OneLineShield

What we check, and what we do not

This page is a contract, not a brochure. Every item below maps to one file in the code that runs it, on a schedule, against your website. Changing what we check without changing this page turns our own test suite red, which is the entire point of writing it this way.

The 6 checks running today

All of them run every ten minutes, on every website in your account. Two of them stay quiet until Cloudflare confirms your website is behind the shield, and say so, because an origin server that answers or a hostname that does not resolve tells us nothing about your security before that point.

  • Protection status

    Running now
    What we look at
    Whether Cloudflare reports your hostname as active, and whether the certificate for it has finished being issued. We need both before we call anything protected.
    How often
    Every ten minutes, and every five seconds while you are watching the setup screen.
    Why it matters
    This is the only check allowed to turn the word protected on. Nothing in our own code can set it: the answer comes back from Cloudflare, or it does not happen.
    If something is wrong
    We show your two DNS records again, with the exact value each one needs, and keep asking. Most of the time one of them simply has not spread yet.

  • Security certificate

    Running now
    What we look at
    The expiry date Cloudflare reports for the certificate that keeps your visitors on HTTPS.
    How often
    Every ten minutes.
    Why it matters
    An expired certificate does not slow a website down, it replaces it. Visitors get a full page browser warning where your homepage used to be.
    If something is wrong
    We warn once fewer than 14 days are left, because renewal normally happens around thirty days out. Check the renewal record below first: a renewal that failed is almost always the cause, not the certificate itself.

  • Origin server exposure

    Running now
    What we look at
    We call your real server from outside Cloudflare and record the status code it gives back. HTTPS first, and only if that stays completely silent do we spend a second request on plain HTTP, because a server open on port 80 is silent on 443.
    How often
    Every ten minutes, once your website is behind the shield. Before that we say we cannot tell: a server that answers the whole internet is the normal state of a website that has not been put behind anything yet, not a finding.
    Why it matters
    The product rests on traffic reaching Cloudflare first. If your server still answers people who skip that step, nobody has to get through the shield. They walk around it.
    If something is wrong
    Tell your server, or your hosting firewall, to accept traffic only from Cloudflare address ranges. Moving to a new address is not the fix: old addresses stay in public DNS history.

  • Certificate renewal record

    Running now
    What we look at
    Whether the delegation record on _acme-challenge for your hostname still points at Cloudflare. One public DNS query.
    How often
    Every ten minutes.
    Why it matters
    This is the quietest failure we know of. Delete this record and nothing happens today, or next week. Months later the certificate cannot renew itself, and your website answers with a security warning instead of a page.
    If something is wrong
    We show the record again, with the exact value it needs. It is one line in your DNS panel, and it takes effect on the next renewal attempt.

  • CNAME record

    Running now
    What we look at
    Whether your hostname still points at our gateway. One public DNS query, the same one anyone can run against your domain.
    How often
    Every ten minutes.
    Why it matters
    Move DNS provider, or tidy up a record that looks unused, and from that second your traffic goes straight to your server. The website keeps loading, so nothing looks wrong.
    If something is wrong
    We stop saying you are protected in the same sweep that notices, and show the record that needs to go back. A green badge over a website that is no longer behind anything is the one thing this product must never do.

  • Website reachability

    Running now
    What we look at
    One request to your website over HTTPS, loaded the way a visitor would load it, and the status code that comes back.
    How often
    Every ten minutes, once your website is behind the shield. While it is still being set up, not reachable through the gateway is the expected answer, not a fault.
    Why it matters
    The other checks each look at one piece of the path. This one walks the whole path: your DNS, the Cloudflare edge, your server. Every piece can look fine and people still cannot open your website.
    If something is wrong
    A 5xx answer, or no answer at all, points at your server. A 4xx is reported as something to look at, with the code, and does not count as unreachable: a 4xx is proof the request arrived and something answered it.

Your dashboard lists all 6 every time, including the ones that passed, each with the time we last looked. A security product that only speaks up when something is wrong is indistinguishable from one that stopped running.

What a result can say

Four answers, and the fourth is the one worth reading twice.

Fine
We looked, and there was nothing to report.
Worth a look
Something is drifting, but nothing is broken yet. A certificate with thirteen days left lands here, and so does a 4xx answer from your website.
Needs attention
We measured something that is wrong right now, and the item tells you what to do about it. A finding we cannot measure is not a finding, so we do not raise one.
Not determined
We could not find out this time, and we always say why. A Cloudflare request that timed out, a DNS answer that came back empty, or a check waiting for your website to be behind the shield all land here. It never quietly becomes a pass.

A missing answer is not a good answer. When we cannot measure something we say so, with the reason and the time of the last real result, instead of showing you a stale green tick.

Not running yet

These are on the list. None of them run today, none of them feed anything above, and we are not putting a date on them. When one starts running it moves into the list above in the same change that ships it.

  • Security headers on your server

    Not running yet

    Whether your server sends the headers that stop other sites framing your pages or downgrading your visitors to HTTP. We can read them. We do not read them today.

  • Redirect from HTTP to HTTPS

    Not running yet

    Whether someone who types your address without the s ends up on the secure version rather than staying on the plain one.

  • Unusual traffic detection

    Not running yet

    Telling a busy day apart from something worth worrying about. This one is hard to do honestly, which is exactly why it is not on the list above.

Three things we do not do

A list of what we check is only half a contract. Here is the other half.

  • We do not run a firewall of our own. The filtering belongs to Cloudflare, it applies at the zone level, and it is the same for every website here. Per hostname firewall rules are an Enterprise feature on their side, not something one of our plans unlocks. We do not sell a stronger wall.
  • We do not read your website. A check keeps the status code it got, the DNS value it found, the value it expected, how long the request took, and the time it looked. That list is enforced in code, and the contents of your pages have no field to go in.
  • We do not scan your application for malware or for holes in the code you wrote. Nothing here looks inside what you built.