Remove “Secure Your Cloudflare Account” email

The “Secure Your Cloudflare Account” email falls into the phishing category as it tries to steal users’ Cloudflare login credentials. The email is disguised as a security notification from Cloudflare and warns recipients that they need to secure their accounts. The email suggests that users need to review recent activities and update security settings by clicking on the provided button. However, if users click on the button, they will be taken to a phishing site that asks them to log in to their accounts. If users do, their accounts may be stolen by malicious actors.

 

 

The “Secure Your Cloudflare Account” email is a phishing scam, and its contents should be ignored. This deceptive email is made to mimic a legitimate security alert from Cloudflare, informing you that to ensure the security of your account, you should review recent activity and update security settings. It urges you to click on the “Go to Cloudflare dashboard” button to do this. However, clicking this button redirects to a phishing website designed to capture login credentials if you enter them. Although the site may closely resemble the official Cloudflare login page, any information entered will be sent directly to the attackers behind the scam.

Login credentials for these kinds of accounts are very valuable for malicious actors. If the cybercriminals operating this phishing campaign don’t use the stolen credentials themselves, they will sell them to other criminals. Thus, if you have fallen for this phishing attempt, you need to secure your Cloudflare account immediately by changing the password. If you can no longer access your account, you must try all account recovery options.

The full “Secure Your Cloudflare Account” email scam text is below:

CLOUDFLARE
Important: Secure Your Cloudflare Account

Hello,

To ensure the security of your Cloudflare account, we recommend reviewing recent activity and updating your security settings.
Action Required: Log in to your Cloudflare Dashboard to verify recent changes or enable additional security measures.
Go to Cloudflare Dashboard

For security reasons, never share your login credentials. Сlоudflаrе will never ask for your password via email.

Need help? Visit our Support Center.

Best regards,
The Cloudflare Team

© 2025 Cloudflare, Inc. All rights reserved.

Cloudflare, Inc. | 101 Townsend St, San Francisco, CA 94107

Security Policy

How to recognize a phishing email

Phishing emails like the “Secure Your Cloudflare Account” email are often poorly done and not very sophisticated. From how it greets you, it becomes evident that the email is not genuinely from Cloudflare. It does not address you in any way, and a mere “Hello” is used instead. It’s an immediate giveaway because a legitimate email from Cloudflare would address you by name. Additionally, the email originates from an address that clearly does not belong to Cloudflare. Identifying phishing emails is usually easy for most users, except in cases where high-profile targets are specifically chosen. Attacks targeting specific people/companies are usually very sophisticated, and can deceive even the most careful users under the right circumstances.

Oftentimes, phishing emails tend to be generic, riddled with mistakes, sent from random addresses, and generally unprofessional in design. In contrast, more advanced phishing scams target high-profile individuals or organizations and often appear more convincing, with accurate details and personal information about the target. These sophisticated attacks are more likely to succeed, although the majority of users encounter simpler phishing attempts that are easier to detect due to their generic nature.

If you receive an unsolicited email asking you to click a link or open an attachment, verify the sender’s email address before you do anything else. A quick online search can confirm whether the email address matches the one that belongs to whomever the sender claims to be. While generic phishing emails often come from obviously dubious addresses, more advanced attempts may use addresses that closely mimic those of legitimate companies. In the case of the “Secure Your Cloudflare Account” email, the sender’s address does not use Cloudflare’s domain, making it immediately clear that the email is malicious.

Another common sign of phishing is poor grammar or spelling mistakes. Receiving an email with mistakes seemingly from a reputable company like Cloudflare is a clear indication of a scam. The “Secure Your Cloudflare Account” email is riddled with such mistakes, further confirming it’s not legitimate.