Cloudflare for SaaS

8/1/2025

This post details a vulnerability in the older SSL for SaaS v1 (Managed CNAME) product, where IP-based routing and lack of domain ownership verification allowed for potential Man-in-the-Middle attacks. It explains the architectural difference between v1 and the newer Cloudflare for SaaS v2, highlighting how v2's verified custom hostname model with hostname verification and pre-validation closes this security gap. Compensating controls like an allowlist and WAF custom rules are implemented for remaining v1 users, and the post emphasizes the ongoing migration to the secure, validated v2 model.

9/21/2022

This post announces the General Availability (GA) of Workers for Platforms for Cloudflare Enterprise customers. It introduces two key new components: Dispatch Workers, which act as an entry point for platform customers to route requests to end-developer code, and User Workers, which are deployed by end-developers to customize SaaS applications. It also highlights the removal of the script limit for these customers and introduces Dynamic Dispatch Namespaces, a mechanism for Dispatch Workers to call User Workers without explicit pre-definition, addressing limitations of Service Bindings in this context. The post provides code examples for Dispatch Worker configuration and User Worker upload, along with a link to an example application and developer documentation.

8/9/2022

This post announces the launch of a new, dedicated section in the Cloudflare Developer Docs specifically for Cloudflare for SaaS. The new documentation is organized into six main categories and includes detailed guides for various configurations and product integrations, such as WAF for SaaS, Regional Services for SaaS, Early Hints for SaaS, Cache for SaaS, Argo Smart Routing for SaaS, and migrating custom hostnames. It aims to bridge the gap in understanding and using the full capabilities of Cloudflare for SaaS by providing clearer organization and more in-depth product guides.

3/22/2022

This post introduces the capability for SaaS providers to deploy mutual TLS (mTLS) authentication on their customers' domains through Cloudflare for SaaS and Access. It explains the concept of mTLS, its benefits for SaaS providers (e.g., payment processors), and how to configure it by setting up custom hostnames and Access policies. This extends Zero Trust security to domains managed by SaaS providers on behalf of their customers.

3/15/2022

Introduced WAF for SaaS, enabling SaaS providers to create and deploy distinct WAF rule sets for their customers. This is facilitated by associating custom metadata (e.g., 'security_level') with custom hostnames, which can then be leveraged within the Ruleset Engine to trigger specific security product configurations like WAF, Firewall Rules, and Advanced Rate Limiting. Also announced a free tier for Cloudflare for SaaS (100 custom hostnames) and reduced custom hostname pricing to $0.10/month.

1/26/2022

This post details an incident where a product migration for Cloudflare for SaaS resulted in 24 hostnames being incorrectly proxied to the clickfunnels.com origin. The root cause was identified as a bug in the migration process that erroneously moved 'blocked' hostnames to an 'active' state. Procedural and technical follow-ups were implemented, including: no more blocked hostname overrides, explicit customer validation for blocked hostnames during migration, additional monitoring for migrated hostnames and www.cloudflare.com, and staging hostname activations on non-production elements before production promotion.

10/22/2021

This post announces the general availability of Cloudflare for SaaS, making it accessible to all customers. It details the core components of the offering, including SSL for SaaS, Workers, Argo Smart Routing, Custom Hostnames, WAF, and Bot Management. The pricing model is clarified, with Custom Hostnames costing $2 per month and only being charged for active customers. Examples of successful implementations with mmm.page and Lightfunnels are provided, highlighting the use of Workers and Custom Hostnames for domain and SSL management, performance optimization, and cost reduction.

9/8/2021

Introduced Custom Hostname Analytics for Cloudflare for SaaS, enabling SaaS providers to offer traffic analytics to their end customers. This includes visibility into request volume, data transfer, and geographic distribution per custom hostname. The post highlights the use of the GraphQL Analytics API with the `clientRequestHTTPHost` field for building custom dashboards and extending existing analytics datasets (like Bot Management) to custom hostnames.

9/7/2021

This post introduces several new features and enhancements for Cloudflare for SaaS and SSL for SaaS, primarily for Enterprise customers. Key additions include Apex Proxying (providing dedicated IPs for SaaS providers to offer to their customers for apex domain proxying), Bring Your Own IPs (BYOIP) integration for more granular IP allocation to customers, Custom Origin Support (allowing different custom hostnames to be routed to different origins), and Wildcard Support for Custom Hostnames (enabling wildcard certificates for subdomains). For TLS management, CSR support and the ability for customers to upload their own certificates are now available. Custom Metadata and Workers allow for per-hostname configuration customization.

4/15/2021

This post announces the rebranding of 'SSL for SaaS' to 'Cloudflare for SaaS' and its availability to all customers. It highlights the expansion of the service beyond SSL certificate management to include DDoS mitigation, WAF, and bot management, allowing SaaS providers to extend these benefits to their customers. The post also emphasizes the synergy with Cloudflare Workers, simplifying infrastructure management for SaaS companies. It showcases examples like Statusflare and PLUMA to illustrate the benefits of using Cloudflare for SaaS and Workers for building and scaling SaaS applications.

4/19/2017

Introduced 'SSL for SaaS' to enable SaaS providers to easily extend Cloudflare's benefits, including SSL certificates for HTTPS and HTTP/2, to their customers' custom domains. This is achieved via a single API call during the customer onboarding workflow, simplifying the process of provisioning hostnames, acquiring SSL certificates, and providing DDoS protection, CDN, and content optimization to customer-facing domains.