Desktop Cloudflare posture audits with findings, history, and local evidence control.
Audit WAF coverage, DNS exposure, bot pressure, cache risk, and TLS or edge posture across Cloudflare zones from a single local desktop console.
Every desktop build starts with 7 days of full product access. After the trial, a Lemon Squeezy license key activates continued scans, exports, and advanced workflows. Launch scope includes the desktop app, docs hub, staged downloads, and pricing visibility while commerce and CDN delivery remain config-driven. Taxes, VAT, and local fees are handled at checkout where applicable.
Scroll to explore the productA desktop-first Cloudflare audit workflow for real operator review.
CF Guard Desk is desktop-first Cloudflare security audit software for operators, consultants, and small teams that need reproducible posture evidence, local data control, and report-ready findings.
Connections and Workspaces
Validate Cloudflare tokens, inspect capabilities, and separate client or environment boundaries before a scan is trusted.
Zone Coverage
Run quick, full, or focused scans across discovered zones while keeping scope and visibility gaps explicit.
Findings and Triage
Review severity, confidence, lifecycle state, suppressions, and remediation guidance from one local desktop workflow.
History and Exports
Track drift, save markdown or JSON evidence, and keep diagnostics redacted and operator-triggered.
Score, critical findings, bot pressure, visibility gaps, and next actions in one operator view.
Operator priority view
- score is directional
- critical findings first
- coverage gaps stay visible
Cloudflare audit screens from the actual CF Guard Desk product line.
These captures show the product story buyers actually need: vault gating, dashboard posture, zone coverage, findings triage, history, exports, and licensing-aware desktop state.
The screenshots give visual proof that the product is more than a landing page concept. Search engines and buyers both get concrete evidence of the real operator workflow.
Unlock the local vault before Cloudflare connections, scans, or findings become actionable.
The desktop boundary is visible immediately: vault-gated access, OS-backed secret storage, local persistence, and a clear separation between locked state and operational state.
Review the security sectionSee posture score, high-risk zones, findings, and pressure trends at a glance.
The dashboard compresses posture, attack pressure, WAF gaps, DNS exposure, and follow-up priority into one operator surface instead of scattering that context across Cloudflare tabs.
Read the current product docsMove from workspace and token validation into real zone coverage and scan execution.
Connections, account capabilities, discovered zones, and scan profiles stay attached to the same desktop workflow so missing access or entitlement gaps stay explicit.
See the feature stackTriage posture findings with severity, confidence, and operator lifecycle controls.
Each finding carries deterministic rule metadata, operator notes, and concrete remediation framing so the tool behaves like an audit workspace instead of a flat checklist.
Inspect the workflowTrack threat pressure, scan history, and posture drift without leaving the desktop client.
The analytics and history surfaces keep scan timelines, drift, and exported evidence readable enough for consultants and in-house operators who need defensible reports.
See history and exportsControl licensing state, operator defaults, and release-aware desktop settings.
Licensing, support diagnostics, vault behavior, and operator-facing settings live in one panel so the commercial model and local runtime policies stay explicit.
Read the product overviewTrust model stays legible at a glance.
Visible pricing now, staged commerce and downloads where the rollout is still catching up.
CF Guard Desk is priced for solo operators, in-house teams, and consultants. The public site keeps the plan structure visible even while checkout and platform artifacts are still being wired or promoted in stages.
Pricing stays public even while download and checkout URLs remain config-driven. Annual pricing is emphasized and staged launch states stay explicit.
- Quick Scan, Full Audit, and Focused Rescan profiles
- Dashboard, findings, analytics, history, and local exports
- Built for solo consultants and smaller estates
- Advanced exports, policy packs, suppressions, and premium rules stay outside this tier
Checkout URLs are config-driven. The pricing surface is live even when commerce links are still being wired.
- Advanced exports, policy packs, suppressions, and premium rules included
- Best fit for in-house infrastructure or security operators
- History, drift, analytics, and export workflows stay fully unlocked
- Commercial workflow remains desktop-first with local enforcement
- Designed for multi-client estates and consulting workflows
- Includes advanced exports, policy packs, suppressions, and premium rules
- Supports commercial consulting positioning without inventing a team SaaS backend
- Best when local evidence handling matters as much as the scan output
Good support starts with evidence and reproducibility.
Reports without version, environment, repro steps, and the docs page already followed are incomplete. This is the line between product support and avoidable setup drift.
- Version from the About panel
- Operating system and install type
- Exact repro steps and expected result
- Actual result with redacted evidence
- The docs page already followed
Questions buyers ask before they trust a serious Cloudflare audit workflow.
