diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 365170953d1..475eae7db4e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,5 +1,5 @@
 # 1.1.1.1
-products/1.1.1.1/ @abracchi-tw @cloudflare/PCX
+products/1.1.1.1/ @cloudflare/PCX @cloudflare/dns
 
 # Access
 products/access/ @cloudflare/access-docs @cloudflare/PCX
@@ -10,12 +10,27 @@ products/analytics/ @soheiokamoto @jherre @tlozoot @cloudflare/PCX
 # API
 products/api/ @cloudflare/sdk @cloudflare/PCX
 
-# Argo Tunnel
-products/argo-tunnel/ @abracchi-tw
+# APO
+products/automatic-platform-optimization/ @cloudflare/PCX
+
+# Bot management
+products/bots/ @cloudflare/PCX
+
+# Browser Isolation
+products/browser-isolation/ @cloudflare/PCX
 
 # BYOIP
 products/byoip/ @ConzorKingKong @dinasaur404 @cloudflare/PCX
 
+# Cache
+products/cache/ @cloudflare/PCX
+
+# Cloudflare One
+products/cloudflare-one/ @cloudflare/PCX
+
+# Developers homepage
+developers.cloudflare.com/ @cloudflare/PCX
+
 # Distributed Web
 products/distributed-web/ @lukevalenta @thibmeu @jhoyla @Lekensteyn @cloudflare/PCX
 
@@ -28,8 +43,8 @@ products/events/ @ConzorKingKong @cloudflare/PCX
 # Firewall Rules
 products/firewall/ @cloudflare/firewall @cloudflare/PCX
 
-# Gateway
-products/gateway/ @abracchi-tw
+# Fundamentals
+products/fundamentals/ @cloudflare/PCX
 
 # HTTP/3
 products/http3/ @ConzorKingKong @cloudflare/PCX
@@ -37,9 +52,6 @@ products/http3/ @ConzorKingKong @cloudflare/PCX
 # Image Resizing
 products/images/ @kornel @cloudflare/PCX
 
-# The Life of a Request
-products/internet/ @ConzorKingKong @cloudflare/PCX
-
 # Load Balancing
 products/load-balancing/ @ConzorKingKong @cloudflare/PCX
 
@@ -49,17 +61,26 @@ products/logs/ @soheiokamoto @jherre @tlozoot @bharatnc @cloudflare/PCX
 # Magic Transit
 products/magic-transit/ @annikagarbers @cloudflare/PCX
 
+# Magic Firewall
+products/magic-firewall/ @arges @annikagarbers @cloudflare/PCX
+
 # Network Interconnect
 products/network-interconnect @ConzorKingKong @cloudflare/PCX
 
 # Pages
 products/pages/ @cloudflare/workers-docs @cloudflare/PCX
 
+# Page Shield
+products/page-shield/ @cloudflare/PCX
+
+# Railgun
+products/railgun/ @cloudflare/PCX
+
 # Randomness Beacon
 products/randomness-beacon/ @lukevalenta @armfazh @cloudflare/PCX
 
 # Registrar
-products/registrar/ @TownLake @cloudflare/PCX
+products/registrar/ @cloudflare/PCX
 
 # Rules
 products/rules/ @cloudflare/PCX
@@ -85,8 +106,11 @@ products/time-services/ @lukevalenta @wbl @armfazh @cloudflare/PCX
 # WAF
 products/waf/ @cloudflare/firewall @cloudflare/PCX
 
+# Waiting Room
+products/waiting-room/ @cloudflare/PCX
+
 # Warp Client
-products/warp-client/ @abracchi-tw
+products/warp-client/ @cloudflare/PCX
 
 # Workers
 products/workers/ @cloudflare/workers-docs @cloudflare/PCX
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b396e75020..92b3142bcbf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,29 +13,34 @@ jobs:
       access: ${{ steps.filter.outputs.access }}
       analytics: ${{ steps.filter.outputs.analytics }}
       api: ${{ steps.filter.outputs.api }}
-      argo-tunnel: ${{ steps.filter.outputs.argo-tunnel }}
+      api-security: ${{ steps.filter.outputs.api-security }}
       automatic-platform-optimization: ${{ steps.filter.outputs.automatic-platform-optimization }}
       bots: ${{ steps.filter.outputs.bots }}
       byoip: ${{ steps.filter.outputs.byoip }}
+      cache: ${{ steps.filter.outputs.cache }}
+      client-ip-geolocation: ${{ steps.filter.outputs.client-ip-geolocation }}
       cloudflare-one: ${{ steps.filter.outputs.cloudflare-one }}
       distributed-web: ${{ steps.filter.outputs.distributed-web }}
       docs-engine: ${{ steps.filter.outputs.docs-engine }}
       events: ${{ steps.filter.outputs.events }}
       firewall: ${{ steps.filter.outputs.firewall }}
       fundamentals: ${{ steps.filter.outputs.fundamentals }}
-      gateway: ${{ steps.filter.outputs.gateway }}
       browser-isolation: ${{ steps.filter.outputs.browser-isolation }}
       http3: ${{ steps.filter.outputs.http3 }}
-      images: ${{ steps.filter.outputs.images }}
+      image-resizing: ${{ steps.filter.outputs.image-resizing }}
       load-balancing: ${{ steps.filter.outputs.load-balancing }}
       logs: ${{ steps.filter.outputs.logs }}
+      magic-firewall: ${{ steps.filter.outputs.magic-firewall }}
       magic-transit: ${{ steps.filter.outputs.magic-transit }}
+      magic-wan: ${{ steps.filter.outputs.magic-wan }}
       network-interconnect: ${{ steps.filter.outputs.network-interconnect }}
       pages: ${{ steps.filter.outputs.pages }}
+      railgun: ${{ steps.filter.outputs.railgun }}
       page-shield: ${{ steps.filter.outputs.page-shield }}
+      partners: ${{ steps.filter.outputs.partners }}
       randomness-beacon: ${{ steps.filter.outputs.randomness-beacon }}
       registrar: ${{ steps.filter.outputs.registrar }}
-      rules: ${{ steps.filter.outputs.rules }}      
+      rules: ${{ steps.filter.outputs.rules }}
       spectrum: ${{ steps.filter.outputs.spectrum }}
       ssl: ${{ steps.filter.outputs.ssl }}
       stream: ${{ steps.filter.outputs.stream }}
@@ -62,14 +67,18 @@ jobs:
               - 'products/analytics/**'
             api:
               - 'products/api/**'
-            argo-tunnel:
-              - 'products/argo-tunnel/**'
+            api-security:
+              - 'products/api-security/**'
             automatic-platform-optimization:
               - 'products/automatic-platform-optimization/**'
             bots:
               - 'products/bots/**'
             byoip:
               - 'products/byoip/**'
+            cache:
+              - 'products/cache/**'
+            client-ip-geolocation:
+              - 'products/client-ip-geolocation/**'
             cloudflare-one:
               - 'products/cloudflare-one/**'
             distributed-web:
@@ -82,26 +91,32 @@ jobs:
               - 'products/firewall/**'
             fundamentals:
               - 'products/fundamentals/**'
-            gateway:
-              - 'products/gateway/**'
             browser-isolation:
               - 'products/browser-isolation/**'
             http3:
               - 'products/http3/**'
-            images:
-              - 'products/images/**'
+            image-resizing:
+              - 'products/image-resizing/**'
             load-balancing:
               - 'products/load-balancing/**'
             logs:
               - 'products/logs/**'
+            magic-firewall:
+              - 'products/magic-firewall/**'
             magic-transit:
               - 'products/magic-transit/**'
+            magic-wan:
+              - 'products/magic-wan/**'
             network-interconnect:
               - 'products/network-interconnect/**'
             pages:
               - 'products/pages/**'
             page-shield:
               - 'products/page-shield/**'
+            partners:
+              - 'products/partners/**'  
+            railgun:
+              - 'products/railgun/**'
             randomness-beacon:
               - 'products/randomness-beacon/**'
             registrar:
@@ -222,14 +237,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-argo-tunnel:
+  build-api-security:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.argo-tunnel == 'true' }}
+    if: ${{ needs.changes.outputs.api-security == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/argo-tunnel
+        working-directory: products/api-security
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -241,7 +256,6 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-
   build-automatic-platform-optimization:
     runs-on: ubuntu-latest
     needs: changes
@@ -259,7 +273,7 @@ jobs:
           npm install
           mkdir .docs
           npm run ghactionsbootstrap
-          npm run build  
+          npm run build
 
   build-bots:
     runs-on: ubuntu-latest
@@ -298,6 +312,44 @@ jobs:
           mkdir .docs
           npm run ghactionsbootstrap
           npm run build
+          
+  build-client-ip-geolocation:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.client-ip-geolocation == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/client-ip-geolocation
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+
+  build-cache:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.cache == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/cache
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
 
   build-cloudflare-one:
     runs-on: ubuntu-latest
@@ -412,14 +464,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-gateway:
+  build-browser-isolation:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.gateway == 'true' }}
+    if: ${{ needs.changes.outputs.browser-isolation == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/gateway
+        working-directory: products/browser-isolation
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -431,14 +483,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-browser-isolation:
+  build-http3:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.browser-isolation == 'true' }}
+    if: ${{ needs.changes.outputs.http3 == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/browser-isolation
+        working-directory: products/http3
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -450,14 +502,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-http3:
+  build-image-resizing:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.http3 == 'true' }}
+    if: ${{ needs.changes.outputs.image-resizing == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/http3
+        working-directory: products/image-resizing
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -469,14 +521,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-images:
+  build-load-balancing:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.images == 'true' }}
+    if: ${{ needs.changes.outputs.load-balancing == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/images
+        working-directory: products/load-balancing
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -488,14 +540,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-load-balancing:
+  build-logs:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.load-balancing == 'true' }}
+    if: ${{ needs.changes.outputs.logs == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/load-balancing
+        working-directory: products/logs
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -507,14 +559,14 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
-  build-logs:
+  build-magic-firewall:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.logs == 'true' }}
+    if: ${{ needs.changes.outputs.magic-firewall == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/logs
+        working-directory: products/magic-firewall
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -545,6 +597,25 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
+  build-magic-wan:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.magic-wan == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/magic-wan
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+
   build-network-interconnect:
     runs-on: ubuntu-latest
     needs: changes
@@ -582,7 +653,7 @@ jobs:
           mkdir .docs
           npm run ghactionsbootstrap
           npm run build
-  
+
   build-page-shield:
     runs-on: ubuntu-latest
     needs: changes
@@ -602,6 +673,44 @@ jobs:
           npm run ghactionsbootstrap
           npm run build
 
+  build-partners:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.partners == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/partners
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+
+  build-railgun:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.railgun == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/railgun
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+
   build-randomness-beacon:
     runs-on: ubuntu-latest
     needs: changes
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 02e83693abe..47e741f84a2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -15,26 +15,31 @@ jobs:
       access: ${{ steps.filter.outputs.access }}
       analytics: ${{ steps.filter.outputs.analytics }}
       api: ${{ steps.filter.outputs.api }}
-      argo-tunnel: ${{ steps.filter.outputs.argo-tunnel }}
+      api-security: ${{ steps.filter.outputs.api-security }}
       automatic-platform-optimization: ${{ steps.filter.outputs.automatic-platform-optimization }}
       bots: ${{ steps.filter.outputs.bots }}
       byoip: ${{ steps.filter.outputs.byoip }}
+      cache: ${{ steps.filter.outputs.cache }}
+      client-ip-geolocation: ${{ steps.filter.outputs.client-ip-geolocation }}
       cloudflare-one: ${{ steps.filter.outputs.cloudflare-one }}
       distributed-web: ${{ steps.filter.outputs.distributed-web }}
       docs-engine: ${{ steps.filter.outputs.docs-engine }}
       events: ${{ steps.filter.outputs.events }}
       firewall: ${{ steps.filter.outputs.firewall }}
       fundamentals: ${{ steps.filter.outputs.fundamentals }}
-      gateway: ${{ steps.filter.outputs.gateway }}
       browser-isolation: ${{ steps.filter.outputs.browser-isolation }}
       http3: ${{ steps.filter.outputs.http3 }}
-      images: ${{ steps.filter.outputs.images }}
+      image-resizing: ${{ steps.filter.outputs.image-resizing }}
       load-balancing: ${{ steps.filter.outputs.load-balancing }}
       logs: ${{ steps.filter.outputs.logs }}
+      magic-firewall: ${{ steps.filter.outputs.magic-firewall }}
       magic-transit: ${{ steps.filter.outputs.magic-transit }}
+      magic-wan: ${{ steps.filter.outputs.magic-wan }}
       network-interconnect: ${{ steps.filter.outputs.network-interconnect }}
       pages: ${{ steps.filter.outputs.pages }}
       page-shield: ${{ steps.filter.outputs.page-shield }}
+      partners: ${{ steps.filter.outputs.partners }}
+      railgun: ${{ steps.filter.outputs.railgun }}
       randomness-beacon: ${{ steps.filter.outputs.randomness-beacon }}
       registrar: ${{ steps.filter.outputs.registrar }}
       rules: ${{ steps.filter.outputs.rules }}
@@ -64,14 +69,18 @@ jobs:
               - 'products/analytics/**'
             api:
               - 'products/api/**'
-            argo-tunnel:
-              - 'products/argo-tunnel/**'
+            api-security:
+              - 'products/api-security/**'
             automatic-platform-optimization:
               - 'products/automatic-platform-optimization/**'
             bots:
               - 'products/bots/**'
             byoip:
               - 'products/byoip/**'
+            cache:
+              - 'products/cache/**'
+            client-ip-geolocation:
+              - 'products/client-ip-geolocation/**'
             cloudflare-one:
               - 'products/cloudflare-one/**'
             distributed-web:
@@ -84,26 +93,32 @@ jobs:
               - 'products/firewall/**'
             fundamentals:
               - 'products/fundamentals/**'
-            gateway:
-              - 'products/gateway/**'
             browser-isolation:
               - 'products/browser-isolation/**'
             http3:
               - 'products/http3/**'
-            images:
-              - 'products/images/**'
+            image-resizing:
+              - 'products/image-resizing/**'
             load-balancing:
               - 'products/load-balancing/**'
             logs:
               - 'products/logs/**'
+            magic-firewall:
+              - 'products/magic-firewall/**'
             magic-transit:
               - 'products/magic-transit/**'
+            magic-wan:
+              - 'products/magic-wan/**'
             network-interconnect:
               - 'products/network-interconnect/**'
             pages:
               - 'products/pages/**'
             page-shield:
             - 'products/page-shield/**'
+            partners:
+            - 'products/partners/**'
+            railgun:
+            - 'products/railgun/**'
             randomness-beacon:
               - 'products/randomness-beacon/**'
             registrar:
@@ -296,15 +311,15 @@ jobs:
           workingDirectory: "products/api"
           environment: "production"
           wranglerVersion: '1.13.0'
-
-  deploy-argo-tunnel:
+          
+  deploy-api-security:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.argo-tunnel == 'true' }}
+    if: ${{ needs.changes.outputs.api-security == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/argo-tunnel
+        working-directory: products/api-security
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -321,13 +336,13 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/argo-tunnel"
+          workingDirectory: "products/api-security"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/argo-tunnel"
+          workingDirectory: "products/api-security"
           environment: "production"
           wranglerVersion: '1.13.0'
 
@@ -430,6 +445,70 @@ jobs:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           workingDirectory: "products/byoip"
           environment: "production"
+          
+  deploy-client-ip-geolocation:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.client-ip-geolocation == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/client-ip-geolocation
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+        env:
+          WORKERS_ENV: development
+      - name: Publish staging
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/client-ip-geolocation"
+      - name: Publish production
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/client-ip-geolocation"
+          environment: "production"
+
+  deploy-cache:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.cache == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/cache
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+        env:
+          WORKERS_ENV: development
+      - name: Publish staging
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/cache"
+      - name: Publish production
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/cache"
+          environment: "production"
 
   deploy-cloudflare-one:
     runs-on: ubuntu-latest
@@ -635,14 +714,14 @@ jobs:
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-gateway:
+  deploy-browser-isolation:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.gateway == 'true' }}
+    if: ${{ needs.changes.outputs.browser-isolation == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/gateway
+        working-directory: products/browser-isolation
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -659,24 +738,24 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/gateway"
+          workingDirectory: "products/browser-isolation"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/gateway"
+          workingDirectory: "products/browser-isolation"
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-browser-isolation:
+  deploy-http3:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.browser-isolation == 'true' }}
+    if: ${{ needs.changes.outputs.http3 == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/browser-isolation
+        working-directory: products/http3
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -693,24 +772,24 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/browser-isolation"
+          workingDirectory: "products/http3"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/browser-isolation"
+          workingDirectory: "products/http3"
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-http3:
+  deploy-image-resizing:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.http3 == 'true' }}
+    if: ${{ needs.changes.outputs.image-resizing == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/http3
+        working-directory: products/image-resizing
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -727,24 +806,24 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/http3"
+          workingDirectory: "products/image-resizing"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/http3"
+          workingDirectory: "products/image-resizing"
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-images:
+  deploy-load-balancing:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.images == 'true' }}
+    if: ${{ needs.changes.outputs.load-balancing == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/images
+        working-directory: products/load-balancing
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -761,24 +840,24 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/images"
+          workingDirectory: "products/load-balancing"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/images"
+          workingDirectory: "products/load-balancing"
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-load-balancing:
+  deploy-logs:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.load-balancing == 'true' }}
+    if: ${{ needs.changes.outputs.logs == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/load-balancing
+        working-directory: products/logs
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -795,24 +874,24 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/load-balancing"
+          workingDirectory: "products/logs"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/load-balancing"
+          workingDirectory: "products/logs"
           environment: "production"
           wranglerVersion: '1.13.0'
 
-  deploy-logs:
+  deploy-magic-firewall:
     runs-on: ubuntu-latest
     needs: changes
-    if: ${{ needs.changes.outputs.logs == 'true' }}
+    if: ${{ needs.changes.outputs.magic-firewall == 'true' }}
     defaults:
       run:
         shell: bash
-        working-directory: products/logs
+        working-directory: products/magic-firewall
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1
@@ -829,13 +908,13 @@ jobs:
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/logs"
+          workingDirectory: "products/magic-firewall"
           wranglerVersion: '1.13.0'
       - name: Publish production
         uses: cloudflare/wrangler-action@1.2.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
-          workingDirectory: "products/logs"
+          workingDirectory: "products/magic-firewall"
           environment: "production"
           wranglerVersion: '1.13.0'
 
@@ -873,6 +952,40 @@ jobs:
           environment: "production"
           wranglerVersion: '1.13.0'
 
+  deploy-magic-wan:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.magic-wan == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/magic-wan
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+        env:
+          WORKERS_ENV: development
+      - name: Publish staging
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/magic-wan"
+          wranglerVersion: '1.13.0'
+      - name: Publish production
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/magic-wan"
+          environment: "production"
+          wranglerVersion: '1.13.0'
+
   deploy-network-interconnect:
     runs-on: ubuntu-latest
     needs: changes
@@ -940,6 +1053,13 @@ jobs:
           workingDirectory: 'products/pages'
           environment: 'production'
           wranglerVersion: '1.13.0'
+      - name: Google Chat Notification
+        uses: signalnerve/google-chat-notification@master
+        with:
+          name: Build
+          url: ${{ secrets.WDC_TEAM_GOOGLE_CHAT_WEBHOOK }}
+          status: ${{ job.status }}
+        if: ${{ failure() }}
   
   deploy-page-shield:
     runs-on: ubuntu-latest
@@ -975,6 +1095,72 @@ jobs:
           environment: 'production'
           wranglerVersion: '1.13.0'
 
+  deploy-partners:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.partners == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/partners
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+        env:
+          WORKERS_ENV: development
+      - name: Publish staging
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: 'products/partners'
+          wranglerVersion: '1.13.0'
+      - name: Publish production
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: 'products/partners'
+          environment: 'production'
+          wranglerVersion: '1.13.0'
+
+  deploy-railgun:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.railgun == 'true' }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: products/railgun
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14.2.0
+      - run: |
+          npm install
+          mkdir .docs
+          npm run ghactionsbootstrap
+          npm run build
+        env:
+          WORKERS_ENV: development
+      - name: Publish staging
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/railgun"
+      - name: Publish production
+        uses: cloudflare/wrangler-action@1.2.0
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          workingDirectory: "products/railgun"
+          environment: "production"
+
   deploy-randomness-beacon:
     runs-on: ubuntu-latest
     needs: changes
@@ -1414,3 +1600,10 @@ jobs:
           workingDirectory: "products/workers"
           environment: "production"
           wranglerVersion: '1.13.0'
+      - name: Google Chat Notification
+        uses: signalnerve/google-chat-notification@master
+        with:
+          name: Build
+          url: ${{ secrets.WDC_TEAM_GOOGLE_CHAT_WEBHOOK }}
+          status: ${{ job.status }}
+        if: ${{ failure() }}
diff --git a/README.md b/README.md
index b3df6ad7666..63e10fbef87 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,6 @@ To get write access to this repo, please reach out to the __Developer Docs__ roo
 | Analytics               | analytics            | [Test](https://analytics.cloudflare-docs.workers.dev/analytics)                       | [Prod](https://developers.cloudflare.com/analytics)            |
 | API                     | api                  | [Test](https://api.cloudflare-docs.workers.dev/api)                                   | [Prod](https://developers.cloudflare.com/api)                  |
 | Automatic Platform Optimization | automatic-platform-optimization | [Test](https://automatic-platform-optimization.cloudflare-docs.workers.dev/automatic-platform-optimization) | [Prod](https://developers.cloudflare.com/automatic-platform-optimization) |
-| Argo Tunnel             | argo-tunnel          | [Test](https://argo-tunnel.cloudflare-docs.workers.dev/argo-tunnel)                   | [Prod](https://developers.cloudflare.com/argo-tunnel)          |
 | Bots                    | bots                 | [Test](https://bots.cloudflare-docs.workers.dev/bots)                                 | [Prod](https://developers.cloudflare.com/bots)     
 | BYOIP                   | byoip                | [Test](https://byoip.cloudflare-docs.workers.dev/byoip)                               | [Prod](https://developers.cloudflare.com/byoip)                |
 | Cloudflare One          | cloudflare-one       | [Test](https://cloudflare-one.cloudflare-docs.workers.dev/cloudflare-one)             | [Prod](https://developers.cloudflare.com/cloudflare-one)       |
@@ -28,14 +27,15 @@ To get write access to this repo, please reach out to the __Developer Docs__ roo
 | Events                  | events               | [Test](https://events.cloudflare-docs.workers.dev/events)                             | [Prod](https://developers.cloudflare.com/events)               |
 | Firewall                | firewall             | [Test](https://firewall.cloudflare-docs.workers.dev/firewall)                         | [Prod](https://developers.cloudflare.com/firewall)             |
 | Fundamentals            | fundamentals         | [Test](https://fundamentals.cloudflare-docs.workers.dev/fundamentals)                 | [Prod](https://developers.cloudflare.com/fundamentals)         |
-| Gateway                 | gateway              | [Test](https://gateway.cloudflare-docs.workers.dev/gateway)                           | [Prod](https://developers.cloudflare.com/gateway)              |
 | HTTP/3                  | http3                | [Test](https://http3.cloudflare-docs.workers.dev/http3)                               | [Prod](https://developers.cloudflare.com/http3)                |
 | Image Resizing          | images               | [Test](https://images.cloudflare-docs.workers.dev/images)                             | [Prod](https://developers.cloudflare.com/images)               |
 | Load Balancing          | load-balancing       | [Test](https://load-balancing.cloudflare-docs.workers.dev/load-balancing)             | [Prod](https://developers.cloudflare.com/load-balancing)       |
 | Logs                    | logs                 | [Test](https://logs.cloudflare-docs.workers.dev/logs)                                 | [Prod](https://developers.cloudflare.com/logs)                 |
+| Magic Firewall          | magic-firewall        | [Test](https://magic-firewall.cloudflare-docs.workers.dev/magic-firewall)            | [Prod](https://developers.cloudflare.com/magic-firewall)        |
 | Magic Transit           | magic-transit        | [Test](https://magic-transit.cloudflare-docs.workers.dev/magic-transit)               | [Prod](https://developers.cloudflare.com/magic-transit)        |
 | Network Interconnect    | network-interconnect | [Test](https://network-interconnect.cloudflare-docs.workers.dev/network-interconnect) | [Prod](https://developers.cloudflare.com/network-interconnect) |
 | Pages                   | pages                | [Test](https://pages.cloudflare-docs.workers.dev/pages)                               | [Prod](https://developers.cloudflare.com/pages)                |
+| Railgun                 | railgun              | [Test](https://railgun.cloudflare-docs.workers.dev/railgun)                           | [Prod](https://developers.cloudflare.com/railgun)              |
 | Randomness Beacon       | randomness-beacon    | [Test](https://randomness-beacon.cloudflare-docs.workers.dev/randomness-beacon)       | [Prod](https://developers.cloudflare.com/randomness-beacon)    |
 | Registrar               | registrar            | [Test](https://registrar.cloudflare-docs.workers.dev/registrar)                       | [Prod](https://developers.cloudflare.com/registrar)            |
 | Rules                   | rules                | [Test](https://rules.cloudflare-docs.workers.dev/rules)                               | [Prod](https://developers.cloudflare.com/rules)                |
diff --git a/developers.cloudflare.com/docs-config.js b/developers.cloudflare.com/docs-config.js
index 341088bf13b..cefd807344c 100644
--- a/developers.cloudflare.com/docs-config.js
+++ b/developers.cloudflare.com/docs-config.js
@@ -9,8 +9,8 @@ module.exports = {
     url: "https://cloudflare.com"
   }],
   search: {
-    indexName: "",
-    apiKey: "",
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
     algoliaOptions: { "facetFilters": "" }
   },
   siteMetadata: {
@@ -18,6 +18,6 @@ module.exports = {
     description: "Browse the latest developer documentation including API reference, articles, and sample code.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/developers.cloudflare.com/gatsby-config.js b/developers.cloudflare.com/gatsby-config.js
index 90553ba003e..c2de45bec9c 100755
--- a/developers.cloudflare.com/gatsby-config.js
+++ b/developers.cloudflare.com/gatsby-config.js
@@ -13,7 +13,6 @@ const products = [
   "access",
   "analytics",
   "api",
-  "argo-tunnel",
   "byoip",
   "cloudflare-for-teams",
   "cloudflare-one",
@@ -22,13 +21,13 @@ const products = [
   "events",
   "firewall",
   "fundamentals",
-  "gateway",
   "http3",
   "images",
   "load-balancing",
   "logs",
   "magic-transit",
   "network-interconnect",
+  "railgun",
   "randomness-beacon",
   "registrar",
   "spectrum",
diff --git a/developers.cloudflare.com/package.json b/developers.cloudflare.com/package.json
index c9817731634..a7fd4437a42 100755
--- a/developers.cloudflare.com/package.json
+++ b/developers.cloudflare.com/package.json
@@ -5,8 +5,8 @@
   "version": "0.1.0",
   "author": "Cloudflare <github@cloudflare.com>",
   "dependencies": {
-    "@adaptivelink/pops": "0.2.25",
-    "@cloudflare/cloudflare-brand-assets": "4.7.5",
+    "@adaptivelink/pops": "0.3.3",
+    "@cloudflare/cloudflare-brand-assets": "4.7.7",
     "@material-ui/core": "4.11.0",
     "@mdx-js/mdx": "1.6.6",
     "@mdx-js/react": "1.6.6",
diff --git a/developers.cloudflare.com/src/components/product-grid.js b/developers.cloudflare.com/src/components/product-grid.js
index 2865c2153b5..8f399ea7eaa 100644
--- a/developers.cloudflare.com/src/components/product-grid.js
+++ b/developers.cloudflare.com/src/components/product-grid.js
@@ -6,22 +6,27 @@ const $ = {}
 $["1.1.1.1"]              = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/1.1.1.1.js").pathD
 $["analytics"]            = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/analytics.js").pathD
 $["api"]                  = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/api.js").pathD
+$["api-security"]         = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/page-shield.js").pathD
 $["automatic-platform-optimization"]   = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/automatic-platform-optimization.js").pathD
 $["bots"]                 = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/bots.js").pathD
 $["byoip"]                = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/byoip.js").pathD
+$["cache"]                = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/cache.js").pathD
 $["cloudflare-for-teams"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/cloudflare-for-teams.js").pathD
 $["cloudflare-one"]       = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/cloudflare-one.js").pathD
 $["distributed-web"]      = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/distributed-web.js").pathD
 $["firewall"]             = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/firewall.js").pathD
 $["http3"]                = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/http3.js").pathD
-$["images"]               = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/images.js").pathD
+$["image-resizing"]       = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/images.js").pathD
 $["fundamentals"]         = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/fundamentals.js").pathD
 $["load-balancing"]       = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/load-balancing.js").pathD
 $["logs"]                 = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/logs.js").pathD
 $["magic-transit"]        = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/magic-transit.js").pathD
+$["magic-firewall"]       = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/firewall.js").pathD
+$["magic-wan"]            = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/magic-wan.js").pathD
 $["network-interconnect"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/network-interconnect.js").pathD
 $["pages"]                = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/pages.js").pathD
 $["page-shield"]          = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/page-shield.js").pathD
+$["partners"]             = require("../../../products/partners/src/content/icons/partners.js").pathD
 $["railgun"]              = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/railgun.js").pathD
 $["randomness-beacon"]    = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/randomness-beacon.js").pathD
 $["registrar"]            = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/registrar.js").pathD
@@ -43,6 +48,11 @@ const products = [
     path: "api",
     icon: "api",
   },
+  {
+    title: "API Security",
+    path: "api-security",
+    icon: "page-shield",
+  },
   {
     title: "Analytics",
     path: "analytics",
@@ -74,6 +84,11 @@ const products = [
     path: "byoip",
     icon: "byoip",
   },
+  {
+    title: "Cache",
+    path: "cache",
+    icon: "cache",
+  },
   {
     title: "Cloudflare for Teams",
     path: "cloudflare-one",
@@ -103,8 +118,8 @@ const products = [
   },
   {
     title: "Image Resizing",
-    path: "images",
-    icon: "images",
+    path: "image-resizing",
+    icon: "image-resizing",
   },
   {
     title: "Cloudflare Fundamentals",
@@ -127,6 +142,16 @@ const products = [
     path: "magic-transit",
     icon: "magic-transit",
   },
+  {
+    title: "Magic Firewall",
+    path: "magic-firewall",
+    icon: "magic-firewall",
+  },
+  {
+    title: "Magic WAN",
+    path: "magic-wan",
+    icon: "magic-wan",
+  },
   {
     title: "Network Interconnect",
     path: "network-interconnect",
@@ -143,9 +168,14 @@ const products = [
     path: "page-shield",
     icon: "page-shield",
   },
+  {
+    title: "Partners",
+    path: "partners",
+    icon: "partners",
+  },
   {
     title: "Railgun",
-    href: "https://www.cloudflare.com/docs/railgun/",
+    path: "railgun",
     icon: "railgun",
   },
   {
@@ -217,7 +247,7 @@ const products = [
 ]
 
 const ProductGridLink = ({ product }) => (
-  <a className="ProductGrid--link" data-wrap-title={product.wrap} href={product.href || `http://developers.cloudflare.com/${product.path}`}>
+  <a className="ProductGrid--link" data-wrap-title={product.wrap} href={product.href || `https://developers.cloudflare.com/${product.path}`}>
     <svg viewBox="0 0 48 48"><path d={$[product.icon]}/></svg>
     <span>{product.title}</span>
   </a>
diff --git a/developers.cloudflare.com/src/components/seo.js b/developers.cloudflare.com/src/components/seo.js
index 5f5bf885d44..26a39eb9824 100755
--- a/developers.cloudflare.com/src/components/seo.js
+++ b/developers.cloudflare.com/src/components/seo.js
@@ -54,6 +54,7 @@ function SEO({ lang, title, description, meta }) {
       <meta property="og:type" content="website"/>
 
       <meta name="twitter:title" content={title}/>
+      <meta name="twitter:image" content="https://www.cloudflare.com/img/cf-twitter-card.png"/>
       <meta name="twitter:description" content={metaDescription}/>
       <meta name="twitter:creator" content={site.siteMetadata.author}/>
       <meta name="twitter:card" content="summary_large_image"/>
diff --git a/developers.cloudflare.com/src/components/site-header.js b/developers.cloudflare.com/src/components/site-header.js
index 6ba6b0d09b6..8e301cba2e6 100644
--- a/developers.cloudflare.com/src/components/site-header.js
+++ b/developers.cloudflare.com/src/components/site-header.js
@@ -5,6 +5,7 @@ import { Link } from "gatsby"
 import CloudflareLogo from "cloudflare-docs-engine/src/components/cloudflare-logo"
 import DocsNavLogoLockup from "cloudflare-docs-engine/src/components/docs-nav-logo-lockup"
 import ThemeToggle from "cloudflare-docs-engine/src/components/theme-toggle"
+import SiteSearch from "./site-search"
 
 import "../css/components/site-header.css"
 
@@ -26,6 +27,10 @@ const SiteHeader = () => (
         </Link>
       </div>
 
+      <div className="SiteHeader--search">
+        <SiteSearch/>
+      </div>
+
       <div className="SiteHeader--nav">
         <Link className="SiteHeader--nav-link" to="/docs">
           <span>Docs</span>
diff --git a/developers.cloudflare.com/src/components/site-page.js b/developers.cloudflare.com/src/components/site-page.js
index 6bf06cd4b40..2fd7b895965 100755
--- a/developers.cloudflare.com/src/components/site-page.js
+++ b/developers.cloudflare.com/src/components/site-page.js
@@ -26,7 +26,6 @@ const SitePage = ({ pageContext: page, children, location }) => {
   const htmlProps = {}
   htmlProps["is-site-page"] = ""
   htmlProps["is-docs-page"] = ""
-  htmlProps["search-disabled"] = ""
 
   return (
     <>
diff --git a/developers.cloudflare.com/src/components/site-search.js b/developers.cloudflare.com/src/components/site-search.js
new file mode 100644
index 00000000000..9a5610e363b
--- /dev/null
+++ b/developers.cloudflare.com/src/components/site-search.js
@@ -0,0 +1,174 @@
+// Based on cloudflare-docs-engine/src/components/docs-search.js
+// Keep these components (mostly) in sync.
+//
+// Due to what seems like a Gatsby bug which occurs only with `gatsby build`
+// and not `gatsby develop`, when any file imported from cloudflare-docs-engine
+// contains `useStaticQuery` the build fails due to a relative import issue with
+// the way GraphQL stores the cached static JSON.
+
+import React, { useCallback, useEffect, useState } from "react"
+import Helmet from "react-helmet"
+
+import { useStaticQuery, graphql } from "gatsby"
+
+import AccessibleSVG from "cloudflare-docs-engine/src/components/accessible-svg"
+
+import "../css/components/site-search.css"
+
+const SiteSearch = () => {
+  const { site: { siteMetadata }} = useStaticQuery(
+    graphql`
+      query {
+        site {
+          siteMetadata {
+            cloudflareDocs {
+              search {
+                indexName
+                apiKey
+                algoliaOptions {
+                  facetFilters
+                }
+              }
+            }
+          }
+        }
+      }
+    `
+  )
+
+  const {
+    search: {
+      indexName,
+      apiKey,
+      algoliaOptions
+    }
+  } = siteMetadata.cloudflareDocs
+  
+  const enableSearch = indexName && apiKey && algoliaOptions
+
+  let [scriptAdded, setScriptAdded] = useState(false)
+  let [scriptLoaded, setScriptLoaded] = useState(false)
+  let [searchFocused, setSearchFocused] = useState(false)
+
+  const onSearchFocus = useCallback(() => setSearchFocused(true), [])
+  const onSearchBlur = useCallback(() => setSearchFocused(false), [])
+
+  useEffect(() => {
+    if (enableSearch && !scriptAdded) {
+      const searchScript = document.createElement('script')
+      searchScript.type = "text/javascript"
+      searchScript.src = 'https://cdnjs.cloudflare.com/ajax/libs/docsearch.js/2.6.3/docsearch.min.js'
+      searchScript.onload = () => { setScriptLoaded(true) }
+      document.body.appendChild(searchScript)
+      setScriptAdded(true)
+    }
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [])
+
+  useEffect(() => {
+    const init = () => {
+      const search = window.docsearch({
+        indexName,
+        apiKey,
+        algoliaOptions,
+
+        // TODO: pass DOM in with Reacth.createRef?
+        inputSelector: "#SiteSearch--input",
+
+        autocompleteOptions: {
+          // https://github.com/algolia/autocomplete.js#global-options
+          autoselect: true,
+          openOnFocus: true,
+          clearOnSelected: false,
+          tabAutocomplete: false,
+
+          appendTo: ".SiteSearch--input-wrapper",
+          hint: false,
+
+          autoselectOnBlur: matchMedia("(pointer: course)").matches
+        },
+
+        // https://docsearch.algolia.com/docs/behavior
+        handleSelected: (input, event, suggestion, datasetNumber, context) => {
+          const url = new URL(suggestion.url)
+
+          // Don’t scroll to hash when it’s just the h1.
+          if (suggestion.isLvl0) {
+            url.hash = ""
+          }
+          window.location.href = url.toString()
+        },
+        
+        transformData: function(hits) {
+          // Remove empty results
+          for (let i = hits.length - 1; i >= 0; i -= 1) {
+            if (!hits[i].hierarchy.lvl0 && !hits[i].hierarchy.lvl1) {
+              hits.splice(i, 1)
+            }
+          }
+        }
+      })
+  
+      const autocompleteWrapper = search.autocomplete.autocomplete.getWrapper()
+
+      search.autocomplete.on("autocomplete:shown", event => {
+        autocompleteWrapper.setAttribute("data-expanded", true)
+      })
+
+      search.autocomplete.on("autocomplete:closed", event => {
+        autocompleteWrapper.setAttribute("data-expanded", false)
+      })
+
+      const input = search.input[0]
+
+      document.addEventListener("keydown", event => {
+        if (event.target === input) return
+
+        const slashShortcut = event.key === "/"
+        const commandShortcut = event.key === "S" && event.shiftKey
+
+        if (slashShortcut || commandShortcut) {
+          event.preventDefault()
+          window.scrollTo(0, 0)
+          input.focus()
+        }
+      })
+    }
+  
+    if (enableSearch && scriptLoaded) {
+      init()
+    }
+  
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [scriptLoaded])
+  
+  if (!enableSearch) {
+    return (
+      <>
+        <Helmet>
+          <html search-disabled=""/>
+        </Helmet>
+      </>
+    )
+  }
+  
+  return (
+    <>
+      <div className="SiteSearch" {...(searchFocused ? {"is-focused" : ""} : {})}>
+        <div className="SiteSearch--input-wrapper">
+          <input id="SiteSearch--input" className="SiteSearch--input"
+          onFocus={onSearchFocus} onBlur={onSearchBlur}
+          type="text" spellCheck="false" autoComplete="false" placeholder="Search docs..."/>
+          <div className="SiteSearch--input-icon">
+            <AccessibleSVG title="Search icon (depiction of a magnifying glass)" viewBox="0 0 16 16">
+              <path d="M11.999 10.585l3.458 3.458a1 1 0 01-1.414 1.414L10.585 12a6.5 6.5 0 111.414-1.414zM6.75 11.5a4.75 4.75 0 100-9.5 4.75 4.75 0 000 9.5z"/>
+            </AccessibleSVG>
+          </div>
+        </div>
+      </div>
+    </>
+  )
+}
+  
+export default SiteSearch
+  
diff --git a/developers.cloudflare.com/src/css/components/site-header.css b/developers.cloudflare.com/src/css/components/site-header.css
index b6cacd1a669..21bc1537660 100644
--- a/developers.cloudflare.com/src/css/components/site-header.css
+++ b/developers.cloudflare.com/src/css/components/site-header.css
@@ -50,13 +50,6 @@
   margin-right: auto;
 }
 
-@supports ((-webkit-backdrop-filter: blur(1em)) or (backdrop-filter:blur(1em))) {
-  .SiteHeader {
-    background: rgba(var(--background-color-rgb), .8);
-    -webkit-backdrop-filter: blur(1em);
-    backdrop-filter: blur(1em)
-  }
-}
 
 .SiteHeader--logo-section {
   display: flex;
@@ -85,8 +78,16 @@
 .SiteHeader--theme-toggle {
   display: flex;
   align-items: center;
-  margin-left: auto;
-  padding-right: 1rem;
+  padding: 0 1rem;
+}
+
+.SiteHeader--search {
+  flex: 1;
+  margin-right: auto;
+}
+
+[search-disabled] .SiteHeader--search {
+  visibility: hidden;
 }
 
 .SiteHeader--nav {
@@ -139,6 +140,14 @@
     display: none;
   }
 
+  .SiteHeader--search {
+    flex-basis: 3em;
+    flex-grow: 0;
+    margin-left: auto;
+    margin-right: 0;
+    max-width: 100vw;
+  }
+  
   .SiteHeader--cloudflare-logo-link {
     --docs-logo-lockup-gap: var(--docs-logo-lockup-gap-small);
     --logo-size: 2.5em;
@@ -146,6 +155,13 @@
   }
 
   .SiteHeader--theme-toggle {
+    padding-left: 0;
     padding-right: .9rem;
   }
 }
+
+@media (max-width: 1024px) {
+  .SiteHeader--nav {
+    display: none;
+  }
+}
diff --git a/developers.cloudflare.com/src/css/components/site-page.css b/developers.cloudflare.com/src/css/components/site-page.css
index fff15a5d3ba..5b249a9fa10 100755
--- a/developers.cloudflare.com/src/css/components/site-page.css
+++ b/developers.cloudflare.com/src/css/components/site-page.css
@@ -1,7 +1,7 @@
 /* TODO: move to @cloudflare/cloudflare-docs-engine/src/css/docs/components/docs-page.css */
 [is-site-page] .DocsPage {
   --docs-sidebar-width: 0;
-  --docs-content-gap: 1em;
+  --docs-content-gap: 3.7em;
 }
 
 html[is-site-page] .DocsContent {
diff --git a/developers.cloudflare.com/src/css/components/site-search.css b/developers.cloudflare.com/src/css/components/site-search.css
new file mode 100644
index 00000000000..c29504c0c7c
--- /dev/null
+++ b/developers.cloudflare.com/src/css/components/site-search.css
@@ -0,0 +1,311 @@
+.SiteSearch {
+  --text-indent: calc(var(--docs-content-gap) + 1px);
+  height: var(--docs-header-height);
+  flex: 1;
+}
+  
+.SiteSearch--input-wrapper {
+  position: relative;
+  height: 100%;
+}
+  
+.SiteSearch--input {
+  position: relative;
+  color: inherit;
+  height: 100%;
+  width: 100%;
+  border: 0;
+  padding: 0 var(--text-indent) .05em;
+  background: transparent;
+  outline: none;
+  z-index: 2;
+}
+  
+@-moz-document url-prefix() {
+  .SiteSearch--input {
+    letter-spacing: 0;
+  }
+}
+
+.SiteSearch--input::placeholder {
+  color: rgba(var(--color-rgb), .45);
+  opacity: 1;
+}
+
+[theme="dark"] .SiteSearch--input::placeholder {
+  color: rgba(var(--color-rgb), .55);
+}
+  
+.SiteSearch--input-icon {
+  position: absolute;
+  top: 0;
+  bottom: .05em;
+  margin-top: auto;
+  margin-bottom: auto;
+  left: 2.2em;
+  height: .8823529411em;
+  width: .8823529411em;
+  pointer-events: none;
+  opacity: .5;
+  transition: color .3s ease, opacity .3s ease;
+  z-index: 3;
+}
+
+.SiteSearch--input-wrapper:focus-within .SiteSearch--input-icon {
+  color: var(--orange);
+  opacity: 1;
+}
+
+[theme="dark"] .SiteSearch--input {
+  background:
+    linear-gradient(to right,
+      rgba(var(--shadow-color-rgb), .1) 0%,
+      rgba(var(--shadow-color-rgb), .1) calc(30% - 6em),
+      rgba(var(--shadow-color-rgb), 0) 30%
+    );
+}
+  
+/* Algolia DocSearch (https://docsearch.algolia.com) */
+
+.SiteSearch .algolia-autocomplete {
+  --dropdown-text-indent: var(--text-indent);
+  --suggestion-item-vertical-padding: .5em;
+
+  /* Combat Algolia-set inline styles */
+  display: block !important;
+  top: 0 !important;
+  left: 0 !important;
+  right: auto !important;
+  z-index: 1 !important;
+
+  background: var(--background-color);
+
+  --box-shadow:
+    0 3rem 6rem -1.2rem rgba(var(--shadow-color-rgb), .25),
+    0 3rem 6rem -3rem rgba(var(--shadow-color-rgb), .3);
+
+  --backdrop-box-shadow-alpha: .07;
+  --backdrop-box-shadow:
+    0 0 0 999em rgba(var(--shadow-color-rgb), var(--backdrop-box-shadow-alpha));
+
+  box-shadow: var(--box-shadow), var(--backdrop-box-shadow);
+
+  border-radius: 0 0 .5em .5em;
+  will-change: opacity;
+  transition: opacity .15s ease;
+}
+  
+[theme="dark"] .SiteSearch .algolia-autocomplete {
+  --dark-theme-shadow-offset: 1px;
+  --dropdown-text-indent: calc(var(--text-indent) - var(--dark-theme-shadow-offset));
+  --box-shadow: 0 0 0 1px rgb(var(--shadow-color-rgb), .3), 0 .3em 2em rgb(var(--shadow-color-rgb), .3);
+  --backdrop-box-shadow-alpha: .3;
+  background: var(--gray-0);
+  margin-left: var(--dark-theme-shadow-offset);
+}
+
+.SiteSearch .algolia-autocomplete[style*="display: none"],
+.SiteSearch .algolia-autocomplete:not([data-expanded="true"]) {
+  opacity: 0;
+  --backdrop-box-shadow: none;
+  pointer-events: none;
+}
+  
+@supports ((-webkit-backdrop-filter: blur(1em)) or (backdrop-filter: blur(1em))) {
+  .SiteSearch .algolia-autocomplete {
+    background: rgba(var(--background-color-rgb), .8);
+    -webkit-backdrop-filter: saturate(200%) blur(1.25em);
+    backdrop-filter: saturate(200%) blur(1.25em);
+  }
+
+  [theme="dark"] .SiteSearch .algolia-autocomplete {
+    background: rgba(var(--gray-0-rgb), .8);
+  }
+
+  /* Safari only hack */
+  @media not all and (min-resolution:.001dpcm) { @media {
+    .SiteSearch .algolia-autocomplete {
+      background: rgba(var(--background-color-rgb), 1);
+    }
+  }}
+}
+  
+.SiteSearch .algolia-autocomplete [class|="ds-dataset"] > *:first-child {
+  position: relative;
+  --padding-top: calc(var(--docs-header-height) + .66rem);
+  padding: var(--padding-top) var(--dropdown-text-indent) 0;
+}
+  
+.SiteSearch .algolia-autocomplete [class|="ds-dataset"] > *:first-child::before {
+  content: "";
+  position: absolute;
+  left: 0;
+  right: 0;
+  top: var(--docs-header-height);
+  margin-top: -1px;
+  height: 1px;
+  background: rgba(var(--color-rgb), .07);
+}
+
+[theme="dark"] .SiteSearch .algolia-autocomplete [class|="ds-dataset"] > *:first-child::before {
+  margin-top: 0;
+  background: rgba(var(--color-rgb), .07);
+  box-shadow:
+    0 -1px rgba(var(--shadow-color-rgb), .2),
+    0 calc(-1 * var(--docs-header-height)) rgba(var(--shadow-color-rgb), .1);
+}
+  
+.SiteSearch .ds-suggestion {
+  display: block;
+  --horizontal-padding: 1em;
+  padding: var(--suggestion-item-vertical-padding) var(--horizontal-padding);
+  margin: 0 calc(-1 * var(--horizontal-padding));
+  border-radius: .25em;
+}
+
+.SiteSearch .ds-suggestion.ds-cursor {
+  background: rgba(var(--gray-5-rgb), .2);
+}
+
+[theme="dark"] .SiteSearch .ds-suggestion.ds-cursor {
+  background: rgba(var(--gray-6-rgb), .15);
+}
+
+.SiteSearch a.algolia-docsearch-suggestion {
+  display: block;
+  color: inherit;
+  text-decoration: none;
+}
+
+.SiteSearch .algolia-docsearch-suggestion--text {
+  font-size: .9em;
+  color: rgba(var(--color-rgb), .8);
+}
+
+.SiteSearch .algolia-docsearch-suggestion--highlight {
+  --highlight-opacity: .2;
+  background-color: rgba(var(--orange-rgb), var(--highlight-opacity));
+  color: var(--color);
+}
+
+[theme="dark"] .SiteSearch .algolia-docsearch-suggestion--highlight {
+  --highlight-opacity: .4;
+}
+
+.SiteSearch .algolia-docsearch-suggestion--no-results {
+  padding-top: var(--suggestion-item-vertical-padding);
+  margin-bottom: 1em;
+}
+
+.SiteSearch .algolia-docsearch-suggestion--no-results .algolia-docsearch-suggestion--text {
+  padding-top: var(--suggestion-item-vertical-padding);
+  font-size: 1em;
+}
+
+.SiteSearch .algolia-docsearch-suggestion--no-results b {
+  font-weight: inherit;
+}
+
+.SiteSearch .algolia-docsearch-footer {
+  margin-top: .5rem;
+  padding: 0 var(--dropdown-text-indent) 2rem;
+  font-size: .7em;
+  opacity: .5;
+}
+
+.SiteSearch .algolia-docsearch-footer--logo {
+  color: inherit;
+}
+
+.SiteSearch .algolia-docsearch-suggestion--category-header-lvl0:empty::before {
+  content: "Document";
+}
+
+.SiteSearch .algolia-docsearch-suggestion__main .algolia-docsearch-suggestion--subcategory-column,
+.SiteSearch .algolia-docsearch-suggestion__main .algolia-docsearch-suggestion--subcategory-inline,
+.SiteSearch .algolia-docsearch-suggestion__main .algolia-docsearch-suggestion--title {
+  display: none;
+}
+
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--subcategory-column,
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--subcategory-inline {
+  display: none;
+}
+
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--category-header,
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--wrapper,
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--content,
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--title {
+  display: inline;
+}
+
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--content:not(.algolia-docsearch-suggestion--no-results)::before {
+  content: "›";
+  opacity: .15;
+  padding: 0 .333em;
+  display: inline-block;
+  transform: scale3d(1.5, 1.2, 1);
+}
+
+.SiteSearch .algolia-docsearch-suggestion:not(.algolia-docsearch-suggestion__main) .algolia-docsearch-suggestion--content:not(.algolia-docsearch-suggestion--no-results) .algolia-docsearch-suggestion--title::before {
+  content: "#";
+  padding-right: .25em;
+  opacity: .5;
+}
+  
+@media (max-width: 768px) {
+  .SiteSearch {
+    pointer-events: all;
+  }
+
+  .SiteSearch--input:not(:focus) {
+    padding: 0;
+    opacity: 0;
+  }
+
+  .SiteSearch[is-focused] {
+    position: fixed;
+    top: 0;
+    left: 0;
+    right: 0;
+    --text-indent: 3rem;
+    z-index: 2;
+  }
+
+  .SiteSearch--input-icon {
+    left: 15px;
+    height: 15px;
+    width: 15px;
+  }
+
+  .SiteSearch--input-wrapper:focus-within .SiteSearch--input-icon {
+    left: 19px;
+  }
+
+  .SiteSearch[is-focused] .SiteSearch--input-wrapper {
+    background: var(--background-color);
+    height: var(--docs-header-height);
+  }
+
+  .SiteSearch--input-bottom-border {
+    display: none;
+  }
+
+  .SiteSearch .algolia-autocomplete {
+    position: fixed;
+    top: var(--docs-header-height);
+    width: 100% !important;
+  }
+
+  @supports ((-webkit-backdrop-filter: blur(1em)) or (backdrop-filter: blur(1em))) {
+    .SiteSearch .algolia-autocomplete {
+      background: var(--background-color);
+      -webkit-backdrop-filter: none;
+      backdrop-filter: none;
+    }
+
+    [theme="dark"] .SiteSearch .algolia-autocomplete {
+      background: var(--background-color);
+    }
+  }
+}
diff --git a/developers.cloudflare.com/src/images/cf-twitter-card.png b/developers.cloudflare.com/src/images/cf-twitter-card.png
new file mode 100644
index 00000000000..bd726b62fd7
Binary files /dev/null and b/developers.cloudflare.com/src/images/cf-twitter-card.png differ
diff --git a/developers.cloudflare.com/static/robots.txt b/developers.cloudflare.com/static/robots.txt
index a54d276d23a..b50e84daa54 100644
--- a/developers.cloudflare.com/static/robots.txt
+++ b/developers.cloudflare.com/static/robots.txt
@@ -1,16 +1,15 @@
 User-agent: *
 Allow: /
 Disallow: /browser-isolation
+Disallow: /client-ip-geolocation
 
 Sitemap: https://developers.cloudflare.com/developers/sitemap.xml
-Sitemap: https://developers.cloudflare.com/onedot/sitemap.xml
-Sitemap: https://developers.cloudflare.com/access/sitemap.xml
+Sitemap: https://developers.cloudflare.com/1.1.1.1/sitemap.xml
 Sitemap: https://developers.cloudflare.com/analytics/sitemap.xml
 Sitemap: https://developers.cloudflare.com/api/sitemap.xml
-Sitemap: https://developers.cloudflare.com/argo-tunnel/sitemap.xml
+Sitemap: https://developers.cloudflare.com/api-security/sitemap.xml
 Sitemap: https://developers.cloudflare.com/automatic-platform-optimization/sitemap.xml
 Sitemap: https://developers.cloudflare.com/bots/sitemap.xml
-Sitemap: https://developers.cloudflare.com/browser-isolation/sitemap.xml
 Sitemap: https://developers.cloudflare.com/byoip/sitemap.xml
 Sitemap: https://developers.cloudflare.com/cloudflare-one/sitemap.xml
 Sitemap: https://developers.cloudflare.com/distributed-web/sitemap.xml
@@ -18,15 +17,16 @@ Sitemap: https://developers.cloudflare.com/docs-engine/sitemap.xml
 Sitemap: https://developers.cloudflare.com/events/sitemap.xml
 Sitemap: https://developers.cloudflare.com/firewall/sitemap.xml
 Sitemap: https://developers.cloudflare.com/fundamentals/sitemap.xml
-Sitemap: https://developers.cloudflare.com/gateway/sitemap.xml
 Sitemap: https://developers.cloudflare.com/http3/sitemap.xml
-Sitemap: https://developers.cloudflare.com/images/sitemap.xml
+Sitemap: https://developers.cloudflare.com/image-resizing/sitemap.xml
 Sitemap: https://developers.cloudflare.com/load-balancing/sitemap.xml
 Sitemap: https://developers.cloudflare.com/logs/sitemap.xml
 Sitemap: https://developers.cloudflare.com/magic-transit/sitemap.xml
+Sitemap: https://developers.cloudflare.com/magic-firewall/sitemap.xml
 Sitemap: https://developers.cloudflare.com/network-interconnect/sitemap.xml
 Sitemap: https://developers.cloudflare.com/pages/sitemap.xml
 Sitemap: https://developers.cloudflare.com/page-shield/sitemap.xml
+Sitemap: https://developers.cloudflare.com/railgun/sitemap.xml
 Sitemap: https://developers.cloudflare.com/randomness-beacon/sitemap.xml
 Sitemap: https://developers.cloudflare.com/registrar/sitemap.xml
 Sitemap: https://developers.cloudflare.com/rules/sitemap.xml
diff --git a/developers.cloudflare.com/wrangler.toml b/developers.cloudflare.com/wrangler.toml
index db09640d0c3..8d9f0e6bea6 100644
--- a/developers.cloudflare.com/wrangler.toml
+++ b/developers.cloudflare.com/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "42719e2c4502479e9145f347015e5b34" }
+]
 
 [site]
 bucket = "./public"
diff --git a/products/.DS_Store b/products/.DS_Store
deleted file mode 100644
index 5008ddfcf53..00000000000
Binary files a/products/.DS_Store and /dev/null differ
diff --git a/products/1.1.1.1/docs-config.js b/products/1.1.1.1/docs-config.js
index 72495b73211..0f0af8eede5 100644
--- a/products/1.1.1.1/docs-config.js
+++ b/products/1.1.1.1/docs-config.js
@@ -24,6 +24,6 @@ module.exports = {
     description: "A blazing fast DNS resolver built for private browsing.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/1.1.1.1",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/index.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/index.md
index 24f65cfb0ed..4992be737a2 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/index.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/index.md
@@ -1,10 +1,11 @@
 ---
 order: 3
+pcx-content: interim
 ---
 
 # 1.1.1.1 for Families
 
-1.1.1.1 for Families is the easiest way to add a layer of protection to your home network, and protect it from malware and adult content. 1.1.1.1 for Families leverages Cloudflare's global network to ensure that it is fast and secure around the world, and includes the same [strong privacy guarantees](/1.1.1.1/privacy/public-dns-resolver/) that we committed to when we launched 1.1.1.1 two years ago.
+1.1.1.1 for Families is the easiest way to add a layer of protection to your home network, and protect it from malware and adult content. 1.1.1.1 for Families leverages Cloudflare's global network to ensure that it is fast and secure around the world, and includes the same [strong privacy guarantees](/privacy/public-dns-resolver/) that we committed to when we launched 1.1.1.1 two years ago.
 
 1.1.1.1 for Families has two default options: one that blocks malware and the other that blocks malware and adult content. You choose which setting you want depending on which IP address you configure.
 
@@ -12,21 +13,21 @@ order: 3
 
 Using the following DNS resolvers will block malicious content:
 
-* **1.1.1.2**
-* **1.0.0.2**
-* **2606:4700:4700::1112**
-* **2606:4700:4700::1002**
+* `1.1.1.2`
+* `1.0.0.2`
+* `2606:4700:4700::1112`
+* `2606:4700:4700::1002`
 
 ## Block malware and adult content
 
 When you change your DNS resolvers to the addresses below, 1.1.1.1 for Families will block malware and adult content.
 
-* **1.1.1.3**
-* **1.0.0.3**
-* **2606:4700:4700::1113**
-* **2606:4700:4700::1003**
+* `1.1.1.3`
+* `1.0.0.3`
+* `2606:4700:4700::1113`
+* `2606:4700:4700::1003`
 
-Cloudflare will return 0.0.0.0 if the FQDN or IP in a DNS query is classified as malicious.
+Cloudflare will return `0.0.0.0` if the FQDN or IP in a DNS query is classified as malicious.
 
 Ready to set it up? You’ll find an easy guide for every device in the [setup instructions](/1.1.1.1-for-families/setup-instructions/) page.
 
@@ -36,4 +37,4 @@ Customers can decide to block certain categories, like “Gambling” or “Spor
 
 If you are using Gateway or 1.1.1.1 for Families and see a domain that you believe is miscategorized, fill in this [form](https://radar.cloudflare.com/categorization-feedback/) to bring it to our attention. Your submission will remain anonymous.
 
-We review these submissions to improve Cloudflare’s categorization.
+We review these submissions to improve Cloudflare’s categorization.
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/dns-over-https.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/dns-over-https.md
index e37e0df3f6c..a303551cdba 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/dns-over-https.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/dns-over-https.md
@@ -1,16 +1,19 @@
 ---
 order: 5
+pcx-content: interim
 ---
 # DNS over HTTPS
 
 You can send DNS queries in an encrypted fashion for 1.1.1.1 for Families. If you have DNS over HTTPS compliant client, use the following URLs to use 1.1.1.1 for Families.
 
 ## Block Malware
-To block all malware use the following URL
+
+To block all malware use the following URL:
 
 https://security.cloudflare-dns.com/dns-query
 
 ## Block Malware and Adult Content
-To block all malware and adult content use following URL
+
+To block all malware and adult content use following URL:
 
 https://family.cloudflare-dns.com/dns-query
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/index.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/index.md
index f9e47ecfde0..7af7e8a51a2 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/index.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content: navigation
 ---
 
 # Setup instructions
@@ -19,3 +20,7 @@ See how you can send DNS queries to 1.1.1.1 for Families from Windows.
 ## [Linux](./linux/)
 
 See how you can send DNS queries to 1.1.1.1 for Families from a Linux distro.
+
+## [DNS over HTTPS](./dns-over-https/)
+
+See how you can encrypt and protect your DNS queries.
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/linux.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/linux.md
index 69fff79f487..cf7898ac4b2 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/linux.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/linux.md
@@ -1,7 +1,10 @@
 ---
 order: 4
+pcx-content: how-to
 ---
 
+import CaptivePortals from "../../_partials/_captive-portals.md"
+
 # Linux setup instructions
 
 ## Block malware
@@ -9,73 +12,152 @@ order: 4
 ### Ubuntu
 
 #### IPv4
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Click Edit then click IPv4.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.2**
-    * **1.0.0.2**
-* Click Apply
+
+1. Click **System** > **Preferences** > **Network Connections**.
+1. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
+1. Click **Edit** > **IPv4**.
+1. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.2
+    1.0.0.2
+    ```
+
+1. Click **Apply**.
 
 #### IPv6
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Then go to IPv6.
-* Add the IPv6 address listed below:
-    * **2606:4700:4700::1112**
-    * **2606:4700:4700::1002**
-* Click Apply.
+
+1. Click **System** > **Preferences** > **Network Connections**.
+1. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
+1. Go to **IPv6**.
+1. Add the IPv6 addresses listed below:
+
+    ```txt
+    2606:4700:4700::1112
+    2606:4700:4700::1002
+    ```
+
+1. Click **Apply**.
 
 ### Debian
 
 #### IPv4
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Replace the nameserver lines with: (Since you are using vim press the <kbd>i</kbd> key on your keyboard to edit the document)
-    * **1.1.1.2**
-    * **1.0.0.2**
-* Save and exit vim by pressing the <kbd>ESC</kbd> key on your keyboard. Then after lifting the key type `:wq`.
+
+1. In the command line, type:
+
+    ```bash
+    sudo vim /etc/resolv.conf
+    ```
+
+1. Press the <kbd>i</kbd> key on your keyboard to edit the document.
+1. Replace the nameserver lines with:
+
+    ```txt
+    1.1.1.2
+    1.0.0.2
+    ```
+
+2. Press the <kbd>ESC</kbd> key on your keyboard to save and exit vim. Then, after lifting the key, type:
+
+    ```
+    :wq
+    ```
 
 #### IPv6
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Add the IPv6 address listed below:
-    * **2606:4700:4700::1112**
-    * **2606:4700:4700::1002**
-* Save and exit vim by pressing the <kbd>ESC</kbd> key on your keyboard. Then after lifting the key type `:wq`
+
+1. In the command line, type:
+
+    ```bash
+    sudo vim /etc/resolv.conf
+    ```
+
+1. Add the IPv6 address listed below:
+
+    ```txt
+    2606:4700:4700::1112
+    2606:4700:4700::1002
+    ```
+
+1. Press the <kbd>ESC</kbd> key on your keyboard to save and exit vim. Then, after lifting the key, type:
+
+    ```
+    :wq
+    ```
 
 ## Block Malware and Adult Content
 
 ### Ubuntu
 
 #### IPv4
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Click Edit then click IPv4.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.3**
-    * **1.0.0.3**
-* Click Apply
+
+1. Click **System** > **Preferences** > **Network Connections**.
+1. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
+1. Click **Edit** > **IPv4**.
+1. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.3
+    1.0.0.3
+    ```
+1. Click **Apply**.
 
