Citadel Docs
Set up, tune, and operate Citadel: Cloudflare routing, protected domains, challenges, allowlists, caching, traffic visibility, bandwidth, alerts, and billing.
Start here
Connect Cloudflare, understand protection, and activate your first site.
Getting started with Citadel
Set up Citadel step by step: add your domain and origin, point proxied Cloudflare DNS records at the ingress IP, set SSL to Full, and pick a challenge mode.
Citadel protection overview
Read fleet health, live traffic, bandwidth, and domains needing setup.
Set up Cloudflare for Citadel
Point proxied (orange cloud) Cloudflare A records at the Citadel ingress IP, set SSL/TLS to Full, and fix domains that stay awaiting DNS.
Domains
Manage protected hostnames, origins, DNS, and health.
Manage Citadel domains
Add a domain to Citadel with its root name, origin host, port and TLS setting, check its connection, search the Domains list, or remove protection.
Understand a Citadel domain's status
Find a domain's Citadel ingress IP, see when its status changes from awaiting DNS to Active, and jump to Origin, Health, Security, Cache and Insights.
Configure Citadel origins and hostnames
Configure the backend Citadel forwards clean traffic to: apex host, port and TLS-to-origin, plus protected subdomains that share or override it.
Check Citadel origin health
Run Citadel origin health probes to diagnose latency, failed checks and 502 errors, then fix origin host, port, TLS or firewall settings and re-test.
Citadel DNS stays in Cloudflare
Keep Cloudflare nameservers and point protected web records at Citadel.
Protection
Choose challenge levels, bypasses, branding, caching, and incident controls.
Configure Citadel security
Choose challenge levels and review allowlists, blocklists, and rate limits.
Citadel challenge levels explained
Choose Off, Cookie, JS, Interaction, Auto, or Lockdown for the situation.
Brand Citadel challenge and error pages
Customize visual HTML shells while Citadel supplies the mitigation controls.
Configure Citadel allowlists
Bypass challenges for trusted paths, IPs, and user agents on every hostname.
Use Citadel cache and purge
Enable Citadel caching for static files such as CSS, JavaScript, images and fonts, bypass dynamic paths like /api/, and purge the cache after a release.
Read Citadel insights and attack timeline
Follow an attack on one domain: charts, the attack and event timeline, and the challenge and block reasons behind Citadel's recent decisions.
Traffic
Investigate request logs, analytics, bandwidth, and speed limits.
Search Citadel domain logs
Search 15 days of Citadel access, security and origin-error logs by IP, path, host or request ID, with filters, sorting and ASN and country details.
Use Citadel analytics
Compare edge, proxied and blocked request trends across all Citadel domains, spot traffic spikes, and drill into one site with Insights and Logs.
Track Citadel bandwidth and speed limits
Review clean-traffic quota, live transfer, and per-domain outbound caps.
Account
Manage your team, alerts, billing, and support.