WatchTower

Manually monitoring hundreds of web projects does not scale

In an infrastructure that manages a large number of web projects and servers, each site's traffic profile can be different. A traffic increase that is normal for one project may represent unusual behavior for another. Static thresholds alone do not always provide enough operational context. Code64 needed a centralized mechanism that could observe each project's normal traffic behavior, monitor abnormal activity in logs and, when necessary, apply controlled security actions through the existing infrastructure.

Learning what normal looks like for each project

WatchTower observes traffic for a defined period to establish a reference for normal operating behavior. Server and web application logs are monitored continuously, and new traffic is evaluated in the context of previously observed activity. The goal is not to classify every spike as an attack, but to detect meaningful deviations from normal behavior early enough to produce an actionable operational signal.

From detection to direct security action

When WatchTower detects unusual traffic behavior, it can raise the Cloudflare security level for the relevant web project through the API. When conditions require it, the security level can be increased up to Cloudflare's Under Attack mode. API access is provided through dedicated tokens limited to the required areas and permissions. This turns WatchTower from a passive monitoring dashboard into an operational tool capable of applying predefined security actions automatically.

A controlled return to normal

How the system returns to normal is as important as how it raises protection levels. WatchTower does not immediately restore the previous security level as soon as traffic appears to normalize. Instead, it continues monitoring during a defined cooldown period and gradually lowers the security level. This approach keeps the system attentive to a renewed increase while preventing elevated security settings from remaining in place longer than necessary.

Keeping the operations team informed

Detected events and security actions performed by WatchTower are sent to the operations team through Telegram notifications. The system can act automatically while the team maintains visibility into what happened and which security changes were applied. WatchTower is actively used across Code64's own operational infrastructure. The system currently monitors 8 servers: 4 on Google Cloud and 4 hosted in Türkiye-based environments. Across these servers, traffic and log activity for more than 1000 web projects is monitored continuously.

WatchTower is not positioned as a standalone commercial product. It is developed primarily as an internal Code64 operations tool, while similar deployments can also be installed and supported on customer servers when needed.

Systems that do more than monitor — they act.

We build custom software that observes infrastructure behavior and applies controlled actions under defined conditions. Get in touch

Bringing monitoring and action into the same loop

WatchTower operates as a continuous feedback loop. The system first observes traffic behavior and establishes a reference for normal activity. New log and traffic data is then evaluated against that operating pattern. When unusual activity is detected, the relevant Cloudflare security settings can be activated. Once traffic stabilizes, WatchTower returns to observation mode and gradually lowers the security level after the defined cooldown period. This brings monitoring, decision-making, action and normalization into one operational flow instead of treating them as separate manual tasks.

Limiting access to what the automation actually needs

WatchTower does not rely on broad Cloudflare account permissions. Access is provided through dedicated API tokens limited to the relevant zone and the security actions required by the automation. This keeps the automation's permissions aligned with its operational responsibilities.