Skip to content
Cloudflare Docs

Cloudflare Version Management

Safely test, deploy, and roll back changes to your zone configurations using Version Management.

Enterprise-only

Benefits

By using Version Management, you can:

  • Create independent versions to make changes with no risk of impacting live traffic.
  • Safely deploy changes to staging environments ahead of deploy to production.
  • Quickly roll back deployed changes when issues occur.

Availability

Free Pro Business Enterprise

Availability

No

No

No

Yes

For access, enable Zone Versioning in the Cloudflare dashboard.

Limitations

Version Management does not currently support or have limited support for the following products or features:

API Shield
  • Some API Shield configurations are not cloned when a new zone version is created.
  • Customers are allowed to opt-in to remove the UI block that prevents enabling Version Management.

Authenticated Origin Pull
  • Authenticated Origin Pull does not work with Zone Versioning.
  • Accessing your domain from an allowlisted IP returns a Cloudflare 520 error.

Cache
  • Cache Reserve is intended for production use only.
  • Purging the production environment purges all environments.

Cache Rules when used with Cloudflare Images
  • Image Resizing does not work with the additional_cacheable_ports Cache Rule setting and Zone Versioning.
  • If you use additional_cacheable_ports with Image Resizing, the image will be resized every time it is requested and will result in low performance.

Workers Cache API
  • Workers Cache API does not work with Version Management.
  • If you use the Workers Cache API with Zone Versioning, you might encounter unexpected caching behaviours.

China Network
  • Regardless of the version deployed to production, traffic in China will always target the root zone.
  • Other incompatibility issues with Access and ICP licenses.

Cloudflare API
  • Version Management does not currently expose a public API.
  • Customers can only use Version Management through the Cloudflare dashboard ↗.

Domain-scoped Roles
  • Domain-scoped Roles apply only to your root zone.
  • Once a new version is created, these roles do not copy over and they lose access to versions.

Image Transformations

Network Error Logging

Page Shield
  • Page Shield is not available for versioning and is only configurable under your Global Configuration.

Rules
  • Version Management does not currently support Snippets.

Security Insights
  • Security Insights are not shown when Zone Versioning is enabled and the first version is deployed to production.

Terraform
  • Version Management does not currently support Terraform.
  • Customers should either use Terraform or Version Management.

WAF Attack Score
  • WAF Attack Score configurations are not cloned when a new zone version is created.

Waiting Room
  • Waiting Room users active on the site may be placed back in the queue.
  • Waiting Room users in the queue may lose their place in line.
  • Traffic may exceed limits.

Wrangler
  • If a version has a Worker route, it might disappear when a Worker is deployed via Wrangler.
  • If two versions have the same custom domains, the Worker might randomly choose between them.

Requirements

To use Version Management, the following must all be true:

  • Your zone is on an Enterprise plan.
  • Your zone is in an active state.
  • Your zone uses WAF managed rules.
  • Your zone has migrated to use Custom Rules instead of Firewall Rules (deprecated).
  • Your account uses the new WAF ↗ (if not, contact your account team).
  • Your user account must have a Super Administrator or Administrator role. Zone Versioning roles cannot create new versions.
  • Your user account must have an API Key provisioned (if not, view your API Key).
  • Your user account must have API Access enabled. Refer to control API Access for more information.
  • You must use the dashboard to manage versioning.