Do I need permission to perform a penetration test for a site hosted on cloudflare pages?

Hi,

Do I need permission to perform a penetration test for a site hosted on Cloudflare pages?
I could only find some discussion in Cloudflare community regarding this topic and no official statement.

Is there an official statement / page talking about this topic?

Thanks in advance!
Thomas

As far as I remember, you do not need authorization from Cloudflare to conduct this penetration test.

May I ask will you perform those scans over Cloudflare IP addresses (your domain being proxied via Cloudflare, DNS records being :orange: cloud) or over your origin IP address (DNS records being :grey: cloud)?

Keep in mind though, If you test the infrastructure, you’d be testing Cloudflare’s and that might need some permission, respectively might not be appreciated at all.

I believe the best way would be to contact Cloudflare support in this case.

1 Like

Is this somewhere documented? As much as I am thankful for your response, I guess a post in forum does not represent a legal statement.

I do want to test the infrastructure itself, but I will contact the support team

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.