Cloudflare Security Effectiveness Assessment — smartbackgroundchecks.com

Scope: Single zone — smartbackgroundchecks.com (zone ID bdc17fff8bb8538d768382c84182465f, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

Mid-scale traffic, aggressively filtered. The zone served 358.0M requests / 4.44 TB over 30 days, with 75.8M requests (21.2%) served a 403 and 201K rate-limited (429). US traffic is clean; foreign traffic (Netherlands, Brazil, France, Vietnam) runs at 95–99% threat rates. (Confirmed)
Automation is a large minority of scored traffic. Of ~340M scored requests, ~43% score as likely-human, ~30% automated, ~27% grey. Cloudflare flagged 25.3M requests as threats. (Confirmed)
Cloudflare is containing abuse — through a single tier. Custom rules generated 117.5M events (25.3M blocks + 47.3M challenges) and carry essentially all enforcement; the managed-challenge layer runs at a ~91.5% abandonment rate. (Confirmed)
The Managed WAF / OWASP ruleset is completely inactive. It generated zero firewall events in 30 days — no signature-based defense (SQLi/XSS/RCE/traversal) and no WAF-layer attack telemetry. This is significant because the site exposes a dynamic /search.php endpoint and phone/record-lookup paths. (Confirmed)
Rate limiting is well-targeted but low-volume, and security-level challenging is off. Rate-limit rules challenge on /people/<name> record pages (good targeting) but fired only 226.6K times; no securitylevel events were observed. (Confirmed / Likely)
Perimeter hygiene is excellent. DNS is clean (31 records): every production A/CNAME is proxied, with no exposed origin IP, no RFC1918, and no origin-bypass record. The edge cannot be trivially circumvented. (Confirmed)
Scraping is the dominant threat, and it is cloud-based. Top block sources are Google Cloud (4.0M), a German hosting network (1.3M), VNPT, Alibaba, and AWS — using rotating spoofed browser user-agents against the homepage, search, and record pages. (Confirmed)
Overall risk: HIGH — a PII background-check property with a dynamic search surface and no active signature WAF or attack telemetry, dependent on a single enforcing tier. This is partly offset by a clean perimeter and effective custom-rule + bot-challenge enforcement, which is why it is not CRITICAL. Executive score: 61/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Metric	Value
Total requests	358,043,973 (358.0M)
Cached requests	165,961,426 (46.4%)
Uncached requests	192,082,547 (53.6%)
Total bandwidth	4.44 TB
Encrypted (HTTPS) share	98.0%
Requests flagged "threat"	25,281,427 (~7.1%)

Edge response codes (Confirmed): 200 253.2M (70.7%) · 403 75.8M (21.2%) · 204 16.78M · 301 3.79M · 302 2.86M · 304 2.13M · 499 1.90M · 404 1.38M · 429 201K · 500 10.8K. The 21.2% 403 rate is the visible footprint of the (custom-rule-driven) security layer.

Human vs Bot breakdown

Derived from the adaptive bot-score dataset — estimates with stated assumptions. The adaptive total (≈763M) counts more broadly than the billing rollup; ~423M were unscored (predominantly cached edge hits). Percentages are given as a share of scored traffic.

Segment	Definition	Volume	% of scored
Likely human	botScore 80–99	146.1M	43.0%
Automated / bot	botScore 1–29	102.6M	30.2%
Grey / uncertain	botScore 30–79	91.3M	26.9%
(Unscored)	botScore 0 — mostly cached	423.2M	—

Verified good bots (Confirmed — verifiedBotCategory, ~58M total): AI Crawler 25.4M · AI Search 12.1M · Advertising & Marketing 8.59M · Search Engine Crawler 7.88M · SEO 2.49M · Page Preview 1.12M · other <0.6M each. (AI-related crawling — Crawler + Search ≈ 37.5M — is the largest verified-bot load.)

Assumptions: (1) botScore < 30 = automated per Cloudflare guidance; (2) unscored traffic excluded from ratios (cache-dominated); (3) verified good bots reported separately as they legitimately score low. Takeaway: the property leans human, but nearly a third of scored traffic is automated and foreign automated traffic is almost entirely hostile.