These are the recurring questions behind evaluation and rollout decisions: scope, platform state, trial behavior, visibility gaps, and how the current desktop workflow actually works.
What is CF Guard Desk?
CF Guard Desk is desktop-first Cloudflare security audit software. It focuses on posture discovery, evidence-backed findings, drift tracking, and prioritized hardening guidance across Cloudflare zones.
Is CF Guard Desk a hosted SaaS control plane?
No. The product is local-first desktop software. It stores workspace and scan data locally, keeps Cloudflare secrets in OS-backed storage, and does not require a hosted operator account to be useful.
What can the current build audit?
The current build audits WAF coverage, rule quality, DNS exposure, DNS hygiene, bot pressure, cache risk, TLS or edge posture, and visibility gaps across Cloudflare zones.
How do scan profiles work?
Quick Scan is for fast posture snapshots, Full Audit is for evidence-backed review and exports, and Focused Rescan is for validating a narrower set of zones or re-checking after a change.
Does the product treat missing API visibility as safe posture?
No. Capability gaps and entitlement limits are surfaced as visibility gaps. Missing data is never silently scored as safe.
How are findings triaged?
Findings carry severity, confidence, impact, remediation complexity, lifecycle state, and operator notes. Suppression workflow and history help teams separate accepted exceptions from regressions.
Which plans are visible today?
The public pricing surface is aligned around Indie, Pro, and Consultant. Annual pricing is emphasized, and checkout links remain config-driven until commerce wiring is finalized.
Does CF Guard Desk have a free trial?
Yes. Every public build starts with 7 days of full access before plan enforcement begins.
What happens offline after activation?
The current licensing model includes a 7-day offline grace window. After grace expires, the app moves into restricted mode while keeping local data visible.
Does the desktop app contain analytics or tracking SDKs?
No desktop telemetry is enabled by default. The marketing site can run consent-based analytics and download click tracking separately from the desktop runtime.
Who is the product best for?
The product is positioned for consultants, agencies, fractional operators, and internal platform or security teams that need Cloudflare posture evidence without adopting a collaborative SaaS platform first.
Staged public builds, explicit platform status, and a local-first trial workflow.
Windows is the first verified public path. macOS and Linux stay visible on the site with honest rollout state instead of broken links or implied availability.
0.9.0 owner build anchors the current public site. Hosted URLs become live only when the corresponding Cloudflare-backed artifact path is actually ready.
Choose the desktop build that matches the current rollout stage, then use the trial before committing to a paid plan.
The browser is modeled more like a release index than a feature grid: artifact state, availability, and install context stay visible so the public site never outruns the real distribution path.
Windows is the first public target. Set NEXT_PUBLIC_DOWNLOAD_WINDOWS_URL or NEXT_PUBLIC_CF_DESK_CDN_URL to turn this card into a live download.
A macOS handoff exists, but public CDN hosting should wait for a proper macOS build host, signing flow, and notarization readiness.
Linux public artifacts are planned after the Cloudflare-backed download host and release packaging flow settle around the early Windows-first rollout.
Ready to publish
Unsigned early-access installers may still trigger SmartScreen on some Windows systems.
Confirm the artifact URL and version first, then use the troubleshooting guidance if Windows blocks the installer. Read troubleshooting for the full flow.
Coming soon
macOS packaging currently depends on a macOS host and Apple signing or notarization flow.
xattr -cr "/Applications/CF Guard Desk.app"If unsigned evaluation builds are distributed, Gatekeeper recovery steps remain part of the documented install path. Read troubleshooting for the full flow.
Staged launch behavior
Pricing is public immediately. Checkout and download URLs become live when the corresponding Cloudflare-backed host and release artifact are actually ready.
Support starts after the docs, not instead of them.
If the issue is real, the docs let you prove it. Version, operating system, exact repro steps, redacted evidence, and the documentation page already followed are the minimum baseline for a useful report.
Good support starts with reproducible evidence, redacted diagnostics, and the exact doc path already followed.
Bring reproducible detail.
- Version from the About panel
- Operating system and install type
- Exact repro steps
- Expected and actual result
- Redacted screenshots, activity, queue, or diagnostics evidence
A useful support request cites the exact documentation page followed before the workflow diverged.
Read the support requirementsInclude the app version, operating system, and whether this is a release installer or a local source build.
Read the support requirementsIf the issue cannot be reproduced from your steps, there is not enough detail to distinguish operator drift from a product defect.
Read the support requirementsZone names, rule IDs, and route patterns are useful. Tokens, auth headers, and unredacted support bundles are not.
Read the support requirements