Skip to content

STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/use-cases/web-apps/security/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/use-cases/web-apps/security/. For this product's page index use https://developers.cloudflare.com/use-cases/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. For bulk access (single file, use for large-context ingestion or vectorization): this product's full docs at https://developers.cloudflare.com/use-cases/llms-full.txt. All Cloudflare docs at https://developers.cloudflare.com/llms-full.txt.

Cloudflare Docs

Docs Directory APIs SDKs

Secure your application

Web applications face threats at every layer: unencrypted traffic, injection attacks, DDoS floods, credential stuffing bots, and malicious third-party scripts. Cloudflare provides defense in depth from automatic SSL/TLS encryption through application security, DDoS protection, bot scoring, and client-side script monitoring.

Solutions

SSL/TLS

Encrypt all traffic with free, automatic SSL certificates. Learn more about SSL/TLS.

Automatic HTTPS - Free Universal SSL certificates provisioned and renewed automatically

Application security

Get automatic protection from vulnerabilities and create your own custom rules. Learn more about Application security.

Attack protection - Application security's managed rulesets block SQL injection, Cross-Site Scripting (XSS), and Open Web Application Security Project (OWASP) Top 10 vulnerabilities

DDoS protection

Automatic mitigation of volumetric and application-layer DDoS attacks. Learn more about DDoS protection.

DDoS mitigation - Always-on layer 3/4 and layer 7 Distributed Denial of Service (DDoS) protection included at no extra cost

Bot security

Machine learning powered bot detection with granular control over bot traffic. Learn more about Bot security.

Bot defense - Stop credential stuffing and content scraping with ML-powered bot scoring

Turnstile

Privacy-preserving CAPTCHA alternative for forms and user interactions. Learn more about Turnstile.

Form protection - Privacy-preserving CAPTCHA alternative for login and signup forms

Client-side security

Monitor and control third-party scripts and outbound connections on your pages. Learn more about Client-side security.

Script security - Detect and block malicious third-party JavaScript injections

Get started