> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Install the Cloudflare Enforcer

If your organization uses **Cloudflare**, you can use HUMAN's **Cloudflare Enforcer** to protect against malicious behavior. The Cloudflare Enforcer is installed using a Cloudflare **Worker**, or a snippet of code, and is deployed to your content delivery network (CDN). The Enforcer dictates how traffic should be handled per your organization's standards.

You can learn how to install the Cloudflare Enforcer with this article.

> **Note**
>
> This process uses the [Deploy Tool](/applications/general/deploy-tool), HUMAN's recommended method for installing and updating the Enforcer. If you prefer a manual method, see our [manual installation article](/applications/manually-install-the-cloudflare-enforcer).

## Prerequisites

* A **Cloudflare account** with permissions to create **API tokens**
* Docker or Script, depending on your preferred method to run the deploy tool.
  * For Docker, see how to install Docker Desktop with their [documentation](https://docs.docker.com/get-started/get-docker/).
  * For Script, install the following:
    * [Node.js 18.x or later and npm 10.x or later](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
    * [Git CLI](https://git-scm.com/downloads)
    * [GNU Wget](https://www.gnu.org/software/wget/)
* An Enforcer configuration file, `enforcerConfig.json`, which you can download from the **Platform Settings > Enforcers**, clicking on the appropriate Enforcer, and clicking **Download configuration file** . This file has the basic information for Enforcer functionality, such as your **Application ID** and remote authorization token, already filled in. Be sure to save it in a directory you’ll remember, like `/deploy`.

## Create a Cloudflare API token

1. Log in to your **Cloudflare account**.
2. Navigate to **My Profile > API Tokens > Create Token.**
3. Under **Create custom token,** click **Get started.**
4. Enter a **name** for your token. Then, fill out the remaining fields according to the following:

#### Permissions

| Permissions group | Resources                 | Access |
| :---------------- | :------------------------ | :----- |
| Account           | Workers KV Storage        | Edit   |
| Account           | Workers Scripts           | Edit   |
| Account           | Accounts Settings         | Read   |
| Account           | Access: Apps and Policies | Read   |
| Zone              | Workers Routes            | Edit   |

#### Account Resources

| Inclusion | Accounts                                                                                 |
| :-------- | :--------------------------------------------------------------------------------------- |
| Include   | All accounts (you may restrict access to the accounts you are deploying the Enforcer on) |

#### Zone Resources

| Inclusion | Zones                                                                              |
| --------- | :--------------------------------------------------------------------------------- |
| Include   | All zones (you may restrict access to the zones you are deploying the Enforcer on) |

5. Click **Continue to summary.**
6. Click **Create token.**
7. Copy and save the token in a secure location.

> **Warning**
>
> This will be the **only** time you’ll see your token, so be sure to save it before closing the page!

## Run the Deploy Tool

First, download and run the Deploy Tool. You can do this by either pulling a Docker image or running a script.

#### Docker method

> **Additional setup for Windows users**
>
> If you're using Windows, you also need to complete additional steps to set up Docker:
>
> 1. In your Windows search bar, search for and open **Turn Windows features on or off**.
> 2. Find the **Windows Hypervisor Platform** feature and click its checkbox to enable it.
> 3. Click **OK** to save your changes.
> 4. Open **Windows PowerShell** as an Administrator.
> 5. Copy and paste in `C:\Windows\System32\wsl.exe --update --web-download`, then hit Enter.

1. Pull the Docker image by running:

```bash
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

2. Navigate to the directory where you saved `enforcerConfig.json`.
3. Run the Deploy Tool with the following:

```bash
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

#### Script method

1. Navigate to the directory where you created `enforcerConfig.json`.
2. Pull the HUMAN Deploy Tool zip from Google Artifact Registry using:

**`Windows`**

```shell title="Windows"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_win:1.7.1:cdn-enforcer-deploy-tool_win.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

**`Mac and Linux`**

```shell title="Mac and Linux"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_unix:1.7.1:cdn-enforcer-deploy-tool_unix.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

3. Unzip `cdn-enforcer-deploy-tool.zip` to the same directory you saved `enforcerConfig.json` in.
4. Navigate to the folder you unzipped and double click the script file to run the Deploy Tool. Depending on your operating system, the folder and script file are named differently:
   * **Windows**: Open the `cdn-enforcer-deploy-tool_win` folder and double click `run.bat`.
   * **Mac or Linux**: Open the `cdn-enforcer-deploy-tool_unix` folder and double click `run.command`.

## Deploy the Enforcer

After you run the Deploy Tool, you'll be prompted with steps to deploy the Enforcer.

1. When prompted, select **Cloudflare Workers** and hit **Enter.**

```bash
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
? Which platform do you want to deploy to? (Use arrow keys)
  ...
❯ Cloudflare Workers
  ...
```

2. Follow the prompts that appear to complete the setup process.
3. After you complete the setup, confirm that the displayed details are correct, then enter `y` to deploy the Enforcer.