3. Cloudflare Protection Effectiveness

Observed firewall events over 30 days. Rule thresholds/bodies were not readable (403); ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

Source	Events	Role
Custom rules (`firewallCustom`)	117,513,420	Primary — and effectively only — enforcement engine
Rate limiting (`ratelimit`)	226,570	Enforcing (challenge), well-targeted but low-volume
IP rules (`ip`)	42,890	Minimal
Managed WAF (`firewallManaged`)	0	No events — completely inactive
(Security Level)	0 observed	No reputation challenges firing (Likely off)

3.2 Events by action (Confirmed, all sources)

managed_challenge 47.32M · block 25.28M · managed_challenge_bypassed 23.11M · skip 18.02M · managed_challenge_non_interactive_solved 2.58M · managed_challenge_interactive_solved 1.42M · allow 42.9K. (No log-mode action — posture is challenge/block.)

3.3 Per-protection scorecard

Protection	Events	Blocks	Challenges	Allowed/Skip	Est. effectiveness	Rating
Custom Rules	117.5M	25.28M	47.32M issued	18.02M skip	Terminal blocks enforced; carries the whole zone	Excellent
Managed WAF (Cloudflare Managed Ruleset)	0	0	—	—	Deployed in inventory but not executing	Missing
OWASP Core Ruleset	0	0	—	—	Not contributing	Missing
Rate Limiting	226,570	140	~226K (challenge)	—	Enforcing via challenge, targeted at record pages; low volume	Needs Improvement
Bot Management	drives challenges	via rules	47.32M	—	Scoring active; 91.5% challenge-abandon	Good / Excellent
Managed Challenge	47.32M issued	—	47.32M	4.00M solved	~91.5% did not solve → strong deterrence	Excellent
JS Challenge	not observed	—	—	—	Not in use (managed challenge used)	N/A
Security Level	0 observed	—	0	—	No reputation challenges firing	Missing / Off (Likely)

Challenge math (Confirmed): 47.32M challenges issued, 4.00M solved → ~91.5% abandonment. A further 23.11M "bypassed" events are returning clients with valid clearance tokens (benign).

Managed WAF finding (Confirmed): the Cloudflare Managed Ruleset (v377) and OWASP Core Ruleset (v88) appear in the ruleset inventory but generated zero firewall events in 30 days. There is therefore no active signature-based defense and no WAF-layer telemetry. On a site exposing a dynamic /search.php endpoint and record-lookup paths, injection/exploit attempts are neither blocked nor recorded — they would be stopped only if a custom rule happens to match.

Rate limiting finding (Confirmed): two active rate-limit rules challenge on threshold, well-aimed at /people/<name> person-record pages — the correct target for a background-check property. However, total volume is low (226.6K events), suggesting thresholds are high or coverage is narrow relative to the scraping pressure.

Security-level finding (Likely): no securitylevel-sourced events were observed, indicating reputation-based challenging is not active (security level appears essentially off). The exact setting value returned 403 (Unknown), but its behavioral signature is absent.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Netherlands 4.09M · Brazil 2.18M · France 1.83M · Vietnam 1.21M · Bangladesh 0.92M · Argentina 0.82M · Pakistan 0.76M · Iraq 0.68M · India 0.59M · Japan 0.54M · Singapore 0.52M · Colombia 0.47M. (NL dominance reflects datacenter/hosting scraping; US does not appear — US traffic is clean.)

Top attacking ASNs (operator names from public registries, not Cloudflare data — Likely): AS396982 Google Cloud 4.00M · AS29066 Velia.net (Germany hosting) 1.30M · AS45899 VNPT (Vietnam) 0.99M · AS55569 (hosting) 0.51M · AS45102 Alibaba Cloud 0.45M · AS212238 Datacamp/CDN77 0.29M · AS16509 Amazon AWS 0.28M · AS8193 0.19M · AS25019 0.18M · AS28573 Claro (Brazil) 0.17M · AS14593 SpaceX Starlink 0.17M · AS199739 0.16M. The attack profile is overwhelmingly cloud/hosting-based scraping.

Top targeted paths (block events): / 296.8K · /favicon.ico 269.0K · /robots.txt 110.1K · /optout 90.8K · /search.php 13.8K · /service-worker.js 13.0K · /phone/9139937139 12.0K (phone-record lookup) · a cluster of /css/* and /vendor/* assets (Bootstrap, jQuery — full-page rendering) · /manifest.json · /images/*.svg.

