Cloudflare for SaaS

11 posts · Apr 2017 – Aug 2025

What this trail covers

Cloudflare for SaaS has evolved to be available to all customers, not just Enterprise. This solution provides SaaS providers with a unified platform to extend Cloudflare's network benefits, including performance, security (DDoS mitigation, WAF, Bot Management), and SSL certificate management, to their end customers. It integrates with Cloudflare Workers, allowing SaaS companies to focus on core product development while Cloudflare handles infrastructure, security, and performance at the edge. The deprecation of SSL for SaaS v1 (Managed CNAME) is nearing completion, with remaining customers being migrated to the more secure and validated Cloudflare for SaaS v2 model, which uses verified custom hostnames and eliminates IP-based routing risks.

All Cloudflare trails

Aug 2025Vulnerability disclosure on SSL for SaaS v1 (Managed CNAME)This post details a vulnerability in the older SSL for SaaS v1 (Managed CNAME) product, where IP-based routing allowed for potential Man-in-the-Middle attacks if combined with DNS poisoning and an origin-side vulnerability. The vulnerability was discovered through the bug bounty program. The mitigation and evolution to Cloudflare for SaaS v2 is highlighted, which uses verified custom hostnames and eliminates the IP-based routing risk. Compensating controls have been implemented for remaining v1 users, and new accounts cannot configure v1.
Sep 2022The easiest way to build a modern SaaS applicationThis post announces the General Availability (GA) of Workers for Platforms for Cloudflare Enterprise customers. It introduces two key new components: Dispatch Workers, which act as an entry point for platform customers to route requests to end-developer code, and User Workers, which are deployed by end-developers to customize SaaS applications. It also highlights the removal of the script limit for these customers and introduces Dynamic Dispatch Namespaces, a mechanism for Dispatch Workers to call User Workers without explicit pre-definition, addressing limitations of Service Bindings in this context. The post provides code examples for Dispatch Worker configuration and User Worker upload, along with a link to an example application and developer documentation.
Mar 2022Zero Trust for SaaS: Deploying mTLS on custom hostnamesThis post introduces the ability for SaaS providers to enable mutual TLS (mTLS) authentication on custom hostnames managed through Cloudflare for SaaS, leveraging Cloudflare Access. Previously, mTLS was only available for domains owned directly by customers. This new capability allows SaaS providers to configure Root CAs for each customer's API endpoints and issue client certificates, enforcing Zero Trust policies for sensitive services like payment processing. The setup involves configuring Cloudflare for SaaS with custom hostnames and then adding mTLS authentication within the Cloudflare for Teams dashboard.
Mar 2022Security for SaaS providersIntroduces WAF for SaaS, allowing Enterprise customers to create and deploy different sets of WAF rules for their customers, enabling segmentation based on security requirements. Also announces a Free tier of Cloudflare for SaaS for Free, Pro, and Biz plans, providing 100 custom hostnames free of charge, and lowers the custom hostname price from $2 to $0.10 per month. Details the process of setting up WAF for SaaS through custom hostname definition, associating custom metadata, and triggering security products based on this metadata.
Jan 2022Incorrect proxying of 24 hostnames on January 24, 2022This post details an incident where a product migration for Cloudflare for SaaS erroneously activated blocked hostnames, redirecting traffic for 24 hostnames, including www.cloudflare.com, to the clickfunnels.com origin. The root cause was identified as an issue in the migration process that incorrectly transitioned blocked hostnames to an active state. Procedural and technical follow-ups were implemented, including stricter validation for blocked hostname activations, enhanced monitoring during migrations, and staging hostname activations on non-production elements.
Advertisement
Oct 2021Cloudflare for SaaS for All, now Generally Available!This post announces the general availability of Cloudflare for SaaS, making it accessible to all customers regardless of size. It details the core components of the offering, mapping SaaS provider responsibilities (origin server setup, encryption, uptime, performance, vanity domains, security, scaling, analytics) to specific Cloudflare products (Workers, SSL for SaaS, Anycast network, Argo/Cache, Custom Hostnames, WAF/Bot Management). It also introduces a per-Custom Hostname pricing model ($2/month) and highlights early customer adoption with examples like mmm.page, Lightfunnels, and Ventrata, showcasing the use of Workers and Custom Hostnames for domain and SSL management.
Sep 2021Introducing: Custom Hostname AnalyticsThis post introduces Custom Hostname Analytics for Cloudflare for SaaS. It enables SaaS providers to offer their customers visibility into traffic analytics for their custom hostnames. This includes data transfer, geographic distribution, and bot protection insights, accessible via the Cloudflare Dashboard or GraphQL Analytics API using the `clientRequestHTTPHost` field. The goal is to allow SaaS providers to build custom dashboards for their customers, showcasing the benefits of Cloudflare's network.
Sep 2021What’s new with Cloudflare for SaaS?This post introduces several enhancements to Cloudflare for SaaS and SSL for SaaS for Enterprise customers. Key features include: Apex Proxying, which provides SaaS providers with dedicated IP addresses for customers to use as A/AAAA records at the apex of their domain; Bring Your Own IPs (BYOIP), allowing SaaS providers to use their own IP ranges for customer allocation; Custom Origin Support, enabling routing of specific custom hostnames to different origins; and Wildcard Support for Custom Hostnames, extending protection to subdomains. For TLS management, the post details CSR Support/Custom Certs, allowing SaaS providers to upload customer certificates or generate CSRs for custom CAs, and Custom Metadata with Workers for per-hostname behavior customization.
Apr 2021Announcing Cloudflare for SaaS for EveryoneThis post announces the expansion of Cloudflare for SaaS to all customers, previously only available to Enterprise. It rebrands 'SSL for SaaS' to 'Cloudflare for SaaS' to reflect its broader capabilities beyond just SSL certificate management. The post highlights how the service provides DDoS mitigation, WAF, and Bot Management to SaaS providers' customers, and leverages Cloudflare's Anycast network and caching for performance improvements. It also emphasizes the synergy with Cloudflare Workers, enabling SaaS companies to offload infrastructure management.
Apr 2017Introducing SSL for SaaSThis post introduces the 'SSL for SaaS' product, which allows SaaS providers to programmatically provision SSL certificates for their customers' custom hostnames. It details the customer onboarding flow, including CNAME setup, API calls for certificate issuance, and the benefits of using Cloudflare's edge for TLS termination, DDoS protection, and CDN. It also covers certificate renewal, reissuance, and the various Cloudflare benefits customers will enjoy.