1. Noraina Tools
  2. Noraina Rewind, configuration backup and restore for Cloudflare

Cloudflare configuration

Noraina Rewind, configuration backup and restore for Cloudflare

Noraina Rewind is a backup service for Cloudflare configuration. It takes a read-only snapshot of your DNS, zone settings, WAF and other rules and Zero Trust policies every day, shows what changed and who changed it, and lets you restore one object to any earlier version.

What it does

  1. Backs up every night: a read-only snapshot of each zone and account you enable, between 02:00 and 06:00 UTC, plus snapshots on demand. A new version is recorded only when something changed.
  2. Shows what changed: a readable diff of every snapshot, object by object, with the Cloudflare users who made changes since the previous one.
  3. Restores one object: a rule, a list, a DNS record set, a zone setting or a Zero Trust policy, to any earlier version. Missing dependencies, such as a deleted list a rule refers to, are recreated first. From a diff you can revert a change in one step.
  4. Keeps restores safe: if the live object no longer matches the latest snapshot, the restore waits for you to confirm. Write access is granted for that restore only and revoked at the end.
  5. Moves configuration: export a zone or an account’s Zero Trust as a Git bundle and import it into another account, compare, and restore the objects you choose.
  6. Tells you when something fails: email or signed webhook notifications when a backup fails, when access to the account needs renewing and when a restore finishes.

Secrets, such as origin header values or identity provider client secrets, are never stored in a snapshot. Objects that contain them are marked as needing a manual step when restored.

Who it is for

Teams that manage Cloudflare through the dashboard, often with several people or partners making changes, and that want to know what changed, recover from a wrong edit in minutes and keep a history of their configuration for audits.

How it is delivered

Rewind runs on Cloudflare. Customers sign in with their Cloudflare account; there are no API tokens to create. Each customer’s snapshots live in their own repository and are never shared with other customers. Our staff can only open a customer’s snapshot contents with a stated reason, and that access is shown to the customer.

Pricing

Edition Who it applies to
Included Customers who buy Cloudflare through Noraina, for every zone and Zero Trust user
Free One zone, and fewer than 50 Zero Trust users
Subscription More zones or Zero Trust users, and any Cloudflare Enterprise plan not bought through Noraina

The subscription is priced per zone with backups on and per Zero Trust user. Prices exclude VAT.

Getting it

Open Rewind and sign in with Cloudflare to back up your first zone, or talk to us about backups for all your accounts.

Independent tools built by Noraina, a Cloudflare Authorized Service Delivery Partner. Not made or operated by Cloudflare. Cloudflare is a trademark of Cloudflare, Inc.

Frequently asked questions

How do I back up my Cloudflare configuration?

Sign in to Noraina Rewind with your Cloudflare account and choose the zones to back up. Rewind takes a snapshot every night and stores each version, with its full history, so you can compare any two days and restore from any of them. You can also take a snapshot on demand before a change.

What parts of Cloudflare does Rewind back up?

DNS records, zone settings, SSL/TLS settings and certificate metadata, load balancing, rules (redirects, transforms, cache, configuration, origin and others) and Snippets; WAF, rate limiting and other security rules, lists and Bulk Redirects; and in Zero Trust, Access applications, policies and groups, Gateway rules and lists, device profiles, posture rules, DLP profiles and tunnel configuration. Anything your plan does not include is listed as not available.

Can Rewind change my Cloudflare configuration?

Not without your approval each time. Daily backups use a read-only sign-in. A restore asks you to grant write access on Cloudflare's own consent screen, for that one restore; the access is revoked when it finishes and is never stored.

Can I restore a single WAF rule or DNS record without touching the rest?

Yes. A restore can bring back a whole object or just one part of it, such as one rule of a ruleset, one zone setting or one DNS record set. Rewind checks first that nobody has changed the object since the last snapshot, takes a snapshot before and after the restore, and you can undo it.

Is there a RANCID or Oxidized for Cloudflare?

Rewind does that job for Cloudflare. It keeps every version of your Cloudflare configuration as files in a Git repository, one per customer, and shows the differences between versions. You can download the repository as a Git bundle at any time, for a whole account or for selected zones.

How much does Rewind cost?

It is included for customers who buy Cloudflare through Noraina. Otherwise it is free for one zone and for fewer than 50 Zero Trust users; beyond that, or for an Enterprise plan bought elsewhere, it is a paid subscription.

Cloud your way

Talk to us Check your certification