Security

Tools → Security answers one question: am I protected? Open Tools in the left-hand menu. Security is the first tab.

The badge next to the title shows Protected, or Needs attention if something should be fixed. Click Check now to re-check at any time.

Protection overview

Card	What it tells you
Account access	Protected when two-factor authentication is on. Otherwise Action needed: see Signing in and MFA.
Website protection	Active when your domains are protected by Cloudflare, or Pending while they are being set up.
Security checks	Passed, or Review when there are urgent issues.

If something needs attention you’ll see a Protection gaps banner with a button that takes you to the fix. A Recommended banner lists urgent security updates for your applications. Click Review to open the application.

Cloud and threat protection

• Cloud protection shows how many of your domains meet the greneIT security baseline, with a progress bar. Review needed means fewer than 80% do.
• Threat protection shows threats blocked in the last 24 hours and how many IP addresses are blocked across your servers. Click View activity to see Monitoring.

Advanced stack protection

This section summarises Encrypted connections (should be Strict), Bot protection (should be Active) and Minimum security standard (should be TLS 1.3). Click Manage advanced settings to change them.

Cloudflare edge tab

• Cloudflare zones: each domain shows a badge such as Maximum baseline or N not at baseline. Expand a domain and click Apply greneIT baseline to restore the recommended settings. You can also turn Under Attack Mode on or off here.
• To lower a setting below the baseline, tick I accept the responsibility for making the changes below first. Only do this if a service you rely on needs it.
• Cloudflare WAF pack: a firewall rule set for WordPress sites. Click Apply WAF, or Update WAF pack when an update is available.

Server protection tab

Block an IP address

1. Under Threats & IP blocking, type the address in IP address to look up or block.
2. Click Lookup to see where it is from and how much traffic it has sent.
3. Click Block IP and confirm. You can also block addresses straight from the Top talkers list.

Allow only certain countries

1. Under GeoIP Blocking - App Level, find the server.
2. Enter the two-letter country codes that may visit, for example GB, FI, SE.
3. Switch Enabled on and click Save. Visitors from other countries see an “access denied” page.

The tab also has:

• WordPress checksum scans: run integrity scans. See WordPress tools.
• Origin firewall (Cloudflare only): makes your server accept web traffic only through Cloudflare’s protection.
• Server baseline scan: checks such as Automatic security updates and Fail2ban. Click Fix next to any check that fails.