Cloudflare security posture audits from a single desktop console.
CF Guard Desk audits WAF coverage, DNS exposure, bot pressure, cache risk, and TLS or edge posture across your Cloudflare zones. Connect accounts, scan zones, review cross-signal findings, track drift, and export audit reports - all from a local-first desktop workflow with no SaaS dependency.
Launch offer: 25% off annual plans with code CFGUARD25 through April 30, 2026 at 23:59 UTC.
A serious Cloudflare security audit console for operators who need to prove posture, not just monitor it.
CF Guard Desk is a desktop-first security posture console for Cloudflare. Connect accounts, validate tokens, discover zones, run structured audits, review cross-signal findings, track posture drift over time, and export evidence-backed reports - from one local desktop workspace.
Desktop audit workflow for Cloudflare security: structured scans + cross-signal findings + exportable evidence.
Structured Audits
Run Quick Scan, Full Audit, or Focused Rescan profiles across connected Cloudflare zones with evidence-backed findings and cross-signal risk scoring.
Findings Explorer
Review classified findings with lifecycle state, operator notes, suppression workflow, and severity context - not flat compliance checklists.
Drift and History
Compare scan snapshots, track posture changes over time, and identify regressions before they become incidents.
Exports and Reporting
Export Markdown and JSON audit reports for internal hardening, client deliverables, or compliance evidence without depending on a SaaS reporting layer.
Dashboard, findings, scan execution, and export workflows in one desktop surface.
The preview walks through the core audit loop: posture overview, findings triage, structured scan profiles, and exportable evidence.
A serious Cloudflare security audit console for operators who need to prove posture, not just monitor it.
CF Guard Desk is a desktop-first security posture console for Cloudflare. Connect accounts, validate tokens, discover zones, run structured audits, review cross-signal findings, track posture drift over time, and export evidence-backed reports - from one local desktop workspace.
Dashboard
Zone count, last scan date, finding severity breakdown, posture trend, and workspace health at a glance.
Findings
Review classified findings across WAF, DNS, bot pressure, cache risk, TLS posture, and visibility gaps.
Scan
Validate tokens, inspect capabilities, discover zones, and run Quick Scan, Full Audit, or Focused Rescan.
Export
Generate Markdown and JSON audit reports with metadata, severity context, and operator annotations.
Zone count, last scan date, finding severity breakdown, posture score trend, and workspace health at a glance.
Posture dashboard and workspace overview
- severity stays visible
- score trend is directional
- workspace health remains explicit
Cloudflare security audit screenshots from the actual product.
These captures show the live CF Guard Desk desktop workflow for vault unlock, dashboard review, findings triage, scan configuration, policy posture, analytics, history, and licensing controls.
You can see the actual desktop workflow before installing: vault access, dashboard posture review, findings triage, scan setup, history, and licensing controls.
Unlock the vault locally before connections, scans, findings, or exports become operational.
This screen makes the desktop trust boundary obvious: passphrase-gated access, local unlock on the current machine, OS keychain-backed credentials, backend-signed audit commands, and no operational access until the vault is open.
Review the security modelSee posture score, priority fixes, domain posture, and top findings from one desktop dashboard.
The dashboard view shows the actual Cloudflare security audit surface: posture scoring, critical and high finding counts, WAF, DNS, cache, and TLS scoring, visibility coverage, trend lines, and prioritized findings for operator triage.
See the feature stackTriage cross-signal findings with severity filters, lifecycle state, and operator actions.
The findings screen shows the review workflow clearly: critical and high findings, DNS exposure, WAF coverage gaps, TLS edge issues, lifecycle filtering, bulk action controls, and evidence-backed triage instead of flat alerts.
Inspect the audit workflowConfigure Full Audit scope with category targeting, lookback control, and safe probe options.
This capture shows the structured scan entry point: explicit scan profile selection, time window control, target categories across WAF, DNS, bot, cache, and TLS or edge posture, plus safe probes and refresh controls before execution starts.
See how scans are runTurn edge policy posture into readable control coverage, gap priority, and surface footprint.
The policies view explains why Cloudflare control gaps matter by surfacing missing managed WAF coverage, absent rate limits, TLS attention areas, per-zone policy posture, control coverage, and the sensitive surface footprint that deserves tighter protection.
