← Fundamentals / fundamentals / account / account-security

Secure compromised account

If you observe suspicious activity within your Cloudflare account, secure your account with these steps.

For more guidance on changing your password, refer to Change email address or password.

When there is more than one active session associated with your email account, you can revoke any session that is not the current session.

To revoke a session:

1. Log in to the Cloudflare dashboard.

   Go to Account home ↗

2. Go to My Profile > Sessions.

3. On a specific section, click Revoke.

4. You will be prompted to enter your password before revoking the session.

To prevent future compromises, make sure that you have Two-Factor Authentication (2FA) enabled on your account.

If your API key might be compromised, change your API key:

1. Log in to the Cloudflare dashboard.

   Go to Account home ↗

2. Go to My Profile > API Tokens.

3. In the API Keys section, find your key.

4. Select Change.

If your token is lost or compromised, you can either create a new token or roll your token to generate a new secret. Rolling your API token into a new one will invalidate the previous token, but the access and permissions will be the same as the previous API token. The new token uses the scannable format, which allows credential scanning tools to detect leaked tokens.

To roll your API token:

1. Go to My Profile > API Tokens.

   Go to API Tokens ↗

2. Next to the API token you want to roll, select the three dot icon > Roll.

3. Select Confirm to generate a new API token.

To access audit logs in the Cloudflare dashboard:

In the Cloudflare dashboard, go to the Audit Logs page.

You can search these audit logs by user email or domain and filter by date range. To download audit logs, click Download CSV.

If you notice any settings were changed, you should undo those changes.