Citadel Docs
Set up, tune, and operate Citadel: Cloudflare routing, protected domains, challenges, allowlists, caching, traffic visibility, bandwidth, alerts, and billing.
Start here
Connect Cloudflare, understand protection, and activate your first site.
- Getting started with CitadelSet up Citadel step by step: add your domain and origin, point proxied Cloudflare DNS records at the ingress IP, set SSL to Full, and pick a challenge mode.
- Citadel protection overviewRead fleet health, live traffic, bandwidth, and domains needing setup.
- Set up Cloudflare for CitadelPoint proxied (orange cloud) Cloudflare A records at the Citadel ingress IP, set SSL/TLS to Full, and fix domains that stay awaiting DNS.
Domains
Manage protected hostnames, origins, DNS, and health.
- Manage Citadel domainsAdd a domain to Citadel with its root name, origin host, port and TLS setting, check its connection, search the Domains list, or remove protection.
- Understand a Citadel domain's statusFind a domain's Citadel ingress IP, see when its status changes from awaiting DNS to Active, and jump to Origin, Health, Security, Cache and Insights.
- Configure Citadel origins and hostnamesConfigure the backend Citadel forwards clean traffic to: apex host, port and TLS-to-origin, plus protected subdomains that share or override it.
- Check Citadel origin healthRun Citadel origin health probes to diagnose latency, failed checks and 502 errors, then fix origin host, port, TLS or firewall settings and re-test.
- Citadel DNS stays in CloudflareKeep Cloudflare nameservers and point protected web records at Citadel.
Protection
Choose challenge levels, bypasses, branding, caching, and incident controls.
- Configure Citadel securityChoose challenge levels and review allowlists, blocklists, and rate limits.
- Citadel challenge levels explainedChoose Off, Cookie, JS, Interaction, Auto, or Lockdown for the situation.
- Brand Citadel challenge and error pagesCustomize visual HTML shells while Citadel supplies the mitigation controls.
- Configure Citadel allowlistsBypass challenges for trusted paths, IPs, and user agents on every hostname.
- Use Citadel cache and purgeEnable Citadel caching for static files such as CSS, JavaScript, images and fonts, bypass dynamic paths like /api/, and purge the cache after a release.
- Read Citadel insights and attack timelineFollow an attack on one domain: charts, the attack and event timeline, and the challenge and block reasons behind Citadel's recent decisions.
Traffic
Investigate request logs, analytics, bandwidth, and speed limits.
- Search Citadel domain logsSearch 15 days of Citadel access, security and origin-error logs by IP, path, host or request ID, with filters, sorting and ASN and country details.
- Use Citadel analyticsCompare edge, proxied and blocked request trends across all Citadel domains, spot traffic spikes, and drill into one site with Insights and Logs.
- Track Citadel bandwidth and speed limitsReview clean-traffic quota, live transfer, and per-domain outbound caps.
Account
Manage your team, alerts, billing, and support.