Cloudflare traffic, caching, and security as readings you can watch
Requests, cache hit rate, threats blocked, and the TLS settings you configured once and never checked again.
Get early access to the Cloudflare integration
dev-views is in active development. Join the waitlist and we will note your interest in Cloudflare.
Cloudflare is infrastructure you configure once and then stop looking at, which is precisely why it is worth a tile. A zone left in development mode bypasses caching entirely. A zone accidentally paused sends every request straight to your origin with no cache and no WAF. Neither announces itself; both cost real money and real latency.
dev-views reads one zone through the Cloudflare API: traffic and bandwidth over 30 days, how much of it the edge cache absorbed, what the WAF stopped, and the security settings currently in force. The three permissions it needs are all read — a token built as the connect screen describes cannot change a single setting.
What dev-views reads from Cloudflare
27 readings, computed from the Cloudflare API. There are no defaults — you choose which become tiles and in what order, because guessing which of 27 matters to you would be wrong for most people.
Cache hit rate
The share of requests served from Cloudflare's edge rather than your origin, with cached bandwidth beside it. This is the number that explains an origin bill.
Threats blocked, 30 days
Requests Cloudflare stopped before they reached your origin, with a same-day figure alongside it.
Development mode
When on, caching is bypassed entirely. It expires after three hours, but three hours of uncached traffic is plenty to notice on a bill.
Cloudflare paused
When a zone is paused, traffic bypasses Cloudflare completely: no cache, no WAF, nothing. A reading rather than a setting you have to remember to check.
SSL mode
How Cloudflare connects to your origin. Full (strict) is the safe setting, and anything else is worth knowing about deliberately rather than by accident.
The full list
- Requests, 30 days
- Requests, 7 days
- Requests today
- Page views, 30 days
- Unique visitors, 30 days
- Bandwidth, 30 days
- Cached requests, 30 days
- Cache hit rate
- Cached bandwidth, 30 days
- Bandwidth saved
- Development mode
- Threats blocked, 30 days
- Threats blocked today
- Security level
- Encrypted requests
- SSL mode
- Minimum TLS version
- Always use HTTPS
- Automatic HTTPS rewrites
- HTTP/3
- Brotli
- Zone status
- Cloudflare paused
- Plan
- DNS records
- Zone type
- Added
How the connection works
- 01In Cloudflare, create a custom API token under My Profile → API Tokens.
- 02Grant exactly three permissions and nothing else: Zone → Zone → Read, Zone → Analytics → Read, and Zone → DNS → Read.
- 03Paste the token into dev-views, which verifies it against the Cloudflare API before storing it.
- 04Pick the zone to watch, then choose which of the 27 readings become tiles.
- Credential
- A API token (40 characters), created under My Profile → API Tokens.
- Watches
- One zone, chosen after connecting.
- Refresh
- Every 60 seconds, cached per user so browsing does not re-spend your API budget. A manual refresh forces a read immediately.
- Storage
- Encrypted with AES-256-GCM before it is stored. The encryption key lives in the environment, never in the database, and the credential is never sent back to the browser.
Read-only is enough
Grant these and nothing else. A credential scoped this way cannot change anything, whatever software is holding it.
- Zone → Zone → Readzone status, plan, type, and pause state
- Zone → Analytics → Readrequests, bandwidth, cache, and threats
- Zone → DNS → Readthe record count for the zone
What your dashboard shows
- Traffic and caching read together, so a request count means something: 400,000 requests at a 92% hit rate is a very different bill from the same count at 40%.
- Configuration treated as data rather than settings — development mode, pause state, SSL mode, and minimum TLS version are readings you can put on a board.
- A paused zone or a bypassed cache raised in the attention band above the dashboard, because those are exactly the states nobody thinks to go looking for.
Who this is for
- Solo developers fronting a site or API with Cloudflare who want cache effectiveness visible rather than assumed.
- Anyone who has left development mode on and discovered it from an origin bill.
- Developers who configured SSL mode and minimum TLS once and would like ongoing confirmation that it is still what they set.
Cloudflare questions
Which Cloudflare metrics does dev-views track?
Twenty-seven readings for one zone: traffic as requests over today, 7 days, and 30 days plus page views, unique visitors, and total bandwidth; caching as cached requests, hit rate, cached bandwidth, bandwidth saved, and whether development mode is on; security as threats blocked over 30 days and today, the configured security level, and the share of requests arriving over HTTPS; TLS configuration including SSL mode, minimum TLS version, Always Use HTTPS, automatic HTTPS rewrites, HTTP/3, and Brotli; and zone facts covering status, pause state, plan, DNS record count, zone type, and when it was added.
What permissions does the Cloudflare token need?
Three, all read: Zone → Zone → Read, Zone → Analytics → Read, and Zone → DNS → Read. Cloudflare's tokens are properly scopable, so rather than asking you to trust that dev-views only reads, the connect screen names the exact three to grant. A token built that way cannot change a single setting on your account, whatever software is holding it.
How far back does the analytics data go?
Thirty days, which is the window the traffic, caching, and threat readings describe. Shorter figures — requests today, threats blocked today — are counted from midnight UTC.
Why track TLS settings on a dashboard?
Because they are set once and then invisible. An SSL mode quietly on Flexible instead of Full (strict), or a minimum TLS version older than you intended, produces no error and no alert — it simply stays wrong. Reading them alongside traffic makes the configuration something you notice rather than something you assume.
Can I watch more than one zone?
One zone per connected token. The stored scope is a single zone, and the traffic, caching, and security readings are all computed against it.
Works alongside
dev-views is most useful when more than one service is on the board. These are the ones people connect next to Cloudflare.
Watch Cloudflare alongside the rest of your stack
One read-only surface for every service you run. Join the waitlist for early access.