# Cloudflare control room for your whole domain portfolio

> See every domain's security and certificate settings on one screen, spot the ones that drift from your house standard, and fix them in bulk.

- Workflow type: app
- Services: Cloudflare, Slack Bot
- Categories: Engineering, Operations
- Published: 2026-08-16

## What it does

- Lists every domain you have access to in one sortable grid, with plan, status, nameservers, security settings, bot protection, DNSSEC state and certificate health side by side
- Lets you save a house standard once (for example strict SSL, always use HTTPS, a minimum TLS version, DNSSEC on) and shows each domain a badge naming exactly which settings drift from it
- Applies your standard to one or many drifting domains at once, behind a preview that spells out every change per domain before anything runs
- Opens any domain for a full drill-in with its settings, DNS records and recent account activity, so you can see who changed what
- Restarts stalled certificates, clears a domain's cache, and posts a summary of what changed to a Slack channel

## What you'll need

- A Cloudflare login with access to the domains you want to manage
- A Slack workspace, if you want change summaries posted to a channel
- A rough idea of your house standard for security settings, which you can set up and edit inside the app

## Prompt

Build me a Cloudflare domain portfolio control room: one screen that lists every zone my Cloudflare connection can see, so I stop clicking through domains one at a time in the Cloudflare dashboard. This is used by an agency or an internal IT team managing dozens of domains, so everything should be built around reviewing and fixing many zones at once rather than one zone at a time.

The main view is a portfolio grid, one row per zone. Populate it with List Zones, and use Get Zone Details for the per zone plan, status and nameservers. Then enrich each row with the security and performance settings from List All Zone Settings (SSL/TLS mode, Always Use HTTPS, minimum TLS version, Brotli, security level), Bot Management state from List Bot Management Settings, DNSSEC state from Get DNSSEC, and certificate health from List Certificate Packs plus Get SSL Verification so that expiring or stuck certificates show up as their own column. The grid must be sortable and filterable by drift severity, by plan, and by certificate expiry date, because the whole point is to triage the portfolio quickly.

Let me save a house standard baseline inside the app and edit it there. It is a set of expected setting values, for example SSL mode Full strict, Always Use HTTPS on, minimum TLS version 1.2, and DNSSEC enabled. Persist the baseline in the app so it survives reloads and is shared by the team, and let me change which settings are part of it. Every zone row shows a drift badge that lists exactly which settings deviate from the baseline, with a severity so I can sort the worst offenders to the top.

Each zone has a drill-in page showing all of its settings from List All Zone Settings with the baseline value next to the live value, the zone's DNS records from List DNS Records, its certificate packs with detail from Get Certificate Pack and outstanding validation records from Get SSL Verification, and recent activity from List Audit Logs so I can see who changed what and when.

Actions in the app. First, select one or many drifting zones and apply the baseline, using Update Multiple Zone Settings where several settings change on the same zone and Update Zone Setting for a single change. This must sit behind a preview that spells out, per zone, every setting that would change and its before and after value, and nothing runs until I confirm. Second, restart a stalled certificate with Restart Certificate Pack Validation. Third, purge a zone's cache with Purge Cache. Fourth, post a change summary to a Slack channel using the Slack Bot Send a Message operation, naming the zones touched and the settings changed.

Important behaviours to bake in. Settings that are not available on a zone's plan must be shown as not supported for that zone rather than being counted as drift or failing the apply, and a batch apply must skip them and carry on with the rest instead of aborting. Every apply is logged inside the app with who ran it, when, which zones were included, and the per zone result including partial failures, and that log is visible in the app. Cloudflare access is scoped to whatever zones the connection was granted, so an empty or unexpectedly short zone list should be explained in the UI as likely scoping rather than presented as an error or a bug.

Keep this app on the zone settings surface. Do not build ruleset editing into it, because updating a ruleset replaces its rules wholesale and that is not a safe bulk action for a portfolio tool. Handle pagination when listing zones and DNS records, and be considerate of rate limits when fanning out per zone reads across dozens of domains.

## How to customize

- Change the house standard itself: which settings are part of it, and what counts as a serious drift versus a minor one
- Adjust how the grid sorts and filters by default, for example leading with certificates expiring soonest or the worst drift
- Pick which Slack channel gets the change summary, and how much detail each summary includes

## FAQ

### Does this change anything in Cloudflare on its own?

No. The app only reads your domains until you select some and confirm. Every change goes through a preview that lists each domain and each setting that would change, and nothing runs until you approve it.

### What happens to settings my domain's plan does not include?

They are shown as not supported for that domain rather than counted as drift, and they are skipped when you apply your standard. The rest of the settings still apply normally, so a free plan domain never blocks the batch.

### Why do I see fewer domains than I expect?

Access to Cloudflare is scoped when you connect it, so the app can only show the domains that connection was given. If the list looks short, the connection was almost certainly limited to a subset rather than all of your domains.

### Can several people on the team use this at once?

Yes. It is built for agencies and internal IT teams managing dozens of domains. Every apply is recorded in the app with who ran it, when, which domains were touched and what changed, so there is a shared history rather than one person's browser tabs.

### Can I see the certificates that are about to expire or are stuck?

Yes. Certificate health is a column in the main grid, and you can sort and filter by expiry date. If a certificate is stuck waiting on validation, you can restart that check from the app without going back to the Cloudflare dashboard.

Use this prompt in General Input: https://www.generalinput.com/prompts/cloudflare-control-room-for-your-whole-domain-portfolio