Cloudflare integration

Cloudflare's global network, free TLS, instant DDoS protection and Workers runtime are an excellent match for a serverless SaaS. It is fast, secure and very cost-effective.

Not for basic hosting. You only need a Cloudflare account if you want to manage your own DNS, WAF rules or Workers alongside the platform.

Settings, Integrations, Cloudflare. Authorize with an API token scoped to DNS Edit and Zone Read on the domains you want managed.

Yes if you want one place to manage DNS, security and caching. Move nameservers per the registrar's instructions; the platform reads your zone afterwards.

For traffic served by Blanca's Builder, leave it grey-cloud (DNS only). The platform already runs on Cloudflare's edge so double-proxying adds latency.

Yes. Cache rules at your zone level take effect alongside the platform's defaults. Be careful not to cache HTML aggressively or you can break personalised content.

Page Rules are being replaced by Configuration Rules and Cache Rules. Both work with Blanca's Builder; for new setups prefer the modern rule sets.

Yes. The free Managed Ruleset is enough for most sites. Pro WAF adds OWASP Top 10 protection and bot challenges, useful for high-traffic public sites.

Yes. Deploy them at a sub-path or hostname. Common uses are custom auth, A/B testing or stitching content from multiple origins.

Tunnels are useful for self-hosted origins. Blanca's Builder projects already run on the edge so a tunnel is rarely needed.

Yes, via S3-compatible APIs. R2 has no egress fees, which is attractive for large media. Most projects use Supabase Storage for tight integration with auth and RLS.

Optional. Blanca's Builder already serves AVIF/WebP via Cloudflare Polish. Cloudflare Images adds storage and on-the-fly resizing if you do not want a separate origin.

Yes. Cloudflare's Web Analytics dashboard works alongside the platform's first-party analytics. Both are privacy-friendly and cookie-free.

Yes. Add a Cloudflare Access policy to any subdomain (typically staging or admin) to require SSO before users reach the site.

Yes. Turnstile is the recommended CAPTCHA replacement and is built into the platform's form components. Bring your own keys from your Cloudflare dashboard.

No. The free Cloudflare plan covers DNS, basic WAF and DDoS for most sites. Upgrade if you need image optimization, advanced WAF or higher rate limits.

Check Security Events, find the request and either set a custom rule to allow it or whitelist the IP. Tune sensitivity per route rather than across the whole site.

Yes for public marketing sites — it stops cheap scrapers. Disable for routes that legitimate bots (Stripe webhooks, monitoring) must reach.

No. Sites run on Cloudflare Workers with full SSR. Pages is great for static sites; Workers gives us SSR plus serverless APIs in one runtime.

For typical small-to-mid traffic, yes — egress is free and edge compute is per-request. For very large traffic the calculation depends on your usage profile.