Zonesteward
Apply for beta
Menu
Product Who it’s for Apply for beta
Use cases

Ask it what you'd ask a colleague.

The questions an agency gets at five o'clock, and what happens when you type them in. Every one is a question first, a proposal second, and a change only after you approve it. Nine are asked in the chat; the last is typed into the alert composer. Paging comes from armed rules, never from a conversation.

  1. 01
    You ask
    › Is client.com down?
    It checks
    • The status mix for the last fifteen minutes — served, redirected, rejected, origin errors — by path, with origin response times
    • Whether Cloudflare is still serving cached copies, on plans that expose cache status
    • Cloudflare's own health checks and notification history for the zone, if you have them, and the global attack picture — whether it is just you
    • Whether the origin is currently judged down by the rules you have armed, and on what basis — the zone's own traffic, or the product's own probe when the site is too quiet to judge — plus any open incident and its investigation
    • The audit trail: every change made through Zonesteward in the last hour — who approved it, when, whether it applied, and whether it can be reverted
    It proposes

    Edge or origin, with the evidence: origin errors and response times against the edge status mix. If it is the server it says so — there is nothing to write to Cloudflare — and it can propose a Cloudflare health check, on some plans, so you are told first next time. If a rule you approved earlier is the cause, ask it to undo that change: the revert card appears in the conversation, built from the recorded before-state and linked to the original, for an administrator to approve. Paging comes from the alert rules you have armed, never from a conversation.

    proposed · approved · verified · revertable

  2. 02
    You ask
    › Why is the site slow?
    It checks
    • Origin response time at the median, 95th and 99th percentile, by hour, against the day before, beside the request rate — the shape of a saturated origin, not the cause; it cannot see your server
    • Cache status by path, on plans that expose it: the static resources going to the origin uncached
    • Path breadth: how many distinct URLs were requested and which user agents are walking them
    • One endpoint being hammered — path, user agent, rate — and whether the firewall already challenged it, over the most recent days the plan allows
    • Whether it is slow everywhere or from one region
    It proposes

    A cache rule for the paths going to the origin uncached, with the number of requests it would have matched in the last 24 hours and how much of that was already served from cache, on plans that expose cache status. A rate limit or a managed challenge for the crawler path. Or nothing, when the numbers say it is the origin — then it says so, with the evidence to take to the host.

    proposed · approved · verified · revertable

  3. 03
    You ask
    › Who is attacking us right now?
    The security tab: ranked sources with country flags, networks, probed paths and Block or Challenge actions
    Who is attacking, last 24 hours
    It checks
    • Every source classified across nine attack categories with a severity score
    • What each source is doing, how much the firewall already stopped, its verdict, the paths it hit, its full status mix and how much was actually served — the signature of a scanner is a source that was served nothing
    • On the Security tab, Investigate checks whether the same source is hitting your other zones and hands the evidence to the conversation
    • Sources that look hostile but aren't — crawlers, research scanners, a theme fetching its own assets — named with the reason they were cleared, in the answer and on the Security tab
    It proposes

    A managed challenge for the single source — one click on the Security tab or a sentence in the conversation — on a card that shows how many requests it would have matched in the last 24 hours and how many of those were served. If the source is hitting several clients, the same rule fanned across the zone group on one card, with an acknowledgement above ten zones or when the change itself is high-impact.

    proposed · approved · verified · revertable

  4. 04
    You ask
    › What would this WAF rule actually block?
    Approval card: Create WAF rule (managed challenge) on WordPress login and XML-RPC endpoints — would have matched about 115 requests of the last 24 hours, broken down by path, network, country and user agent, with a map, and Approve & run or Reject
    What the rule would have matched
    It checks
    • The expression translated into analytics filters and run against your real last 24 hours — a sampled estimate
    • Supported: country, network, IP, host, method, path and user agent, with equals, in, contains and starts-with, joined by and/or. Negation, regular expressions, ranges and other fields show "preview unavailable" rather than a wrong number
    • The matches by the top five countries, networks, paths, user agents and addresses — network and address detail on some plans
    • Of the matched traffic, how much was served, redirected, rejected or failed at the origin — whether you are about to block customers — with a warning when most of it was being served
    • Two more warnings: a match that also catches a known-good crawler, and a rule that would have matched more than a fifth of all traffic
    It proposes