 #### IPv6
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Then go to IPv6.
-* Add the IPv6 address listed below:
-    * **2606:4700:4700::1113**
-    * **2606:4700:4700::1003**
-* Click Apply.
+
+1. Click **System** > **Preferences** > **Network Connections**.
+1. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
+1. Go to **IPv6**.
+1. Add the IPv6 addresses listed below:
+
+    ```txt
+    2606:4700:4700::1113
+    2606:4700:4700::1003
+    ```
+
+1. Click **Apply**.
 
 ### Debian
 
 #### IPv4
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Replace the nameserver lines with: (Since you are using vim press the <kbd>i</kbd> key on your keyboard to edit the document)
-    * **1.1.1.3**
-    * **1.0.0.3**
-* Save and exit vim by pressing the <kbd>ESC</kbd> key on your keyboard. Then after lifting the key type `:wq`
+
+1. In the command line, type:
+
+    ```bash
+    sudo vim /etc/resolv.conf
+    ```
+
+1. Press the <kbd>i</kbd> key on your keyboard to edit the document.
+1. Replace the nameserver lines with:
+
+    ```txt
+    1.1.1.3
+    1.0.0.3
+    ```
+
+1. Press the <kbd>ESC</kbd> key on your keyboard to save and exit vim. Then, after lifting the key, type:
+
+    ```
+    :wq
+    ```
 
 #### IPv6
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Add the IPv6 address listed below:
-    * **2606:4700:4700::1113**
-    * **2606:4700:4700::1003**
-* Save and exit vim by pressing the <kbd>ESC</kbd> key on your keyboard. Then after lifting the key type `:wq`
+
+1. In the command line, type:
+
+    ```bash
+    sudo vim /etc/resolv.conf
+    ```
+
+1. Add the IPv6 addresses listed below:
+
+    ```txt
+    2606:4700:4700::1113
+    2606:4700:4700::1003
+    ```
+
+1. Press the <kbd>ESC</kbd> key on your keyboard to save and exit vim. Then, after lifting the key, type:
+
+    ```
+    :wq
+    ```
+
+    <CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/mac.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/mac.md
index ef338c7c04f..1d9ef7b17c5 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/mac.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/mac.md
@@ -1,49 +1,74 @@
 ---
 order: 2
+pcx-content: how-to
 ---
 
+import CaptivePortals from "../../_partials/_captive-portals.md"
+
 # Mac setup instructions
 
 ## Block malware
 
 ### IPv4
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.2**
-    * **1.0.0.2**
-* Click OK.
-* Click Apply.
+
+1. Go to **System Preferences**. You can find it by pressing <kbd>Command</kbd> + <kbd>Space</kbd> on your keyboard and typing `System Preferences`.
+1. Click on the **Network** icon.
+1. Click **Advanced**.
+1. Select the **DNS** tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.2
+    1.0.0.2
+    ```
+
+1. Click **OK**.
+1. Click **Apply**.
 
 ### IPv6
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the IPv6 address we listed below:
-    * **2606:4700:4700::1112**
-    * **2606:4700:4700::1002**
-* Click OK.
-* Click Apply.
+
+1. Go to **System Preferences**. You can find it by pressing <kbd>Command</kbd> + <kbd>Space</kbd> on your keyboard and typing `System Preferences`.
+1. Click on the **Network** icon.
+1. Click **Advanced**.
+1. Select the **DNS** tab. Remove any IP addresses that may be already listed and in their place add the IPv6 addresses listed below:
+
+    ```txt
+    2606:4700:4700::1112
+    2606:4700:4700::1002
+    ```
+
+1. Click **OK**.
+1. Click **Apply**.
 
 ## Block malware and adult content
 
 ### IPv4
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.3**
-    * **1.0.0.3**
-* Click OK.
-* Click Apply.
+
+1. Go to **System Preferences**. You can find it by pressing <kbd>Command</kbd> + <kbd>Space</kbd> on your keyboard and typing `System Preferences`.
+1. Click on the **Network** icon.
+1. Click **Advanced**.
+1. Select the **DNS** tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.3
+    1.0.0.3
+    ```
+
+1. Click **OK**.
+1. Click **Apply**.
 
 ### IPv6
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the IPv6 address we listed below:
-    * **2606:4700:4700::1113**
-    * **2606:4700:4700::1003**
-* Click OK.
-* Click Apply.
+
+1. Go to **System Preferences**. You can find it by pressing <kbd>Command</kbd> + <kbd>Space</kbd> on your keyboard and typing `System Preferences`.
+1. Click on the **Network** icon.
+1. Click **Advanced**.
+1. Select the **DNS** tab. Remove any IP addresses that may be already listed and in their place add the IPv6 addresses we listed below:
+
+    ```txt
+    2606:4700:4700::1113
+    2606:4700:4700::1003
+    ```
+
+2. Click **OK**.
+3. Click **Apply**.
+
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/router.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/router.md
index 73281d4bc40..3147e57be87 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/router.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/router.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content: how-to
 ---
 
 # Router setup instructions
@@ -8,179 +9,159 @@ order: 1
 
 Follow this quick guide to start using 1.1.1.1 for Families on your router.
 
-Step 1: Go to the IP address used to access your router's admin console in your browser.
+1. Go to the IP address used to access your router's admin console in your browser.
 
-  * Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
-  * Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
-  * D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
-  * Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
+   * Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
+   * Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
+   * D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
+   * Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
 
-Step 2: Enter the router password.
+1. Enter the router password.
 
-Step 3: Find the place in the admin console where DNS settings are set.
+1. Find the place in the admin console where DNS settings are set.
+1. Replace the existing addresses with:
 
-Step 4: Replace the existing addresses with:
+  ```txt
+  1.1.1.2
+  1.0.0.2
+  2606:4700:4700::1112
+  2606:4700:4700::1002
+  ```
 
-```txt
-1.1.1.2
-1.0.0.2
-2606:4700:4700::1112
-2606:4700:4700::1002
-```
-
-Step 5: Save and exit.
+1. Save the updated settings.
 
 ### Using DNS-Over-TLS on OpenWRT
 
-It is possible to encrypt DNS traffic out from your router using DNS-over-TLS if it is running OpenWRT. For more details, see our blog post on the topic: [Adding DNS-Over-TLS support to OpenWRT (LEDE) with Unbound](https://blog.cloudflare.com/dns-over-tls-for-openwrt/)
+It is possible to encrypt DNS traffic out from your router using DNS-over-TLS if it is running OpenWRT. For more details, see our blog post on the topic: [Adding DNS-Over-TLS support to OpenWRT (LEDE) with Unbound](https://blog.cloudflare.com/dns-over-tls-for-openwrt/).
 
 ### Ubiquiti UniFi controller
 
 <StreamVideo id="510f09dad9812cd7ac009ebcab75068e"/>
 
-Step 1: Go to [http://unifi.ubnt.com](http://unifi.ubnt.com) and enter your email and password.
-
-Step 2: Click on the name of the network you are managing. Click Launch.
-
-Step 3: Click on the settings icon in the lower left-hand corner.
-
-Step 4: From the settings menu, choose Networks.
-
-Step 5; Click Edit by the name of the Network.
-
-Step 6: Scroll to where it says DHCP Name Server. If Auto is selected, select Manual instead.
-
-Step 7: In the boxes called DNS Server 1, 2, 3, etc. put:
-
-```txt
-1.1.1.2
-1.0.0.2
-2606:4700:4700::1112
-2606:4700:4700::1002
-```
-
-Step 8: Click Save.
+1. Go to [http://unifi.ubnt.com](http://unifi.ubnt.com).
+1. Enter your email and password.
+1. Click on the name of the network you are managing.
+1. Click **Launch**.
+1. Click on the **Settings** icon in the lower left-hand corner.
+1. From the Settings menu, click **Networks**.
+1. Click **Edit by the name of the Network**.
+1. Scroll to where it says DHCP Name Server. If Auto is selected, select **Manual** instead.
+1. In the boxes called DNS Server 1, 2, 3, etc. put:
+
+  ```txt
+  1.1.1.2
+  1.0.0.2
+  2606:4700:4700::1112
+  2606:4700:4700::1002
+  ```
+
+1. Click **Save**.
 
 ### Google Wi-Fi
 
-Step 1: Open the Google Wifi app on your phone.
-
-Step 2: Click the settings tab, then click on Network & general
-
-Step 3: Click on Advanced networking then click on DNS
-
-Step 4: Remove any IP addresses that may be already listed and in their place enter:
+1. Open the Google Wifi app on your phone.
+1. Click the **Settings** tab > **Network & general**.
+1. Click on **Advanced networking** > **DNS**.
+1. Remove any IP addresses that may be already listed and in their place enter:
 
-```txt
-1.1.1.2
-1.0.0.2
-2606:4700:4700::1112
-2606:4700:4700::1002
-```
+  ```txt
+  1.1.1.2
+  1.0.0.2
+  2606:4700:4700::1112
+  2606:4700:4700::1002
+  ```
 
-Step 5: Click Save.
+1. Click **Save**.
 
 ### Asus Router
 
-Step 1: Go to https://192.168.1.1/
+1. Go to https://192.168.1.1/.
 
-![Asus Router](../../static/asus.png)
+  ![Asus Router](../../static/asus.png)
 
-Step 2: Under Advanced Settings, click on WAN
+1. Under **Advanced Settings**, click on **WAN**.
+1. In **Internet Connection** > **WAN DNS Setting** > **DNS servers**, add:
 
-Step 3: In the Internet Connection tab, under WAN DNS Setting, in DNS servers, add:
-
-```txt
-1.1.1.2
-1.0.0.2
-2606:4700:4700::1112
-2606:4700:4700::1002
-```
+  ```txt
+  1.1.1.2
+  1.0.0.2
+  2606:4700:4700::1112
+  2606:4700:4700::1002
+  ```
 
 ## Block Malware and Adult Content
-Follow this quick guide to start using 1.1.1.1 for Families on your router.
-
-Step 1: Go to the IP address used to access your router's admin console in your browser.
 
-  * Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
-  * Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
-  * D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
-  * Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
-
-Step 2: Enter the router password.
-
-Step 3: Find the place in the admin console where DNS settings are set.
+Follow this quick guide to start using 1.1.1.1 for Families on your router.
 
-Step 4: Replace the existing addresses with:
+1. Go to the IP address used to access your router's admin console in your browser.
+   * Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
+   * Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
+   * D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
+   * Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
+1. Enter the router password.
+1. Find the place in the admin console where DNS settings are set.
+1. Replace the existing addresses with:
 
-```txt
-1.1.1.3
-1.0.0.3
-2606:4700:4700::1113
-2606:4700:4700::1003
-```
+  ```txt
+  1.1.1.3
+  1.0.0.3
+  2606:4700:4700::1113
+  2606:4700:4700::1003
+  ```
 
-Step 5: Save and exit.
+1. Save the updated settings.
 
 ### Ubiquiti UniFi Controller
 
 <StreamVideo id="510f09dad9812cd7ac009ebcab75068e"/>
 
-Step 1: Go to [http://unifi.ubnt.com](http://unifi.ubnt.com) and enter your email and password.
-
-Step 2: Click on the name of the network you are managing. Click Launch.
-
-Step 3: Click on the settings icon in the lower left-hand corner.
-
-Step 4: From the settings menu, choose Networks.
-
-Step 5; Click Edit by the name of the Network.
-
-Step 6: Scroll to where it says DHCP Name Server. If Auto is selected, select Manual instead.
-
-Step 7: In the boxes called DNS Server 1, 2, 3, etc. put:
-
-```txt
-1.1.1.3
-1.0.0.3
-2606:4700:4700::1113
-2606:4700:4700::1003
-```
-
-Step 8: Click Save.
+1. Go to [http://unifi.ubnt.com](http://unifi.ubnt.com).
+1. Enter your email and password.
+1. Click on the name of the network you are managing.
+1. Click **Launch**.
+1. Click on the **Settings** icon in the lower left-hand corner.
+1. From the Settings menu, choose **Networks**.
+1. Click **Edit** by the name of the Network.
+1. Scroll to where it says **DHCP Name Server**. If **Auto** is selected, select **Manual** instead.
+1. In the boxes called DNS Server 1, 2, 3, etc. put:
+
+  ```txt
+  1.1.1.3
+  1.0.0.3
+  2606:4700:4700::1113
+  2606:4700:4700::1003
+  ```
+
+1. Click **Save**.
 
 ### Google Wi-Fi
 
-Step 1: Open the Google Wifi app on your phone.
-
-Step 2: Click the settings tab, then click on Network & general
+1. Open the Google Wifi app on your phone.
+1. Click **Settings** > **Network & general**.
+1. Click **Advanced networking** > **DNS**.
+1. Remove any IP addresses that may be already listed and in their place enter:
 
-Step 3: Click on Advanced networking then click on DNS
+  ```txt
+  1.1.1.3
+  1.0.0.3
+  2606:4700:4700::1113
+  2606:4700:4700::1003
+  ```
 
-Step 4: Remove any IP addresses that may be already listed and in their place enter:
-
-```txt
-1.1.1.3
-1.0.0.3
-2606:4700:4700::1113
-2606:4700:4700::1003
-```
-
-Step 5: Click Save.
+1. Click **Save**.
 
 ### Asus Router
 
-Step 1: Go to https://192.168.1.1/
-
-![Asus Router](../../static/asus.png)
+1. Go to https://192.168.1.1/.
 
-Step 2: Under Advanced Settings, click on WAN
+  ![Asus Router](../../static/asus.png)
 
-Step 3: In the Internet Connection tab, under WAN DNS Setting, in DNS servers, add:
+1. Under **Advanced Settings**, click on **WAN**.
+1. In **Internet Connection tab** > **WAN DNS Setting** > **DNS servers**, add:
 
-```txt
-1.1.1.3
-1.0.0.3
-2606:4700:4700::1113
-2606:4700:4700::1003
-```
+  ```txt
+  1.1.1.3
+  1.0.0.3
+  2606:4700:4700::1113
+  2606:4700:4700::1003
+  ```
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/windows.md b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/windows.md
index 4923bf1ad5b..9e092a5c945 100644
--- a/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/windows.md
+++ b/products/1.1.1.1/src/content/1.1.1.1-for-families/setup-instructions/windows.md
@@ -1,64 +1,78 @@
 ---
-
 order: 3
+pcx-content: how-to
 ---
 
+import CaptivePortals from "../../_partials/_captive-portals.md"
+
 # Windows setup instructions
 
 ## Block malware
 
 ### IPv4
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 4.
-* Click Properties.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.2**
-    * **1.0.0.2**
-* Click OK.
-
-# IPv6
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 6.
-* Click Properties.
-* Click Use The Following DNS Server Addresses.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **2606:4700:4700::1112**
-    * **2606:4700:4700::1002**
-* Click OK.
+
+1. Open the **Start menu** and select **Control Panel**.
+2. Click **Network and Internet** > **Change Adapter Settings**.
+3. Right-click on the Wi-Fi network you are connected to.
+4. Select **Properties** > **Internet Protocol Version 4**.
+5. Click **Properties**.
+6. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.2
+    1.0.0.2
+    ```
+
+7. Click **OK**.
+
+### IPv6
+
+1. Open the **Start menu** and select **Control Panel**.
+2. Click **Network and Internet** > **Change Adapter Settings**.
+3. Right-click on the Wi-Fi network you are connected to.
+4. Click **Properties** > **Internet Protocol Version 6**.
+5. Select **Properties** > **Use The Following DNS Server Addresses**.
+6. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    2606:4700:4700::1112
+    2606:4700:4700::1002
+    ```
+
+7.  Click **OK**.
 
 ## Block malware and adult content
 
 ### IPv4
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 4.
-* Click Properties.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **1.1.1.3**
-    * **1.0.0.3**
-* Click OK.
-
-# IPv6
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 6.
-* Click Properties.
-* Click Use The Following DNS Server Addresses.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **2606:4700:4700::1113**
-    * **2606:4700:4700::1003**
-* Click OK.
+
+1. Open the **Start menu** and select **Control Panel**.
+1. Click **Network and Internet** > **Change Adapter Settings**.
+1. Right-click on the Wi-Fi network you are connected to.
+1. Click **Properties**.
+1. Select **Internet Protocol Version 4**.
+1. Click **Properties**.
+1. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    1.1.1.3
+    1.0.0.3
+    ```
+
+1. Click **OK**.
+
+### IPv6
+
+1. Open the **Start menu** and select **Control Panel**.
+1. Click **Network and Internet** > **Change Adapter Settings**.
+1. Right-click on the Wi-Fi network you are connected to.
+1. Select **Properties** > **Internet Protocol Version 6**.
+1. Click **Properties** > **Use The Following DNS Server Addresses**.
+1. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
+
+    ```txt
+    2606:4700:4700::1113
+    2606:4700:4700::1003
+    ```
+1.  Click **OK**.
+
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/_partials/_captive-portals.md b/products/1.1.1.1/src/content/_partials/_captive-portals.md
new file mode 100644
index 00000000000..cac37d7e3c8
--- /dev/null
+++ b/products/1.1.1.1/src/content/_partials/_captive-portals.md
@@ -0,0 +1,10 @@
+<Aside>
+
+**Note:** Setting up a static IP address to configure a DNS server may prevent you from connecting to some public Wi-Fi networks that use captive portals (these are the web pages some wireless networks employ to let users log in and use their services). 
+
+If you are experiencing connectivity issues related to captive portals:
+1. Remove the static IP addresses from the device.
+1. Connect to the Wi-Fi network.
+1. Once the connection has been established, re-add the static IP addresses.
+
+</Aside>
diff --git a/products/1.1.1.1/src/content/dns-over-https/cloudflared-proxy.md b/products/1.1.1.1/src/content/dns-over-https/cloudflared-proxy.md
index 1bf8cfea4f7..34d95aefc40 100644
--- a/products/1.1.1.1/src/content/dns-over-https/cloudflared-proxy.md
+++ b/products/1.1.1.1/src/content/dns-over-https/cloudflared-proxy.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content: how-to
 ---
 
 # Running a DNS over HTTPS client
@@ -10,33 +11,36 @@ There are several DNS over HTTPS (DoH) clients you can use to connect to 1.1.1.1
 
 We've open sourced a Golang DoH client you can use to get started. Follow this quick guide to start a DNS over HTTPS proxy to 1.1.1.1.
 
-Step 1: Download the cloudflared daemon. You can [find it here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation).
+1. Download the cloudflared daemon. You can [find it here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation).
+1. Verify that the `cloudflared` daemon is installed:
 
-Step 2: Verify that the `cloudflared` daemon is installed
-
-    cloudflared --version
+    ```sh
+    $ cloudflared --version
     cloudflared version 2020.11.11 (built 2020-11-25-1643 UTC)
+    ```
 
-Step 3: Start the DNS proxy on an address and port in your network. If you don't
-specify an address and port, it will start listening on `localhost:53`. DNS (53)
-is a privileged port, so for the initial demo we will use a different port:
+1. Start the DNS proxy on an address and port in your network. If you don't specify an address and port, it will start listening on `localhost:53`. DNS (53) is a privileged port, so for the initial demo we will use a different port:
 
-    cloudflared proxy-dns --port 5553
+    ```sh
+    $ cloudflared proxy-dns --port 5553
     INFO[2020-12-04T19:58:57Z] Adding DNS upstream - url: https://1.1.1.1/dns-query
     INFO[2020-12-04T19:58:57Z] Adding DNS upstream - url: https://1.0.0.1/dns-query
     INFO[2020-12-04T19:58:57Z] Starting metrics server on 127.0.0.1:44841/metrics
     INFO[2020-12-04T19:58:57Z] Starting DNS over HTTPS proxy server on: dns://localhost:5553
+    ```
 
-Step 4: You can verify that it's running using a `dig`, `kdig`, `host`, or any other DNS client.
+1. You can verify that it's running using a `dig`, `kdig`, `host`, or any other DNS client.
 
-    dig +short @127.0.0.1 -p5553 cloudflare.com AAAA
+    ```sh
+    $ dig +short @127.0.0.1 -p5553 cloudflare.com AAAA
     2606:4700::6810:85e5
     2606:4700::6810:84e5
+    ```
 
-Step 5: Set up cloudflared as a service so it starts on user login. On many
-Linux distributions, this can be done with:
+1. Set up `cloudflared` as a service so it starts on user login. On many Linux distributions, this can be done with:
 
-    sudo tee /etc/systemd/system/cloudflared-proxy-dns.service >/dev/null <<EOF
+    ```bash
+    $ sudo tee /etc/systemd/system/cloudflared-proxy-dns.service >/dev/null <<EOF
     [Unit]
     Description=DNS over HTTPS (DoH) proxy client
     Wants=network-online.target nss-lookup.target
@@ -51,38 +55,47 @@ Linux distributions, this can be done with:
     [Install]
     WantedBy=multi-user.target
     EOF
-    sudo systemctl enable --now cloudflared-proxy-dns
 
-Step 6: Change your system DNS servers to use 127.0.0.1. On Linux, one can
-modify `/etc/resolv.conf`:
+    $ sudo systemctl enable --now cloudflared-proxy-dns
+    ```
+
+1. Change your system DNS servers to use `127.0.0.1`. On Linux, you can modify `/etc/resolv.conf`:
 
-    sudo rm -f /etc/resolv.conf
-    echo nameserver 127.0.0.1 | sudo tee /etc/resolv.conf >/dev/null
+    ```sh
+    $ sudo rm -f /etc/resolv.conf
+    $ echo nameserver 127.0.0.1 | sudo tee /etc/resolv.conf >/dev/null
+    ```
 
-Step 7: Finally verify it locally with:
+1. Finally, verify it locally with:
 
-    dig +short @127.0.0.1 cloudflare.com AAAA
+    ```sh
+    $ dig +short @127.0.0.1 cloudflare.com AAAA
     2606:4700::6810:85e5
     2606:4700::6810:84e5
+    ```
 
 ## dnscrypt-proxy
 
 The [dnscrypt-proxy](https://dnscrypt.info) 2.0+ supports DoH out of the box. It supports both 1.1.1.1, and other services. It includes more advanced features, such as load balancing and local filtering.
 
-Step 1: Install the dnscrypt-proxy. You can [find the instructions here](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation).
-
-Step 2: Verify that the `dnscrypt-proxy` is installed, and at least version 2.0
+1. Install the dnscrypt-proxy. You can [find the instructions here](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation).
+1. Verify that the `dnscrypt-proxy` is installed, and at least version 2.0:
 
-    dnscrypt-proxy -version
+    ```sh
+    $ dnscrypt-proxy -version
     2.0.8
+    ```
 
-Step 3: Set up the configuration file using the [official instructions](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation#setting-up-dnscrypt-proxy), and add 'cloudflare' and 'cloudflare-ipv6' to the server list in `dnscrypt-proxy.toml`
+1. Set up the configuration file using the [official instructions](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation#setting-up-dnscrypt-proxy), and add `cloudflare` and `cloudflare-ipv6` to the server list in `dnscrypt-proxy.toml`:
 
+    ```toml
     server_names = ['cloudflare', 'cloudflare-ipv6']
+    ```
 
-Step 4: Make sure that nothing else is running on `localhost:53`, and check that everything works as expected
+1. Make sure that nothing else is running on `localhost:53`, and check that everything works as expected:
 
-    dnscrypt-proxy -resolve cloudflare-dns.com
+    ```sh
+    $ dnscrypt-proxy -resolve cloudflare-dns.com
     Resolving [cloudflare-dns.com]
 
     Domain exists:  yes, 3 name servers found
@@ -90,5 +103,6 @@ Step 4: Make sure that nothing else is running on `localhost:53`, and check that
     IP addresses:   2400:cb00:2048:1::6810:6f19, 2400:cb00:2048:1::6810:7019, 104.16.111.25, 104.16.112.25
     TXT records:    -
     Resolver IP:    172.68.140.217
+    ```
 
-Step 5: Register it as a system service using the [instructions here](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation#installing-as-a-system-service-windows-linux-macos)
+1. Register it as a system service according to the [dnscrypt-proxy installation instructions](https://github.com/jedisct1/dnscrypt-proxy/wiki/installation).
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/dns-over-https/index.md b/products/1.1.1.1/src/content/dns-over-https/index.md
index 2ab3cda976a..580fa468fd4 100644
--- a/products/1.1.1.1/src/content/dns-over-https/index.md
+++ b/products/1.1.1.1/src/content/dns-over-https/index.md
@@ -1,5 +1,6 @@
 ---
 order: 8
+pcx-content: concept
 ---
 
 # DNS over HTTPS
diff --git a/products/1.1.1.1/src/content/dns-over-https/json-format.md b/products/1.1.1.1/src/content/dns-over-https/json-format.md
index 2af029b699f..e1588fcf8b7 100644
--- a/products/1.1.1.1/src/content/dns-over-https/json-format.md
+++ b/products/1.1.1.1/src/content/dns-over-https/json-format.md
@@ -1,64 +1,77 @@
 ---
 order: 3
+pcx-content: reference
 ---
 
 # Using JSON
 
 Cloudflare's DNS over HTTPS endpoint also supports JSON format for querying DNS data. For lack of an agreed upon JSON schema for DNS over HTTPS in the IETF, Cloudflare has chosen to follow the same schema as Google's DNS over HTTPS resolver.
 
-JSON formatted queries are sent using a GET request. When making requests using GET, the DNS query is encoded into the URL. An additional URL parameter of 'ct' should indicate the MIME type (application/dns-json).
+JSON formatted queries are sent using a `GET` request. When making requests using `GET`, the DNS query is encoded into the URL. An additional URL parameter of `ct` should indicate the MIME type (`application/dns-json`).
 
 Supported Parameters:
 
+<TableWrap>
+
 Field              | Required?      | Description                                                                | Example
 -------------------|----------------|----------------------------------------------------------------------------|----------------
-name               | Required       | Query Name                                                                 | example.com
-type               | Required       | Query Type (either a numeric value or text)                                | AAAA
-do                 | No             | DO bit - set if client wants DNSSEC data (either boolean or numeric value) | true
-cd                 | No             | CD bit - set to disable validation (either boolean or numeric value)       | false
+name               | Required       | Query Name.                                                                | example.com
+type               | Required       | Query Type (either a numeric value or text).                               | AAAA
+do                 | No             | DO bit - set if client wants DNSSEC data (either boolean or numeric value).| true
+cd                 | No             | CD bit - set to disable validation (either boolean or numeric value).      | false
+
+</TableWrap>
 
-Example Request:
+Example request:
 
-    curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=example.com&type=AAAA'
+```sh
+$ curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=example.com&type=AAAA'
+```
 
-Example Response:
+Example response:
 
+```json
+{
+  "Status": 0,
+  "TC": false,
+  "RD": true,
+  "RA": true,
+  "AD": true,
+  "CD": false,
+  "Question": [
+    {
+      "name": "example.com.",
+      "type": 28
+    }
+  ],
+  "Answer": [
     {
-      "Status": 0,
-      "TC": false,
-      "RD": true,
-      "RA": true,
-      "AD": true,
-      "CD": false,
-      "Question": [
-        {
-          "name": "example.com.",
-          "type": 28
-        }
-      ],
-      "Answer": [
-        {
-          "name": "example.com.",
-          "type": 28,
-          "TTL": 1726,
-          "data": "2606:2800:220:1:248:1893:25c8:1946"
-        }
-      ]
+      "name": "example.com.",
+      "type": 28,
+      "TTL": 1726,
+      "data": "2606:2800:220:1:248:1893:25c8:1946"
     }
+  ]
+}
+```
+
+The following table has more information on each response field:
 
-Below the fields in the response are explained
+<TableWrap>
 
 Field          | Description
 ---------------|-----------------------------------
-Status         | The Response Code of the DNS Query. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
+Status         | The Response Code of the DNS Query. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6.
 TC             | If true, it means the truncated bit was set. This happens when the DNS answer is larger than a single UDP or TCP packet. TC will almost always be false with Cloudflare DNS over HTTPS because Cloudflare supports the maximum response size.
 RD             | If true, it means the Recursive Desired bit was set. This is always set to true for Cloudflare DNS over HTTPS.
 RA             | If true, it means the Recursion Available bit was set. This is always set to true for Cloudflare DNS over HTTPS.
 AD             | If true, it means that every record in the answer was verified with DNSSEC.
 CD             | If true, the client asked to disable DNSSEC validation. In this case, Cloudflare will still fetch the DNSSEC-related records, but it will not attempt to validate the records.
 Question: name | The record name requested.
-Question: type | The type of DNS record requested. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4
+Question: type | The type of DNS record requested. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4.
 Answer: name   | The record owner.
-Answer: type   | The type of DNS record. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4
+Answer: type   | The type of DNS record. These are defined here: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4.
 Answer: TTL    | The number of seconds the answer can be stored in cache before it is considered stale.
 Answer: data   | The value of the DNS record for the given name and type. The data will be in text for standardized record types and in hex for unknown types.
+
+</TableWrap>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/dns-over-https/request-structure.md b/products/1.1.1.1/src/content/dns-over-https/request-structure.md
index 24a11297e42..22175ab9e78 100644
--- a/products/1.1.1.1/src/content/dns-over-https/request-structure.md
+++ b/products/1.1.1.1/src/content/dns-over-https/request-structure.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content: reference
 ---
 
 # Making requests
@@ -16,11 +17,23 @@ See curl examples for [UDP wireformat](https://developers.cloudflare.com/1.1.1.1
 
 ## HTTP method
 
-Cloudflare's DOH endpoint supports POST and GET for UDP wireformat, and GET for JSON format.
+Cloudflare's DOH endpoint supports `POST` and `GET` for UDP wireformat, and `GET` for JSON format.
 
-When making requests using POST, the DNS query is included as the message body of the HTTP request, and the MIME type (application/dns-udpwireformat) is sent in the Content-Type request header. Cloudflare will use the message body of the HTTP request as sent by the client, so the message body should not be encoded.
+When making requests using `POST`, the DNS query is included as the message body of the HTTP request, and the MIME type (`application/dns-udpwireformat`) is sent in the `Content-Type` request header. Cloudflare will use the message body of the HTTP request as sent by the client, so the message body should not be encoded.
 
-When making requests using GET, the DNS query is encoded into the URL. An additional URL parameter of 'ct' should indicate the MIME type (see below).
+When making requests using `GET`, the DNS query is encoded into the URL. An additional URL parameter of `ct` should indicate the MIME type (see below).
+
+## Send multiple questions in a query
+
+Sending more than one question when making requests depends on the HTTP version used, as each DNS query maps to exactly one HTTP request. HTTP/2 and HTTP/3 have multiplexing and you can start multiple requests concurrently. HTTP/2 is, in fact, the minimum recommended version of HTTP for use with DNS over HTTPS (DoH). This is not specific to 1.1.1.1, but rather how DoH works. 
+
+You can learn more about how DoH works in RFC8484, more specifically [the HTTP layer requirements](https://datatracker.ietf.org/doc/html/rfc8484#section-5.2).
+
+The following example sends two questions in a query:
+
+```sh
+$ curl --http2 -H 'accept: application/dns-json' https://1.1.1.1/dns-query?name=cloudflare.com --next --http2 -H 'accept: application/dns-json' https://1.1.1.1/dns-query?name=example.com
+```
 
 ## Wireformat and JSON options
 
@@ -28,7 +41,7 @@ Both [UDP wireformat](https://developers.cloudflare.com/1.1.1.1/dns-over-https/w
 
 ## Valid MIME types
 
-If you use JSON format, set 'application/dns-json' URL parameter, and if you use DNS wire format, use 'application/dns-message' as either URL parameter of 'ct' or a Content-Type header for POST requests.
+If you use JSON format, set `application/dns-json` URL parameter, and if you use DNS wire format, use `application/dns-message` as either URL parameter of `ct` or a `Content-Type` header for `POST` requests.
 
 ## Authentication
 
diff --git a/products/1.1.1.1/src/content/dns-over-https/web-browser.md b/products/1.1.1.1/src/content/dns-over-https/web-browser.md
index 68e6dac05d0..f940a7b7ecc 100644
--- a/products/1.1.1.1/src/content/dns-over-https/web-browser.md
+++ b/products/1.1.1.1/src/content/dns-over-https/web-browser.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content: how-to
 ---
 
 # Configure your browser to use DNS over HTTPS
@@ -8,13 +9,13 @@ There are several browsers compatible with DNS over HTTPS (DoH) that you can use
 
 ## Mozilla Firefox
 
-1. Click the hamburger menu at the top-right corner of your browser window.
+1. Click the **hamburger menu** at the top-right corner of your browser window.
 1. Click **Preferences**.
 1. In the **General** menu, scroll down to access `Network Settings`.
-1. Click on the `Settings` button.
+1. Click on the **Settings** button.
 1. Click **Enable DNS over HTTPS**. By default, it resolves to Cloudflare DNS.
 
-## Google Chrome 
+## Google Chrome
 
 <Aside>
 
@@ -22,9 +23,9 @@ This setting may already be enabled on Chrome by default.
 
 </Aside>
 
-1. Click on the three-dot menu at in the top-right corner of your browser window.
+1. Click on the **three-dot menu** at in the top-right corner of your browser window.
 1. Click **Settings**.
-1. Navigate to **Privacy and security > Security**.
+1. Navigate to **Privacy and security** > **Security**.
 1. Enable the **Use secure DNS** switch.
 
 Your browser infers the DNS over HTTPS provider you want based on your system DNS. To benefit from Cloudflare DoH, make sure your system is [properly configured](https://1.1.1.1/dns/#setup-instructions).
@@ -38,9 +39,9 @@ Your browser infers the DNS over HTTPS provider you want based on your system DN
 
 ## Brave
 
-1. Click the hamburger menu at the top-right corner of your browser window.
+1. Click the **hamburger menu** at the top-right corner of your browser window.
 1. Navigate to **Settings**.
-1. Navigate to **Privacy and security > Security**.
+1. Navigate to **Privacy and security** > **Security**.
 1. Enable the **Use secure DNS**.
 1. Choose *Cloudflare (1.1.1.1)* as a service provider.
 
@@ -50,5 +51,5 @@ As of today, Safari does not support DNS over HTTPS.
 
 ## How to check if my browser is configured correctly?
 
-1. Visit [1.1.1.1 help page](https://1.1.1.1/help)
-2. Verify that `Using DNS over HTTPS (DoH)` is `Yes`
+1. Visit [1.1.1.1 help page](https://1.1.1.1/help).
+1. Verify that `Using DNS over HTTPS (DoH)` is `Yes`.
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/dns-over-https/wireformat.md b/products/1.1.1.1/src/content/dns-over-https/wireformat.md
index 8a138cb7cfa..5d919fa1d69 100644
--- a/products/1.1.1.1/src/content/dns-over-https/wireformat.md
+++ b/products/1.1.1.1/src/content/dns-over-https/wireformat.md
@@ -1,84 +1,93 @@
 ---
 order: 11
+pcx-content: how-to
 ---
 
 # Using DNS Wireformat
 
 Cloudflare respects DNS wireformat as is defined in RFC1035.
 
-To send queries using DNS wire format, set the header 'accept: application/dns-message', or 'content-type: application/dns-message' if using POST to signalize the media type of the query.
+To send queries using DNS wire format, set the header `accept: application/dns-message`, or `content-type: application/dns-message` if using `POST` to signalize the media type of the query.
 
-Queries using DNS wireformat can be sent using POST or GET.
+Queries using DNS wireformat can be sent using `POST` or `GET`.
 
 ## Using POST
 
-When making requests using POST, the DNS query is included as the message body of the HTTP request, and the MIME type (see below) is included in the Content-Type request header. Cloudflare will use the message body of the HTTP request as sent by the client, so the message body should not be encoded.
+When making requests using `POST`, the DNS query is included as the message body of the HTTP request, and the MIME type (see below) is included in the `Content-Type` request header. Cloudflare will use the message body of the HTTP request as sent by the client, so the message body should not be encoded.
 
 Example request:
 
 The same DNS query for www.example.com, using the POST method would be:
 
-    :method = POST
-    :scheme = https
-    :authority = cloudflare-dns.com
-    :path = /dns-query
-    accept = application/dns-message
-    content-type = application/dns-message
-    content-length = 33
-
-    <33 bytes represented by the following hex encoding>
-    00 00 01 00 00 01 00 00  00 00 00 00 03 77 77 77
-    07 65 78 61 6d 70 6c 65  03 63 6f 6d 00 00 01 00
-    01
+```txt
+:method = POST
+:scheme = https
+:authority = cloudflare-dns.com
+:path = /dns-query
+accept = application/dns-message
+content-type = application/dns-message
+content-length = 33
+
+<33 bytes represented by the following hex encoding>
+00 00 01 00 00 01 00 00  00 00 00 00 03 77 77 77
+07 65 78 61 6d 70 6c 65  03 63 6f 6d 00 00 01 00
+01
+```
 
 And would return the answer in wireformat:
 
-    :status = 200
-    content-type = application/dns-message
-    content-length = 64
-    cache-control = max-age=128
+```txt
+:status = 200
+content-type = application/dns-message
+content-length = 64
+cache-control = max-age=128
 
-    <64 bytes represented by the following hex encoding>
-    00 00 81 80 00 01 00 01  00 00 00 00 03 77 77 77
-    07 65 78 61 6d 70 6c 65  03 63 6f 6d 00 00 01 00
-    01 03 77 77 77 07 65 78  61 6d 70 6c 65 03 63 6f
-    6d 00 00 01 00 01 00 00  00 80 00 04 C0 00 02 01
+<64 bytes represented by the following hex encoding>
+00 00 81 80 00 01 00 01  00 00 00 00 03 77 77 77
+07 65 78 61 6d 70 6c 65  03 63 6f 6d 00 00 01 00
+01 03 77 77 77 07 65 78  61 6d 70 6c 65 03 63 6f
+6d 00 00 01 00 01 00 00  00 80 00 04 C0 00 02 01
+```
 
 To try using cURL you can do:
 
-    echo -n 'q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | base64 -D | curl -H 'content-type: application/dns-message' --data-binary @- https://cloudflare-dns.com/dns-query -o - | hexdump
+```sh
+$ echo -n 'q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | base64 -D | curl -H 'content-type: application/dns-message' --data-binary @- https://cloudflare-dns.com/dns-query -o - | hexdump
+```
 
 ## Using GET
 
-When making requests using GET, the DNS query is encoded into the URL. The 'accept' header can be used to indicate the MIME type (default: 'application/dns-message').
+When making requests using GET, the DNS query is encoded into the URL. The `accept` header can be used to indicate the MIME type (default: `application/dns-message`).
 
 Example request:
 
-    $ curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump
-    * Using HTTP2, server supports multi-use
-    * Connection state changed (HTTP/2 confirmed)
-    * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
-    * Using Stream ID: 1 (easy handle 0x7f968700a400)
-    GET /dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/2
-    Host: cloudflare-dns.com
-    User-Agent: curl/7.54.0
-    accept: application/dns-message
-
-    * Connection state changed (MAX_CONCURRENT_STREAMS updated)!
-    HTTP/2 200
-    date: Fri, 23 Mar 2018 05:14:02 GMT
-    content-type: application/dns-message
-    content-length: 49
-    cache-control: max-age=0
-    set-cookie: \__cfduid=dd1fb65f0185fadf50bbb6cd14ecbc5b01521782042; expires=Sat, 23-Mar-19 05:14:02 GMT; path=/; domain=.cloudflare.com; HttpOnly
-    server: cloudflare-nginx
-    cf-ray: 3ffe69838a418c4c-SFO-DOG
-
-    { [49 bytes data]
-    100    49  100    49    0     0    493      0 --:--:-- --:--:-- --:--:--   494
-    * Connection #0 to host cloudflare-dns.com left intact
-    0000000 ab cd 81 80 00 01 00 01 00 00 00 00 03 77 77 77
-    0000010 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 00 01 00
-    0000020 01 c0 0c 00 01 00 01 00 00 0a 8b 00 04 5d b8 d8
-    0000030 22
-    0000031
+```sh
+$ curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump
+* Using HTTP2, server supports multi-use
+* Connection state changed (HTTP/2 confirmed)
+* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
+* Using Stream ID: 1 (easy handle 0x7f968700a400)
+GET /dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/2
+Host: cloudflare-dns.com
+User-Agent: curl/7.54.0
+accept: application/dns-message
+
+* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
+HTTP/2 200
+date: Fri, 23 Mar 2018 05:14:02 GMT
+content-type: application/dns-message
+content-length: 49
+cache-control: max-age=0
+set-cookie: \__cfduid=dd1fb65f0185fadf50bbb6cd14ecbc5b01521782042; expires=Sat, 23-Mar-19 05:14:02 GMT; path=/; domain=.cloudflare.com; HttpOnly
+server: cloudflare-nginx
+cf-ray: 3ffe69838a418c4c-SFO-DOG
+
+{ [49 bytes data]
+100    49  100    49    0     0    493      0 --:--:-- --:--:-- --:--:--   494
+* Connection #0 to host cloudflare-dns.com left intact
+0000000 ab cd 81 80 00 01 00 01 00 00 00 00 03 77 77 77
+0000010 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 00 01 00
+0000020 01 c0 0c 00 01 00 01 00 00 0a 8b 00 04 5d b8 d8
+0000030 22
+0000031
+```
diff --git a/products/1.1.1.1/src/content/dns-over-tls/index.md b/products/1.1.1.1/src/content/dns-over-tls/index.md
index 15e875f6065..125ea77e289 100644
--- a/products/1.1.1.1/src/content/dns-over-tls/index.md
+++ b/products/1.1.1.1/src/content/dns-over-tls/index.md
@@ -1,5 +1,6 @@
 ---
 order: 9
+pcx-content: concept
 ---
 
 # DNS over TLS
@@ -8,48 +9,50 @@ By default, DNS is sent over a plaintext connection. DNS over TLS is one way to
 
 ## Configuration
 
-Cloudflare supports DNS over TLS on 1.1.1.1 and 1.0.0.1 on port 853. The certificate presented is for cloudflare-dns.com.
+Cloudflare supports DNS over TLS on `1.1.1.1` and `1.0.0.1` on port 853. The certificate presented is for cloudflare-dns.com.
 
 ## How it works
 
 A stub resolver (the DNS client on a device that talks to the DNS resolver) connects to the resolver over a TLS connection:
 
- * Before the connection the DNS stub resolver has stored a base64 encoded SHA256 hash of cloudflare-dns.com's TLS certificate (called SPKI)
- * DNS stub resolver establishes a TCP connection with cloudflare-dns.com:853
- * DNS stub resolver initiates a TLS handshake
- * In the TLS handshake, cloudflare-dns.com presents its TLS certificate.
- * Once the TLS connection is established, the DNS stub resolver can send DNS over an encrypted connection, preventing eavesdropping and tampering.
- * All DNS queries sent over the TLS connection must comply with specifications of [sending DNS over TCP](https://tools.ietf.org/html/rfc1035#section-4.2.2).
+1. Before the connection the DNS stub resolver has stored a base64 encoded SHA256 hash of cloudflare-dns.com's TLS certificate (called SPKI).
+1. DNS stub resolver establishes a TCP connection with `cloudflare-dns.com:853`.
+1. DNS stub resolver initiates a TLS handshake.
+1. In the TLS handshake, `cloudflare-dns.com` presents its TLS certificate.
+1. Once the TLS connection is established, the DNS stub resolver can send DNS over an encrypted connection, preventing eavesdropping and tampering.
+1. All DNS queries sent over the TLS connection must comply with specifications of [sending DNS over TCP](https://tools.ietf.org/html/rfc1035#section-4.2.2).
 
 ## Example
 
-    $ kdig -d @1.1.1.1 +tls-ca +tls-host=cloudflare-dns.com  example.com
-    ;; DEBUG: Querying for owner(example.com.), class(1), type(1), server(1.1.1.1), port(853), protocol(TCP)
-    ;; DEBUG: TLS, imported 170 system certificates
-    ;; DEBUG: TLS, received certificate hierarchy:
-    ;; DEBUG:  #1, C=US,ST=CA,L=San Francisco,O=Cloudflare\, Inc.,CN=\*.cloudflare-dns.com
-    ;; DEBUG:      SHA-256 PIN: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
-    ;; DEBUG:  #2, C=US,O=DigiCert Inc,CN=DigiCert ECC Secure Server CA
-    ;; DEBUG:      SHA-256 PIN: PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=
-    ;; DEBUG: TLS, skipping certificate PIN check
-    ;; DEBUG: TLS, The certificate is trusted.
-    ;; TLS session (TLS1.3)-(ECDHE-SECP256R1)-(ECDSA-SECP256R1-SHA256)-(AES-256-GC
-    ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 58548
-    ;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1
-
-    ;; EDNS PSEUDOSECTION:
-    ;; Version: 0; flags: ; UDP size: 1536 B; ext-rcode: NOERROR
-    ;; PADDING: 408 B
-
-    ;; QUESTION SECTION:
-    ;; example.com.        		IN	A
-
-    ;; ANSWER SECTION:
-    example.com.        	2347	IN	A	93.184.216.34
-
-    ;; Received 468 B
-    ;; Time 2018-03-31 15:20:57 PDT
-    ;; From 1.1.1.1@853(TCP) in 12.6 ms
+```sh
+$ kdig -d @1.1.1.1 +tls-ca +tls-host=cloudflare-dns.com  example.com
+;; DEBUG: Querying for owner(example.com.), class(1), type(1), server(1.1.1.1), port(853), protocol(TCP)
+;; DEBUG: TLS, imported 170 system certificates
+;; DEBUG: TLS, received certificate hierarchy:
+;; DEBUG:  #1, C=US,ST=CA,L=San Francisco,O=Cloudflare\, Inc.,CN=\*.cloudflare-dns.com
+;; DEBUG:      SHA-256 PIN: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
+;; DEBUG:  #2, C=US,O=DigiCert Inc,CN=DigiCert ECC Secure Server CA
+;; DEBUG:      SHA-256 PIN: PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=
+;; DEBUG: TLS, skipping certificate PIN check
+;; DEBUG: TLS, The certificate is trusted.
+;; TLS session (TLS1.3)-(ECDHE-SECP256R1)-(ECDSA-SECP256R1-SHA256)-(AES-256-GC
+;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 58548
+;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1
+
+;; EDNS PSEUDOSECTION:
+;; Version: 0; flags: ; UDP size: 1536 B; ext-rcode: NOERROR
+;; PADDING: 408 B
+
+;; QUESTION SECTION:
+;; example.com.        		IN	A
+
+;; ANSWER SECTION:
+example.com.        	2347	IN	A	93.184.216.34
+
+;; Received 468 B
+;; Time 2018-03-31 15:20:57 PDT
+;; From 1.1.1.1@853(TCP) in 12.6 ms
+```
 
 ## Supported TLS versions
 
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-in-google-sheets.md b/products/1.1.1.1/src/content/fun-stuff/dns-in-google-sheets.md
index b1afb644f1d..47ad90dbbc3 100644
--- a/products/1.1.1.1/src/content/fun-stuff/dns-in-google-sheets.md
+++ b/products/1.1.1.1/src/content/fun-stuff/dns-in-google-sheets.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content: tutorial
 ---
 
 # DNS in Google Sheets
@@ -100,4 +101,4 @@ Returns:
 
 `198.41.214.162, 198.41.215.162`
 
-![function](../static/google-sheet-result.png)
+![function](../static/google-sheet-result.png)
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-over-discord.md b/products/1.1.1.1/src/content/fun-stuff/dns-over-discord.md
index 9c39edbc1cc..60a08e4368f 100644
--- a/products/1.1.1.1/src/content/fun-stuff/dns-over-discord.md
+++ b/products/1.1.1.1/src/content/fun-stuff/dns-over-discord.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content: tutorial
 ---
 
 # DNS over Discord
@@ -8,19 +9,25 @@ Ever wanted to make DNS requests from the comfort of your Discord server? Well n
 
 To start using the DNS over Discord bot, invite it to your Discord server using this link: [https://cfl.re/3nM6VfQ](https://cfl.re/3nM6VfQ)
 
+
 ## dig command
 
-Once the bot is in your server, type `/dig` to begin using the bot's main command -- performing DNS lookups.
+Once the bot is in your server, type `/dig` to begin using the bot's main command — performing DNS lookups.
 This will provide a native interface within Discord that allows you to specify the domain to lookup, an optional DNS record type and an optional flag for a short result.
 
-Due to limitations in Discord, the `/dig` command can only offer 10 different DNS record types, and will default to 'A' records if none is specified.
+If only a domain is given for the command, the bot will default to looking for 'A' DNS records, and will return the full format result, not the short form.
 
 ![dig command](../static/dns-over-discord/dig-command.png)
 
-![dig command types](../static/dns-over-discord/dig-command-types.png)
+![dig domain: cloudflare.com](../static/dns-over-discord/dig-command-example-1.png)
+
+_`/dig domain: cloudflare.com`_
+
 
 ### Supported record types
 
+Discord has a limit of 25 options in slash commands, so DNS over Discord offers the 25 most common DNS record types to choose from:
+
 *   A
 *   AAAA
 *   CAA
@@ -31,69 +38,147 @@ Due to limitations in Discord, the `/dig` command can only offer 10 different DN
 *   SPF
 *   SRV
 *   TXT
+*   DNSKEY
+*   DS
+*   LOC
+*   URI
+*   HTTPS
+*   NAPTR
+*   PTR
+*   SMIMEA
+*   SOA
+*   SSHFP
+*   SVCB
+*   TLSA
+*   HINFO
+*   CDS
+*   CDNSKEY
 
-*For all DNS record types, use the `/multi-dig` command.*
+*To query other DNS record types, or multiple record types at once, use the `/multi-dig` command.*
 
-### Examples
+![dig command types](../static/dns-over-discord/dig-command-types.png)
 
-![dig domain: cloudflare.com](../static/dns-over-discord/dig-command-example-1.png)
 
-_`/dig domain: cloudflare.com`_
+### Short form response
+
+Much like the dig command itself, DNS over Discord has an optional flag in the dig command that allows the user to request that the response be in the short form.
+
+When this is requested, the name and TTL columns will be excluded, with just the data column returned without the table formatting, similar to the equivalent dig command response.
+
+![dig domain: cloudflare.com type: AAAA short: true](../static/dns-over-discord/dig-command-example-2.png)
+
+_`/dig domain: cloudflare.com type: AAAA short: true`_
+
+
+### Refreshing existing results
+
+As part of the response that the DNS over Discord bot returns for dig commands there is a button to refresh the results.
 
-![dig domain: cloudflare.com type: AAAA short: True](../static/dns-over-discord/dig-command-example-2.png)
+Any user can press this button, triggering the bot to re-request the DNS query in the message and update the results in the message.
+
+The refresh button is available on all responses to the dig command, including those that resulted in an error, such as an unknown domain or no records found.
+
+![Refreshing dig domain: cloudflare.com](../static/dns-over-discord/dig-command-refresh.gif)
+
+_`/dig domain: cloudflare.com`_
 
-_`/dig domain: cloudflare.com type: AAAA short: True`_
 
 ## multi-dig command
 
-Want to lookup multiple DNS record types at once, or record types not available in `/dig`?
+Want to lookup multiple DNS record types at once?
 The `/multi-dig` command allows you to specify any supported DNS record type, and multiple types separated by a space.
 
-When providing DNS record types for the `/multi-dig` command, Discord will not prompt you with options.
-Please provide a space-separated list of valid DNS record types to lookup, any invalid options will be silently dropped.
-'A' records will be used as the default if no valid types are given.
-
 ![multi-dig command](../static/dns-over-discord/multi-dig-command.png)
 
-![multi-dig command types](../static/dns-over-discord/multi-dig-command-types.png)
+![multi-dig domain: cloudflare.com types: A AAAA](../static/dns-over-discord/multi-dig-command-example-1.png)
+
+_`/multi-dig domain: cloudflare.com types: A AAAA`_
+
 
 ### Supported record types
 
+When providing DNS record types for the `/multi-dig` command, Discord will not prompt you with options.
+
+Please provide a space-separated list of valid DNS record types to lookup, any invalid options will be silently dropped.
+'A' records will be used as the default if no valid types are given.
+
+The following DNS record types are supported and considered valid by the bot:
+
 *   A
 *   AAAA
 *   CAA
 *   CERT
 *   CNAME
+*   MX
+*   NS
+*   SPF
+*   SRV
+*   TXT
 *   DNSKEY
 *   DS
 *   LOC
-*   MX
+*   URI
+*   HTTPS
 *   NAPTR
-*   NS
 *   PTR
 *   SMIMEA
-*   SPF
-*   SRV
+*   SOA
 *   SSHFP
+*   SVCB
 *   TLSA
-*   TXT
-*   URI
+*   HINFO
+*   CDS
+*   CDNSKEY
+*   AFSDB
+*   APL
+*   CSYNC
+*   DHCID
+*   DLV
+*   DNAME
+*   EUI48
+*   EUI64
+*   HIP
+*   IPSECKEY
+*   KEY
+*   KX
+*   NSEC
+*   NSEC3
+*   NSEC3PARAM
+*   OPENPGPKEY
+*   RP
+*   TA
+*   TKEY
+*   ZONEMD
 
 *Use '\*' (asterisk) in place of a record type to get DNS results for all supported types.*
 
-### Examples
+![multi-dig command types](../static/dns-over-discord/multi-dig-command-types.png)
 
-![multi-dig domain: cloudflare.com types: A AAAA](../static/dns-over-discord/multi-dig-command-example-1.png)
 
-_`/multi-dig domain: cloudflare.com types: A AAAA`_
+### Short form response
+
+Like the main dig command, the multi-dig command also supports the optional short flag after the types have been specified in the slash command.
 
-![multi-dig domain: cloudflare.com types: DNSKEY short: True](../static/dns-over-discord/multi-dig-command-example-2.png)
+![multi-dig domain: cloudflare.com types: CDS CDNSKEY short: true](../static/dns-over-discord/multi-dig-command-example-2.png)
+
+_`/multi-dig domain: cloudflare.com types: CDS CDNSKEY short: true`_
+
+
+### Refreshing existing results
+
+The multi-dig command also provides a refresh button below each set of DNS results requested (or after each block of 10 DNS record types if more than 10 were requested).
+
+As with the dig command, any user can press the refresh button to refresh the displayed DNS results, including for DNS queries that had previously failed.
+
+![Refreshing multi-dig domain: cloudflare.com types: A AAAA](../static/dns-over-discord/multi-dig-command-refresh.gif)
+
+_`/multi-dig domain: cloudflare.com types: A AAAA`_
 
-_`/multi-dig domain: cloudflare.com types: DNSKEY short: True`_
 
 ## whois command
 
-The `/whois` command allows you to perform an RDAP/WHOIS lookup right in Discord to find who is behind a given domain name, an IP address, or an ASN.
+Curious about who's behind a domain name, an IP address or even an ASN?
+The `/whois` command allows you to perform an RDAP/WHOIS lookup right in Discord for a given domain, IP or ASN.
 
 ![whois command](../static/dns-over-discord/whois-command.png)
 
@@ -160,4 +245,4 @@ _`/invite`_
 
 The DNS over Discord bot is deployed on [Cloudflare Workers](https://workers.cloudflare.com/).
 
-You can find the source code for the bot on GitHub, as well as information on getting started with contributing to the project, at [https://github.com/MattIPv4/DNS-over-Discord/](https://github.com/MattIPv4/DNS-over-Discord/).  
+You can find the source code for the bot on GitHub, as well as information on getting started with contributing to the project, at [https://github.com/MattIPv4/DNS-over-Discord/](https://github.com/MattIPv4/DNS-over-Discord/).
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-over-email.md b/products/1.1.1.1/src/content/fun-stuff/dns-over-email.md
index 6e4e6bd359f..95dc021cd9a 100644
--- a/products/1.1.1.1/src/content/fun-stuff/dns-over-email.md
+++ b/products/1.1.1.1/src/content/fun-stuff/dns-over-email.md
@@ -1,11 +1,10 @@
 ---
 order: 3
+pcx-content: tutorial
 ---
 
 # DNS over email
 
-Ah, the classic yet revolutionary DNS over email.
-
 To receive DNS responses over email, send an email to `lookup@resolver.email`. The DNS query goes in the body of the message.
 
 You can send a single domain (defaults to AAAA).
@@ -46,4 +45,4 @@ AAAA example.com
 
 Returns:
 
-![DNS-over-email](../static/dns-over-email.png)
+![DNS-over-email](../static/dns-over-email.png)
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-over-telegram.md b/products/1.1.1.1/src/content/fun-stuff/dns-over-telegram.md
index 5d6ed6f2b32..55296a5537a 100644
--- a/products/1.1.1.1/src/content/fun-stuff/dns-over-telegram.md
+++ b/products/1.1.1.1/src/content/fun-stuff/dns-over-telegram.md
@@ -1,45 +1,43 @@
 ---
 order: 4
+pcx-content: tutorial
 ---
 
 # DNS over Telegram
 
 To perform DNS over Telegram, you will need the Telegram app. For the unfamiliar, Telegram is an end-to-end encrypted messaging app. You can download it on [telegram.org](https://telegram.org/).
 
-First, you will need to add the 1.1.1.1 bot to your friends list in Telegram. Open the Telegram app, click on 'contacts' and search for `onedotonedotonedotonedotbot`.
+You will also need to add the 1.1.1.1 bot to your friends list in Telegram before using this functionality:
+1. Open the Telegram app.
+1. Click **Contacts**.
+1. Search for `onedotonedotonedotonedotbot`.
 
-![search](../static/search.png)
+    <div class="medium-img"><img alt="Search" src="../static/search.png"/></div>
 
-When the 1.1.1.1 bot appears in the search results, click on it.
+1. When the 1.1.1.1 bot appears in the search results, click on it.
+1. Then press **Start**.
 
-Then press `start`.
+    <div class="medium-img"><img alt="Search" src="../static/click-start.png"/></div>
 
-![search](../static/click-start.png)
+1. You can send a single domain name, which will default to returning the AAAA record. For example:
 
-You can send a single domain name, which will default to returning the AAAA record.
-
-Example:
-
-![search](../static/example-com.png)
+    <div class="medium-img"><img alt="Search" src="../static/example-com.png"/></div>
 
 Or you can send a record type followed by a domain name. The record types supported are:
 
-```txt
-A
-AAAA
-CAA
-CNAME
-DS
-DNSKEY
-MX
-NS
-NSEC
-NSEC3
-RRSIG
-SOA
-TXT
-```
+* A
+* AAAA
+* CAA
+* CNAME
+* DS
+*  DNSKEY
+*  MX
+*  NS
+*  NSEC
+*  NSEC3
+*  RRSIG
+*  SOA
+*  TXT
 
 Example:
-
-![search](../static/aaaa-example-com.png)
+<div class="medium-img"><img alt="Search" src="../static/aaaa-example-com.png"/></div>
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-over-tor.md b/products/1.1.1.1/src/content/fun-stuff/dns-over-tor.md
index 2d344efd1aa..b69f41cde43 100644
--- a/products/1.1.1.1/src/content/fun-stuff/dns-over-tor.md
+++ b/products/1.1.1.1/src/content/fun-stuff/dns-over-tor.md
@@ -1,84 +1,85 @@
 ---
 order: 5
+pcx-content: tutorial
 ---
 
 # DNS over Tor
 
-Follow this quick guide to start using the hidden resolver or read about it in
-[this blog post](https://blog.cloudflare.com/welcome-hidden-resolver/)
+Follow this quick guide to start using the hidden resolver or read about it in [this blog post](https://blog.cloudflare.com/welcome-hidden-resolver/)
 
 ## Setting up a Tor client
 
-The important difference between using all other modes of DNS and this mode is that packet
-routing no longer uses IP addresses, and therefore all connections must be routed through a
-Tor client. Before anything else, head to the
-[Tor Project](https://www.torproject.org/download/download.html.en) website to download and
-install a Tor client. If you use the Tor Browser, it will automatically start a SOCKS proxy at
-`127.0.0.1:9150`. If you use Tor from the command line, create a config file like below and run
-`tor -f tor.conf`:
+The important difference between using all other modes of DNS and this mode is that packet routing no longer uses IP addresses, and therefore all connections must be routed through a Tor client. Before anything else, head to the [Tor Project](https://www.torproject.org/download/download.html.en) website to download and install a Tor client. If you use the Tor Browser, it will automatically start a SOCKS proxy at `127.0.0.1:9150`. If you use Tor from the command line, create a config file like below and run `tor -f tor.conf`:
 
-	SOCKSPort 9150
+```txt
+SOCKSPort 9150
+```
 
-Also, if you use the Tor Browser, you can head to the resolver's address to see the usual
-1.1.1.1 page:
+Also, if you use the Tor Browser, you can head to the resolver's address to see the usual 1.1.1.1 page:
 
-	https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/
+```txt
+https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/
+```
 
-__Note:__ the HTTPS certificate indicator should say "Cloudflare, Inc. (US)."
+<Aside>
 
-__Protip:__ if you ever forget the dns4torblahblahblah.onion address, you can simply use cURL:
+**Note:** the HTTPS certificate indicator should say "Cloudflare, Inc. (US)."
 
-	curl -sI https://tor.cloudflare-dns.com | grep -i alt-svc
-	alt-svc: h2="dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443"; ma=315360000; persist=1
+</Aside>
+
+**Tip:** If you ever forget the `dns4torblahblahblah.onion` address, use cURL:
+
+```sh
+$ curl -sI https://tor.cloudflare-dns.com | grep -i alt-svc
+alt-svc: h2="dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443"; ma=315360000; persist=1
+```
 
 ## Setting up a local DNS proxy using socat
 
-Of course, not all DNS clients support connecting to the Tor client, so the easiest way to
-connect any DNS-speaking software to the hidden resolver is by forwarding ports locally, for
-instance using [`socat`](http://www.dest-unreach.org/socat/).
+Of course, not all DNS clients support connecting to the Tor client, so the easiest way to connect any DNS-speaking software to the hidden resolver is by forwarding ports locally, for instance using [`socat`](http://www.dest-unreach.org/socat/).
 
 ### DNS over TCP, TLS, and HTTPS
 
-The hidden resolver is set up to listen on TCP ports 53 and 853 for DNS over TCP and TLS. After
-setting up a Tor proxy, run the following `socat` command as a privileged user, replacing the
-port number appropriately:
+The hidden resolver is set up to listen on TCP ports 53 and 853 for DNS over TCP and TLS. After setting up a Tor proxy, run the following `socat` command as a privileged user, replacing the port number appropriately:
 
-	PORT=853; socat TCP4-LISTEN:${PORT},reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:${PORT},socksport=9150
+```sh
+$ PORT=853; socat TCP4-LISTEN:${PORT},reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:${PORT},socksport=9150
+```
 
-From here, you can follow the regular guide for [Setting Up 1.1.1.1](../../setting-up-1.1.1.1/),
-except always use `127.0.0.1` instead of 1.1.1.1. If you need to access the proxy from another
-device, simply replace `127.0.0.1` in `socat` commands with your local IP address.
+From here, you can follow the regular guide for [Setting up 1.1.1.1](../../setting-up-1.1.1.1/), except always use `127.0.0.1` instead of 1.1.1.1. If you need to access the proxy from another device, simply replace `127.0.0.1` in `socat` commands with your local IP address.
 
 ### DNS over UDP
 
-Note that the Tor network does not support UDP connections, which is why some hacking is needed.
-If your client only supports UDP connections, the solution is to encapsulate packets to port
-UDP:53 on localhost as TCP packets using the following `socat` command:
+Note that the Tor network does not support UDP connections, which is why some hacking is needed. If your client only supports UDP connections, the solution is to encapsulate packets to port `UDP:53` on localhost as TCP packets using the following `socat` command:
 
-	socat UDP4-LISTEN:53,reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:253,socksport=9150
+```sh
+$ socat UDP4-LISTEN:53,reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:253,socksport=9150
+```
 
 ### DNS over HTTPS
 
 As explained in the blog post, our favorite way of using the hidden resolver is using DoH.
 
-1. First, start with downloading `cloudflared` by following the regular guide for
-[Running a DNS over HTTPS Client](../../dns-over-https/cloudflared-proxy/).
-
-2. Start a Tor SOCKS proxy and use `socat` to forward port TCP:443 to localhost:
-
-		socat TCP4-LISTEN:443,reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443,socksport=9150
+1. First, start with downloading `cloudflared` by following the regular guide for [Running a DNS over HTTPS Client](../../dns-over-https/cloudflared-proxy/).
+1. Start a Tor SOCKS proxy and use `socat` to forward port TCP:443 to localhost:
 
-3. Instruct your machine to treat the .onion address as localhost:
+	```sh
+	$ socat TCP4-LISTEN:443,reuseaddr,fork SOCKS4A:127.0.0.1:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:443,socksport=9150
+	```
 
-		cat << EOF >> /etc/hosts
-		127.0.0.1 dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion
-		EOF
+1. Instruct your machine to treat the `.onion` address as localhost:
 
-4. Finally, start a local DNS over UDP daemon:
+	```bash
+	$ cat << EOF >> /etc/hosts
+	127.0.0.1 dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion
+	EOF
+	```
 
-		cloudflared proxy-dns --upstream "https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/dns-query"
-		INFO[0000] Adding DNS upstream                           url="https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/dns-query"
-		INFO[0000] Starting DNS over HTTPS proxy server          addr="dns://localhost:53"
-		INFO[0000] Starting metrics server                       addr="127.0.0.1:35659"
+1. Finally, start a local DNS over UDP daemon:
 
-5. Profit!
+	```sh
+	$ cloudflared proxy-dns --upstream "https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/dns-query"
+	INFO[0000] Adding DNS upstream                           url="https://dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion/dns-query"
+	INFO[0000] Starting DNS over HTTPS proxy server          addr="dns://localhost:53"
+	INFO[0000] Starting metrics server                       addr="127.0.0.1:35659"
+	```
diff --git a/products/1.1.1.1/src/content/fun-stuff/dns-over-twitter.md b/products/1.1.1.1/src/content/fun-stuff/dns-over-twitter.md
deleted file mode 100644
index c18090d7ca8..00000000000
--- a/products/1.1.1.1/src/content/fun-stuff/dns-over-twitter.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 6
----
-
-# DNS over Twitter
-
-Meet [@1111Resolver](https://twitter.com/1111Resolver), your DNS over Twitter client.
-
-To DNS over Twitter, tweet `@1111Resolver`, followed by a record type, followed by a domain name.
-
-Record types supported by @1111Resolver are `A` and `AAAA`.
-
-Example:
-
-![AAAA](../static/dns-twitter.png)
diff --git a/products/1.1.1.1/src/content/fun-stuff/index.md b/products/1.1.1.1/src/content/fun-stuff/index.md
index f30cda72107..887ae0855e9 100644
--- a/products/1.1.1.1/src/content/fun-stuff/index.md
+++ b/products/1.1.1.1/src/content/fun-stuff/index.md
@@ -1,11 +1,12 @@
 ---
 order: 9
+pcx-content: interim
 ---
 
 # Fun with DNS
 
-1.1.1.1's key innovation was bringing DNS to other transport protocols. You may have heard about [DNS over HTTPS](dns-over-https/) and [DNS over TLS](dns-over-tls/), but you may not have heard of the more breakthrough protocols such as [DNS over Twitter (DoT)](./dns-over-twitter/).
+Did you know there are other ways to use 1.1.1.1? You may have heard about [DNS over HTTPS](/dns-over-https) and [DNS over TLS](/dns-over-tls), but how about the less common [DNS over Discord (DoD)](/fun-stuff/dns-over-discord)?
 
-In the following sections you can explore the brand new scientific innovations of such modern DNS transit protocols.
+<br/>
 
-(AAAA! Who knew DNS could be SOA cool. Enjoy the NXT sections. TT(y)L.)
+<DirectoryListing path="/fun-stuff"/>
diff --git a/products/1.1.1.1/src/content/index.md b/products/1.1.1.1/src/content/index.md
index 6b296f657cf..73296fef1a3 100644
--- a/products/1.1.1.1/src/content/index.md
+++ b/products/1.1.1.1/src/content/index.md
@@ -1,24 +1,28 @@
 ---
-title: Welcome
 order: -2
 type: overview
+pcx-content: landing-page
 ---
 
-import h1gif from "./static/1111-fancycolor.gif"
-import IndexH1 from "./index-h1.js"
+# Overview
 
-# <IndexH1 gif={h1gif} />
+<br/>
+<div class="medium-img">
+
+![Cloudflare 1.1.1.1](static/1111-fancycolor.gif)
+
+</div>
 
 <ContentColumn>
 
-1.1.1.1 is a fast and private way to browse the internet. It is a DNS resolver - kind of like Google Maps for your computer, it translates places (like cloudflare.com) into addresses (like 2400:cb00:2048:1::c629:d7a2). 1.1.1.1 is deployed in 150+ cities worldwide, and has access to the addresses of 7M+ domain names on the same servers it runs on so [it’s the fastest resolver out there](https://www.dnsperf.com/#!dns-resolvers).
+1.1.1.1 is a fast and private way to browse the internet. It is a DNS resolver - kind of like Google Maps for your computer, it translates places (like cloudflare.com) into addresses (like `2400:cb00:2048:1::c629:d7a2`). 1.1.1.1 is deployed in 150+ cities worldwide, and has access to the addresses of 7M+ domain names on the same servers it runs on so [it’s the fastest resolver out there](https://www.dnsperf.com/#!dns-resolvers).
 
 The addresses of 1.1.1.1 are:
 
-- 1.1.1.1
-- 1.0.0.1
-- 2606:4700:4700::1111
-- 2606:4700:4700::1001
+- `1.1.1.1`
+- `1.0.0.1`
+- `2606:4700:4700::1111`
+- `2606:4700:4700::1001`
 
 Moreover, you can access 1.1.1.1 as a Tor hidden service at this address:
 
@@ -29,4 +33,4 @@ Moreover, you can access 1.1.1.1 as a Tor hidden service at this address:
   <Button type="secondary" href="/1.1.1.1/what-is-1.1.1.1">Learn more</Button>
 </ButtonGroup>
 
-</ContentColumn>
+</ContentColumn>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/nitty-gritty-details/index.md b/products/1.1.1.1/src/content/nitty-gritty-details/index.md
index d3979f6e450..8517cd8e8e1 100644
--- a/products/1.1.1.1/src/content/nitty-gritty-details/index.md
+++ b/products/1.1.1.1/src/content/nitty-gritty-details/index.md
@@ -1,12 +1,13 @@
 ---
 order: 8
+pcx-content: interim
 ---
 
 # The nitty gritty
 
 ## ANY
 
-Cloudflare [stopped supporting the ANY query](https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/) in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. 1.1.1.1 returns NOTIMPL when asked for qtype==ANY.
+Cloudflare [stopped supporting the ANY query](https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/) in 2015 as ANY queries are more often used to perpetuate large volumetric attacks against the DNS system than valid use. 1.1.1.1 returns `NOTIMPL` when asked for `qtype==ANY`.
 
 ## DNSSEC
 
@@ -18,8 +19,6 @@ Cloudflare [stopped supporting the ANY query](https://blog.cloudflare.com/deprec
 
 ## IPv6
 
-It’s not 1995.
-
 1.1.1.1 has full IPv6 support.
 
 ## Purge cache
diff --git a/products/1.1.1.1/src/content/privacy/firefox.md b/products/1.1.1.1/src/content/privacy/firefox.md
index a6a8c7a4923..966d0b40ac8 100644
--- a/products/1.1.1.1/src/content/privacy/firefox.md
+++ b/products/1.1.1.1/src/content/privacy/firefox.md
@@ -1,12 +1,13 @@
 ---
 order: 2
+pcx-content: concept
 ---
 
 # Cloudflare Resolver for Firefox
 
-## FREQUENTLY ASKED QUESTIONS ABOUT THE CLOUDFLARE RESOLVER FOR FIREFOX
+## Frequently asked questions about the Cloudflare resolver for Firefox
 
-WHAT IS THE CLOUDFLARE RESOLVER FOR FIREFOX?
+### What is the Cloudflare resolver for Firefox?
 
 Every time you type a web address, such as www.mozilla.org or www.firefox.com, into a web browser the web browser sends a query to a DNS resolver. If DNS is like the card catalog of the Internet, then a DNS resolver is like a helpful librarian that knows how to use the information from that catalog to track down the exact location of a website. Whenever a resolver receives your query it looks up the IP address associated with the web address that you entered and relays that information to your web browser. “DNS resolution” as this process is referred to, is a crucial component of your Internet experience because without it your web browser would be unable to communicate with the servers that host your favorite websites since communication requires knowing the IP addresses of those websites.
 
@@ -14,7 +15,7 @@ For most Internet users the DNS resolver that they use is either the one that co
 
 To counter such threats, Mozilla has partnered with Cloudflare to provide direct DNS resolution from within the Firefox browser using the Cloudflare Resolver for Firefox. What this means is that whenever you click on or type a web address in the Firefox browser your DNS lookup request will be sent over a secure channel to the Cloudflare Resolver for Firefox rather than to an unknown DNS resolver, significantly decreasing the odds of any unwanted spying or man in the middle attacks.
 
-WHAT INFORMATION DOES THE CLOUDFLARE RESOLVER FOR FIREFOX COLLECT?
+### What information does the Cloudflare resolver for Firefox collect?
 
 Any data Cloudflare handles as a result of its resolver for Firefox is as a data processor acting pursuant to Firefox’s data processing instructions. Therefore, the data Cloudflare collects and processes pursuant to its agreement with Firefox is not covered by the [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/). As part of its agreement with Firefox, Cloudflare has agreed to collect only a limited amount of data about the DNS requests that are sent to the Cloudflare Resolver for Firefox via the Firefox browser. Cloudflare will collect only the following information from Firefox users:
 
@@ -58,7 +59,7 @@ All of the above information will be stored briefly as part of Cloudflare’s te
 
 Information stored in Cloudflare’s permanent logs will be anonymized and may be held indefinitely by Cloudflare for its own internal research and development purposes.
 
-WHAT IS THE CLOUDFLARE PROMISE?
+### What is the Cloudflare promise?
 
 Cloudflare understands how important your data is to you which is why we promise to use the information that we collect from the Cloudflare Resolver for Firefox solely to improve the performance of Cloudflare Resolver for Firefox and to assist us in debugging efforts if an issue arises. In addition to limiting our collection and use of your data, Cloudflare also promises:
 
@@ -68,6 +69,6 @@ Cloudflare will not combine the data that it collects from such queries, with an
 
 Cloudflare will not sell, license, sublicense, or grant any rights to your data to any other person or entity without Mozilla’s explicit written permission.
 
-WHAT ABOUT GOVERNMENT REQUESTS FOR CONTENT BLOCKING?
+### What about government requests for content blocking?
 
 Cloudflare does not block or filter content through the Cloudflare Resolver for Firefox. As part of its agreement with Mozilla, Cloudflare is providing only direct DNS resolution. If Cloudflare were to receive written requests from law enforcement and government agencies to block access to domains or content through the Cloudflare resolver for Firefox, Cloudflare would, in consultation with Mozilla, exhaust our legal remedies before complying with such a request. We also commit to documenting any government request to block access in our semi-annual transparency report, unless legally prohibited from doing so.
diff --git a/products/1.1.1.1/src/content/privacy/index.md b/products/1.1.1.1/src/content/privacy/index.md
index 3694298080a..c1836205dba 100644
--- a/products/1.1.1.1/src/content/privacy/index.md
+++ b/products/1.1.1.1/src/content/privacy/index.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content: reference
 ---
 
 # Privacy
diff --git a/products/1.1.1.1/src/content/privacy/public-dns-resolver.md b/products/1.1.1.1/src/content/privacy/public-dns-resolver.md
index 950fc803cb0..206a5db20f7 100644
--- a/products/1.1.1.1/src/content/privacy/public-dns-resolver.md
+++ b/products/1.1.1.1/src/content/privacy/public-dns-resolver.md
@@ -1,12 +1,13 @@
 ---
 order: 1
+pcx-content: reference
 ---
 
 # 1.1.1.1 Public DNS Resolver
 
 *Last updated September 30, 2020*
 
-Cloudflare’s Commitment to Privacy: 1.1.1.1 Public DNS Resolver
+## Cloudflare’s commitment to privacy: 1.1.1.1 Public DNS Resolver
 
 The 1.1.1.1 public DNS resolver is governed by our [Privacy Policy](https://www.cloudflare.com/privacypolicy/). This document provides additional details on our collection, use, and disclosure of the information collected from the 1.1.1.1 public DNS resolver.
 
@@ -21,16 +22,16 @@ Given the current state of affairs, Cloudflare created a DNS resolver with your
 The 1.1.1.1 public DNS resolver was designed for privacy first, and Cloudflare commits to the following:
 
 1. Cloudflare will not sell or share Public Resolver users’ personal data with third parties or use personal data from the Public Resolver to target any user with advertisements.
-2. Cloudflare will only retain or use what is being asked, not information that will identify who is asking it. Except for randomly sampled network packets captured from at most .05% of all traffic sent to Cloudflare’s network infrastructure, Cloudflare will not retain the source IP from DNS queries to the Public Resolver in non-volatile storage. These randomly sampled packets are solely used for network troubleshooting and DoS mitigation purposes.
-3. A Public Resolver user’s IP address (referred to as the client or source IP address) will not be stored in non-volatile storage. Cloudflare will anonymize source IP addresses via IP truncation methods (last octet for IPv4 and last 80 bits for IPv6). Cloudflare will delete the truncated IP address within 25 hours.
-4. Cloudflare will retain only the limited transaction and debug log data (“Public Resolver Logs”) set forth below, for the legitimate operation of our Public Resolver and research purposes, and Cloudflare will delete the Public Resolver Logs within 25 hours.
-5. Cloudflare will not share the Public Resolver Logs with any third parties except for APNIC pursuant to a Research Cooperative Agreement. APNIC will only have limited access to query the anonymized data in the Public Resolver Logs and conduct research related to the operation of the DNS system.
+1. Cloudflare will only retain or use what is being asked, not information that will identify who is asking it. Except for randomly sampled network packets captured from at most .05% of all traffic sent to Cloudflare’s network infrastructure, Cloudflare will not retain the source IP from DNS queries to the Public Resolver in non-volatile storage. These randomly sampled packets are solely used for network troubleshooting and DoS mitigation purposes.
+1. A Public Resolver user’s IP address (referred to as the client or source IP address) will not be stored in non-volatile storage. Cloudflare will anonymize source IP addresses via IP truncation methods (last octet for IPv4 and last 80 bits for IPv6). Cloudflare will delete the truncated IP address within 25 hours.
+1. Cloudflare will retain only the limited transaction and debug log data (“Public Resolver Logs”) set forth below, for the legitimate operation of our Public Resolver and research purposes, and Cloudflare will delete the Public Resolver Logs within 25 hours.
+1. Cloudflare will not share the Public Resolver Logs with any third parties except for APNIC pursuant to a Research Cooperative Agreement. APNIC will only have limited access to query the anonymized data in the Public Resolver Logs and conduct research related to the operation of the DNS system.
 
 Frankly, we don’t want to know what any one person is doing on the Internet — it’s none of our business — and we’ve taken the technical steps to ensure we can’t.
 
-We wanted to put our money where our mouth was, so we retained one of the top four accounting firms to audit our practices and publish a public report confirming we're doing what we said we would. The report is available [here](https://www.cloudflare.com/compliance/).
+We wanted to put our money where our mouth was, so we retained one of the top four accounting firms to audit our practices and publish a public report confirming we're doing what we said we would. The report is available in the [Certifications and compliance resources](https://www.cloudflare.com/trust-hub/compliance-resources/) page.
 
-## LIMITED DATA SHARING WITH APNIC
+## Limited data sharing with APNIC
 
 Cloudflare has partnered with [APNIC Labs](https://labs.apnic.net/?p=1127), the regional Internet registry for the Asia-Pacific region to make the 1.1.1.1 IP address the home of the Cloudflare Public DNS Resolver. As part of its mission to ensure a global, open and secure Internet, APNIC conducts research about the functioning and governance of the Internet, which it makes available on its website, located at www.apnic.net.
 
@@ -40,7 +41,7 @@ APNIC Labs will use such data for non-profit operational research. As part of Cl
 
 Aside from APNIC, Cloudflare will not share the Public Resolver Logs with any third party.
 
-## DATA IN PUBLIC RESOLVER LOGS
+## Data in public resolver logs
 
 The Public Resolver Logs we store consist entirely of the following fields:
 
@@ -87,8 +88,8 @@ The following subrequest data is included in the Public Resolver Logs:
 * subrequest.queryName
 * subrequest.queryType
 * subrequest.responseCode
-* subreqest.responseCount
-* subreqeust.recordType
+* subrequest.responseCount
+* subrequest.recordType
 * subrequest.recordData
 * subrequest.error
 
@@ -96,7 +97,7 @@ Except for the limited aggregated data generated using the Public Resolver Logs
 
 Cloudflare will only store the following aggregated data:
 
-* Total number of queries with different protocol settings (e.g tcp/udp/dnssec) by Cloudflare PoP
+* Total number of queries with different protocol settings (for example, tcp/udp/dnssec) by Cloudflare PoP
 * Response code/time quantiles with different protocol settings by Cloudflare PoP
 * Total Number of Requests Processed by Cloudflare PoP
 * Aggregate List of All Domain Names Requested, aggregate number of requests and timestamp of first time requested
@@ -106,7 +107,7 @@ Cloudflare will only store the following aggregated data:
 
 Cloudflare may store the aggregated data described above indefinitely in order to power Cloudflare Radar and assist Cloudflare in improving Cloudflare services, such as, enhancing the overall performance of the Cloudflare Resolver and identifying security threats.
 
-## WHAT ABOUT REQUESTS FOR CONTENT BLOCKING?
+## What about requests for content blocking?
 
 Cloudflare does not block or filter any content through the 1.1.1.1 Public DNS Resolver, which is designed for direct, fast DNS resolution, not for blocking or filtering content. Cloudflare does block and filter malware and adult content through 1.1.1.1 for Families, which is designed to help individuals protect their home networks.
 
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/android.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/android.md
index 6ab499e1ec2..6d97501bcb7 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/android.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/android.md
@@ -1,24 +1,27 @@
 ---
 order: 1
+pcx-content: tutorial
 ---
 
+import CaptivePortals from "../_partials/_captive-portals.md"
+
 # Android
 
-## Android 9 Pie
+## Android 9 Pie or later
 
-Android Pie supports Private DNS, which uses DNS over TLS to secure your queries.
-If your device runs Android 9, this is the recommended method to set up 1.1.1.1 because unlike previous versions
-of Android, it does not need to be configured for each new WiFi network.
+Android Pie or later supports Private DNS, which uses DNS over TLS to secure your queries.
+If your device runs Android version 9 or later, this is the recommended method to set up 1.1.1.1 because unlike previous versions
+of Android, it does not need to be configured for each new Wi-Fi network.
 
 Follow these steps to configure your device to use 1.1.1.1.
 
-Step 1: Go to Settings → Network & internet → Advanced → Private DNS.
+1. Go to **Settings** > **Network & internet** > **Advanced** > **Private DNS**.
 
-Step 2: Select the Private DNS provider hostname option.
+1. Select the **Private DNS** provider hostname option.
 
-Step 3: Enter `one.one.one.one` or `1dot1dot1dot1.cloudflare-dns.com` and hit Save.
+1. Enter `one.one.one.one` or `1dot1dot1dot1.cloudflare-dns.com` and hit **Save**.
 
-Step 4: Visit [1.1.1.1/help](https://1.1.1.1/help) to verify DNS over TLS is enabled.
+1. Visit [1.1.1.1/help](https://1.1.1.1/help) to verify DNS over TLS is enabled.
 
 ## Previous versions
 
@@ -26,25 +29,27 @@ Follow this quick guide to start using 1.1.1.1 on your Android.
 
 <StreamVideo id="62dceb0d5905f0c98a895d21409d6247"/>
 
-Step 1: Open up Settings.
+1. Open **Settings**.
+
+1. Click on **Wi-Fi**.
 
-Step 2: Click on Wi-Fi.
+1. Press down and hold on the name of the network you are currently connected to.
 
-Step 3: Press down and hold on the name of the network you are currently connected to.
+1. Click **Modify Network**.
 
-Step 4: Click Modify Network.
+1. Click the check box **Show Advanced Options**.
 
-Step 5: Click the check box called Show Advanced Options.
+1. Change the IP Settings to **Static**.
 
-Step 6: Change the IP Settings to the option called Static.
+1. Remove any IP addresses that may be already listed and in their place add:
 
-Step 7: Remove any IP addresses that may be already listed and in their place add:
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
+1. Click **Save**. You may need to disconnect from the Wi-Fi and reconnect for the changes to take place.
 
-Step 8: Click Save. You may need to disconnect from the Wi-Fi and reconnect for the changes to take place.
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/azure.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/azure.md
index 47db9bf40d9..b1b27e353c5 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/azure.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/azure.md
@@ -1,22 +1,23 @@
 ---
 order: 2
+pcx-content: tutorial
 ---
 
 # Azure
 
 Follow this quick guide to start using 1.1.1.1 on Microsoft  Azure.
 
-Step 1: Log into your Azure portal.
+1. Log into your Azure portal.
 
-Step 2: From the Azure portal side menu, select **Virtual Networks**.
+1. From the Azure portal side menu, select **Virtual Networks**.
 
-Step 3: Navigate to the virtual network associated with your virtual machine (VM).
+1. Navigate to the virtual network associated with your virtual machine (VM).
 
-Step 4: Select **DNS Servers**, then **Custom**, and add two entries:
+1. Select **DNS Servers** > **Custom**, and add two entries:
 
-```txt
-1.1.1.1
-1.0.0.1
-```
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    ```
 
-Step 5: Click **Save**.
+1. Click **Save**.
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/gaming.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/gaming.md
index d93bac0b9be..2830dc87c0d 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/gaming.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/gaming.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content: tutorial
 ---
 
 # Gaming consoles
@@ -10,85 +11,62 @@ Follow the instructions below to setup 1.1.1.1 on your gaming consoles.
 
 ## PS4
 
-Step 1: Go to Settings.
-
-Step 2: Go to Network.
-
-Step 3: Go to Set Up Internet Connection
-
-Step 4: Select Wifi or LAN depending on what you use.
-
-Step 5: Select Custom.
-
-Step 6: Set IP Address Settings to Automatic.
-
-Step 7: Set DHCP Host Name to Do Not Specify
-
-Step 8: Set DNS Settings to Manual
-
-Step 9: Set Primary DNS to: `1.1.1.1`
-
-Step 10: Set Secondary DNS to: `1.0.0.1`
-
-Step 11: If you are able to add more DNS servers, you can add the IPv6 addresses as well:
-
-```txt
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 12: Set MTU Settings to Automatic
-
-Step 13: Set Proxy Server to Do Not Use
+1. Go to **Settings**.
+1. Go to **Network**.
+1. Go to **Set Up Internet Connection**.
+1. Select **Wi-Fi** or **LAN** depending on what you use.
+1. Select **Custom**.
+1. Set **IP Address Settings** to **Automatic**.
+1. Set **DHCP Host Name** to **Do Not Specify**.
+1.  Set **DNS Settings** to **Manual**.
+1.  Set **Primary DNS** to: `1.1.1.1`.
+1. Set **Secondary DNS** to: `1.0.0.1`.
+1. If you are able to add more DNS servers, you can add the IPv6 addresses as well:
+
+    ```txt
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
+
+1. Set **MTU Settings** to **Automatic**.
+1. Set **Proxy Server** to **Do Not Use**.
 
