# Cloudflare Integration

Let your AI agent check how your own Cloudflare account delivers your site to search engines and AI crawlers, and make two approved changes. You connect your own account and choose the sites.

---

Connect your own Cloudflare account so your Chipp AI can check how your site is delivered: DNS, HTTPS, caching, redirects, bot protection and traffic errors. It then ranks what to fix, and after you approve it can clear the cache for pages you changed.

This is part of Chipp's SEO and AEO (answer engine optimization) toolkit. The AI reads and recommends. It only changes something when you approve, and it never edits or publishes your website.

## Whose credentials are used

The connection is **yours**. You connect your own Cloudflare account, and Chipp never holds a Cloudflare credential for you.

- **API token (works for every plan).** You create a scoped token in the Cloudflare dashboard and paste it into Chipp.
- **OAuth.** You sign in to Cloudflare and approve access on Cloudflare's own consent screen, where you pick the account and can decline optional permissions. OAuth needs an OAuth client. Chipp uses its own Cloudflare app when it is set up. Otherwise you can create a private OAuth client in your own Cloudflare account (Manage Account, OAuth clients) and use it through **Use your own app**. A private client can only be authorized by members of the account that created it.
- Chipp stores your token encrypted, never shows it again, and never sends it to the AI model.
- To stop access, disconnect in **Brain > Integrations** (Chipp deletes the stored credential), and delete the token on the Cloudflare API Tokens page or click **Revoke** on Cloudflare's authorized applications page.

## You choose the sites

Connecting is not consent to use everything the token can reach. After you connect, click **Choose sites** and tick the Cloudflare accounts and sites your AI may use. You only see accounts and sites your own credential can reach.

- Nothing is allowed until you save at least one site. Until then every tool answers that you have not chosen sites yet.
- The AI can only work on the sites you ticked. If it names another site, the request is refused before anything is sent to Cloudflare.
- Every request checks the site live with Cloudflare. If a site was renamed, moved to another account or deleted, it is refused until you choose again.
- You can allow up to 10 accounts and 25 sites. Disconnecting and connecting again clears your choice, so you choose again.

## What the AI can do

| Tool | What it does |
|------|--------------|
| **cloudflare_list_zones** | Lists the sites you allowed, with status, plan and nameservers |
| **cloudflare_zone_settings** | Reads SSL/TLS mode, HTTPS redirects, caching, compression, HTTP/2 and HTTP/3, Rocket Loader, security level and more, and flags problems |
| **cloudflare_dns_records** | Reads DNS records (up to 100) and checks the main and www records |
| **cloudflare_ssl_status** | Reads the SSL/TLS mode and certificates, and flags missing, pending or expiring certificates |
| **cloudflare_crawler_rules** | Reads redirects, URL rewrites, response header rules, cache rules, configuration rules, origin rules, custom firewall rules and page rules that can affect crawlers |
| **cloudflare_bot_and_robots** | Reads bot protection, whether Googlebot and Bingbot are blocked, AI crawler blocking and managed robots.txt |
| **cloudflare_traffic_summary** | Shows up to 30 days of traffic, error rates and cache hit rate |
| **cloudflare_purge_cache_urls** | Clears Cloudflare's cached copy of up to 30 specific pages (needs your approval) |
| **cloudflare_update_zone_setting** | Turns on Always Use HTTPS or Automatic HTTPS Rewrites, or raises the SSL/TLS mode to Full or Strict (needs your approval) |

Every read returns ranked findings with the evidence behind each one. A part that your token or plan cannot read is reported with the permission it needs, never skipped silently.

## Connecting with an API token


  **1.** 
    <strong>Create the token</strong>

    In the Cloudflare dashboard open **My Profile**, **API Tokens**, **Create Token**, **Create Custom Token**. Under **Zone Resources** choose **Include**, **Specific zone**, and pick only the sites to share.
  


