Cloudflare

For sites behind Cloudflare: blocked IPs are stopped at Cloudflare's edge, before they reach your server.

Set up

Each connector walks you through it on Blocking → Set up Cloudflare, and ticks each step off as it's done.

1. Create a token. In Cloudflare, open My Profile → API Tokens, then Create Token → Create Custom Token. It needs two permission policies:

   Policy	Scope	Search for	Tick	Access
   1	Specified Domains → the site's domain	zone waf	Zone WAF Rules (under App Security)	Edit
   1		zone	Zone (under DNS & Zones)	Read
   2	Entire Account (Add policy, then pick it)	lists	Account Rule Lists (under Rules & Configuration)	Edit

   Copy the token when it's created: Cloudflare only shows it once. Account-owned tokens, from Manage account → Account API Tokens, work too.

2. Set it in the site's environment: PORRO_CLOUDFLARE_TOKEN=…. The token stays in the environment, never the database.

3. Connect. Press Connect to Cloudflare on the setup page, or run:

connect finds the zone serving the site (or PORRO_CLOUDFLARE_HOST), creates or reuses the account's porro_blocklist IP list, and adds one custom rule blocking that list next to your existing rules, never replacing them. Then it syncs.

How it stays in sync

• After every change on the Blocking page, in the background, so whoever blocked doesn't wait.
• On the scheduled task or cron, which also drops expired blocks.
• Only production syncs, and only to the zone it connected to, so a local or staging copy with the live .env can't push its list.

One list for every site

Cloudflare keeps IP lists per account, not per domain, so porro_blocklist is shared by every site you connect on the account. An IP blocked on one of them is blocked on all of them. Sites that mustn't share blocks, such as different clients, need their own Cloudflare accounts.

Each site only adds and removes items tagged with its own id, and an address another site already blocked is left alone. The Blocking page shows how many of yours were already blocked by other sites.

To see the list, go to Manage account → Configurations → Lists → porro_blocklist in Cloudflare (it's account-level, so it isn't under a domain). The rule is on each domain under Security → Security rules, named "Porro blocklist".

Commands

Better IP details too

With a token set, IP details show the network from Cloudflare: Cloudflare IP Intelligence when the token also has Account → Intel → Read, otherwise Cloudflare Radar.