Cloudflare Trace

Cloudflare Trace (beta) follows an HTTP/S request through Cloudflare’s reverse proxy to your origin. Use this tool to understand how different Cloudflare configurations interact with an HTTP/S request for one of your proxied hostnames.

You can define specific request properties to simulate different conditions for an HTTP/S request. Inactive rules configured in Cloudflare products will not be evaluated.

Cloudflare Trace is available to users with an Administrator or Super Administrator role.

​​ Use Trace in the dashboard

​​ 1. Configure one or more Cloudflare products

1. Log in to the Cloudflare dashboard Open external link , and select your account.
2. Set configuration settings at the account level, or select a domain and configure settings for one or more Cloudflare products.

​​ 2. Build a trace

1. In the Cloudflare dashboard Open external link , go to Account Home > Trace.

2. Enter a URL to trace. The URL must include a hostname that is proxied by Cloudflare.

3. Select an HTTP method. If you select POST, PUT, or PATCH, you should enter a value in Request body.

4. (Optional) Define any custom request properties to simulate the conditions of a specific HTTP/S request. You can customize the following request properties:

   • Protocol (HTTP protocol version)
   • Request headers
   • Cookies
   • Geolocation (request source country, region, and city)
   • Bot score
   • Threat score
   • Request body (for POST, PUT, and PATCH requests)
   • Skip challenge (skips a Cloudflare-issued challenge, if any, allowing the trace to continue)

5. Select Send trace.

​​ 3. Assess results

The Trace results page shows all evaluated and executed configurations from different Cloudflare products, in evaluation order. Any inactive rules are not evaluated.

1. Analyze the different steps with evaluated and executed configurations for the current trace. Trace results include matches for all active rules and configurations, whether configured at the account level or for a specific domain or subdomain.

   To show all configurations, including the ones that did not match the request, select All configurations in the Results shown dropdown.

2. (Optional) Update your Cloudflare configuration (at the account or at the domain/subdomain level) and create a new trace to check the impact of your changes.

​​ 4. (Optional) Save the trace configuration

To run a trace later with the same configuration:

1. Copy the JSON shown in the dashboard with the current trace configuration.
2. When creating a new trace, paste it in the JSON box to define all the settings of the new trace.

​​ Use Trace via API

Use the Request Trace Open API docs link operation to perform a trace using the Cloudflare API.

​​ Steps in trace results

For matched configurations in trace results, each step corresponds to one of the following:

• Execution of one or more rules of a Cloudflare product, in the context of a phase (for products built on the Ruleset Engine)
• Page Rules (execution of one or more rules)

The following steps are planned for future additions:

• Workers (execution of one or more scripts)

​​ Limitations

Currently, you cannot perform traces for:

• Spectrum applications
• Hostnames using Data Localization Suite

Also, the following products will not appear in trace results:

• Firewall rules
• WAF managed rules (previous version)
• Rate limiting rules (previous version)