# Install on Cloudflare

> If your site is behind Cloudflare, paste one API token and we add a small worker that puts the tag on every page.

Any site whose domain runs through Cloudflare (orange cloud) can install without touching the site's code. This is full protection: the worker enforces your block rules on every page, so it also covers Shopify and any other store that sits behind Cloudflare.

## Steps

1. Go to [/start](https://tryostia.com/start), pick **Cloudflare** and enter your store address.
2. Click **Create the token in Cloudflare**. The link opens Cloudflare with three permissions filled in:

| Permission | Access | Why |
|---|---|---|
| Account: Workers Scripts | Edit | to add the worker |
| Zone: Workers Routes | Edit | to add the route for your host |
| Zone: Zone | Read | to find your zone |

3. Create the token, copy it, paste it on /start and click **Connect and install**. You see each step as it runs.
4. Open your store once. [/app](https://tryostia.com/app) shows **Seeing traffic** when the first visit arrives.

We use the token once, for those few calls, and never keep it: it is not stored, logged or put in a URL. You can delete the token in Cloudflare right after. Your store key is saved in the worker as an encrypted secret named `STORE_KEY`.

## What gets added

One small worker and one route, `<your host>/*`. The worker passes every request to your site unchanged, adds the script tag to HTML pages, and answers an agent you blocked in [/app](https://tryostia.com/app) with a plain-text 403 (People and search engines always get your normal site). With `STORE_KEY` set, it also counts each visit after your page is sent, so AI assistants and crawlers that never run scripts show up too. If anything in it fails, visitors get your site's own response. Nothing else on your zone is changed.

## By hand instead

On /start, the Cloudflare step also shows the worker script and these steps:

1. In Cloudflare open **Workers & Pages > Create > Start with Hello World**, name it and deploy.
2. Open **Edit code**, replace everything with the script from /start and deploy again.
3. Open the worker's **Settings > Domains & Routes > Add > Route**. Route `<your host>/*`, your zone. Save.
4. Open **Settings > Variables and Secrets > Add**, type **Secret**, name `STORE_KEY`, value your store key. Deploy.

## Your site is a Cloudflare Worker already?

The same install works. The route runs before your site's worker, sees each request first and hands it on unchanged.

## Remove it

Delete the route and the worker in the Cloudflare dashboard.

Source: https://tryostia.com/docs/install-cloudflare