  **2.** 
    <strong>Add the permissions</strong>

    Required: **Zone, Zone, Read**. Recommended, each set to **Read**: Zone Settings, DNS, SSL and Certificates, Analytics, Page Rules, Bot Management, Zone WAF, Transform Rules, Single Redirect, Cache Rules, Config Rules and Origin Rules. A permission you leave out only turns off the part of the report that needs it. Only if you want the AI to make approved changes, also add **Zone Settings, Edit** and **Cache Purge**.
  


  **3.** 
    <strong>Connect</strong>

    In your app's builder, go to **Brain > Integrations**, find **Cloudflare** (under **SEO & AEO**), paste the token into **Cloudflare API token** and click **Connect**. Chipp checks the token with Cloudflare before saving it.
  


  **4.** 
    <strong>Choose sites</strong>

    Click **Choose sites**, tick the accounts and sites your AI may use, and save.
  


## Connecting with OAuth

Choose **Connect with Cloudflare**, pick your account on Cloudflare's consent screen, review the permissions and click **Authorize**. Then click **Choose sites**. The AI reads only what the permissions (scopes) you granted allow, and a report that needs another permission tells you which one. OAuth scope names look like `zone.read`.

## Approval and safety

Only two actions change anything in Cloudflare, and both are narrow:

- **Clear cache for specific pages.** Up to 30 full URLs on your site's domain or its subdomains. If one URL is invalid or on another domain, nothing is sent. It never clears the whole cache.
- **Raise one HTTPS setting.** Always Use HTTPS on, Automatic HTTPS Rewrites on, or SSL/TLS mode raised to Full or Strict. Nothing can be turned off or lowered. The AI shows the current and new value first, and the change is refused if the live value is different from the one it showed you. Asking again after it was applied does nothing.

For both:

- **You approve every change.** Your AI shows what it would do and waits for your approval.
- **Limits.** Up to 20 approved changes per hour for each site.
- **Audit log.** Every change is written to your audit log with the site, what changed (before and after for a setting), the result and your stated reason. The log never holds the token or the list of URLs.
- **Changing SSL mode can take a site offline** if your server cannot answer over HTTPS. If it breaks, change it back in the Cloudflare dashboard (SSL/TLS, Overview).

There is no way to change DNS records, rules, redirects or security settings with this integration, and nothing on your website is published automatically. Fixes for those go to you or your site editor.

## Plan and API limits

- Which settings, rules and history you see depends on your Cloudflare plan and on the permissions of your token. Traffic history is shortest on the Free plan.
- Bot settings come from the zone's bot management settings. They are not available on every plan.
- Traffic counts are Cloudflare edge counts. They include bots and crawlers and will not match Google Analytics.
- Chipp reads Cloudflare's configuration of robots.txt, not the live file. Ask your AI to fetch `/robots.txt` with the site audit tools to see the final text.
- Cloudflare limits how fast an account can call its API. If you hit the limit, your AI tells you to wait.

## Re-checking

After an approved change goes live, ask your AI to run the same read again, for example **cloudflare_zone_settings** after a setting change, or **cloudflare_traffic_summary** a few days later to see whether errors fell. If you also connect IndexNow or Bing Webmaster Tools, it can tell search engines about the changed pages after the cache is cleared.

## Troubleshooting

| Message | What to do |
|---------|-----------|
| This token cannot read your zones | Edit the token and add Zone, Zone, Read for the sites you want to share |
| Cloudflare rejected the connected credential | Create a new token (or authorize again), disconnect and connect again, then choose sites again |
| You have not chosen which sites your AI may use | Open Integrations, Cloudflare, **Choose sites** |
| That zone is not on your allowed list | Add the site in **Choose sites** |
| The zone no longer matches what you allowed | The site was renamed or moved. Choose your sites again |
| The token does not include the permission this needs | Add the permission named in the message to your token |
| Hourly limit reached | Wait an hour, and change only what needs it |

## Billing

Cloudflare tool calls use your standard Chipp LLM token billing. Your Cloudflare plan is billed by Cloudflare.