← Version Management / version-management / reference
Available configurations
When you use Version Management, you can edit various configurations, such as WAF custom rules and Cache.
Generally, you are allowed to edit all zone-level configurations except for the following:
- DNS
- Spectrum
- Traffic (Load Balancing, Waiting Rooms, Health Checks, and more)
- Zero Trust and Access policies
- SSL certificates (though you can test these with a separate staging certificates feature)
Limitations
Version Management does not currently support or have limited support for the following products or features:
API Shield
- Some API Shield configurations are not cloned when a new zone version is created.
- Customers are allowed to opt-in to remove the UI block that prevents enabling Version Management.
Authenticated Origin Pull
- Authenticated Origin Pull does not work with Zone Versioning.
- Accessing your domain from an allowlisted IP returns a Cloudflare 520 error.
Cache
- Cache Reserve is intended for production use only.
- Purging the production environment purges all environments.
Cache Rules when used with Cloudflare Images
- Image Resizing does not work with the
additional_cacheable_portsCache Rule setting and Zone Versioning. - If you use
additional_cacheable_portswith Image Resizing, the image will be resized every time it is requested and will result in low performance.
Workers Cache API
- Workers Cache API does not work with Version Management.
- If you use the Workers Cache API with Zone Versioning, you might encounter unexpected caching behaviours.
China Network
- Regardless of the version deployed to production, traffic in China will always target the root zone.
- Other incompatibility issues with Access and ICP licenses.
Cloudflare API
- Version Management environments — including their routing expressions and version assignments — can be managed through the public Environments API.
- Creating, cloning, and editing zone versions (the configuration snapshots themselves) are currently only available through the Cloudflare dashboard ↗.
Domain-scoped Roles
- Domain-scoped Roles apply only to your root zone.
- Once a new version is created, these roles do not copy over and they lose access to versions.
Image Transformations
- Changes made to Image Transformations are not cloned when a new zone version is created.
Network Error Logging
- Network Error Logging configurations are not cloned when a new version is created.
Client-side security
- Client-side security (formerly known as Page Shield) is not available for versioning and is only configurable under your Global Configuration.
Rules
- Version Management does not currently support the following:
Security Insights
- Security Insights are not shown when Zone Versioning is enabled and the first version is deployed to production.
Terraform
- Version Management does not currently support Terraform.
- Customers should either use Terraform or Version Management.
WAF Attack Score
- WAF Attack Score configurations are not cloned when a new zone version is created.
Waiting Room
- Waiting Room users active on the site may be placed back in the queue.
- Waiting Room users in the queue may lose their place in line.
- Traffic may exceed limits.
Wrangler
- If a version has a Worker route, it might disappear when a Worker is deployed via Wrangler.
- If two versions have the same custom domains, the Worker might randomly choose between them.