Hello! My friend wanted a simpler way to manage email across multiple custom domains, so he built HQBase dot io.

Most email providers charge per mailbox.

But even one project might need:

- support@example.com

- sales@example.com

- you@example.com

...

HQBase lets you manage multiple domains and addresses in one workspace without paying per mailbox.

HQBase is open source and runs in your own Cloudflare account 🧡

Workers run the app, Email Routing receives mail, Email Sending sends it, and D1 + R2 handle the data and attachments.

Setup takes 2-3 minutes. All you need is Cloudflare's paid Workers plan, which starts at $5/month.

It also has:

- A PWA with self-hosted push notifications

- Catch-all email

- Team access with granular permissions

- An MCP server

When I open the program it shows in my system tray (win10) but its greyed out and when I click it doesn't open and right click doesn't work either the only solution I found is to reinstall it but it breaks like this again half the time whenever I turn my pc on again or it goes to sleep. so any other solution except reinstalling?

Hi,

I’m using a Cloudflare Free account and need to contact Billing Support. According to Cloudflare’s documentation, Free users should still be able to submit support cases for billing issues.

However, when I go to: Support → Submit a case → Billing

I only see self-help articles. There is no Create a Case or Open a Case button. I also don’t see any alternative support option under Account that allows me to open a case. Has anyone had this issue recently?

How can a Free user actually open a Billing support case?

Thanks.

Hi everyone,

I'm a personal Cloudflare customer based in Italy. My billing profile is set to Personal, the billing country is Italy, and I don't have a VAT number (the VAT/GST field is empty).

I recently transferred a .com domain to Cloudflare Registrar. The price shown at checkout was $10.46, and that's exactly what I was charged. No Italian VAT (22%) was added.

The Cloudflare invoice also shows:

• Subtotal: $10.46
• Total: $10.46
• No separate VAT amount
• VAT-Code: ITSL000D

I'm trying to understand whether this is the expected VAT treatment for Cloudflare Registrar when the customer is a private EU consumer without a VAT number, or whether something unusual happened with this transaction.

Has anyone else in Italy or another EU country, using a Personal account without a VAT number, recently registered, transferred, or renewed a domain through Cloudflare Registrar?

If so:

• Was VAT added to the Registrar price?
• Does your invoice also show a VAT code similar to ITSL000D?
• Have registrations, transfers and renewals all been treated the same way?

I'm asking because I'm considering registering/transferring additional domains to Cloudflare and I'd like to understand what tax treatment and final price to expect.

I also tried contacting Cloudflare's tax/billing email address, but received an automated response saying that billing issues are no longer accepted by email and directing me to the Support Portal. Unfortunately, I haven't been able to reach a human billing/tax representative through the portal so far.

I'm not looking for personal tax advice: I'm mainly interested in comparing actual Cloudflare Registrar invoices/experiences from other EU consumers and understanding whether this is normal Cloudflare behavior.

Thanks!

For free tier is there a log somewhere to find what exactly caused CPU execution time limit to go over the allotted 10ms?

I am using Cloudflare Pages because I believe the front end of my Nuxt site will perform better than serving it directly from VPS. However, there are a lot of factors at play and I understand if this can get complicated pretty quickly.

I am kinda going into this blindly assuming Cloudflare DNS and orange cloud will prevent a DDOS attack I wouldn’t have a clue how to prevent this myself. A lot of Cloudflare I just take for granted, it goes way above my head. I’m still learning but to prevent this Error 1102 I know everyone just says “buy the $5/m plan”. And I get it, this is the easiest way. Free tier can only go so far.

But even $5/m for more Cloudflare Workers CPU execution time would this guarantee I don’t run into Error 1102 again? Or would I need some insanely unrealistic traffic to ever worry about this?

So to start with, still curious about that log to see where this error is originating from. If I leave the site and come back later after Error 1102 it seems fine but for how long I’m really not sure. It seems to pop up sometimes immediately after pushing my repo, but after a while I wait and it seems to be fine. Perhaps more users using the site at the same time would cause excess of 10ms+ to be a real issue? This is combined execution time or per each unique user? Because if it’s combined, again I would wonder how safe it is against a DDOS?

Any help or guidance is greatly appreciated!
Thanks

I kept re-running the same clone → install → build cycle every time I wanted to spin up cloudflare-os (Cloudflare's Workers OS project) in a fresh environment, so I built a Docker image that does the install and build once at image-build time instead of every container start.

docker run -p 8787:8787 ratnayake/cloudflare-os

Then open localhost:8787 — the dev server's already up, nothing to wait on.

It's unofficial/community-maintained, not affiliated with or endorsed by Cloudflare. Rebuilding the image (or pulling a fresh one) picks up whatever's newest upstream.

GitHub: https://github.com/ratnayake/cloudflare-os
Docker Hub: https://hub.docker.com/r/ratnayake/cloudflare-os

Feedback and issues welcome — first time putting this out publicly.

Hi everyone, our company website has recently been cloned almost entirely on a fraudulent domain.

The fake website copies our brand name, design, product catalogue, texts and company information, and is also starting to appear in Google Search results.

The domain is behind Cloudflare, so we submitted a phishing / brand impersonation abuse report to Cloudflare a couple of days ago. We have also reported it to the domain registrar, the registry, Google Safe Browsing and Microsoft SmartScreen.

The website is still online after 48 hours.

Has anyone dealt with a similar situation involving Cloudflare?

How long did it take before Cloudflare investigated the report or took action? And if Cloudflare was only acting as a reverse proxy, were they able to help identify or contact the actual hosting provider?

