Skip to main content
Cloudflare sits in front of all traffic to PensionsPortal.ie, providing DDoS mitigation, WAF rule enforcement, and Zero Trust access controls for administrative infrastructure.

​
Architecture

All DNS for PensionsPortal.ie is managed through Cloudflare. Cloudflare acts as a reverse proxy — the true Vercel origin IP addresses are not publicly disclosed.

​
Web Application Firewall (WAF)

​
Managed Rulesets

Cloudflare’s managed WAF rulesets are enabled: Managed rulesets are updated automatically by Cloudflare as new threats emerge — no manual intervention required.

​
Custom WAF Rules

Custom rules are configured for the application’s specific risk profile:

​
Bot Management

Cloudflare Bot Management scores every request. Requests with a bot score below the configured threshold are either challenged (JS Challenge) or blocked. Verified bots (Googlebot, etc.) are allowed through.

​
DDoS Protection

Cloudflare’s DDoS protection is always-on at the network layer (L3/L4) and application layer (L7). Volumetric attacks are absorbed at Cloudflare’s edge before reaching Vercel. No additional configuration is required.

​
Cloudflare Zero Trust

Cloudflare Zero Trust (Access) is used to protect administrative access to infrastructure dashboards — these systems are not accessible from the public internet without Cloudflare Access authentication.

​
Protected Resources

​
Access Policy Structure

Access tokens are short-lived. Sessions expire after 8 hours of inactivity.

​
TLS Configuration

Cloudflare enforces:
  • Minimum TLS version: TLS 1.2
  • TLS mode: Full (Strict) — origin certificate validation is enforced
  • Automatic HTTPS Rewrites: enabled — HTTP requests are upgraded to HTTPS
  • HSTS: enabled via application headers (see Security Headers)

​
Cloudflare Tunnel (Optional)

For origin server protection, a Cloudflare Tunnel (cloudflared) can be used to connect Vercel to Cloudflare without exposing a public IP. In the current deployment, Vercel’s edge network serves as the origin and Cloudflare proxies via DNS.

​
Monitoring

Cloudflare Analytics provides:
  • Real-time WAF block events and rule match details
  • Bot score distribution
  • Origin error rates (5xx responses from Vercel)
  • Bandwidth and request volume trends
Alerts are configured in Cloudflare for:
  • Spike in WAF block rate (possible attack)
  • Origin error rate exceeding 5% (application health issue)
  • DDoS attack detection