Today we are excited to share a small but useful feature for your Joomla dashboard — improved support for Cloudflare.

The new feature dramatically reduces the number of Watchful-generated false-positive alerts that the IP Address of your Cloudflare-enhanced website(s) server has changed.

By whitelisting Cloudflare IP Addresses, Watchers can now re-enable notifications for IP Address changes without worrying about a constant flood of email notifications.

What is Cloudflare?

Cloudflare is a popular service that improves the performance of your website while protecting it from intruders and malicious scripts.

To deliver these services, the traffic to and from Cloudflare-enhanced websites is routed through specialized servers. In other words, Cloudflare serves as a reverse proxy.

Cloudflare requires updating the domain name servers for your website. Thus, domain-related lookups such as ping and traceroute return Cloudflare IP Addresses.

Importantly, the Cloudflare IP Address returned from these lookups will rotate regularly.

So what’s the problem with an IP Address change?

Since IP address changes are relatively rare in production environments, this can be a soft/early indicator of an intruder or perhaps even a compromised account at the domain name registrar.

Thus, monitoring the IP Address of your website should be included in any Joomla security policy. For this reason, IP Address monitoring is one of the original features of Watchful.

Unfortunately, most Watchers who use Cloudflare disable notifications related to IP Address. Disabling these notices in your account settings stops the near-continuous number of alerts generated by the rotating nature of the Cloudflare addresses (see above).

So … you fixed it, right?

To prevent these notifications, we created a notification whitelist for the Cloudflare IP Addresses. Thus, these IP Addresses no longer generate alerts.

The improved Cloudflare support was quietly released a few weeks ago.

What if I don’t use Cloudflare?

If you are not using Cloudflare, then this feature will likely go unnoticed to you.

However, we encourage all site owners to try this free service and see if it provides benefits and enhances security for your website.