Cloudflare Migration

Guide for migrating firewall rules from Vercel Firewall to Cloudflare WAF using Vercel Doorman.

Before You Begin

• Complete the Cloudflare Setup guide first
• Back up your current Vercel configuration
• Review the compatibility matrix below — some features don't translate 1:1

Important: Always test in a staging environment before applying to production.

Compatibility Matrix

Migration Steps

1. Back Up

vercel-doorman backup
vercel-doorman export --format json --output vercel-backup.json

2. Preview the Migration

vercel-doorman migrate --from vercel --to cloudflare --dry-run

This shows which rules will migrate perfectly, which will be modified, and which can't migrate. No changes are made.

3. Generate the Cloudflare Config

vercel-doorman migrate --from vercel --to cloudflare --output cloudflare.config.json

The generated file includes:

• Translated rules with Cloudflare provider settings
• Migration metadata (source, date, warnings)
• Notes on any rules that were modified

4. Review and Validate

Open cloudflare.config.json and review the translated rules, then:

vercel-doorman validate --config cloudflare.config.json
vercel-doorman status --config cloudflare.config.json

5. Test in Staging

vercel-doorman sync --config cloudflare.config.json --provider cloudflare

Verify in the Cloudflare dashboard under Security → WAF → Custom rules.

6. Deploy to Production

vercel-doorman sync --config cloudflare.config.json --provider cloudflare
vercel-doorman status --config cloudflare.config.json

7. Monitor

• Check Security → Events in the Cloudflare dashboard
• Watch for false positives in the first few days
• Adjust rules based on real traffic patterns

Handling Common Translation Changes

Regex → Simple Matching

Regex patterns are converted to simpler operators on non-Enterprise plans:

// Vercel (regex)
{ "type": "path", "op": "re", "value": "\\.(php|asp|jsp)$" }

// Cloudflare (converted to multiple suffix conditions)
[
  { "type": "path", "op": "suf", "value": ".php" },
  { "type": "path", "op": "suf", "value": ".asp" },
  { "type": "path", "op": "suf", "value": ".jsp" }
]

Review these conversions to ensure they still cover your intended traffic patterns.

Environment Conditions Removed

Cloudflare doesn't have an equivalent to Vercel's environment condition. Options:

• Use separate config files per environment
• Use zone-based separation (different Cloudflare zones for staging vs production)

Rate Limiting Format Differences

Rate limiting translates automatically, but review thresholds — Cloudflare's rate limiting behavior may differ slightly from Vercel's.

Rollback

Restore from Backup

vercel-doorman backup --list
vercel-doorman backup --restore backup-file.json
vercel-doorman sync --provider vercel

Reverse Migration

vercel-doorman migrate --from cloudflare --to vercel --output vercel-restored.config.json
vercel-doorman sync --config vercel-restored.config.json --provider vercel

Note: Cloudflare → Vercel translation has some limitations. Review the output carefully.

Gradual Migration

For large rule sets, consider migrating in phases:

1. Critical security rules (bot blocking, IP blocking)
2. Rate limiting rules
3. Remaining rules
4. Optimize for Cloudflare-specific features

Post-Migration Checklist

• All critical rules active in Cloudflare
• IP blocking working correctly
• Rate limiting functioning as expected
• No false positives in legitimate traffic
• Cloudflare Analytics showing expected rule triggers
• Team trained on Cloudflare-specific workflows
• CI/CD pipelines updated for Cloudflare provider
• Backup procedures updated

Related Pages

• Cloudflare Setup — Credentials, environment, and initial configuration
• Configuration — Configuration file reference
• Commands Overview — Full CLI reference