Review the security sectionUse analytics-backed threat pressure, clustering, and path intelligence inside the desktop workflow.
The analytics surface shows observed attack telemetry, inferred path intelligence, zones in scope, tracked paths, host hotspots, attack clusters, trend movement, and surface pressure mix so the posture story stays connected to operational pressure.
Explore the product scopeTrack scan lineage, completed runs, and diff-based drift between audit snapshots.
The history view makes drift tracking concrete: completed scan runs, profile lineage, rule-pack and score-model references, fingerprint-based diff output, and new versus resolved changes across successive Cloudflare audit snapshots.
See drift and historyManage trial state, licensing, workspace settings, and export controls from one desktop surface.
This settings screen shows the shipped commercial workflow: local trial state, feature access, license activation, device management, hosted checkout access, manage-subscription flow, workspace controls, and support or licensing docs in one operator-facing panel.
Review pricing and licensingTrust model stays legible at a glance.
Start with 7 days free, then choose a plan only if you want to keep auditing.
Every desktop build starts with 7 days of full Pro access. If you want to keep using CF Guard Desk after the trial, choose the paid variant that fits your workflow in hosted Lemon Squeezy checkout. All pricing excludes local taxes.
Every desktop build starts with 7 days of full Pro access. After the trial ends, choose a paid plan if you want to keep creating workspaces, running scans, exporting reports, and updating findings.
- Start with the same Pro desktop workflow shipped to paying customers
- Use the full app free of charge for 7 days after install
- EULA acceptance happens on first launch
- After day 7, choose a paid Lemon Squeezy variant to continue
- Windows, macOS, and Linux installers all start in trial mode
- Up to 3 workspaces
- Up to 25 zones
- Quick Scan, Full Audit, and Focused Rescan
- Cross-signal findings and posture scoring
- Markdown and JSON exports
- Scan history and drift comparison
- Everything in Indie
- Up to 15 workspaces
- Up to 250 zones
- Advanced exports
- Suppression workflow
- Guided remediation snippets
- Everything in Pro
- Up to 50 workspaces
- Up to 1,000 zones
- Commercial use positioning
- Annual billing only
Good support starts with evidence and reproducibility.
Include version, operating system, exact steps, expected result, actual result, and redacted evidence so support can reproduce the issue quickly.
- Version from the About panel
- Operating system and install type
- Exact repro steps and expected result
- Actual result with redacted evidence
- The docs page already followed
Questions teams ask before they install a serious Cloudflare security audit console.
What is CF Guard Desk?
CF Guard Desk is desktop security posture software for Cloudflare. It audits WAF coverage, DNS exposure, bot pressure, cache risk, and TLS or edge posture across your zones, then surfaces cross-signal findings with evidence, remediation guidance, and exportable reports for operators, consultants, and security-conscious teams.
Is CF Guard Desk a Cloudflare security scanner?
Yes. CF Guard Desk is a desktop Cloudflare security audit console with structured scan profiles, cross-signal finding analysis, posture scoring, drift tracking, and exportable audit reports across Windows, macOS, and Linux.
What does it scan?
The scan engine collects DNS records, WAF rulesets, managed and custom rules, rate limiting rules, cache rules, selected zone settings, and security events via GraphQL with REST fallback. It adds safe public-edge probes for HTTPS redirect, HSTS, cache headers, and common security headers. It classifies auth, admin, API, payment, upload, and search surfaces, then builds findings for WAF coverage, WAF rule quality, DNS and origin exposure, bot pressure, cache risk, TLS and header posture, visibility gaps, and compound cross-signal risk.
How is this different from Cloudflare's built-in security tools?
Cloudflare offers Security Center, Security Insights, Security Analytics, and Firewall Analytics as native dashboard tools for operators already inside the control plane. CF Guard Desk is a workflow and accountability layer on top of Cloudflare: repeatable scan profiles, cross-signal compound findings that Cloudflare does not surface as unified risks, posture scoring, drift tracking over time, and exportable audit reports for proving posture to clients, auditors, or leadership. It does not replace Cloudflare's control plane - it builds the review and reporting layer that Cloudflare does not ship.
