new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Cloudflare Workers · Wrangler · all subjects

out of scope

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Pay Per Crawl disable by URI pattern

You can disable Pay Per Crawl by URI pattern using Configuration Rules to offer free access to specific pages while charging for others.

Pay Per Crawl dynamic pricing

Dynamic pricing for Pay Per Crawl can be configured by having your origin return a crawler-price response header, or by using a Cloudflare Worker to set prices based on request properties.

cf-pay-per-crawl request header

When dynamic pricing is enabled, Pay Per Crawl adds a cf-pay-per-crawl request header to origin requests so your origin or Worker can determine the appropriate price.

Example Access policy for SSH application with SSO and MFA

You can create a self-hosted application in Access for ssh.testapp.local running on port 22, then build a policy that only allows engineers in your organization to connect after they pass an SSO/MFA check and are using a corporate device.

Cloudflare Access now supports all ports and protocols for private hostname applications

Cloudflare Access for private hostname applications can now secure traffic on all ports and protocols, removing the previous limitation that required HTTPS on port 443 with Server Name Indicator (SNI) support. As long as the application is reachable via a Cloudflare off-ramp, Zero Trust security controls such as single sign-on (SSO), multi-factor authentication (MFA), device posture checks, and variable session lengths can now be enforced on any private application, including non-HTTPS services like SSH, RDP, internal databases, and other protocols.

No configuration change required for HTTP private apps login flow

The change from Cloudflare One Client notification flow to browser-based login for plaintext HTTP private apps requires no configuration changes. The Cloudflare One Client is still required to route traffic to the private network but no longer manages the Access session for HTTP apps.

Non-HTTP protocols still use Cloudflare One Client notification flow

Other non-HTTP protocols (SSH, RDP, arbitrary TCP/UDP) continue to use the Cloudflare One Client notification flow for authentication.

Plaintext HTTP private apps now use browser-based login

Cloudflare Access now uses the standard browser-based login flow for private applications served over plaintext HTTP on port 80. Previously, these apps fell back to the same session flow used for SSH, RDP, and other non-HTTP protocols, requiring users to handle an 'Authentication required' pop-up from the Cloudflare One Client before opening a browser to log in. Now users see the Access login page directly in the browser.

HTTP private apps receive standard Access application tokens

When users successfully log in to plaintext HTTP private apps, they now receive a standard Access application token, bringing the HTTP experience in line with HTTPS apps that have Gateway TLS decryption enabled.

Give your agent this brain

out of scope — Cloudflare Workers · Wrangler