 ## Xbox One
 
-Step 1: Open the Network screen by pressing the Xbox button (looks like the Xbox logo) and then selecting Settings > Network > Network Settings.
-
-Step 2: Click Advanced Settings
-
-Step 3: Click DNS Settings
+1. Open the Network screen by pressing the Xbox button (looks like the Xbox logo).
+1.  Select **Settings** > **Network** > **Network Settings**.
+1. Click **Advanced Settings**.
+1. Click **DNS Settings**.
+1. Choose **Manual**.
+1. Set **Primary DNS** to: `1.1.1.1`.
+1. Set **Secondary DNS** to: `1.0.0.1`.
+1. If you are able to add more DNS servers, you can add the IPv6 addresses as well:
 
-Step 4: Choose Manual
+    ```txt
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 5: Set Primary DNS to: `1.1.1.1`
-
-Step 6: Set Secondary DNS to: `1.0.0.1`
-
-Step 7: If you are able to add more DNS servers, you can add the IPv6 addresses as well:
-
-```txt
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 8: When you are done, you will be shown a confirmation screen. Press the B button to save.
+1. When you are done, you will be shown a confirmation screen. Press the **B button** to save.
 
 ## Nintendo
 
 The following instructions work on New Nintendo 3DS, New Nintendo 3DS XL, New Nintendo 2DS XL, Nintendo 3DS, Nintendo 3DS XL, and Nintendo 2DS.
 
-Step 1: Go to the home menu and choose System Settings (the wrench icon)
-
-Step 2: Select Internet Settings > Connection Settings
-
-Step 3: Select your internet connection and then select Change Settings
-
-Step 4: Select Change DNS
-
-Step 5: Set Auto-Obtain DNS to No.
-
-Step 6: Click Detailed Setup
-
-Step 7: Set Primary DNS to: `1.1.1.1`
-
-Step 8: Set Secondary DNS to: `1.0.0.1`
-
-Step 9: If you are able to add more DNS servers, you can add the IPv6 addresses as well:
-
-```txt
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 10: Click Save then OK
+1. Go to the home menu and choose **System Settings** (the wrench icon).
+1. Select **Internet Settings** > **Connection Settings**.
+1. Select your Internet connection and then select **Change Settings**.
+1. Select **Change DNS**.
+1. Set **Auto-Obtain DNS** to **No**.
+1. Click **Detailed Setup**.
+1. Set **Primary DNS** to: `1.1.1.1`.
+1. Set **Secondary DNS** to: `1.0.0.1`.
+1. If you are able to add more DNS servers, you can add the IPv6 addresses as well:
+
+    ```txt
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
+
+1. Click **Save**.
+1. Click **OK**.
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/index.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/index.md
index c4df5a6af6a..d9269c8aecb 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/index.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/index.md
@@ -1,5 +1,6 @@
 ---
 order: -1
+pcx-content: navigation
 ---
 
 # Setting up 1.1.1.1
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/iphone.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/iphone.md
index 2bae8064a17..c17ac98d289 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/iphone.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/iphone.md
@@ -1,48 +1,56 @@
 ---
 order: 5
+pcx-content: tutorial
 ---
 
+import CaptivePortals from "../_partials/_captive-portals.md"
+
 # iPhone
 
 Follow this quick guide to start using 1.1.1.1 on your iPhone.
 
 <StreamVideo id="ddf07732bc76fc854d4b1879eea2c517"/>
 
-Step 1: Go to Settings.
-
-Step 2: Click on Wi-Fi.
-
-Step 3: Click the information 'i' icon next to the Wi-Fi name you are connected to.
+1. Go to **Settings**.
+1. Click on **Wi-Fi**.
+1. Click the information **'i'** icon next to the Wi-Fi name you are connected to.
+1. Scroll down until you see the section called **Configure DNS**.
+1. Change the configuration from **Automatic** to **Manual**.
+1. Click **Add Server**.
+1. Remove any IP addresses that may be already listed and in their place add:
 
-Step 4: Scroll down until you see the section called Configure DNS
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 5: Change the configuration from Automatic to Manual.
+1. Click **Save**.
 
-Step 6: Click Add Server.
+## 1.1.1.1 iOS app
 
-Step 7: Remove any IP addresses that may be already listed and in their place add:
+If you want to configure 1.1.1.1 automatically, you can [download Cloudflare's 1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627) free iOS app.
 
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
+1.1.1.1: Faster Internet automatically configures your phone to use 1.1.1.1 on any network you connect to. The app also allows you to enable encryption for DNS queries to the 1.1.1.1 DNS resolver or enable [WARP mode](https://developers.cloudflare.com/warp-client/), which gives you all the protection from 1.1.1.1 while additionally keeping all your HTTP traffic private and secure.
 
-Step 8: Click Save.
+You can select between these options in 1.1.1.1: Faster Internet's settings. By default, 1.1.1.1:Faster Internet's settings are configured to WARP mode.
 
-## Using DNS Override iOS App
+To set up 1.1.1.1: Faster Internet:
 
-You can also use a handy iOS app called DNS Override (paid app, costs $1.99) that automatically configures 1.1.1.1 for you on any network you connect to. To use it:
+1. Download [1.1.1.1: Faster Internet from the app store](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627).
+1. Launch 1.1.1.1: Faster Internet and accept the Terms of Service.
+1. Install the VPN profile that allows your phone to connect securely to 1.1.1.1.
 
-<StreamVideo id="da4eefaa9315767842737eb793c9b63d"/>
+You are now using 1.1.1.1 for your DNS queries. If you want to add an extra layer of security and encrypt all of your traffic with HTTPS, toggle the **WARP** button to **Connected**.
 
-Step 1: [Download DNS Override from the app store](https://itunes.apple.com/us/app/dns-override/id1060830093?mt=8).
+Alternatively, you may want to only encrypt your DNS queries and leave the remaining traffic unencrypted. If this is the case: 
 
-Step 2: Launch the DNS Override app.
+1. Open 1.1.1.1: Faster Internet.
+1. Tap the menu button.
+1. You will see two options: 1.1.1.1 and WARP. Select **1.1.1.1** > **Done**.
 
-Step 3: Click 1.1.1.1 at the top of the app.
+You are now using encryption only for your DNS queries.
 
-Step 4: Turn on the DNS Override toggle
 
-Step 5: DNS Override may ask you to install their VPN profile so that they can automatically update DNS settings.
+<CaptivePortals/>
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/linux.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/linux.md
index 3783f03fbb9..dd58228da49 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/linux.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/linux.md
@@ -1,62 +1,66 @@
 ---
 order: 6
+pcx-content: tutorial
 ---
 
+import CaptivePortals from "../_partials/_captive-portals.md"
+
 # Linux
 
 Follow this quick guide to start using 1.1.1.1 on your Linux device.
 
 ## Ubuntu
 
-Step 1: Click System > Preferences > Network Connections.
-
-Step 2: Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-
-Step 3: Click Edit then click IPv4.
+1. Click **System** > **Preferences** > **Network Connections**.
+1. Click on the **Wireless tab**, then choose the Wi-Fi network you are currently connected to.
+1. Click **Edit** > **IPv4**.
+1. Change the DNS servers listed to:
 
-Step 4: Change the DNS servers listed to:
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    ```
 
-```txt
-1.1.1.1
-1.0.0.1
-```
+1. Click **Apply**.
+1. Then, go to **IPv6**.
+1. Add the DNS servers:
 
-Step 5: Click Apply
+    ```txt
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 6: Then go to IPv6.
+1. Click **Apply**.
 
-Step 7: Add the DNS servers:
-
-```txt
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
+## Debian
 
-Step 8: Click Apply.
+   1. In the command line, type:
 
-## Debian
+       ```sh
+       $ sudo vim /etc/resolv.conf
+       ```
 
-Step 1: In the command line, type:
+   1. Press the <kbd>i</kbd> key on your keyboard to edit the document.
+   1. Replace the `nameserver` lines with:
 
-```sh
-$ sudo vim /etc/resolv.conf
-```
+   For IPv4:
 
-Step 2: Replace the nameserver lines with:
-(Since you are using vim press the <kbd>i</kbd> key on your keyboard to edit the document)
+    ```txt
+    nameserver 1.0.0.1
+    nameserver 1.1.1.1
+    ```
 
-For IPv4:
+   For IPv6:
 
-```txt
-nameserver 1.0.0.1
-nameserver 1.1.1.1
-```
+    ```txt
+    nameserver 2606:4700:4700::1111
+    nameserver 2606:4700:4700::1001
+    ```
 
-For IPv6:
+   1. Press the <kbd>ESC</kbd> key on your keyboard to save and exit vim. Then after lifting the key, type:
 
-```txt
-nameserver 2606:4700:4700::1111
-nameserver 2606:4700:4700::1001
-```
+   ```
+   :wq
+   ```
 
-Step 3: Save and exit vim by pressing the <kbd>ESC</kbd> key on your keyboard. Then after lifting the key type `:wq`.
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/mac.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/mac.md
index 6d83da76eb5..0a6ed19631e 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/mac.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/mac.md
@@ -1,28 +1,29 @@
 ---
 order: 7
+pcx-content: tutorial
 ---
 
+import CaptivePortals from "../_partials/_captive-portals.md"
+
 # macOS
 
 Follow this quick guide to start using 1.1.1.1 on your Mac.
 
 <StreamVideo id="b95943849d53350130ba22d039fa6faf"/>
 
-Step 1: Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-
-Step 2: Click on the icon called Network.
-
-Step 3: Click Advanced.
-
-Step 4: Select the DNS tab. Remove any IP addresses that may be already listed and in their place add:
+1. Go to **System Preferences**. You can find it by pressing <kbd>Command</kbd> + <kbd>Space</kbd> on your keyboard and typing `System Preferences`.
+1. Click on the **Network** icon.
+1. Click **Advanced**.
+1. Select the **DNS** tab. Remove any IP addresses that may be already listed and in their place add:
 
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 5: Click OK.
+1. Click **OK**.
+1. Click **Apply**.
 
-Step 6: Click Apply.
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/router.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/router.md
index cb1db49610a..b90ff806a2e 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/router.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/router.md
@@ -1,32 +1,30 @@
 ---
 order: 8
+pcx-content: tutorial
 ---
 
 # Router
 
 Follow this quick guide to start using 1.1.1.1 on your router.
+1. Go to the **IP address** used to access your router's admin console in your browser.
 
-Step 1: Go to the IP address used to access your router's admin console in your browser.
+   - Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
+   - Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
+   - D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
+   - Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
 
-- Linksys and Asus routers typically use [http://192.168.1.1](http://192.168.1.1)
-- Netgear routers typically use [http://192.168.0.1](http://192.168.0.1) or [http://192.168.1.1](http://192.168.1.1)
-- D-Link routers typically use [http://192.168.0.1](http://192.168.0.1)
-- Ubiquiti routers typically use [http://unifi.ubnt.com](http://unifi.ubnt.com)
+1. Enter the router password.
+1. Find the place in the admin console where **DNS settings** are set.
+1. Replace the existing addresses with:
 
-Step 2: Enter the router password.
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 3: Find the place in the admin console where DNS settings are set.
-
-Step 4: Replace the existing addresses with:
-
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 5: Save and exit.
+1. Save the updated settings.
 
 ## Using DNS-Over-TLS on OpenWRT
 
@@ -36,65 +34,56 @@ It is possible to encrypt DNS traffic out from your router using DNS-over-TLS if
 
 <StreamVideo id="510f09dad9812cd7ac009ebcab75068e"/>
 
-Step 1: Go to [http://unifi.ubnt.com](http://unifi.ubnt.com) and enter your email and password.
-
-Step 2: Click on the name of the network you are managing. Click Launch.
-
-Step 3: Click on the settings icon in the lower left-hand corner.
-
-Step 4: From the settings menu, choose Networks.
-
-Step 5; Click Edit by the name of the Network.
+1. Go to [http://unifi.ubnt.com](http://unifi.ubnt.com) and enter your **email** and **password**.
+1. Click on the name of the network you are managing.
+1. Click **Launch**.
+1. Click on the **settings** icon in the lower left-hand corner.
+1. From the settings menu, choose **Networks**.
+1. Click **Edit** by the name of the Network.
+1. Scroll to where it says **DHCP Name Server**. If Auto is selected, select **Manual** instead.
+1. In the boxes called DNS Server 1, 2, 3, etc. put:
 
-Step 6: Scroll to where it says DHCP Name Server. If Auto is selected, select Manual instead.
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 7: In the boxes called DNS Server 1, 2, 3, etc. put:
-
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 8: Click Save.
+1. Click **Save**.
 
 ## Google Wi-Fi
 
-Step 1: Open the Google Wifi app on your phone.
-
-Step 2: Click the settings tab, then click on Network & general
+1. Open the Google Wifi app on your phone.
+1. Click **Settings** > **Network & general**.
+1. Click on **Advanced networking** > **DNS**.
+1. Remove any IP addresses that may be already listed and in their place enter:
 
-Step 3: Click on Advanced networking then click on DNS
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
-Step 4: Remove any IP addresses that may be already listed and in their place enter:
-
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 5: Click Save.
+1. Click **Save**.
 
 ## Asus Router
 
-Step 1: Go to https://192.168.1.1/
-
-![Asus Router](../static/asus.png)
+1. Go to https://192.168.1.1/
 
-Step 2: Under Advanced Settings, click on WAN
+    ![Asus Router](../static/asus.png)
 
-Step 3: In the Internet Connection tab, under WAN DNS Setting, in DNS servers, add:
+1. Under **Advanced Settings**, click on **WAN**.
+1. In the **Internet Connection** > **WAN DNS Setting** > **DNS servers**, add:
 
-```txt
-1.1.1.1
-1.0.0.1
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
 
 ## FRITZ!Box
 
-Starting with [FRITZ!OS 7.20](https://en.avm.de/press/press-releases/2020/07/fritzos-720-with-even-more-performance-convenience-and-security-more-than-100-new-features-and-updates/), DNS over TLS is supported, see [Configuring different DNS servers in the FRITZ!Box](https://en.avm.de/service/fritzbox/fritzbox-7590/knowledge-base/publication/show/165_Configuring-different-DNS-servers-in-the-FRITZ-Box/)
+Starting with [FRITZ!OS 7.20](https://en.avm.de/press/press-releases/2020/07/fritzos-720-more-performance-convenience-security/), DNS over TLS is supported, see [Configuring different DNS servers in the FRITZ!Box](https://en.avm.de/service/knowledge-base/dok/FRITZ-Box-7590/165_Configuring-different-DNS-servers-in-the-FRITZ-Box/).
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/setting-up-1.1.1.1/windows.md b/products/1.1.1.1/src/content/setting-up-1.1.1.1/windows.md
index 6df12091eed..f6b80aa499c 100644
--- a/products/1.1.1.1/src/content/setting-up-1.1.1.1/windows.md
+++ b/products/1.1.1.1/src/content/setting-up-1.1.1.1/windows.md
@@ -1,7 +1,10 @@
 ---
-order:8
+order: 8
+pcx-content: tutorial
 ---
 
+import CaptivePortals from "../_partials/_captive-portals.md"
+
 # Windows
 
 Follow this quick guide to start using 1.1.1.1 on your Windows computer.
@@ -10,42 +13,32 @@ Follow this quick guide to start using 1.1.1.1 on your Windows computer.
 
 <StreamVideo id="92b27227d737a866adc8b0572cf0db89"/>
 
-Step 1: Click on the Start menu, then click on **Control Panel**.
-
-Step 2: Click on **Network and Internet**.
-
-Step 3: Click on Change **Adapter Settings**.
-
-Step 4: Right click on the Wi-Fi network you are connected to.
-
-Step 5: Click Properties.
-
-Step 6: Select **Internet Protocol Version 4**.
-
-Step 7: Click Properties.
-
-Step 8: Click Use The Following DNS Server Addresses.
-
-Step 9: Remove any IP addresses that may be already listed and in their place add:
-
-```txt
-1.1.1.1
-1.0.0.1
-```
-
-Step 10: Click OK.
-
-Step 11: Go now to **Internet Protocol Version 6**.
-
-Step 12: Click Properties
-
-Step 13: Click Use The Following DNS Server Addresses.
-
-Step 14: Remove any IP addresses that may be already listed and in their place add:
-
-```txt
-2606:4700:4700::1111
-2606:4700:4700::1001
-```
-
-Step 15: Click Close.
+1. Click on the **Start menu** > **Control Panel**.
+1. Click on **Network and Internet**.
+1. Click on **Change Adapter Settings**.
+1. Right click on the Wi-Fi network you are connected to.
+1. Click **Properties**.
+1. Select **Internet Protocol Version 4**.
+1. Click **Properties**.
+1. Click **Use The Following DNS Server Addresses**.
+1. Remove any IP addresses that may be already listed and in their place add:
+
+    ```txt
+    1.1.1.1
+    1.0.0.1
+    ```
+
+1. Click **OK**.
+1. Go now to **Internet Protocol Version 6**.
+1. Click **Properties**.
+1. Click **Use The Following DNS Server Addresses**.
+1. Remove any IP addresses that may be already listed and in their place add:
+
+    ```txt
+    2606:4700:4700::1111
+    2606:4700:4700::1001
+    ```
+
+1. Click **Close**.
+
+<CaptivePortals/>
\ No newline at end of file
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-1.png b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-1.png
index 2cae2721ab2..55954613e95 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-1.png and b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-1.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-2.png b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-2.png
index e3ba642e6b6..15eaa189f4d 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-2.png and b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-example-2.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-refresh.gif b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-refresh.gif
new file mode 100644
index 00000000000..a2271ea1280
Binary files /dev/null and b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-refresh.gif differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-types.png b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-types.png
index a2523278a96..d5cb099674a 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-types.png and b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command-types.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command.png b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command.png
index 4a5cd590b8d..428f2097586 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/dig-command.png and b/products/1.1.1.1/src/content/static/dns-over-discord/dig-command.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-1.png b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-1.png
index 53e16d9b531..91107fc22b6 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-1.png and b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-1.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-2.png b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-2.png
index 4b2dc7ebbda..c86fd1d14da 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-2.png and b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-example-2.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-refresh.gif b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-refresh.gif
new file mode 100644
index 00000000000..9876674e998
Binary files /dev/null and b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-refresh.gif differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-types.png b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-types.png
index 65e1c018616..de28ff3a9e2 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-types.png and b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command-types.png differ
diff --git a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command.png b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command.png
index 88fcc85cb55..71e55c789ab 100644
Binary files a/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command.png and b/products/1.1.1.1/src/content/static/dns-over-discord/multi-dig-command.png differ
diff --git a/products/1.1.1.1/src/content/support-nat64/index.md b/products/1.1.1.1/src/content/support-nat64/index.md
index 69e8c8bdad2..929025541d3 100644
--- a/products/1.1.1.1/src/content/support-nat64/index.md
+++ b/products/1.1.1.1/src/content/support-nat64/index.md
@@ -1,6 +1,7 @@
 ---
 title: For IPv6-only networks
 order: 9
+pcx-content: interim
 ---
 
 # Supporting IPv6-only networks
@@ -17,13 +18,17 @@ You should only enable DNS64 if you are managing or using an IPv6-only network.
 
 DNS64 is specifically for networks that already have NAT64 support. If you are a network operator who has NAT64, you can test our DNS64 support by updating it to the following IP addresses:
 
-    2606:4700:4700::64
-    2606:4700:4700::6400
+```txt
+2606:4700:4700::64
+2606:4700:4700::6400
+```
 
-Some devices use separate fields for all eight parts of IPv6 addresses and cannot accept the :: IPv6 abbreviation syntax. For such fields enter:
+Some devices use separate fields for all eight parts of IPv6 addresses and cannot accept the `::` IPv6 abbreviation syntax. For such fields enter:
 
-    2606:4700:4700:0:0:0:0:64
-    2606:4700:4700:0:0:0:0:6400
+```txt
+2606:4700:4700:0:0:0:0:64
+2606:4700:4700:0:0:0:0:6400
+```
 
 ## How can I test it?
 
diff --git a/products/1.1.1.1/src/content/terms-of-use/index.md b/products/1.1.1.1/src/content/terms-of-use/index.md
index d61b975b96b..d5b83180a8e 100644
--- a/products/1.1.1.1/src/content/terms-of-use/index.md
+++ b/products/1.1.1.1/src/content/terms-of-use/index.md
@@ -1,10 +1,9 @@
 ---
 title: Terms
 order: 10
+pcx-content: reference
 ---
 
 # Terms of Use
 
-1.1.1.1 Public DNS Resolver & 1.1.1.1 for Families Terms of Use
-
 By using 1.1.1.1 Public DNS Resolver or 1.1.1.1 for Families, you consent to be bound by the [Cloudflare Website and Online Services Terms of Use](https://www.cloudflare.com/website-terms/).
diff --git a/products/1.1.1.1/src/content/what-is-1.1.1.1/index.md b/products/1.1.1.1/src/content/what-is-1.1.1.1/index.md
index 0394b9f9355..fd7a78ef708 100644
--- a/products/1.1.1.1/src/content/what-is-1.1.1.1/index.md
+++ b/products/1.1.1.1/src/content/what-is-1.1.1.1/index.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content: concept
 ---
 
 # What is 1.1.1.1?
@@ -8,9 +9,9 @@ order: 2
 
 When you request to visit an application like cloudflare.com, your computer needs to know which server to connect you to so that it can load the application. Computers don’t know how to do this name to address translation, so they ask a specialized server to do it for them.
 
-This specialized server is called a DNS recursive resolver. The resolver’s job is to find the address for a given name, like 2400:cb00:2048:1::c629:d7a2 for cloudflare.com, and return it to the computer that asked for it.
+This specialized server is called a DNS recursive resolver. The resolver’s job is to find the address for a given name, like `2400:cb00:2048:1::c629:d7a2` for cloudflare.com, and return it to the computer that asked for it.
 
-Computers are configured to talk to specific DNS resolvers, identified by IP address. Usually the configuration is managed by your ISP (like Comcast or AT&T) if you’re on your home or wireless internet, and by your network administrator if you’re connected to the office internet. You can also change the configured DNS resolver your computer talks to yourself.
+Computers are configured to talk to specific DNS resolvers, identified by IP address. Usually the configuration is managed by your ISP (like Comcast or AT&T) if you’re on your home or wireless Internet, and by your network administrator if you’re connected to the office Internet. You can also change the configured DNS resolver your computer talks to yourself.
 
 ## What do DNS resolvers do?
 
@@ -24,4 +25,4 @@ The resolver then asks the TLD’s servers where it can find the domain it is lo
 
 Once the resolver has the final IP address, it returns the answer to the computer that asked.
 
-This whole system - with the servers that host the information (they are called authoritative DNS) and the servers that seek the information (the DNS resolvers) is called the Domain Name System (DNS). DNS is like Google Maps for the internet. It translates the name of places to addresses so that you can figure out how to get there.
+This whole system — with the servers that host the information (they are called authoritative DNS) and the servers that seek the information (the DNS resolvers) — is called the Domain Name System (DNS). DNS is like Google Maps for the Internet. It translates the name of places to addresses so that you can figure out how to get there.
diff --git a/products/access/docs-config.js b/products/access/docs-config.js
index 0d706c5d87d..1c6b5584aa5 100644
--- a/products/access/docs-config.js
+++ b/products/access/docs-config.js
@@ -28,6 +28,6 @@ module.exports = {
     description: "Welcome to Cloudflare Access. You can now make all your applications available on the internet without a VPN. Access protects these applications and allows only authorized users to access them. For example, Cloudflare uses Access to ensure only people at Cloudflare can access internal tools like our staging site.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/access",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/access/src/content/api-and-terraform/access-with-terraform.md b/products/access/src/content/api-and-terraform/access-with-terraform.md
index 4d19a7bd1e9..2fdde393a96 100644
--- a/products/access/src/content/api-and-terraform/access-with-terraform.md
+++ b/products/access/src/content/api-and-terraform/access-with-terraform.md
@@ -12,7 +12,8 @@ We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Pl
 
 | Requirements |
 | ------------ |
-| [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) installed on your machine. |
+| [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) installed on your machine |
+| The [Cloudflare provider](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) properly configured |
 
 [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building [Cloudflare resources](https://www.terraform.io/docs/providers/cloudflare/). Listed below are examples to help you get started with building Access with Terraform. For a more generalized guide on configuring Cloudflare and Terraform, visit our [Getting Started with Terraform and Cloudflare](https://blog.cloudflare.com/getting-started-with-terraform-and-cloudflare-part-1/) blog post.
 
@@ -23,8 +24,6 @@ We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Pl
  Here is an example configuration:
 
 ```
-provider "cloudflare" {}
-
 variable "domain" {
   default = "example.com"
 }
@@ -189,4 +188,4 @@ resource "cloudflare_access_policy" "cf_policy" {
   }
 }
 ```
-These are the basics to get up and running with Access and Terraform. See our [API documentation](https://api.cloudflare.com/#access-organizations-properties) for other endpoints that can be managed via Terraform.
\ No newline at end of file
+These are the basics to get up and running with Access and Terraform. See our [API documentation](https://api.cloudflare.com/#access-organizations-properties) for other endpoints that can be managed via Terraform.
diff --git a/products/access/src/content/common-access-configurations/gitlab.md b/products/access/src/content/common-access-configurations/gitlab.md
index 4cbc276c6aa..2552bc3f58f 100644
--- a/products/access/src/content/common-access-configurations/gitlab.md
+++ b/products/access/src/content/common-access-configurations/gitlab.md
@@ -48,8 +48,8 @@ Cloudflare Argo Tunnel creates a secure, outbound-only, connection between this
 Argo Tunnel can be installed on the machine with the following commands.
 
 ```sh
-$ sudo wget https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb
-$ sudo dpkg -i ./cloudflared-stable-linux-amd64.deb
+$ sudo wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+$ sudo dpkg -i ./cloudflared-linux-amd64.deb
 ```
 
 Once installed, you will need to authenticate `cloudflared`. The following command will print a URL that can be visited in another machine with a browser.
diff --git a/products/access/src/content/other-protocols/smb-guide.md b/products/access/src/content/other-protocols/smb-guide.md
index 8a7cb0780a4..e3a17ef9144 100644
--- a/products/access/src/content/other-protocols/smb-guide.md
+++ b/products/access/src/content/other-protocols/smb-guide.md
@@ -37,8 +37,7 @@ For example, on a Windows server, the following Powershell example can be used.
 ```bash
 New-Item -Path "C:\cloudflared" -ItemType "directory"
 Set-Location "C:\cloudflared"
-(New-Object System.Net.WebClient).DownloadFile("https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-amd64.zip","c:\cloudflared\cloudflared.zip")
-Expand-Archive -LiteralPath c:\cloudflared\cloudflared.zip -DestinationPath c:\cloudflared
+(New-Object System.Net.WebClient).DownloadFile("https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe","c:\cloudflared\cloudflared.exe")
 ```
 
 ## 2. Authenticate the Cloudflare daemon
@@ -103,4 +102,4 @@ On the Windows machine, locate the Server process, likely called "Server" and ru
 
 **Common issues**
 
-* Ensure that the machine's firewall permits egress on ports 80, 443, and 2244, otherwise `cloudflared` will return an error.
\ No newline at end of file
+* Ensure that the machine's firewall permits egress on ports 80, 443, and 2244, otherwise `cloudflared` will return an error.
diff --git a/products/access/src/content/protocols-and-connections/SMB-file-shares.md b/products/access/src/content/protocols-and-connections/SMB-file-shares.md
index 0650a5786a3..203c6c84ee8 100644
--- a/products/access/src/content/protocols-and-connections/SMB-file-shares.md
+++ b/products/access/src/content/protocols-and-connections/SMB-file-shares.md
@@ -41,8 +41,7 @@ For example, on a Windows server, the following Powershell example can be used.
 ```bash
 New-Item -Path "C:\cloudflared" -ItemType "directory"
 Set-Location "C:\cloudflared"
-(New-Object System.Net.WebClient).DownloadFile("https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-amd64.zip","c:\cloudflared\cloudflared.zip")
-Expand-Archive -LiteralPath c:\cloudflared\cloudflared.zip -DestinationPath c:\cloudflared
+(New-Object System.Net.WebClient).DownloadFile("https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe","c:\cloudflared\cloudflared.exe")
 ```
 ### 2. Authenticate `cloudflared`
 
diff --git a/products/analytics/docs-config.js b/products/analytics/docs-config.js
index 2283cf64f2a..36a70b02ec3 100644
--- a/products/analytics/docs-config.js
+++ b/products/analytics/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "With the GraphQL Analytics API, all of your performance, security, and reliability data is available from one endpoint. And you can select exactly what you need, from one metric for a domain to multiple metrics aggregated for your account.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/analytics",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/analytics/src/content/faq/index.md b/products/analytics/src/content/faq/index.md
index dfbbbc58e23..ca82e514047 100644
--- a/products/analytics/src/content/faq/index.md
+++ b/products/analytics/src/content/faq/index.md
@@ -1,69 +1,10 @@
 ---
-title: FAQ
 order: 40
+pcx-content-type: navigation
 ---
 
 # FAQs
 
-## Web Analytics FAQ
+Visit the following pages to see commonly asked questions:
 
-### When I add the beacon to my website and load the webpage, I see an error that includes "is not allowed by Access-Controll-Allow-Origin" (CORS). What's happening?
-
-This error usually occurs when the hostname of the site loading the analytics does not match the name of the analytics site configured in the dashboard. Double-check that they are identical. 
-
-Cloudflare matches hostnames based on a postfix. For example, if you set up analytics for "example.com", we'll allow analytics from "www.example.com," "blog.staging.example.com," and "fooexample.com." However, we won't allow analytics from "example.com.br."
-
-You may also see this error if the site does not send a "Referer" or "Origin" header. The "Referer" header is required (don't try to use the "Referrer-policy" header instead). We have a change in-flight now that only the "Origin" header will be required – we believe there is no way to disable that in the browser.
-
-### Can I track more than one website with Web Analytics?
-
-Yes. Right now there's a soft limit of 10 sites per account, but that can be adjusted by contacting Cloudflare support.
-
-### The analytics beacon is blocked by ad-blockers (including adblockplus, Brave, DuckDuckGo extension, etc). Why is that?
-
-Cloudflare is aware that the analytics beacon is blocked by these services.
-
-While Cloudflare Web Analytics uses a JS beacon, Cloudflare’s edge analytics can't be blocked because we can measure every request that's received. Edge analytics are available to any customer who "orange clouds" and proxies traffic through Cloudflare. Currently, users on Pro, Business, and Enterprise plans get advanced web analytics powered by our edge logs.
-
-### If I'm proxying my site through Cloudflare already, should I manually add the JS beacon?
-
-You can, but you don't have to. 
-
-Existing Cloudflare customers can access analytics collected from our edge on the "Analytics" tab of the dashboard. You can also enable Browser Insights to measure performance using JavaScript.
-
-Cloudflare Web Analytics is designed primarily for customers who do not use Cloudflare's proxy to measure their web traffic. However, in the future we may add the option for orange-cloud users to automatically add the beacon if they'd like to measure web traffic using the beacon. 
-
-### Can I see server-side analytics by URL?
-Web Analytics only displays client-side analytics. All Cloudflare customers who proxy their traffic also get analytics based on traffic at their edge.
-
-Currently users on Pro, Business, and Enterprise plans get advanced HTTP traffic analytics, which is the only way to see features like a breakdown of traffic by URL based on server-side analytics. 
-
-### Can I use Web Analytics with AMP?
-Not yet, but we plan to support AMP soon. 
- 
-### Can I add Web Analytics to my site using a tag manager like Google Tag Manager (GTM)?
-Yes. Instead of embedding the script using a tag manager as shown here:
-```bash
-<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "$SITE_TOKEN"}'></script>
-```
-
-Add the following script:
-```bash
-<script defer src='https://static.cloudflareinsights.com/beacon.min.js?token=$SITE_TOKEN'></script>
-```
-
-### Does Cloudflare Web Analytics support UTM parameters?
-Not yet. UTM parameters are special query string parameters that can help track where traffic is coming from. 
-Currently Cloudflare Web Analytics don't log query strings to avoid collecting potentially sensitive data, but we may add support for this in the future.
-
-### Does Web Analytics support custom events?
-Not yet, but we may add support for this in the future.
-  
-### I'm not seeing all the metrics for SPA (or even MPA). Why is that?
-Every route change that occurs in the single-page app will send the measurement of the route before the route is changed to the beacon endpoint. The measurement for the last route change will be sent whenever the user leaves the tab or closes the browser window. That will trigger visibilityState to a hidden state. Whenever that happens, Beacon JS sends the payload using the [Navigator.sendBeacon method](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon) that should not be cancelled even when the browser window is closed. However, due to compatibility, old browsers would fallback to using Ajax (XmlHttpRequest), which can be cancelled when the browser window is closed, so the last payload that gets sent to the beacon endpoint can be lost. Also, due to various network conditions, there can be data loss when the payload is sent to the beacon endpoint. 
-
-### Can I use the same JS Snippet for a different domain? 
-No. However, if the root domain is the same, you can use the same site tag. For example, if you have provided us a hostname "example.com" when registering a site, you can use the JS Snippet from that site for "abc.example.com" and "def.example.com" since they use the same root domain. When payload gets sent to the beacon endpoint, we validate the hostname with postfix matching, so if your domain shares the same root domain, that would work. 
-
-### If I'm orange-clouded, can Web Analytics load the script and report stats back to my own domain (using /cdn-cgi/, for example)?
-Not yet, but we may add support for this in the future.
+<DirectoryListing path="/faq"/>
\ No newline at end of file
diff --git a/products/analytics/src/content/faq/web-analytics/index.md b/products/analytics/src/content/faq/web-analytics/index.md
new file mode 100644
index 00000000000..97d52bc9054
--- /dev/null
+++ b/products/analytics/src/content/faq/web-analytics/index.md
@@ -0,0 +1,105 @@
+---
+pcx-content-type: faq
+---
+
+# Web Analytics FAQ
+
+## Errors
+
+### When I add the beacon to my website and load the webpage, I see an error that includes "is not allowed by Access-Control-Allow-Origin" (CORS). What's happening?
+
+This error usually occurs when the hostname of the site loading the analytics does not match the name of the analytics site configured in the dashboard. Double-check that they are identical. 
+
+Cloudflare matches hostnames based on a postfix. For example, if you set up analytics for `example.com`, we'll allow analytics from `www.example.com`, `blog.staging.example.com`, and `fooexample.com`. However, we won't allow analytics from `example.com.br`.
+
+You may also see this error if the site does not send a "Referer" or "Origin" header. The "Referer" header is required (don't try to use the "Referrer-policy" header instead). We have a change in-flight now that only the "Origin" header will be required – we believe there is no way to disable that in the browser.
+
+### The analytics beacon is blocked by ad-blockers (including adblockplus, Brave, DuckDuckGo extension, etc). Why is that?
+
+Cloudflare is aware that the analytics beacon is blocked by these services.
+
+While Cloudflare Web Analytics uses a JS beacon, Cloudflare’s edge analytics can't be blocked because we can measure every request that's received. Edge analytics are available to any customer who "orange clouds" and proxies traffic through Cloudflare. Currently, users on Pro, Business, and Enterprise plans get advanced web analytics powered by our edge logs.
+
+### Why am I not seeing all the metrics for SPA (or even MPA)?
+
+Every route change that occurs in the single-page app will send the measurement of the route before the route is changed to the beacon endpoint. The measurement for the last route change will be sent whenever the user leaves the tab or closes the browser window. That will trigger visibilityState to a hidden state. Whenever that happens, Beacon JS sends the payload using the [Navigator.sendBeacon method](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon) that should not be cancelled even when the browser window is closed. However, due to compatibility, old browsers would fallback to using Ajax (XmlHttpRequest), which can be cancelled when the browser window is closed, so the last payload that gets sent to the beacon endpoint can be lost. Also, due to various network conditions, there can be data loss when the payload is sent to the beacon endpoint. 
+
+### For the same site, why would I see more data reported with an automatic setup?
+
+Unless you are using Rules to control which pages to be measured, using [automatic setup] will inject the JS snippet on all pages (sub-domains) under the zone. 
+
+If you used a [manual setup] instead, only those pages that render the JS snippet will be reported.
+
+<Aside type="note">
+
+Since only one JS snippet can be rendered and used per page, you cannot have multiple snippets on the same page.
+
+</Aside> 
+
+---
+
+## Setup
+
+### If I'm proxying my site through Cloudflare already, should I manually add the JS beacon?
+
+You can, but you don't have to. Cloudflare Web Analytics is designed primarily for customers who do not use Cloudflare's proxy to measure their web traffic.
+
+Existing Cloudflare customers can access analytics collected from our edge on the **Analytics** tab of the dashboard. You can also enable Browser Insights to measure performance using JavaScript.
+
+Using an orange-clouded domain with [automatic setup] will report stats back to your own domain's `/cdn-cgi/rum` endpoint. If you have installed JS snippet yourself (a [manual setup]), it will report back to `cloudflareinsights.com/cdn-cgi/rum` endpoint. 
+
+### Can I add Web Analytics to my site using a tag manager like Google Tag Manager (GTM)?
+
+Yes. Instead of embedding the script using a tag manager as shown here:
+```bash
+<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "$SITE_TOKEN"}'></script>
+```
+
+Add the following script:
+```bash
+<script defer src='https://static.cloudflareinsights.com/beacon.min.js?token=$SITE_TOKEN'></script>
+```
+
+### Can I use the same JS Snippet for a different domain? 
+
+No. However, if the root domain is the same, you can use the same site tag. For example, if you have provided us a hostname `example.com` when registering a site, you can use the JS snippet from that site for `abc.example.com` and `def.example.com` since they use the same root domain. When payload gets sent to the beacon endpoint, we validate the hostname with postfix matching, so if your domain shares the same root domain, that would work. 
+
+### Can I use automatic setup with a DNS-only domain (CNAME setup)?
+
+No, you can only use the [automatic setup] with JS snippet injection if traffic to your domain is proxied through Cloudflare (orange-clouded).
+
+If you have a DNS-only domain, you will have to do a [manual setup] instead.
+
+---
+
+## Functionality
+
+### Can I see server-side analytics by URL?
+
+Web Analytics only displays client-side analytics. All Cloudflare customers who proxy their traffic also get analytics based on traffic at their edge.
+
+Currently users on Pro, Business, and Enterprise plans get advanced HTTP traffic analytics, which is the only way to see features like a breakdown of traffic by URL based on server-side analytics. 
+
+### Can I use Web Analytics with AMP?
+
+Not yet, but we plan to support AMP soon. 
+ 
+### What is the data retention policy for Web Analytics?
+
+One month, but we are planning to increase the retention in the near future.
+
+### Does Cloudflare Web Analytics support UTM parameters?
+
+Not yet. UTM parameters are special query string parameters that can help track where traffic is coming from. 
+Currently Cloudflare Web Analytics don't log query strings to avoid collecting potentially sensitive data, but we may add support for this in the future.
+
+### Does Web Analytics support custom events?
+
+Not yet, but we may add support for this in the future.
+  
+### Can I track more than one website with Web Analytics?
+
+Yes. Right now there's a soft limit of 10 sites per account, but that can be adjusted by contacting Cloudflare support.
+
+[manual setup]:/web-analytics/getting-started#sites-not-proxied-through-cloudflare
+[automatic setup]:/web-analytics/getting-started#sites-proxied-through-cloudflare
\ No newline at end of file
diff --git a/products/analytics/src/content/graphql-api/errors/index.md b/products/analytics/src/content/graphql-api/errors/index.md
index 11a8a9f71aa..642088ace10 100644
--- a/products/analytics/src/content/graphql-api/errors/index.md
+++ b/products/analytics/src/content/graphql-api/errors/index.md
@@ -1,6 +1,6 @@
 ---
-title: Error responses
 order: 25
+pcx-content-type: reference
 ---
 
 # Error responses
diff --git a/products/analytics/src/content/graphql-api/features/data-sets/index.md b/products/analytics/src/content/graphql-api/features/data-sets/index.md
index d492b4e69e6..20826853982 100755
--- a/products/analytics/src/content/graphql-api/features/data-sets/index.md
+++ b/products/analytics/src/content/graphql-api/features/data-sets/index.md
@@ -1,6 +1,6 @@
 ---
-title: Data Sets (tables)
 order: 2
+pcx-content-type: reference
 ---
 
 # Data Sets (tables)
@@ -34,6 +34,7 @@ The following data sets (and associated nodes) are available in Cloudflare Analy
 | Network Analytics           | `ipFlows1mGroups` `ipFlows1hGroups` `ipFlows1dGroups` `ipFlows1mAttacksGroups`                                                 |
 | SYN Attacks (DoS Analytics) | `synAvgPps1mGroups`                                                                                                            |
 | Workers Metrics             | `workersInvocationsAdaptive`                                                                                                   |
+| Magic Firewall Analytics    | `magicFirewallSamplesAdaptiveGroups`                                                                                           |
 
 </TableWrap>
 
@@ -64,8 +65,8 @@ The following data nodes are deprecated. To avoid disruption, migrate to replace
 | `firewallRulePreviewGroups`  | `httpRequestsAdaptiveGroups`         | March 1, 2021     |
 | `healthCheckEvents`          | `healthCheckEventsAdaptive`          | March 1, 2021     |   
 | `healthCheckEventsGroups`    | `healthCheckEventsAdaptiveGroups`    | March 1, 2021     |  
-| `loadBalancingRequests`      | `loadBalancingRequestsAdaptive`      | March 1, 2021     | 
-| `loadBalancingRequestsGroups`| `loadBalancingRequestsAdaptiveGroups`| March 1, 2021     |
+| `loadBalancingRequests`      | `loadBalancingRequestsAdaptive`      | September 30, 2021     | 
+| `loadBalancingRequestsGroups`| `loadBalancingRequestsAdaptiveGroups`| September 30, 2021     |
 
 </TableWrap>
 
diff --git a/products/analytics/src/content/graphql-api/features/filtering/index.md b/products/analytics/src/content/graphql-api/features/filtering/index.md
index 441061bd2d7..f512bdcef25 100755
--- a/products/analytics/src/content/graphql-api/features/filtering/index.md
+++ b/products/analytics/src/content/graphql-api/features/filtering/index.md
@@ -1,6 +1,6 @@
 ---
-title: Filtering
 order: 10
+pcx-content-type: reference
 ---
 
 # Filtering
@@ -102,12 +102,13 @@ The `like` operator is available for string comparisons and supports the `%` cha
 
