Once you point that record at us, every request for your site comes through our Worker on its way to your origin. If we are having a bad day, you are having one too. Pretending otherwise would be the one thing this feature cannot afford, so here is exactly what we have built so that the bad day is survivable.
If our code throws — any of it — we re-issue the request to your origin and return what it says. The request is cloned before we touch anything, so this works even for a form post whose body we already read. In our own source the rule is written as a contract: There is no code path in which an internal error of ours becomes an error page on a customer’s site.
A hostname we do not recognise gets a 421 Misdirected Request and nothing else. There is no default site, no wildcard, no "first one in the list". We would rather serve nothing than serve you somebody else's site — a fallback tenant is exactly how one customer's visitor ends up reading another customer's page.
One button in your dashboard suspends injection, markdown twins and resource overrides and turns us into a plain forwarder. It takes effect everywhere within sixty seconds. Sixty is not a marketing round number: it is how long the edge caches that setting, it is the shortest interval the platform allows, and there is a test that fails if anyone raises it.
Traffic follows DNS. Point the record back where it was and we are out of the path as soon as it propagates. No ticket, no offboarding call, no thirty-day export window, and no agreement required from us. The way out is yours and unilateral — that is the single most important sentence on this page.
The Worker that sits in front of your site carries no Cloudflare account credential and no signing key. Its only authority is that one site's own edge token. If it were compromised, the blast radius is the thing it was already allowed to do.
One thing the switch deliberately does not stop is the analytics tap, because the switch exists for when our response handling is suspected of harming a site — and the tap is a fire-and-forget request whose result is never read. Silently losing your analytics during an incident would be a second outage nobody asked for. If you want true silence, we can turn telemetry off for the site, or you remove the record. Either way we would rather tell you than let you assume. What we record →
You point a hostname at our zone. Cloudflare for SaaS issues the certificate — on our zone, which is why you need no Cloudflare account, no API token and no plugin. A single multi-tenant Worker resolves your site from the Host header and nothing else, fetches the page from your real origin over HTTPS with the right SNI, and returns it with your approved changes merged in.
That architecture is why "any host" is a flat statement rather than a matrix: WordPress anywhere, Shopify, Squarespace, Webflow, a Vercel app, a box you rent. From where we stand they are all just an origin that answers on a name.
Three components — edge serving, the control plane, the telemetry pipeline — reported worst-not-average, so one broken thing cannot be averaged into a green tick. Each one states what evidence it is based on and how old that evidence is, because "we last heard from this four hours ago" is a different fact from "it is fine". It has zero external dependencies and it renders even when our own database is down, which is the only time a status page has a job to do.