The zone limit your API token hits and your Global API Key does not
Cloudflare documents a fifty domain threshold before pending zones block new ones. A scoped token hits it on the second domain. How to check, and the way around it.
How to audit agent readiness when the scanner cannot reach the site
An external scanner needs a public URL, so a staging build gets no score at all. What moving the checks into the browser changes, and the rule that keeps it honest.
How to see the redirect chain your browser actually followed
curl shows the server hops. It cannot see a JS redirect, a meta refresh, or an HSTS upgrade, and DevTools forgets on navigation. How to capture the whole chain.