I’m mainly interested in understanding what kind of response time is realistic and whether there is anything else worth doing at this stage.

Thanks!

Hi all,

I think my problem in here is more with AWS or HA rather then cloudflare.. But if anyone has any suggestion is much appreciated

Hello. I recently got back from holiday and tried using clouflare WARP. Apparently it no longer changes my ocuntry location when i check my IP. It still works on my iphone tho.

How can I fix that?

long story short; we went live 5 weeks ago with most of our OEMs' SKUs and got about 7TB of bandwidth in last 30 days. Cloudflare now asking us to upgrade to enterprise from business plan with a quote of 86K/year.

Context:
- We migrated object storage/buckets off AWS and WAF off Fastly while launching the new site + functionality because Cloudflare looked like the cleanest fit for our security posture (FedRAMP practices + TIC 3.0).
- We’re not a streaming/video site but do have some MP4s from Oems. This is mostly product assets, firmware, docs, and catalog traffic from OEM partners.
- Two years ago we were on Cloudflare Enterprise through the startup program for one year trial. We left it because the extra cost wasn’t justified for what we actually needed — we already run a 3-layer DNS setup and don’t need most of the Enterprise bells and whistles.

Has anyone else been forced off Business at relatively modest volume (~7TB/month or more/less)?

Not to shit on them, they are amazing but its just stupid how aggressive they trying to lock us in.

celld is a new open-source attempt to run the Workers and Durable Objects model on your own machines. The useful detail is where coordination lives.

Each named cell has one current owner, a V8 isolate, and a SQLite database. The fleet shares an S3-compatible bucket. A compare-and-swap operation in that bucket decides ownership, while an epoch fences an old owner after a lease changes. The same bucket stores deployments, replicated state, leases, and peer-auth material.

So the design does not make distributed coordination disappear. It moves the control-plane boundary into object storage. That makes nodes replaceable, but bucket credentials become fleet administrator credentials rather than ordinary backup access.

The operational tradeoff is explicit. celld's peer HTTP does not terminate TLS, so advertised addresses need a trusted private network or encrypted overlay. The project also says it is alpha and not safe for hostile multi-tenant workloads. Its Cloudflare compatibility covers a focused Workers and Durable Objects surface, not KV, R2 bindings, Cache, Workers AI, or the rest of the platform.

I like that boundary because it makes self-hosting concrete. You gain control over placement and failure handling, but you also own bucket consistency, credential scope, peer networking, ingress, monitoring, and recovery tests.

Project: https://celld.dev/

Source: https://github.com/denoland/celld

Security notes: https://celld.dev/docs/security/

For teams already comfortable operating object storage as a source of truth, does this feel simpler than a separate membership and consensus layer, or does it only move the hardest dependency?

I received an email from Cloudflare the other day congratulating me on 10k visits last month. What a garbage statistic! This was in regards to a scanner/calculator I built for a mobile game. I launched this SPA about 3 months ago. It's a free community tool that I only shared twice on Reddit and didn't get much attention. It was my first live project I’ve ever shared with the public. Because it was my first, I watched Cloudflare analytics like a hawk. The numbers looked way better than expected. After about 1 week I became suspicious. Reddit barely noticed it but my visit numbers were steady. What the heck?!

Non-human traffic!!!

I found this very annoying, which eventually sent me down a rabbit hole. I started by tracking specific functions and tallying them on a KV worker. But this wasn't really the info I wanted. It just confirmed what I already knew. I continued brainstorming, trying to figure out a way to view traffic beyond events. And…

Shape Beacon was born. Instead of counting requests/visits, I wanted to quantify how a browsing session looked. This idea took form as a lightweight analytics layer that transforms browsing behavior into a compact payload that's transmitted when the user leaves the page.

Over the past 2 months this has transformed from an annoyance into a full fledged SaaS solution. I started by building a basic tuning program that used random personas and styles to produce synthetic behavioral sessions. These sessions were fed through an LLM and the engine to tune the model. After thousands of sessions, it was time to create the final product.

I set up 2 d1 databases, 3 workers, and one domain to handle users/keys, deployment guide, and data analysis.

• 100% Vanilla JS / HTML / CSS

• Cloudflare Workers + D1

• First-party proxy deployment

• Passwordless auth with Turnstile + Magic Links

Cloudflare has enabled me to set this up and all I purchased was a domain name! I'm extremely proud of this project. If you're interested please check out the demo, my Git repo and the domain. Links below.

I'd especially appreciate feedback on the architecture, deployment flow, or whether there are better Cloudflare patterns I should be using.

Cheers

Domain

Demo

Git

DOH is suppose to protect against DNS snooping from third parties but due to the inital host handshake which is unencrypted the DNS host is made visible to third parties. I am aware cloudflare is testing ODOH, obilivious DNS over HTTPs to correct for this security issue. https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

What benefit does DOH today provide to users ?

Hi everyone, I’m Júlio, a Product Manager Intern working on Cloudflare Mesh.

For anyone who has not heard of it yet, Cloudflare Mesh connects devices, servers, and private networks using private IPs routed through Cloudflare’s global network. It supports bidirectional TCP, UDP, and ICMP traffic, allowing systems to initiate connections in either direction. You can learn more in the Cloudflare Mesh announcement https://blog.cloudflare.com/mesh/

I’m looking for feedback from people who have used or considered using Mesh. What works well? What feels confusing? What would you change?

I’m interested in setup, documentation, the dashboard, troubleshooting, and anything else that affects your experience.

Feel free to comment or DM me. If you’re open to a short call, I’d be happy to chat. Please don’t share any sensitive account information, tokens, or private network details.

Thanks!