 ```graphql
 {
-  myQuery(
-    filter: {
-      clientCountry: "UK" # all objects having client country equal to "UK"
-      datetime_gt: "2018-01-01T10:00:00Z" # all object having datetime greater than "2018-01-01T10:00:00Z"
+  viewer {
+    zones(filter: {zoneTag: $zoneTag}) {
+      httpRequestsAdaptiveGroups(filter: {datetime_gt: "2021-06-10T00:00:00Z", clientCountryName: "GB"}, limit: 1) {
+        count
+      }
     }
-  )
+  }
 }
 ```
 
@@ -118,7 +119,7 @@ The following GraphQL example shows how to filter a specific node. The SQL equiv
 ##### GraphQL {#001}
 
 ```graphql
-httpRequests1hGroups(filter: {datetime: "2018-01-01T10:00:00Z"}) {
+httpRequestsAdaptiveGroups(filter: {datetime: "2018-01-01T10:00:00Z"}) {
     ...
 }
 ```
@@ -127,7 +128,6 @@ httpRequests1hGroups(filter: {datetime: "2018-01-01T10:00:00Z"}) {
 
 ```sql
 WHERE datetime="2018-01-01T10:00:00Z"
-  AND ((clientCountryName = "UK") OR (clientCountryName = "US"))
 ```
 
 #### Filter on multiple fields
@@ -150,14 +150,15 @@ WHERE (datetime > "2018-01-01T10:00:00Z") AND (datetime < "2018-01-01T10:00:00Z"
 
 #### Filter using the `OR` operator
 
-The following GraphQL example demonstrates using the `OR` operator in a filter. This `OR` operator filters for the value `US` or `UK` in the `clientCountryName` field.
+The following GraphQL example demonstrates using the `OR` operator in a filter. This `OR` operator filters for the value `US` or `GB` in the `clientCountryName` field.
 
 ##### GraphQL {#005}
 
 ```graphql
-httpRequests1hGroups(filter: {
-    datetime: "2018-01-01T10:00:00Z",
-    OR:[{clientCountryName: "US"}, {clientCountryName: "UK"}]) {
+httpRequestsAdaptiveGroups(
+        filter: {
+          datetime: "2018-01-01T10:00:00Z",
+          OR:[{clientCountryName: "US"}, {clientCountryName: "GB"}]) {
     ...
 }
 ```
@@ -166,7 +167,7 @@ httpRequests1hGroups(filter: {
 
