aioflare

Manage Zone Security & Performance Settings

aioflare lets you view and change common Cloudflare security and speed settings for each zone — without opening the Cloudflare dashboard for every tweak. This guide explains how to open zone settings, what you can change, and what is view-only or managed elsewhere.

How to open zone settings

Two quick ways from the Zones page

  1. Go to the Zones page

    Open Zones from the sidebar. Find the domain (zone card) you want to manage.

  2. Open the zone sheet — option A: click the zone name

    Click the domain name on the zone card (under the account email). This opens the zone settings sheet as an overlay.

  3. Open the zone sheet — option B: use the menu

    Click the three dots (⋯) on the top-right of the zone card, then choose Settings. This opens the same zone settings sheet.

  4. Open Security or Performance

    In the zone sheet, use the tabs at the top. Choose Security for HTTPS, TLS, and protection settings. Choose Performance for caching, protocols, and speed options.

  5. Load current values if needed

    If settings look empty, click Fetch Details at the top of the sheet. aioflare will load the latest values from Cloudflare.

Before you change anything

A short checklist so settings load and save correctly

  • Unlock encryption in aioflare if prompted — settings are stored securely and need your session unlocked.
  • Use Fetch Details once when you first open Security or Performance so aioflare syncs values from Cloudflare.
  • Read the short explanation on sensitive options (for example SSL/TLS mode) before confirming a change.

Configurable vs read-only — at a glance

Three simple categories

Not every Cloudflare setting works the same way in aioflare. Some you can turn on or off directly. Some are shown for information only because Cloudflare no longer allows changes through the API. Advanced firewall features are managed only in the Cloudflare dashboard.

You can change

Toggle or dropdown — saved to Cloudflare when you confirm.

View only

Shown for reference; the control is disabled or has no effect.

Cloudflare dashboard

Not available in aioflare — use dash.cloudflare.com for full control.

Security tab

HTTPS, TLS, attack protection, and browser security

Settings you can change

  • SSL/TLS encryption mode — Choose Automatic, Full (Strict), Full, Flexible, or Off. Affects how HTTPS works between visitors, Cloudflare, and your server.
  • Always Use HTTPS — Redirects HTTP visitors to HTTPS.
  • Automatic HTTPS Rewrites — Rewrites insecure http:// links in HTML to https://.
  • Opportunistic Encryption — Tells browsers your site supports encryption via Alt-Svc headers.
  • Minimum TLS version — Sets the oldest TLS version still allowed (1.0 through 1.3).
  • TLS 1.3 — Enables the newer, faster TLS version.
  • I'm Under Attack mode — Shows a challenge page to all visitors during an active attack. Turn off when the attack ends.
  • Bot Fight Mode — Challenges obvious automated bots. May affect monitoring or API clients.
  • Challenge Passage TTL — How long a visitor who passed a challenge can browse without being challenged again.
  • WAF (Web Application Firewall) — Turns managed WAF protection on or off. Requires a paid Cloudflare plan.
  • Browser Integrity Check — Blocks requests with headers often used by spam bots.
  • Email Address Obfuscation — Hides plain email addresses in HTML from scrapers.
  • Hotlink Protection — Stops other websites from hotlinking your images.

View only in aioflare

  • Security level (Always protected) — Cloudflare now protects zones automatically. The old Low / Medium / High slider is gone — aioflare shows the current status only.
  • Privacy Pass Support — Deprecated by Cloudflare. Shown for reference; changes have no effect.

Only in Cloudflare dashboard

  • Managed WAF rulesets (OWASP, Cloudflare Managed) — Configure in Cloudflare under Security → WAF.
  • Custom firewall rules — Create and edit in Cloudflare under Security → WAF → Custom rules.
  • Rate limiting rules — Managed in the Cloudflare dashboard, not in aioflare.
  • IP Access / allow & block lists — Managed in the Cloudflare dashboard under Security.

Performance tab

Caching, protocols, compression, and image optimization

Settings you can change

  • Caching level — Standard, No Query String, or Ignore Query String — controls how URLs are cached.
  • Browser Cache TTL — How long visitors' browsers keep cached files.
  • Always Online — Serves a cached copy if your origin server is down.
  • HTTP/3 (QUIC) — Faster connections over QUIC where supported.
  • 0-RTT Connection Resumption — Reduces latency on repeat visits; use with care for non-idempotent requests.
  • WebSockets — Required for real-time apps (chat, live updates).
  • Pseudo IPv4 — Adds a header so IPv6-only origins can log IPv4-style addresses.
  • Early Hints (103) — Lets browsers preload resources sooner. Still experimental on some browsers.
  • Rocket Loader — Loads JavaScript asynchronously. Legacy feature — may break strict script order.

Paid plan required

  • Polish (image optimization) — Compresses images at the edge. Needs Cloudflare Pro, Business, or Enterprise.
  • Image Resizing — Resize images via URL parameters. Needs a paid Cloudflare plan.

View only in aioflare

  • HTTP/2 — Managed automatically by Cloudflare. You cannot turn it off in aioflare.
  • Brotli compression — Always on for all zones since 2024. Read-only here; use Compression Rules in Cloudflare for advanced control.

Deprecated — shown but may not work

  • Auto Minify (CSS, HTML, JavaScript) — Cloudflare removed this from the dashboard. Toggles may still appear but changes often have no effect.

Saving changes safely

What happens when you edit a setting

  • Important changes (for example SSL/TLS mode) show a confirmation dialog with a short explanation before they are sent to Cloudflare.
  • After you confirm, aioflare updates the setting through the Cloudflare API. A spinner shows while the save is in progress.
  • Use the orange Cloudflare path badge under each row to double-check the same setting in the official Cloudflare dashboard.

Cloudflare dashboard badges

How to verify a setting in Cloudflare

Each row can show a small orange badge such as SSL/TLS → Edge Certificates. That is the menu path in the Cloudflare dashboard where you can verify the value matches what you see in aioflare.

Frequently asked questions

Common questions about zone Security and Performance

Why do I need Fetch Details?
aioflare loads zone settings on demand to save API calls. Fetch Details pulls the latest Security and Performance values from Cloudflare into the zone sheet.
Why is a setting read-only?
Cloudflare removed or locked some options (for example Brotli, HTTP/2, Privacy Pass). aioflare still displays them so you know the current state, but the API no longer accepts changes.
Why can't I enable WAF or Polish?
Some features need a paid Cloudflare plan on that zone. aioflare shows the control but keeps it disabled until your zone plan supports it.
Will changes affect my site immediately?
Yes — most settings apply as soon as Cloudflare accepts the update. For risky options like SSL/TLS mode, read the warning in the confirmation dialog first.

See also: How to Manage Redirect Rule