Top abusive IPs (block events): 92.204.248.55 (GoDaddy hosting) 1.26M · 63.32.23.121 (AWS) 91.2K · 182.161.74.84–94 (a /24 cluster) ~80K each · 52.215.186.214 (AWS) 71.4K · 54.194.183.189 (AWS) 49.3K · 35.212.115.150 (Google Cloud) 49.0K · 34.90.28.61 (Google Cloud) 46.3K.

Top blocked user-agents (Confirmed): an evenly-distributed set of generic spoofed browser UAs — Chrome 145/144/143/142 and Edge variants on Windows/Mac — each blocked ~1.29–1.31M times. (This near-uniform distribution across many near-identical modern-browser UAs is a classic user-agent-rotation scraping signature; no named crawler dominates.)

Most common "WAF" detections (Confirmed): because the managed WAF is inactive, all blocks come from custom rules. One rule — 0d00075d58504e1ead274212fc7100be — accounts for 24.94M blocks (~98.6% of all blocks); rule a7ee2cdd… blocks 334.6K; rule ecd1f33e… 9.0K. Rule names/expressions were not readable (403).

Most common rate-limit triggers (Confirmed): rule 1d52e27b… (201.75K challenges) and 52a7d1f9… (3.9K), challenging on /people/<name> person-record pages (/people/-miles, /people/harry-ponce, /people/edna-ponce, /people/laura-pitts, …) — correctly aimed at record scraping.

Abuse-indicator summary

Indicator	Evidence	Tier
Scraping	Cloud/hosting ASNs (GCP 4.0M, Velia, Alibaba, AWS, Datacamp) at scale; rotating spoofed browser UAs at ~1.3M each; full-page asset pulls	Confirmed — cloud-based
Enumeration	`/phone/<number>` lookup and `/people/<name>` record pages in block + rate-limit data	Confirmed
Search-endpoint abuse	`/search.php` appears in blocks — automated querying of the dynamic search endpoint	Likely
Opt-out / DSAR probing	`/optout` blocked 90.8K	Possible
Credential abuse	No login/auth-endpoint signal in block or rate-limit data	Unknown / no evidence
Authenticated abuse	Not observable from edge data — requires backend session/account correlation	Unknown
Injection/exploit attempts	Would be caught by the managed WAF/OWASP — but that layer is inactive, so attempts against `/search.php` and other dynamic paths are neither detected nor recorded	Unknown (blind spot)

Two evidence limits: (1) Cloudflare edge data cannot confirm account-level or authenticated abuse — that needs backend correlation. (2) With the managed WAF inactive, the zone has no telemetry on signature-based attacks — their absence here is a visibility gap, not proof they aren't occurring. This is especially relevant given the dynamic /search.php endpoint.

5. Protection Coverage

✓ Enabled / Confirmed active

Enterprise plan; Universal TLS certificates (Google Trust Services active, valid to 2026-09-01; Sectigo backup)
Apex, www, and product subdomains proxied (origin behind AWS Elastic Beanstalk)
Excellent DNS hygiene — 31 records, every production A/CNAME proxied, no exposed origin IP, no RFC1918, no origin-bypass record
Custom firewall ruleset — the enforcement engine (25.28M blocks + 47.32M challenges), updated recently (v116)
Rate limiting — enforcing and well-targeted at person-record pages (v40, the most-iterated rate-limit config in review)
Bot Management — entitled and scoring live traffic; Managed Challenge in heavy use (91.5% abandon)
Cloudflare Managed Ruleset (v377), OWASP Core (v88), Exposed Credentials Check, DDoS L7 — present in inventory (but see gaps)
URL Normalization; 98.0% encrypted traffic

⚠ Missing / inactive protections

Managed WAF / OWASP enforcement — deployed in inventory but generating zero events. No signature defense, no WAF telemetry, on a site with a dynamic search endpoint.
Security-level reputation challenge — no securitylevel events observed; appears essentially off.

⚠ Weak configuration

Rate limiting volume — correctly targeted but low (226.6K events) relative to the confirmed cloud-scraping pressure.
Single-tier dependence — custom rules are effectively the only enforcing layer; no signature or reputation backstop.
Only Universal certificates (no Advanced certificate) — functional, but fewer advanced-TLS options.