 ```sql
 WHERE datetime="2018-01-01T10:00:00Z"
-  AND ((clientCountryName = "UK") OR (clientCountryName = "US"))
+  AND ((clientCountryName = "US") OR (clientCountryName = "GB"))
 ```
 
 ### Subqueries (advanced filters)
diff --git a/products/analytics/src/content/graphql-api/features/index.md b/products/analytics/src/content/graphql-api/features/index.md
index 08f586d35e6..8bdd180b484 100644
--- a/products/analytics/src/content/graphql-api/features/index.md
+++ b/products/analytics/src/content/graphql-api/features/index.md
@@ -1,14 +1,10 @@
 ---
-title: Features
 order: 20
+pcx-content-type: navigation
 ---
 
 # Features
 
 The GraphQL Analytics API offers the following features:
 
-- [Data Sets (tables)](/graphql-api/features/data-sets/)
-- [Filtering](/graphql-api/features/filtering/)
-- [Sorting](/graphql-api/features/sorting/)
-- [Pagination](/graphql-api/features/pagination/)
-- [Nested Structures](/graphql-api/features/nested-structures/)
+<DirectoryListing path="/graphql-api/features"/>
diff --git a/products/analytics/src/content/graphql-api/features/nested-structures/index.md b/products/analytics/src/content/graphql-api/features/nested-structures/index.md
index 4c076d3533b..3d30e1d51e5 100644
--- a/products/analytics/src/content/graphql-api/features/nested-structures/index.md
+++ b/products/analytics/src/content/graphql-api/features/nested-structures/index.md
@@ -1,6 +1,6 @@
 ---
-title: Nested Structures
 order: 16
+pcx-content-type: reference
 ---
 
 # Nested Structures
diff --git a/products/analytics/src/content/graphql-api/features/pagination/index.md b/products/analytics/src/content/graphql-api/features/pagination/index.md
index e232f31f141..089533cc3e0 100755
--- a/products/analytics/src/content/graphql-api/features/pagination/index.md
+++ b/products/analytics/src/content/graphql-api/features/pagination/index.md
@@ -1,6 +1,6 @@
 ---
-title: Pagination
 order: 14
+pcx-content-type: reference
 ---
 
 # Pagination
diff --git a/products/analytics/src/content/graphql-api/features/sorting/index.md b/products/analytics/src/content/graphql-api/features/sorting/index.md
index 4b4f4f3ec88..5e6654365b7 100755
--- a/products/analytics/src/content/graphql-api/features/sorting/index.md
+++ b/products/analytics/src/content/graphql-api/features/sorting/index.md
@@ -1,6 +1,6 @@
 ---
-title: Sorting
 order: 12
+pcx-content-type: reference
 ---
 
 # Sorting
diff --git a/products/analytics/src/content/graphql-api/getting-started/authentication/api-key-auth.md b/products/analytics/src/content/graphql-api/getting-started/authentication/api-key-auth.md
index 10578760460..a58f1fbe7cc 100644
--- a/products/analytics/src/content/graphql-api/getting-started/authentication/api-key-auth.md
+++ b/products/analytics/src/content/graphql-api/getting-started/authentication/api-key-auth.md
@@ -1,6 +1,6 @@
 ---
-title: Authenticate with a Cloudflare API key
 order: 30
+pcx-content-type: reference
 ---
 
 # Authenticate with a Cloudflare API key
diff --git a/products/analytics/src/content/graphql-api/getting-started/authentication/api-token-auth.md b/products/analytics/src/content/graphql-api/getting-started/authentication/api-token-auth.md
index 45e56989e72..de424e49d40 100644
--- a/products/analytics/src/content/graphql-api/getting-started/authentication/api-token-auth.md
+++ b/products/analytics/src/content/graphql-api/getting-started/authentication/api-token-auth.md
@@ -1,6 +1,6 @@
 ---
-title: Configure an Analytics API token
 order: 20
+pcx-content-type: how-to
 ---
 
 # Configure an Analytics API token
@@ -11,10 +11,11 @@ For more detail on API tokens and the full range of supported options, see [_Cre
 
 To create an API token for authentication to the GraphQL Analytics API, use this workflow:
 
-* [Access the Create API Token page](#access-the-create-api-token-page)
-* [Configure a custom API token](#configure-a-custom-api-token)
-* [Review and create your API token](#review-and-create-your-api-token)
-* [Copy and test your API token](#copy-and-test-your-api-token)
+- [Configure an Analytics API token](#configure-an-analytics-api-token)
+  - [Access the Create API Token page](#access-the-create-api-token-page)
+  - [Configure a custom API token](#configure-a-custom-api-token)
+  - [Review and create your API token](#review-and-create-your-api-token)
+  - [Copy and test your API token](#copy-and-test-your-api-token)
 
 ## Access the Create API Token page
 
diff --git a/products/analytics/src/content/graphql-api/getting-started/authentication/graphql-client-headers.md b/products/analytics/src/content/graphql-api/getting-started/authentication/graphql-client-headers.md
index 5b713b03d33..667cc528216 100644
--- a/products/analytics/src/content/graphql-api/getting-started/authentication/graphql-client-headers.md
+++ b/products/analytics/src/content/graphql-api/getting-started/authentication/graphql-client-headers.md
@@ -1,6 +1,6 @@
 ---
-title: Configure GraphQL client endpoint and HTTP headers
 order: 40
+pcx-content-type: how-to
 ---
 
 # Configure GraphQL client endpoint and HTTP headers
diff --git a/products/analytics/src/content/graphql-api/getting-started/authentication/index.md b/products/analytics/src/content/graphql-api/getting-started/authentication/index.md
index 2c408f9e0e8..5f0410247e9 100644
--- a/products/analytics/src/content/graphql-api/getting-started/authentication/index.md
+++ b/products/analytics/src/content/graphql-api/getting-started/authentication/index.md
@@ -1,6 +1,6 @@
 ---
-title: Authentication
 order: 10
+pcx-content-type: reference
 ---
 
 # Authentication
diff --git a/products/analytics/src/content/graphql-api/getting-started/compose-graphql-query.md b/products/analytics/src/content/graphql-api/getting-started/compose-graphql-query.md
index a59b206d08e..ef7405d97ab 100644
--- a/products/analytics/src/content/graphql-api/getting-started/compose-graphql-query.md
+++ b/products/analytics/src/content/graphql-api/getting-started/compose-graphql-query.md
@@ -1,6 +1,6 @@
 ---
-title: Create a query in GraphiQL
 order: 50
+pcx-content-type: interim
 ---
 
 # Create a query in GraphiQL
diff --git a/products/analytics/src/content/graphql-api/getting-started/execute-graphql-query.md b/products/analytics/src/content/graphql-api/getting-started/execute-graphql-query.md
index de9ec14eeff..a2641a6346d 100644
--- a/products/analytics/src/content/graphql-api/getting-started/execute-graphql-query.md
+++ b/products/analytics/src/content/graphql-api/getting-started/execute-graphql-query.md
@@ -1,6 +1,6 @@
 ---
-title: Use curl to query the Analytics API
 order: 60
+pcx-content-type: interim
 ---
 
 # Use curl to query the Analytics API
diff --git a/products/analytics/src/content/graphql-api/getting-started/explore-graphql-schema.md b/products/analytics/src/content/graphql-api/getting-started/explore-graphql-schema.md
index 1bd125ab766..6ef38999443 100644
--- a/products/analytics/src/content/graphql-api/getting-started/explore-graphql-schema.md
+++ b/products/analytics/src/content/graphql-api/getting-started/explore-graphql-schema.md
@@ -1,6 +1,6 @@
 ---
-title: Explore the Analytics schema with GraphiQL
 order: 40
+pcx-content-type: interim
 ---
 
 # Explore the Analytics schema with GraphiQL
diff --git a/products/analytics/src/content/graphql-api/getting-started/index.md b/products/analytics/src/content/graphql-api/getting-started/index.md
index edd61016c23..e96588465b6 100644
--- a/products/analytics/src/content/graphql-api/getting-started/index.md
+++ b/products/analytics/src/content/graphql-api/getting-started/index.md
@@ -1,9 +1,10 @@
 ---
 title: Getting started
 order: 10
+pcx-content-type: navigation
 ---
 
-# Getting started
+# Get started
 
 Use these articles to get started with the Cloudflare GraphQL Analytics API:
 
diff --git a/products/analytics/src/content/graphql-api/getting-started/querying-basics.md b/products/analytics/src/content/graphql-api/getting-started/querying-basics.md
index c65c72e82e2..e81e2792b25 100644
--- a/products/analytics/src/content/graphql-api/getting-started/querying-basics.md
+++ b/products/analytics/src/content/graphql-api/getting-started/querying-basics.md
@@ -1,6 +1,6 @@
 ---
-title: Querying basics
 order: 20
+pcx-content-type: reference
 ---
 
 # Querying basics
diff --git a/products/analytics/src/content/graphql-api/index.md b/products/analytics/src/content/graphql-api/index.md
index 369ff37196f..f347f15dd50 100644
--- a/products/analytics/src/content/graphql-api/index.md
+++ b/products/analytics/src/content/graphql-api/index.md
@@ -1,6 +1,6 @@
 ---
-title: GraphQL Analytics API
 order: 2
+pcx-content-type: interim
 ---
 
 # GraphQL Analytics API
diff --git a/products/analytics/src/content/graphql-api/limits/index.md b/products/analytics/src/content/graphql-api/limits/index.md
index aba5d64011b..c2a658df235 100644
--- a/products/analytics/src/content/graphql-api/limits/index.md
+++ b/products/analytics/src/content/graphql-api/limits/index.md
@@ -1,6 +1,6 @@
 ---
-title: Limits
 order: 30
+pcx-content-type: reference
 ---
 
 # Limits
@@ -41,6 +41,7 @@ Access to Network Analytics <b>ipFlows</b> nodes is only available to Enterprise
 | `loadBalancingRequestsGroups`        |      n/a |   3 days |  30 days |    30 days |
 | `loadBalancingRequests`              |      n/a |   3 days |  30 days |    30 days |
 | `synAvgPps1mGroups`                  |      n/a |      n/a |      n/a |     7 days |
+| `magicFirewallSamplesAdaptiveGroups` |      n/a |      n/a |      n/a |     7 days |
 
 </TableWrap>
 
diff --git a/products/analytics/src/content/graphql-api/migration-guides/graphql-api-analytics/index.md b/products/analytics/src/content/graphql-api/migration-guides/graphql-api-analytics/index.md
index 4b87ac0f7f7..a516fd485b5 100644
--- a/products/analytics/src/content/graphql-api/migration-guides/graphql-api-analytics/index.md
+++ b/products/analytics/src/content/graphql-api/migration-guides/graphql-api-analytics/index.md
@@ -1,6 +1,7 @@
 ---
 title: HTTP Requests by Colo Groups to HTTP Requests by Adaptive Groups
 order: 10
+pcx-content-type: reference
 ---
 
 # httpRequests1mByColoGroups/httpRequests1dByColoGroups to httpRequestsAdaptiveGroups
diff --git a/products/analytics/src/content/graphql-api/migration-guides/index.md b/products/analytics/src/content/graphql-api/migration-guides/index.md
index d3d0bb7013a..a41b0fdb9af 100644
--- a/products/analytics/src/content/graphql-api/migration-guides/index.md
+++ b/products/analytics/src/content/graphql-api/migration-guides/index.md
@@ -1,6 +1,6 @@
 ---
-title: Migration guides
 order: 60
+pcx-content-type: navigation
 ---
 
 # Migration guides
diff --git a/products/analytics/src/content/graphql-api/migration-guides/zone-analytics-colos/index.md b/products/analytics/src/content/graphql-api/migration-guides/zone-analytics-colos/index.md
index 475886e2c0a..f0b923ff2d0 100644
--- a/products/analytics/src/content/graphql-api/migration-guides/zone-analytics-colos/index.md
+++ b/products/analytics/src/content/graphql-api/migration-guides/zone-analytics-colos/index.md
@@ -1,6 +1,6 @@
 ---
-title: Zone Analytics Colos Endpoint to GraphQL Analytics
 order: 12
+pcx-content-type: reference
 ---
 # Zone Analytics Colos Endpoint to GraphQL Analytics
 
diff --git a/products/analytics/src/content/graphql-api/migration-guides/zone-analytics/index.md b/products/analytics/src/content/graphql-api/migration-guides/zone-analytics/index.md
index 8422bf00b4d..e84de042fbf 100644
--- a/products/analytics/src/content/graphql-api/migration-guides/zone-analytics/index.md
+++ b/products/analytics/src/content/graphql-api/migration-guides/zone-analytics/index.md
@@ -1,6 +1,6 @@
 ---
-title: Zone Analytics to GraphQL Analytics
 order: 11
+pcx-content-type: reference
 ---
 
 # Zone Analytics to GraphQL Analytics
diff --git a/products/analytics/src/content/graphql-api/sampling/index.md b/products/analytics/src/content/graphql-api/sampling/index.md
index 1f4b3cd9772..ba3d78be637 100644
--- a/products/analytics/src/content/graphql-api/sampling/index.md
+++ b/products/analytics/src/content/graphql-api/sampling/index.md
@@ -1,6 +1,6 @@
 ---
-title: Sampling
 order: 40
+pcx-content-type: reference
 ---
 
 # Sampling
@@ -15,13 +15,14 @@ Cloudflare Analytics builds the following data sets from sampled data:
 
 <TableWrap>
 
-| Data set              | Nodes                                                                          |
-| :-------------------- | :----------------------------------------------------------------------------- |
-| Firewall Activity Log | `firewallEventsAdaptive` `firewallEventsAdaptiveByTimeGroups`                  |
-| Firewall Analytics    | `firewallEventsAdaptiveGroups`                                                 |
-| Firewall Rule Preview | `firewallRulePreviewGroups`                                                    |
-| Network Analytics     | `ipFlows1mGroups` `ipFlows1hGroups` `ipFlows1dGroups` `ipFlows1mAttacksGroups` |
-| Workers Metrics       | `workersInvocationsAdaptive`                                                   |
+| Data set                  | Nodes                                                                          |
+| :-------------------------| :----------------------------------------------------------------------------- |
+| Firewall Activity Log     | `firewallEventsAdaptive` `firewallEventsAdaptiveByTimeGroups`                  |
+| Firewall Analytics        | `firewallEventsAdaptiveGroups`                                                 |
+| Firewall Rule Preview     | `firewallRulePreviewGroups`                                                    |
+| Network Analytics         | `ipFlows1mGroups` `ipFlows1hGroups` `ipFlows1dGroups` `ipFlows1mAttacksGroups` |
+| Workers Metrics           | `workersInvocationsAdaptive`                                                   |
+| Magic Firewall Analytics  | `magicFirewallSamplesAdaptiveGroups`                                           |
 
 </TableWrap>
 
diff --git a/products/analytics/src/content/graphql-api/tutorials/build-your-own-analytics/index.md b/products/analytics/src/content/graphql-api/tutorials/build-your-own-analytics/index.md
index 6fd77dc6783..f2990819a9b 100644
--- a/products/analytics/src/content/graphql-api/tutorials/build-your-own-analytics/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/build-your-own-analytics/index.md
@@ -1,6 +1,6 @@
 ---
-title: Build your own Analytics dashboard
 order: 40
+pcx-content-type: interim
 ---
 
 # Build your own Analytics dashboard
diff --git a/products/analytics/src/content/graphql-api/tutorials/export-graphql-to-csv/index.md b/products/analytics/src/content/graphql-api/tutorials/export-graphql-to-csv/index.md
index b29118e7d25..3816895e80f 100644
--- a/products/analytics/src/content/graphql-api/tutorials/export-graphql-to-csv/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/export-graphql-to-csv/index.md
@@ -1,5 +1,5 @@
 ---
-title: Export GraphQL data to CSV
+pcx-content-type: interim
 ---
 
 # Export GraphQL data to CSV
diff --git a/products/analytics/src/content/graphql-api/tutorials/index.md b/products/analytics/src/content/graphql-api/tutorials/index.md
index 71e42408a74..49d2c328682 100644
--- a/products/analytics/src/content/graphql-api/tutorials/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/index.md
@@ -1,6 +1,6 @@
 ---
-title: Tutorials
 order: 50
+pcx-content-type: navigation
 ---
 
 # Tutorials
diff --git a/products/analytics/src/content/graphql-api/tutorials/querying-firewall-events/index.md b/products/analytics/src/content/graphql-api/tutorials/querying-firewall-events/index.md
index f0c58cbb211..514ee14163d 100644
--- a/products/analytics/src/content/graphql-api/tutorials/querying-firewall-events/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/querying-firewall-events/index.md
@@ -1,5 +1,5 @@
 ---
-title: Querying Firewall Events with GraphQL
+pcx-content-type: interim
 ---
 
 # Querying Firewall Events with GraphQL
diff --git a/products/analytics/src/content/graphql-api/tutorials/querying-magic-firewall-samples/index.md b/products/analytics/src/content/graphql-api/tutorials/querying-magic-firewall-samples/index.md
new file mode 100644
index 00000000000..5092b7af6ed
--- /dev/null
+++ b/products/analytics/src/content/graphql-api/tutorials/querying-magic-firewall-samples/index.md
@@ -0,0 +1,110 @@
+---
+pcx-content-type: interim
+---
+
+# Querying Magic Firewall Samples with GraphQL
+
+In this example, we're going to use the GraphQL Analytics API to query for Magic Firewall Samples over a specified time period.
+
+The following API call will request Magic Firewall Samples over a one hour period, and output the requested fields. Be sure to replace CLOUDFLARE_ZONE_ID, CLOUDFLARE_EMAIL, and CLOUDFLARE_API_KEY with your zone tag and API credentials, and adjust the datetime_geg and datetime_leq values to your liking.
+
+## API Call
+
+```
+PAYLOAD='{ "query":
+  "query MFWActivity {
+      viewer {
+        accounts(filter: { accountTag: $accountTag }) {
+          magicFirewallSamplesAdaptiveGroups(
+            filter: $filter
+            limit: 10
+            orderBy: [datetimeFiveMinute_DESC]
+          ) {
+            sum {
+              bits
+              packets
+            }
+            dimensions {
+              datetimeFiveMinute
+              ruleId
+            }
+          }
+        }
+      }
+    }",
+    "variables": {
+      "accountTag": "$CLOUDFLARE_ACCOUNT_ID",
+      "filter": {
+        "datetime_geq": "2021-04-24T11:00:00Z",
+        "datetime_leq": "2021-04-24T12:00:00Z"
+      }
+    }
+  }'
+
+curl \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -H "X-Auth-Email: CLOUDFLARE_EMAIL" \
+  -H "X-Auth-key: CLOUDFLARE_API_KEY" \
+  --data "$(echo $PAYLOAD)" \
+  https://api.cloudflare.com/client/v4/graphql/
+```
+
+The returned values represent the total number of packets and bits received during the five minute interval for a particular rule. The result will be in JSON (as requested), so piping the output to `jq` will make it easier to read, e.g.,:
+```
+curl \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -H "X-Auth-Email: CLOUDFLARE_EMAIL" \
+  -H "X-Auth-key: CLOUDFLARE_API_KEY" \
+  --data "$(echo $PAYLOAD)" \
+  https://api.cloudflare.com/client/v4/graphql/ | jq .
+{
+  "data": {
+    "viewer": {
+      "accounts": [
+        {
+          "magicFirewallSamplesAdaptiveGroups": [
+            {
+              sum: { bits:  327680, packets: 16384 },
+              dimensions: {
+                datetimeFiveMinute: '2021-05-12T22:00-00:00',
+                ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'
+              }
+            },
+            {
+              sum: { bits:  360448, packets: 8192 },
+              dimensions: {
+                datetimeFiveMinute: '2021-05-12T22:05-00:00',
+                ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'
+              }
+            },
+            {
+              sum: { bits:  327680, packets: 8192 },
+              dimensions: {
+                datetimeFiveMinute: '2021-05-12T22:05-00:00',
+                ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'
+              }
+            },
+            {
+              sum: { bits:  360448, packets: 8192 },
+              dimensions: {
+                datetimeFiveMinute: '2021-05-12T22:20-00:00',
+                ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'
+              }
+            },
+            {
+              sum: { bits:  327680, packets: 8192 },
+              dimensions: {
+                datetimeFiveMinute: '2021-05-12T22:20-00:00',
+                ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'
+              }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "errors": null
+}
+```
diff --git a/products/analytics/src/content/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/index.md b/products/analytics/src/content/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/index.md
index 89d8ed439b5..beddba5baff 100644
--- a/products/analytics/src/content/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/index.md
@@ -1,5 +1,5 @@
 ---
-title: Querying Magic Transit Tunnel Health Check Results with GraphQL
+pcx-content-type: interim
 ---
 
 # Querying Magic Transit Tunnel Health Check Results with GraphQL
diff --git a/products/analytics/src/content/graphql-api/tutorials/querying-workers-metrics/index.md b/products/analytics/src/content/graphql-api/tutorials/querying-workers-metrics/index.md
index 7ae5ee25655..30f310c0fb2 100644
--- a/products/analytics/src/content/graphql-api/tutorials/querying-workers-metrics/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/querying-workers-metrics/index.md
@@ -1,5 +1,6 @@
 ---
 title: Querying Workers Metrics with GraphQL
+pcx-content-type: interim
 ---
 
 # Querying Workers Metrics with GraphQL
@@ -32,7 +33,7 @@ PAYLOAD='{ "query":
               cpuTimeP99
             }
             dimensions{
-              datetimeMinute
+              datetime
               scriptName
               status
             }
diff --git a/products/analytics/src/content/graphql-api/tutorials/use-graphql-create-widgets/index.md b/products/analytics/src/content/graphql-api/tutorials/use-graphql-create-widgets/index.md
index 138225cf3fd..071379be173 100644
--- a/products/analytics/src/content/graphql-api/tutorials/use-graphql-create-widgets/index.md
+++ b/products/analytics/src/content/graphql-api/tutorials/use-graphql-create-widgets/index.md
@@ -1,18 +1,20 @@
 ---
-title: Use GraphQL to create widgets
 order: 45
+pcx-content-type: interim
 ---
 
 # Use GraphQL to create widgets
 
 This article presents examples of queries you can use to populate your own dashboard.
 
-* [Timeseries graph](#timeseries-graph)
-* [Activity log](#activity-log)
-* [Top N cards - source](#top-n-cards---source)
-* [Top N cards - destination](#top-n-cards---destination)
-* [TCP flags](#tcp-flags)
-* [Executive summary](#executive-summary)
+- [Use GraphQL to create widgets](#use-graphql-to-create-widgets)
+  - [Parameters and filters](#parameters-and-filters)
+  - [Timeseries graph](#timeseries-graph)
+  - [Activity log](#activity-log)
+  - [Top N cards - source](#top-n-cards---source)
+  - [Top N cards - destination](#top-n-cards---destination)
+  - [TCP Flags](#tcp-flags)
+  - [Executive summary](#executive-summary)
 
 Use this workflow to build and test queries:
 
diff --git a/products/analytics/src/content/index.md b/products/analytics/src/content/index.md
index 2b0243d1e8c..bd320ecec14 100644
--- a/products/analytics/src/content/index.md
+++ b/products/analytics/src/content/index.md
@@ -1,15 +1,17 @@
 ---
-title: Welcome
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Overview
 
+Cloudflare visualizes the metadata collected by our products in the Cloudflare dashboard. Refer to [Accessing the data Cloudflare collects](https://developers.cloudflare.com/fundamentals/data-products/accessing-cf-data) for more information about the various types of analytics and where they exist in the dashboard.
+
 ## Cloudflare Web Analytics
 
-Cloudflare Web Analytics provides free, privacy-first analytics for your website without changing your DNS or using Cloudflare’s proxy. 
+[Cloudflare Web Analytics](/web-analytics) provides free, privacy-first analytics for your website without changing your DNS or using Cloudflare’s proxy.
 
 ## GraphQL Analytics API
 
-With the GraphQL Analytics API, all of your performance, security, and reliability data is available from one endpoint.
-And you can select exactly what you need, from one metric for a domain to multiple metrics aggregated for your account.
\ No newline at end of file
+With the [GraphQL Analytics API](/graphql-api), all of your performance, security, and reliability data is available from one endpoint.
+And you can select exactly what you need, from one metric for a domain to multiple metrics aggregated for your account.
diff --git a/products/analytics/src/content/web-analytics/about/index.md b/products/analytics/src/content/web-analytics/about/index.md
new file mode 100644
index 00000000000..496f14d2332
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/about/index.md
@@ -0,0 +1,16 @@
+---
+order: 20
+pcx-content-type: concept
+---
+
+# About Web Analytics
+
+Cloudflare Web Analytics helps you understand the performance of your web pages as experienced by your site visitors.
+
+To enable Web Analytics, Cloudflare writes and injects a piece of JavaScript code (also known as a beacon) that collects certain pieces of information into your web pages. More specifically, this beacon collects metrics using the Performance API, which is available in all major web browsers.
+
+Web Analytics supports Adaptive Bit Rate (ABR). Cloudflare's servers will select the best resolution for each chart or table depending on the size of the data, the date range, your network connection, and other factors. For more information, refer to [Explaining Cloudflare's ABR Analytics](https://blog.cloudflare.com/explaining-cloudflares-abr-analytics/).
+
+The data displayed in Web Analytics is real user monitoring (RUM). For more information, refer to [Real User Monitoring](https://en.wikipedia.org/wiki/Real_user_monitoring).
+
+Note: Web Analytics now includes the functionality formerly enabled through Browser Insights.
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/change-log/index.md b/products/analytics/src/content/web-analytics/change-log/index.md
new file mode 100644
index 00000000000..29e9ea78a47
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/change-log/index.md
@@ -0,0 +1,28 @@
+---
+title: Change log
+order: 40
+pcx-content-type: reference
+---
+
+# Change log for beacon.min.js
+
+Cloudflare occasionally updates the `beacon.min.js` file to improve Web Analytics functionality. The table below includes a log of what changed in the `beacon.min.js` file and when.
+
+<table style="width:100%">
+   <thead>
+        <tr>
+            <th>Date of change</th>
+            <th>Description</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>2021-05-28</td>
+            <td>startsWith function replaced with indexOf function, which prevents rendering if multiple beacon scripts are loaded.</td>
+        </tr>
+        <tr>
+            <td>2021-05-12</td>
+            <td>Reporting endpoint changed from /cdn-cgi/beacon/performance to /cdn-cgi/rum (for Browser Insights only).</td>
+        </tr>
+   </tbody>
+</table>
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/configuring-web-analytics/filters/index.md b/products/analytics/src/content/web-analytics/configuring-web-analytics/filters/index.md
index 31b4fa6e4e2..93fc682d42a 100644
--- a/products/analytics/src/content/web-analytics/configuring-web-analytics/filters/index.md
+++ b/products/analytics/src/content/web-analytics/configuring-web-analytics/filters/index.md
@@ -1,6 +1,6 @@
 ---
-title: Filters
 order: 40
+pcx-content-type: how-to
 ---
 
 # Filters
diff --git a/products/analytics/src/content/web-analytics/configuring-web-analytics/index.md b/products/analytics/src/content/web-analytics/configuring-web-analytics/index.md
index 0c5e4dad995..434ee7b64aa 100644
--- a/products/analytics/src/content/web-analytics/configuring-web-analytics/index.md
+++ b/products/analytics/src/content/web-analytics/configuring-web-analytics/index.md
@@ -1,8 +1,10 @@
 ---
-title: Configuring Cloudflare Web Analytics
 order: 30
+pcx-content-type: navigation
 ---
 
 # Configuring Cloudflare Web Analytics
 
 Customize your Web Analytics views by using filters.
+
+<DirectoryListing path="/web-analytics/configuring-web-analytics"/>
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/configuring-web-analytics/rules/index.md b/products/analytics/src/content/web-analytics/configuring-web-analytics/rules/index.md
new file mode 100644
index 00000000000..5cd129486ec
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/configuring-web-analytics/rules/index.md
@@ -0,0 +1,16 @@
+---
+order: 41
+pcx-content-type: how-to
+---
+
+# Rules
+
+Use **Rules** to configure whether to track Web Analytics for specific websites or paths. If you do not configure any rules, Web Analytics injects the JavaScript (JS) snippet for all sites.
+
+Rules are only available for sites proxied through Cloudflare. For more information, refer to [Limits](/web-analytics/understanding-web-analytics/limits/).
+
+1. From **Quick Actions**, click **View Web Analytics sites**.
+2. Find the site you want to configure and click **Manage site**.
+3. Click **Advanced options** > **Add rule**.
+4. Select the **Action** and fill in the Host name and Path(s) you want to add a rule for.
+5. Enable the rule to deploy it on your site.
diff --git a/products/analytics/src/content/web-analytics/getting-started/index.md b/products/analytics/src/content/web-analytics/getting-started/index.md
index 65f29567b5f..0be42e28a76 100644
--- a/products/analytics/src/content/web-analytics/getting-started/index.md
+++ b/products/analytics/src/content/web-analytics/getting-started/index.md
@@ -1,22 +1,39 @@
 ---
-title: Getting started
+title: Get started
 order: 10
+pcx-content-type: how-to
 ---
 
 # Enabling Cloudflare Web Analytics
 
+## Sites not proxied through Cloudflare
 
-If you already have a Cloudflare account, go to Web Analytics from your Account Home page and skip to step 4.
-
-1. Visit [Get started with Web Analytics](https://dash.cloudflare.com/sign-up/web-analytics). 
-1. Enter your Email address and password.
+1. Go to [Get started with Web Analytics](https://dash.cloudflare.com/sign-up/web-analytics).
+1. Enter an Email address and password.
 1. Click **Create Account**.
-1. Enter your website’s hostname and click **Next**.
-1. Copy the JS Snippet and add it to any of your website’s HTML pages before the ending body tag.
-1. Click **Next**.
+1. Enter your website’s hostname.
+1. Copy the JS snippet.
+1. Add the JS snippet to any of your website’s HTML pages before the ending body tag.
+1. Click **Done**.
 1. Wait for the redirect to the Web Analytics page or click **View Analytics**. It may take a few minutes for Web Analytics data to appear.
 
-Repeat steps 4-7 for all of the websites you want to track with Web Analytics. Cloudflare enforces a soft limit of 10 sites per account, but that can be adjusted by contacting Cloudflare support. 
+Repeat steps 4-8 for all of the websites you want to track with Web Analytics by going to **Quick Actions** > **Add a site** from the Web Analytics Sites page. Adjust Web Analytics for your site at any time by clicking **Manage site**.
+
+For more information on how many sites you can track, refer to [Limits](../understanding-web-analytics/limits/).
+
+## Sites proxied through Cloudflare
+
+1. Go to [Web Analytics Sites](dash.cloudflare.com/?to=/:account/web-analytics) from your account home page.
+2. Under **Quick Actions**, click **Add a site**.
+3. Select a hostname from the drop-down menu. Automatic setup is enabled by default. To set up Web Analytics manually:
+   1. Expand **Advanced options**.
+   2. Select **Disable automatic setup**.
+   3. Copy the JS snippet.
+   4. Add the JS snippet to any of your website’s HTML pages before the ending body tag.
+4. Click **Done**.
+
+Repeat steps 3-4 for all of the websites you want to track with Web Analytics. Web Analytics are enabled by default for sites proxied through Cloudflare that previously used Browser Insights. Adjust Web Analytics for your site at any time by clicking **Manage site** from the Web Analytics Sites page.
 
-Once enabled, find and copy the JS Snippet on the left menu of the Web Analytics page anytime.
+For more information on how many sites you can track, refer to [Limits](../understanding-web-analytics/limits/).
 
+For more information on how to configure which sites or pages you track with Web Analytics, refer to [Rules](../understanding-web-analytics/rules/).
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/getting-started/web-analytics-spa/index.md b/products/analytics/src/content/web-analytics/getting-started/web-analytics-spa/index.md
index 571ace5d7d6..f6c5dd23cd0 100644
--- a/products/analytics/src/content/web-analytics/getting-started/web-analytics-spa/index.md
+++ b/products/analytics/src/content/web-analytics/getting-started/web-analytics-spa/index.md
@@ -1,6 +1,7 @@
 ---
 title: Web Analytics for SPAs
 order: 12
+pcx-content-type: reference
 ---
 
 # Web Analytics for Single Page Applications (SPAs)
diff --git a/products/analytics/src/content/web-analytics/index.md b/products/analytics/src/content/web-analytics/index.md
index b86a3925ade..d4b489bd21a 100644
--- a/products/analytics/src/content/web-analytics/index.md
+++ b/products/analytics/src/content/web-analytics/index.md
@@ -1,6 +1,7 @@
 ---
 title: Cloudflare Web Analytics
 order: 1
+pcx-content-type: reference
 ---
 
 # Overview
@@ -9,5 +10,4 @@ Cloudflare Web Analytics provides free, privacy-first analytics for your website
 
 Cloudflare Web Analytics does not collect or use your visitors’ personal data.
 
-To view similar analytics for domains using Cloudflares proxy (orange-clouded), navigate to the Analytics app and select Web Traffic Analytics. Web Traffic Analytics are available for Pro, Business, and Enterprise plans.
-
+To view similar analytics for domains using Cloudflare's proxy (orange-clouded), navigate to the Analytics app and select Web Traffic Analytics. Web Traffic Analytics are available for Pro, Business, and Enterprise plans.
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/core-web-vitals/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/core-web-vitals/index.md
index e0a672b4bef..0676507e033 100644
--- a/products/analytics/src/content/web-analytics/understanding-web-analytics/core-web-vitals/index.md
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/core-web-vitals/index.md
@@ -1,6 +1,6 @@
 ---
-title: Core Web Vitals
 order: 40
+pcx-content-type: concept
 ---
 
 # Core Web Vitals
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/data-origin-and-collection/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/data-origin-and-collection/index.md
new file mode 100644
index 00000000000..6c0d603b261
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/data-origin-and-collection/index.md
@@ -0,0 +1,17 @@
+---
+order: 38
+pcx-content-type: concept
+---
+
+# Data origin and collection
+
+Web Analytics relies on the `performance.getEntriesByType('navigation')` object to collect metrics about page load performance. If Navigation Timing Level 2 is not supported, then [performance.timing (Level 1)](https://developer.mozilla.org/en-US/docs/Web/API/Performance/timing) is used.
+
+Refer to the [W3C Processing Model](https://www.w3.org/TR/navigation-timing-2/#processing-model) for a visual depiction of the sequence of timing events for web page loads.
+
+## Data collection and reporting
+Web Analytics collects the minimum amount of information - timing metrics - to show customers how their websites perform. Cloudflare does not track individual end users across our customers’ Internet properties.
+
+The Web Analytics performance beacon loads from [https://static.cloudflareinsights.com/beacon.min.js](https://static.cloudflareinsights.com/beacon.min.js) and uses a third-party domain so that the script is cached across website loads. You may need to update your [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) settings to load this script.
+
+Beacon data is sent to `https://<yourdomainname>/cdn-cgi/rum` for sites proxied through Cloudflare or `https://cloudflareinsights.com/cdn-cgi/rum` for sites not proxied through Cloudflare. Core Web Vital metrics are reported when the `visibilityState` is hidden for the first time after the page load event is triggered.
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/dimensions/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/dimensions/index.md
index ed43ebff23b..4eb2ede8686 100644
--- a/products/analytics/src/content/web-analytics/understanding-web-analytics/dimensions/index.md
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/dimensions/index.md
@@ -1,6 +1,6 @@
 ---
-title: Dimensions
 order: 41
+pcx-content-type: reference
 ---
 
 # Dimensions
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/high-level-metrics/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/high-level-metrics/index.md
new file mode 100644
index 00000000000..e2e680d6adb
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/high-level-metrics/index.md
@@ -0,0 +1,13 @@
+---
+order: 39
+pcx-content-type: reference
+---
+
+# High-level metrics
+
+* Visits - A page view that originated from a different website or direct link. Cloudflare checks where the HTTP referer does not match the hostname. One visit can consist of multiple page views.
+* Page views - A successful HTTP response with a content-type of HTML.
+* Page load time - The total amount of time required to load the page.
+* Core Web Vitals - Higher-level metrics designed by Google to capture the user experience more completely.
+
+![Web Analytics overview](../../../static/images/dash-web_analytics-overview.png)
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/index.md
index ee79a94e436..7d9fb09652b 100644
--- a/products/analytics/src/content/web-analytics/understanding-web-analytics/index.md
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/index.md
@@ -1,17 +1,8 @@
 ---
-title: Understanding Cloudflare Web Analytics
-order: 30
+order: 20
+pcx-content-type: navigation
 ---
 
 # Understanding Cloudflare Web Analytics
 
-View your website’s page views, visits, [page load time](/web-analytics/understanding-web-analytics/page-load-time-summary/), and [Core Web Vitals](/web-analytics/understanding-web-analytics/core-web-vitals/) by switching between views on the graph. You can also filter data by various [dimensions](/web-analytics/understanding-web-analytics/dimensions/).
-
-## High-Level Metrics
-
-* Visits - A page view that originated from a different website or direct link. Cloudflare checks where the HTTP referer does not match the hostname. One visit can consist of multiple page views.
-* Page views - A successful HTTP response with a content-type of HTML.
-* Page load time - The total amount of time required to load the page.
-* Core Web Vitals - Higher-level metrics designed by Google to capture the user experience more completely.
-
-![Web Analytics dash overview](../../static/images/dash-web_analytics-overview.png)
\ No newline at end of file
+<DirectoryListing path="/web-analytics/understanding-web-analytics"/>
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/limits/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/limits/index.md
new file mode 100644
index 00000000000..c8c803e594a
--- /dev/null
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/limits/index.md
@@ -0,0 +1,38 @@
+---
+order: 43
+pcx-content-type: reference
+---
+
+# Limits
+
+Cloudflare limits the number of sites for which you can track web analytics as well as the number of rules allowed for each plan type. Refer to the following tables for more information.
+
+## Site Limits
+
+Cloudflare limits the number of sites for which you can track web analytics. Limits depend on whether a site uses Cloudflare's proxy.  
+
+<TableWrap>
+
+| Site type                                      | Limit              |
+| ---------------------------------------------- | ------------------ |
+| Not proxied through Cloudflare                 | 10                 |
+| Proxied through Cloudflare                     | No limit           |
+
+</TableWrap>
+
+## Rules Limits
+
+Cloudflare limits the number of Web Analytics rules you can have by plan type. For plans with a limit of zero, Web Analytics injects the JS snippet on all subdomains.
+
+Rules are only available for sites proxied through Cloudflare.
+
+<TableWrap>
+
+| Plan type      | Rules limit  |
+| -------------- | ------------ |
+| Free           | 0            |
+| Pro            | 5            |
+| Business       | 20           |
+| Enterprise     | 100          |
+
+</TableWrap>
\ No newline at end of file
diff --git a/products/analytics/src/content/web-analytics/understanding-web-analytics/page-load-time-summary/index.md b/products/analytics/src/content/web-analytics/understanding-web-analytics/page-load-time-summary/index.md
index e8aa99614ca..a60d56bdf8b 100644
--- a/products/analytics/src/content/web-analytics/understanding-web-analytics/page-load-time-summary/index.md
+++ b/products/analytics/src/content/web-analytics/understanding-web-analytics/page-load-time-summary/index.md
@@ -1,6 +1,6 @@
 ---
-title: Page load time summary
 order: 42
+pcx-content-type: reference
 ---
 
 # Page load time summary
diff --git a/products/api-security/README.md b/products/api-security/README.md
new file mode 100644
index 00000000000..56aaa41482d
--- /dev/null
+++ b/products/api-security/README.md
@@ -0,0 +1,5 @@
+# Cloudflare API Security docs
+ 
+[View docs →](https://developers.cloudflare.com/api-security)
+ 
+[Read contributor guidelines →](https://github.com/cloudflare/cloudflare-docs/blob/10189c62728443109c98c82cff9d6900ceb185dc/CONTRIBUTING.md)
\ No newline at end of file
diff --git a/products/api-security/docs-config.js b/products/api-security/docs-config.js
new file mode 100644
index 00000000000..3318d173eb5
--- /dev/null
+++ b/products/api-security/docs-config.js
@@ -0,0 +1,25 @@
+module.exports = {
+    product: "API Security",
+    pathPrefix: "/api-security",
+    productIconKey: "page-shield",
+    contentRepo: "cloudflare/cloudflare-docs",
+    contentRepoFolder: "products/api-security",
+  externalLinks: [
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:api-security"]'}
+  },
+  siteMetadata: {
+    title: "Cloudflare API Security docs",
+    description: "Protect your APIs from simple and sophisticated attacks using Cloudflare API Security products.",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/api-security",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+  }
+}
\ No newline at end of file
diff --git a/products/argo-tunnel/package.json b/products/api-security/package.json
similarity index 100%
rename from products/argo-tunnel/package.json
rename to products/api-security/package.json
diff --git a/products/api-security/src/content/_partials/_availability.md b/products/api-security/src/content/_partials/_availability.md
new file mode 100644
index 00000000000..548bfe241d9
--- /dev/null
+++ b/products/api-security/src/content/_partials/_availability.md
@@ -0,0 +1,3 @@
+<Aside header="Note:">
+If you are an Enterprise customer and interested in this product, contact your account team.
+</Aside>
diff --git a/products/api-security/src/content/_partials/_blog-post.md b/products/api-security/src/content/_partials/_blog-post.md
new file mode 100644
index 00000000000..cf96f0dcdb1
--- /dev/null
+++ b/products/api-security/src/content/_partials/_blog-post.md
@@ -0,0 +1 @@
+For more technical details, see our [blog post](https://blog.cloudflare.com/api-abuse-detection/).
\ No newline at end of file
diff --git a/products/api-security/src/content/index.md b/products/api-security/src/content/index.md
new file mode 100644
index 00000000000..aca1618cb01
--- /dev/null
+++ b/products/api-security/src/content/index.md
@@ -0,0 +1,32 @@
+---
+title: Overview
+order: 0
+pcx-content-type: landing-page
+type: overview
+---
+
+# Cloudflare API Security
+
+Cloudflare offers a range of products to help identify and address API vulnerabilities.
+
+## Why care about API security?
+
+APIs have become the [backbone of popular web services](https://blog.postman.com/intro-to-apis-history-of-apis/), helping the Internet become more accessible and useful.
+
+As APIs have become more prevalent, however, so have their problems:
+- Many companies have [thousands of APIs](products/api-discovery), including ones they do not even know about.
+- To support a large base of users, many APIs are protected by a [negative security model](products/api-shield) that makes them vulnerable to credential-stuffing attacks and automated scanning tools.
+- With so many endpoints and users, it’s difficult to recognize brute-force attacks against [specific endpoints](products/volumetric-abuse-detection).
+- Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon [usage patterns](products/sequential-abuse-detection).
+
+## Features
+
+Cloudflare offers the following features to help learn about and secure your APIs:
+<DirectoryListing path="/products"/>
+
+For additional details, see our [blog post](https://blog.cloudflare.com/api-abuse-detection/).
+
+## Availability
+Cloudflare API Security products are available to Enterprise customers only. 
+
+Additionally, API Discovery, Volumetric Abuse Detection, and Sequential Abuse Detection are currently enabled by request. If you are interested in using these products, contact your account team.
diff --git a/products/api-security/src/content/products/api-discovery.md b/products/api-security/src/content/products/api-discovery.md
new file mode 100644
index 00000000000..63dba89e57a
--- /dev/null
+++ b/products/api-security/src/content/products/api-discovery.md
@@ -0,0 +1,42 @@
+---
+order: 0
+pcx-content-type: concept
+type: overview
+---
+
+import Availability from "../_partials/_availability.md"
+import BlogBlurb from "../_partials/_blog-post.md"
+
+# API Discovery
+
+<Availability/>
+
+Most development teams struggle to keep track of their APIs. Cloudflare API Discovery helps you map out and understand your attack surface area.
+
+## Process
+
+Cloudflare produces a simple, trustworthy map of API endpoints through a process of path normalization.
+
+For example, you might have thousands of APIs, but a lot of the calls look similar, such as:
+- `api.example.com/login/238`
+- `api.example.com/login/392`
+
+Both paths serve a similar purpose — allowing users to log into their accounts — but they are not identical. To simplify your endpoints, these examples might both map to `api.example.com/login/*`.
+
+API Discovery runs this process across all your authenticated endpoints, eventually generating a simple map of endpoints that might look like:
+
+- `login/{customer_identifier}`
+- `auth`
+- `account/{customer_identifier}`
+- `password_reset`
+- `logout`
+
+This process currently requires a session identifier, like an authorization token available as a request header. Once you have finished API Discovery, your APIs are ready for protection from [volumetric](../volumetric-abuse-detection) and [sequential](../sequential-abuse-detection) attacks.
+
+<BlogBlurb/>
+
+## API requests
+
+To better understand your API traffic, you can also see [API requests](https://dash.cloudflare.com/?to=/:account/:zone/analytics/traffic/api-requests) in your application dashboard.
+
+This view adds a lightweight filter to application requests so you can better identify API traffic. If you want a more sophisticated understanding of API traffic, check out [Bot Tags](https://developers.cloudflare.com/bots/about/cloudflare-bot-tags).
diff --git a/products/api-security/src/content/products/api-shield.md b/products/api-security/src/content/products/api-shield.md
new file mode 100644
index 00000000000..3c85450e3d7
--- /dev/null
+++ b/products/api-security/src/content/products/api-shield.md
@@ -0,0 +1,13 @@
+---
+pcx-content-type: concept
+order: 4
+---
+
+# API Shield™
+
+Cloudflare API Shield allows you to secure your APIs using the following security solutions:
+
+- **Mutual TLS (mTLS)** — Blocks traffic from devices that do not have a valid client SSL/TLS certificate with an API Shield rule.
+- **Schema Validation** — Protects your origin from invalid API requests or a malicious payload by matching each request with the provided schema.
+
+For more details, see the full [API Shield documentation](https://developers.cloudflare.com/firewall/cf-firewall-rules/api-shield).
\ No newline at end of file
diff --git a/products/api-security/src/content/products/index.md b/products/api-security/src/content/products/index.md
new file mode 100644
index 00000000000..2c8304307fb
--- /dev/null
+++ b/products/api-security/src/content/products/index.md
@@ -0,0 +1,12 @@
+---
+order: 1
+pcx-content-type: navigation
+type: overview
+---
+
+# Products
+
+Cloudflare offers the following features to help learn about and secure your APIs:
+<DirectoryListing path="/products"/>
+
+For additional details, see our [blog post](https://blog.cloudflare.com/api-abuse-detection/).
\ No newline at end of file
diff --git a/products/api-security/src/content/products/sequential-abuse-detection.md b/products/api-security/src/content/products/sequential-abuse-detection.md
new file mode 100644
index 00000000000..a6b315a7e34
--- /dev/null
+++ b/products/api-security/src/content/products/sequential-abuse-detection.md
@@ -0,0 +1,25 @@
+---
+order: 3
+pcx-content-type: concept
+type: overview
+---
+
+import Availability from "../_partials/_availability.md"
+import BlogBlurb from "../_partials/_blog-post.md"
+
+# Sequential Abuse Detection
+
+<Availability/>
+
+Sequential Abuse Detection uncovers endpoint abuse by looking for irregular traffic across multiple endpoints.
+
+## Process
+
+Requests tend to come to endpoints in predictable patterns. For example, a login process might consist of the following:
+1. A request is sent to `/login/*/enter`.
+1. It is redirected to `/login/*/verify`.
+1. It is finally redirected to `/login-successful`.
+
+When requests go straight to `/login-successful`, they are not following the typical pattern and might be malicious. Sequential Abuse Detection identifies these common patterns in your API traffic and flags traffic that does not match these patterns.
+
+<BlogBlurb/>
\ No newline at end of file
diff --git a/products/api-security/src/content/products/volumetric-abuse-detection.md b/products/api-security/src/content/products/volumetric-abuse-detection.md
new file mode 100644
index 00000000000..e36be25ef84
--- /dev/null
+++ b/products/api-security/src/content/products/volumetric-abuse-detection.md
@@ -0,0 +1,26 @@
+---
+order: 2
+pcx-content-type: concept
+type: overview
+---
+
+import Availability from "../_partials/_availability.md"
+import BlogBlurb from "../_partials/_blog-post.md"
+
+# Volumetric Abuse Detection
+
+<Availability/>
+
+Cloudflare Volumetric Abuse Detection helps you set up a system of adaptive rate limiting.
+
+## Process
+
+After [API Discovery](../api-discovery), Cloudflare looks for endpoint abuse based on common user traffic.
+
+For example, your API might see different levels of traffic to a `/reset-password` endpoint than a `/login` endpoint. Additionally, your `/login` endpoint might see higher than average traffic after a successful marketing campaign.
+
+These two scenarios speak to the limitations of traditional rate limiting. Not only does traffic vary between endpoints, but it also can vary over time for the same endpoint. Volumetric Abuse Detection solves these problems with unsupervised learning to develop separate baselines for each API and better adjust to changes in user behavior.
+
+This process currently requires a session identifier, like an authorization token available as a request header.
+
+<BlogBlurb/>
\ No newline at end of file
diff --git a/products/api-security/wrangler.toml b/products/api-security/wrangler.toml
new file mode 100644
index 00000000000..0bb2ee0667e
--- /dev/null
+++ b/products/api-security/wrangler.toml
@@ -0,0 +1,14 @@
+name = "api-security"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+ 
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/api-security*"
+ 
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
\ No newline at end of file
diff --git a/products/api/docs-config.js b/products/api/docs-config.js
index 0c731ae66db..256a7fbcdee 100644
--- a/products/api/docs-config.js
+++ b/products/api/docs-config.js
@@ -15,15 +15,15 @@ module.exports = {
     }
   ],
   search: {
-    indexName: "",
-    apiKey: "",
-    algoliaOptions: { 'facetFilters': ''}
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:api"]'}
   },
   siteMetadata: {
     title: "Cloudflare API docs",
     description: "Cloudflare’s API tokens allow you to make calls to our API to alter different settings.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/api",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/api/src/content/index.md b/products/api/src/content/index.md
index 70cc9b38585..7ae440dc62e 100644
--- a/products/api/src/content/index.md
+++ b/products/api/src/content/index.md
@@ -27,4 +27,4 @@ For specific guidance on making API calls, see the following:
 
 * The specific [Developer Docs section](https://developers.cloudflare.com) for a service for how to guides.
 * [API schema docs](https://api.cloudflare.com) for request and response payloads for each endpoint.
-* If you are using [golang](https://github.com/cloudflare/cloudflare-go) or [Hashicorp's Terraform](https://github.com/terraform-providers/terraform-provider-cloudflare) you can leverage our 1st party libraries to integrate with Cloudflare's API.
+* If you are using [golang](https://github.com/cloudflare/cloudflare-go) or [Hashicorp's Terraform](https://github.com/cloudflare/terraform-provider-cloudflare) you can leverage our 1st party libraries to integrate with Cloudflare's API.
diff --git a/products/api/src/content/tokens/advanced/api.md b/products/api/src/content/tokens/advanced/api.md
index b42be1c4efc..bcfb8bd41fc 100644
--- a/products/api/src/content/tokens/advanced/api.md
+++ b/products/api/src/content/tokens/advanced/api.md
@@ -9,7 +9,7 @@ With API Tokens it is possible to be able to generate new tokens on the fly via
 
 ## Generating the initial token
 
-Before you can create Tokens via the API you need to generate the intial Token which will have the ability to do so via the Cloudflare Dashboard. From the [API Tokens management screen](https://dash.cloudflare.com/profile/api-tokens), select `Create Token` and select the `Create Additional Tokens` Template. This template will contain the user permission for creating API Tokens. This allows you to mimic the exact behavior presented in the UI from the API.
+Before you can create Tokens via the API you need to generate the initial Token which will have the ability to do so via the Cloudflare Dashboard. From the [API Tokens management screen](https://dash.cloudflare.com/profile/api-tokens), select `Create Token` and select the `Create Additional Tokens` Template. This template will contain the user permission for creating API Tokens. This allows you to mimic the exact behavior presented in the UI from the API.
 
 <Aside type="note">
 
diff --git a/products/api/src/content/tokens/create/permissions.md b/products/api/src/content/tokens/create/permissions.md
index 9a91514a1c8..94b412b21ec 100644
--- a/products/api/src/content/tokens/create/permissions.md
+++ b/products/api/src/content/tokens/create/permissions.md
@@ -57,8 +57,8 @@ Below is a list of all the Token Permissions that are available to use. The curr
 |Load Balancers Write|6d7f2f5f5b1d4a0e9081fdc98d432fd1|Grants write access to load balancers and associated resources|com.cloudflare.api.account.zone|
 |Load Balancing: Monitors and Pools Read|9d24387c6e8544e2bc4024a03991339f|Grants read access to account level load balancer resources|com.cloudflare.api.account|
 |Load Balancing: Monitors and Pools Write|d2a1802cc9a34e30852f8b33869b2f3c|Grants write access to account level load balancer resources|com.cloudflare.api.account|
-|Logs Read|c4a30cd58c5d42619c86a3c36c441e2d|Grants read access to logs and logpush jobs|com.cloudflare.api.account.zone|
-|Logs Write|3e0b5820118e47f3922f7c989e673882|Grants write access to logpush jobs|com.cloudflare.api.account.zone|
+|Logs Read|6a315a56f18441e59ed03352369ae956|Grants read access to logs and logpush jobs|com.cloudflare.api.account|
+|Logs Write|96163bd1b0784f62b3e44ed8c2ab1eb6|Grants write access to logpush jobs|com.cloudflare.api.account|
 |Page Rules Read|b415b70a4fd1412886f164451f20405c|Grants read access to Page Rules|com.cloudflare.api.account.zone|
 |Page Rules Write|ed07f6c337da4195b4e72a1fb2c6bcae|Grants write access to Page Rules|com.cloudflare.api.account.zone|
 |SSL and Certificates Read|7b7216b327b04b8fbc8f524e1f9b7531|Grants read access to SSL configuration and cert management|com.cloudflare.api.account.zone|
diff --git a/products/argo-tunnel/README.md b/products/argo-tunnel/README.md
deleted file mode 100644
index ad45a211195..00000000000
--- a/products/argo-tunnel/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Cloudflare Argo Tunnel docs
-
-[View docs →](https://developers.cloudflare.com/argo-tunnel)
-
-[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
diff --git a/products/argo-tunnel/docs-config.js b/products/argo-tunnel/docs-config.js
deleted file mode 100644
index ff088bc9ede..00000000000
--- a/products/argo-tunnel/docs-config.js
+++ /dev/null
@@ -1,29 +0,0 @@
-module.exports = {
-  product: "Argo Tunnel",
-  pathPrefix: "/argo-tunnel",
-  productIconKey: "argo-tunnel",
-  contentRepo: "cloudflare/cloudflare-docs",
-  contentRepoFolder: "products/argo-tunnel",
-  externalLinks: [
-    {
-      title: "Argo Tunnel home",
-      url: "https://www.cloudflare.com/products/argo-tunnel/"
-    },
-    {
-      title: "cloudflared on GitHub",
-      url: "https://github.com/cloudflare/cloudflared"
-    }
-  ],
-  search: {
-    indexName: "developers-cloudflare",
-    apiKey: "b23088ab4d346409f9d3ece6606344c3",
-    algoliaOptions: { 'facetFilters': '["project:argo-tunnel"]'}
-  },
-  siteMetadata: {
-    title: "Cloudflare Argo Tunnel docs",
-    description: "Argo Tunnel exposes applications running on your local web server, on any network with an Internet connection, without adding DNS records or configuring a firewall or router. It just works.",
-    author: "@cloudflare",
-    url: "https://developers.cloudflare.com/argo-tunnel",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
-  }
-}
diff --git a/products/argo-tunnel/src/content/configuration/arguments.md b/products/argo-tunnel/src/content/configuration/arguments.md
deleted file mode 100644
index dbf78de4142..00000000000
--- a/products/argo-tunnel/src/content/configuration/arguments.md
+++ /dev/null
@@ -1,207 +0,0 @@
----
-order: 1
----
-
-# Arguments
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Tunnel commands
-
-All tunnel-related commands are prefixed with `tunnel`. For example:
-
-```sh
-$ cloudflared tunnel --origincert ~/cert.pem --config ~/tunnel.yaml run mytunnel
-```
-
-Tunnel-related commands include creating, deleting and running tunnels with
-
-```sh
-$ cloudflared tunnel create <TUNNELNAME>
-$ cloudflared tunnel delete <TUNNELNAME>
-$ cloudflared tunnel run    <TUNNELNAME>
-```
-
-You can also list all tunnels with
-
-```sh
-$ cloudflared tunnel list
-```
-
-- [Tunnel commands](#tunnel-commands)
-  - [`--config`](#--config)
-  - [`--autoupdate-freq`](#--autoupdate-freq)
-  - [`--no-autoupdate`](#--no-autoupdate)
-  - [`--origincert`](#--origincert)
-  - [`--no-tls-verify`](#--no-tls-verify)
-  - [`--metrics`](#--metrics)
-  - [`--metrics-update-freq`](#--metrics-update-freq)
-  - [`--tag`](#--tag)
-  - [`--loglevel`](#--loglevel)
-  - [`--proto-loglevel`](#--proto-loglevel)
-  - [`--retries`](#--retries)
-  - [`--pidfile`](#--pidfile)
-  - [`--logfile`](#--logfile)
-  - [`--help`](#--help)
-  - [`--version`](#--version)
-- [Login command](#login-command)
-- [Service commands](#service-commands)
-- [Update command](#update-command)
-
-### `--config`
-
-| Syntax | Default |
-|--|--|
-| `--config value` | `~/.cloudflared/config.yml` |
-
-Specifies a config file in YAML format.
-
-### `--autoupdate-freq`
-
-| Syntax | Default |
-|--|--|
-| `--autoupdate-freq` | `24h` |
-
-Autoupdate frequency. See also [`--no-autoupdate`](#no-autoupdate).
-
-### `--no-autoupdate`
-
-| Syntax | Default |
-|--|--|
-| `--no-autoupdate` | `false` |
-
-Disables periodic check for updates, restarting the server with the new version. See also [`--autoupdate-freq`](#autoupdate-freq). Restarts are performed by spawning a new process that connects to the Cloudflare edge. On successful connection, the old process will gracefully shut down after handling all outstanding requests.
-
-### `--origincert`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--origincert value` | `~/.cloudflared/cert.pem` | `TUNNEL_ORIGIN_CERT` |
-
-Specifies the Tunnel certificate for one of your zones, authorizing the client to serve as an origin for that zone. A certificate is required to use Argo Tunnel. You can obtain a certificate by using the login command or by visiting `https://dash.cloudflare.com/argotunnel`.
-
-### `--no-tls-verify`
-
-| Syntax | Default |
-|--|--|
-| `--no-tls-verify` | `false` |
-
-Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
-The connection from your machine to Cloudflare's Edge is still encrypted and verified using TLS.
-
-### `--metrics`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--metrics value` | `localhost:` | `TUNNEL_METRICS` |
-
-Address to query for usage metrics.
-
-### `--metrics-update-freq`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--metrics-update-freq duration` | `5s` | `TUNNEL_METRICS_UPDATE_FREQ` |
-
-Frequency to update tunnel metrics.
-
-### `--tag`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--tag KEY=VALUE` | `TUNNEL_TAG` |
-
-Custom tags used to identify this tunnel, in format `KEY=VALUE`. Multiple tags may be specified by delimiting them with commas e.g. `KEY1=VALUE1`,`KEY2=VALUE2`.
-
-### `--loglevel`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--loglevel value` | `info` | `TUNNEL_LOGLEVEL` |
-
-Specifies the verbosity of logging. The default `info` is not noisy, but you may wish to run with `warn` in production. Available options: `panic` `fatal` `error` `warn` `info` `debug`
-
-### `--proto-loglevel`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--proto-loglevel` | `warn` | `TUNNEL_PROTO_LOGLEVEL` |
-
-Specifies the verbosity of the HTTP/2 protocol logging. Any value below `warn` is noisy and should only be used to debug low-level performance issues and protocol quirks.
-
-### `--retries`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--retries value` | `5` | `TUNNEL_RETRIES` |
-
-Maximum number of retries for connection/protocol errors. Retries use exponential backoff (retrying at 1, 2, 4, 8, 16 seconds by default) so increasing this value significantly is not recommended.
-
-### `--pidfile`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--pidfile value` | `TUNNEL_PIDFILE` |
-
-Write the application's PID to this file after the first successful connection. Mainly useful for scripting and service integration.
-
-### `--logfile`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--logfile value` | `TUNNEL_LOGFILE` |
-
-Save application log to this file. Mainly useful for reporting issues.
-
-### `--help`
-
-| Syntax |
-|--|
-| `--help` |
-
-Shows help text.
-
-### `--version`
-
-| Syntax |
-|--|
-| `--version` |
-
-Prints the version number and build date.
-
-## Login command
-
-```sh
-$ cloudflared tunnel login
-```
-
-Opens a special section of the Cloudflare dashboard for obtaining a Tunnel certificate.
-
-It should open your browser automatically and prompt you to log in to your Cloudflare account (unless you previously logged in with 'Remember me' selected). If running cloudflared on a server, you will be given an URL that you can visit on another machine.
-After logging in, a list of your zones will appear. Select the zone you want to use Argo Tunnel with. After confirming your authorization, the certificate should be sent to the Tunnel client and saved to `.cloudflared/cert.pem` in your user folder. If this process fails for any reason, the certificate will instead be downloaded by your browser and you will have to copy the file manually to that location.
-You can also obtain a Tunnel certificate independently of this command by visiting `https://dash.cloudflare.com/argotunnel`.
-
-## Service commands
-
-```sh
-$ cloudflared service install
-```
-
-```sh
-$ cloudflared service uninstall
-```
-
-Install or uninstall cloudflared as a system service. The details of service installation depend on the OS you are using.
-
-## Update command
-
-```sh
-$ cloudflared update
-```
-
-Looks for a new version on the official download server. If a new version exists, updates the agent binary and quits. Otherwise, it does nothing.
-To determine if an update happened in a script, check for error code 64.
diff --git a/products/argo-tunnel/src/content/configuration/config.md b/products/argo-tunnel/src/content/configuration/config.md
deleted file mode 100644
index 6dd127051a1..00000000000
--- a/products/argo-tunnel/src/content/configuration/config.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-order: 1
----
-
-# Config file
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can run `cloudflared` with [Arguments](/configuration/arguments) from the command line or  a configuration file.
-
-The configuration file format uses [YAML syntax](http://www.yaml.org/start.html). Every command-line argument of cloudflared can be expressed in YAML.
-
-For example, the `--hostname [hostname]` argument is written in the config file as:
-
-```yml
-hostname: [hostname]
-```
-
-## Default behavior
-
-You can specify a particular Tunnel in the config file by name or ID. When the following stanza is present in the file, the command `cloudflared tunnel run` will be treated as if `cloudflared tunnel run NAME-OR-ID` was run.
-
-```yml
-tunnel: NAME-OR-ID
-```
-
-## File location
-
-You can use `--config` to point to a non-standard YAML file location:
-
-```sh
-$ cloudflared tunnel --config tunnels/config.yml run
-```
-
-Without specifying `--config`, `cloudflared` will default to reading `~/.cloudflared/config.yml`.
-An example `config.yml` for the above command could look like:
-
-```yml
-hostname: tunnel.yourdomain.com
-url: http://localhost:8000
-logfile: /var/log/cloudflared.log
-```
-
-Flags that don't expect any value (such as `--hello-world`) should be specified as boolean `true` in the YAML:
-
-```yml
-hello-world: true
-```
-
-See the full set of [command-line arguments](/configuration/arguments).
diff --git a/products/argo-tunnel/src/content/configuration/index.md b/products/argo-tunnel/src/content/configuration/index.md
deleted file mode 100644
index 9a449536247..00000000000
--- a/products/argo-tunnel/src/content/configuration/index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-order: 4
----
-
-# Configure a Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can run `cloudflared` with arguments from the command line, or with a configuration file. This section covers:
-
-* A list of [arguments](/configuration/arguments) and their descriptions
-* An overview of the structure of the [configuration file](/configuration/config)
diff --git a/products/argo-tunnel/src/content/configuration/ingress.md b/products/argo-tunnel/src/content/configuration/ingress.md
deleted file mode 100644
index b9a7c555b51..00000000000
--- a/products/argo-tunnel/src/content/configuration/ingress.md
+++ /dev/null
@@ -1,312 +0,0 @@
----
-order: 20
----
-
-# Ingress rules
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can configure ingress rules to proxy traffic from multiple hostnames to multiple services using a single instance of `cloudflared` and a single Argo Tunnel.
-
-Each incoming request received by `cloudflared` causes `cloudflared` to send a request to a local service.
-By configuring **ingress rules** in the [configuration file](/configuration/config), you can specify which local services a request should be proxied to.
-
-You can define ingress rules inside of the configuration file.
-
-## Requirements
-
-Configuration files that contain ingress rules must always include a catch-all rule that concludes the ingress file.
-
-In the following example, `- service: http_status:404` serves as the catch-all rule for the file.
-
-The file also includes the Tunnel UUID, path to the credentials file, and two ingress rules. The Tunnel UUID or name can alternatively be specified in the `tunnel run` command and the path to the credentials file can be excluded if it is located at the default filepath.
-
-```yml
-tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
-credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
-
-ingress:
-  - hostname: gitlab.widgetcorp.tech
-    service: http://localhost:80
-  - hostname: gitlab-ssh.widgetcorp.tech
-    service: ssh://localhost:22
-  - service: http_status:404
-```
-
-## Matching traffic
-
-When `cloudflared` gets an incoming request, it evaluates each ingress rule from top to bottom to find which rule matches the request. Rules can match either the hostname or path of an incoming request, or both.
-
-If a rule doesn't specify a hostname, all hostnames will be matched. If a rule doesn't specify a path, all paths will be matched.
-
-The last rule you list in the config file must be a catch-all rule that matches all traffic.
-
-This is an example config file that specifies several different rules:
-
-```yml
-tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
-credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
-
-ingress:
-  # Rules map traffic from a hostname to a local service:
-  - hostname: example.com
-    service: https://localhost:8000
-  # Rules can match the request's path to a regular expression:
-  - hostname: static.example.com
-    path: /*.(jpg|png|css|js)
-    service: https://localhost:8001
-  # Rules can match the request's hostname to a wildcard character:
-  - hostname: "*.example.com"
-    service: https://localhost:8002
-  # An example of a catch-all rule:
-  - service: https://localhost:8003
-```
-
-## Supported protocols
-
-In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and unix sockets. See a [list of supported protocols](https://developers.cloudflare.com/access/protocols-and-connections).
-
-You can also route traffic to the built-in *Hello World* test server. This is useful when you need to test your Argo Tunnel protocol.
-
-```yml
-tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
-credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
-
-ingress:
-  # Example of a request over TCP:
-  - hostname: example.com
-    service: tcp://localhost:8000
-  # Example of a request over a Unix socket:
-  - hostname: staging.example.com
-    service: unix:/home/production/echo.sock
-  # Example of a request mapping to the Hello World test server:
-  - hostname: test.example.com
-    service: hello_world
-  # Example of a rule responding to traffic with an HTTP status:
-  - service: http_status:404
-```
-
-With the catch-all rule, you can set `cloudflared` to respond to traffic with an HTTP status.
-
-| Service | Description | Example `service` value |
-|--|--|--|--|
-| HTTP/S | Incoming HTTP requests are proxied directly to your local service | `https://localhost:8000` |
-| HTTP/S over unix socket | Just like HTTP/S, but using a unix socket instead | `unix:/home/production/echo.sock` |
-| TCP, RDP, SSH, SMB, kubectl to a single address | TCP requests are proxied to your local service. [Learn more](https://developers.cloudflare.com/access/protocols-and-connections). | `ssh://localhost:2222` |
-| TCP, RDP, SSH, SMB, kubectl bastion mode | `cloudflared` will act like a jumphost, allowing access to any local address. | `bastion` |
-| Hello World | Test server for validating your Argo Tunnel setup | `hello_world` |
-| HTTP status | Responds to all requests with the given HTTP status | `http_status:404` |
-
-## Single-service configuration
-
-If you need to proxy traffic to only one local service, you can do so using the config file. As an alternative, you can set up single-service configurations using command line flags.
-
-This is an example of a single service configured on the command line:
-
-```bash
-cloudflared tunnel --url localhost:8000 --no-chunked-encoding run mytunnel
-```
-
-## Validating your configuration
-
-To validate the ingress rules in your configuration file, run:
-
-```bash
-$ cloudflared tunnel ingress validate
-```
-
-This will ensure that the set of ingress rules specified in your config file is **valid**.
-
-## Testing your configuration
-
-To verify that `cloudflared` will proxy the right traffic to the right local service, use `cloudflared tunnel ingress rule`. This checks a URL against every rule, from first to last, and shows the first rule that matches. For example:
-
-```bash
-$ cloudflared tunnel ingress rule https://foo.example.com
-Using rules from /usr/local/etc/cloudflared/config.yml
-Matched rule #3
-	hostname: *.example.com
-	service: https://localhost:8000
-```
-
-## Origin configurations
-
-You can define the way that `cloudflare` sends requests to each service by specifying additional configuration options. The following example sets a 30-second connection timeout for all services except for one.
-
-```yml
-tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
-credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
-originRequest: # Root-level configuration
-  connectTimeout: 30s
-
-ingress:
-  # This service inherits all configuration from the root-level config, i.e.
-  # it will use a connectTimeout of 30 seconds.
-  - hostname: example.com
-    service: localhost:8000
-  - hostname: example2.com
-    service: localhost:8001
-  # This service overrides some root-level config.
-  - service: localhost:8002
-    originRequest:
-      connectTimeout: 10s
-      disableChunkedEncoding: true
-  # Some built-in services (like `http_status`) don't use any config. So, this
-  # rule will inherit all the config, but won't actually use it (because it just
-  # responds with HTTP 404).
-  - service: http_status:404
-```
-
-You can use the following configuration options inside of an ingress rule.
-
-- [connectTimeout](#connectTimeout)
-- [tlsTimeout](#tlsTimeout)
-- [tcpKeepAlive](#tcpKeepAlive)
-- [noHappyEyeballs](#noHappyEyeballs)
-- [keepAliveConnections](#keepAliveConnections)
-- [keepAliveTimeout](#keepAliveTimeout)
-- [httpHostHeader](#httpHostHeader)
-- [originServerName](#originServerName)
-- [caPool](#caPool)
-- [noTLSVerify](#noTLSVerify)
-- [disableChunkedEncoding](#disableChunkedEncoding)
-- [proxyAddress](#proxyAddress)
-- [proxyPort](#proxyPort)
-- [proxyType](#proxyType)
-
-<div id="connectTimeout">
-
-## connectTimeout
-</div>
-
-Default: `30s`
-
-Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to
-establish TLS, which is controlled by [tlsTimeout]({{< ref "#tlsTimeout" >}}).
-
-<div id="tlsTimeout">
-
-## tlsTimeout
-</div>
-
-Default: `10s`
-
-Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
-
-<div id="tcpKeepAlive">
-
-## tcpKeepAlive
-</div>
-
-Default: `30s`
-
-The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
-
-<div id="noHappyEyeballs">
-
-## noHappyEyeballs
-</div>
-
-Default: `false`
-
-Disable the "happy eyeballs" algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
-
-<div id="keepAliveConnections">
-
-## keepAliveConnections
-</div>
-
-Default: `100`
-
-Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
-
-<div id="keepAliveTimeout">
-
-## keepAliveTimeout
-</div>
-
-Default: `1m30s`
-
-Timeout after which an idle keepalive connection can be discarded.
-
-<div id="httpHostHeader">
-
-## httpHostHeader
-</div>
-
-Default: `""`
-
-Sets the HTTP Host header on requests sent to the local service.
-
-<div id="originServerName">
-
-## originServerName
-</div>
-
-Default: `""`
-
-Hostname that `cloudflared` should expect from your origin server certificate.
-
-<div id="caPool">
-
-## caPool
-</div>
-
-Default: `""`
-
-Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
-
-<div id="noTLSVerify">
-
-## noTLSVerify
-</div>
-
-Default: `false`
-
-Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
-
-<div id="disableChunkedEncoding">
-
-## disableChunkedEncoding
-</div>
-
-Default: `false`
-
-Disables chunked transfer encoding. Useful if you are running a WSGI server.
-
-<div id="proxyAddress">
-
-## proxyAddress
-</div>
-
-Default: `127.0.0.1`
-
-`cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying e.g. SSH or RDP.
-This configures the listen address for that proxy.
-
-<div id="proxyPort">
-
-## proxyPort
-</div>
-
-Default: `0`
-
-`cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying e.g. SSH or RDP.
-This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen.
-
-<div id="proxyType">
-
-## proxyType
-</div>
-
-Default: `""`
-
-`cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying e.g. SSH or RDP.
-This configures what type of proxy will be started. Valid options are
-
- - "" for the regular proxy
- - "socks" for a SOCKS5 proxy. See [kubectl](https://developers.cloudflare.com/access/other-protocols/kubectl) for more.
diff --git a/products/argo-tunnel/src/content/configuration/origins-via-cli.md b/products/argo-tunnel/src/content/configuration/origins-via-cli.md
deleted file mode 100644
index c54019c99bb..00000000000
--- a/products/argo-tunnel/src/content/configuration/origins-via-cli.md
+++ /dev/null
@@ -1,140 +0,0 @@
----
-order: 11
----
-
-# Legacy: Configuring Origins via CLI
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-`cloudflared` proxies traffic to local services running on your origin. You can configure the exact properties of each
-origin by adding stanzas to the [Ingress Rules](/configuration/ingress#origin-configurations). However, if you only want to proxy
-traffic to a single local service, you can use CLI flags instead of YAML to configure that service.
-
-- [`--url`](#--url)
-- [`--hostname`](#--hostname)
-- [`--lb-pool`](#--lb-pool)
-- [`--origin-ca-pool`](#--origin-ca-pool)
-- [`--origin-server-name`](#--origin-server-name)
-- [`--no-chunked-encoding`](#--no-chunked-encoding)
-- [`--hello-world`](#--hello-world)
-- [`--proxy-connect-timeout`](#--proxy-connect-timeout)
-- [`--proxy-tls-timeout`](#--proxy-tls-timeout)
-- [`--proxy-tcp-keepalive`](#--proxy-tcp-keepalive)
-- [`--proxy-no-happy-eyeballs`](#--proxy-no-happy-eyeballs)
-- [`--proxy-keepalive-connections`](#--proxy-keepalive-connections)
-- [`--proxy-keepalive-timeout`](#--proxy-keepalive-timeout)
-- [`--socks5`](#--socks5)
-
-### `--url`
-
-| Syntax | Default | Environment Variable |
-|--|--|--|
-| `--url URL` | `http://localhost:8080` | `TUNNEL_URL` |
-
-Connects to the local webserver at `URL`.
-
-### `--hostname`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--hostname value` | `TUNNEL_HOSTNAME` |
-
-Sets a hostname on a Cloudflare zone to route traffic through this tunnel.
-
-### `--lb-pool`
-
-| Syntax |
-|--|
-| `--lb-pool POOL_NAME` |
-
-Add this tunnel to a Load Balancer pool. If it doesn’t already exist a load balancer will be created for the hostname of your tunnel, and a pool will be created with the pool name you specify. Traffic destined to that pool will be load balanced across this tunnel and any other tunnels which share its pool name.
-
-### `--origin-ca-pool`
-
-| Syntax |
-|--|
-| `--origin-ca-pool value` |
-
-Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
-
-### `--origin-server-name`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--origin-server-name value` | `TUNNEL_ORIGIN_SERVER_NAME` |
-
-### `--no-chunked-encoding`
-
-| Syntax | Default |
-|--|--|
-| `--no-chunked-encoding` | `false` |
-
-Disables chunked transfer encoding; useful if you are running a WSGI server.
-
-### `--hello-world`
-
-| Syntax | Environment Variable |
-|--|--|
-| `--hello-world` | `TUNNEL_HELLO_WORLD` |
-
-Use the established tunnel to expose a `Hello world` HTTP server for testing Argo Tunnel. Mutually exclusive with the `--url argument`.
-
-### `--proxy-connect-timeout`
-
-| Syntax | Default |
-|--|--|
-| `--proxy-connect-timeout value` | `30s` |
-
-Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [--proxy-tls-timeout](#proxy-tls-timeout).
-
-### `--proxy-tls-timeout`
-
-| Syntax | Default |
-|--|--|
-| `--proxy-tls-timeout value` | `10s` |
-
-Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
-
-### `--proxy-tcp-keepalive`
-
-| Syntax | Default |
-|--|--|
-| `--proxy-tcp-keepalive value` | `30s` |
-
-The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
-
-### `--proxy-no-happy-eyeballs`
-
-| Syntax |
-|--|
-| `--proxy-no-happy-eyeballs` |
-
-Disable the "happy eyeballs" algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
-
-### `--proxy-keepalive-connections`
-
-| Syntax | Default |
-|--|--|
-| `--proxy-keepalive-connections value` | `100` |
-
-Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
-
-### `--proxy-keepalive-timeout`
-
-| Syntax | Default |
-|--|--|
-| `--proxy-keepalive-timeout value` | `1m30s` |
-
-Timeout after which an idle keepalive connection can be discarded.
-
-### `--socks5`
-
-| Syntax | Default |
-|--|--|
-| `--socks5=value` | `true` |
-
-See [kubectl](https://developers.cloudflare.com/access/other-protocols/kubectl) for example usage.
diff --git a/products/argo-tunnel/src/content/create-tunnel/index.md b/products/argo-tunnel/src/content/create-tunnel/index.md
deleted file mode 100644
index 0fa9e335fe7..00000000000
--- a/products/argo-tunnel/src/content/create-tunnel/index.md
+++ /dev/null
@@ -1,85 +0,0 @@
----
-order: 3
----
-
-# Create a Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website) |
-| 2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708) |
-| 3. [Install `cloudflared` and authenticate the software](/getting-started) |
-| 4. [Understand the overview for using Argo Tunnels](/getting-started/high-level-steps) |
-
-## Create a Tunnel
-
-<Aside>
-
-Argo Tunnels created in this method do not currently display in the Traffic tab of the Cloudflare dashboard. These connections will be added to the dashboard in a future release.
-
-</Aside>
-
-Run the following command to create a Tunnel.
-
-```sh
-$ cloudflared tunnel create <NAME>
-```
-
-Replace `<NAME>` with the name you want to give to the Tunnel. The name assigned can be any string and does not need to relate to the hostname where traffic will be served.
-
-This command will create a Tunnel with the name provided and associate it with a UUID. The relationship between the UUID and the name is persistent. The command will not create a connection at this point.
-
-![Create a tunnel](../static/img/create-tunnel/ct1.png)
-
-Creating a Tunnel generates a credentials file for that specific Tunnel. This file is distinct from the cert.pem file. To run the Tunnel without managing DNS from `cloudflared`, you only need the credentials file.
-
-<TableWrap>
-
-| Action | `cert.pem` | Credentials file |
-|---|---|---|
