Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems. Focus on systematic investigation using Cloudflare API to examine actual configuration rather than

Cloudflare Troubleshooting Methodology base: the general evidence driven network diagnosis discipline (falsification, layered isolation, counter review) lives in the debugging network issues skill. This skill is the Cloudflare domain layer on top of it. Core Principle Investigate with evidence, not assumptions. Always query Cloudflare API to examine actual configuration before diagnosing issues. The skill's value is the systematic investigation methodology, not predetermined solutions. Investigation Methodology 1. Gather Credentials Reuse the domain and authorized Cloudflare connection already supplied by the user or project configuration. Ask only for missing connection information: domain, account email plus Global API Key, or API Token. Keep the working authentication method; troubleshooting does not require replacing it. Global API Key location: Cloudflare Dashboard → My Profile → API Tokens → View Global API Key 2. Get Zone Information First step for any Cloudflare troubleshooting obtain the zone ID: Select the exact matching zone and account before extracting its id ; do not blindly select the first result when account or domain identity is ambiguous. Use that zone’s account.id for account scoped calls. 3. Investigate Systematically For each issue, gather evidence before making conclusions. Use Cloudflare API to inspect: Current configuration state Recent changes (if audit log available) Related settings that might interact Common Investigation Patterns Redirect Loops (ERR TOO MANY REDIRECTS) Evidence gathering sequence: 1. Check SSL/TLS mode: Look for: result.value tells current SSL mode 2. Check Always Use HTTPS setting: 3. Check Page Rules for redirects: Look for: forwarding url or always use https actions 4. Test origin server directly (if possible): Diagnosis logic: SSL mode "flexible" + origin enforces HTTPS = redirect loop Multiple redirect rules can conflict Check browser vs curl behavior differences Fix: Purge cache after fix: Email Routing and Forwarding For alias delivery, destination verification, catch all behavior or forwarding MX issues, follow [Email Routing](references/email routing.md). It supplies the account/zone API read sequence and separates saved configuration from actual Inbox arrival. DNS Issues Evidence gathering: 1. List DNS records: 2. Check external DNS resolution: 3. Check DNSSEC status: Look for: Missing A/AAAA/CNAME records Incorrect proxy status (proxied vs DNS only) TTL values Conflicting records SSL Certificate Errors Evidence gathering: 1. Check SSL certificate status: 2. Check origin certificate (if using Full Strict): 3. Check SSL settings: Minimum TLS version TLS 1.3 status Opportunistic Encryption Common issues: Error 526: SSL mode is "strict" but origin cert invalid Error 525: SSL handshake failure at origin Provisioning delay: Wait 15 30 minutes for Universal SSL Origin Server Errors (502/503/504) Evidence gathering: 1. Check if origin is reachable: 2. Check DNS records point to correct origin: 3. Review load balancer config (if applicable): 4. Check firewall rules: Learning New APIs When encountering issues not covered above, consult Cloudflare API documentation: 1. Browse API reference: https://developers.cloudflare.com/api/ 2. Search for relevant endpoints using issue keywords 3. Check API schema to understand available operations 4. Test with GET requests first to understand data structure 5. Make changes with PATCH/POST after confirming approach Pattern for exploring new APIs: API Reference Overview Consult references/api overview.md for: Common endpoints organized by category Request/response schemas Authentication patterns Rate limits and error handling Consult references/ssl modes.md for: Detailed SSL/TLS mode explanations Platform compatibility Security implications Consult references/common issues.md for: Issue patterns and symptoms Investigation checklists Platform specific notes Best Practices Evidence Based Investigation 1. Query before assuming Use API to check actual state 2. Gather multiple data points Cross reference settings 3. Check related configurations Settings often interact 4. Verify externally Use dig/curl to confirm 5. Test incrementally One change at a time API Usage 1. Parse JSON responses Use jq or python for readability 2. Check success field "success": true/false in responses 3. Handle errors gracefully Read errors array in responses 4. Respect rate limits Cloudflare API has limits 5. Use appropriate methods: GET: Retrieve information PATCH: Update settings POST: Create resources / trigger actions DELETE: Remove resources Making Changes 1. Gather evidence first Understand current state 2. Identify root cause Don't guess 3. Apply targeted fix Change only what's needed 4. Purge cache if needed Especially for SSL/redirect changes 5. Verify fix Re query API to confirm 6. Inform user of wait times: Edge server propagation: 30 60 seconds DNS propagation: Up to 48 hours Browser cache: Requires manual clear Security Never log API keys in output Warn if user shares credentials in public context Recommend API Tokens with scoped permissions over Global API Key Use read only operations for investigation Workflow Template Example: Complete Investigation When user reports "site shows ERR TOO MANY REDIRECTS": When Scripts Are Useful The bundled scripts ( scripts/check cloudflare config.py , scripts/fix ssl mode.py ) serve as: Reference implementations of investigation patterns Quick diagnostic tools when Python is available Examples of programmatic API usage However, prefer direct API calls via Bash/curl for flexibility and transparency. Scripts should not limit capability use them when convenient, but use raw API calls when needed for: Unfamiliar scenarios Edge cases Learning/debugging Operations not covered by scripts The investigation methodology and API knowledge is the core skill, not the scripts.

cloudflare-troubleshooting