Cloudflare Integration

Connect your own Cloudflare account so your Chipp AI can check how your site is delivered: DNS, HTTPS, caching, redirects, bot protection and traffic errors. It then ranks what to fix, and after you approve it can clear the cache for pages you changed.

This is part of Chipp’s SEO and AEO (answer engine optimization) toolkit. The AI reads and recommends. It only changes something when you approve, and it never edits or publishes your website.

Whose credentials are used

The connection is yours. You connect your own Cloudflare account, and Chipp never holds a Cloudflare credential for you.

• API token (works for every plan). You create a scoped token in the Cloudflare dashboard and paste it into Chipp.
• OAuth. You sign in to Cloudflare and approve access on Cloudflare’s own consent screen, where you pick the account and can decline optional permissions. OAuth needs an OAuth client. Chipp uses its own Cloudflare app when it is set up. Otherwise you can create a private OAuth client in your own Cloudflare account (Manage Account, OAuth clients) and use it through Use your own app. A private client can only be authorized by members of the account that created it.
• Chipp stores your token encrypted, never shows it again, and never sends it to the AI model.
• To stop access, disconnect in Brain > Integrations (Chipp deletes the stored credential), and delete the token on the Cloudflare API Tokens page or click Revoke on Cloudflare’s authorized applications page.

You choose the sites

Connecting is not consent to use everything the token can reach. After you connect, click Choose sites and tick the Cloudflare accounts and sites your AI may use. You only see accounts and sites your own credential can reach.

• Nothing is allowed until you save at least one site. Until then every tool answers that you have not chosen sites yet.
• The AI can only work on the sites you ticked. If it names another site, the request is refused before anything is sent to Cloudflare.
• Every request checks the site live with Cloudflare. If a site was renamed, moved to another account or deleted, it is refused until you choose again.
• You can allow up to 10 accounts and 25 sites. Disconnecting and connecting again clears your choice, so you choose again.

What the AI can do

Tool	What it does
cloudflare_list_zones	Lists the sites you allowed, with status, plan and nameservers
cloudflare_zone_settings	Reads SSL/TLS mode, HTTPS redirects, caching, compression, HTTP/2 and HTTP/3, Rocket Loader, security level and more, and flags problems
cloudflare_dns_records	Reads DNS records (up to 100) and checks the main and www records
cloudflare_ssl_status	Reads the SSL/TLS mode and certificates, and flags missing, pending or expiring certificates
cloudflare_crawler_rules	Reads redirects, URL rewrites, response header rules, cache rules, configuration rules, origin rules, custom firewall rules and page rules that can affect crawlers
cloudflare_bot_and_robots	Reads bot protection, whether Googlebot and Bingbot are blocked, AI crawler blocking and managed robots.txt
cloudflare_traffic_summary	Shows up to 30 days of traffic, error rates and cache hit rate
cloudflare_purge_cache_urls	Clears Cloudflare’s cached copy of up to 30 specific pages (needs your approval)
cloudflare_update_zone_setting	Turns on Always Use HTTPS or Automatic HTTPS Rewrites, or raises the SSL/TLS mode to Full or Strict (needs your approval)

Every read returns ranked findings with the evidence behind each one. A part that your token or plan cannot read is reported with the permission it needs, never skipped silently.

Connecting with an API token

Connecting with OAuth

Choose Connect with Cloudflare, pick your account on Cloudflare’s consent screen, review the permissions and click Authorize. Then click Choose sites. The AI reads only what the permissions (scopes) you granted allow, and a report that needs another permission tells you which one. OAuth scope names look like zone.read.

Approval and safety

Only two actions change anything in Cloudflare, and both are narrow:

• Clear cache for specific pages. Up to 30 full URLs on your site’s domain or its subdomains. If one URL is invalid or on another domain, nothing is sent. It never clears the whole cache.
• Raise one HTTPS setting. Always Use HTTPS on, Automatic HTTPS Rewrites on, or SSL/TLS mode raised to Full or Strict. Nothing can be turned off or lowered. The AI shows the current and new value first, and the change is refused if the live value is different from the one it showed you. Asking again after it was applied does nothing.

For both:

• You approve every change. Your AI shows what it would do and waits for your approval.
• Limits. Up to 20 approved changes per hour for each site.
• Audit log. Every change is written to your audit log with the site, what changed (before and after for a setting), the result and your stated reason. The log never holds the token or the list of URLs.
• Changing SSL mode can take a site offline if your server cannot answer over HTTPS. If it breaks, change it back in the Cloudflare dashboard (SSL/TLS, Overview).

There is no way to change DNS records, rules, redirects or security settings with this integration, and nothing on your website is published automatically. Fixes for those go to you or your site editor.

Plan and API limits

• Which settings, rules and history you see depends on your Cloudflare plan and on the permissions of your token. Traffic history is shortest on the Free plan.
• Bot settings come from the zone’s bot management settings. They are not available on every plan.
• Traffic counts are Cloudflare edge counts. They include bots and crawlers and will not match Google Analytics.
• Chipp reads Cloudflare’s configuration of robots.txt, not the live file. Ask your AI to fetch /robots.txt with the site audit tools to see the final text.
• Cloudflare limits how fast an account can call its API. If you hit the limit, your AI tells you to wait.

Re-checking

After an approved change goes live, ask your AI to run the same read again, for example cloudflare_zone_settings after a setting change, or cloudflare_traffic_summary a few days later to see whether errors fell. If you also connect IndexNow or Bing Webmaster Tools, it can tell search engines about the changed pages after the cache is cleared.

Troubleshooting

Message	What to do
This token cannot read your zones	Edit the token and add Zone, Zone, Read for the sites you want to share
Cloudflare rejected the connected credential	Create a new token (or authorize again), disconnect and connect again, then choose sites again
You have not chosen which sites your AI may use	Open Integrations, Cloudflare, Choose sites
That zone is not on your allowed list	Add the site in Choose sites
The zone no longer matches what you allowed	The site was renamed or moved. Choose your sites again
The token does not include the permission this needs	Add the permission named in the message to your token
Hourly limit reached	Wait an hour, and change only what needs it

Billing

Cloudflare tool calls use your standard Chipp LLM token billing. Your Cloudflare plan is billed by Cloudflare.