-| Create a new Tunnel | Required | - |
-| Delete a Tunnel | Required | - |
-| Run a Tunnel | Available | Required |
-| Create DNS records<br/>from `cloudflared` | Required | - |
-| Connect to load balancer<br/>pools from `cloudflared` | Required | - |
-| Route traffic to a running Tunnel<br/>from the Cloudflare dashboard | Available | Available |
-
-</TableWrap>
-
-## List available Tunnels
-
-`cloudflared` can list all created Tunnels in your account, as well as those actively connected to Cloudflare, by running the following command:
-
-```sh
-cloudflared tunnel list
-```
-
-Note: the command requires the `cert.pem` file.
-
-![List tunnels](../static/img/create-tunnel/lt1.png)
-
-## Revoke and delete a Tunnel
-
-You can delete an existing Tunnel with cloudflared. To delete a Tunnel, run the following command:
-
-```sh
-$ cloudflared tunnel delete <NAME>
-```
-
-Note: the command requires the `cert.pem` file.
-
-If there are still active connections on that tunnel, then you will have to force the deletion with:
-
-```sh
-$ cloudflared tunnel delete -f <NAME>
-```
-
-This will cause those connections to be dropped.
-
-Deleting the tunnel also invalidates the credentials file associated with that Tunnel, meaning those connections can not be re-established again.
diff --git a/products/argo-tunnel/src/content/create-tunnel/kubernetes-sidecar-model.md b/products/argo-tunnel/src/content/create-tunnel/kubernetes-sidecar-model.md
deleted file mode 100644
index 5af86244d64..00000000000
--- a/products/argo-tunnel/src/content/create-tunnel/kubernetes-sidecar-model.md
+++ /dev/null
@@ -1,203 +0,0 @@
----
-order: 1
-hidden: true
----
-
-# Run as a Kubernetes sidecar
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Running Argo Tunnel in a sidecar model is meant as an
-alternative to the Argo Tunnel Ingress Controller. The two should not be used
-simultaneously.
-
-</Aside>
-
-## Sidecar model background
-
-A Kubernetes [pod](https://kubernetes.io/docs/concepts/workloads/pods/pod/) consists of
-one or more containers that share storage and network. Pods are defined by a
-configuration file that determines the deployment of the containers, typically
-in a YAML file.
-
-Containers within a pod share an IP address space and can address each other over
-localhost. Argo Tunnel can be run as a sidecar in a pod - a separate container
-that performs its own function distinct from the application container.
-
-In this model, the Argo Tunnel daemon, `cloudflared`, runs in its own container
-and connects to the Cloudflare network to proxy requests for an associated
-hostname. The `cloudflared` container will then send those requests to port
-80 on the application container over the common localhost in the Pod using the
-shared IP address space.
-
-## Docker image
-
-Cloudflare publishes an official Docker image of `cloudflared` available on [DockerHub](https://hub.docker.com/r/cloudflare/cloudflared).
-
-Alternatively, you can build your own image. `cloudflared` is written in Go and can be built
-in a Docker container by generating a Dockerfile that defines the Go
-version, the working directory, and the steps to run and install the application.
-
-Once built, the image will need to be pushed to a container registry that the
-Kubernetes cluster can reach (whether a private registry or a public one like Docker Hub or Google Container Registry).
-
-## Secret generation
-
-Even though Kubernetes will grab the `cloudflared` image from a container
-registry, the sidecar model still needs a mechanism for authentication.
-Argo Tunnel authenticates machines to a hostname using a certificate
-downloaded on the origin when the user logs in to their Cloudflare
-account.
-
-Before deploying to a cluster, that certificate must be converted into a
-**Kubernetes secret**. A Kubernetes secret is an object that Kubernetes can securely use to configure the pod while reducing the risk of exposure of sensitive data.
-
-To generate a Kubernetes secret:
-
-1. Download `cloudflared` in a development environment and follow the steps to authenticate the tool with the corresponding Cloudflare account.
-
-2. Identify the path where the certificate was downloaded and convert it into a Kubernetes secret with the following command:
-
-```sh
-$ kubectl create secret generic example.com --from-file="$HOME/.cloudflared/cert.pem"
-```
-
-3. Ensure the secret was generated successfully with the following command:
-
-```sh
-$ kubectl get secret
-```
-
-4. The output will list the secret and its details in the following format:
-
-```txt
-NAME                TYPE         DATA AGE
-----                ----         ---- ---
-example.com         opaque       3    42s
-```
-
-## Pod configuration
-
-Kubernetes can use YAML files to configure the settings for the
-deployment of a Pod to a given cluster. In the sidecar model,
-`cloudflared` must be defined as a "kind: Deployment" section. The
-configuration file must include the arguments used to start Argo Tunnel,
-as well as the reference to the generated secret.
-
-Additionally, you will need to use the flag `--no-auto-update` to ensure that the
-`cloudflared` update process does not cause the container to crash on launch. In
-some cases, the auto-update flow can cause the container to launch a new process
-as PID 1, which causes the container to crash.
-
-```yaml
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: hello
-  name: hello
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort:
-// targetPort defaults to the port configured above if left blank.
-  selector:
-    app: hello
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  labels:
-    app: hello
-  name: hello
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hello
-  template:
-    metadata:
-      labels:
-        app: hello
-    spec:
-      containers:
-      - name: hello
-        image: gcr.io/google-samples/gb-frontend:v4
-        imagePullPolicy: Always
-        env:
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        ports:
-        - containerPort: 80
-        resources:
-          limits:
-            cpu: 100m
-            memory: 40Mi
-          requests:
-            cpu: 20m
-            memory: 40Mi
-      - name: tunnel
-        image: docker.io/cloudflare/cloudflared:2020.7.1
-        imagePullPolicy: Always
-        command: ["cloudflared", "tunnel"]
-        args:
-        - --url=http://127.0.0.1:80
-        - --hostname=hello.example.com
-        - --origincert=/etc/cloudflared/cert.pem
-        - --no-autoupdate
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        resources:
-          limits:
-            cpu: 10m
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 20Mi
-        volumeMounts:
-        - mountPath: /etc/cloudflared
-          name: tunnel-secret
-          readOnly: true
-      terminationGracePeriodSeconds: 60
-      volumes:
-      - name: tunnel-secret
-        secret:
-          secretName: example.com
----
-```
-
-The example file above defines the deployment of "hello" as both a
-container and a service that will serve requests on port 8080. Below those
-definitions, the file sets arguments for `cloudflared`
-`--url` specifies the destination of proxied requests
-`--hostname` specifies the DNS hostname exposed to the public internet
diff --git a/products/argo-tunnel/src/content/downloads/index.md b/products/argo-tunnel/src/content/downloads/index.md
deleted file mode 100644
index ac2305e7f4c..00000000000
--- a/products/argo-tunnel/src/content/downloads/index.md
+++ /dev/null
@@ -1,109 +0,0 @@
----
-order: 100
-hidden: true
----
-
-# Downloads
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
---------------------------------
-
-## Linux
-
-Downloads are available for amd64, x86 and ARMv6 in several forms:
-
-* Standalone binary
-* .deb package for Debian and derivatives (Ubuntu etc.)
-* .rpm package for CentOS, RHEL 7, etc.
-
-Type   | amd64 / x86-64 | x86 (32-bit) | ARMv6 | ARM64 |
--------|----------------|--------------|------|------|
-Binary | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.tgz) | [Download](https://github.com/cloudflare/cloudflared/releases/download/2020.8.2/cloudflared-linux-arm64) |
-.deb   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.deb) | - |
-.rpm   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.rpm) | - |
-
-You can also download packages from [Cloudflare's package repository](https://pkg.cloudflare.com).
-
---------------------------------
-
-## macOS
-
-Argo Tunnel can also be installed via [Homebrew](https://brew.sh):
-
-```sh
-$ brew install cloudflare/cloudflare/cloudflared
-```
-
-Install via Terminal:
-
-```sh
-$ curl https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-darwin-amd64.tgz | tar xzC /usr/local/bin
-```
-
---------------------------------
-
-## Windows
-
-Downloads are available in ZIP format for [32-bit](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-386.zip) and [64-bit](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-amd64.zip) versions.
-
-Go to Downloads folder, right-click on the zip folder and select "Extract All" to extract the executable.
-Open Powershell and navigate to the Downloads folder
-
-```bash
-PS C:\Users\Administrator> cd .\Downloads\
-PS C:\Users\Administrator\Downloads> ls
-
-
-    Directory: C:\Users\Administrator\Downloads
-
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
-d-----         4/2/2018  10:57 PM                cloudflared-stable-windows-amd64
--a----         4/2/2018  10:54 PM        7021519 cloudflared-stable-windows-amd64.zip
-
-PS C:\Users\Administrator\Downloads> cd .\cloudflared-stable-windows-amd64\
-PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> ls
-
-
-    Directory: C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64
-
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
-------         4/2/2018   7:04 PM       25781248 cloudflared.exe
-```
-
-Run the `cloudflared.exe` executable to ensure that it works properly on your computer:
-
-```bash
-PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version
-cloudflared version 2018.4.8 (built 2018-04-26-1817 UTC)
-```
-
-To spin up a tunnel, you will first need to log in with your Cloudflare account. Run `.\cloudflared.exe login` to spawn the login page in your web browser:
-
-```bash
-PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe login
-A browser window should have opened at the following URL:
-
-https://www.cloudflare.com/a/warp?callback=https%3A%2F%2Flogin.cloudflarewarp.com%2FP3P3TOWUADVHF6AH43ISGRWZOL257VNO5GLJTPBNCR5JDOMVLN2OTXON2ASJ6J4B
-
-If the browser failed to open, open it yourself and visit the URL above.
-```
-
-If the browser fails to open, right-click the login URL and navigate to it in the browser.
-
---------------------------------
-
-## New releases
-
-Cloudflare frequently updates `cloudflared` with new features and
-bug fixes. All releases and release notes are in the GitHub repository for the project.
-
-Check out the latest releases [here](https://github.com/cloudflare/cloudflared/releases).
diff --git a/products/argo-tunnel/src/content/faq/index.md b/products/argo-tunnel/src/content/faq/index.md
deleted file mode 100644
index aa9dc9467d3..00000000000
--- a/products/argo-tunnel/src/content/faq/index.md
+++ /dev/null
@@ -1,199 +0,0 @@
----
-order: 60
----
-
-# Troubleshooting and FAQ
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## General
-
-### What causes tunnels to fail to authenticate?
-To start using Argo Tunnel, a super administrator in the Cloudflare account must first log in through `cloudflared login`.
-The client will launch a browser window and prompt the user to select a hostname in their Cloudflare account. Once selected, Cloudflare generates a certificate that consists of three components:
-
-1. The public key of the origin certificate for that hostname
-2. The private key of the origin certificate for that domain
-3. A token that is unique to Argo Tunnel
-
-Those three components are bundled into a single PEM file that is downloaded one time
-during that login flow. The host certificate is valid for the root domain and any subdomain
-one-level deep. Cloudflare uses that certificate file to authenticate `cloudflared` to
-create DNS records for your domain in Cloudflare.
-
-The third component, the token, consists of the zone ID (for the selected domain) and
-an API token scoped to the user who first authenticated with the login command. When user
-permissions change (if that user is removed from the account or becomes an admin of another
-account, for example), Cloudflare rolls the user's API key. However, the certificate file
-downloaded through `cloudflared` retains the older API key and can cause authentication
-failures. The user will need to login once more through `cloudflared` to regenerate the
-certificate. Alternatively, the administrator can create a dedicated service user to authenticate.
-
-### What are the ports and IPs used by `cloudflared`?
-
-Users can implement a positive security model with Argo Tunnel by restricting traffic originating from cloudflared. The parameters below can be configured for egress traffic inside of a firewall.
-
-- TCP port 7844 (HTTPS)
-- IPs are those behind **region1.argotunnel.com** and **region2.argotunnel.com** \*
-
-Below the output of `dig` commands towards the above hostnames:
-
-```bash
-
-$ dig region1.argotunnel.com
-...
-
-;; ANSWER SECTION:
-region1.argotunnel.com.	86400	IN	A	198.41.192.7
-region1.argotunnel.com.	86400	IN	A	198.41.192.47
-region1.argotunnel.com.	86400	IN	A	198.41.192.107
-region1.argotunnel.com.	86400	IN	A	198.41.192.167
-region1.argotunnel.com.	86400	IN	A	198.41.192.227
-
-...
-
-$ dig region2.argotunnel.com
-
-...
-
-;; ANSWER SECTION:
-region2.argotunnel.com.	300	IN	A	198.41.200.193
-region2.argotunnel.com.	300	IN	A	198.41.200.233
-region2.argotunnel.com.	300	IN	A	198.41.200.13
-region2.argotunnel.com.	300	IN	A	198.41.200.53
-region2.argotunnel.com.	300	IN	A	198.41.200.113
-
-...
-```
-
-\* *These IP addresses are unlikely to change but in the event that they do, Cloudflare will update the information here.*
-
-### Can a user create an Argo Tunnel for an apex domain?
-
-No. Argo Tunnel will only create DNS records for subdomains.
-
-### Does Argo Tunnel support Websockets?
-
-Argo Tunnel has full support for Websockets.
-
-### How can Tunnel be used with Partial DNS (CNAME Setup)?
-
-Cloudflare offers two modes of setup: Full Setup, in which the domain uses Cloudflare DNS name servers, and Partial Setup (also known as CNAME setup) in which the domain uses non-Cloudflare DNS servers.
-
-The best experience with Argo Tunnel is using Full Setup because Cloudflare manages DNS for the domain and can automatically configure DNS records for newly started Tunnels.
-
-You can still use Tunnel with Partial Setup. You will need to create a new DNS record with your current DNS provider for each new hostname connected through Argo Tunnel. The DNS record should be of type CNAME or ALIAS if it is on the root of the domain. The name of the record should be the subdomain it corresponds to (e.g. example.com or tunnel.example.com) and the value of the record should be subdomain.domain.tld.cdn.cloudflare.net. (e.g. example.com.cdn.cloudflare.net or tunnel.example.com.cdn.cloudflare.net)
-
-### How are records managed after a Tunnel has been unregistered?
-
-Tunnel deletes DNS records after 24-48 hours of being unregistered. Tunnel does not delete TLS certificates on your behalf once the tunnel is shut down. If you want to clean up a tunnel you’ve shut down, you can delete DNS records [in the DNS editor](https://dash.cloudflare.com/?zone=dns) and revoke TLS certificates in the Origin Certificates section of the [SSL/TLS tab of the Cloudflare dashboard](https://dash.cloudflare.com?to=/:account/:zone/ssl-tls/origin).
-
-### Where can audit logs be found?
-
-Audit Logs for Tunnel are available in the [account section of the Cloudflare dashboard](https://dash.cloudflare.com/?account=audit-log) which you can find by clicking on your name or email in the upper right-hand corner of the dashboard. The following actions are logged:
-
-Action       | Description
--------------|--------------
-Registered   | This is logged when Tunnel is started and connects to the Cloudflare edge.
-Unregistered | This is logged when Tunnel is disconnected from the Cloudflare edge.
-CNAME add    | This is logged when Tunnel registers a new DNS (CNAME or AAAA) record for the tunneled application.
-
-#### How can origin servers be secured when using Tunnel?
-
-Tunnel can expose web applications to the internet that sit behind a NAT or firewall. Thus, you can keep your web server otherwise completely locked down. To double check that your origin web server is not responding to requests outside Cloudflare while Tunnel is running you can run netcat in the command line:
-
-```bash
-netcat -zv [your-server’s-ip-address] 80
-netcat -zv [your-server’s-ip-address] 443
-```
-
-If your server is still responding on those ports, you will see:
-
-```bash
-[ip-address] 80 (http) open
-```
-
-If your server is correctly locked down, you will see:
-
-```bash
-[ip-address] 443 (https): Connection refused
-```
-
-### Why does the name "warp" appear in some legacy materials?
-
-Argo Tunnel was previously named Warp during the beta phase. As Warp was added to the Argo product family, we changed the name to match.
-
-### What is the maximum number of tunnels that can be run per account?
-
-Argo Tunnel allows a maximum number of 1000 concurrently running tunnels per account.
-
-### How is traffic encrypted between Argo Tunnel and HTTPs origin servers?
-
-The Argo Tunnel daemon, `cloudflared`, performs its own SSL termination that is distinct from the origin.
-
-The data in transit between the Cloudflare network and the instance of `cloudflared` is encrypted according to the stages below.
-
-**`cloudflared` to Cloudflare**
-
-* When `cloudflared` reaches out to the Cloudflare network, the daemon validates a TLS server name for `cftunnel.com`.
-* The certificate is issued from a Cloudflare-managed root CA.
-
-Details for this flow are available in the `cloudflared` repository [here](https://github.com/cloudflare/cloudflared/blob/2020.2.0/tlsconfig/certreloader.go#L124).
-
-**`cloudflared` to origin**
-
-* `cloudflared` trusts the system's certificate pool. If you need to add an additional CA, you can do so by setting the `--origin-ca-pool` flag.
-* On Windows systems, the system certificate pool is not supported by the Go standard library used by `cloudflared`. As a result, Windows users will always need to set the `--origin-ca-pool` flag.
-* `cloudflared` uses the Go HTTP client to connect to the origin. The daemon connects to the URL specified with the `--url` flag, which determines the TLS server name.
-* When the Cloudflare network proxies a request through `cloudflared` to the origin, `cloudflared` converts this stream to an HTTP/1.1 [request](https://github.com/cloudflare/cloudflared/blob/2020.2.0/origin/tunnel.go#L591).
-* `cloudflared` then issues the request and [receives](https://github.com/cloudflare/cloudflared/blob/2020.2.0/origin/tunnel.go#L642) an HTTP/1.1 response from the origin, in plaintext, which is encrypted and sent back to the Cloudflare network.
-
-Details for this flow are available in the `cloudflared` repository [here](https://github.com/cloudflare/cloudflared/blob/2020.2.0/cmd/cloudflared/tunnel/configuration.go#L204).
-
-### What is the format of the output of the metrics endpoint in `cloudflared`?
-
-The output adheres to a standard [Prometheus metrics format](https://prometheus.io/docs/concepts/data_model/). The data can also [be added](https://prometheus.io/docs/introduction/first_steps/#configuring-prometheus) as a scrape target by a Prometheus server.
-
-### What is the difference between Tunnel creating a CNAME or AAAA record in the hostname's DNS setting?
-
-Tunnels that use Cloudflare's Load Balancer use CNAME records. Tunnels that do not use the Load Balancer product will create AAAA records.
-
-### Does Argo Tunnel send visitor IPs to my origin?
-
-No. When using Argo Tunnel, all requests to the origin are made internally between `cloudflared` and the origin.
-
-To log external visitor IPs, you will need to [configure an alternative method](https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-Logging-visitor-IP-addresses-with-mod-cloudflare-).
-
-### When does the cert.pem generated expire?
-The Argo Tunnel login command generates an origin certificate and a service token. Both are stored in the `cert.pem`. The origin certificate is valid for at least 10 years and the service token is valid until revoked.
-
-### How to revoke the credentials for a tunnel?
-When you (as an administrator in possession of the cert.pem obtained with `cloudflared login`) create a tunnel via
-`cloudflared tunnel create` this generates a JSON credentials file. That file can be distributed to other users (who do
-not have the cert.pem) and they will (only) be able to start connections to serve that tunnel origin.
-
-However, at some point in time you (as an administrator) may want to revoke those credentials. The correct way to do so
-is by [deleting that tunnel by its name](/create-tunnel). Doing so will stop the active
-connections and prevent users (in possession of the tunnel credentials file) from starting them again.
-
-### Did `cloudflared` run?
-
-```sh
-$ kubectl logs -lapp=hello -c tunnel
-```
-
-Returns logs from the cluster in the container, tunnel, where `cloudflared` is running as a sidecar.
-
-### Did the cluster's deployment fail?
-
-```sh
-$ kubectl describe po -lapp=hello
-```
-
-Returns information about the pod running the containers.
-Errors related to the failure to start the `cloudflared` process can be
-gathered with this command.
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/getting-started/high-level-steps.md b/products/argo-tunnel/src/content/getting-started/high-level-steps.md
deleted file mode 100644
index 80904b80908..00000000000
--- a/products/argo-tunnel/src/content/getting-started/high-level-steps.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-order: 3
----
-
-# Overview to using Argo Tunnels
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Get `cloudflared`](/getting-started/installation) |
-| 2. [Authenticate `cloudflared`](/getting-started/setup) |
-
-There are 3 high level steps towards setting up and running an Argo Tunnel:
- 1. [Create a Named Argo Tunnel](/create-tunnel)
- 2. [Route traffic to your Argo Tunnel](/routing-to-tunnel)
- 3. [Run your Argo Tunnel](/run-tunnel)
-
-Steps 1-2 are executed once per Tunnel, normally by an administrator, and Step 3
-is executed whenever the Tunnel is to be started, normally by the owner of the
-Tunnel (whom may be different from the administrator).
-
-Be sure to check out our [Tutorials](/learning/tutorials) where you can also find
-best practices for managing Tunnels as an administrator.
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/getting-started/index.md b/products/argo-tunnel/src/content/getting-started/index.md
deleted file mode 100644
index 286ff3c2c26..00000000000
--- a/products/argo-tunnel/src/content/getting-started/index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-order: 2
----
-
-# Getting started
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-This section covers:
- * How to [install](/getting-started/installation) `cloudflared`.
- * [Set up](/getting-started/setup) `cloudflared`.
- * [Overview to using Argo Tunnels](/getting-started/high-level-steps).
diff --git a/products/argo-tunnel/src/content/getting-started/installation.md b/products/argo-tunnel/src/content/getting-started/installation.md
deleted file mode 100644
index efc31fe3965..00000000000
--- a/products/argo-tunnel/src/content/getting-started/installation.md
+++ /dev/null
@@ -1,111 +0,0 @@
----
-order: 1
----
-
-# Installation
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. `cloudflared` is an [open source project](https://github.com/cloudflare/cloudflared) maintained by Cloudflare.
-
-Releases can be [found on GitHub](https://github.com/cloudflare/cloudflared/releases). Downloads are available as standalone binaries or packages like Debian and RPM.
-
-## Linux
-
-Type   | amd64 / x86-64 | x86 (32-bit) | ARMv6 | ARM64 |
--------|----------------|--------------|------|------|
-Binary | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.tgz) | [Download from GitHub](https://github.com/cloudflare/cloudflared/releases) |
-.deb   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.deb) | - |
-.rpm   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.rpm) | - |
-
-## Docker
-
-A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared).
-
-## macOS
-
-You can install `cloudflared` on macOS systems via Homebrew:
-
-```sh
-$ brew install cloudflare/cloudflare/cloudflared
-```
-
-Alternatively, you can download the latest Darwin amd64 release directly.
-
-## Windows
-
-Type   | 32-bit | 64-bit |
--------|----------------|-----|
-ZIP | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-386.zip) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-amd64.zip) |
-
-Once `cloudflared` is installed:
-1. Navigate to the **Downloads** folder.
-2. Right-click on the ZIP folder and select `Extract All` to extract the executable.
-3. Next, open PowerShell.
-4. Navigate to the same Downloads folder.
-5. Run the `cloudflared.exe` executable as an administrator to confirm the installation, replacing the path in the example below with the specifics of your directory:
-
-```sh
-PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version
-```
-
-The command above should output the version of `cloudflared` if successfully installed.
-
-<Aside>
-Instances of `cloudflared` do not automatically update on Windows. You will need to perform manual updates.
-</Aside>
-
-## Updating `cloudflared`
-
-You can update cloudflared by running the following command.
-
-```bash
-cloudflared update
-```
-
-The update will cause `cloudflared` to restart which would impact traffic currently being served. You can perform zero-downtime upgrades by using Cloudflare's Load Balancer product or by using multiple `cloudflared` instances.
-
-### Updating with Cloudflare Load Balancer
-
-We recommend this option if you are currently using Cloudflare's Load Balancer product with your Argo Tunnel deployment.
-
-1. Install a new instance of `cloudflared` and [create](/create-tunnel) a new Argo Tunnel.
-2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`.
-3. [Add the address](/routing-to-tunnel/lb) of the new instance of `cloudflared` into your Load Balancer pool as priority 2.
-4. Swap the priority such that the new instance is now priority 1 and monitor to confirm traffic is being served.
-5. Once confirmed, you can remove the older version from the Load Balancer pool.
-
-### Updating with multiple `cloudflared` instances
-
-1. Install a new instance of `cloudflared` and [create](/create-tunnel) a new Argo Tunnel.
-2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`.
-3. In the Cloudflare DNS dashboard, [replace](/routing-to-tunnel/dns) the address of the current instance of `cloudflared` with the address of the new instance. Save the record.
-4. Remove the now-inactive instance of `cloudflared`.
-
-
-#### Running multiple instances in Windows
-
-Windows systems require services to have a unique name and display name. You can run multiple instances of `cloudflared` by creating `cloudflared` services with unique names.
-
-First, install and configure `cloudflared`. Next, create a service with a unique name and point to the `cloudflared` executable and configuration file.
-
-`sc.exe create <unique-name> binPath='<path-to-exe>' --config '<path-to-config>' displayname="Unique Name"`
-
-Proceed to create additional services with unique names. You can now start each unique service.
-
-`sc.exe start <unique-name>`
-
-## Deprecated versions
-
-Cloudflare currently supports all versions of `cloudflared`. Starting on March 20, 2021, Cloudflare will no longer support versions released prior to 2020.5.1.
-
-All features available in versions released prior to 2020.5.1 are available in current versions. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1.
-
-| Version(s) | Deprecation status |
-|---|---|
-| 2020.5.1 and later | Supported |
-| Versions prior to 2020.5.1 | Will no longer be supported starting March 20, 2021 |
diff --git a/products/argo-tunnel/src/content/getting-started/setup.md b/products/argo-tunnel/src/content/getting-started/setup.md
deleted file mode 100644
index 05c6f4d8bec..00000000000
--- a/products/argo-tunnel/src/content/getting-started/setup.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-order: 2
----
-
-# Setup
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website) |
-| 2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708) |
-| 3. [Enable Argo Smart Routing for your account](https://support.cloudflare.com/hc/articles/115000224552-Configuring-Argo-through-the-UI) |
-| 4. [Install `cloudflared`](/getting-started/installation/) |
-
-Follow these steps to set up Cloudflare Argo Tunnel:
-
-1. Authenticate your instance `cloudflared` by logging in to your Cloudflare account with the following command:
-
-```sh
-$ cloudflared tunnel login
-```
-
-2. The command will attempt to open a browser and prompt you to authenticate with your Cloudflare account.
-
-  If running on a headless system, copy the link and paste it into a browser.
-
-3. Once authenticated, Cloudflare will return a certificate file, `cert.pem`, that will give this instance of `cloudflared` the ability to:
-    * Create and delete Tunnels
-    * Modify DNS records in your account
-
-The file is required if you want to:
-   * Create new Tunnels
-   * Change DNS routing from `cloudflared`
-
-The file is not required if you want to:
-  * Run an existing Tunnel
-  * Manage routing from the Cloudflare dashboard
diff --git a/products/argo-tunnel/src/content/glossary/index.md b/products/argo-tunnel/src/content/glossary/index.md
deleted file mode 100644
index d24f9ae8a17..00000000000
--- a/products/argo-tunnel/src/content/glossary/index.md
+++ /dev/null
@@ -1,260 +0,0 @@
----
-order: 200
----
-
-# Glossary
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## [Cloudflare for Teams](https://www.cloudflare.com/teams-home/)
-Cloudflare for Teams brings the power of Cloudflare’s global network to your internal teams and infrastructure. Teams empowers users with secure, fast and seamless access to any device on the Internet.
-
-## [Cloudflare Access](https://developers.cloudflare.com/access/)
-Cloudflare Access replaces corporate VPNs with Cloudflare’s network. Instead of placing internal tools on a private network, customers deploy them in any environment, including hybrid or multi-cloud models, and secure them consistently with Cloudflare’s network.
-
-## [Cloudflare Gateway](https://developers.cloudflare.com/gateway/)
-Cloudflare Gateway is a modern next generation firewall between your user, device or network and the public Internet. Once you setup Cloudflare Gateway, Gateway's DNS filtering service will inspect all Internet bound DNS queries, log them and apply corresponding policies.
-
-## [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/)
-A secure outbound connection which runs in your infrastructure to connect the applications and machines to Cloudflare.
-
-## [Cloudflare Workers](https://developers.cloudflare.com/workers/)
-Cloudflare Workers provides a serverless execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure.
-
----------------
-
-## Access App Launch
-The Access App Launch portal provides end users with a single dashboard from which they can open applications secured by Access.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Active zone
-A DNS zone is a portion of the DNS namespace that is managed by a specific organization or administrator. For a domain to be active on Cloudflare, its nameservers need to be changed to Cloudflare's.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Application (Access)
-
-The resource being protected by Cloudflare Access. An application can be a subdomain, a path, or a SaaS application.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Auth Domain
-The unique subdomain assigned to your Cloudflare account; for example, https://example.cloudflareaccess.com
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Authenticated Origin Pulls
-
-Authenticated Origin Pulls let origin web servers validate that a web request came from Cloudflare. Cloudflare uses TLS client certificate authentication, a feature supported by most web servers, to present a Cloudflare certificate when establishing a connection between Cloudflare and the origin web server.
-
-| Related products: | [Cloudflare SSL](https://developers.cloudflare.com/ssl/) |
-|---|---|
-
-## cloudflared
-
-`cloudflared` is the software that powers Argo Tunnel. `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## daemon
-A program that performs tasks without active management or maintenance.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## DoH
-*DNS over HTTPS*
-
-With DoH, DNS queries and responses are encrypted, and they are sent via the HTTP or HTTP/2 protocols. Like [DoT](#DoT), DoH ensures that attackers can't forge or alter DNS traffic. DoH traffic looks like other HTTPS traffic – e.g. normal user-driven interactions with websites and web apps – from a network administrator's perspective.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## DNS filtering
-
-DNS filtering is the process of using the Domain Name System to block malicious websites and filter out harmful or inappropriate content. This ensures that company data remains secure and allows companies to have control over what their employees can access on company-managed networks. DNS filtering is often part of a larger access control strategy.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## DNS server
-
-Each device connected to the Internet has a unique IP address which other machines use to find the device. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## DoT
-*DNS over TLS*
-
-DNS over TLS, or DoT, is a standard for encrypting DNS queries to keep them secure and private. DoT uses the same security protocol, TLS, that HTTPS websites use to encrypt and authenticate communications. (TLS is also known as "SSL.") DoT adds TLS encryption on top of the user datagram protocol (UDP), which is used for DNS queries. Additionally, it ensures that DNS requests and responses are not tampered with or forged via on-path attacks.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## hostname
-The name given to a server or node on a network. In most cases, the public DNS name of a server.
-
-## IdP
-*identity provider*
-
-An identity provider (IdP or IDP) stores and manages users' digital identities. Think of an IdP as being like a guest list, but for digital and cloud-hosted applications instead of an event. An IdP may check user identities via username-password combinations and other factors, or it may simply provide a list of user identities that another service provider (like an SSO) checks.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## JWT
-*JSON web token*
-
-An open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Location
-Locations are physical entities like offices, homes, retail stores, movie theatres or a data center.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## mTLS
-*mutual TLS*
-
-Mutual TLS is a common security practice that uses client TLS certificates to provide an additional layer of protection, allowing to cryptographically verify the client information.
-
-## Next-generation firewall
-A next-generation firewall (NGFW) is more powerful than a traditional firewall. NGFWs have the capabilities of traditional firewalls, but they also have a host of added features to address a greater variety of organizational needs. NGFWs can run either in the cloud or on-premises.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## OAuth
-OAuth is a technical standard for authorizing users. It is a protocol for passing authorization from one service to another without sharing the actual user credentials, such as a username and password. With OAuth, a user can sign in on one platform and then be authorized to perform actions and view data on another platform.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## OpenID Connect
-
-A simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. (From: [source](https://openid.net/connect/))
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Origin certificate
-
-Cloudflare Origin Certificates are free SSL certificates issued by Cloudflare for installation on your origin server to facilitate end-to-end encryption for your visitors using HTTPS.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## Policy
-**Gateway**: a set of rules determining which domains, content categories, or domain categories are allowed through Gateway.
-**Access**: a set of rules determining which users are allowed to access an application through Access.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## RDP
-*Remote Desktop Protocol*
-
-A protocol, or technical standard, for using a desktop computer remotely. RDP was initially released by Microsoft and is available for most Windows operating systems, but it can be used with Mac operating systems too.
-
-## SafeSearch
-
-A feature of search engines that can help you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children, you or at work.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## SAML
-*Security Assertion Markup Language*
-
-A standardized way to tell external applications and services that a user is who they say they are. SAML makes single sign-on ([SSO](#SSO)) technology possible by providing a way to authenticate a user once and then communicate that authentication to multiple applications.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SASE
-*Secure Access Service Edge*
-
-A cloud-based security model which bundles software-defined networking with network security functions and delivers them from a single service provider. SASE packages software-defined wide area networking (SD-WAN) capabilities with other network security functions (like secure web gateways, Zero Trust network access, firewall-as-a-service, and cloud access security brokers) and is delivered from and managed on a single cloud platform.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## seat
-A unique user who authenticates to connect to an application protected by Cloudflare Access, or to use a Gateway service.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## service token
-Service tokens consist of an ID and Secret generated by Cloudflare Access that can be used by an automated system or application to reach an application protected by Cloudflare Access. Service tokens allow systems to authenticate without identity provider credentials in an automated way.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SIEM
-*Security Information and Event Management*
-
-Security Information and Event Management (SIEM) solutions provide an analysis layer for logs generated by other systems.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SMB
-*Server Message Block*
-
-A network file sharing protocol that allows applications on a computer to read and write to files and to request services from server programs in a computer network. (From: [source](https://docs.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview))
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SSH
-*Secure SHell protocol*
-
-Secure Shell (SSH) protocol allows users to connect to infrastructure to perform activities like remote command execution.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SSO
-A technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Terraform
-[Terraform](https://www.terraform.io/) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building Cloudflare resources.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Tunnel certificate
-The Argo Tunnel software, `cloudflared`, generates a certificate when you login with your Cloudflare account. The certificate consists of a [service token](#service-token) and [origin certificate](#origin-certificate).
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## WARP/WARP+
-WARP is a mobile app designed for everyone. It uses Cloudflare's global network to secure all of your phone’s Internet traffic WARP automatically adds encryption from your device to the edge of Cloudflare’s network.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## Zero Trust Security
-An IT security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter. No single specific technology is associated with zero trust architecture; it is a holistic approach to network security that incorporates several different principles and technologies.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
diff --git a/products/argo-tunnel/src/content/how-it-works.md b/products/argo-tunnel/src/content/how-it-works.md
deleted file mode 100644
index 12792f58d80..00000000000
--- a/products/argo-tunnel/src/content/how-it-works.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-order: 1
----
-
-# How Argo Tunnel works
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare secures your origin servers by proxying requests to your DNS records through our anycast network, and to the external IP of your origin. However, if attackers discover those destinations, external IP addresses can still provide them with a path around Cloudflare security.
-
-Argo Tunnel provides a secure way to connect your origin to Cloudflare without a publicly routable IP address.
-
-With Tunnel, you don’t expose an external IP from your infrastructure to the Internet. Instead, a lightweight daemon runs in your infrastructure and creates outbound-only connections to Cloudflare’s edge. This allows you to quickly deploy infrastructure in a Zero Trust model by ensuring all requests to your resources pass through Cloudflare’s security filters.
-
-Argo Tunnel connects your web server to the Cloudflare network over an encrypted Tunnel. An example request follows these steps:
-
-- A visitor makes a request to `tunnel.yourdomain.com`.
-
-- The DNS lookup resolves to a Cloudflare network address.
-
-- The visitor connects to the closest Cloudflare edge PoP via Anycast.
-
-- Cloudflare routes the visitor through a special PoP-to-PoP route called [Argo Smart Routing](https://www.cloudflare.com/en-gb/products/argo-smart-routing/) and connects them to a Cloudflare edge PoP that has an established persistent connection to the daemon (`cloudflared`) running on the visitor's web server.
-
-- The request is routed to the `cloudflared` instance running on your server.
-
-- The Tunnel client forwards the request to your web service.
-
-## In more detail
-
-When the `cloudflared` process starts, the `cloudflared` client will establish an outbound HTTP connection with the two closest Cloudflare data centers. Which data centers are closest is determined by iterating through the SRV DNS record and standard Anycast routing.
-
-Administrators can create a DNS record or a Load Balancer entry to proxy traffic to the connection created by `cloudflared`.
-The connection between `cloudflared` and the Cloudflare edge is a long-lived persistent HTTP2 connection encrypted with TLS. To keep the connection alive, `cloudflared` sends a heartbeat to the edge in the form of a ping frame over HTTP2. If the connection is dropped, the `cloudflared` client re-establishes the connection with Cloudflare. `cloudflared` connects to Cloudflare on port `7844`.
-
-All packets between Cloudflare and the tunneled web server use stream multiplexing over HTTP2. In HTTP2, each request/response pair is called a Stream and given a unique Stream ID so that these streams can be “multiplexed” or sent asynchronously over the same connection.
diff --git a/products/argo-tunnel/src/content/index.md b/products/argo-tunnel/src/content/index.md
deleted file mode 100644
index 6dcd57f3fd1..00000000000
--- a/products/argo-tunnel/src/content/index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: Welcome
-order: 0
----
-
-# Argo Tunnel docs
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. Argo Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare’s WAF and Unmetered DDoS mitigation, and authenticated with Access if you’ve enabled those features for your account.
-
-Argo Tunnel relies on the `cloudflared` daemon to create a persistent connection between your web server and the Cloudflare network. You can lock down the web server to external requests. Instead, Argo Tunnel will connect out to Cloudflare from your origin.
-
-<ButtonGroup>
-  <Button type="primary" href="/getting-started">Get started</Button>
-  <Button type="secondary" href="/learning/how-tunnel-works">How Argo Tunnel works</Button>
-</ButtonGroup>
diff --git a/products/argo-tunnel/src/content/learning/examples.md b/products/argo-tunnel/src/content/learning/examples.md
deleted file mode 100644
index 42ab034f3ed..00000000000
--- a/products/argo-tunnel/src/content/learning/examples.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 2
----
-
-# Examples
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can find examples of Argo Tunnel deployment models in this [repository](https://github.com/cloudflare/argo-tunnel-examples).
-
-If you would like to contribute your example, please open a pull request to have it reviewed.
diff --git a/products/argo-tunnel/src/content/learning/how-tunnel-works.md b/products/argo-tunnel/src/content/learning/how-tunnel-works.md
deleted file mode 100644
index 7947ab76507..00000000000
--- a/products/argo-tunnel/src/content/learning/how-tunnel-works.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-order: 0
-hidden: true
----
-
-# How Argo Tunnel works
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare secures your origin servers by proxying requests to your DNS records through our anycast network, and to the external IP of your origin. However, if attackers discover those destinations, external IP addresses can still provide them with a path around Cloudflare security.
-
-Argo Tunnel provides a secure way to connect your origin to Cloudflare without a publicly routable IP address.
-
-With Tunnel, you don’t expose an external IP from your infrastructure to the Internet. Instead, a lightweight daemon runs in your infrastructure and creates outbound-only connections to Cloudflare’s edge. This allows you to quickly deploy infrastructure in a Zero Trust model by ensuring all requests to your resources pass through Cloudflare’s security filters.
-
-Argo Tunnel connects your web server to the Cloudflare network over an encrypted Tunnel. An example request follows these steps:
-
-- A visitor makes a request to `tunnel.yourdomain.com`.
-
-- The DNS lookup resolves to a Cloudflare network address.
-
-- The visitor connects to the closest Cloudflare edge PoP via Anycast.
-
-- Cloudflare routes the visitor through a special PoP-to-PoP route called [Argo Smart Routing](https://www.cloudflare.com/en-gb/products/argo-smart-routing/) and connects them to a Cloudflare edge PoP that has an established persistent connection to the daemon (`cloudflared`) running on the visitor's web server.
-
-- The request is routed to the `cloudflared` instance running on your server.
-
-- The Tunnel client forwards the request to your web service.
-
-## In more detail
-
-When the `cloudflared` process starts, the `cloudflared` client will establish an outbound HTTP connection with the two closest Cloudflare data centers. Which data centers are closest is determined by iterating through the SRV DNS record and standard Anycast routing.
-
-Administrators can create a DNS record or a Load Balancer entry to proxy traffic to the connection created by `cloudflared`.
-The connection between `cloudflared` and the Cloudflare edge is a long-lived persistent HTTP2 connection encrypted with TLS. To keep the connection alive, `cloudflared` sends a heartbeat to the edge in the form of a ping frame over HTTP2. If the connection is dropped, the `cloudflared` client re-establishes the connection with Cloudflare. `cloudflared` connects to Cloudflare on port `7844`.
-
-All packets between Cloudflare and the tunneled web server use stream multiplexing over HTTP2. In HTTP2, each request/response pair is called a Stream and given a unique Stream ID so that these streams can be “multiplexed” or sent asynchronously over the same connection.
diff --git a/products/argo-tunnel/src/content/learning/index.md b/products/argo-tunnel/src/content/learning/index.md
deleted file mode 100644
index 375367c5dd4..00000000000
--- a/products/argo-tunnel/src/content/learning/index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-order: 40
----
-
-# Learning
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-This section covers:
-* [TryCloudflare](/learning/trycloudflare/), a tool that allows developers to experiment with Argo Tunnel without adding a site to Cloudflare's DNS.
-* [Examples](/learning/examples/) of Argo Tunnel deployments.
-* [Tutorials](/learning/tutorials/) for managing Argo Tunnel in more complex scenarios (including integrations with other Cloudflare One products such as Access for Teams).
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/learning/sidecar.md b/products/argo-tunnel/src/content/learning/sidecar.md
deleted file mode 100644
index acf7299f089..00000000000
--- a/products/argo-tunnel/src/content/learning/sidecar.md
+++ /dev/null
@@ -1,218 +0,0 @@
----
-order: 3
-hidden: true
----
-
-# Kubernetes Sidecar model
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Running Argo Tunnel in a sidecar model is meant as an
-alternative to the Argo Tunnel Ingress Controller. The two should not be used
-simultaneously.
-</Aside>
-
-## Sidecar model background
-A Kubernetes [pod](https://kubernetes.io/docs/concepts/workloads/pods/pod/) consists of
-one or more containers that share storage and network. Pods are defined by a
-configuration file that determines the deployment of the containers, typically
-in a YAML file.
-
-Containers within a pod share an IP address space and can address each other over
-localhost. Argo Tunnel can be run as a sidecar in a pod - a separate container
-that performs its own function distinct from the application container.
-
-In this model, the Argo Tunnel daemon, `cloudflared`, runs in its own container
-and connects to the Cloudflare network to proxy requests for an associated
-hostname. The `cloudflared` container will then send those requests to port
-8080 on the application container over the common localhost in the Pod using the
-shared IP address space.
-
-## `cloudflared` Docker image
-Cloudflare publishes an official Docker image of `cloudflared` available on [DockerHub](https://hub.docker.com/r/cloudflare/cloudflared).
-
-Alternatively, you can build your own image.`cloudflared` is written in Go and can be built
-in a Docker container by generating a Dockerfile that defines the Go
-version, the working directory, and the steps to run and install the application.
-
-Once built, the image will need to be pushed to a container registry that the
-Kubernetes cluster can reach (whether a private registry or a public one like Docker Hub or Google Container Registry).
-
-## Secret generation
-Even though Kubernetes will grab the `cloudflared` image from a container
-registry, the sidecar model still needs a mechanism for authentication.
-Argo Tunnel authenticates machines to a hostname using a certificate
-downloaded on the origin when the user logs in to their Cloudflare
-account.
-
-Before deploying to a cluster, that certificate must be converted into a
-Kubernetes secret. A Kubernetes secret is an object that Kubernetes can securely use to
-configure the pod while reducing the risk of exposure of sensitive data.
-
-In a development environment, download `cloudflared` and follow the steps
-to authenticate the tool with the corresponding Cloudflare account.
-Identify the path where the certificate was downloaded and convert it
-into a Kubernetes secret with the following command:
-
-```sh
-$ kubectl create secret generic example.com --from-file="$HOME/.cloudflared/cert.pem"
-```
-
-Ensure the secret was generated successfully with the following command:
-
-```sh
-$ kubectl get secret
-```
-
-The output will list the secret and its details in the following format
-
-```txt
-NAME                TYPE         DATA AGE
-----                ----         ---- ---
-example.com         opaque       3    42s
-```
-
-## Pod configuration
-Kubernetes can use YAML files to configure the settings for the
-deployment of a Pod to a given cluster. In the sidecar model,
-`cloudflared` must be defined as a "kind: Deployment" section. The
-configuration file must include the arguments used to start Argo Tunnel,
-as well as the reference to the generated secret.
-
-Additionally, you will need to use the flag `--no-auto-update` to ensure that the
-`cloudflared` update process does not cause the container to crash on launch. In
-some cases, the auto-update flow can cause the container to launch a new process
-as PID 1, which causes the container to crash.
-
-```yaml
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: hello
-  name: hello
-spec:
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort:
-// targetPort defaults to the port configured above if left blank.
-  selector:
-    app: hello
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  labels:
-    app: hello
-  name: hello
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hello
-  template:
-    metadata:
-      labels:
-        app: hello
-    spec:
-      containers:
-      - name: hello
-        image: gcr.io/google-samples/gb-frontend:v4
-        imagePullPolicy: Always
-        env:
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: POD_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        ports:
-        - containerPort: 8080
-        resources:
-          limits:
-            cpu: 100m
-            memory: 40Mi
-          requests:
-            cpu: 20m
-            memory: 40Mi
-      - name: tunnel
-        image: docker.io/cloudflare/cloudflared:2020.7.1
-        imagePullPolicy: Always
-        command: ["cloudflared", "tunnel"]
-        args:
-        - --url=http://127.0.0.1:8080
-        - --hostname=hello.example.com
-        - --origincert=/etc/cloudflared/cert.pem
-        - --no-autoupdate
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        resources:
-          limits:
-            cpu: 10m
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 20Mi
-        volumeMounts:
-        - mountPath: /etc/cloudflared
-          name: tunnel-secret
-          readOnly: true
-      terminationGracePeriodSeconds: 60
-      volumes:
-      - name: tunnel-secret
-        secret:
-          secretName: example.com
----
-```
-
-The example file above defines the deployment of "hello" as both a
-container and a service that will serve requests on port 8080. Below those
-definitions, the file sets arguments for `cloudflared`
-`--url` specifies the destination of proxied requests
-`--hostname` specifies the DNS hostname exposed to the public internet
-
-## Troubleshooting
-
-### Did `cloudflared` run?
-
-```sh
-$ kubectl logs -lapp=hello -c tunnel
-```
-
-Returns logs from the cluster in the container, tunnel, where `cloudflared` is running as a sidecar.
-
-### Did the cluster's deployment fail?
-
-```sh
-$ kubectl describe po -lapp=hello
-```
-
-Returns information about the pod running the containers.
-Errors related to the failure to start the `cloudflared` process can be
-gathered with this command.
diff --git a/products/argo-tunnel/src/content/learning/trycloudflare.md b/products/argo-tunnel/src/content/learning/trycloudflare.md
deleted file mode 100644
index 1f350c8b9c0..00000000000
--- a/products/argo-tunnel/src/content/learning/trycloudflare.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-order: 1
----
-
-# TryCloudflare
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-TryCloudflare is a tool that allows developers to experiment with Argo Tunnel without adding a site to Cloudflare's DNS.
-
-TryCloudflare will launch a process that generates a random subdomain on `trycloudflare.com`. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost.
-
-## Using TryCloudflare
-1. Follow the instructions [here](/getting-started/installation) to install `cloudflared`. If you have an older copy, update to 2019.4.0 or later.
-2. Launch a web server that is available over localhost to `cloudflared`.
-3. Run the following terminal command to start a free tunnel.
-
-```sh
-$ cloudflared tunnel
-```
-
-The command above will default to port 8080; you can specify an alternate port with the --url flag.
-
-```sh
-$ cloudflared tunnel --url http://localhost:7000
-```
-
-`cloudflared` will generate a random subdomain when connecting to the Cloudflare network and print it in the terminal for you to use and share. The output will serve traffic from the server on your local machine to the public internet, using Cloudflare's Argo Smart Routing, at a public URL.
-
-## Example use cases for TryCloudflare
-With TryCloudflare, you can:
-* Create a web server for a project on your laptop that you want to share with others on different networks.
-
-* Test browser compatibility for a new site by creating a free Argo Tunnel and testing the link in different browsers.
-
-* Run speed tests from different regions by using a tool like Pingdom or WebPageTest to connect to the randomly-generated subdomain created by TryCloudflare
-
-## Why does Cloudflare provide this service for free?
-
-<Aside>
-
-Free tunnels are meant to be used for testing and development, not for deploying a production website. We don’t guarantee any SLA or uptime of TryCloudflare.
-</Aside>
-
-* With TryCloudflare, we hope you experience the speed and security improvements of Argo Tunnel (and Argo Smart Routing) and decide to add it to your production sites.
-
-* With TryCloudflare, we hope to make more and more of our products available for trial without you necessarily owning a domain, or having to set that domain's DNS to Cloudflare's nameserver.
-
-* With TryCloudflare, we plan to test new Argo Tunnel features and improvements. This provides us with a group of connections to test before we deploy to production customers.
-
-## Legal
-Your installation of `cloudflared` software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](/license/), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/).
diff --git a/products/argo-tunnel/src/content/learning/tutorials.md b/products/argo-tunnel/src/content/learning/tutorials.md
deleted file mode 100644
index 03c12ba1159..00000000000
--- a/products/argo-tunnel/src/content/learning/tutorials.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-order: 3
----
-
-# Tutorials
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can find many tutorials in [Cloudflare One documentation](https://developers.cloudflare.com/cloudflare-one/tutorials)
-that use Argo Tunnels.
-
-The following list highlights the most relevant ones for running Argo Tunnels:
- * [Share a local development environment with a colleague](https://developers.cloudflare.com/cloudflare-one/tutorials/share-new-site): a good entry-level tutorial for creating, routing and running a Named Argo Tunnel.
- * [Best practice to run Argo Tunnels without cert.pem](https://developers.cloudflare.com/cloudflare-one/tutorials/credentials-only): recommended for administrators so that they create and route the Named Tunnels, and then allow their users to run those Tunnels without the `cert.pem` file.
- * [Serve multiple origins with a single Argo Tunnel](https://developers.cloudflare.com/cloudflare-one/tutorials/multi-origin): explains in detail how to manage better your Argo Tunnels by having a single one with many origins being served.
- * [Run your Gitlab instance via Argo Tunnel](https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab): the Argo Tunnel is used to serve both HTTP and SSH traffic to a Gitlab instance.
diff --git a/products/argo-tunnel/src/content/license/index.md b/products/argo-tunnel/src/content/license/index.md
deleted file mode 100644
index aa0d8c02d69..00000000000
--- a/products/argo-tunnel/src/content/license/index.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-order: 50
----
-
-# License
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-**CLOUDFLARED LICENSE**
-
-Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of this cloudflared License (this "*Agreement*").  This Agreement is a binding legal agreement between you and Cloudflare, Inc. ("*Cloudflare*") for the cloudflared services being provided to you by Cloudflare or its authorized representative (the "*cloudflared Services*"), including any computer software and any associated media, printed materials, and "online" or electronic documentation provided in connection with the cloudflared Services (the "*cloudflared Software*" and together with the cloudflared Services, hereinafter collectively referred to as the "*Solution*").  If you are not accepting this Agreement as an individual, then "you" means your company, its officers, members, employees, agents, representatives, successors and assigns.
-
-BY USING THE SOLUTION, YOU ARE INDICATING THAT YOU HAVE READ, AND AGREE TO BE BOUND BY, THE POLICIES, TERMS, AND CONDITIONS SET FORTH BELOW IN THEIR ENTIRETY WITHOUT LIMITATION OR QUALIFICATION, AS WELL AS BY ALL APPLICABLE LAWS AND REGULATIONS, AS IF YOU HAD HANDWRITTEN YOUR NAME ON AND SIGNED THIS AGREEMENT.  IF YOU DO NOT AGREE TO THE TERMS AND CONDITIONS CONTAINED IN THIS AGREEMENT, YOU MAY NOT USE THE SOLUTION.
-
-1.    *GRANT OF RIGHTS*
-
-*1.1	Grant of License.*  The Solution is licensed by Cloudflare and its licensors, it is not being sold.  Subject to the terms and conditions of this Agreement, Cloudflare hereby grants you a non-exclusive, non-sublicensable, non-transferable license to use the Solution (the “License”).  You may examine source code, if provided to you, solely for the limited purpose of evaluating the Software for security flaws.  You may also use the cloudflared Services to create derivative works; provided, that in no event may you create derivative works for use with products or services other than those provided to you by or on behalf of Cloudflare.  This Agreement applies to the parts of the Solution developed by Cloudflare.  The Solution may also incorporate externally maintained libraries and other open software, which may be governed by third-party licenses.
-
-*1.2	Restrictions.*  The License is granted solely to you and not, by implication or otherwise, to any of your parents, subsidiaries or affiliates, unless otherwise agreed between you and Cloudflare.  No right is granted hereunder to use the Solution to perform services for third parties. All rights not expressly granted to you hereunder are reserved to Cloudflare.  You may not use the Solution except as explicitly permitted under this Agreement.  You are expressly prohibited from modifying, adapting, translating, preparing derivative works from (other than as provided in Section 1.1 of this Agreement), decompiling, reverse engineering, disassembling or otherwise attempting to derive source code from the Software used to provide the cloudflared Services or any internal data files generated by the Solution.  You are also prohibited from removing, obscuring or altering any copyright notice, trademarks, or other proprietary rights notices affixed to or associated with the Solution.
-
-*1.3	Ownership.*  Except for the rights and licenses explicitly granted herein, as between you and Cloudflare, Cloudflare and/or its licensors own and shall retain all right, title, and interest in and to the Solution, including any and all technology embodied therein, including all copyrights, patents, trade secrets, trade dress and other proprietary rights associated therewith, and any derivative works created therefrom.
-
-*2.	LIMITATION OF LIABILITY*
-
-YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT DOWNLOADING THE SOFTWARE IS AT YOUR SOLE RISK.  THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND AND CLOUDFLARE, ITS LICENSORS AND ITS AUTHORIZED REPRESENTATIVES EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  CLOUDFLARE DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OR THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE SOFTWARE WILL BE CORRECTED.  FURTHERMORE, CLOUDFLARE DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE SOFTWARE OR RELATED DOCUMENTATION IN TERMS OF THEIR CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY CLOUDFLARE SHALL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY.
-
-*3.	CONFIDENTIALITY*
-
-It may be necessary during the set-up and performance of the Solution for you and Cloudflare to exchange Confidential Information. "Confidential Information" as used in this Agreement means any information whether oral, or written, of a private, secret, proprietary or confidential nature, concerning either party or its business operations, including without limitation: (i) your data; and (ii) Cloudflare's access control systems, specialized network equipment, techniques related to the Solution, and use policies, any of which may include trade secrets of Cloudflare and its licensors. Each party agrees to use the same degree of care to protect the confidentiality of the Confidential Information of the other party and to prevent its unauthorized use or dissemination as it uses to protect its own Confidential Information of a similar nature, but in no event shall exercise less than due diligence and reasonable care. Each party agrees to use the Confidential Information of the other party only for purposes related to the performance of this Agreement. All Confidential Information remains the property of the party disclosing the information and no license or other rights to Confidential Information are granted or implied hereby.
-
-*4.	TERM AND TERMINATION*
-
-*4.1	Term.*  This Agreement shall be effective upon download or installation of the cloudflared Software by you, and shall continue until terminated in accordance with Section 4.2 of this Agreement.
-
-*4.2	Termination.* This Agreement may be terminated by Cloudflare or its authorized representative if any of the following events occur:  (i) you fail to pay any amounts due to Cloudflare for the cloudflared Services and/or the Solution, and written notice of such non-payment has been provided to you; (ii) you are in material breach of any term, condition, or provision of this Agreement or any other agreement between you and Cloudflare or its authorized representative (a "Related Agreement"); (iii) you terminate or suspend your business, becomes subject to any petition of bankruptcy or other proceeding related to insolvency, receivership, liquidation or assignment for the benefit of creditors; or (iv) a Related Agreement is terminated or expires.
-
-*4.3	Effect of Termination.*  Upon the termination of this Agreement for any reason: (i) all license rights granted hereunder shall terminate; and (ii) all Confidential Information shall be returned to the disclosing party or destroyed.
-
-*5.	MISCELLANEOUS*
-
-*5.1	Assignment.*  You may not assign any of your rights or delegate any of your obligations under this Agreement, whether by operation of law or otherwise, without the prior express written consent of Cloudflare or its authorized representative.  Any such assignment without the prior express written consent of Cloudflare or its authorized representative shall be void.  Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their respective successors and permitted assigns.
-
-*5.2	Waiver and Amendment.*  Cloudflare may modify this Agreement upon written notice to you.  No failure or delay by either party in exercising any right, power, or remedy under this Agreement, except as specifically provided herein, shall operate as a waiver of any such right, power or remedy.
-
-*5.3	Governing Law.*  This Agreement shall be governed by the laws of the State of California, without giving effect to any conflicts of laws principles that require the application of the law of a different jurisdiction, and excluding the United Nations Convention on Contracts for the International Sale of Goods.
-
-*5.4	Notices.*  All notices, demands or consents required or permitted under this Agreement shall be in writing.  Notice shall be sent to you at the e-mail address provided by you to Cloudflare or its authorized representative.
-
-*5.5	Independent Contractors.* The parties to this Agreement are independent contractors.  Neither party shall be deemed to be an employee, agent, partner or legal representative of the other for any purpose and neither shall have any right, power or authority to create any obligation or responsibility on behalf of the other.
-
-*5.6	Severability.*  If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, such provision shall be changed and interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law, and the remaining provisions of this Agreement shall remain in full force and effect.
-
-*5.7	Force Majeure.*  Cloudflare shall not be liable to you or any other party for any failure or delay in performance caused by reasons beyond its reasonable control.
-
-*5.8	Complete Understanding.*  This Agreement constitutes the final, complete and exclusive agreement between you and Cloudflare with respect to the License and the Solution, and supersedes all previous written and oral agreements and communications related thereto.  To the extent this Agreement and any Related Agreement conflict regarding the License or the Solution, this Agreement shall control.
diff --git a/products/argo-tunnel/src/content/license/libraries.md b/products/argo-tunnel/src/content/license/libraries.md
deleted file mode 100644
index ce33f6c5166..00000000000
--- a/products/argo-tunnel/src/content/license/libraries.md
+++ /dev/null
@@ -1,1176 +0,0 @@
----
-order: 101
----
-
-# Copyrights
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-The `cloudflared` client is produced using licensed software:
-
----
-
-https://github.com/BurntSushi/toml
-
-The MIT License (MIT)
-
-Copyright (c) 2013 TOML authors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
----
-
-https://github.com/Sirupsen/logrus
-
-The MIT License (MIT)
-
-Copyright (c) 2014 Simon Eskildsen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
----
-
-https://github.com/beorn7/perks/
-
-Copyright (C) 2013 Blake Mizerany
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----
-
-https://github.com/certifi/gocertifi
-
-This Source Code Form is subject to the terms of the Mozilla Public License,
-v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain
-one at http://mozilla.org/MPL/2.0/.
-
----
-
-https://github.com/coreos/go-oidc/
-https://github.com/coreos/go-systemd/
-
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
----
-
-https://github.com/facebookgo/grace
-
-BSD License
-
-For grace software
-
-Copyright (c) 2015, Facebook, Inc. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification,
-are permitted provided that the following conditions are met:
-
- * Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
- * Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
- * Neither the name Facebook nor the names of its contributors may be used to
-   endorse or promote products derived from this software without specific
-   prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
-ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
----
-
-https://github.com/getsentry/raven-go
-
-Copyright (c) 2013 Apollic Software, LLC. All rights reserved.
-Copyright (c) 2015 Functional Software, Inc. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Apollic Software, LLC nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
----
-
-https://github.com/glycerine/rbtree
-
-Copyright (C) 2012 Yasushi Saito
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
----
-
-https://github.com/golang/protobuf
-
-Go support for Protocol Buffers - Google's data interchange format
-
-Copyright 2010 The Go Authors.  All rights reserved.
-https://github.com/golang/protobuf
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-    * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-    * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
----
-
-https://github.com/lib/pq
-
-Copyright (c) 2011-2013, 'pq' Contributors
-Portions Copyright (C) 2011 Blake Mizerany
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----
-
-https://godoc.org/github.com/matttproud/golang_protobuf_extensions/pbutil
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
----
-
-https://github.com/mitchellh/go-homedir
-
-The MIT License (MIT)
-
-Copyright (c) 2013 Mitchell Hashimoto
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
----
-
-https://github.com/pkg/errors
-
-Copyright (c) 2015, Dave Cheney <dave@cheney.net>
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
----
-
-https://github.com/prometheus/client_golang
-https://github.com/prometheus/client_model
-https://github.com/prometheus/common
-https://github.com/prometheus/procfs
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
----
-
-https://github.com/urfave/cli
-
-MIT License
-
-Copyright (c) 2016 Jeremy Saenz & Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
----
-
-https://github.com/go-yaml/yaml
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
----
-
-https://zombiezen.com/go/capnproto2
-
-go-capnproto is licensed under the terms of the MIT license reproduced below.
-
-===============================================================================
-
-Copyright (C) 2014 the go-capnproto authors and contributors.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-===============================================================================
diff --git a/products/argo-tunnel/src/content/quickstart/index.md b/products/argo-tunnel/src/content/quickstart/index.md
deleted file mode 100644
index 2db0d5ed8a1..00000000000
--- a/products/argo-tunnel/src/content/quickstart/index.md
+++ /dev/null
@@ -1,147 +0,0 @@
----
-order: 100
-hidden: true
----
-
-# Quickstart
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. Argo Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare’s WAF and Unmetered DDoS mitigation, and authenticated with Access if you've enabled those features for your account.
-
-Argo Tunnel relies on the `cloudflared` daemon to create a persistent connection between your web server and the Cloudflare network. You can lock down the web server to external requests. Instead, Argo Tunnel will connect out to Cloudflare from your origin.
-
-## How much does Argo Tunnel cost?
-Argo Tunnel is free with the purchase of Argo Smart Routing. Argo Smart Routing can be purchased [in the Cloudflare dashboard](https://dash.cloudflare.com/?zone=traffic) and costs $5/month plus 10 cents per GB. Cloudflare only charges for Argo routing; there is no charge for the count of tunnels used.
-
-## Setup
-
-### Requirements
-* A <a href="http://dash.cloudflare.com/" target="_blank">Cloudflare account</a>
-* The [`cloudflared`](/downloads/) daemon
-* An <a href="https://support.cloudflare.com/hc/en-us/articles/201720164-Step-2-Create-a-Cloudflare-account-and-add-a-website">active zone on Cloudflare</a>
-* An active subscription to <a href="https://dash.cloudflare.com/?zone=traffic">Argo</a> which you can enable in the Cloudflare dashboard in the Traffic tab
-
-### Step 1: Enable Argo
-Argo Tunnel uses Argo Smart Routing technology to route traffic over the fastest path within the Cloudflare network between the user and the data centers closest to your origin.
-
-To begin using Argo Smart Routing, navigate to the <a href="https://dash.cloudflare.com/?zone=traffic" target="_blank">Traffic tab of the Cloudflare dashboard</a>, click the 'Enable' button, and follow the steps on the screen for setting up usage-based billing.
-
-<Aside>
-
-Enterprise customers who have enabled Argo will need to contact their Cloudflare representative to have Argo Smart Routing enabled for their account.
-</Aside>
-
-### Step 2: Install cloudflared
-`cloudflared` is the software that runs Argo Tunnel. `cloudflared` is available for amd64, x86, and ARMv6 machines in Binary, .deb, and .rpm types. The code for the `cloudflared` client is available on GitHub [here](https://github.com/cloudflare/cloudflared).
-
-[Follow these instructions to install `cloudflared`](/downloads/)
-
-Once installed, verify `cloudflared` has installed properly by checking the version.
-
-```sh
-$ cloudflared --version
-cloudflared version 2019.2.1 (built 2019-02-28-0010 UTC)
-```
-
-Not working? If you installed a .deb or .rpm package (Linux) or used Homebrew (macOS) it should be in your `PATH`; otherwise, change to the directory where you extracted `cloudflared`.
-
-### Step 3: Login to your Cloudflare account
-Next, login to your Cloudflare account from `cloudflared`. You will use the same username and password that you use to login to the Cloudflare dashboard.
-
-Run the following command and a login page should open in your browser:
-
-```sh
-$ cloudflared tunnel login
-A browser window should have opened at the following URL:
-
-https://dash.cloudflare.com/argotunnel?callback=https%3A%2F%2Flogin.cloudflarewarp.com%2FA5XXPKA6S5N5YWMTOXRKVWPRPE7BHG3MFRCDZES7UBZU7SWQFF4KA4PWMGL5GXJ
-```
-
-_If the browser fails to open automatically, copy and paste the URL into your browser's address bar and press enter._
-
-Once you login, you will see a list of domains associated with your account. Argo Tunnel connects your machine to the Cloudflare network by associating it with a hostname in your Cloudflare account. Locate the domain you wish to use to represent your server and select its name in the table. Once you select the domain, `cloudflared` will automatically install a certificate to authenticate your machine to the Cloudflare network for the specific hostname. Once `cloudflared` installs the certificate, you'll see a "Success" message in your browser, and you can start using `cloudflared` and Argo Tunnel.
-
-<Aside>
-
-The certificate consists of three components bundled into a single PEM file. One of those components consists of the API key from the user who authenticated. If this user leaves the Cloudflare account or their permissions change, that API key will be invalidated and the tunnel will fail to authenticate. A new certificate will need to be generated.
-</Aside>
-
-Sometimes firewalls or unusual network configuration can prevent `cloudflared` from automatically installing the certificate. If this occurs, your browser will download the certificate as a file named `cert.pem`. You should see it in your browser's standard list of downloaded files. You'll need to move that `cert.pem` file from your browser's downloads folder into the `~/.cloudflared` folder. Copy and paste the following command to move the certificate to the `.cloudflared` directory on your system.
-
-```sh
-$ mv cert.pem ~/.cloudflared/cert.pem
-```
-
-### Step 4: (Optional) Hello Tunnel
-Argo Tunnel runs a virtual, encrypted tunnel from a local web server to the Cloudflare network. If you do not have a web server running locally and want to test Tunnel, you can try a hello world installation with the built-in web server.
-
-To do so, pass the flag --hello-world and replace [hostname] with a hostname in your Cloudflare account. Because Tunnel automatically creates DNS records for you, you can choose a subdomain that is not otherwise in use.
-
-```sh
-$ cloudflared --hostname [hostname] --hello-world
-INFO[0000] Build info: {GoOS:darwin GoVersion:go1.11.1 GoArch:amd64}
-INFO[0000] Version 2019.2.1
-INFO[0000] Flags map[hostname:test.warptunnels.org no-autoupdate:true grace-period:10s hello-world:true]
-INFO[0000] cloudflared will not automatically update when run from the shell. To enable auto-updates, run cloudflared as a service: https://developers.cloudflare.com/argo-tunnel/reference/service/
-INFO[0000] Starting metrics server                       addr="127.0.0.1:51245"
-INFO[0000] Starting Hello World server at 127.0.0.1:51246
-INFO[0000] Proxying tunnel requests to https://127.0.0.1:51246
-INFO[0009] Connected to LAX
-INFO[0009] Each HA connection's tunnel IDs: map[0:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0]
-INFO[0009] Route propagating, it may take up to 1 minute for your new route to become functional
-INFO[0020] Connected to SFO-DOG
-INFO[0020] Connected to LAX
-INFO[0020] Each HA connection's tunnel IDs: map[0:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0 1:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0]
-INFO[0020] Route propagating, it may take up to 1 minute for your new route to become functional
-INFO[0020] Each HA connection's tunnel IDs: map[0:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0 1:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0 2:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0]
-INFO[0020] Route propagating, it may take up to 1 minute for your new route to become functional
-INFO[0020] Connected to SFO-DOG
-INFO[0020] Each HA connection's tunnel IDs: map[3:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r3vvlffz9ek4gi0 0:n1ud0l8y47d5755vsqxuvaa3tf7rp4dp643a6r...
-```
-
-Above, you can see Tunnel establishes four long-lived connections between the two closest data centers. You know the tunnel is ready when you see the message `Connected to …`.
-
-When the messages above conclude, Argo Tunnel has successfully created a connection out from your machine to the Cloudflare network.
-
-If you go visit the domain name at which you created the tunnel (e.g. tunnel.example.com) you will see the request logs directly in the `cloudflared` output with debug level enabled. We call this Tunnel Vision.
-
-```txt
-INFO[0615] GET https://127.0.0.1:62627/ HTTP/1.1         CF-RAY=4067701b598e8184-LAX
-INFO[0615] 200 OK                                        CF-RAY=4067701b598e8184-LAX
-```
-
-### Step 5: Establishing the tunnel
-With your credentials saved to disk, you can now start Argo Tunnel for your production service. Replace [hostname] with the hostname you want associated with your server; this must be the domain or subdomain of a zone added to your Cloudflare account.
-
