Glossary

ECS is a DNS extension that enables recursive DNS resolvers to include client IP address information in their DNS queries.

Not all resolvers use ECS but, if they do, usually a part of the IP address is omitted. Sending ECS headers is generally intended to reduce latency and speed up content delivery in connection to CDNs and load balancers Open external link . The ECS mechanism is specified in RFC 7871 Open external link .

Exposed credentials refers to sensitive authentication information disclosed in some way (for example, due to misconfigurations, data breaches, or simple human error), allowing other parties to gain access to digital resources.

Credentials may include usernames, passwords, API keys, authentication tokens, or private keys.

Requests issued by a monitor at regular interval and — depending on the monitor settings — return a pass or fail value to make sure an origin is still able to receive traffic.

Each health monitor request is trying to answer two questions:

1. Is the server offline?: Does the server respond to the health monitor request at all? If so, does it respond quickly enough (as specified in the monitor’s Timeout field)?
2. Is the server working as expected?: Does the server respond with the expected HTTP response codes? Does it include specific information in the response body?

If the answer to either of these questions is “No”, then the server fails the health monitor request.

A Durable Object migration is a mapping process from a class name to a runtime state. Initiate a Durable Object migration when you need to:

• Create a new Durable Object class.
• Rename a Durable Object class.
• Delete a Durable Object class.
• Transfer an existing Durable Objects class.

A monitor issues health monitor requests at regular intervals to evaluate the health of each server within an origin pool.

When a pool becomes unhealthy, your load balancer takes that pool out of the server rotation.

Within Cloudflare, pools represent your origin servers and how they are organized. As such, a pool can be a group of several origin servers, or you could also have only one origin server per pool.

If you are familiar with DNS terminology, think of a pool as a “record set,” except Cloudflare only returns addresses that are considered healthy. You can attach health monitors to individual pools for customized monitoring.

A number that identifies the network portion of an IP address. It tells devices if an IP address is on the same network or not. It is shown as a number after a slash (for example, /31) at the end of the IP address.

Using an analogy, the prefix is like a street address. If an IP is in the same street, it belongs to the same network of devices.

SNI allows a server to host multiple TLS Certificates for multiple websites using a single IP address. SNI adds the website hostname in the TLS handshake to inform the server which website to present when using shared IPs.

Cloudflare uses SNI for all Universal SSL certificates.

Shadow IT is the unsanctioned use of software, hardware, or other systems and services within an organization, often without the knowledge of that organization’s information technology (IT) department.

For more information, refer to the Cloudflare Learning Center Open external link .

A unique subdomain assigned to your Cloudflare account, where secured applications are accessed by users; for example, <your-team-name>.cloudflareaccess.com.

Setting up a team domain is an essential step in your Cloudflare Zero Trust configuration. This is where your users will find the apps you have secured behind Cloudflare Zero Trust — displayed in the App Launcher — and will be able to make login requests to them.

The customizable portion of your team domain, allowing you to personalize your Cloudflare Zero Trust configuration. You can view your team name in Zero Trust under Settings > Custom Pages.

To learn about the consequences of changing your team name, refer to the FAQ.

The threat score is a score from 0 (zero risk) to 100 (high risk) classifying the IP reputation of a visitor.

IP reputation is calculated based on Project Honeypot, external public IP information, as well as internal threat intelligence from WAF managed rules and DDoS.

Two-factor authentication (2FA) is a security process in which a user provides two different authentication factors to verify their identity. In addition to something you know, typically your password, 2FA adds an extra layer of security to user logins by requiring users to also present something they have, such as Yubikey or a one-time login code, or something you are, such as a fingerprint.

It adds an extra layer of security to user logins by requiring users to present two or more separate pieces of evidence (factors) that establish their identity.