Edit zone settings info

PATCH

https://api.cloudflare.com/client/v4/zones/{zone_identifier}/settings

Zone Settings

Last modified:2022-12-16 13:48:36

Edit settings for a zone.

Request

Path Params

zone_identifier

string

required

Body Params application/json

items

array[null (setting) {56}]

required

One or more zone setting objects. Must contain an ID and a value.

>= 1 items

Example:

[{"id":"always_online","value":"on"},{"id":"browser_cache_ttl","value":18000},{"id":"ip_geolocation","value":"off"}]

object

Always Online Mode

optional

When enabled, Cloudflare serves limited copies of web pages available from the Internet Archive's Wayback Machine if your server is offline. Refer to Always Online for more information.

object

Advanced DDoS Protection

optional

Advanced protection from Distributed Denial of Service (DDoS) attacks on your website. This is an uneditable value that is 'on' in the case of Business and Enterprise zones.

object

Brotli Compression

optional

When the client requesting an asset supports the Brotli compression algorithm, Cloudflare will serve a Brotli compressed version of the asset.

object

Browser Cache TTL

optional

Browser Cache TTL (in seconds) specifies how long Cloudflare-cached resources will remain on your visitors' computers. Cloudflare will honor any larger times specified by your server. (https://support.cloudflare.com/hc/en-us/articles/200168276).

object

Browser Check

optional

Browser Integrity Check is similar to Bad Behavior and looks for common HTTP headers abused most commonly by spammers and denies access to your page. It will also challenge visitors that do not have a user agent or a non standard user agent (also commonly used by abuse bots, crawlers or visitors). (https://support.cloudflare.com/hc/en-us/articles/200170086).

object

Cloudflare CNAME Flattening

optional

Whether or not cname flattening is on.

object

Cloudflare Cache Level

optional

Cache Level functions based off the setting level. The basic setting will cache most static resources (i.e., css, images, and JavaScript). The simplified setting will ignore the query string when delivering a cached resource. The aggressive setting will cache all static resources, including ones with a query string. (https://support.cloudflare.com/hc/en-us/articles/200168256).

object

Challenge Page TTL

optional

Specify how long a visitor is allowed access to your site after successfully completing a challenge (such as a CAPTCHA). After the TTL has expired the visitor will have to complete a new challenge. We recommend a 15 - 45 minute setting and will attempt to honor any setting above 45 minutes. (https://support.cloudflare.com/hc/en-us/articles/200170136).

object

Development Mode

optional

Development Mode temporarily allows you to enter development mode for your websites if you need to make changes to your site. This will bypass Cloudflare's accelerated cache and slow down your site, but is useful if you are making changes to cacheable content (like images, css, or JavaScript) and would like to see those changes right away. Once entered, development mode will last for 3 hours and then automatically toggle off.

object

Early Hints

optional

When enabled, Cloudflare will attempt to speed up overall page loads by serving 103 responses with Link headers from the final response. Refer to Early Hints for more information.

object

Edge Cache TTL

optional

Time (in seconds) that a resource will be ensured to remain on Cloudflare's cache servers.

object

Error Pages On

optional

Cloudflare will proxy customer error pages on any 502,504 errors on origin server instead of showing a default Cloudflare error page. This does not apply to 522 errors and is limited to Enterprise Zones.

Default:

off

object

Get String Sort

optional

Cloudflare will treat files with the same query strings as the same file in cache, regardless of the order of the query strings. This is limited to Enterprise Zones.

Default:

off

object

Email Obfuscation

optional

Encrypt email adresses on your web page from bots, while keeping them visible to humans. (https://support.cloudflare.com/hc/en-us/articles/200170016).

object

Hotlink Protection

optional

When enabled, the Hotlink Protection option ensures that other sites cannot suck up your bandwidth by building pages that use images hosted on your site. Anytime a request for an image on your site hits Cloudflare, we check to ensure that it's not another site requesting them. People will still be able to download and view images from your page, but other sites won't be able to steal them for use on their own pages. (https://support.cloudflare.com/hc/en-us/articles/200170026).

object

IP Geolocation

optional

Enable IP Geolocation to have Cloudflare geolocate visitors to your website and pass the country code to you. (https://support.cloudflare.com/hc/en-us/articles/200168236).

object

IPv6

optional

Enable IPv6 on all subdomains that are Cloudflare enabled. (https://support.cloudflare.com/hc/en-us/articles/200168586).

object

WebSockets

optional

WebSockets are open connections sustained between the client and the origin server. Inside a WebSockets connection, the client and the origin can pass data back and forth without having to reestablish sessions. This makes exchanging data within a WebSockets connection fast. WebSockets are often used for real-time applications such as live chat and gaming. For more information refer to Can I use Cloudflare with Websockets.

