Caps

Cap recipes

Cloudflare-native ways to stop spend with SignalFlare caps, each with what it breaks, how to undo it, its blast radius and the token scopes it needs.

Each recipe below is a cap action, or a pattern you build around one. Pick the smallest one that stops the spend you are worried about. Every cap starts as a dry run, and you can practise any of them with a fire drill before relying on it.

Caps act on estimated spend: an early warning from sampled analytics, not your invoice. Expect a few minutes of spend past the budget before a cap runs.

Reroute to a maintenance Worker

Point an expensive zone route at a cheap Worker that serves a static “back soon” page, instead of deleting the route.

1. Deploy a small Worker, for example maintenance-page, on the same account. It only needs to return a static response.
2. Create a Reroute a Worker route to a fallback Worker action with the zone ID, the route ID and maintenance-page as the fallback script.

Warning. Breaks: every request on that route pattern gets the maintenance page instead of your app. Undo: Restore points the route back at the original script. Blast radius: one route pattern on one zone.

Scope: Zone · Workers Routes · Edit

If you would rather have no Worker on the path at all, use Remove a Worker route. Requests then fall through to your origin, or fail if there is none.

WAF rate-limit or block rule

Prepare the rule while you are calm, leave it disabled, and let the cap switch it on.

1. In the Cloudflare dashboard, create a custom rule or a rate limiting rule that matches the expensive traffic, for example http.request.uri.path wildcard "/api/search*". Leave it disabled.
2. Create an Enable a blocking WAF rule action with the zone ID, the ruleset ID and the rule ID.

SignalFlare reads the rule first and writes it back with every field unchanged except enabled, and keeps a copy so Restore puts back exactly what was there.

Warning. Breaks: everything the rule matches is blocked or rate limited at the edge, real users included. Undo: Restore disables the rule again. Blast radius: whatever the rule expression matches, so keep it narrow.

Scope: Zone · Zone WAF · Edit

Under Attack mode

Raise the zone security level so every visitor must pass a browser challenge first. Bots and scripted traffic that cannot run JavaScript stop.

Create a Raise the zone security level action with the zone ID and I’m Under Attack.

Warning. Breaks: every hostname on the zone challenges visitors. API clients, mobile apps, webhooks from other services and uptime checks are blocked. Undo: Restore sets the previous level back. Blast radius: the whole zone.

Scope: Zone · Zone Settings · Edit

Pause crons

Clear a Worker’s cron triggers. Scheduled jobs that loop, fan out or write too often are a classic source of runaway D1, KV and Durable Object bills.

Create a Pause a Worker’s cron triggers action with the script name.

Warning. Breaks: scheduled jobs (cleanups, syncs, reports) stop running. HTTP traffic is untouched. Undo: Restore puts the exact schedules back. Blast radius: one Worker’s cron triggers.

Scope: Account · Workers Scripts · Edit

workers.dev off

Turn off a Worker’s *.workers.dev URL. Forgotten workers.dev URLs get found by crawlers and scrapers.

Create a Take a Worker off workers.dev action with the script name.

Warning. Breaks: anything calling the workers.dev or preview URL directly. Routes and Custom Domains keep serving. Undo: Restore puts the previous workers.dev and preview settings back. Blast radius: one Worker’s workers.dev URL.

Scope: Account · Workers Scripts · Edit

DNS failover to a maintenance origin

Repoint one hostname at a maintenance origin, such as a static page host.

Create a Repoint a DNS record action with the zone ID, the record ID, the new content (an IP for A/AAAA records, a hostname for CNAME records) and, optionally, the proxied flag.

Warning. This is the highest-risk recipe. Breaks: the hostname serves whatever the new target serves. Resolvers cache the old answer for up to the record’s TTL, so both the switch and the restore take time to propagate, and a wrong target is an outage. Undo: Restore writes back the captured content, proxied flag and TTL, then waits on the same propagation. Blast radius: one hostname, plus anything that depends on it.

SignalFlare only changes A, AAAA and CNAME records. MX, TXT and every other type are refused, so mail and domain verification are never touched.

Scope: Zone · DNS · Edit

Prefer a route reroute or a WAF rule when you can: they take effect at the edge within seconds and undo just as fast.

Pause a queue

Stop a Queue from delivering messages, which halts consumer Workers that retry forever or fan out in a loop.

Create a Pause delivery on a Queue action with the queue ID (find it under Storage & Databases → Queues, or with wrangler queues info <name>).

Warning. Breaks: consumers stop receiving messages. Producers can still send, so the backlog grows, and messages older than the queue’s retention period are deleted before delivery resumes. Undo: Restore resumes delivery and the backlog drains through your consumers; wrangler queues resume-delivery <queue> does the same by hand. Blast radius: one queue and its consumers.

Scope: Account · Queues · Edit

Status-API circuit breaker for Durable Object alarms and queues

Some loops never pass through a route or a queue SignalFlare can pause: a Durable Object alarm that reschedules itself, or a consumer you would rather keep draining slowly. Put the breaker inside the loop with the status API.

export class Crawler {
  constructor(private state: DurableObjectState, private env: Env) {}

  async alarm(): Promise<void> {
    const level = await budgetLevel(this.env);
    if (level === 'critical' || level === 'exceeded') return;
    await this.doOneBatch();
    await this.state.storage.setAlarm(Date.now() + 60_000);
  }
}

budgetLevel is the cached helper from the status API page. Returning without calling setAlarm stops the loop; schedule the alarm again from a request or an admin route once the level drops. The same check at the top of a queue consumer can retry() messages with a long delay instead of processing them.

Warning. Breaks: the work the loop does stops at critical or exceeded. Undo: schedule the alarm again, or let the consumer pick up retried messages, once the level drops. Blast radius: only the code you guard. Decide per loop whether a status API outage should fail open or closed.

Scope: a status key, no Cloudflare token.

Anything else: call your webhook

For feature flags, scaling down another cloud, or a runbook, use the outbound webhook action. SignalFlare signs and POSTs a cap.fired event; your endpoint makes the change.