_zone_security_compare.py --token YOUR_TOKEN --zones ZONE_ID_1,ZONE_ID_2 # Use environment variable for token export CLOUDFLARE_API_TOKEN=your_token python cf_zone_security_compare.py --account YOUR_ACCOUNT_ID # Use a config file python cf_zone_security_compare.py --config config.json
| Category | What's Compared |
|---|---|
| WAF Custom Rules | Expressions, actions, enabled state |
| WAF Managed Rules | Deployed rulesets, overrides |
| Rate Limiting | Rate limit configurations |
| DDoS L7 | L7 DDoS protection rules |
| Bot Fight Mode | Super Bot Fight Mode rules |
| Security Settings | TLS, security level, browser check, challenge TTL |
| IP Access Rules | Allowlists, blocklists, challenges |
For each category, rules are classified as: