The websites that we host have the option of enhanced protection against malicious web traffic using Cloudflare.
Who are Cloudflare and why are we using them?
Cloudflare provide a wide range of networking, content delivery, DNS and cyber security services - it is estimated that around 20% of all websites globally use them for their web security.
With the increase in attacks on UK public sector websites, we have chosen Cloudflare to provide additional resilience to our hosting service. In particular, we will be taking advantage of Cloudflare DDoS Protection (opens new window).
Existing clients
If you already host with us and would like to use Cloudflare, the changes involve:
- Your project manager will be in contact via Jira
- There are updates to project risk logs and contracts (as Cloudflare will be included as a sub-processor)
- Planning the changes needed to your DNS records
- Whether your site is available on a www or or non-www domain
- Make updates to your cookie policy articles (see below)
- Scheduling the switchover
Cookies set by Cloudflare
Once your site is protected by Cloudflare, two additional essential cookies will be set.
__cf_bm - This cookie is part of Cloudflare's bot protection. It helps distinguish between genuine human traffic and automated, potentially harmful bot activity. Without this cookie, Cloudflare cannot reliably filter malicious requests, which may expose your website to performance issues or security risks. It does not track users' behaviour across sites; it simply ensures that legitimate users can access the site without interruptioncf_clearance - This cookie is issued after Cloudflare verifies that a visitor is legitimate (for example, after passing a challenge or security check). It allows that visitor to continue accessing the site without repeated security challenges. Removing or blocking this cookie would prevent users from reliably reaching the website, as Cloudflare would have no way of remembering that they were validated
If your cookie policy lists all of the cookies set by your website, it should be updated to include them. For full descriptions, see Cloudflare's Cookie (opens new window) page.
FAQs
What is a DDoS attack?
A denial of service attack is a form of cyber attack that seeks to bring down a service (ie your website) by flooding it with requests. The requests can number in the millions, preventing genuine users from accessing the service, and eventually overwhelming the server.
A distributed denial-of-service attack (DDoS attack) is an attack that originates from multiple sources at once, making it more difficult to block. Cloudflare have autonomous tools which automatically detect and mitigate DDoS attacks.
What level of protection are we offering?
We can provide DDoS protection to all of our hosting tiers with an associated 'fair-usage' policy.
For information on these tiers please speak to your GOSS Account Manager.
What are CDNs?
Cloudflare CDNs are used by any traffic that get proxied through the Cloudflare network. This is essential when activating Cloudflare features like DDoS protection, WAF functionality, Bot protection and performance optimisation.
The CDN only caches static resources (images, scripts, stylesheets) to enhance site performance. Cloudflare does not save personal data like form submissions, login credentials, session cookies and user uploaded content.
What will this look like for our users?
Cloudflare assesses each request to your site, and decides whether the request is routed (so the user won't be challenged), or whether a challenge is issued. A challenge is generally a single "Are you human?" checkbox.
Would internal users (all from the same IP address) be affected?
Occasionally high volumes of traffic to the site from one IP address (for example a Customer Services centre) can be flagged as a false-positive in Cloudflare. In the case of false-positives, we are able to add exceptions to the Cloudflare rules.
Can users access our site if they refuse the Cloudflare cookies?
No. Cloudflare cookies are essential/necessary and should be described on your Cookie Policy article as such.
How does this affect GDPR compliance?
Cloudflare's Core Application Layer service processes a visitor's IP addresses, metadata, and traffic logs. See https://www.cloudflare.com/en-gb/trust-hub/gdpr/ (opens new window) for more information.
