Principal Solutions Architect
Valli Wang
Designs edge architectures and application security programmes for companies expanding overseas, with a focus on API security, bot governance and vendor comparison. Articles are grounded in published Cloudflare documentation and real projects; wherever a capability boundary matters, the official wording is stated rather than inferred.
Areas of focus
- API security and schema validation
- Bot management and anti-automation
- Rate limiting and quota design
- DDoS mitigation and runbooks
- Vendor selection and capability boundaries
Articles (17)
Network Architecture for AI Products Going Global: Model Calls, AI Gateway, and Edge Caching
AI latency is cross-border round trips plus inference, not rendering. Split edge access, AI Gateway and model layer; caching only hits identical requests.
DDoS Runbook for SaaS Teams: Prepare Before It Happens
Cloudflare mitigates L3-7 DDoS on every plan. A runbook is about the other half: six things to prepare, an order of response, and who decides what.
Why WAF Rules Miss Bots — and Where Bot Management Starts
A WAF asks if a payload matches a known attack. Bot control asks if the caller behaves like a user. Tiers differ in what you can write rules against.
Can a CDN Protect Your Website from DDoS Attacks?
A CDN solves the DDoS problems that usually kill a site: origin exposure, concentrated traffic and repeated requests. Where it stops.
Cloudflare API Shield: The Positive Security Model for APIs
API Shield checks what a request should be, not what it might attack with: mTLS, schema validation, JWT checks, per-session limits — and their limits.
Cloudflare Free vs Enterprise: When to Upgrade
Free and Enterprise differ in three ways: plan-included limits, Enterprise-only products, and paid add-ons on top. Six signals that an upgrade pays off.
Cloudflare vs AWS, Alibaba Cloud and Tencent Cloud: Do You Need Both?
Your cloud decides where the app runs; Cloudflare decides how global users reach it. Real overlap, real pricing, DNS setup, when Enterprise fits.
Cloudflare WAF vs AWS WAF
One is an inspecting reverse proxy with CDN and DDoS built in; the other a rule engine on a load balancer. What that means in practice.
How to Choose DDoS Protection for Global Businesses
DDoS protection is not bought by bandwidth. Three tests decide if a service protects you: coverage, preconditions, and where it stops working.
How to Choose an Enterprise Web Application Firewall
WAF selection is not a rule-count contest. False positive cost, expressiveness against your business logic, and who maintains it decide it.
How to Mitigate HTTP Flood and Layer 7 Attacks
A layer 7 flood looks legitimate, so capacity never solves it, classification does. Four signals, the mitigation order and plan thresholds.
How Attackers Find Your Origin IP Behind Cloudflare
Proxied DNS hides your origin from a lookup, not from an attacker. Six leak paths, a verification order, and four containment layers.
How to Prevent Malicious Web Scraping
Scraping is not one problem: search crawlers, competitor price monitoring and bulk extraction need opposite responses. How to tell them apart.
How to Prevent API Abuse in AI SaaS
AI SaaS API abuse burns inference budget and wrecks concurrency. The defence order that works: contract validation, strong identity, bot control, quotas.
Managing API Costs and Abnormal Traffic in AI SaaS
Cost lives in tokens and compute, not request counts. The control chain: cost-based rate limiting, tiered quotas, anomaly detection, caching and breakers.
Preventing Automated Signups and Free-Tier Abuse in AI Apps
Automated signups poison user data and the inference bill at once. Six defence layers, from email reputation to invisible verification and quotas.
How to Mitigate API Key Abuse and Unauthorized Access
A leaked API key is a credential incident, not a password incident. Five bindings that make a stolen key worthless: origin, cert, quota, contract, audit.