    The rule, with the number it would have matched. If the preview says it is too broad, ask for a narrower expression and preview again. You decide with the count in front of you, before the rule exists.

    proposed · approved · verified · revertable

  5. 05
    You ask
    › Did that change take effect? Undo it.
    The Changes tab: each change to the site with when it was made, who made it, and its outcome
    The change history, with outcomes
    It checks
    • Rules, settings, DNS records, access rules, managed rulesets, health checks and waiting rooms are read back from Cloudflare after every change; "applied" means the read-back agreed. Purges are accepted by Cloudflare, not read back — there is nothing to read
    • The audit row — who approved it, when, what it was, whether it applied and whether it can be reverted — in the conversation, on the zone's Changes tab and in the audit log
    It proposes

    A revert card built from the stored before-state, through the same pipeline as the original — classified, approved, executed, read back — from the conversation or the Changes tab, for an administrator to approve; the audit row records which change it undid. Purges, speed tests and zone creation cannot be reverted.

    proposed · approved · verified · revertable

  6. 06
    You ask
    › Why is it slow in Germany?
    It checks
    • Requests and origin latency by country, then by the Cloudflare data centre and network that served them, on plans that expose them
    • Whether that region's traffic is hitting cache or going to the origin, on plans that expose cache status
    • Whether a rule or a challenge is firing disproportionately on that region
    It proposes

    What is different about that region, with the evidence. A cache or origin rule if one would help; a plain answer if the origin is simply far away.

    proposed · approved · verified · revertable

  7. 07
    You ask
    › Purge the cache for the homepage on every client site.
    It checks
    • Which zones are in the group you named, and which token reaches each one
    • That the purge is by URL, so nothing else is touched
    • Give it the path — "/" — and the card lists the homepage URL for each zone in the group
    It proposes

    One bulk card listing every zone, approved by an administrator, with an acknowledgement above ten zones or when the change itself is high-impact. Each zone is purged and audited on its own and the card reports which zones Cloudflare accepted — a purge cannot be read back. Large fan-outs are spaced out, because purging many caches at once loads the origins.

    proposed · approved · verified · revertable

  8. 08
    You ask
    › Send me a seven-day digest for client.com.
    It checks
    • Traffic, 5xx rate, top countries, paths and hosts over the seven days; top networks on plans that expose them
    • Firewall activity over the full seven days, alerts that fired, and every change made through Zonesteward — from the audit trail
    It proposes

    Nothing to approve. It returns the highlights in the conversation with links to the printable report and CSV exports of each table — the thing you would otherwise assemble by hand on a Friday afternoon.

    proposed · approved · verified · revertable

  9. 09
    You ask
    › Chart cache hit ratio by hour for this week, and put it on the dashboard.
    The Viz tab after a question about cache hit ratio: hit, miss, none, bypass, expired and revalidated request counts by hour drawn as a series, with Stacked area and Heatmap 3D proposed beside it, each marked AI, and Suggest views, Author with AI and Save buttons
    Cache status by hour, with three proposed views
    It checks
    • The analytics query behind the chart, run against the zone with your own token — cache status on plans that expose it. The exact query and its variables are on the GraphQL tab
    • Which charts fit the shape of the result — an instant chart first, then up to four proposed views, each with a one-line reason and offered only if the data fits; Suggest views asks for fresh ones
    It proposes

    A chart you review and save to your library, pinned if you like, and added to the dashboard in the same click if you want it there. Those are your clicks — the conversation never touches the dashboard. On the dashboard it re-queries every minute. Every saved chart opens the conversation it came from, so you can see why it was built.

    How charts work →

    proposed · approved · verified · revertable

Apply for beta → Twenty seats. Bring the question you dread most.
  1. 01You
  2. 02Your fleet
  3. 03Fit
Who should we write back to?

Takes about two minutes.