CDN, WAF & Edge Security

Server Startup has been an official Cloudflare partner since 2019. We audit, migrate and run CDN, WAF and bot control, mostly for retail chains and e-commerce.

Let's review your Cloudflare

“Imagine an organization’s network as a castle and the network perimeter as a moat. Once the drawbridge is lowered and someone crosses it, they have free rein inside the castle grounds.”

— Cloudflare

We've worked with the Cloudflare platform since 2017, two years before Server Startup became an official partner. We audit, migrate and tune Enterprise and Business accounts.

Your Cloudflare is configured. Are you sure it's configured right? In many organizations nobody dares touch the WAF rules. They block something. Nobody remembers what.

We know why each rule is there, because we wrote them, we version them with Terraform, and we keep them running in production.

WAF ≠ security

A firewall is one part of security. The other is knowing who changed each rule and what it stopped today. We configure Cloudflare as architecture, with every switch on this panel in Terraform.

Security · serverstartup.ioACTIVE

Cloudflare PoPs300+

Workers · latency to the user≈50 ms

Rules without a reason0

WAF rules written for your businessCloudflare's managed rules as the base, tuned to your actual attack surface, with your business rules on top. OWASP Top 10, DDoS, bots.

Cache and CDNThe cache takes the traffic before it reaches your origin, and response times become predictable. Black Friday included.

Zero-downtime migrationsFrom Akamai or whatever you run today, without stopping the store.

Everything in TerraformThe whole configuration as code, versioned and reviewed. Nothing depends on anyone's memory.

Logic next to the userWorkers: we put the first ones into production in 2018, and this whole site runs on them.

Daily WAF reportEvery day you get a report: what the WAF stopped and which rule fired. And we handle the traffic, security and origin-health alerts.

“Set up by someone who left” modeOff since 2019. We wrote the rules and we maintain them.

Whoever configures it, maintains it

Once we set up Cloudflare, we keep running it: we watch the traffic, adjust rules as attack patterns change, and answer when something degrades. If a rule blocks legitimate traffic, we roll it back from its history in Terraform.

We've deployed Cloudflare for:

The platform doesn't end at CDN and WAF. Zero Trust, Access or Stream can come later; we help you decide which pieces fit, and which don't.

This very site runs on Workers, D1 and R2. We take it apart, piece by piece, in Deconstructing this website.

Let's talk, engineer to engineer.

Bring the problem as it is. You'll hear back from the person who'll write the code.

Tell us about your project