Cloudflare Zero Trust key terms

Zero Trust Network Access: a model that grants users access to individual private applications after verifying identity and device posture, instead of placing them on the network. Cloudflare delivers it through Cloudflare Access and Gateway.

A Cloudflare Zero Trust policy object that protects a specific hostname, path, or self-hosted app. Each application carries its own allow, block, and bypass rules evaluated per request.

An ordered rule inside an Access application that decides who may reach the app. It combines an action such as allow or block with include, require, and exclude selectors over users, groups, and devices.

The building block of an Access policy rule, such as email domain, user group, IP range, country, or device posture. Include, require, and exclude each hold one or more selectors.

An Access policy clause where every listed condition must be satisfied for the rule to match. Unlike include, require narrows a match rather than creating one.

The external authentication service, such as Okta, Entra ID, or Google, that Cloudflare redirects users to during login. Access trusts its assertions to learn identity, email, and group membership.

A standard protocol Cloudflare uses to sync users and groups from an identity provider automatically. It keeps Access group selectors current without manual list maintenance.

A non-interactive credential pair of client ID and secret that lets a machine or script authenticate to an Access application without a browser login. Requests still pass the application's policies.

A mutual TLS client certificate that Cloudflare can require before reaching an Access application. It proves device or client identity and can be combined with user identity checks.

An outbound-only connection from a private network or host to Cloudflare's edge, created by the cloudflared daemon. It publishes internal apps without opening inbound firewall ports or exposing public IPs.

The connector daemon that establishes and maintains Cloudflare Tunnel connections. It runs on a server or container inside the private network and routes requests to internal origins.

The endpoint agent installed on user devices that enrolls them in a Zero Trust organization and routes traffic through Cloudflare. It enables device posture checks and private network access.

The process of registering a user device with a Zero Trust organization through the WARP client, typically gated by a login rule. Enrolled devices can be evaluated for posture and receive profiles.

Signals collected from an enrolled device, such as OS version, disk encryption, or running software, that Access and Gateway policies can require. Posture turns device state into an access condition.

A rule set that decides which enrolled devices receive which WARP settings, such as split tunnel or gateway mode. Profiles match on user groups, OS, or other attributes.

A WARP configuration that decides which traffic goes through Cloudflare and which goes directly to the internet or local network. It balances inspection coverage against performance and local resource access.

An internal IP range, such as a corporate subnet, made reachable through Cloudflare Tunnel and routed to enrolled devices. Users reach these addresses without a traditional VPN concentrator.

An Access rule that lets matching requests skip authentication and reach the application directly. It is useful for public assets or health checks but weakens protection if scoped too broadly.

Secure Web Gateway: a proxy that inspects and controls outbound user traffic to the internet. Cloudflare's SWG is implemented through Gateway DNS, network, and HTTP policies.

Cloudflare's policy engine for filtering traffic from enrolled devices and networks. It evaluates DNS, network, and HTTP requests against ordered rules and takes actions such as allow or block.

A Gateway rule that resolves or blocks domain lookups before a connection is made. It is the lightest inspection layer and works even for traffic that never reaches an HTTP proxy.

A Gateway rule that inspects full HTTP requests, including host, path, method, and content categories. It enables granular control and integrates with DLP and antivirus scanning.

A Gateway rule that filters traffic by IP address, port, or protocol for connections that are neither DNS nor HTTP. It covers arbitrary TCP and UDP flows from enrolled devices.

Decrypting outbound TLS traffic at the gateway so full URLs and payloads can be examined, then re-encrypting it. It requires a trusted root certificate on endpoints and often bypass lists for sensitive apps.

An application practice of trusting only a specific certificate or issuer, which breaks when a gateway re-signs TLS. Pinned apps usually need to be excluded from TLS inspection.

A set of destinations, such as banking or healthcare sites, that Gateway exempts from TLS inspection for privacy or compliance. Traffic is still filtered on visible metadata.

Blocking or allowing domain resolution based on categories, threat intelligence, or custom lists. It stops malicious connections early and is enforced by Gateway DNS policies.

A Cloudflare-maintained classification of domains, such as malware, phishing, or newly registered, used in Gateway rules. Custom lists let organizations add their own domains.

Digital Experience Monitoring: Cloudflare's set of tools for measuring end-user experience, including device health, network path tests, and application performance analytics.

A DEX diagnostic that traces a request from the device through the network to the destination, hop by hop. It reveals where latency or failure is introduced.

A DEX view summarizing enrolled devices by connectivity, WARP version, and health signals. It helps administrators spot outdated clients or offline endpoints across the organization.

An on-demand DEX check that measures reachability and latency between a device and a target host, similar to traceroute or ping. Results help isolate ISP or routing problems.

Cloud Access Security Broker: controls that discover and govern sanctioned and unsanctioned SaaS use. Cloudflare's API-driven CASB scans connected SaaS accounts for misconfigurations and sensitive data.

A connection Cloudflare makes to a SaaS provider using OAuth or API keys so CASB can read configuration and content. Findings surface as posture issues and DLP detections.

Cloud applications used without IT approval, often discovered from Gateway traffic logs. Discovery lets teams decide whether to block, coach, or formally sanction each app.

Identifying SaaS applications in use by inspecting traffic against a catalog of known apps. It reports usage volume and risk scores so policy can be tuned.

A CASB result flagging a risky SaaS configuration, such as missing multi-factor authentication or public file sharing. Findings are prioritized for remediation in the admin dashboard.

Data Loss Prevention: detecting and controlling sensitive data such as credentials, personal data, or source code in traffic and stored content. Cloudflare applies DLP profiles to HTTP policies and CASB scans.

A named collection of detection entries, such as patterns for credit cards or API keys, that policies reference. Profiles can include custom regex and predefined data classes.

A single match recorded when traffic or stored content satisfies a DLP profile entry. Detections feed logs, alerts, and block actions in Gateway and CASB.

An organization-defined set of domains, IPs, or other values used in Gateway and Access rules. Lists centralize repeated values so policies stay readable and easy to update.