What it does: Creates an IP access rule in the site’s own Cloudflare zone when Guard Forge locks an address out, and — since 1.2.0 — refreshes Cloudflare’s published list of edge addresses once a day. How to access: GuardForge > Cloudflare. Free/PRO: Pro (cloudflare_sync). Notes:

• The API token is the site owner’s, scoped to Zone → Firewall Services → Edit, stored encrypted on the site. The call goes straight from the site to Cloudflare; Avakode never holds the token and never relays the request.
• Repeated locks of the same address inside an hour are skipped, so a sustained attack does not churn the zone’s rule list. Rules Guard Forge creates are tagged in their notes and pruned by a daily cron after the retention window (30 days by default); rules created by hand are never touched.
• The edge ranges used to be a snapshot compiled into the free core’s class-ip.php. Cloudflare adds ranges, so a site behind a newer edge quietly stopped identifying its visitors — every one of them logged, counted and geo-located as the edge itself, with nothing reporting a problem. The list is now downloaded daily from api.cloudflare.com/client/v4/ips (public, unauthenticated, IPv6 included) through the Forge_Net gate; if the refresh fails the previous list stays in use, and the screen says when it last changed.
• Like patch-by-update, this daily job schedules itself from its class constructor, not from the activation hook — an update does not run activation, so an activation-only schedule exists on fresh installs and on no site that upgraded.