Cloudflare Spectrum proxies TCP and UDP services, Argo Smart Routing selects paths for eligible traffic, and Cloudflare WAF checks web and API requests against security rules. The three functions address different problems. A service may use several of them, depending on its protocol, Cloudflare configuration, and plan.

A website, an SSH service, and a UDP game service do not present the same traffic to Cloudflare. A web client sends HTTP requests that a WAF can interpret. SSH and UDP game traffic use different message formats, so HTTP filtering rules do not apply to them in the same way.

Argo's current web offering is part of Smart Shield, Cloudflare's bundle of origin performance and protection features. Spectrum and WAF still serve separate roles, even when a site also uses that bundle.

Identify the Traffic before Choosing a Feature

Start with the service's hostname, protocol, destination port, and origin. The origin is the backend server or service that processes the traffic. Determine whether the client sends HTTP or HTTPS, another TCP protocol, or UDP datagrams, and whether that traffic passes through Cloudflare at all.

The ordinary Cloudflare web proxy handles supported HTTP and HTTPS traffic. Spectrum extends proxying to services with different transport requirements. WAF rules operate on the web request path, while routing optimization affects how eligible traffic travels between Cloudflare and the origin.

Consider a site with an HTTPS account page and a separate UDP service. The account page can use the web proxy and WAF, while the UDP service needs its own supported proxy configuration. Even when Spectrum carries the UDP traffic, the web page's WAF rules do not inspect those UDP messages.

Spectrum Proxies TCP and UDP Services

Spectrum receives traffic for a configured service at Cloudflare's edge and forwards it to the service's origin. For a direct TCP application, Cloudflare handles the client connection and a separate connection toward the origin. For UDP applications, Spectrum forwards datagrams between the client and origin.

Spectrum can carry supported services such as SSH and game traffic. The service still runs at the origin. The proxy does not supply the application's account system, fix its protocol implementation, or decide which authenticated account may perform an action.

Spectrum includes network and transport DDoS mitigation for traffic using its protected path. That is different from evaluating an HTTP parameter for an application exploit. The application must still validate messages and control access to its accounts and functions.

Origin Protection Depends on the Actual Path

Clients using a Spectrum hostname connect to the application's Cloudflare edge addresses rather than directly to the origin. This reduces public exposure through that hostname, but it does not erase an address already published elsewhere or prevent connections to an origin that remains directly reachable.

To prevent direct connections to the origin, restrict access to the required proxy connections and any other authorized routes. An old DNS record, another service on the same server, or a previously known address can leave a route that avoids the intended protection. Check whether the origin still accepts connections that bypass the proxy.

HTTP Processing Depends on the Application Type

A direct TCP or UDP Spectrum application relays the service traffic without providing general HTTP request processing. It does not automatically add HTTP headers, convert an HTTP request into HTTPS, or apply web WAF rules to arbitrary TCP messages.

Spectrum also supports HTTP and HTTPS application types that route eligible traffic through Cloudflare's web pipeline. Those application types provide access to web functions such as caching and request inspection. Choosing a TCP application merely because HTTPS runs over TCP does not provide the same web processing.

Argo Changes the Network Path

Argo Smart Routing uses Cloudflare's observations of network conditions to select suitable paths for eligible traffic, including alternatives that avoid congestion. For web traffic, its origin performance measurements concern the interval between Cloudflare sending a request to the origin and receiving the first response byte.

The potential benefit depends on how much delay comes from that network path. A slow database query, an overloaded application worker, or a client spending time rendering a page is a different source of delay. Routing optimization does not make those operations faster by itself.

Argo also does not decide whether an API request is authorized or whether a submitted value is an attack. A request that the WAF blocks does not become permitted because a faster route to the origin exists.

Smart Shield Is the Current Web Package

Smart Shield combines origin-related functions, including tiered caching and connection reuse. Smart Shield + Argo and Smart Shield Advanced include Argo Smart Routing. Other package tiers do not necessarily include it.

An edge cache hit needs no request to the origin, so Argo cannot shorten an origin trip that never occurs. An uncached API request can still benefit from a faster route.

Argo Support for Spectrum

For Spectrum, Argo is an application setting with Enterprise plan requirements. Argo acceleration applies to TCP or UDP Spectrum applications using the direct traffic type. UDP acceleration remains in beta, so a UDP deployment needs confirmed access and supported settings before depending on it.

Buying a Smart Shield package for a website does not enable Argo for every Spectrum application. Check the Argo setting and protocol support for each Spectrum application separately.

The WAF Evaluates Web and API Requests

Cloudflare WAF applies rules to incoming web requests using properties such as the requested path, IP address, headers, and available body content. Cloudflare maintains managed rules to detect known attack patterns; custom rules let the operator define conditions for the site's own traffic.

The action matters as much as the match. A request can be blocked, challenged, or handled by another supported action. Rule order can also affect which checks run: an earlier blocking decision can prevent later rules from evaluating the same request.

For example, a site's custom rule might restrict an administrative path, while managed rules look for exploit patterns in other requests. These are web request decisions. A raw game message or SSH exchange does not have the HTTP path and request body that those rules expect.

WAF inspection has limits on request body size and on the fields it can process. A request that passes the WAF still needs application validation and account permission checks. Passing a rule check is not proof that every submitted value is safe.

Using the Services Together

For an ordinary proxied HTTPS website, WAF rules can inspect incoming requests while Argo, when included and enabled in Smart Shield, optimizes eligible origin traffic. The operator still needs to decide which rules apply and which package features are active. A WAF rule controls how a request is handled; Argo selects the route for traffic sent to the origin.

For a direct Spectrum TCP service, Spectrum supplies the transport proxy and relevant network protection. Eligible Argo acceleration can be enabled for that application. HTTP-oriented WAF checks do not become a general parser for the TCP application's messages.

An HTTP or HTTPS service entering through Spectrum needs the corresponding web application type and supported web path to use the intended web features. Pointing a direct TCP Spectrum application at another Cloudflare-proxied hostname creates an unsupported double-proxy path and can cause connection failures.

Check Plan Support and Test the Service

Spectrum is not available on the Free plan. Pro and Business support only specific protocols, while custom TCP and UDP applications require Enterprise with the paid Spectrum add-on. Advanced settings may have additional plan requirements.

WAF features are available across plans, but ruleset coverage, rule limits, actions, and advanced detection differ. The Free Managed Ruleset does not imply access to every paid managed ruleset or advanced field. Check which rules and features are enabled for the hostname, as well as which ones the plan offers.

When testing a service you control, check each function separately:

  • For Spectrum, check whether the intended service connection reaches the correct origin and whether connection events indicate filtering or origin errors.
  • For Argo, compare the relevant origin response measurements under comparable requests and locations, while accounting for cache behavior and origin processing.
  • For the WAF, confirm that intended rules handle controlled matching requests and that legitimate application operations still work.

Connection counts, origin response times, and WAF events answer different questions. Record the hostname, application type, enabled settings, and request or connection for each test so that the results can be traced to the configuration tested.