⚠ Unverifiable configuration (Unknown — 403)

SSL/TLS mode, min-TLS version, HSTS, exact security-level value, Page Shield status, Bot Management action config. Verify with a settings-scoped token; Page Shield is worth confirming on a data-collection property.

6. Operational Risk: HIGH

Why HIGH:

No active signature WAF on a dynamic PII search surface. The Managed WAF/OWASP ruleset generated zero events in 30 days, so injection/exploit attempts against /search.php, /phone/<number>, and other dynamic paths are neither blocked nor recorded. The zone has no visibility into whether such attacks are occurring. (Confirmed)
Single enforcing tier. With the managed WAF inactive and security-level challenging off, custom rules are effectively the only enforcing layer — a gap in one rule (98.6% of blocks come from a single rule) has no signature or reputation backstop. (Confirmed)
Confirmed, heavy, cloud-based scraping against record and search endpoints. (Confirmed)

Why not CRITICAL:

The perimeter has no bypass path — every production record is proxied, no origin IP or RFC1918 is published, so the edge cannot be trivially circumvented. (Confirmed)
The enforcement that runs is effective — 21.2% of traffic 403'd, 91.5% challenge abandonment, foreign hostile traffic blocked at the edge; rate limiting is correctly aimed at record scraping. No edge evidence of successful mass exfiltration. (Confirmed)

7. Recommendations (evidence-prioritized)

Highest impact

Activate the managed WAF / OWASP ruleset — this is the single most important action. Bring it into active execution (block for high-confidence signatures; brief log-then-tune for the rest). This closes the signature-defense gap on the dynamic /search.php surface and restores the attack telemetry the zone currently lacks entirely. Evidence: 0 managed events in 30 days. — Low–Medium effort
Increase rate-limiting coverage/sensitivity on record and search paths. The targeting (/people/<name>) is right; raise sensitivity and extend to /search.php and /phone/<number> so the rules actually bite under the confirmed cloud-scraping load. Evidence: 226.6K rate-limit events vs 25.3M blocks. — Low effort

Sustaining

Turn security level on (or set an appropriate reputation challenge) so known-bad IPs are challenged before reaching the custom rules. Evidence: zero securitylevel events observed. — Low effort
Preserve DNS hygiene. The clean, fully-proxied DNS is this zone's strongest control — keep new records proxied and avoid publishing origin IPs. Evidence: 31 records, no bypass path. — Low effort (governance)

Verify (blocked by token scope this run)

Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token. — Low effort

None of these require new licensing — all sit within the existing Enterprise entitlement.

8. Executive Score: 61 / 100

Interpretation: Effective scraping control on a clean perimeter, but a serious signature-defense gap. A strong custom-rule + bot-challenge tier and clean DNS keep cloud scraping contained; the score is held back by a completely inactive managed WAF on a dynamic PII endpoint, an off security level, and low rate-limit volume.

Dimension	Assessment	Deduction
Cloudflare coverage	Full ruleset stack in inventory + BM entitlement + fully-proxied DNS	—
Configuration consistency	Excellent DNS hygiene; no origin-bypass path	— (strength)
WAF maturity	Managed WAF + OWASP inactive (0 events) on a dynamic `/search.php` surface	−17
Rate limiting	Correctly targeted at record pages but low volume/coverage	−6
Bot protection	Scoring active; 91.5% challenge abandonment	small
Layered defenses	Custom rules the only enforcing tier; 98.6% of blocks from one rule; no backstop	−6
Security level	No reputation challenges firing (appears off)	−4
Observed attack success	Well-contained (21.2% 403, 91.5% abandon); no edge evidence of exfiltration	small
Verification gaps	Page Shield / TLS mode / HSTS unconfirmed; Universal-only certs; no WAF telemetry on dynamic surface	−6
Total		≈ −39 → 61/100

Bottom line: smartbackgroundchecks.com has a clean perimeter and an effective single tier of enforcement — custom rules and bot challenges are containing a heavy, cloud-based scraping campaign, and rate limiting is correctly aimed at record scraping. The dominant weakness is depth: the managed WAF/OWASP is entirely inactive, leaving a dynamic /search.php PII surface with no signature defense and no attack visibility, backed only by a single custom-rule tier with security level off. Activating the managed WAF is the one change that most reduces risk here — it is inside the current plan and would restore both the missing defense layer and the missing telemetry.