-The localhost address should point to a locally running web server.
-
-```sh
-$ cloudflared tunnel --hostname [hostname] --url http://localhost:8000
-INFO[0000] Proxying tunnel requests to https://127.0.0.1:8000
-INFO[0000] Starting metrics server                       addr="127.0.0.1:62634"
-INFO[0001] Connected to LAX
-INFO[0020] Connected to LAX
-INFO[0019] Connected to SFO
-INFO[0021] Connected to SFO
-```
-
-A successful connection gives you the last line `Connected to…`
-
-If you get the error: ‘Server error: Fail to update CNAME’ it is because there is already a DNS A/AAAA record existing at that hostname. You should either first delete the existing A/AAAA records or create a tunnel on a brand new hostname.
-
-### Step 6: Test the configuration
-Open a web browser and type in the selected hostname. Access to the Tunnel is permitted over both HTTP and HTTPS, though you can easily redirect all HTTP traffic to HTTPS with Cloudflare.
-
-If the connection succeeds, you should see content served from your local webserver. If you used the built-in Hello World server, you will see a message like this:
-![Hello World server output](../static/img/quickstart/argotunnel-hello.png)
-
-### Next steps
-The steps above can be sufficient for local dev environments. For a production environment, we recommend a few additional settings be configured:
-
-* [Automatically starting Argo Tunnel](/reference/service)
-* [Configuration file format](/reference/config)
diff --git a/products/argo-tunnel/src/content/reference/arguments.md b/products/argo-tunnel/src/content/reference/arguments.md
deleted file mode 100644
index b4d79ac565d..00000000000
--- a/products/argo-tunnel/src/content/reference/arguments.md
+++ /dev/null
@@ -1,388 +0,0 @@
----
-order: 100
----
-
-# Command-line arguments
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-* [Tunnel command](#tunnel-command)
-* [Login command](#login-command)
-* [Service command](#service-command)
-* [Update command](#update-command)
-
-<div id="tunnel-command">
-
-### Tunnel command
-</div>
-
-All tunnel-related commands are prefixed with 'tunnel'. For example:
-
-```bash
-cloudflared tunnel --url localhost:5555 --hostname x.example.com
-```
-
-<div id="config">
-
-## config
-</div>
-
-Syntax: `--config value`
-
-Default: `~/.cloudflared/config.yml`
-
-Specifies a config file in YAML format.
-
-<div id="url">
-
-## url
-</div>
-
-Syntax: `--url URL`
-
-Default: `http://localhost:8080`
-
-Environment variable: `TUNNEL_URL`
-
-Connect to the local webserver at URL.
-<div id="hostname">
-
-## hostname
-</div>
-
-Syntax: `--hostname value`
-
-Environment variable: `TUNNEL_HOSTNAME`
-
-Set a hostname on a Cloudflare zone to route traffic through this tunnel.
-
-<div id="lb-pool">
-
-## lb-pool
-</div>
-
-Syntax : `--lb-pool POOL_NAME`
-
-Add this tunnel to a [Load Balancer pool](/reference/load-balancing/). If it doesn’t already exist a load balancer will be created
-for the hostname of your tunnel, and a pool will be created with the pool name you specify. Traffic destined to that
-pool will be load balanced across this tunnel and any other tunnels which share its pool name.
-
-<div id="autoupdate-freq">
-
-## autoupdate-freq
-</div>
-
-Syntax: `--autoupdate-freq duration`
-
-Default: `24h`
-
-Autoupdate frequency. See also [--no-autoupdate](#no-autoupdate)
-
-<div id="no-autoupdate">
-
-## no-autoupdate
-</div>
-
-Syntax: `--no-autoupdate`
-
-Default: `false`
-
-Disable periodic check for updates, restarting the server with the new version. See also [--autoupdate-freq](#autoupdate-freq)
-
-Restarts are performed by spawning a new process that connects to the Cloudflare edge. On successful connection, the old process will gracefully shut down after handling all outstanding requests.
-
-<div id="origincert">
-
-## origincert
-</div>
-
-Syntax: `--origincert value`
-
-Default: `~/.cloudflared/cert.pem`
-
-Environment variable: `TUNNEL_ORIGIN_CERT`
-
-Specifies the Tunnel certificate for one of your zones, authorizing the client to serve as an origin for that zone. A certificate is required to use Argo Tunnel. You can obtain a certificate by using the [login command](#login-command) or by visiting https://dash.cloudflare.com/argotunnel.
-
-<div id="no-tls-verify">
-
-## no-tls-verify
-</div>
-
-Syntax: `--no-tls-verify`
-
-Default: `false`
-
-Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
-
-<Aside>
-
-The connection from your machine to Cloudflare's Edge is still encrypted and verified using TLS.
-</Aside>
-
-<div id="origin-ca-pool">
-
-## origin-ca-pool
-</div>
-
-Syntax: `--origin-ca-pool value`
-
-Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
-
-<div id="origin-server-name">
-
-## origin-server-name
-</div>
-
-Syntax: `--origin-server-name value`
-
-Environment variable: `TUNNEL_ORIGIN_SERVER_NAME`
-
-Hostname that `cloudflared` should expect from your origin server certificate.
-
-<div id="metrics">
-
-## metrics
-</div>
-
-Syntax: `--metrics value`
-
-Default: `localhost:`
-
-Environment variable: `TUNNEL_METRICS`
-
-Address to query for usage metrics.
-<div id="metrics-update-freq">
-
-## metrics-update-freq
-</div>
-
-Syntax: `--metrics-update-freq duration`
-
-Default: `5s`
-
-Environment variable: `TUNNEL_METRICS_UPDATE_FREQ`
-
-Frequency to update tunnel metrics.
-
-<div id="tag">
-
-## tag
-</div>
-
-Syntax: `--tag KEY=VALUE`
-
-Environment variable: `TUNNEL_TAG`
-
-Custom tags used to identify this tunnel, in format `KEY=VALUE`. Multiple tags may be specified by delimiting them with commas e.g. `KEY1=VALUE1,KEY2=VALUE2`.
-
-<div id="loglevel">
-
-## loglevel
-</div>
-
-Syntax: `--loglevel (panic|fatal|error|warn|info|debug)`
-
-Default: `info`
-
-Environment variable: `TUNNEL_LOGLEVEL`
-
-Specifies the verbosity of logging. The default "info" is not noisy, but you may
-wish to run with "warn" in production.
-
-<div id="proto-loglevel">
-
-## proto-loglevel
-</div>
-
-Syntax: `--proto-loglevel (panic|fatal|error|warn|info|debug)`
-
-Default: `warn`
-
-Environment variable: `TUNNEL_PROTO_LOGLEVEL`
-
-Specifies the verbosity of the HTTP/2 protocol logging. Any value below 'warn' is noisy and should only be used
-to debug low-level performance issues and protocol quirks.
-
-<div id="retries">
-
-## retries
-</div>
-
-Syntax: `--retries value`
-
-Default: `5`
-
-Environment variable: `TUNNEL_RETRIES`
-
-Maximum number of retries for connection/protocol errors. Retries use exponential backoff (retrying at 1, 2, 4, 8, 16 seconds by default) so increasing this value significantly is not recommended.
-
-<div id="no-chunked-encoding">
-
-## no-chunked-encoding
-</div>
-
-Syntax: `--no-chunked-encoding`
-
-Default: `false`
-
-Disables chunked transfer encoding; useful if you are running a WSGI server.
-
-<div id="hello-world">
-
-## hello-world
-</div>
-
-Syntax: `--hello-world`
-
-Environment variable: `TUNNEL_HELLO_WORLD`
-
-Use the established tunnel to expose a 'Hello world' HTTP server for testing Argo Tunnel. Mutually exclusive with the `--url` argument.
-
-<div id="pidfile">
-
-## pidfile
-</div>
-
-Syntax: `--pidfile value`
-
-Environment variable: `TUNNEL_PIDFILE`
-
-Write the application's PID to this file after first successful connection. Mainly useful for scripting and service integration.
-
-<div id="logfile">
-
-## logfile
-</div>
-
-Syntax: `--logfile value`
-
-Environment variable: `TUNNEL_LOGFILE`
-
-Save application log to this file. Mainly useful for reporting issues.
-
-<div id="proxy-connect-timeout">
-
-## proxy-connect-timeout
-</div>
-
-Syntax: `--proxy-connect-timeout value`
-
-Default: `30s`
-
-Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [--proxy-tls-timeout]({{< ref "#proxy-tls-timeout" >}}).
-
-<div id="proxy-tls-timeout">
-
-## proxy-tls-timeout
-</div>
-
-Syntax: `--proxy-tls-timeout value`
-
-Default: `10s`
-
-Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
-
-<div id="proxy-tcp-keepalive">
-
-## proxy-tcp-keepalive
-</div>
-
-Syntax: `--proxy-tcp-keepalive value`
-
-Default: `30s`
-
-The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
-
-<div id="proxy-no-happy-eyeballs">
-
-## proxy-no-happy-eyeballs
-</div>
-
-Syntax: `--proxy-no-happy-eyeballs`
-
-Disable the "happy eyeballs" algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
-
-<div id="proxy-keepalive-connections">
-
-## proxy-keepalive-connections
-</div>
-
-Syntax: `--proxy-keepalive-connections value`
-
-Default: `100`
-
-Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
-
-<div id="proxy-keepalive-timeout">
-
-## proxy-keepalive-timeout
-</div>
-
-Syntax: `--proxy-keepalive-timeout value`
-
-Default: `1m30s`
-
-Timeout after which an idle keepalive connection can be discarded.
-
-<div id="help">
-
-## help
-</div>
-
-Syntax: `--help`
-
-Shows help text.
-
-<div id="version">
-
-## version
-</div>
-
-Syntax: `--version`
-
-Prints the version number and build date.
-<div id="login-command">
-
-#### Login command
-</div>
-
-`cloudflared tunnel login`
-
-Opens a special section of the Cloudflare dashboard for obtaining a Tunnel certificate.
-
-It should open your browser automatically and prompt you to log in to your Cloudflare account (unless you previously logged in with 'remember me' selected). If running `cloudflared` on a server, you will be given an URL that you can visit on another machine.
-
-After logging in, a list of your zones will appear. Select the zone you want to use Argo Tunnel with. After confirming your authorization, the certificate should be sent to the Tunnel client and saved to `.cloudflared/cert.pem` in your user folder. If this process fails for any reason, the certificate will instead be downloaded by your browser and you will have to copy the file manually to that location.
-
-You can also obtain a Tunnel certificate independently of this command by visiting https://dash.cloudflare.com/argotunnel.
-
-<div id="service-command">
-
-#### Service command
-</div>
-
-`cloudflared service install`
-`cloudflared service uninstall`
-
-Install or uninstall cloudflared as a system service. The details of service installation depend on the OS you are using. See [Automatically starting Argo Tunnel]({{< ref "reference/service.md" >}}) for more information.
-
-<div id="update-command">
-
-### Update command
-</div>
-
-`cloudflared update`
-
-Looks for a new version on the official download server. If a new version exists, updates the agent binary and quits. Otherwise, does nothing.
-
-To determine if an update happened in a script, check for error code 64.
-
-<style dangerouslyInsertInnerHTML={{__html: `
-h2 {
-  text-transform: none !important
-}`}}></style>
diff --git a/products/argo-tunnel/src/content/reference/common-errors.md b/products/argo-tunnel/src/content/reference/common-errors.md
deleted file mode 100644
index c52da9ec3c2..00000000000
--- a/products/argo-tunnel/src/content/reference/common-errors.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-order: 110
----
-
-# Common Errors
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## HTTP 502
-
-A 502 Error means that the Cloudflare edge can establish a connection with the `cloudflared` client, but the `cloudflared` client is not able to establish a connection with the web server. If you see this error, you should double check that your web server is running on the same port you told `cloudflared` when starting Tunnel.
-
-You may also get this error if the TLS certificate used by the webserver is not valid. Check the [Invalid TLS certificate](#invalid-tls) section for more information.
-
-## HTTP 503
-
-A 503 error means either that the tunnel has been unregistered, or that there is a delay in DNS propagation.  Tunnels are unregistered when all instances of `cloudflared` exit for a domain.  In this case, start `cloudflared` to resume service.  Argo-Tunnel uses DNS connect your tunnels, this means that initial bring-up of a tunnel will take a few seconds for DNS to update.  `cloudflared` will report when your tunnel is ready to service requests.
-
-## TLS Errors
-
-### Cannot validate certificate
-
-If you are pointing `cloudflared` to a locally-available URL that is different from your hostname, you may get TLS errors. To tell `cloudflared` to ignore those errors, you can include the **no-tls-verify** flag.
-
-Find more information on the **no-tls-verify** flag [here](/reference/arguments/#no-tls-verify).
-
-### <a name="invalid-tls"></a> Invalid TLS certificate
-If the TLS certificate used by the webserver is not valid, you may get a 502 Error.
-If you run:
-
-```bash
-cloudflared tunnel --hostname example.com http://localhost:8080
-```
-
-then Tunnel expects a certificate for localhost. You can use the origin-server-name field to specify what the name is in the certificate:
-
-```bash
-cloudflared tunnel --hostname example.com --origin-server-name example.com http://localhost:8080
-```
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/reference/config.md b/products/argo-tunnel/src/content/reference/config.md
deleted file mode 100644
index d5d00206f71..00000000000
--- a/products/argo-tunnel/src/content/reference/config.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-order: 90
----
-
-# Configuration File Format
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-The configuration file format uses [YAML syntax](http://www.yaml.org/start.html). Every command-line argument of `cloudflared` can be expressed in YAML.
-
-For example, the `--hostname [hostname]` argument is written in the config file as:
-
-```yaml
-hostname: [hostname]
-```
-
-You can use `--config` to point to a non-standard YAML file location:
-
-```sh
-$ cloudflared tunnel --config tunnels/config.yml
-```
-
-Without specifying `--config`, `cloudflared` will default to reading `~/.cloudflared/config.yml`.
-
-An example `config.yml` for the above command could look like:
-
-```yaml
-hostname: tunnel.yourdomain.com
-url: https://localhost:8000
-logfile: /var/log/cloudflared.log
-```
-
-Flags that don't expect any value (such as `--hello-world`) should be specified as boolean `true` in the YAML:
-```yaml
-hello-world: true
-```
-
-See the [full set of command-line arguments](/reference/arguments)
diff --git a/products/argo-tunnel/src/content/reference/docker.md b/products/argo-tunnel/src/content/reference/docker.md
deleted file mode 100644
index 0ebe34f7c42..00000000000
--- a/products/argo-tunnel/src/content/reference/docker.md
+++ /dev/null
@@ -1,154 +0,0 @@
----
-order: 110
----
-
-# Exposing Docker Containers
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Argo Tunnel support for Docker is in Beta.
-</Aside>
-
-You can use Argo Tunnel to expose applications running in Docker containers through Cloudflare's
-edge, just like any other origin. Since this requires running 2 services in one container (your
-origin + cloudflared), you'll have to install [Supervisord](http://supervisord.org), a Unix process
-manager which will control the services running in the container. Supervisord uses a config file to
-define which processes to run on start, and provides various options to configure each process such
-as auto-restarting on crashes.
-
-Running 2 services in one container is generally not the advisable strategy in this situation - in a
-perfect world, using `docker-compose` to create a dual container setup is the recommended strategy whenever 2
-separate services are involved. However, there are some situations in which having everything in
-one container is preferred.
-
-# Getting Started
-
-In this example, we'll create a Docker container which exposes a simple Flask application through Argo Tunnels. We'll start our Dockerfile with the following:
-
-```docker
-FROM debian
-RUN apt-get -yqq update
-COPY . /opt/flaskapp
-WORKDIR /opt/flaskapp
-```
-
-This will create a Debian image, update the package repo, and copy our files to a working
-directory. Now, add the instructions to install Supervisord in your Dockerfile:
-
-```docker
-RUN apt-get install -y supervisor
-RUN mkdir -p /var/log/supervisor
-RUN mkdir -p /etc/supervisor/conf.d/
-COPY supervisord.conf /etc/supervisord.conf
-```
-
-This will also create the appropriate directories for Supervisord, and copy the config file into the correct location. Now, add the following to install `cloudflared` in the Docker image:
-
-```docker
-RUN apt-get install -y wget
-RUN wget -O- https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.tgz | tar xz
-RUN mkdir -p /etc/cloudflared/
-COPY cert.pem /etc/cloudflared/
-COPY config.yaml /etc/cloudflared/
-```
-
-Note that you will need a `config.yaml` and a `cert.pem` for `cloudflared` in the directory that you are working in. The instructions on how to install cloudflared and generate a certificate can be found [here](/quickstart/). For more info on how to setup a `cloudflared` config, see the [configuration
-page](/reference/config/).
-
-Now, we'll install Python and it's dependencies for our example app. This step may be different for
-you depending on the application you want to expose securely with Argo Tunnel.
-
-```docker
-RUN apt-get -yqq install python3 python3-pip
-RUN pip3 install flask
-```
-
-And the entrypoint into our container will be starting Supervisord:
-
-```docker
-CMD ["/usr/bin/supervisord"]
-```
-
-For the purposes of this example, create a Python file `server.py` :
-
-```python
-from flask import Flask
-
-app = Flask(__name__)
-
-@app.route('/') def hello_world(): return "Hello, World!"
-
-if __name__ == '__main__': app.run() ```
-  app.run()
-```
-
-# Configuring Supervisord
-
-Supervisord uses a config file, `supervisord.conf`, to configure options for each service it
-manages. Create `supervisord.conf` and add the following:
-
-```
-[supervisord]
-nodaemon = true
-
-[program: cloudflared]
-command=/opt/flaskapp/cloudflared
-autostart=true
-autorestart=true
-startretries=3
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-
-[program: flask]
-command=/usr/bin/python3.5 /opt/flaskapp/server.py
-autostart=true
-autorestart=true
-startretries=3
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-```
-
-This defines 2 services (`cloudflared` and Flask) and configures some options for them like
-autorestarting and logging to `stdout`. And that's it! This is what the full Dockerfile should look
-like:
-
-```docker
-FROM debian
-
-RUN apt-get -yqq update C
-OPY . /opt/flaskapp
-WORKDIR /opt/flaskapp
-
-# Supervisord
-
-RUN apt-get install -y supervisor
-RUN mkdir -p /var/log/supervisor
-RUN mkdir -p /etc/supervisor/conf.d/
-COPY supervisord.conf /etc/supervisord.conf
-
-# Cloudflared
-
-RUN apt-get install -y wget
-RUN wget -O- https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.tgz | tar xz
-RUN mkdir -p /etc/cloudflared/
-COPY cert.pem /etc/cloudflared/
-COPY config.yaml /etc/cloudflared/
-
-# Python and Flask
-
-RUN apt-get -yqq install python3 python3-pip
-RUN pip3 install flask
-
-# Main
-
-CMD ["/usr/bin/supervisord"]
-```
-
-You should be able to build and run the container, and have `cloudflared` create a tunnel from inside
-your container as defined in the `config.yaml`.
diff --git a/products/argo-tunnel/src/content/reference/doh.md b/products/argo-tunnel/src/content/reference/doh.md
deleted file mode 100644
index 992ac36dd16..00000000000
--- a/products/argo-tunnel/src/content/reference/doh.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 60
----
-
-# DNS over HTTPS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-The `cloudflared` client also supports doing DNS over an encrypted HTTPS connection instead of using the default DNS resolver configured for your server/container/VM/environment.
-
-Instructions are available here for how to run the `cloudflared` DNS over HTTPS proxy [here](https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy/).
diff --git a/products/argo-tunnel/src/content/reference/how-it-works.md b/products/argo-tunnel/src/content/reference/how-it-works.md
deleted file mode 100644
index 17dcf80b144..00000000000
--- a/products/argo-tunnel/src/content/reference/how-it-works.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-order: 20
----
-
-# How Argo Tunnel works
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel connects your web server to the Cloudflare network over an encrypted Tunnel. An example request follows these steps:
-
-* A visitor makes a request to tunnel.yourdomain.com.
-* The DNS lookup resolves to a Cloudflare network address.
-* The visitor connects to the closest Cloudflare edge PoP via Anycast.
-* Cloudflare routes the visitor through a special PoP to PoP route called [Argo Smart Routing](https://www.cloudflare.com/products/argo-smart-routing/) to reach a Cloudflare edge PoP that has an established persistent connection with the Argo Tunnel agent `cloudflared` running on your web server.
-* The request is routed to the `cloudflared` instance running on your server.
-* The Tunnel client forwards the request to your web service.
-
-In more detail:
-
-Argo Tunnel allows you to host any web-based application on the internet, even those that run in a NAT’ed environment.
-
-When the `cloudflared` process starts, the `cloudflared` client will establish an outbound HTTP connection with the two closest Cloudflare data centers. Which data centers are closest is determined by iterating through the SRV DNS record and standard Anycast routing. Simultaneously, a DNS entry is created. Tunnels that use Cloudflare's Load Balancer will create a CNAME record; all other Tunnels will create a AAAA record for your specified hostname. Because the request is initiated from the client, Tunnel is able to expose applications to the internet that are behind a NAT or a firewall without any further port forwarding or configuration.
-
-The connection between `cloudflared` and the Cloudflare edge is a long-lived persistent HTTP2 connection encrypted with TLS. To keep the connection alive, `cloudflared` sends a heartbeat to the edge in the form of a ping frame over HTTP2. If the connection is dropped, the `cloudflared` client re-establishes the connection with Cloudflare. `cloudflared` connects to Cloudflare on port 7844.
-
-For TLS negotiation between Cloudflare and the `cloudflared` client, the `cloudflared` client downloads a certificate for the requested domain (\*.requested-domain.tld) from Cloudflare before starting. The initial login with your Cloudflare credentials through `cloudflared` generates this certificate. This certificate is a self-signed certificate from Cloudflare’s Origin CA service.
-
-All packets between Cloudflare and the tunneled web server use stream multiplexing over HTTP2. In HTTP2, each request/response pair is called a Stream and given a unique Stream ID so that these streams can be “multiplexed” or sent asynchronously over the same connection.
-
-When a visitor makes a request to a web server behind Tunnel, the visitor’s device first performs a DNS lookup to find the address of the server. The DNS answer returned are shared Anycast addresses from Cloudflare’s data centers. Then, Cloudflare routes the request using Argo Smart Routing (optimized data center to data center routing) to one of the two data centers connected to the origin web server. From there, the request is sent to the `cloudflared` client, which then forwards the request to the application.
-
-## Argo Tunnel Runs on Argo
-
-Argo Tunnel is available for free with the purchase of [Argo Smart Routing](https://www.cloudflare.com/products/argo-smart-routing/). Argo Smart Routing is like Waze for internet traffic between Cloudflare data centers: it chooses the optimal route to get a packet across the internet, using Cloudflare data centers as a virtual backbone. For example, if a visitor in Frankfurt is visiting an application with a server in Virginia, Cloudflare may send the visitor’s request from the FRA data center, to the LHR data center, to the EWR data center, to the IAD data center, or whatever is the fastest and least congested path at that time. This means that requests to servers behind Tunnel are not only secure by default, they are fast.
-
-Why is Argo Tunnel a part of Argo? When a visitor requests an application behind Tunnel, the visitor first hits the closest Cloudflare data center to them, and then needs to be routed to one of the data centers that has the virtual Tunnel connection back to the web server. This is what Argo specializes in - finding the most optimal way to route from one Cloudflare data center to another. It made sense to combine the two products so that we could provide better routes and faster service for the visitor.
-
-## How does Argo Tunnel compare with a GRE tunnel?
-
-The old way to ensure a web server was locked down to external traffic was by using a GRE tunnel, which is a slow and expensive technology. If you are a network admin currently using a GRE tunnel, we suggest moving to Argo Tunnel to lower your costs and increase your performance. It’s the same security without the hassle or latency.
-
-Why is GRE tunneling inadequate? GRE is a tunneling protocol for sending data between two servers by simulating a physical link. Configuring a GRE tunnel requires coordination between network administrators from both sides of the connection. It is an expensive service that is usually only available for large corporations with dedicated budgets. The GRE protocol encapsulates packets inside other packets, which means that you will have to either lower the MTU of your origin servers, or have your router do packet fragmentation, leading to slower responses.
diff --git a/products/argo-tunnel/src/content/reference/index.md b/products/argo-tunnel/src/content/reference/index.md
deleted file mode 100644
index e9ab1eb4570..00000000000
--- a/products/argo-tunnel/src/content/reference/index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-order: 100
-hidden: true
----
-
-# Reference
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Guides and references for Argo Tunnel and `cloudflared`.
-
-<DirectoryListing path="/reference"/>
diff --git a/products/argo-tunnel/src/content/reference/kubernetes.md b/products/argo-tunnel/src/content/reference/kubernetes.md
deleted file mode 100644
index 3ebc399f7d6..00000000000
--- a/products/argo-tunnel/src/content/reference/kubernetes.md
+++ /dev/null
@@ -1,202 +0,0 @@
----
-order: 80
----
-
-# Kubernetes Ingress Controller
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Cloudflare will end support for our Kubernetes Ingress Controller at the end of 2019.
-The project is open source and we will continue to make it available in our GitHub repository. More information can be found <a href="https://github.com/cloudflare/cloudflare-ingress-controller/issues/172#issuecomment-541230988">here</a>.
-
-We still believe that using Argo Tunnel and k8s together is a strong combination, but have
-learned that running `cloudflared` as a sidecar is generally a more reliable and faster
-approach. You can find more information about running Argo tunnel in a sidecar model [here](/argo-tunnel[/reference/sidecar/).
-
-</Aside>
-
-Playing around with the Argo Tunnel Ingress Controller is easy, and can be done on any Kubernetes
-cluster ([Google GKE][k8s-google-gke], [Amazon EKS][k8s-amazon-eks], [Microsoft AKS][k8s-microsoft-aks]).
-If you don't have one, you can create a local Kubernetes cluster with [Minikube][k8s-minikube].
-
-For use-cases that require more than a single controller replica, you will need to purchase
-[Cloudflare Load Balancing][cflare-load-balancing] to use Argo Tunnel Ingress Controller.
-In the future, Cloudflare Load Balancing will be a configuration option, and the Ingress
-Controller will be usable without Load Balancing.
-
-In this example, we're going to expose a private version of the `echoserver` through Argo Tunnel.
-This example assumes you have a Kubernetes cluster running on one of the platforms mentioned above.
-
-## Step One: Download `cloudflared` & Generate a Certificate
-Download and install `cloudflared` [here][cflare-tunnel-daemon].
-
-Then, run `cloudflared login` and select a domain to generate and download a certificate. Make sure the certificate is placed into `~/.cloudflared/cert.pem`
-
-## Step Two: Install the Ingress Controller with Helm
-[Helm][help] is a package manager for kubernetes which defines an application as a set of templates. This makes it easy to install and update applications in a kubernetes cluster.
-
-Add the repository that holds the Helm chart:
-
-```sh
-$ helm repo add cloudflare https://cloudflare.github.io/helm-charts
-$ helm repo update
-```
-
-The Helm chart that describes all the components is found [here][cflare-github-helm].
-
-Install the Controller with Helm:
-
-```sh
-$ helm install --name anydomain --namespace default \
-    --set rbac.create=true \
-    --set controller.ingressClass=argo-tunnel \
-    --set controller.logLevel=6 \
-    cloudflare/argo-tunnel
-```
-> **Note**: the controller watches all namespaces.
-
-## Step Three: Deploy a Service into a Kubernetes Cluster
-The `echoserver` image starts a http listener that simply mimics the request as its response.
-
-Create a manifest called echo.yaml:
-
-```yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: echo
-  name: echo
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: echo
----
-apiVersion: extensions/v1beta1
-kind: Deployment
-metadata:
-  labels:
-    app: echo
-  name: echo
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: echo
-  template:
-    metadata:
-      labels:
-        app: echo
-    spec:
-      containers:
-      - name: echo
-        image: k8s.gcr.io/echoserver:latest
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 8080
-        resources:
-          limits:
-            cpu: 10m
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 20Mi
-      terminationGracePeriodSeconds: 60
-```
-
-Deploy `echoserver` into your Kubernetes cluster:
-
-```sh
-$ kubectl apply -f echo.yaml`
-```
-> **Tip**: `-n` sets the namespace for deployment.
-
-## Step Four: Create a Tunnel Secret
-Convert the domain certificate into a tunnel secret:
-
-```sh
-$ kubectl create secret generic mydomain.com --from-file="$HOME/.cloudflared/cert.pem"
-```
-> **Tip**: `-n` sets the namespace for deployment.
-
-## Step Five: Create an Ingress Definition
-The Kubernetes Ingress is a spec for external connectivity to a Kubernetes service. Typically,
-an ingress will contain an annotation, `kubernetes.io/ingress.class`, to identify the controller
-that should handle the ingress.
-
-The ingress manifest contains:
-
-- an annotation `kubernetes.io/ingress.class: argo-tunnel`, matching the controller.
-- mappings between `host` and service name, port, path that should be exposed.
-- mappings between `host` and tunnel secret
-
-Create an ingress definition called `echo-tunnel.yaml`:
-```yaml
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: argo-tunnel
-  labels:
-    ingress: argo-tunnel
-  name: echo
-spec:
-  tls:
-  - hosts:
-    - echo.mydomain.com
-    secretName: mydomain.com
-  rules:
-  - host: echo.mydomain.com
-    http:
-      paths:
-      - backend:
-          serviceName: echo
-          servicePort: http
-```
-**Note:**
-
-- the Ingress must be deployed in the **same namespace** as the Service
-- the Ingress must be deployed in the **same namespace** as the Secret
-- the `host` must belong the domain certificate (tunnel secret)
-
-Deploy the Ingress:
-```sh
-$ kubectl apply -f echo-tunnel.yaml
-```
-> **Tip**: `-n` sets the namespace for deployment.
-
-The ingress controller opens a tunnel between the Cloudflare edge and the Kubernetes virtual service IP.
-
-## Step Six: Use the Tunnel
-The ingress controller opens a tunnel between the Cloudflare edge and the Kubernetes virtual service IP.
-
-Curl the tunnel:
-```sh
-$ curl http://echo.mydomain.com
-```
-
-Questions? Feedback? [We're listening
-here][community-feedback].
-
-[cflare-helm]: https://cloudflare.github.io/helm-charts/
-[cflare-github-ingress]: https://github.com/cloudflare/cloudflare-ingress-controller
-[cflare-github-helm]: https://github.com/cloudflare/helm-charts/tree/master/charts/argo-tunnel
-[cflare-ingress-release]: https://github.com/cloudflare/cloudflare-ingress-controller/releases/tag/0.5.3
-[cflare-load-balancing]: https://www.cloudflare.com/load-balancing/
-[cflare-tunnel-daemon]: https://developers.cloudflare.com/argo-tunnel/downloads/
-[community-feedback]: https://community.cloudflare.com/t/cloudflare-ingress-controller-beta-feedback/9377
-[helm]: http://helm.sh/
-[k8s-amazon-eks]: https://aws.amazon.com/eks/
-[k8s-google-gke]: https://cloud.google.com/kubernetes-engine/
-[k8s-microsoft-aks]: https://azure.microsoft.com/en-gb/services/container-service/
-[k8s-minikube]: https://kubernetes.io/docs/getting-started-guides/minikube/
diff --git a/products/argo-tunnel/src/content/reference/load-balancing.md b/products/argo-tunnel/src/content/reference/load-balancing.md
deleted file mode 100644
index 29da3399cb0..00000000000
--- a/products/argo-tunnel/src/content/reference/load-balancing.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-order: 35
----
-
-# Load balancing
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can create a load balancer within Cloudflare which will direct traffic to
-Argo Tunnels which have been started on multiple machines or even on multiple continents.
-This is the recommended way to deploy high-availability tunnels in production, and allows
-you to use all of the powerful features provided by [Cloudflare Load Balancing](https://www.cloudflare.com/load-balancing/).
-
-The first step is to ensure you have load balancing enabled in your Cloudflare account. Visit
-the Traffic tab of the Cloudflare Dashboard and click "Enable Load Balancing". Each instance of `cloudflared`
-is counted as one origin.
-
-Next, start your tunnel with the `--lb-pool` flag:
-
-```sh
-$ cloudflared tunnel --hostname my.example.com --url http://localhost:8080 --lb-pool my-pool-name-goes-here
-```
-
-You can name your pool anything you like, we will automatically create it for you if it does not exist.
-This example will connect the local port 8080 to your new load balancer, and connect that load
-balancer to my.example.com.
-
-<Aside>
-
-A single load balancer pool can contain either Argo Tunnel origins, or non-Argo Tunnel origins, but not both. Mixed pools are not supported.
-</Aside>
-
-All pools will be created inside a load balancer identified by the hostname specified for your Argo Tunnels.
-You can have a single pool in your load balancer, or create multiple pools to build more complex topologies.
-
-Each Argo Tunnel is composed of multiple connections which each get load balanced individually. You will see 4 origins
-in your load balancer configuration, but you will only be billed for one origin per Argo Tunnel.
-
-You'll generally want to add a health check which will periodically check your application through
-your tunnel. You can configure a health check through the load balancing API or UI. The one note is
-you should manually specify your Tunnel's hostname as the Host header:
-
-![Health Check UI](../static/img/load-balancing/health-check-header.png)
-
-## Fall-back pools
-Users can configure fall-back pools in the event that service through an active tunnel is disrupted. The fall-back pool will consist of origin servers that can be reached over IP networks using TLS encryption and by making sure that the [Cloudflare IP addresses](https://www.cloudflare.com/ips/) are allowed (whitelisted) to reach to origin servers in this fall-back pool.
-
-The failover threshold from Argo Tunnel pool (number of healthy servers in the pool, number of [health-check failures](https://support.cloudflare.com/hc/en-us/articles/230866667-Identifying-Load-Balancing-Health-Checks), etc.), can be configured accordingly. In events that a fail-over to the fall-back pool may happen, the primary pool (Argo Tunnel) will become active again as soon as the configured threshold for number of healthy servers and state of health-checks is restored.
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/reference/multiple-hostnames.md b/products/argo-tunnel/src/content/reference/multiple-hostnames.md
deleted file mode 100644
index 729bfb01576..00000000000
--- a/products/argo-tunnel/src/content/reference/multiple-hostnames.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-order: 40
----
-
-# Multiple hostnames
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel has a 1-1 relationship of tunnel to hostname. Tunnels can only accept traffic for one hostname for each instance of Tunnel. Typically if you want to run Tunnel for multiple hostnames, such as foo.example.com and bar.example.com, you need to run multiple Tunnel clients side by side.
-
-There is one way to workaround this and run one Tunnel instance that can accept traffic across multiple hostnames, if the hostnames are on the same domain and same Level. (aka foo.example.com can be CNAME'd to bar.example.com, but not foo.com or foo.bar.example.com)
-
-To begin, start Tunnel on one hostname. Next, navigate to the  DNS tab in the Cloudflare dashboard. Create CNAME records from the other hostnames you'd like to be passed back to Tunnel that point to the Tunnel with the original hostname.
-
-For example, if you would like to run Tunnel on foo.example.com as well as bar.example.com but don't want to run multiple instances of Tunnel, you can do:
-
-1. Install Tunnel and run it on foo.example.com.
-2. Open up the DNS editor in the Cloudflare dashboard.
-3. Add a CNAME record for bar.example.com so that it points to foo.example.com. (Name would be foo and value would be bar.example.com)
-4. Done. You can continue to point CNAME records to foo.example.com and as Cloudflare receives those requests, it will send the packets back to your origin server running Tunnel.
diff --git a/products/argo-tunnel/src/content/reference/service.md b/products/argo-tunnel/src/content/reference/service.md
deleted file mode 100644
index 3d4f46b6b7a..00000000000
--- a/products/argo-tunnel/src/content/reference/service.md
+++ /dev/null
@@ -1,126 +0,0 @@
----
-order: 30
----
-
-# Automatically starting Argo Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Argo Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS.
-
-By default, Argo Tunnel expects all of the configuration to exist in the `cloudflared/config.yml` configuration file. The available options are documented on the [configuration file reference](../reference/config.md), but at a minimum you should set `hostname` and `url`.
-
-## Linux
-
-Run the following command:
-
-```sh
-$ sudo cloudflared service install
-```
-
-If you have already logged in and have a certificate and (optionally) configuration file in `~/.cloudflared/`, these will be copied to `/etc/cloudflared/`. If you do not have a configuration file, you will need to create a `config.yml` file in the `etc/cloudflared` directory. The file must contain at least the following arguments:
-
-```yml
-hostname: tunnel.yourdomain.com
-url: https://localhost:8000
-logfile: /var/log/cloudflared.log
-```
-
-Sometimes firewalls or unusual network configuration can prevent `cloudflared` from automatically installing the certificate. If this occurs, your browser will download the certificate as a file named `cert.pem` after you login. You should see it in your browser's standard list of downloaded files. You'll need to move that `cert.pem` file from your browser's downloads folder into the `~/.cloudflared` folder. Copy and paste the following command to move the certificate to the `~/.cloudflared` directory on your system.
-
-```sh
-$ mv cert.pem ~/.cloudflared/cert.pem
-```
-
-## macOS
-
-To run at login, open a Terminal and run the following command:
-
-```sh
-$ cloudflared service install
-```
-
-Argo Tunnel will be installed as a launch agent, and start whenever you log in, using your local user configuration found in `~/.cloudflared/`.
-
-You can manually start the service by running:
-
-```sh
-$ launchctl start com.cloudflare.cloudflared
-```
-
-Output will be logged to `~/Library/Logs/com.cloudflare.cloudflared.err.log` and `~/Library/Logs/com.cloudflare.cloudflared.out.log`.
-
-If you wish to run at boot, open a Terminal and run the following command:
-
-```sh
-$ sudo cloudflared service install
-```
-
-Argo Tunnel will be installed as a launch daemon, and start whenever your system boots, using your configuration found in `/etc/cloudflared`.
-
-You can manually start the service by running:
-
-```sh
-$ sudo launchctl start com.cloudflare.cloudflared
-```
-
-Output will be logged to `/Library/Logs/com.cloudflare.cloudflared.err.log` and `/Library/Logs/com.cloudflare.cloudflared.out.log`.
-
-## Windows
-
-Open a Command Prompt with Administrator privileges, then type the following command:
-
-```bash
-PS C:\Cloudflared> .\cloudflared.exe service install
-```
-
-When running as a service, Argo Tunnel expects its configuration at `C:\Windows\system32\config\systemprofile\.cloudflared\config.yml` (assuming Windows is installed to C:\). You can copy your local configuration from `%UserProfile%\.cloudflared\config.yml`.
-
-If you need to specify a custom config file location, you can do so in the the Windows registry after the service has been installed ([MSDN reference](https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicebase.onstart?view=netframework-4.7.2)). Open `regedit`, go to the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cloudflared`, and edit the `ImagePath` value to include `--config <path-to-config>`.
-
-<Aside>
-
-When running cloudflared as a service on Windows, the certificate path needs to be explicitly specified. This can be done in the config file:
-
-```yaml
-origincert: C:\ABSOLUTE\PATH\TO\cert.pem
-```
-
-In some cases, forward slashes should be used to set the explicit path to the certificate.
-
-* In "Raw" YAML scalars, the backslash should be used directly. For example, `C:\cert.pem`.
-* In single-quoted scalars, the backslash should be used directly. For example, `'C:\cert.pem'`.
-* In double-quoted scalars, a forward slash should be used or the backslash should be escaped. For example, `"C:\\cert.pem"`.
-
-```yaml
-origincert: C:/cert.pem
-```
-</Aside>
-
-<Aside>
-
-`cloudflared` will set up Recovery Properties of the service so it restarts on failure, but **this feature is not fully supported on Windows Server 2003 and Windows XP.**
-
-</Aside>
-
-<Aside>
-
-`cloudflared` does not support loading the system certificate pool in Windows.
-To supply a certificate pool to `cloudflared` in Windows, encode the pool into a PEM file and supply it through the `--origin-ca-pool` flag.
-</Aside>
-
-To start the service, go to Service Manager and start the **Argo Tunnel agent** service, or run the following command:
-
-```bash
-C:\> sc start cloudflared
-```
-
-If you are a Powershell user, run this command instead:
-
-```bash
-PS C:> Start-Service cloudflared
-```
diff --git a/products/argo-tunnel/src/content/reference/tiered-subdomains.md b/products/argo-tunnel/src/content/reference/tiered-subdomains.md
deleted file mode 100644
index 6e56c084e7e..00000000000
--- a/products/argo-tunnel/src/content/reference/tiered-subdomains.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-order: 50
----
-
-# Multi-Level subdomains
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can run Tunnel to expose a multi-level subdomain, such as foo.bar.example.com. The certificate generated by Tunnel will cover the first tier of subdomains and the apex (i.e. \*.example.com and example.com) by default. To extend it to a multi-level subdomain, you can follow two options: a CNAME solution or one that uses your own TLS certificate.
-
-### Option 1: DNS solution
-
-The first option is for you to run Tunnel on a separate domain, and then CNAME the domain you wish to expose to that original Warped domain. How this works:
-
-1. Run Tunnel on your origin server and expose your service on a single-level subdomain such as warp.example.com.
-2. Open up the Cloudflare DNS panel and create a CNAME record for the multi-level domain to the domain where Tunnel is running: CNAME foo.bar.example.com ==> warp.example.com.
-
-### Option 2: Bring your own TLS certificate
-
-The reason why you need a custom solution to run Tunnel on a multi-level domain is because the certificate Tunnel generates for your origin server is not valid beyond one subdomain level.
-
-In order to include more hostnames, you can bring your own TLS certificate. Below are instructions for how to use Tunnel with a custom certificate.
-
-1. Install `cloudflared` on your machine
-2. Run the following command when the browser window opens and select the domain in Cloudflare that will be used. The login flow will download a certificate to your origin server.
-
-```sh
-$ cloudflared tunnel login
-```
-
-3. The downloaded certificate will automatically be placed in ~/.cloudflared/cert.pem.
-4. If you open the certificate file, you will see it has three sections: private key, certificate and Tunnel token. Later on you will replace the private key and certificate sections.
-
-```bash
-    -----BEGIN PRIVATE KEY-----
-    MIGHAgEAMBMwd51w/9Ne9nmMolCD0Z8s6AMBMwd51w/9Ne9nmMolCD0Z8s6
-    -----END PRIVATE KEY-----
-    -----BEGIN CERTIFICATE-----
-    MIIDKzCCAtCgAwIBAgIUfk7smiHna9wiBasCpbVyeg6vBRAwCgYIKoZIzj0EAwIw
-    gY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-    YW4gRnJhbmNpc2NvvdWRmbGFyZS5jb20vb3JpZ2luX2Vj
-    Y19jYS5jcmwwCgYIKoZIzj0EAwIDSQAwRgIhANZOIFV/kWzbHVbpmTYewL6hPEdC
-    YgtWeoaU3x5WsnFQAiEAjYSW1LE1A0HjCzU0ZpEzElzo0YbVPbj57eaUV7gk+Tg=
-    -----END CERTIFICATE-----
-    -----BEGIN Tunnel TOKEN-----
-    OWJkMDQ1ZTcxMDQ1ZWI2NTZhZmEwYzRiYTRkMjRhZjQKdjEuMC1kOWMyNTY4MmQ4
-    NTBkYzdjYTc1YzQ0ZlYjI5ZjIxNTU5NjhjOTE0MzY4YTkyYmUwODdhNzRj
-    ZmEyMTU3Y2I5ZjU0MDMwMTczY2Q5MmQ3OTE0MWZkNWVmMTA5MGIxLTIxNjAxZjUz
-    OWQwZjRlMjU3MDRjNmRhNzVjYTZjOTE3NmMwMDRhZGU4OTQ3NDIwOTE4Y2QyZGU2
-    N2ExMWNhNDE=
-    -----END Tunnel TOKEN-----
-```
-
-5. Next, generate a certificate for your origin server. Cloudflare offers a free Certificate Authority for generating origin certificates that are only trusted by Cloudflare. To do so, login to the Cloudflare dashboard and [visit the SSL/TLS tab.](https://dash.cloudflare.com?to=/:account/:zone/ssl-tls/origin)
-6. Scroll down to the section titled Origin Certificates. In that table you will see certificates Tunnel generated for your server.
-7. Click the button labeled 'Create Certificate'.
-8. When the modal opens, select the checkbox for "Let Cloudflare generate a private key and a CSR". You may keep RSA selected as the key type. Then list the hostname you need to Warp, such as foo.bar.example.com.
-9. Cloudflare will then present you a certificate to use for your origin.
-10. Open up the file at ~/.cloudflared/cert.pem and replace the private key and certificate sections with the values Cloudflare shows in the dashboard.
-11. Once you are finished, you can exit the modal in the dashboard by clicking 'Ok'.
-
-<Aside>
-
-If you use an encrypted certificate file, the Tunnel client won't prompt for the passphrase and the certificate will not work.
-</Aside>
-
-You can now start Tunnel on a multi-level subdomain.
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/routing-to-tunnel/dns.md b/products/argo-tunnel/src/content/routing-to-tunnel/dns.md
deleted file mode 100644
index 55b86fc5a68..00000000000
--- a/products/argo-tunnel/src/content/routing-to-tunnel/dns.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-order: 50
----
-
-# DNS record
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Create an Argo Tunnel](/create-tunnel) |
-| 2. [Configure the Tunnel](/configuration) |
-
-## Route traffic from the Cloudflare dashboard
-
-When you create an Argo Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
-
-Unlike publicly routable IP addresses, the subdomain will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.
-
-1. Navigate to the **Cloudflare DNS** tab.
-2. Create a new CNAME record and input the subdomain of your Tunnel into the Target field.
-3. Click **Save**.
-
-![DNS tab](../static/img/dns/dns-record.png)
-
-The DNS record is distinct from the state of the Tunnel. You can create DNS records that point to a Tunnel that is not currently running. If the Tunnel stops running, the DNS record will not be deleted. If you point the DNS record to a Tunnel not currently running visitors will see a 1016 error message.
-
-Additionally, you can create multiple DNS records that point to the same Tunnel subdomain. If you are routing traffic from multiple hostnames to multiple services, you will need to create a CNAME entry for each hostname. The CNAME entries will share the same target.
-
-## Route traffic from the command line
-
-You can create DNS records from `cloudflared`, which will provision a CNAME record that points to the subdomain of a specific Tunnel. The result is the same as creation from the dashboard above.
-
-To do so, run the following command.
-
-```sh
-$ cloudflared tunnel route dns <UUID or NAME> www.app.com
-```
-
-The command will create a CNAME record that points to the Tunnel subdomain, but will not proxy traffic if the Tunnel is not currently running.
-
-Note: this command requires the `cert.pem` file.
diff --git a/products/argo-tunnel/src/content/routing-to-tunnel/index.md b/products/argo-tunnel/src/content/routing-to-tunnel/index.md
deleted file mode 100644
index 3c1e3391ce6..00000000000
--- a/products/argo-tunnel/src/content/routing-to-tunnel/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-order: 4
----
-
-# Route to a Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare can route traffic to your Argo Tunnel connection using a [DNS record](/routing-to-tunnel/dns) or Cloudflare’s [Load Balancer](/routing-to-tunnel/lb) product.
-
-You can configure either option from the Cloudflare dashboard by pointing a DNS CNAME record or a Load Balancer pool to the Argo Tunnel subdomain for your connection. You can also associate these records with your Tunnel from `cloudflared` directly.
-
-Argo Tunnel can also [be configured](/configuration/ingress) to route traffic to multiple hostnames to multiple services in your environment.
\ No newline at end of file
diff --git a/products/argo-tunnel/src/content/routing-to-tunnel/kubernetes.md b/products/argo-tunnel/src/content/routing-to-tunnel/kubernetes.md
deleted file mode 100644
index 82e9d44d8f2..00000000000
--- a/products/argo-tunnel/src/content/routing-to-tunnel/kubernetes.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-order: 40
----
-
-# Kubernetes
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can deploy Argo Tunnel to route traffic to Kubernetes clusters. Cloudflare no longer maintains an ingress controller, but we recommend two options for connecting Kubernetes clusters to Cloudflare without introducing downtime caused by application restarts or `cloudflared` updates.
-
-Both options rely on Cloudflare's Load Balancer to send traffic for a single hostname to two or more instances of `cloudflared`, allowing you to update or modify `cloudflared` without downtime. Those instances of `cloudflared` should point to a service or ingress controller that runs in front of your Kubernetes cluster.
-
-| Before you start |
-|---|
-| 1. [Enable Cloudflare Load Balancers](https://developers.cloudflare.com/load-balancing/create-load-balancer-ui)  |
-| 2. [Create a Tunnel](/create-tunnel) |
-
-## Deploy `cloudflared` to an upstream service
-
-1. Create at least two Tunnels; each with their own dedicated Tunnel ID and associated credentials file.
-
-2. Upload the credentials file for each Tunnel as k8s secrets.
-
-3. Create a service that represents your application. In doing so, updates to the application do not impact the Tunnel configuration. For example, an `httpbin` service can be used.
-
-4. Create two deployments with one replica each using `cloudflared`. Configure `cloudflared` to point to the service IP of the upstream service. Mount the secrets created in Step 1 and point `cloudflared` to the right path.
-
-5. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/routing-to-tunnel/lb) to the two or more Argo Tunnel connections.
-
-Once configured, you can update `cloudflared` by updating one deployment and then proceeding to the next one once you've verified the newly updated cloudflared pod is running and connected.
-
-## Deploy in front of an ingress controller
-
-1. Create at least two Tunnels; each with their own dedicated Tunnel ID and associated credentials file.
-
-2. Upload the credentials file for each Tunnel as k8s secrets.
-
-3. Create two deployments with one replica each using `cloudflared`. Configure `cloudflared` to point to an ingress controller. Mount the secrets created in Step 1 and point `cloudflared` to the right path.
-
-4. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/routing-to-tunnel/lb) to the two or more Argo Tunnel connections.
diff --git a/products/argo-tunnel/src/content/routing-to-tunnel/lb.md b/products/argo-tunnel/src/content/routing-to-tunnel/lb.md
deleted file mode 100644
index f0d3d0f89e2..00000000000
--- a/products/argo-tunnel/src/content/routing-to-tunnel/lb.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-order: 50
----
-
-# Load balancers
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Create an Argo Tunnel](/create-tunnel) |
-| 2. [Configure the Tunnel](/configuration) |
-| 3. [Create a Load Balancer pool in Cloudflare](https://developers.cloudflare.com/load-balancing/create-load-balancer-ui) |
-
-## Route traffic from the dashboard
-
-When you create an Argo Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
-
-Unlike publicly routable IP addresses, the subdomain will only proxy traffic for a DNS record or a Load Balancer pool in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.
-
-To add an Argo Tunnel connection to a Cloudflare Load Balancer pool:
-
-1. Navigate to the Load Balancer page in the Cloudflare dashboard.
-2. Create or edit an existing Origin Pool. Add the Argo Tunnel subdomain as an Origin Address.
-3. Click `Save`.
-
-## Route traffic from the command line
-
-You can add Argo Tunnel to an existing load Balancer pool directly from `cloudflared`. The result is the same as creation from the dashboard above.
-
-To do so, run the following command:
-
-```sh
-$ cloudflared tunnel route lb <tunnel ID or NAME> <load balancer name> <load balancer pool>
-```
-
-**Note**: this command requires the `cert.pem` file.
diff --git a/products/argo-tunnel/src/content/run-tunnel/index.md b/products/argo-tunnel/src/content/run-tunnel/index.md
deleted file mode 100644
index 63015063e05..00000000000
--- a/products/argo-tunnel/src/content/run-tunnel/index.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-order: 5
----
-
-# Run a Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Create a Tunnel](/create-tunnel) |
-| 2. [Configure the Tunnel](/configuration) |
-| 3. [Configure routing to the Tunnel](/routing-to-tunnel) |
-
-Once you have created a Tunnel and decided how to route traffic to that Tunnel, you can run the Tunnel to proxy incoming traffic from the Tunnel to any number of services running locally on your origin. To begin, run the Tunnel with the following command. The command will connect `cloudflared` to Cloudflare's edge, using the configuration supplied. Traffic will route to the Tunnel based on the DNS or Load Balancer settings.
-
-`cloudflared tunnel --config path/config.yaml run <NAME>`
-
-If you have deleted the `cert.pem` file, you must specify the UUID instead of the name.
-
-`cloudflared tunnel --config path/config.yaml run <UUID>`
-
-You can also specify the Tunnel name or UUID inside of the configuration file, in which case the command below will invoke the `run` command for that Tunnel.
-
-`cloudflared tunnel --config path/config.yaml run`
-
-If you do not specify a configuration file location, `cloudflared` will attempt to read a configuration file in `~/.cloudflared/config.yml`.
-
-When `cloudflared` receives a HTTP request from the internet it matches the incoming request to an ingress rule from the config file. The ingress rules specify which traffic should go to which local services. See the section on [Ingress Rules](/configuration/ingress).
-
-You can also run the Tunnel without a configuration file by appending the flags after the `run` command and before the name or UUID. Running your tunnel this way will route _all_ traffic to the given URL.
-
-`cloudflared tunnel run --url localhost:3000 <NAME or UUID>`
-
-![Run tunnels](../static/img/create-tunnel/rt1.png)
-
-Once run, this command will establish an outbound-only connection to Cloudflare’s edge. That connection will not yet serve traffic. Any requests made to the Tunnel directly will fail. To route traffic from a hostname or load balancer pool, follow the routing instructions.
-
-You can also:
-* [Run a tunnel as a service](/run-tunnel/run-as-service)
diff --git a/products/argo-tunnel/src/content/run-tunnel/run-as-service.md b/products/argo-tunnel/src/content/run-tunnel/run-as-service.md
deleted file mode 100644
index 4779c9d2ab7..00000000000
--- a/products/argo-tunnel/src/content/run-tunnel/run-as-service.md
+++ /dev/null
@@ -1,227 +0,0 @@
----
-order: 30
----
-
-# Run as a service
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-| Before you start |
-|---|
-| 1. [Create a Tunnel](/create-tunnel) |
-| 2. [Configure the Tunnel](/configuration) |
-| 3. [Configure routing to the Tunnel](/routing-to-tunnel) |
-
-Argo Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS.
-
-By default, Argo Tunnel expects all of the configuration to exist in the `cloudflared/config.yml` configuration file. The available options are documented on the [configuration file reference](/configuration/config/), but at a minimum you must specify the following arguments to run as a service:
-
-|Argument|Description|
-|---|---|
-|`url`|The destination for proxied traffic in your environment if your origin is not listening on localhost:8080|
-|`tunnel`|The UUID of your Tunnel
-|`credentials-file`|The location of the credentials file for your Tunnel|
-
-You must [create the Tunnel](/create-tunnel), and its credentials file, prior to installing it as a service. Creating the Tunnel in advance will generate the `credentials` file.
-
-If you do not want to create the tunnel in advance, you must install `cloudflared` with the `--legacy` flag.
-
-## Linux
-
-Run the following command:
-
-```sh
-$ sudo cloudflared service install
-```
-
-If you have already logged in and have a configuration file in `~/.cloudflared/`, these will be copied to `/etc/cloudflared/`.
-
-If you do not have a configuration file, you will need to create a config.yml file with fields listed above. You can pass a custom file by running `cloudflared --config CONFIG-FILE service install`.
-
-<Aside>
-
-The above arguments are required for pre-configured Argo Tunnel deployments. If you are using legacy Argo Tunnel, without names, you can append the `--legacy` flag when running cloudflared tunnel install command.
-
-</Aside>
-
-## macOS
-
-### Run at login
-
-Open a Terminal and run the following command:
-
-```sh
-$ cloudflared service install
-```
-
-Argo Tunnel will be installed as a launch agent, and start whenever you log in, using your local user configuration found in `~/.cloudflared/`.
-
-#### Manually start the service
-
-Run the following command:
-
-```sh
-$ launchctl start com.cloudflare.cloudflared
-```
-
-Output will be logged to `~/Library/Logs/com.cloudflare.cloudflared.err.log` and `~/Library/Logs/com.cloudflare.cloudflared.out.log`.
-
-### Run at boot
-
-Run the following command:
-
-```sh
-$ sudo cloudflared service install
-```
-
-Argo Tunnel will be installed as a launch daemon, and start whenever your system boots, using your configuration found in `/etc/cloudflared`.
-
-#### Manually start the service
-
-Run the following command:
-
-```sh
-$ sudo launchctl start com.cloudflare.cloudflared
-```
-
-Output will be logged to `/Library/Logs/com.cloudflare.cloudflared.err.log` and `/Library/Logs/com.cloudflare.cloudflared.out.log`.
-
-## Windows
-
-To run as a service on Windows, you must specify four arguments in the configuration file.
-
-|Argument|Description|
-|---|---|
-|`url`|The destination for proxied traffic in your environment if your origin is not listening on localhost:8080|
-|`tunnel`|The UUID of your Tunnel
-|`credentials-file`|The location of the credentials file for your Tunnel|
-|`logfile`|The location to store `cloudflared` logs`
-
-Before starting, download `cloudflared` and place the `cloudflared.exe` in a location accessible to the OS. This example assumes the executable is stored in the following location:
-
-```bash
-C:\Cloudflared\bin\cloudflared.exe
-```
-
-### Install `cloudflared`
-
-1. Open a Command Prompt with Administrator privileges.
-
-2. Run the following command to install `cloudflared` as a service.
-
-```bash
-C:\Cloudflared\bin\cloudflared.exe service install
-```
-
-Assuming Windows is installed to `C:\`, when running as a service, Argo Tunnel expects the configuration to be available at the following path:
-
-`C:\Windows\system32\config\systemprofile\.cloudflared\config.yml` .
-
-You can copy your local configuration from:
-
-`%UserProfile%\.cloudflared\config.yml`.
-
-If that directory is not available, you can execute the following command to create the directory.
-
-```bash
-mkdir C:\Windows\System32\config\systemprofile\.cloudflared
-```
-
-### (Optional) Specify a custom location for the config file
-
-By default, the Windows service runs in “access” client mode. If you need to specify a custom config file location, you can do so in the Windows registry after the service has been installed ([MSDN reference](https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicebase.onstart?view=netframework-4.7.2)):
-
-1. Open `regedit`.
-2. Go to the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cloudflared`.
-3. Edit the `ImagePath` value to include `--config <path-to-config>`.
-
-Additionally, you will need to add `tunnel run` arguments and, in some cases, a pointer to the config file. For example: `.../cloudflared.exe tunnel [--config FILE] run`.
-
-### Authenticate `cloudflared`
-
-Run the following command to login to Cloudflare and authenticate `cloudflared`.
-
-```bash
-C:\Cloudflared\bin\cloudflared.exe login
-```
-
-Once authenticated, copy the certificate to the `systemprofile` directory.
-
-```bash
-copy C:\Users\%USERNAME%\.cloudflared\cert.pem C:\Windows\System32\config\systemprofile\.cloudflared
-```
-
-### Create, route, and configure the Tunnel
-
-You can now [create](/create-tunnel) an Argo Tunnel and edit the configuration file to [configure](/configuration) `cloudflared`. We recommend setting the [routing](/routing-to-tunnel) before running the service in the next step.
-
-<Aside>
-
-When running `cloudflared` as a service on Windows, the path to the credentials file in the configuration file needs to be explicitly specified.
-
-```yaml
----
-filename: config.yml
----
-credentials-file: C:\ABSOLUTE\PATH\TO\UUID.json
-```
-
-In some cases, forward slashes should be used to set the explicit path to the credentials file.
-
-* In "Raw" YAML scalars, the backslash should be used directly. For example, `C:\UUID.json`.
-* In single-quoted scalars, the backslash should be used directly. For example, `'C:\UUID.json'`.
-* In double-quoted scalars, a forward slash should be used or the backslash should be escaped. For example, `"C:\\UUID.json"`.
-
-```yaml
----
-filename: config.yml
----
-credentials-file: C:/UUID.json
-```
-
-</Aside>
-
-### Start the service
-
-To start the service, open the Service Manager, select `Argo Tunnel agent` and open the `General` tab. In the `Start parameters` field, specify the location of the configuration file and place the `tunnel run` command after the path. For example:
-
-![DNS tab](../static/img/windows/start-param.png)
-
-Once applied, you can click `Start` to run the Tunnel.
-
-<Aside>
-
-The Services UI in Windows will allow you to set Start parameters, and Start the service, but in some cases it may not save. This appears to be a general issue within Windows Services configuration. To save the `Start parameters` value, we recommend [editing the values](https://stackoverflow.com/questions/1488851/how-to-pass-a-parameter-to-a-windows-service-once-and-for-all-at-install-instead) in the Services registry directly.
-
-</Aside>
-
-Alternatively, you can run the following commands to start Argo Tunnel as a service:
-
-```
-C:\> sc start cloudflared tunnel run
-```
-
-If you are a Powershell user, run this command instead:
-
-```
-PS C:> Start-Service cloudflared tunnel run
-```
-
-<Aside>
-
-`cloudflared` will set up Recovery Properties of the service so it restarts on failure, but **this feature is not fully supported on Windows Server 2003 and Windows XP.**
-
-</Aside>
-
-### Start on reboot
-
-You can configure the service in Windows to start if the machine reboots.
-
-1. Open the Registry Editor as an administrator.
-2. Navigate to `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cloudflared`
-3. Edit the entry `ImagePath` to contain the path to the `cloudflared` binary.
-4. Add the parameters that were configured above; for example the path to the configuration file and the `tunnel run` command.
diff --git a/products/argo-tunnel/src/content/static/img/create-tunnel/ct1.png b/products/argo-tunnel/src/content/static/img/create-tunnel/ct1.png
deleted file mode 100644
index 814a8f48971..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/create-tunnel/ct1.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/create-tunnel/lt1.png b/products/argo-tunnel/src/content/static/img/create-tunnel/lt1.png
deleted file mode 100644
index bedba868d95..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/create-tunnel/lt1.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/create-tunnel/rt1.png b/products/argo-tunnel/src/content/static/img/create-tunnel/rt1.png
deleted file mode 100644
index c75ed5c370b..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/create-tunnel/rt1.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/dns/dns-record.png b/products/argo-tunnel/src/content/static/img/dns/dns-record.png
deleted file mode 100644
index 9320567ddb0..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/dns/dns-record.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/load-balancing/health-check-header.png b/products/argo-tunnel/src/content/static/img/load-balancing/health-check-header.png
deleted file mode 100644
index 6f22e9b2069..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/load-balancing/health-check-header.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/quickstart/argotunnel-hello.png b/products/argo-tunnel/src/content/static/img/quickstart/argotunnel-hello.png
deleted file mode 100644
index 2e80f670415..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/quickstart/argotunnel-hello.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/windows/ss1.png b/products/argo-tunnel/src/content/static/img/windows/ss1.png
deleted file mode 100644
index b27b9691e25..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/windows/ss1.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/windows/ss2.png b/products/argo-tunnel/src/content/static/img/windows/ss2.png
deleted file mode 100644
index 235110628f0..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/windows/ss2.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/windows/ss3.png b/products/argo-tunnel/src/content/static/img/windows/ss3.png
deleted file mode 100644
index ece026b39ba..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/windows/ss3.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/static/img/windows/start-param.png b/products/argo-tunnel/src/content/static/img/windows/start-param.png
deleted file mode 100644
index 80a0993d739..00000000000
Binary files a/products/argo-tunnel/src/content/static/img/windows/start-param.png and /dev/null differ
diff --git a/products/argo-tunnel/src/content/trycloudflare/index.md b/products/argo-tunnel/src/content/trycloudflare/index.md
deleted file mode 100644
index 5865793557d..00000000000
--- a/products/argo-tunnel/src/content/trycloudflare/index.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-order: 100
-hidden: true
----
-
-# TryCloudflare
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Developers can use the TryCloudflare tool to experiment with Argo Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on `trycloudflare.com`. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost.
-
-### Using TryCloudflare
-1. Follow the instructions [here](/getting-started/installation) to install `cloudflared`. If you have an older copy, update to 2019.4.0 or later.
-2. Launch a web server that is available over localhost to `cloudflared`.
-3. Run the following terminal command to start a free tunnel.
-
-```sh
-$ cloudflared tunnel
-```
-
-The command above will default to port 8080; you can specify an alternate port with the --url flag.
-
-```sh
-$ cloudflared tunnel --url http://localhost:7000
-```
-
-`cloudflared` will generate a random subdomain when connecting to the Cloudflare network and print it in the terminal for you to use and share. The output will serve traffic from the server on your local machine to the public internet, using Cloudflare's Argo Smart Routing, at a public URL.
-
-### FAQ
-
-#### What are some example use cases for TryCloudflare?
-* Create a web server for a project on your laptop that you want to share with others on different networks
-* Test browser compatibility for a new site by creating a free Argo Tunnel and testing the link in different browsers
-* Run speed tests from different regions by using a tool like Pingdom or WebPageTest to connect to the randomly-generated subdomain created by TryCloudflare
-
-#### Why does Cloudflare provide this service for free?
-* We want more users to experience the speed and security improvements of Argo Tunnel (and Argo Smart Routing). We hope you test it with TryCloudflare and decide to add it to your production sites.
-* Cloudflare’s features historically require you to own a domain, set that domain’s DNS to Cloudflare’s nameservers, and configure its DNS records before you can begin to use any services. We hope to make more and more of our products available to trial without that burden.
-* We don’t guarantee any SLA or uptime of TryCloudflare - we plan to test new Argo Tunnel features and improvements on these free tunnels. This provides us with a group of connections to test before we deploy to production customers. Free tunnels are meant to be used for testing and development, not for deploying a production website.
-
-#### Legal
-Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](https://developers.cloudflare.com/argo-tunnel/license/), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/).
diff --git a/products/argo-tunnel/src/content/use-cases/index.md b/products/argo-tunnel/src/content/use-cases/index.md
deleted file mode 100644
index 207b122bcc2..00000000000
--- a/products/argo-tunnel/src/content/use-cases/index.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-hidden: true
-title: Use cases
-order: 100
----
-
-# What you can do with Argo Tunnel
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Replace your corporate VPN
-
-You can use a combination of Tunnel and Access to lock down an internal application without the use of a VPN.
-
-First, before creating a tunnel to your application, [create an Access policy](https://developers.cloudflare.com/access/setting-up-access/) for the application. You can do this in the [Access tab of the Cloudflare dashboard](https://dash.cloudflare.com/?zone=access).
-
-Now you can start a tunnel on the web server to expose the application through the internet behind Cloudflare. The Access policy you created in the previous step will require any visitors to authenticate before they reach the application. Because the server is running behind Tunnel and all ports are closed on your server, you are guaranteed that any visitors to the application have passed through Cloudflare and authenticated with Access.
-
-Lastly, if your application runs legacy programs, you can block common exploits by turning on the Web Application Firewall in the [Firewall tab of the Cloudflare dashboard](https://dash.cloudflare.com/?zone=firewall).
-
-## Exposing a local development environment from your computer
-
-While you are developing applications it can be useful to share a link with collaborators or for testing on other screens and devices.
-
-To do this, [download](../downloads/) the Mac, Linux or Windows version of Tunnel and start a tunnel from your laptop pointed at the local address of your development environment.
-
-## Webhooks in development environments
-
-When developing an application that uses webhooks (such as building an app for [GitHub](https://developer.github.com/webhooks/), [Slack](https://api.slack.com/incoming-webhooks) or [Stripe](https://stripe.com/docs/webhooks)) you can use Tunnel to run a webhook endpoint from your local environment. Once you run Tunnel on your computer, Tunnel will expose a public URL that you can set as your webhook endpoint. Tunnel will forward all requests to that endpoint to your local development environment.
diff --git a/products/argo-tunnel/wrangler.toml b/products/argo-tunnel/wrangler.toml
deleted file mode 100644
index 8a11014d7bc..00000000000
--- a/products/argo-tunnel/wrangler.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-name = "argo-tunnel"
-type = "webpack"
-account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
-workers_dev = true
-
-[env.production]
-workers_dev = false
-account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
-zone_id = "351cf9fc660523187714fa772ad5ca49"
-route = "https://developers.cloudflare.com/argo-tunnel*"
-kv_namespaces = [
-  { binding = "REDIRECTS", id = "65462db7fc30456593591d0ee0384869" }
-]
-
-[site]
-bucket = ".docs/public/"
-entry-point = ".docs/workers-site"
diff --git a/products/automatic-platform-optimization/docs-config.js b/products/automatic-platform-optimization/docs-config.js
index d434f0fb02c..e743a9b113b 100644
--- a/products/automatic-platform-optimization/docs-config.js
+++ b/products/automatic-platform-optimization/docs-config.js
@@ -28,6 +28,6 @@ module.exports = {
     description: "With Automatic Platform Optimization, Cloudflare serves your entire site from our edge network, ensuring customers see improved performance when visiting your site.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/automatic-platform-optimization",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/automatic-platform-optimization/src/content/about/index.md b/products/automatic-platform-optimization/src/content/about/index.md
index 8f2f942cb3f..433e8249dd5 100644
--- a/products/automatic-platform-optimization/src/content/about/index.md
+++ b/products/automatic-platform-optimization/src/content/about/index.md
@@ -1,6 +1,7 @@
 ---
 title: About
 order: 1
+pcx-content-type: concept
 ---
 
 # About
diff --git a/products/automatic-platform-optimization/src/content/about/plugin-compatibility.md b/products/automatic-platform-optimization/src/content/about/plugin-compatibility.md
index dd6bbff24b6..a5bfd497ee6 100644
--- a/products/automatic-platform-optimization/src/content/about/plugin-compatibility.md
+++ b/products/automatic-platform-optimization/src/content/about/plugin-compatibility.md
@@ -1,6 +1,7 @@
 ---
 title: Plugin compatibility
 order: 3
+pcx-content-type: reference
 ---
 
 # Plugin compatibility
diff --git a/products/automatic-platform-optimization/src/content/about/test-current-speed.md b/products/automatic-platform-optimization/src/content/about/test-current-speed.md
index edc5c883640..058635d8389 100644
--- a/products/automatic-platform-optimization/src/content/about/test-current-speed.md
+++ b/products/automatic-platform-optimization/src/content/about/test-current-speed.md
@@ -1,6 +1,7 @@
 ---
 title: Test current speed
 order: 2
+pcx-content-type: how-to
 ---
 
 # Test current speed
diff --git a/products/automatic-platform-optimization/src/content/get-started/activate-cf-wp-plugin.md b/products/automatic-platform-optimization/src/content/get-started/activate-cf-wp-plugin.md
index f4d9acf9889..c0b647555c3 100644
--- a/products/automatic-platform-optimization/src/content/get-started/activate-cf-wp-plugin.md
+++ b/products/automatic-platform-optimization/src/content/get-started/activate-cf-wp-plugin.md
@@ -1,6 +1,7 @@
 ---
 title: Activate the Cloudflare WordPress plugin
 order: 7
+pcx-content-type: tutorial
 ---
 
 # Activate the Cloudflare WordPress plugin
diff --git a/products/automatic-platform-optimization/src/content/get-started/change-nameservers.md b/products/automatic-platform-optimization/src/content/get-started/change-nameservers.md
index 22a5ea54a0d..b497ef71635 100644
--- a/products/automatic-platform-optimization/src/content/get-started/change-nameservers.md
+++ b/products/automatic-platform-optimization/src/content/get-started/change-nameservers.md
@@ -1,6 +1,7 @@
 ---
 title: Change nameservers
 order: 6
+pcx-content-type: how-to
 ---
 
 # Change nameservers
diff --git a/products/automatic-platform-optimization/src/content/get-started/confirm-dns-records.md b/products/automatic-platform-optimization/src/content/get-started/confirm-dns-records.md
index 36a11291bf0..28ed9cf9e03 100644
--- a/products/automatic-platform-optimization/src/content/get-started/confirm-dns-records.md
+++ b/products/automatic-platform-optimization/src/content/get-started/confirm-dns-records.md
@@ -1,6 +1,7 @@
 ---
 title: Confirm DNS Records
 order: 5
+pcx-content-type: how-to
 ---
 
 # Confirm DNS records
diff --git a/products/automatic-platform-optimization/src/content/get-started/index.md b/products/automatic-platform-optimization/src/content/get-started/index.md
index 57a177b375d..be96273e575 100644
--- a/products/automatic-platform-optimization/src/content/get-started/index.md
+++ b/products/automatic-platform-optimization/src/content/get-started/index.md
@@ -1,6 +1,7 @@
 ---
 title: Get started
 order: 4
+pcx-content-type: navigation
 ---
 
 # Get started with APO
diff --git a/products/automatic-platform-optimization/src/content/get-started/verify-apo-works.md b/products/automatic-platform-optimization/src/content/get-started/verify-apo-works.md
index 8f04ec3dc9a..d7cad0f4b6e 100644
--- a/products/automatic-platform-optimization/src/content/get-started/verify-apo-works.md
+++ b/products/automatic-platform-optimization/src/content/get-started/verify-apo-works.md
@@ -1,6 +1,7 @@
 ---
 title: Verify APO works
 order: 8
+pcx-content-type: tutorial
 ---
 
 # Verify APO works
diff --git a/products/automatic-platform-optimization/src/content/index.md b/products/automatic-platform-optimization/src/content/index.md
index eb7657d139c..c8fafbe31ef 100644
--- a/products/automatic-platform-optimization/src/content/index.md
+++ b/products/automatic-platform-optimization/src/content/index.md
@@ -1,6 +1,7 @@
 ---
 title: Welcome
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Welcome
diff --git a/products/automatic-platform-optimization/src/content/reference/cache-device-type.md b/products/automatic-platform-optimization/src/content/reference/cache-device-type.md
index 2bdca85a62f..c31ffb91083 100644
--- a/products/automatic-platform-optimization/src/content/reference/cache-device-type.md
+++ b/products/automatic-platform-optimization/src/content/reference/cache-device-type.md
@@ -1,6 +1,7 @@
 ---
 title: Cache by device type
 order: 12
+pcx-content-type: reference
 ---
 
 # Cache by device type
diff --git a/products/automatic-platform-optimization/src/content/reference/index.md b/products/automatic-platform-optimization/src/content/reference/index.md
index ddb2dd8c01c..590e631e7e2 100644
--- a/products/automatic-platform-optimization/src/content/reference/index.md
+++ b/products/automatic-platform-optimization/src/content/reference/index.md
@@ -1,6 +1,7 @@
 ---
 title: Reference
 order: 9
+pcx-content-type: navigation
 ---
 
 # Reference 
diff --git a/products/automatic-platform-optimization/src/content/reference/page-rule-integration.md b/products/automatic-platform-optimization/src/content/reference/page-rule-integration.md
index 31f67fca4cf..54996a0e6a4 100644
--- a/products/automatic-platform-optimization/src/content/reference/page-rule-integration.md
+++ b/products/automatic-platform-optimization/src/content/reference/page-rule-integration.md
@@ -1,6 +1,7 @@
 ---
 title: Page Rule integration with APO
 order: 11
+pcx-content-type: reference
 ---
 
 # Page Rule integration with APO
diff --git a/products/automatic-platform-optimization/src/content/reference/query-parameters.md b/products/automatic-platform-optimization/src/content/reference/query-parameters.md
index 67e6e47e114..d2b1f2363b8 100644
--- a/products/automatic-platform-optimization/src/content/reference/query-parameters.md
+++ b/products/automatic-platform-optimization/src/content/reference/query-parameters.md
@@ -1,6 +1,7 @@
 ---
 title: Query parameters and cached responses
 order: 10
+pcx-content-type: reference
 ---
 
 # Query parameters and cached responses
@@ -27,8 +28,8 @@ APO serves cached content as long as the query parameters in the URL are one of
 - `gclid`
 - `dclid`
 - `_ga`
-- `campaigni`
-- `adgroupi`
+- `campaignid`
+- `adgroupid`
 - `_ke`
 - `cn-reloaded`
 - `age-verified`
diff --git a/products/automatic-platform-optimization/src/content/reference/subdomain-subdirectories.md b/products/automatic-platform-optimization/src/content/reference/subdomain-subdirectories.md
index efbd7fe2ec2..3859faebdea 100644
--- a/products/automatic-platform-optimization/src/content/reference/subdomain-subdirectories.md
+++ b/products/automatic-platform-optimization/src/content/reference/subdomain-subdirectories.md
@@ -1,6 +1,7 @@
 ---
 title: Subdomains and subdirectories
 order: 13
+pcx-content-type: how-to
 ---
 
 # Subdomains and subdirectories
diff --git a/products/automatic-platform-optimization/src/content/troubleshooting/faq.md b/products/automatic-platform-optimization/src/content/troubleshooting/faq.md
index 0e289558c65..f6506c33b79 100644
--- a/products/automatic-platform-optimization/src/content/troubleshooting/faq.md
+++ b/products/automatic-platform-optimization/src/content/troubleshooting/faq.md
@@ -1,6 +1,7 @@
 ---
 title: FAQs
 order: 15
+pcx-content-type: faq
 ---
 