object

Toggle SHA1 support

optional

Allow SHA1 support.

object

TLS1.2 only

optional

Only allows TLS1.2.

object

Auto-Minify Assets

optional

Automatically minify certain assets for your website. Refer to Using Cloudflare Auto Minify for more information.

object

Max Upload

optional

Maximum size of an allowable upload.

object

Mobile Redirect

optional

Automatically redirect visitors on mobile devices to a mobile-optimized subdomain. Refer to Understanding Cloudflare Mobile Redirect for more information.

object

Mirage Image Optimization

optional

Automatically optimize image loading for website visitors on mobile devices. Refer to our blog post for more information.

object

Network Error Logging

optional

Enable Network Error Logging reporting on your zone. (Beta)

object

Polish Image Optimization

optional

Removes metadata and compresses your images for faster page load times. Basic (Lossless): Reduce the size of PNG, JPEG, and GIF files - no impact on visual quality. Basic + JPEG (Lossy): Further reduce the size of JPEG files for faster image loading. Larger JPEGs are converted to progressive images, loading a lower-resolution image first and ending in a higher-resolution version. Not recommended for hi-res photography sites.

object

Polish WebP Conversion

optional

When the client requesting the image supports the WebP image codec, and WebP offers a performance advantage over the original image format, Cloudflare will serve a WebP version of the original image.

object

Prefetch preload

optional

Cloudflare will prefetch any URLs that are included in the response headers. This is limited to Enterprise Zones.

Default:

off

object

Privacy Pass

optional

Privacy Pass is a browser extension developed by the Privacy Pass Team to improve the browsing experience for your visitors. Enabling Privacy Pass will reduce the number of CAPTCHAs shown to your visitors. (https://support.cloudflare.com/hc/en-us/articles/115001992652-Privacy-Pass).

object

Response Buffering

optional

Enables or disables buffering of responses from the proxied server. Cloudflare may buffer the whole payload to deliver it at once to the client versus allowing it to be delivered in chunks. By default, the proxied server streams directly and is not buffered by Cloudflare. This is limited to Enterprise Zones.

Default:

off

object

Rocket Loader

optional

Rocket Loader is a general-purpose asynchronous JavaScript optimisation that prioritises rendering your content while loading your site's Javascript asynchronously. Turning on Rocket Loader will immediately improve a web page's rendering time sometimes measured as Time to First Paint (TTFP), and also the window.onload time (assuming there is JavaScript on the page). This can have a positive impact on your Google search ranking. When turned on, Rocket Loader will automatically defer the loading of all Javascript referenced in your HTML, with no configuration required. Refer to Understanding Rocket Loader for more information.

object

Security Header

optional

Cloudflare security header for a zone.

object

Security Level

optional

Choose the appropriate security profile for your website, which will automatically adjust each of the security settings. If you choose to customize an individual security setting, the profile will become Custom. (https://support.cloudflare.com/hc/en-us/articles/200170056).

object

Server Side Exclude

optional

If there is sensitive content on your website that you want visible to real visitors, but that you want to hide from suspicious visitors, all you have to do is wrap the content with Cloudflare SSE tags. Wrap any content that you want to be excluded from suspicious visitors in the following SSE tags: . For example: Bad visitors won't see my phone number, 555-555-5555 . Note: SSE only will work with HTML. If you have HTML minification enabled, you won't see the SSE tags in your HTML source when it's served through Cloudflare. SSE will still function in this case, as Cloudflare's HTML minification and SSE functionality occur on-the-fly as the resource moves through our network to the visitor's computer. (https://support.cloudflare.com/hc/en-us/articles/200170036).

object

SSL

optional

SSL encrypts your visitor's connection and safeguards credit card numbers and other personal data to and from your website. SSL can take up to 5 minutes to fully activate. Requires Cloudflare active on your root domain or www domain. Off: no SSL between the visitor and Cloudflare, and no SSL between Cloudflare and your web server (all HTTP traffic). Flexible: SSL between the visitor and Cloudflare -- visitor sees HTTPS on your site, but no SSL between Cloudflare and your web server. You don't need to have an SSL cert on your web server, but your vistors will still see the site as being HTTPS enabled. Full: SSL between the visitor and Cloudflare -- visitor sees HTTPS on your site, and SSL between Cloudflare and your web server. You'll need to have your own SSL cert or self-signed cert at the very least. Full (Strict): SSL between the visitor and Cloudflare -- visitor sees HTTPS on your site, and SSL between Cloudflare and your web server. You'll need to have a valid SSL certificate installed on your web server. This certificate must be signed by a certificate authority, have an expiration date in the future, and respond for the request domain name (hostname). (https://support.cloudflare.com/hc/en-us/articles/200170416).

object

SSL/TLS Recommender

optional

Enrollment in the SSL/TLS Recommender service which tries to detect and recommend (by sending periodic emails) the most secure SSL/TLS setting your origin servers support.

object

TLS Client Authentication

optional

TLS Client Auth requires Cloudflare to connect to your origin server using a client certificate (Enterprise Only).

object

True Client IP Header

optional

Allows customer to continue to use True Client IP (Akamai feature) in the headers we send to the origin. This is limited to Enterprise Zones.

