Network protection

Confirm the Worker custom domain

In Cloudflare, open Domains > your short domain > DNS > Records. Use the Worker Custom Domain record that Cloudflare creates for the short domain. It should appear as a proxied Worker record for the hostname, such as v8s.link -> v8s-link.

Remove legacy synthetic AAAA 100:: records for the same hostname once the Custom Domain is active. Keep mail, DKIM, DMARC, MTA-STS, and ownership verification records DNS-only unless the provider explicitly requires proxying.

Use the apex hostname as the only vanityURLs Worker hostname. If you publish www, create a proxied DNS record for www and redirect it to the apex in Cloudflare before the Worker. Use separate proxied records only for real web subdomains, such as mta-sts or a docs site.

Redirect www to the apex

In Cloudflare, open Domains > your short domain > Rules. Prefer Redirect Rules when available. If your zone already uses legacy Page Rules, a single forwarding URL rule is also fine for this hostname canonicalization because it runs before the Worker and stays outside the vanityURLs link registry.

Configure the redirect with these values:

Keep the www DNS record proxied so Cloudflare can receive the request and apply the redirect. Do not add www to the Worker custom domain or to the WAF/rate-limit expressions below unless you intentionally serve the Worker on both hostnames.

Set the HTTPS baseline

In Cloudflare, open Domains > your short domain > SSL/TLS > Overview. In Configure encryption mode, select Custom SSL/TLS, choose Full (Strict), then save. Cloudflare may show Automatic SSL/TLS (default) with a current applied mode such as Flexible before you make this change; that is the state to replace for a production Worker custom domain.

Then open SSL/TLS > Edge Certificates and review the options in dashboard order:

Enable baseline security controls

In Cloudflare, open Domains > your short domain > Security > Settings for the dashboard, bot, browser integrity, challenge, content-rewrite, and security.txt controls. The Settings page is long and includes filter chips and a search field. They are useful for finding a known setting, but this checklist follows the page order because the filters hide context and can make setup harder to audit. Custom expressions are covered in Add WAF rules below.

The free-plan security settings should stay boring and explicit. Turn on protections that reduce commodity abuse, but avoid features that alter public content or expose extra visitor data unless there is a clear need.

Cloudflare moves dashboard labels regularly. Review the Cloudflare Docs changelog and product changelogs, especially Rules and bot controls, when refreshing this page. Use the raw capture in data/cloudflare-protection-defaults.json to compare menu labels over time.

Add WAF rules

In Cloudflare, open Domains > your short domain > Security > Security rules > Security rules. To add a custom rule, use Create rule or the Show all rule types menu, choose Custom rules, enter the rule name, click Edit expression, paste one expression, choose the action, then deploy. For rate limiting, use the Rate limiting rules row instead.

Cloudflare security rules run before the Worker. Use them for traffic that should never reach application code.

The expressions below use v8s.link and intentionally scope to the apex hostname. Redirect www.v8s.link to the apex before the Worker instead of adding www to every Worker, WAF, and rate-limit rule. A DNS CNAME alone aliases a hostname; it does not create an HTTP redirect by itself.

For the Free-plan rate limiting rule, use Rate limit short-link candidates as the rule name, IP as the characteristic, 20 requests per 10 seconds, Block as the action, 10 seconds as the duration, and First as the order. The expression excludes the /lookup page but not /lookup/resolve, so lookup resolution stays covered by the single available rate limiting rule.

http.host eq "v8s.link" and
not cf.client.bot and
not starts_with(http.request.uri.path, "/_stats") and
not starts_with(http.request.uri.path, "/_tests") and
not starts_with(http.request.uri.path, "/_analytics") and
not http.request.uri.path in {"/" "/index" "/lookup" "/privacy" "/terms" "/abuse" "/security" "/404" "/expired" "/disabled" "/maintenance" "/security.txt" "/.well-known/security.txt" "/robots.txt" "/favicon.svg"} and
not lower(http.request.uri.path) contains ".css" and
not lower(http.request.uri.path) contains ".js" and
not lower(http.request.uri.path) contains ".png" and
not lower(http.request.uri.path) contains ".svg" and
not lower(http.request.uri.path) contains ".ico" and
not lower(http.request.uri.path) contains ".txt" and
not lower(http.request.uri.path) contains ".webmanifest" and
not lower(http.request.uri.path) contains ".woff"

http.host eq "v8s.link" and
http.request.method eq "POST" and
http.request.uri.path eq "/lookup/resolve" and
not cf.client.bot

http.host eq "v8s.link" and
http.request.method eq "POST" and
http.request.uri.path eq "/_analytics/lookup" and
not cf.client.bot

http.host eq "v8s.link" and (
  ends_with(lower(http.request.uri.path), ".php") or
  lower(http.request.uri.path) contains "/wp-content/" or
  lower(http.request.uri.path) contains "/wp-includes/" or
  lower(http.request.uri.path) contains "/wp-admin/" or
  lower(http.request.uri.path) contains "/wp-" or
  lower(http.request.uri.path) contains "wp-login.php" or
  lower(http.request.uri.path) contains "xmlrpc.php" or
  lower(http.request.uri.path) contains ".env" or
  lower(http.request.uri.path) contains "phpinfo" or
  lower(http.request.uri.path) contains "/vendor/" or
  lower(http.request.uri.path) contains "/.git" or
  lower(http.request.uri.path) contains "/cgi-bin/"
)

http.host eq "v8s.link" and
not http.request.method in {"GET" "HEAD" "OPTIONS"} and
not (
  http.request.method eq "POST" and
  http.request.uri.path in {"/lookup/resolve" "/_analytics/lookup"}
)

http.host eq "v8s.link" and
not cf.client.bot and
not starts_with(http.request.uri.path, "/_stats") and
not starts_with(http.request.uri.path, "/_tests") and
(
  lower(http.user_agent) contains "curl" or
  lower(http.user_agent) contains "wget" or
  lower(http.user_agent) contains "python-requests" or
  lower(http.user_agent) contains "go-http-client" or
  lower(http.user_agent) contains "httpclient"
)

http.host eq "v8s.link" and
http.request.uri.path ne "/robots.txt" and (
  lower(http.user_agent) contains "applebot" or
  lower(http.user_agent) contains "archive.org_bot" or
  lower(http.user_agent) contains "arquivo-web-crawler" or
  lower(http.user_agent) contains "bingbot" or
  lower(http.user_agent) contains "chatgpt-user" or
  lower(http.user_agent) contains "duckassistbot" or
  lower(http.user_agent) contains "googlebot" or
  lower(http.user_agent) contains "manus-user" or
  lower(http.user_agent) contains "meta-externalfetcher" or
  lower(http.user_agent) contains "mistralai-user" or
  lower(http.user_agent) contains "oai-searchbot" or
  lower(http.user_agent) contains "perplexity-user" or
  lower(http.user_agent) contains "perplexitybot" or
  lower(http.user_agent) contains "proratainc" or
  lower(http.user_agent) contains "terracotta"
)

Paste and validate one complete expression at a time. Deploy rules disabled while tuning if traffic is already flowing, then enable them after checking Security Events.

Decide crawler controls

In Cloudflare, use Domains > your short domain > AI Crawl Control for crawler-specific controls. This is separate from the broad Security > Settings > Block AI bots toggle covered earlier.

Use AI Crawl Control > Security to block named crawlers and configure the blocked-crawler response. If you use this page, set the block response allowed paths to:

• /robots.txt
• /llms.txt
• /llms-full.txt
• /.well-known/*

Leave /mcp and /ads.txt disabled unless the instance intentionally publishes those files. Keeping /.well-known/* allowed matters because vanityURLs publishes the security disclosure contact at /.well-known/security.txt.

User-agent: *
Disallow: /

Allow: /robots.txt
Allow: /llms.txt
Allow: /llms-full.txt
Disallow: /en/_stats/
Disallow: /*/_stats/
Disallow: /lookup/

The Signals page should show /robots.txt as reachable with 200 OK. Use Agent Readiness and Robots.txt violations as monitoring surfaces, not as the source of truth for the file content.

Configure Rules and URL normalization

In Cloudflare, open Domains > your short domain > Rules > Settings. Review Managed Transforms, Bulk Redirects, and URL Normalization.

Recommended Rules settings:

Configure Network settings

In Cloudflare, open Domains > your short domain > Network.

Recommended Network settings:

Keep caching conservative

In Cloudflare, open Domains > your short domain > Caching > Configuration for general cache settings, then Caching > Cache Rules to confirm there are no cache rules.

Keep caching boring for a redirector:

• Leave dynamic redirect decisions to the Worker
• Let static assets under build/ use the Worker and asset headers
• Keep Development Mode off except while actively debugging
• Do not create Cache Rules or Cache Response Rules for the baseline
• If any Cache Rules or Cache Response Rules exist, disable or delete them before go-live