Shield Setup

From signup to your first request flowing through Shield in about 10 minutes. DNS, cert provisioning, mode selection, the first 24h.

Prerequisites

  • A verified domain in Settings → Domains. Shield can't protect a domain you haven't proven you own.
  • Access to your DNS provider to add a CNAME record.
  • An accessible origin (Cloud Run, Vercel, your own VPS — anything with a public IP / hostname).

Step 1 — Add the site in Shield

  1. Shield → + Add site
  2. Pick the verified domain (or subdomain).
  3. Enter your origin URL — where Shield should proxy verified traffic. e.g. https://my-app-xyz.run.app.
  4. Optional: paste your OpenAPI spec for Schema Enforcement (can do later).
  5. Click Create. Sectora provisions Cloudflare for SaaS metadata; you'll get DNS instructions on the next screen.

Origin options — one server, multiple IPs, or a load balancer

The origin URL is a single value — one URL, hostname, or IP (Shield prepends https://if you omit the scheme). You can't type a list of IPs into that field. How you point it decides your origin topology:

  • One server — put the IP or hostname directly: 203.0.113.10 or https://my-app.run.app.
  • Multiple IPs (DNS round-robin) — put a hostname in the origin field and give that hostname several A records at your DNS. Shield resolves the hostname on each request, so traffic spreads across all the IPs automatically.
  • Health-checked failover — point the origin at a load balancer hostname/IP and let the LB own the pool + health checks.

Multiple-IP example

# What visitors hit — CNAME'd to Shield (Step 2)
www.yourdomain.com   CNAME  customers.sectora.io   (DNS only / gray cloud)

# Shield "origin URL" field:  origin.yourdomain.com   ← a HOSTNAME, not an IP

# That origin hostname's A records — your backend IPs go HERE:
origin.yourdomain.com   A   203.0.113.10
origin.yourdomain.com   A   203.0.113.11
origin.yourdomain.com   A   203.0.113.12

Caveat: multiple A records give you round-robin, not health-aware failover — if one IP goes down, a share of requests still hit it until you remove the record. For automatic failover, use a load balancer.

Step 2 — Configure DNS

At your DNS provider, add the records Sectora gave you. Two records, typically:

# Main CNAME — routes user traffic to Shield
yourdomain.com  CNAME  customers.sectora.io  (DNS only / gray cloud)

# Validation TXT — proves to Cloudflare you own this hostname
_acme-challenge.yourdomain.com  TXT  "xyz-validation-string-from-sectora"

Step 3 — Wait for cert provisioning

Sectora auto-issues a per-hostname TLS cert via Cloudflare for SaaS. Typical timeline:

  • 0–2 min — DNS propagation, validation TXT confirmed.
  • 2–10 min — Cert issuance complete. The Shield site page flips from "provisioning" to "active".
  • 10–60 min — Edge propagation. Some PoPs may serve a Cloudflare default cert until the new cert reaches them.

If it's stuck in "provisioning" for > 30 min, check the Reconciler page — usually a DNS issue (orange cloud, wrong CNAME target, or wildcard cert detected on your domain).

Step 4 — Test in Log mode

Every new site starts in Log mode. All Shield layers run and record decisions, but NOTHING is blocked. Traffic passes through to your origin exactly as before.

Leave it in Log mode for at least 24 hours. The Shield analytics dashboard will populate with:

  • Total requests + p50/p95 latency added by Shield (should be <15ms).
  • What WOULD have been blocked at each layer.
  • Anomaly score distribution (the curve of legitimate traffic — your baseline).
  • Bot vs human ratio.
  • Geographic + ASN heat map.

Look for false positives. A rule that'd block 5% of your legit traffic is broken — disable that layer or tune its threshold before flipping to Block.

Step 5 — Flip to Block mode

  1. Review the Log-mode analytics one more time. Confirm the block rate looks sane (typically 0.5–5% of requests).
  2. Shield → your site → Settings → Mode → Block.
  3. Watch the next 60 min closely. Real impact appears in the "blocked" chart.

If something looks wrong, flipping back to Log is one click. No DNS change. Rollout is <30s globally.

Step 6 — Tune individual layers

Once you're comfortable in Block mode, walk through each layer. Recommended order:

  1. Managed Rulesets — start here, lowest FP risk.
  2. IP Access — block known-bad ASNs and obviously-attacker geographies.
  3. Rate Limiting — protect login + signup + sensitive endpoints from brute force.
  4. Virtual Patching — wire to your scanner output.
  5. Schema Enforcement — upload your OpenAPI.
  6. Bot Detection — most aggressive layer; enable last.
  7. Anomaly Scoring — fine-tuning the catch-all.

Troubleshooting

"Hostname stuck in provisioning"

  • Confirm the CNAME is set to DNS only (gray cloud).
  • Confirm the validation TXT record matches exactly what Sectora provided.
  • If your domain has a wildcard cert (*.example.com) issued elsewhere, Cloudflare for SaaS may refuse — the Reconciler will log "wildcard cert detected".

"Shield returns 521 / 525 / 526 errors"

  • 521 — Origin refused the connection. Check your origin is up + accepts connections from Cloudflare IPs.
  • 525 — TLS handshake to origin failed. Check the origin's cert is valid + matches the hostname Shield sends in the Host header.
  • 526 — Origin presents an invalid cert. Set the site's Origin TLS mode to "Full" (not "Full Strict") if you're using self-signed.

What's next