Default:

off

object

Proxy Read Timeout

optional

Maximum time between two read operations from origin.

object

Web Application Firewall

optional

The WAF examines HTTP requests to your website. It inspects both GET and POST requests and applies rules to help filter out illegitimate traffic from legitimate website visitors. The Cloudflare WAF inspects website addresses or URLs to detect anything out of the ordinary. If the Cloudflare WAF determines suspicious user behavior, then the WAF will 'challenge' the web visitor with a page that asks them to submit a CAPTCHA successfully to continue their action. If the challenge is failed, the action will be stopped. What this means is that Cloudflare's WAF will block any traffic identified as illegitimate before it reaches your origin web server. (https://support.cloudflare.com/hc/en-us/articles/200172016).

object

Zone Minimum TLS Version value

optional

Only accepts HTTPS requests that use at least the TLS protocol version specified. For example, if TLS 1.1 is selected, TLS 1.0 connections will be rejected, while 1.1, 1.2, and 1.3 (if enabled) will be permitted.

Default:

1.0

object

Zone ciphers allowed for TLS termination

optional

An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.

object

Enable TLS 1.3 value for a zone

optional

Enables Crypto TLS 1.3 feature for a zone.

Default:

off

object

Enable Opportunistic Encryption for a zone

optional

Enables the Opportunistic Encryption feature for a zone.

object

Zone Enable Automatic HTTPS Rewrites

optional

Enable the Automatic HTTPS Rewrites feature for this zone.

Default:

off

object

HTTP2 Value

optional

HTTP2 enabled for this zone.

object

HTTP3 Value

optional

HTTP3 enabled for this zone.

object

Origin Max HTTP version

optional

The highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to Enable HTTP/2 to Origin, for more information.).

object

0-RTT Value

optional

0-RTT session resumption enabled for this zone.

object

Pseudo IPv4 Value

optional

The value set for the Pseudo IPv4 setting.

object

Zone Enable Always Use HTTPS

optional

Reply to all requests for URLs that use "http" with a 301 redirect to the equivalent "https" URL. If you only want to redirect for a subset of requests, consider creating an "Always use HTTPS" page rule.

Default:

off

object

Zone Enable Onion Routing

optional

Add an Alt-Svc header to all legitimate requests from Tor, allowing the connection to use our onion services instead of exit nodes.

Default:

off

object

Orange to Orange

optional

Orange to Orange (O2O) allows zones on Cloudflare to CNAME to other zones also on Cloudflare.

object

Image Resizing

optional

Image Resizing provides on-demand resizing, conversion and optimisation for images served through Cloudflare's network. Refer to the Image Resizing documentation for more information.

object

HTTP/2 Edge Prioritization

optional

HTTP/2 Edge Prioritization optimises the delivery of resources served through HTTP/2 to improve page load performance. It also supports fine control of content delivery when used in conjunction with Workers.

object

Automatic Platform Optimization for WordPress

optional

Automatic Platform Optimization for WordPress serves your WordPress site from Cloudflare's edge network and caches third-party fonts.

Example

{
  "items": [
    {
      "id": "always_online",
      "value": "on"
    },
    {
      "id": "browser_cache_ttl",
      "value": 18000
    },
    {
      "id": "ip_geolocation",
      "value": "off"
    }
  ]
}

Request samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location --request PATCH 'https://api.cloudflare.com/client/v4/zones//settings' \
--header 'Content-Type: application/json' \
--data-raw '{
    "items": [
        {
            "id": "always_online",
            "value": "on"
        },
        {
            "id": "browser_cache_ttl",
            "value": 18000
        },
        {
            "id": "ip_geolocation",
            "value": "off"
        }
    ]
}'

Responses

🟢200Edit zone settings info response

application/json

Body

allOf {2}

optional

object (api-response-collection)

optional

errors

array [object {2}]

messages

required

Example:

[]

messages

array [object {2}]

messages

required

Example:

[]

result

required

success

enum<boolean>

required

Whether the API call was successful

Allowed value:

true

Example:

true

result_info

object

result_info

optional

object

optional

result

optional

Example

{
  "errors": [],
  "messages": [],
  "result": [
    null
  ],
  "success": true,
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}

🟢200Edit zone settings info response failure

Get all Zone settings

Get 0-RTT session resumption setting