Cloudflare Version Management

Safely test, deploy, and roll back changes to your zone configurations using Version Management.

Enterprise-only

Benefits

By using Version Management, you can:

Create independent versions to make changes with no risk of impacting live traffic.
Safely deploy changes to staging environments ahead of deploy to production.
Quickly roll back deployed changes when issues occur.

	Free	Pro	Business	Enterprise
Availability	No	No	No	Yes

For access, enable Zone Versioning in the Cloudflare dashboard.

Version Management does not currently support or have limited support for the following products or features:

API Shield

Some API Shield configurations are not cloned when a new zone version is created.
Customers are allowed to opt-in to remove the UI block that prevents enabling Version Management.

Authenticated Origin Pull

Cache

Cache Rules when used with Cloudflare Images

Image Resizing does not work with the additional_cacheable_ports Cache Rule setting and Zone Versioning.
If you use additional_cacheable_ports with Image Resizing, the image will be resized every time it is requested and will result in low performance.

Workers Cache API

Workers Cache API does not work with Version Management.
If you use the Workers Cache API with Zone Versioning, you might encounter unexpected caching behaviours.

China Network

Regardless of the version deployed to production, traffic in China will always target the root zone.
Other incompatibility issues with Access and ICP licenses.

Cloudflare API

Version Management environments — including their routing expressions and version assignments — can be managed through the public Environments API.
Creating, cloning, and editing zone versions (the configuration snapshots themselves) are currently only available through the Cloudflare dashboard ↗.

Domain-scoped Roles

Domain-scoped Roles apply only to your root zone.
Once a new version is created, these roles do not copy over and they lose access to versions.

Image Transformations

Changes made to Image Transformations are not cloned when a new zone version is created.

Network Error Logging

Network Error Logging configurations are not cloned when a new version is created.

Client-side security

Client-side security (formerly known as Page Shield) is not available for versioning and is only configurable under your Global Configuration.

Rules

Version Management does not currently support the following:
- Snippets
- Compression Rules

Security Insights

Security Insights are not shown when Zone Versioning is enabled and the first version is deployed to production.

Terraform

WAF Attack Score

WAF Attack Score configurations are not cloned when a new zone version is created.

Waiting Room

Wrangler

If a version has a Worker route, it might disappear when a Worker is deployed via Wrangler.
If two versions have the same custom domains, the Worker might randomly choose between them.

To use Version Management, the following must all be true:

Your zone is on an Enterprise plan.
Your zone is in an active state.
Your zone uses WAF managed rules.
Your zone has migrated to use custom rules instead of Firewall Rules (deprecated).
Your account uses the new WAF ↗ (if not, contact your account team).
Your user account must have a Super Administrator or Administrator role. Zone Versioning roles cannot create new versions.
Your user account must have an API Key provisioned (if not, view your API Key).
Your user account must have API Access enabled. Refer to control API Access for more information.
You must use the dashboard to manage versioning.