Glossary

The SSL/TLS certificates that Cloudflare presents to clients visiting your website or application.

Because of how Cloudflare works, there can actually be two certificates involved in a single request: an edge certificate and an origin certificate.

ECS is a DNS extension that enables recursive DNS resolvers to include client IP address information in their DNS queries.

Not all resolvers use ECS but, if they do, usually a part of the IP address is omitted. Sending ECS headers is generally intended to reduce latency and speed up content delivery in connection to CDNs and load balancers Open external link . The ECS mechanism is specified in RFC 7871 Open external link .

Any service or hardware that intercepts and processes incoming public or private traffic.

Examples of endpoints include origins, hostnames, private or public IP addresses, virtual IP addresses (VIPs), servers, and other dedicated hardware boxes.

Exposed credentials refers to sensitive authentication information disclosed in some way (for example, due to misconfigurations, data breaches, or simple human error), allowing other parties to gain access to digital resources.

Credentials may include usernames, passwords, API keys, authentication tokens, or private keys.

Requests issued by a monitor at regular interval and — depending on the monitor settings — return a pass or fail value to make sure an endpoint is still able to receive traffic.

Each health monitor request is trying to answer two questions:

1. Is the endpoint offline?: Does the endpoint respond to the health monitor request at all? If so, does it respond quickly enough (as specified in the monitor’s Timeout field)?
2. Is the endpoint working as expected?: Does the endpoint respond with the expected HTTP response codes? Does it include specific information in the response body?

If the answer to either of these questions is “No”, then the endpoint fails the health monitor request.

A Durable Object migration is a mapping process from a class name to a runtime state. Initiate a Durable Object migration when you need to:

• Create a new Durable Object class.
• Rename a Durable Object class.
• Delete a Durable Object class.
• Transfer an existing Durable Objects class.

A monitor issues health monitor requests at regular intervals to evaluate the health of each endpoint within a pool.

When a pool becomes unhealthy, your load balancer takes that pool out of the endpoint rotation.

A nameserver is a dedicated server that translates human readable hostnames (www.example.com) into IP addresses.

Nameservers like root servers, TLD servers, and authoritative nameservers are fundamental components of the Domain Name System (DNS).

Within Cloudflare, pools represent your endpoints and how they are organized. As such, a pool can be a group of several endpoints, or you could also have only one endpoint (an origin server, for example) per pool.

If you are familiar with DNS terminology, think of a pool as a “record set,” except Cloudflare only returns addresses that are considered healthy. You can attach health monitors to individual pools for customized monitoring.

A number that identifies the network portion of an IP address. It tells devices if an IP address is on the same network or not. It is shown as a number after a slash (for example, /31) at the end of the IP address.

Using an analogy, the prefix is like a street address. If an IP is in the same street, it belongs to the same network of devices.

The proxy status of a DNS record defines whether requests for your domain will route through Cloudflare (proxied) or not (DNS-only).

When a DNS record is proxied, requests are processed according to your configurations, and Cloudflare can optimize, cache, and protect your domain. Refer to How Cloudflare works for details.

SNI allows a server to host multiple TLS Certificates for multiple websites using a single IP address. SNI adds the website hostname in the TLS handshake to inform the server which website to present when using shared IPs.

Cloudflare uses SNI for all Universal SSL certificates.

Shadow IT is the unsanctioned use of software, hardware, or other systems and services within an organization, often without the knowledge of that organization’s information technology (IT) department.

For more information, refer to the Cloudflare Learning Center Open external link .

The customizable portion of your team domain, allowing you to personalize your Cloudflare Zero Trust configuration. You can view your team name in Zero Trust under Settings > Custom Pages.

To learn about the consequences of changing your team name, refer to the FAQ.

Two-factor authentication (2FA) is a security process in which a user provides two different authentication factors to verify their identity. In addition to something you know, typically your password, 2FA adds an extra layer of security to user logins by requiring users to also present something they have, such as Yubikey or a one-time login code, or something you are, such as a fingerprint.

It adds an extra layer of security to user logins by requiring users to present two or more separate pieces of evidence (factors) that establish their identity.

The level to which a certificate authority validates domain ownership before issuing an SSL/TLS certificate.

The different certificate validation levels are DV (Domain Validated), OV (Organization Validated), or EV (Extended Validation).