Who changed my Cloudflare settings?
Updated 2026-10-17
Short answer: Cloudflare keeps a log of changes made in your account. When more than one person or tool has access (you, a developer, an agency, a plugin with an API token), a setting or DNS record can change without anyone telling you, and the first sign is something breaking.
How to check it yourself
- In the Cloudflare dashboard, open Manage Account, then Audit Log.
- Filter by the date things started going wrong, and look at what changed and which user or token made the change.
- Check Members and API Tokens to see who still has access, and remove anyone who shouldn't.
- Ask whoever made an unexpected change what it was for before you undo it.
What Preventionlabs shows
With a read-only Cloudflare token connected, every report shows the changes made in the Cloudflare account in the last 72 hours, from its change log. Preventionlabs also takes a snapshot of your DNS records every hour and reports any record added, removed or changed since, with the time. For example, from a real report: "changed CNAME dceaustralia.com: dceaustralia.pages.dev -> dce-lab.pages.dev".
The token is read-only: Preventionlabs can see changes, but it can't make any.
Price
First report free, no card needed. Then A$50 a month, up to 10 domains.