What are cross-signal findings?
Cross-signal findings combine evidence from multiple data sources into compound risk assessments. For example: origin-bypass risk combined with weak WAF coverage, or auth-path pressure without rate limiting. These are the findings that flat compliance checklists miss because they require correlating signals across DNS, WAF, traffic, and configuration state.
Does CF Guard Desk have a free trial?
Yes. Every desktop build starts with 7 days of full Pro access free of charge. After the trial ends, a Lemon Squeezy subscription is required to continue using the product.
Can CF Guard Desk audit Cloudflare WAF coverage across multiple zones?
Yes. CF Guard Desk is built to audit Cloudflare WAF coverage across multiple zones and workspaces from one desktop console. It helps operators review WAF coverage, rule quality, rate-limiting posture, and correlated findings without jumping across each zone manually.
Can it detect Cloudflare DNS exposure and origin bypass risk?
Yes. CF Guard Desk audits Cloudflare DNS exposure, origin bypass risk, and related edge posture signals. It combines DNS evidence, WAF state, and safe public-edge checks so operators can identify exposed origins, weak coverage, and visibility gaps that matter during a Cloudflare security review.
Does CF Guard Desk help with Cloudflare bot pressure, rate limiting, and edge posture reviews?
Yes. CF Guard Desk is designed for Cloudflare security posture reviews that include bot pressure, rate-limiting posture, cache risk, TLS or header posture, and other edge-facing controls. The goal is to turn those signals into one reviewable audit workflow instead of scattered dashboard checks.
Can I export Cloudflare security audit reports for internal reviews or client work?
Yes. CF Guard Desk exports Markdown and JSON audit reports so consultants, agencies, and internal operators can deliver Cloudflare security findings, remediation context, and posture evidence without depending on a SaaS reporting layer.
How much does it cost?
Paid variants are Indie Monthly at $15, Indie Yearly at $149, Pro Monthly at $39, Pro Yearly at $390, and Consultant Yearly at $990. Every installer starts with a free 7-day Pro trial. All pricing excludes local taxes.
Is this a subscription?
Yes. CF Guard Desk uses hosted Lemon Squeezy checkout for monthly or annual licensing. Consultant is annual-only. All plans begin after the 7-day Pro trial if you decide to continue.
How do the free trial, EULA, and licensing work?
You download the app, accept the EULA on first launch, and get 7 days of full Pro access. If you want to continue after the trial, choose a plan from Lemon Squeezy and register the license key in the app. License state is verified locally with a 7-day offline grace window.
Does CF Guard Desk store Cloudflare credentials locally?
Yes. Secrets stay in the OS keychain, vault gating controls operational access, and backend-only request execution keeps credentials out of browser code paths. The desktop app ships with no in-app telemetry by default.
Which operating systems are supported?
CF Guard Desk ships in Windows, macOS, and Linux variants. Windows requires WebView2, macOS support targets modern desktop releases, and Linux requires a graphical desktop environment with WebKitGTK and AppIndicator-compatible components.
Who is this for?
CF Guard Desk is built for Cloudflare-heavy operators who need structured, repeatable security audits with exportable evidence: freelance consultants, agencies, fractional security operators, hosting and platform teams, and SMB infrastructure teams managing many zones. It is not yet shaped for collaborative enterprise SaaS workflows with SSO, RBAC, or shared dashboards.
Get help faster with the details needed to reproduce an issue.
If something breaks, include version, operating system, exact steps, redacted diagnostics, and the docs page you already followed so support can investigate quickly.
When you contact support, include version, operating system, exact steps, and redacted evidence so the issue can be reproduced quickly.
Bring enough detail that someone else could reproduce it.
- Version from the About panel
- Operating system and install type
- Exact repro steps
- Expected and actual result
- Redacted screenshots, scan output, or diagnostics evidence
Link the documentation page you already followed so support can see where the workflow broke down.
Read the support requirementsVersion from the About panel, operating system, and install type are baseline context, not optional detail.
Read the support requirementsExact repro steps, expected result, and actual result with redacted evidence are required before an issue is actionable.
Read the support requirementsZone names and finding details are useful. Cloudflare tokens, API keys, cookies, and account IDs are not.
Read the support requirements