×
Cloudflare
×
Cloudflare
The Clearing advises DoD, DHS, DOJ and FAA — yet theclearing.com runs on a single, publicly-reachable AWS WordPress origin, with DNS at GoDaddy and no security at the edge. Cloudflare puts your website, your team’s access, and your inboxes behind one FedRAMP-authorized network — the posture your federal clients already expect.
The Clearing, Inc. is a Washington, D.C. operations-design and strategy firm (founded 2009, ~50–60 staff per LinkedIn) whose work centers on IT modernization, security compliance and organizational transformation for federal agencies — including the Department of Defense and Department of Homeland Security, per theclearing.com. For a firm of that mission, the digital front door and internal access model are part of the credibility story.
Today that footprint is spread thin: a lone Amazon EC2 instance serves the WordPress site with no edge WAF/CDN, authoritative DNS sits at GoDaddy, email runs on Google Workspace alongside GoDaddy and Pardot/Mailchimp senders, a public dev/staging site is exposed, and the WordPress login page answers openly to the internet. Each is a place Cloudflare can reduce risk and vendors at once.
Give a distributed, federal-contractor team least-privilege access to internal & SaaS apps without a legacy VPN. One agent, one policy engine — and the access-control + audit trail your DoD/DHS engagements require.
A federal contractor is a prime target for spear-phishing and business-email-compromise. Email Security sits in front of Workspace to catch what native filtering misses — and tightens the sender domains you already run.
The website is one EC2 instance with no edge in front. Put Cloudflare’s managed WordPress WAF, DDoS protection and caching in the path — and stop the open login page from being brute-forced.
Cloudflare Tunnel makes the AWS origin unreachable except through Cloudflare, and Access puts the exposed dev/staging site behind identity so pre-release work isn’t open to the internet.
Move authoritative DNS onto Cloudflare’s anycast network — faster, more resilient, and the foundation that lets everything else proxy through the edge. Add DNSSEC and, optionally, at-cost Registrar.
The site embeds a Pickaxe AI assistant. AI Gateway puts a governed front door on LLM calls — logging, rate-limits and spend caps that a federal-facing firm needs for audit — while Turnstile shields forms and the login from bots.
| Function | Today | How it was identified | On Cloudflare |
|---|---|---|---|
| Web origin & CDN | Single AWS EC2, no edge identified | apex A 52.72.22.19 · AS14618 AMAZON-AES; Server: Apache | WAF + CDN + DDoS |
| CMS | WordPress; login exposed risk | X-Redirect-By: WordPress; /wp-login.php → 200 | Managed WAF + rate limit + Turnstile |
| Authoritative DNS | GoDaddy identified | NS ns51/ns52.domaincontrol.com | Cloudflare DNS + DNSSEC |
| Google Workspace + GoDaddy | MX aspmx.l.google.com; mail.* → secureserver.net | Email Security (layered) | |
| Marketing mail | Mailchimp + Pardot | SPF include servers.mcsv.net, aspmx.pardot.com | Keep; enforce DKIM/DMARC |
| Embedded AI | Pickaxe chatbot | studio.pickaxe.co loaded on page | AI Gateway (govern) + Turnstile |
| Staging | Public dev site risk | 301 dev2021 → dev2025.theclearing.com | Access (Zero Trust) gate |
| Secure access | Distributed team; model to confirm | Federal client base (theclearing.com) | Cloudflare One (FedRAMP) |