 # Frequently Asked Questions
diff --git a/products/automatic-platform-optimization/src/content/troubleshooting/index.md b/products/automatic-platform-optimization/src/content/troubleshooting/index.md
index 9b89f592676..f176e9a6461 100644
--- a/products/automatic-platform-optimization/src/content/troubleshooting/index.md
+++ b/products/automatic-platform-optimization/src/content/troubleshooting/index.md
@@ -1,6 +1,7 @@
 ---
 title: Troubleshooting
 order: 14
+pcx-content-type: interim
 ---
 
 # Troubleshooting
diff --git a/products/bots/docs-config.js b/products/bots/docs-config.js
index c7cf39f2884..fc461d948b8 100644
--- a/products/bots/docs-config.js
+++ b/products/bots/docs-config.js
@@ -18,6 +18,6 @@ module.exports = {
       description: "Cloudflare’s bot solutions identify and mitigate automated traffic to protect your domain from bad bots.",
       author: "@cloudflare",
       url: "https://developers.cloudflare.com/bots",
-      image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
+      image: "https://www.cloudflare.com/img/cf-twitter-card.png",
   },
 }
\ No newline at end of file
diff --git a/products/bots/src/content/_partials/_bfm-ruleset-engine.md b/products/bots/src/content/_partials/_bfm-ruleset-engine.md
new file mode 100644
index 00000000000..2e1d453f7dd
--- /dev/null
+++ b/products/bots/src/content/_partials/_bfm-ruleset-engine.md
@@ -0,0 +1 @@
+Super Bot Fight Mode runs during the `http_request_firewall_managed` phase of the [Ruleset Engine](https://developers.cloudflare.com/firewall/cf-rulesets#phases).
\ No newline at end of file
diff --git a/products/bots/src/content/_partials/_get-started-pro-biz-steps.md b/products/bots/src/content/_partials/_get-started-pro-biz-steps.md
index 99826340613..655dd55031c 100644
--- a/products/bots/src/content/_partials/_get-started-pro-biz-steps.md
+++ b/products/bots/src/content/_partials/_get-started-pro-biz-steps.md
@@ -3,4 +3,10 @@ To start using Super Bot Fight Mode:
 1. Select **Configure Super Bot Fight Mode**.
 1. Choose how your domain should respond to various types of traffic:
     - See [Static resource protection](/about/static-resources/) for more additional details on supported file types
-    - See [JavaScript detections](/about/javascript-detections) for more information on invisible code injection
\ No newline at end of file
+    - See [JavaScript detections](/about/javascript-detections) for more information on invisible code injection
+
+<Aside type="warning" header='Warning'>
+
+If your organization also uses <a href="https://developers.cloudflare.com/cloudflare-one/connections/connect-apps">Cloudflare Tunnel</a>, keep <strong>Definitely Automated</strong> set to <strong>Allow</strong>. Otherwise, tunnels might fail with a <code>websocket: bad handshake</code> error.
+
+</Aside>
\ No newline at end of file
diff --git a/products/bots/src/content/about/cloudflare-bot-tags/index.md b/products/bots/src/content/about/cloudflare-bot-tags/index.md
index 923c4e24cc6..d7102a088da 100644
--- a/products/bots/src/content/about/cloudflare-bot-tags/index.md
+++ b/products/bots/src/content/about/cloudflare-bot-tags/index.md
@@ -29,7 +29,7 @@ The following values may be present in the `BotTags` log field:
 
 ## Enable bot tags
 
-To enable bot tags, include the `BotTags` log field when using our [Logpush service](https://developers.cloudflare.com/logs/logpush).
+To enable bot tags, include the `BotTags` log field when using our [Logpush service](https://developers.cloudflare.com/logs/about).
 
 ## Current features
 
diff --git a/products/bots/src/content/about/index.md b/products/bots/src/content/about/index.md
index a43539fd6b7..f10c1422e75 100644
--- a/products/bots/src/content/about/index.md
+++ b/products/bots/src/content/about/index.md
@@ -10,6 +10,10 @@ import GetStarted from "../_partials/_plan-get-started.md"
 
 While Cloudflare offers several products that mitigate and identify bot traffic, this section reviews our _bot-specific products_, Bot Fight Mode, Super Bot Fight Mode, and Bot Management for Enterprise.
 
+## What is a bot?
+
+A bot is a software application programmed to do certain tasks. For a more thorough definition and real-world examples of bots, see our [Learning Center](https://www.cloudflare.com/learning/bots/what-is-a-bot/).
+
 ## Which bot solution do I need?
 
 If you have a smaller domain and have identified a bot problem, we recommend Bot Fight Mode or Super Bot Fight Mode (included with your plan subscription). You can enable either from your dashboard, but these solutions offer limited configuration options.
diff --git a/products/bots/src/content/bot-analytics/bm-subscription.md b/products/bots/src/content/bot-analytics/bm-subscription.md
index be3de8467a1..0d523838312 100644
--- a/products/bots/src/content/bot-analytics/bm-subscription.md
+++ b/products/bots/src/content/bot-analytics/bm-subscription.md
@@ -42,8 +42,4 @@ Bot Management customers can use Bot Analytics to:
 
 Data from Bot Analytics is also available via the GraphQL API. You can access bot scores, bot sources, [Bot Tags](../../about/cloudflare-bot-tags), and bot *decisions* (*automated*, *likely automated*, etc.).
 
-Read the [GraphQL Analytics API documentation](https://developers.cloudflare.com/analytics/graphql-api) for more information about GraphQL and basic querying.
-
-## Third-party tools
-
-To bring data from **Bot Management** into tools like Elastic, Google Data Studio, and more, see our [Bot Management Dashboard tutorial](https://developers.cloudflare.com/logs/tutorials/bot-management-dashboard).
\ No newline at end of file
+Read the [GraphQL Analytics API documentation](https://developers.cloudflare.com/analytics/graphql-api) for more information about GraphQL and basic querying.
\ No newline at end of file
diff --git a/products/bots/src/content/get-started/biz-and-ent.md b/products/bots/src/content/get-started/biz-and-ent.md
index 7fb354f37d1..b7757626948 100644
--- a/products/bots/src/content/get-started/biz-and-ent.md
+++ b/products/bots/src/content/get-started/biz-and-ent.md
@@ -5,6 +5,7 @@ pcx-content-type: how-to
 ---
 
 import EnableSteps from "../_partials/_get-started-pro-biz-steps.md"
+import RulesetEngine from "../_partials/_bfm-ruleset-engine.md"
 
 # Get started with Super Bot Fight Mode (Business)
 
@@ -27,4 +28,8 @@ Super Bot Fight Mode is included in your Business or Enterprise subscription. Wh
 
 ## Analytics
 
-For more on analytics, see [Bot Analytics](/bot-analytics/biz-and-ent/).
\ No newline at end of file
+For more on analytics, see [Bot Analytics](/bot-analytics/biz-and-ent/).
+
+## Ruleset Engine
+
+<RulesetEngine/>
\ No newline at end of file
diff --git a/products/bots/src/content/get-started/index.md b/products/bots/src/content/get-started/index.md
index e8e039ba3a3..73e3e0bb979 100644
--- a/products/bots/src/content/get-started/index.md
+++ b/products/bots/src/content/get-started/index.md
@@ -1,4 +1,5 @@
 ---
+title: Get started
 order: 3
 pcx-content-type: navigation
 ---
diff --git a/products/bots/src/content/get-started/pro.md b/products/bots/src/content/get-started/pro.md
index b91fbcb70ee..42f83f92974 100644
--- a/products/bots/src/content/get-started/pro.md
+++ b/products/bots/src/content/get-started/pro.md
@@ -5,6 +5,7 @@ pcx-content-type: how-to
 ---
 
 import EnableSteps from "../_partials/_get-started-pro-biz-steps.md"
+import RulesetEngine from "../_partials/_bfm-ruleset-engine.md"
 
 # Get started with Super Bot Fight Mode (Pro)
 
@@ -31,4 +32,8 @@ To access the **Bot Report**, go to **Firewall** > **Bots**. If you see a double
 
 ### Firewall events
 
-You can see bot-related actions by going to **Firewall** > **Overview**. Any requests challenged by this product will be labeled **Super Bot Fight Mode** in the **Service** field. This allows you to observe, analyze, and follow trends in your bot traffic over time.
\ No newline at end of file
+You can see bot-related actions by going to **Firewall** > **Overview**. Any requests challenged by this product will be labeled **Super Bot Fight Mode** in the **Service** field. This allows you to observe, analyze, and follow trends in your bot traffic over time.
+
+## Ruleset Engine
+
+<RulesetEngine/>
\ No newline at end of file
diff --git a/products/bots/src/content/index.md b/products/bots/src/content/index.md
index 2d91f43159f..b20ecc97b4a 100644
--- a/products/bots/src/content/index.md
+++ b/products/bots/src/content/index.md
@@ -8,7 +8,7 @@ pcx-content-type: landing-page
 
 Cloudflare bot solutions identify and mitigate automated traffic to protect your domain from bad bots.
 
-As humans have become more reliant on the Internet, bots have become a force for good and bad. Some bots help us complete monotonous tasks at scale — for example, populating search engines by scraping the web for content. Without these bots, we would have no way to build many important tools and services. Unfortunately, other bots are positioned for abuse. These bots hoard inventory on ecommerce domains, break into user accounts with credential stuffing, and raise origin costs on your domain. Large companies should always have a bot solution in place, and smaller companies and individuals should protect their domains as a best practice.
+As humans have become more reliant on the Internet, [bots](https://www.cloudflare.com/learning/bots/what-is-a-bot/) have become a force for good and bad. Some bots help us complete monotonous tasks at scale — for example, populating search engines by scraping the web for content. Without these bots, we would have no way to build many important tools and services. Unfortunately, other bots are positioned for abuse. These bots hoard inventory on ecommerce domains, break into user accounts with credential stuffing, and raise origin costs on your domain. Large companies should always have a bot solution in place, and smaller companies and individuals should protect their domains as a best practice.
 
 Roughly 40% of Internet traffic is now automated, and [trends](https://blog.cloudflare.com/bot-attack-trends-for-jan-jul-2020/) continue to show more diverse and sophisticated attacks. With Cloudflare’s suite of bot solutions, you can protect your domains and view detailed analytics for your domain's traffic.
 
diff --git a/products/browser-isolation/docs-config.js b/products/browser-isolation/docs-config.js
index ef3fd88965c..ee6924d0865 100644
--- a/products/browser-isolation/docs-config.js
+++ b/products/browser-isolation/docs-config.js
@@ -18,6 +18,6 @@ module.exports = {
         description: "Cloudflare Browser Isolation",
         author: "@cloudflare",
         url: "https://developers.cloudflare.com/browser-isolation",
-        image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
+        image: "https://www.cloudflare.com/img/cf-twitter-card.png",
     },
 }
\ No newline at end of file
diff --git a/products/browser-isolation/src/content/usage/isolated-traffic.md b/products/browser-isolation/src/content/usage/isolated-traffic.md
index 056e060f946..7bcb0f07829 100644
--- a/products/browser-isolation/src/content/usage/isolated-traffic.md
+++ b/products/browser-isolation/src/content/usage/isolated-traffic.md
@@ -23,5 +23,5 @@ Isolation policies are applied to requests that include `Accept: text/html*`. Th
 
 ### Bypass common cert pinning sites
 
-See [Gateway recommeded rules](https://developers.cloudflare.com/gateway/connecting-to-gateway/Troubleshooting#im-using-a-common-application-and-it-seems-unable-to-connect-when-i-inspect-http-traffic-or-presents-an-untrusted-certificate-error)
+See [Gateway recommended rules](https://developers.cloudflare.com/gateway/connecting-to-gateway/Troubleshooting#im-using-a-common-application-and-it-seems-unable-to-connect-when-i-inspect-http-traffic-or-presents-an-untrusted-certificate-error)
 
diff --git a/products/byoip/docs-config.js b/products/byoip/docs-config.js
index 90423027b95..4f823d638da 100644
--- a/products/byoip/docs-config.js
+++ b/products/byoip/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "With BYOIP, Cloudflare announces your IPs in all our locations. Use your IPs with Magic Transit, Spectrum, or CDN services.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/byoip",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/byoip/src/content/dynamic-advertisement/best-practices.md b/products/byoip/src/content/dynamic-advertisement/best-practices.md
index 47b8b4fc7d1..86dab6b572a 100644
--- a/products/byoip/src/content/dynamic-advertisement/best-practices.md
+++ b/products/byoip/src/content/dynamic-advertisement/best-practices.md
@@ -1,6 +1,7 @@
 ---
 title: Best practices
 order: 2
+pcx-content-type: best-practices
 ---
 
 # Best practices for dynamic advertisement
diff --git a/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md b/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md
index 18e8b48c9bd..2f843cef754 100644
--- a/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md
+++ b/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md
@@ -1,6 +1,7 @@
 ---
 title: Configure
 order: 3
+pcx-content-type: how-to
 ---
 
 # Configure dynamic advertisement
diff --git a/products/byoip/src/content/dynamic-advertisement/index.md b/products/byoip/src/content/dynamic-advertisement/index.md
index 35fb88c2d72..187d00bb133 100644
--- a/products/byoip/src/content/dynamic-advertisement/index.md
+++ b/products/byoip/src/content/dynamic-advertisement/index.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Dynamic advertisement
diff --git a/products/byoip/src/content/get-started/index.md b/products/byoip/src/content/get-started/index.md
new file mode 100644
index 00000000000..541bb0e13b9
--- /dev/null
+++ b/products/byoip/src/content/get-started/index.md
@@ -0,0 +1,22 @@
+---
+order: 1
+pcx-content-type: how-to
+---
+
+# Get started with Cloudflare BYOIP
+
+To bring your own IPs, you must go through an onboarding process. Work with your account team to understand everything you need to ensure a smooth transition.
+
+At a high level, Cloudflare requires a service-specific configuration for your prefixes, as well as some requirements that are common to all BYOIP customers, regardless of service type. This documentation covers the requirements common to all products that are compatible with BYOIP (i.e. Magic Transit, CDN, and Spectrum).
+
+There are two major prerequisites before Cloudflare can begin the work of onboarding your IP space.
+
+First, all customers must ensure their [Internet Routing Registry (IRR)](/irr-records) records are up to date with the correct prefix/ASN information.
+
+Secondly, Cloudflare must receive a [Letter of Authorization](/loa) to announce your prefixes, which we will share with our transit partners as evidence that we are allowed to announce the route.
+
+Optionally, if you use the RPKI protocol to sign your routes, Cloudflare can support you there as well. Just let your account team know if you’re interested in using RPKI.
+
+See the subsequent sections to learn more.
+
+Once onboarded, [Border Gateway Protocol (BGP)](https://www.cloudflare.com/learning/security/glossary/what-is-bgp/) announcements for customer prefixes can be controlled with the [Dynamic Advertisement API](/dynamic-advertisement). This API has other useful features and can also be used via the Cloudflare dashboard.
\ No newline at end of file
diff --git a/products/byoip/src/content/index.md b/products/byoip/src/content/index.md
index 5f02c27b41c..bc1e81e77ec 100644
--- a/products/byoip/src/content/index.md
+++ b/products/byoip/src/content/index.md
@@ -1,6 +1,7 @@
 ---
-title: Welcome
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Bringing Your Own IPs to Cloudflare
@@ -9,20 +10,6 @@ With __Bringing Your Own IPs__ (BYOIP), Cloudflare announces your IPs in all our
 
 BYOIP is compatible with Magic Transit, Spectrum, and CDN services.
 
-## Getting started
-
-To bring your own IPs, you must go through an onboarding process. Work with your account team to understand everything you need to ensure a smooth transition.
-
-At a high level, Cloudflare requires a service-specific configuration for your prefixes, as well as some requirements that are common to all BYOIP customers, regardless of service type. This documentation covers the requirements common to all products that are compatible with BYOIP (i.e. Magic Transit, CDN, and Spectrum).
-
-There are two major prerequisites before Cloudflare can begin the work of onboarding your IP space.
-
-First, all customers must ensure their [Internet Routing Registry (IRR)](/irr-records) records are up to date with the correct prefix/ASN information.
-
-Secondly, Cloudflare must receive a [Letter of Authorization](/loa) to announce your prefixes, which we will share with our transit partners as evidence that we are allowed to announce the route.
-
-Optionally, if you use the RPKI protocol to sign your routes, Cloudflare can support you there as well. Just let your account team know if you’re interested in using RPKI!
-
-Please see the subsequent sections to learn more.
-
-Once onboarded, BGP announcements for customer prefixes can be controlled with the [Dynamic Advertisement API](/dynamic-advertisement). This API has other useful features and can also be used via the Cloudflare dashboard.
+<ButtonGroup>
+  <Button type='primary' href='/get-started'>Get started</Button>
+</ButtonGroup>
diff --git a/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md b/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md
index a7ae7ef5195..a78bdb6b8fb 100644
--- a/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md
+++ b/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md
@@ -1,6 +1,7 @@
 ---
 title: Best practices
 order: 6
+pcx-content-type: best-practices
 ---
 
 # Best practices for IRR entry updates
diff --git a/products/byoip/src/content/irr-records/index.md b/products/byoip/src/content/irr-records/index.md
index 8326cec7c58..26f08fb3fb0 100644
--- a/products/byoip/src/content/irr-records/index.md
+++ b/products/byoip/src/content/irr-records/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # IRR records
diff --git a/products/byoip/src/content/irr-records/verify-irr-entries.md b/products/byoip/src/content/irr-records/verify-irr-entries.md
index 7b09aa99c2f..3aa8436c219 100644
--- a/products/byoip/src/content/irr-records/verify-irr-entries.md
+++ b/products/byoip/src/content/irr-records/verify-irr-entries.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: reference
 ---
 
 # Verify IRR entries
diff --git a/products/byoip/src/content/loa/index.md b/products/byoip/src/content/loa/index.md
index 416fc7572ad..e39214e577d 100644
--- a/products/byoip/src/content/loa/index.md
+++ b/products/byoip/src/content/loa/index.md
@@ -1,11 +1,12 @@
 ---
 title: Letter of Authorization
 order: 10
+pcx-content-type: concept
 ---
 
 # Letter of Authorization (LOA)
 
-A letter of authorization (LOA) is a document that authorizes Cloudflare to announce a prefix(es) on behalf of another entity. Some backbone and transit providers require that Cloudflare provide them with an LOA whenever Cloudflare starts to announce a customer prefix.
+A letter of authorization (LOA) is a document that authorizes Cloudflare to announce a prefix(es) on behalf of another entity. The LOA is required by Cloudflare's transit providers so they can accept the routes Cloudflare advertises on behalf of another entity.
 
 The letter must contain both the prefixes you are authorizing Cloudflare to announce, and which ASN they will be announced under. Cloudflare can announce a prefix under your ASN or you are welcome to use ours. If you want Cloudflare to use our ASN, just let us know and we will provide the AS number to put in the LOA document.
 
diff --git a/products/byoip/src/content/loa/loa-template.md b/products/byoip/src/content/loa/loa-template.md
index 794292b02d7..b8c4e63eb4c 100644
--- a/products/byoip/src/content/loa/loa-template.md
+++ b/products/byoip/src/content/loa/loa-template.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # LOA template
diff --git a/products/byoip/src/content/prefix-delegations/index.md b/products/byoip/src/content/prefix-delegations/index.md
index 60604171a9d..7b40efda944 100644
--- a/products/byoip/src/content/prefix-delegations/index.md
+++ b/products/byoip/src/content/prefix-delegations/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: reference
 ---
 
 # Prefix delegations
@@ -8,7 +9,7 @@ BYOIP supports prefix delegations. A prefix delegation is when the prefix owner
 
 The effect of a delegation depends on the service you are using with the prefix. Currently BYOIP + CDN and BYOIP + Spectrum support prefix delegations. See below to learn more about prefix delegations with Spectrum and CDN.
 
-**Spectrum**: If Account A delegates use of part or all of a prefix to Account B, via a delegation, Account B can also use the [Spectrum API](https://developers.cloudflare.com/spectrum/getting-started/byoip/) with the IPs it was delegated access to.
+**Spectrum**: If Account A delegates use of part or all of a prefix to Account B, via a delegation, Account B can also use the [Spectrum API](https://developers.cloudflare.com/spectrum/byoip/) with the IPs it was delegated access to.
 
 Example: Account A is the primary owner of prefix 1.2.3.4/24. Account A delegates the use of 1.2.3.4/32 to Account B. Account B may now use the Spectrum API to create a Spectrum app with 1.2.3.4/32.
 
diff --git a/products/cache/README.md b/products/cache/README.md
new file mode 100644
index 00000000000..5d368d555c5
--- /dev/null
+++ b/products/cache/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Cache docs
+
+[View docs →](https://developers.cloudflare.com/cache)
+
+[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
diff --git a/products/cache/docs-config.js b/products/cache/docs-config.js
new file mode 100644
index 00000000000..a671275a0a8
--- /dev/null
+++ b/products/cache/docs-config.js
@@ -0,0 +1,29 @@
+module.exports = {
+  product: "Cache",
+  pathPrefix: "/cache",
+  productIconKey: "cache",
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/cache",
+  externalLinks: [
+    {
+      title: "Cloudflare CDN",
+      url: "https://www.cloudflare.com/cdn/"
+    },
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:cache"]'}
+  },
+  siteMetadata: {
+    title: "Cloudflare Cache docs",
+    description: "Cloudflare makes customer websites faster by storing a copy of the website’s content on our servers. Caching static resources at Cloudflare reduces your server load and bandwidth, with no extra charges for bandwidth spikes",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/cache",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+  }
+}
diff --git a/products/gateway/package.json b/products/cache/package.json
similarity index 100%
rename from products/gateway/package.json
rename to products/cache/package.json
diff --git a/products/cache/src/content/about/always-online.md b/products/cache/src/content/about/always-online.md
new file mode 100644
index 00000000000..5b8c56e2133
--- /dev/null
+++ b/products/cache/src/content/about/always-online.md
@@ -0,0 +1,31 @@
+---
+title: Always Online
+order: 2
+pcx-content-type: concept
+---
+
+# Always Online
+
+Cloudflare’s Always Online feature is now integrated with the [Internet Archive](https://archive.org/) so that visitors can access a portion of your website even when your origin server is unreachable and a Cloudflare-cached version is not available. When your origin is unreachable, Always Online checks Cloudflare’s cache for a stale or expired version of your website. If a version does not exist, Cloudflare goes to the Internet Archive to fetch and serve static portions of your website. 
+
+When you enable Always Online with Internet Archive integration, Cloudflare shares your hostname and popular URL paths with the archive so that the Internet Archive’s crawler stores the pages you want archived. When submitting targets to the crawler, Cloudflare identifies the most popular URLs found among GET requests that returned a 200 HTTP status code in the previous 5 hours. 
+
+Note that Cloudflare does not save a copy of every page of your website, and it cannot serve dynamic content while your origin is offline. If the requested page is not in Cloudflare’s Always Online cache or the Internet Archive's Wayback Machine, the visitor sees the actual error page caused by the offline origin web server.
+
+A Cloudflare crawler identifies resources to place in the Always Online cache. When Internet Archive integration is enabled, Cloudflare tells the Internet Archive what pages to crawl and how often. To ensure stability of service, Cloudflare limits the crawling interval. Limits vary by Cloudflare plan, and the Always Online crawler ignores robots.txt.
+
+- Free customers once every 30 days.
+- Pro customers once every 15 days.
+- Business and Enterprise customers once every 5 days.
+
+## Visitor Experience
+
+When Always Online with Internet Archive integration is enabled, visitors see a banner at the top of the web page explaining they are visiting an archived version of the website. Visitors can click the Refresh button to check whether the origin has recovered and fresh content is available.
+
+When a visitor requests content for an offline website, Cloudflare returns an HTTP response status code in the range [520–527](https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#:~:text=Error%20520%20occurs%20when%20the,or%20unexpected%20response%20to%20Cloudflare.&text=Contact%20your%20hosting%20provider%20or%20site%20administrator%20and%20request%20a,Origin%20web%20server%20application%20crashes), depending on the issue. These status codes indicate that the origin is unreachable.  
+
+When the requested page is not in the Always Online cache and Internet Archive integration is enabled, Cloudflare checks the archive and serves the most recently archived version of the page. 
+
+Visitors who interact with dynamic parts of a website, such as a shopping cart or comment box, will see an error page caused by the offline origin web server.
+
+To enable Always Online, see [Enable Always Online](/how-to/enable-always-online).
diff --git a/products/cache/src/content/about/cache-control.md b/products/cache/src/content/about/cache-control.md
new file mode 100644
index 00000000000..36632b28684
--- /dev/null
+++ b/products/cache/src/content/about/cache-control.md
@@ -0,0 +1,375 @@
+---
+title: Origin Cache-Control
+order: 7
+pcx-content-type: concept
+---
+
+# Origin Cache Control
+
+Set `Cache-Control` headers to tell Cloudflare how to handle content from the origin. 
+
+When a user sends an HTTP request, the user’s request URL is matched against a [list of cacheable file extensions](/about/default-cache-behavior#default-cached-file-extensions). If the request matches an extension on this list, Cloudflare serves the resource from cache if it is present. If the content is stale in Cloudflare’s cache, Cloudflare attempts to revalidate the content with the origin before serving the response to the client.
+
+In the response, Cloudflare first examines its caches in multiple network locations for content. If the resource is not present in the cache, Cloudflare requests the resource from your origin web server to fill the cache. The response is then sent to the client who initiated the request.
+
+At this point, Cloudflare’s cache logic examines the HTTP response received from your origin server. Based on how Cloudflare interprets request headers, the response is either deemed cacheable and written to disk for use with the next request for the same resource, or the request is deemed un-cacheable which means the next request misses the cache and repeats this flow.
+
+## Cache-control directives
+
+A `Cache-Control` header can include a number of directives, and the directive dictates who can cache a resource along with how long those resources can be cached before they must be updated.
+
+<Aside type="note" header="Note">
+
+For more information about Cache-Control directives at origin servers, refer to the [Mozilla Cache-Control documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control).
+
+</Aside>
+
+If multiple directives are passed together, each directive is separated by a comma. If the directive takes an argument, it follows the directive separated by an equal sign. For example: `max-age=86400`.
+
+Directives can be broken down into four groups: cacheability, expiration, revalidation, and other.
+
+### Cacheability
+
+Cacheability refers to whether or not a resource should enter a cache, and the directives below indicate a resource’s cacheability.
+
+- `public` — Indicates any cache may store the response, even if the response is normally non-cacheable or cacheable only within a private cache.
+- `private` — Indicates the response message is intended for a single user (e.g. a browser cache) and must not be stored by a shared cache like Cloudflare or a corporate proxy.
+- `no-store` — Indicates any cache (i.e., a client or proxy cache) must not store any part of either the immediate request or response.
+
+### Expiration
+
+Expiration refers to how long a resource should remain in the cache, and the directives below affect how long a resource stays in the cache.
+
+<Aside type="note" header="Note">
+
+Cloudflare respects whichever value is higher: the [Browser Cache TTL](/about/edge-browser-cache-ttl) in Cloudflare or the `max-age` header. You can also simultaneously specify a Cloudflare Edge Cache TTL different than a Browser’s Cache TTL respectively via the `s-maxage` and `max-age Cache-Control` headers.
+
+When using Origin Cache-Control and setting `max-age=0`, Cloudflare prefers to cache and revalidate. With Origin Cache-Control off and `max-age=0`, Cloudflare settings bypass cache. Setting `no-cache` also bypasses cache.
+
+</Aside>
+
+- `max-age=seconds` — Indicates the response is stale after its age is greater than the specified number of seconds. Age is defined as the time in seconds since the asset was served from the origin server. The `seconds` argument is an unquoted integer.
+- `s-maxage=seconds` — Indicates that in shared caches, the maximum age specified by this directive overrides the maximum age specified by either the `max-age` directive or the `Expires` header field. The `s-maxage` directive also implies the semantics of the proxy-revalidate response directive. Browsers ignore `s-maxage`.
+- `no-cache` — Indicates the response cannot be used to satisfy a subsequent request without successful validation on the origin server. This allows an origin server to prevent a cache from using the origin to satisfy a request without contacting it, even by caches that have been configured to send stale responses.
+
+### Revalidation
+
+Revalidation determines how the cache should behave when a resource expires, and the directives below affect the revalidation behavior.
+
+- `must-revalidate` — Indicates that once the resource is stale, a cache (client or proxy) must not use the response to satisfy subsequent requests without successful validation on the origin server.
+- `proxy-revalidate` — Has the same meaning as the `must-revalidate` response directive except that it does not apply to private client caches.
+- `stale-while-revalidate=seconds` — When present in an HTTP response, indicates caches may serve the response in which it appears after it becomes stale, up to the indicated number of seconds since the resource expired. If [Always Online](/about/always-online) is enabled, then the `stale-while-revalidate` and `stale-if-error` directive are ignored.
+- `stale-if-error=seconds` — Indicates that when an error is encountered, a cached stale response may be used to satisfy the request, regardless of other freshness information.
+
+The `stale-if-error` directive is ignored if [Always Online](/about/always-online) is enabled or if an explicit in-protocol directive is passed. Examples of explicit in-protocol directives include a `no-store` or `no-cache cache` directive, a `must-revalidate` cache-response-directive, or an applicable `s-maxage` or `proxy-revalidate` cache-response-directive.
+
+### Other 
+
+Additional directives that influence cache behavior are listed below.
+
+- `no-transform` — Indicates that an intermediary — regardless of whether it implements a cache — must not transform the payload
+- `vary` — Cloudflare does not consider vary values in caching decisions.
+- `immutable` — Indicates to clients the response body does not change over time. The resource, if unexpired, is unchanged on the server. The user should not send a conditional revalidation for it (e.g., `If-None-Match` or `If-Modified-Since`) to check for updates, even when the user explicitly refreshes the page. This directive has no effect on public caches like Cloudflare, but does change browser behavior.
+
+## Origin Cache-Control behavior
+
+The table below lists directives and their behaviors when Origin Cache-Control is disabled and when it's enabled.
+
+<table>
+  <tbody>
+    <th colspan="5" rowspan="1">
+      Directive
+    </th>
+    <th colspan="5" rowspan="1">
+      Origin Cache-control disabled behavior
+    </th>
+    <th colspan="5" rowspan="1">
+      Origin Cache-control enabled behavior
+    </th>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>s-maxage=0</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Will not cache
+      </td>
+      <td colspan="5" rowspan="1">
+        Caches and always revalidates
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>max-age=0</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Will not cache
+      </td>
+      <td colspan="5" rowspan="1">
+        Caches and always revalidates
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>no-cache</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Will not cache
+      </td>
+      <td colspan="5" rowspan="1">
+        Caches and always revalidates. Does not serve stale.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>no-cache=#headers</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Will not cache at all
+      </td>
+      <td colspan="5" rowspan="1">
+        Caches if headers mentioned in <code>no-cache=#headers</code> do not exist. Always revalidates if any header mentioned in <code>no-cache=#headers</code> is present.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>Private=#headers</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Will not cache at all
+      </td>
+      <td colspan="5" rowspan="1">
+        Does not cache <code>#headers</code> values mentioned in <code>Private=#headers</code> directive.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>must-revalidate</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Cache directive is ignored and stale is served.
+      </td>
+      <td colspan="5" rowspan="1">
+        Does not serve stale. Must revalidate for CDN but not for browser.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>proxy-revalidate</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Cache directive is ignored and stale is served.
+      </td>
+      <td colspan="5" rowspan="1">
+        Does not serve stale. Must revalidate for CDN but not for browser.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>no-transform</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        May (un)Gzip, Polish, email filter, etc.
+      </td>
+      <td colspan="5" rowspan="1">
+        Does not transform body.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>s-maxage=delta, delta>1</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Same as <code>max-age</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        <code>Max-age</code> and <code>proxy-revalidate</code>
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        <code>immutable</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        Not proxied downstream
+      </td>
+      <td colspan="5" rowspan="1">
+        Proxied downstream. Browser facing, does not impact caching proxies.
+      </td>
+    </tr>                
+  </tbody>
+</table>
+
+Certain scenarios also affect Origin Cache-Control behavior when it is enabled or disabled.
+
+<table>
+  <tbody>
+    <th colspan="5" rowspan="1">
+      Condition
+    </th>
+    <th colspan="5" rowspan="1">
+      Origin Cache-control disabled behavior
+    </th>
+    <th colspan="5" rowspan="1">
+      Origin Cache-control enabled behavior
+    </th>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Presence of <code>Authorization</code> header
+      </td>
+      <td colspan="5" rowspan="1">
+        Content may be cached
+      </td>
+      <td colspan="5" rowspan="1">
+        Content is cached only <code>if must-revalidate</code>, <code>public</code>, or <code>s-maxage</code> is also present
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Use of <code>no-cache</code> header
+      </td>
+      <td colspan="5" rowspan="1">
+        In logs, <code>cacheStatus=miss</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        In logs, <code>cacheStatus=bypass</code>
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Origin response has <code>Set-Cookie</code> header and default cache level is used
+      </td>
+      <td colspan="5" rowspan="1">
+        Content may be cached with stripped <code>set-cookie</code> header
+      </td>
+      <td colspan="5" rowspan="1">
+        Content is not cached
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Browser Cache TTL is set
+      </td>
+      <td colspan="5" rowspan="1">
+        Cache-Control returned to eyeball does not include <code>private</code>
+      </td>
+      <td colspan="5" rowspan="1">
+        If origin returns <code>private</code> in Cache-Control then preserve it
+      </td>
+    </tr>             
+  </tbody>
+</table>
+
+## Examples
+
+Review the examples below to learn which directives to use with the Cache-Control header to control specific caching behavior.
+
+<details>
+  <summary>
+    Cache a static asset
+  </summary>
+    <div>
+      <code>Cache-Control: public, max-age=86400</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Ensure a secret asset is never cached
+  </summary>
+    <div>
+      <code>Cache-Control: no-store</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets on browsers but not on proxy caches
+  </summary>
+    <div>
+      <code>Cache-Control: private, max-age=3600</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets in client and proxy caches, but prefer revalidation when served
+  </summary>
+    <div>
+      <code>Cache-Control: public, no-cache</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets in proxy caches but REQUIRE revalidation by the proxy when served
+  </summary>
+    <div>
+      <code>Cache-Control: public, no-cache, proxy-revalidate</code> or <code>Cache-Control: public, s-maxage=0</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets in proxy caches, but REQUIRE revalidation by any cache when served
+  </summary>
+    <div>
+      <code>Cache-Control: public, no-cache, must-revalidate</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets, but ensure the proxy does not modify it
+  </summary>
+  <div>
+    <code>Cache-Control: public, no-transform</code>
+
+  This configuration also disables transformation like gzip or brotli compression from our edge to your visitors if the original payload was served uncompressed.
+  </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets with revalidation, but allow stale responses if origin server is unreachable
+  </summary>
+  <div>
+    <code>Cache-Control: public, max-age=3600, stale-if-error=60</code>
+
+  With this configuration, Cloudflare attempts to revalidate the content with the origin server after it has been in cache for 3600 seconds (one hour). If the server returns an error instead of proper revalidation responses, Cloudflare continues serving the stale resource for a total of one minute beyond the expiration of the resource.
+  </div>
+</details>
+
+<details>
+  <summary>
+    Cache assets for different amounts of time on Cloudflare and in visitor browsers
+  </summary>
+    <div>
+      <code>Cache-Control: public, max-age=7200, s-maxage=3600</code>
+    </div>
+</details>
+
+<details>
+  <summary>
+    Cache an asset and serve while asset is being revalidated
+  </summary>
+  <div>
+    <code>Cache-Control: max-age=600, stale-while-revalidate=30</code>
+
+This configuration indicates the asset is fresh for 600 seconds. The asset can be served stale for up to an additional 30 seconds to parallel requests for the same resource while the initial synchronous revalidation is attempted.
+  </div>
+</details>
+
+## Interaction with other Cloudflare features
+
+### [Edge Cache TTL](/about/edge-browser-cache-ttl#edge-cache-ttl) 
+
+Edge Cache TTL Page Rules override `s-maxage` and disable revalidation directives if present. When Origin Cache-Control is enabled at Cloudflare, the original Cache-Control header passes downstream from our edge even if Edge Cache TTL overrides are present. Otherwise, when Origin Cache-Control is disabled at Cloudflare (the default), Cloudflare overrides the origin cache control.
+
+### [Browser Cache TTL](/about/edge-browser-cache-ttl#browser-cache-ttl)
+Browser Cache TTL Page Rules override `max-age` settings passed downstream from our edge, typically to your visitor's browsers.
+
+### [Polish](/best-practices/activate-polish)
+Polish is disabled when the `no-transform` directive is present.
+
+### Gzip and Other Compression
+Compression is disabled when the `no-transform` directive is present. If the original asset fetched from the origin is compressed, it is served compressed to the visitor. If the original asset is uncompressed, compression is not applied.
diff --git a/products/cache/src/content/about/cache-keys.md b/products/cache/src/content/about/cache-keys.md
new file mode 100644
index 00000000000..44fe5277e34
--- /dev/null
+++ b/products/cache/src/content/about/cache-keys.md
@@ -0,0 +1,120 @@
+---
+title: Cache keys
+order: 3
+pcx-content-type: concept
+---
+
+# Cache Keys
+
+A Cache Key is an identifier that Cloudflare uses for a file in our cache, and the Cache Key Template defines the identifier for a given HTTP request. For example, consider the following HTTP request on a TLS connection:
+
+```
+GET /logo.jpg HTTP/1.1
+Host: www.cloudflare.com
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
+Accept: image/jpg
+```
+
+The default Cache Key constructed from this request combines aspects such as Cloudflare Zone ID, scheme, hostname, and path into a Cache Key similar to  `1234:https://www.example.com/foo.jpg`. Zone ID and Path are always included in the Cache Key and cannot be modified.
+
+<Aside type="warning" header="Warning">
+
+Using Custom Cache Keys may result in cache sharding and reduction of your cache hit ratio.
+
+</Aside>
+
+To create a Cache Key, see [Create a Custom Cache Key](/how-to/create-cache-keys).
+
+## Cache Key Template
+
+There are a couple of common reasons to change the Cache Key Template. You might change the Cache Key Template to:
+
+- Fragment the cache so one URL is stored in multiple files. For example, to store different files based on a specific query string in the URL.
+- Consolidate the cache so different HTTP requests are stored in the same file. For example, to remove the Origin header added to Cloudflare Cache Keys by default.
+
+<Aside type="note" header="Note">
+
+`$scheme` is the protocol (HTTP or HTTPS) sent to your origin web server and not the protocol received from the visitor. Therefore, setting the Cloudflare [SSL option](https://support.cloudflare.com/hc/articles/200170416) influences caching decisions. For instance, Cloudflare only attempts to connect to your origin web server via HTTP when [Flexible SSL](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes#flexible) is utilized. Thus, Cloudflare serves the same cached resource for visitor requests via either HTTP or HTTPS since Flexible SSL instructs Cloudflare to connect to an origin solely over HTTP.
+
+</Aside>
+
+For cross-origin requests, such as one from `anotherdomain.com` to `example.com`, the Origin HTTP request header results in a Cache Key with the `${header:origin}` token populated as `anotherdomain.com::https://www.example.com/something`.
+
+A [Cache Level](/how-to/set-caching-levels) of Ignore Query String creates the following Cache Key:
+`${header:origin}::${scheme}://${host_header}${uri_iqs}`
+
+`${uri_iqs}` is replaced with the request path excluding the query string, so a request for `http://example.com/file.jpg?something=123` creates the following Cache Key:
+`::http://example.com/file.jpg`
+
+## Cache Key Settings
+
+The following fields control the Cache Key Template.
+
+### Query String
+
+The query string controls which URL query string parameters go into the Cache Key. You can `include` specific query string parameters or `exclude` them using the respective fields. When you include a query string parameter, the `value` of the query string parameter is used in the Cache Key. 
+
+#### Example
+
+If you include the query string foo in a URL like `https://www.example.com/?foo=bar`, then bar appears in the Cache Key. Exactly one of `include` or `exclude` is expected.
+
+#### Usage notes 
+
+- To include all query string parameters (the default behavior), use include: "*"
+- To ignore query strings, use exclude: "*"
+- To include most query string parameters but exclude a few, use the exclude field which assumes  the other query string parameters are included.
+
+### Headers
+
+Headers control which headers go into the Cache Key. Similar to Query String, you can include specific headers or exclude default headers. 
+
+When you include a header, the header value is included in the Cache Key. For example, if an HTTP request contains an HTTP header like `X-Auth-API-key: 12345`, and you include the `X-Auth-API-Key header` in your Cache Key Template, then `12345` appears in the Cache Key.
+
+To check for the presence of a header without including its actual value, use the `check_presence` option.
+
+Currently, you can only exclude the `Origin` header. The `Origin` header is always included unless explicitly excluded. Including the [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin) in the Cache Key is important to enforce [CORS](https://developer.mozilla.org/en-US/docs/Glossary/CORS). Additionally, you cannot include the following headers:
+
+- Headers that have high cardinality and risk sharding the cache
+  - `accept`
+  - `accept-charset`
+  - `accept-encoding`
+  - `accept-datetime`
+  - `accept-language`
+  - `referer`
+  - `user-agent`
+- Headers that re-implement cache or proxy features
+  - `connection`
+  - `content-length`
+  - `cache-control`
+  - `if-match`
+  - `if-modified-since`
+  - `if-none-match`
+  - `if-unmodified-since`
+  - `range`
+  - `upgrade`
+- Headers that are covered by other Cache Key features
+  - `cookie`
+  - `host`
+- Headers that are specific to Cloudflare and prefixed with `cf-`, e.g. `cf-ray`
+- Headers that are already included in the custom Cache Key template, e.g. `origin`
+
+### Host
+
+Host determines which host header to include in the Cache Key.
+- If `resolved: false`, Cloudflare includes the `Host` header in the HTTP request sent to the origin.
+- If `resolved: true`, Cloudflare includes the `Host` header that was resolved to get the `origin IP` for the request. In this scenario, the `Host` header may be different from the header actually sent if the [Cloudflare Resolve Override](https://support.cloudflare.com/hc/articles/206190798) feature is used.
+
+### Cookie
+
+Like `query_string` or `header`, `cookie` controls which cookies appear in the Cache Key. You can either include the cookie value or check for the presence of a particular cookie.
+
+#### Usage notes
+
+You cannot include cookies specific to Cloudflare. Cloudflare cookies are prefixed with `__cf`, e.g. `__cflb`
+
+#### User features
+
+User feature fields add features about the end-user (client) into the Cache Key. 
+- `device_type` classifies a request as `mobile`, `desktop`, or `tablet` based on the User Agent
+- `geo` includes the client’s country, derived from the IP address
+- `lang` includes the first language code contained in the `Accept-Language` header sent by the client
diff --git a/products/cache/src/content/about/cdn-cache-control.md b/products/cache/src/content/about/cdn-cache-control.md
new file mode 100644
index 00000000000..059ea499911
--- /dev/null
+++ b/products/cache/src/content/about/cdn-cache-control.md
@@ -0,0 +1,149 @@
+---
+title: CDN-Cache-Control
+order: 4
+pcx-content-type: concept
+---
+
+# CDN-Cache-Control
+
+`CDN-Cache-Control` is a response header field set on the origin to separately control the behavior of CDN caches from other intermediaries that might handle a response. You can set the `CDN-Cache-Control` or `Cloudflare-CDN-Cache-Control` response header using the same directives used with the [Cache-Control](/about/cache-control)
+.
+## Header precedence
+
+You have several options available to determine how `CDN-Cache-Control` directives interact with `Cache-Control directives`. 
+
+An origin can:
+
+- Return the `CDN-Cache-Control` response header which Cloudflare evaluates to make caching decisions. `Cache-Control`, if also returned by the origin, is proxied as is and does not affect caching decisions made by Cloudflare. Additionally, `CDN-Cache-Control` is proxied downstream in case there are other CDNs between Cloudflare and the browser.
+
+- Return the `Cloudflare-CDN-Cache-Control` response header. This results in the same behavior as the origin returning `CDN-Cache-Control` except Cloudflare does not proxy `Cloudflare-CDN-Cache-Control` downstream because it’s a header only used to control Cloudflare. This option is beneficial if you want only Cloudflare to have a different caching behavior while all other downstream servers rely on `Cache-Control` or if you do not want Cloudflare to proxy the `CDN-Cache-Control` header downstream.
+
+- Return both `Cloudflare-CDN-Cache-Control` and `CDN-Cache-Control` response headers. In this case, Cloudflare only looks at `Cloudflare-CDN-Cache-Control` when making caching decisions because it is the most specific version of `CDN-Cache-Control` and proxies `CDN-Cache-Control` downstream. Only forwarding `CDN-Cache-Control` in this situation is beneficial if you want Cloudflare to have a different caching behavior than other CDNs downstream.
+
+## Interaction with other Cloudflare features
+
+### Edge Cache TTL page rule
+
+The Edge Cache TTL page rule overrides the amount of time an asset is cached on the edge (Cloudflare data centers). This page rule overrides directives in `Cloudflare-CDN-Cache-Control/CDN-Cache-Control` which manage how long an asset is cached on the edge. You can set this page rule from the rules section of the dashboard. 
+
+### Browser Cache TTL page rule
+
+The Browser Cache TTL page rule overrides the amount of time an asset is cached by browsers/servers downstream of Cloudflare. Browser Cache TTL only modifies the `Cache-Control` response header. This page rule does not modify `Cloudflare-CDN-Cache-Control/CDN-Cache-Control` response headers.
+
+### Other Origin Response Headers
+
+The origin returns the `Expires` response header which specifies the amount of time before an object is considered stale to the browser. This response header does not affect the caching decision at Cloudflare when `Cloudflare-CDN-Cache-Control/CDN-Cache-Control` is in use.
+
+### Cloudflare Default cache values
+
+In situations where Cloudflare does not receive `Cloudflare-CDN-Cache-Control`, `CDN-Cache-Control`, or `Cache-Control` values, cacheable assets use the general [default values](/about/default-cache-behavior).
+
+## When to use CDN-Cache-Control
+
+### Manage cached assets TTLs
+
+Use `CDN-Cache-Control` when you want to manage cached asset’s TTLs separately for origin caches, CDN caches, and browser caches. Previously, this scenario required creating page rules, but `CDN-Cache-Control` accomplishes the desired behavior through origin-set response headers. The example below shows how you could manage your cached asset’s TTLs.
+
+Headers: 
+- `Cache-Control: max-age=14400, s-maxage=84000`
+- `Cloudflare-CDN-Cache-Control: max-age=24400`
+- `CDN-Cache-Control: 18000`
+
+Cache behavior: 
+
+<table>
+  <tbody>
+    <th colspan="5" rowspan="1">
+      Caches
+    </th>
+    <th colspan="5" rowspan="1">
+      Cache TTL (seconds)
+    </th>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Origin Server Cache
+      </td>
+      <td colspan="5" rowspan="1">
+        14400
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Network Shared Cache
+      </td>
+      <td colspan="5" rowspan="1">
+        84000
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Cloudflare Edge
+      </td>
+      <td colspan="5" rowspan="1">
+        24400
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Other CDNs
+      </td>
+      <td colspan="5" rowspan="1">
+        18000
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Browser Cache
+      </td>
+      <td colspan="5" rowspan="1">
+        14400
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+### Specify when to serve stale content
+
+Use `CDN-Cache-Control` headers in conjunction with `Cache-Control` headers to specify when to serve stale content in the case of error or during revalidation. The example below shows how you might set your headers and directives to apply to CDNs when handling errors.
+
+Headers:
+- `Cache-Control: stale-if-error=400`
+- `Cloudflare-CDN-Cache-Control: stale-if-error=60`
+- `CDN-Cache-Control: stale-if-error=200`
+
+Behavior in response to 5XX error:
+
+<table>
+  <tbody>
+    <th colspan="5" rowspan="1">
+      Caches
+    </th>
+    <th colspan="5" rowspan="1">
+      Stale served (seconds) in response to error
+    </th>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Origin Cache Layer/Network Cache/Browser Cache
+      </td>
+      <td colspan="5" rowspan="1">
+        400 (if it assumes the directive applies)
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Cloudflare Edge
+      </td>
+      <td colspan="5" rowspan="1">
+        60
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        Other CDN
+      </td>
+      <td colspan="5" rowspan="1">
+        200
+      </td>
+    </tr>
+  </tbody>
+</table>
diff --git a/products/cache/src/content/about/default-cache-behavior.md b/products/cache/src/content/about/default-cache-behavior.md
new file mode 100644
index 00000000000..862bf3332ac
--- /dev/null
+++ b/products/cache/src/content/about/default-cache-behavior.md
@@ -0,0 +1,259 @@
+---
+title: Default cache behavior
+order: 5
+pcx-content-type: concept
+---
+
+# Default Cache Behavior
+
+Cloudflare respects the origin web server’s cache headers in the following order unless an Edge Cache TTL page rule overrides the headers. 
+
+- Cloudflare does not cache the resource if the `Cache-Control` header is set to `private`, `no-store`, `no-cache`, or `max-age=0` or if there is a cookie in the response.
+- Cloudflare caches the resource in the following scenarios:
+    - The `Cache-Control` header is set to `public` and the `max-age` is greater than 0.
+    - The `Expires` header is set to a future date.
+- If both the `max-age` and an `Expires` header are set, `max-age` is used.
+
+For a list of directives and behaviors when Origin Cache-Control is enabled or disabled, see [Cache-Control directives](/about/cache-control#cache-control-directives).
+
+## Default cached file extensions
+
+Cloudflare only caches based on file extension and not by MIME type. The Cloudflare CDN does not cache HTML by default. Additionally, Cloudflare caches a website’s robot.txt.
+
+<table>
+  <tbody>
+    <tr>
+      <td colspan="5" rowspan="1">
+        AVIF
+      </td>
+      <td colspan="5" rowspan="1">
+        BMP
+      </td>
+      <td colspan="5" rowspan="1">
+        EJS
+      </td>
+      <td colspan="5" rowspan="1">
+        JPEG
+      </td>
+      <td colspan="5" rowspan="1">
+        PDF
+      </td>
+      <td colspan="5" rowspan="1">
+        PS
+      </td>
+      <td colspan="5" rowspan="1">
+        TTF
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        CLASS
+      </td>
+      <td colspan="5" rowspan="1">
+        EOT
+      </td>
+      <td colspan="5" rowspan="1">
+        JPG
+      </td>
+      <td colspan="5" rowspan="1">
+        PICT
+      </td>
+      <td colspan="5" rowspan="1">
+        SVG
+      </td>
+      <td colspan="5" rowspan="1">
+        WEBP
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        CSS
+      </td>
+      <td colspan="5" rowspan="1">
+        EPS
+      </td>
+      <td colspan="5" rowspan="1">
+        JS
+      </td>
+      <td colspan="5" rowspan="1">
+        PLS
+      </td>
+      <td colspan="5" rowspan="1">
+        SVGZ
+      </td>
+      <td colspan="5" rowspan="1">
+        WOFF
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        CSV
+      </td>
+      <td colspan="5" rowspan="1">
+        GIF
+      </td>
+      <td colspan="5" rowspan="1">
+        MID
+      </td>
+      <td colspan="5" rowspan="1">
+        PNG
+      </td>
+      <td colspan="5" rowspan="1">
+        SWF
+      </td>
+      <td colspan="5" rowspan="1">
+        WOFF2
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        DOC
+      </td>
+      <td colspan="5" rowspan="1">
+        ICO
+      </td>
+      <td colspan="5" rowspan="1">
+        MIDI
+      </td>
+      <td colspan="5" rowspan="1">
+        PPT
+      </td>
+      <td colspan="5" rowspan="1">
+        TIF
+      </td>
+      <td colspan="5" rowspan="1">
+        XLS
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        DOCX
+      </td>
+      <td colspan="5" rowspan="1">
+        JAR
+      </td>
+      <td colspan="5" rowspan="1">
+        OTF
+      </td>
+      <td colspan="5" rowspan="1">
+        PPTX
+      </td>
+      <td colspan="5" rowspan="1">
+        TIFF
+      </td>
+      <td colspan="5" rowspan="1">
+        XLSX
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+<Aside type="note" header="Note">
+
+The Free plan additionally supports APK, EXE, DMG, BIN, ISO, ZIP, RAR, ZST, TAR, BZ2, 7z, GZ, MP4, MKV, AVI, WEBM, MP3, OGG, and FLAC file extensions. 
+
+</Aside>
+
+To cache additional content, see [Page Rules](/how-to/create-page-rules) to create a rule to cache everything.
+
+## Customization options and limitations
+
+Cloudflare’s CDN provides several cache customization options:
+- Caching behavior for individual URLs via [Cloudflare Page Rules](/how-to/create-page-rules)
+- Customize caching with [Cloudflare Workers](https://developers.cloudflare.com/workers/learning/how-the-cache-works)
+- Adjust caching level, cache TTL, and more via the Cloudflare Caching app
+
+Cloudflare limits the upload size (HTTP POST request size) per plan type:
+
+- 100MB Free and Pro
+- 200MB Business
+- 500MB Enterprise by default. Contact [Customer Support](https://support.cloudflare.com/hc/articles/200172476) to request a limit increase.
+
+If you require a larger upload, group requests smaller than the upload thresholds or upload the full resource through an [unproxied (grey-clouded) DNS record](https://support.cloudflare.com/hc/en-us/articles/200169626).
+
+## Cloudflare cache responses
+
+The output of the `CF-Cache-Status header` shows whether or not a resource is cached. To investigate cache responses returned by the `CF-Cache-Status` header, use services like [Redbot](https://redbot.org/), [webpagetest.org](http://www.webpagetest.org/), or a visual tool like [Chrome’s Dr. Flare plugin](https://community.cloudflare.com/t/community-tip-dr-flare-debug-tool-for-cloudflare-chrome-extension/110166).
+
+<table>
+  <tbody>
+    <th colspan="4" rowspan="1">
+      Status
+    </th>
+    <th colspan="4" rowspan="1">
+      Description
+    </th>
+    <tr>
+      <td colspan="5" rowspan="1">
+        HIT
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource was found in Cloudflare’s cache.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        MISS
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource was not found in Cloudflare’s cache and was served from the origin web server.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        NONE
+      </td>
+      <td colspan="5" rowspan="1">
+        Cloudflare generated response. The resource is not eligible for caching.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        EXPIRED
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource was found in Cloudflare’s cache but was expired and served from the origin web server.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        STALE
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource was served from Cloudflare’s cache but was expired. Cloudflare could not contact the origin to retrieve an updated resource.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        BYPASS
+      </td>
+      <td colspan="5" rowspan="1">
+        The origin server instructed Cloudflare to bypass cache via a Cache-Control header set to <code>no-cache</code>, <code>private</code>, or <code>max-age=0</code> even though Cloudflare originally preferred to cache the asset. BYPASS is returned when enabling <a href="/about/cache-control">Origin Cache-Control</a>. Cloudflare also sets BYPASS when your origin web server sends cookies in the response header.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        REVALIDATED
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource is served from Cloudflare’s cache but is stale. The resource was revalidated by either an <code>If-Modified-Since</code> header or an <code>If-None-Match header</code>.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        UPDATING
+      </td>
+      <td colspan="5" rowspan="1">
+        The resource was served from Cloudflare’s cache and was expired, but the origin web server is updating the resource. UPDATING is typically only seen for very popular cached resources.
+      </td>
+    </tr>
+    <tr>
+      <td colspan="5" rowspan="1">
+        DYNAMIC
+      </td>
+      <td colspan="5" rowspan="1">
+        Cloudflare does not consider the asset eligible to cache and your Cloudflare settings do not explicitly instruct Cloudflare to cache the asset.  Instead, the asset was requested from the origin web server. Use <a href="/how-to/create-page-rules">Page Rules</a> to implement custom caching options.
+      </td>
+    </tr>
+  </tbody>
+</table>
diff --git a/products/cache/src/content/about/edge-browser-cache-ttl.md b/products/cache/src/content/about/edge-browser-cache-ttl.md
new file mode 100644
index 00000000000..615436de6ed
--- /dev/null
+++ b/products/cache/src/content/about/edge-browser-cache-ttl.md
@@ -0,0 +1,29 @@
+---
+title: Edge and Browser Cache TTL
+order: 6
+pcx-content-type: concept
+---
+
+# Edge and Browser Cache TTL
+
+## Edge Cache TTL
+
+Edge Cache TTL (Time to Live) specifies how long to cache a resource in the Cloudflare edge network. Edge Cache TTL only takes effect when included in a page rule setting that sets **Cache Level** to **Cache Everything**. Edge Cache TTL is not visible in response headers and the minimum Edge Cache TTL depends on plan type.
+
+- Free - 2 hours
+- Pro - 1 hour
+- Business - 30 minutes
+- Enterprise - 1 second
+
+For more information on creating page rules, see [Create page rules](/how-to/create-page-rules).
+
+## Browser Cache TTL
+
+The Browser Cache TTL sets the expiration for resources cached in a visitor’s browser. By default, Cloudflare honors the cache expiration set in your `Expires` and `Cache-Control` headers but overrides those headers if:
+
+- The value of the `Cache-Control` header from the origin web server is less than the Browser Cache TTL Cloudflare setting.
+- The origin web server does not send a `Cache-Control` or an `Expires` header.
+
+Unless specifically set in a page rule, Cloudflare does not override or insert `Cache-Control` headers if you set **Browser Cache TTL** to **Respect Existing Headers**.
+
+For more information on setting the Browser Cache TTL, see [Set Browser Cache TTL](/how-to/set-browser-ttl).
diff --git a/products/cache/src/content/about/index.md b/products/cache/src/content/about/index.md
new file mode 100644
index 00000000000..5203e1b2356
--- /dev/null
+++ b/products/cache/src/content/about/index.md
@@ -0,0 +1,9 @@
+---
+title: About
+order: 1
+pcx-content-type: navigation
+---
+
+# About Cache
+
+<DirectoryListing path="/about"/>
diff --git a/products/cache/src/content/best-practices/activate-polish.md b/products/cache/src/content/best-practices/activate-polish.md
new file mode 100644
index 00000000000..cb4dd545a50
--- /dev/null
+++ b/products/cache/src/content/best-practices/activate-polish.md
@@ -0,0 +1,72 @@
+---
+title: Activate Polish
+order: 16
+pcx-content-type: concept
+---
+
+# Activate Polish
+
+Polish strips metadata to accelerate image downloads and reduce image size through lossy or lossless compression. Learn more about Polish from our [blog post](https://blog.cloudflare.com/introducing-polish-automatic-image-optimizati/).
+
+![Polish](../images/polish.png)
+
+<Aside type="note" header="Note">
+
+[Cloudflare Image Resizing](https://developers.cloudflare.com/images/) also optimizes images cached in the Cloudflare network, but is only available for Business and Enterprise users.
+
+</Aside>
+
+## Polish compression options
+
+### Lossless 
+
+Lossless attempts to strip most metadata, e.g. EXIF data, but does not change the image detail. Effectively, when uncompressed, a lossless image is identical to the original.
+
+### Lossy
+
+Lossy attempts to strip most metadata and compresses images by approximately 15 percent. When uncompressed, some of the redundant information from the original image is lost.
+Lossy has the same effect as Lossless when applied to PNG.
+
+<Aside type="note" header="Note">
+
+With Lossless and Lossy modes, Cloudflare attempts to strip as much metadata as possible. However, Cloudflare cannot guarantee stripping all metadata because other factors, such as caching status, might affect which metadata is finally sent in the response.
+
+</Aside>
+
+### WebP
+
+WebP is a modern image format providing superior lossless and lossy compression for images. WebP lossless images are approximately 26 percent smaller than PNGs, while lossy images are 25 to 34 percent smaller than JPEGs. Currently, WebP is only supported in Firefox, Google Chrome, and Opera. You can learn more in our [blog post](https://blog.cloudflare.com/a-very-webp-new-year-from-cloudflare/).
+
+Polish creates and caches a WebP version of the image and delivers it to the browser if the `Accept` header from the browser includes WebP and the compressed image is significantly smaller than the lossy or lossless compression.
+
+`Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8`
+
+## Activate Polish
+
+Images in the [cache must be purged](/how-to/purge-cache) or expired before seeing any changes in Polish settings.
+
+1. Log in to the Cloudflare dashboard.
+1. Click the appropriate Cloudflare account for the domain where you will activate Polish.
+1. Click **Speed** > **Optimization** > **Polish**.
+1. Under **Polish**, choose **Lossy** or **Lossless** from the dropdown menu.
+1. (Optional) Click **WebP**. By applying WebP, Cloudflare can further optimize .png and .jpeg images stored in the origin server.
+
+To ensure WebP is not served from cache to a browser lacking WebP support, disable WebP at your origin web server when using Polish.
+
+## Verify Polish is active
+
+```
+cf-bgj: imgq:85  
+
+cf-polished: qual=85, origFmt=jpeg, origSize=95005  
+
+cf-cache-status: HIT
+```
+
+- The `cf-bgj` header confirms that Cloudflare applied Polish and returns the image quality setting (`imgq`).
+- The `cf-polished` header represents the Polish status and returns the image quality setting (`qual`) and original size (`origSize`).
+- The `cf-cache-status` confirms that the image has been cached and Polish can be applied.
+
+WebP conversion does not change the image URL. The `Content-Type` HTTP header tells the browser the original format of an image.
+
+To view a list of common `Cf-Polished` statuses and how to troubleshoot them, see [Common Cf-Polished statuses](/reference/common-cf-published-statuses).
diff --git a/products/cache/src/content/best-practices/always-online.md b/products/cache/src/content/best-practices/always-online.md
new file mode 100644
index 00000000000..cb0e74121d2
--- /dev/null
+++ b/products/cache/src/content/best-practices/always-online.md
@@ -0,0 +1,31 @@
+---
+title: Always Online
+order: 17
+pcx-content-type: concept
+---
+
+# Always Online
+
+Observe the following best practices when enabling Always Online with Internet Archive integration.
+
+- **Allow requests from Cloudflare IP addresses.** Origin servers for domains [proxied through Cloudflare](https://support.cloudflare.com/hc/articles/205195708#h_815d1b1e-74cf-4a5f-b477-e441a76ac3fd) receive requests from Cloudflare IP addresses. To avoid blocking these requests, follow the guidelines for [allowing Cloudflare IP addresses](https://support.cloudflare.com/hc/articles/201897700). When you observe the Always Online banner while your origin web server is online, your origin web server or hosting provider is likely blocking or rate limiting Cloudflare requests.
+- **Configure your origin server’s Cache Control header.** To ensure Always Online caches resources for your site, do not set your origin server’s Cache Control header to `no-cache`, `must-revalidate`, or `max-age=0`.
+- **Consider potential conflicts with Cloudflare features that transform URIs.** Always Online Beta with Internet Archive integration may cause issues with Page Rules and other Cloudflare features that transform URIs due to the way the Internet Archive crawls pages to archive. Specifically, some redirects that take place at the edge may cause the Internet Archive's crawler not to archive the target URL. Before enabling Origin Cache Control, review [how Cloudflare caches resources by default](/about/default-cache-behavior) as well as any Page Rules you have configured so that you can avoid these issues. If you experience problems, disable Always Online Beta.
+
+Do not use Always Online with:
+- [Custom Hostnames (SSL for SaaS)](https://developers.cloudflare.com/ssl/ssl-for-saas)
+- API traffic
+- An [IP Access Rule](https://support.cloudflare.com/hc/articles/217074967) or [Firewall Rule](https://support.cloudflare.com/hc/articles/360016473712) that blocks the United States or
+- A [Cache Everything Page Rule](/how-to/create-page-rules#cache-everything) that configures an Edge Cache TTL lower than the Always Online crawl frequency pertaining to your domain plan type.
+- Bypass Cache page rules. Always Online ignores Bypass Cache page rules and serves Always Online cached assets.
+
+## Limitations
+
+There are limitations with the Always Online functionality: 
+
+1. Always Online is not immediately active for sites recently added due to:
+    - DNS record propagation, which can take 24-72 hours
+    - Always Online has not initially crawled the website 
+2. Cloudflare cannot show private content behind logins or handle form submission (POSTs) if your origin web server is offline.
+
+Always Online does not trigger for HTTP response codes such as [404](https://support.cloudflare.com/hc/articles/115003014512#code_404), [503](https://support.cloudflare.com/hc/articles/115003011431#503error), or [500](https://support.cloudflare.com/hc/articles/115003011431#500error) errors such as database connection errors or internal server errors.
diff --git a/products/cache/src/content/best-practices/avoid-web-poisoning.md b/products/cache/src/content/best-practices/avoid-web-poisoning.md
new file mode 100644
index 00000000000..dcaddacfc4c
--- /dev/null
+++ b/products/cache/src/content/best-practices/avoid-web-poisoning.md
@@ -0,0 +1,45 @@
+---
+title: Avoid web cache poisoning
+order: 18
+pcx-content-type: concept
+---
+
+# Avoid Web Cache Poisoning
+
+A cache poisoning attack uses an HTTP request to trick an origin web server into responding with a harmful resource that has the same cache key as a clean request. As a result, the poisoned resource gets cached and served to other users.
+
+A Content Delivery Network (CDN) like Cloudflare relies on cache keys to compare new requests against cached resources. The CDN then determines whether the resource should be served from the cache or requested directly from the origin web server.
+
+## Learn about Cache Poisoning
+
+To deepen your understanding of the risks and vulnerabilities associated with cache poisoning, consult the following resources:
+
+- [Practical Web Cache Poisoning](https://portswigger.net/blog/practical-web-cache-poisoning)
+- [How Cloudflare protects customers from cache poisoning](https://blog.cloudflare.com/cache-poisoning-protection/)
+
+## Only cache files that are truly static
+
+Review the caching configuration for your origin web server and ensure you are caching files that are static and do not depend on user input in any way. To learn more about Cloudflare caching, review:
+
+- [Which file extensions does Cloudflare cache for static content?](/about/default-cache-behavior)
+- [How Do I Tell Cloudflare What to Cache?](/how-to/create-page-rules#cache-everything)
+
+## Do not trust data in HTTP headers
+
+Client-side vulnerabilities are often exploited through HTTP headers, including cross-site scripting (XSS). In general, you should not trust the data in HTTP headers and as such:
+
+- Do not rely on values in HTTP headers if they are not part of your [cache key](/about/cache-keys).
+- Never return HTTP headers to users in cached content.
+
+## Do not trust GET request bodies
+
+Cloudflare caches contents of GET request bodies, but they are not included in the cache key. GET request bodies should be considered untrusted and should not modify the contents of a response. If a GET body can change the contents of a response, consider bypassing cache or using a POST request.
+
+
+## Monitor web security advisories
+
+To keep informed about Internet security threats, Cloudflare recommends that you monitor web security advisories on a regular basis. Some of the more popular advisories include:
+
+- [Drupal Security Advisories](http://content.cloudflare.com/dZ0O0ckIN00C000S0h020X0)
+- [Symfony Security Advisories](http://content.cloudflare.com/o02lI00iN00c0X000CSZ0O0)
+- [Zend Security Advisories](http://content.cloudflare.com/AN0j00XS20IZc0000O0m00C)
diff --git a/products/cache/src/content/best-practices/customize-cache.md b/products/cache/src/content/best-practices/customize-cache.md
new file mode 100644
index 00000000000..b0ee2f1225b
--- /dev/null
+++ b/products/cache/src/content/best-practices/customize-cache.md
@@ -0,0 +1,15 @@
+---
+title: Customize cache
+order: 19
+pcx-content-type: concept
+---
+
+# Customize cache
+
+Some possible combinations of origin web server settings and Cloudflare [Page Rules](/how-to/create-page-rules) include:
+
+- Create a directory for static content at your origin web server.  For example, create a `/static/` subdirectory at your origin web server and a Cache Everything Page Rule matching the `*example.com/static/*` URL pattern.
+- Append a unique file extension to static pages. For example, create a `.shtml` file extension for resources at your origin web server and a Cache Everything Page Rule matching the `*example.com/*.shtml` URL pattern.
+- Add a query string to a resource’s URL to mark the content as static.  For example, add a `static=true` query string for resources at your origin web server and a Cache Everything Page Rule matching the `*example.com/*?*static=true*` URL pattern.
+
+Resources that match a Cache Everything Page Rule are still not cached if the origin web server sends a Cache-Control header of `max-age=0`, `private`, `no-cache`, or an `Expires` header with an already expired date. Include the [Edge Cache TTL](/how-to/create-page-rules) setting within the Cache Everything Page Rule to additionally override the `Cache-Control` headers from the origin web server.
diff --git a/products/cache/src/content/best-practices/index.md b/products/cache/src/content/best-practices/index.md
new file mode 100644
index 00000000000..569c0bedc95
--- /dev/null
+++ b/products/cache/src/content/best-practices/index.md
@@ -0,0 +1,9 @@
+---
+title: Best Practices
+order: 15
+pcx-content-type: navigation
+---
+
+# Best practices
+
+<DirectoryListing path="/best-practices"/>
\ No newline at end of file
diff --git a/products/cache/src/content/how-to/create-cache-keys.md b/products/cache/src/content/how-to/create-cache-keys.md
new file mode 100644
index 00000000000..01f57ee1ad7
--- /dev/null
+++ b/products/cache/src/content/how-to/create-cache-keys.md
@@ -0,0 +1,24 @@
+---
+title: Create custom cache keys
+order: 9
+pcx-content-type: how-to
+---
+
+# Create custom cache keys
+
+1. Log in to your Cloudflare account.
+1. Select the domain that requires changes to the Cache Key Template.
+1. Click the **Rules** > **Page Rules**.
+1. Click **Create Page Rule**.
+1. Under **If the URL matches**, enter the URL to match.
+1. Under **Then the settings are**, choose **Custom Cache Ke**y from the dropdown.
+1. Click the appropriate *Query String* setting.
+1. (Optional) Click Advanced and enter appropriate settings for:
+    - `Headers`
+    - `Cookie`
+    - `Host`
+    - `User Features`
+1. Choose a save option:
+    - **Save as Draft** to save the rule and leave it disabled. Note that disabled rules count towards the number of rules allowed for your domain.
+    - **Save and Deploy **to save the rule and enable it immediately.
+  
\ No newline at end of file
diff --git a/products/cache/src/content/how-to/create-page-rules.md b/products/cache/src/content/how-to/create-page-rules.md
new file mode 100644
index 00000000000..bc5f0234d85
--- /dev/null
+++ b/products/cache/src/content/how-to/create-page-rules.md
@@ -0,0 +1,157 @@
+---
+title: Create Edge Cache TTL page rules
+order: 10
+pcx-content-type: tutorial
+---
+
+# Create Edge Cache TTL page rules
+
+## Get Started
+
+Before you begin, you should understand two basic page rule behaviors:
+
+- Only the highest priority matching page rule takes effect on a request.
+- Page rules are prioritized in descending order in the Cloudflare dashboard, with the highest priority rule at the top.
+
+Cloudflare recommends ordering your rules from most specific to least specific.
+
+## Page Rules Explained
+
+A page rule matches a URL pattern based on the following format (comprised of five segments): `<scheme>://<hostname><:port>/<path>?<query_string>`
+
+A URL with four segments look similar to the example below.
+
+`https://www.example.com:443/image.png?parameter1=value1`
+
+The `scheme` and `port` segments are optional. If omitted, scheme matches both `http://` and `https:// protocols`. If no port is specified, the rule matches all ports.
+
+You can disable a page rule at any time. While a rule is disabled, actions won’t trigger, but the rule still appears in the **Rules** > **Page Rules** tab, is editable, and counts against the number of rules allowed for your domain. The Save as Draft option creates a page rule that is disabled by default.
+
+Page rules trigger certain actions when a request matches a defined URL pattern.
+
+<table>
+  <tbody>
+    <th>
+      Plan
+    </th>
+    <th>
+      Page rules allowed
+    </th>
+    <tr>
+      <td>
+        Free
+      </td>
+      <td>
+        3
+      </td>
+    </tr>
+    <tr>
+      <td>
+        Pro
+      </td> 
+      <td>
+        20
+      </td>
+    </tr>
+    <tr>
+      <td>
+        Business
+      </td> 
+      <td>
+        50
+      </td>
+    </tr>
+    <tr>
+      <td>
+        Enterprise
+      </td>  
+      <td>
+        125
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+You can also [purchase additional rules](https://www.cloudflare.com/features-page-rules/) up to a maximum of 100 for domains in the Free, Pro, and Business plans.
+
+
+## Create a page rule
+
+1. Log in to your Cloudflare dashboard.
+1. Select the domain where you want to add the page rule.
+1. Click **Rules**.
+1. In the **Page Rules** tab, click **Create Page Rule**. The **Create Page Rul**e for `<your domain>` dialog opens.
+1. Under **If the URL matches**, enter the URL or URL pattern that should match the rule. Learn more about wildcard matching
+1. Under **Then the settings are**, click **Add a Setting**. 
+1. Select an option from the dropdown. You can include more than one setting per rule. Learn more about settings in the summary below.
+1. From the **Order** dropdown, specify the desired order: **First**, **Last**, or **Custom**.
+1. Choose a save option:
+  - **Save as Draft** to save the rule and leave it disabled. Note that disabled rules count towards the number of rules allowed for your domain.
+  - **Save and Deploy** to save the rule and enable it immediately.
+
+<Aside type="note" header="Note">
+
+We do not support non-ASCII characters (e.g. punycode/unicode domain) in Page Rules. Instead, you can URL-encode the string using [Punycode converter](https://www.punycoder.com/) as a workaround.
+
+</Aside>
+
+## Edit existing page rules
+
+1. Log in to your Cloudflare dashboard.
+1. Select the domain where you want to edit your page rule.
+1. Click **Rules**.
+1. In the **Page Rules** tab, locate the rule to edit.
+1. Proceed to make the necessary changes, as follows:
+    - To enable or disable a rule, click the **On/Off** toggle.
+    - To modify the URL pattern, settings, or order, click the **Edit** button (wrench icon). In the dialog, enter the information you want to change.
+
+## Delete a rule
+
+1. Log in to your Cloudflare dashboard.
+1. Select the domain where you want to edit your page rule.
+1. Click  **Rules**.
+1. In the **Page Rules** tab, locate the rule to edit.
+1. Click the **Delete** button (wrench icon) and confirm the deletion when prompted.
+
+## Cache by device type (Enterprise only)
+
+Enterprise domains can cache content by device type to target visitors with content appropriate to their device. Cloudflare evaluates the User-Agent header in the HTTP request to identify the device type and identifies each device type with a case insensitive match to the regex below:
+
+- Mobile: `(?:phone|windows\s+phone|ipod|blackberry|(?:android|bb\d+|meego|silk|googlebot) .+? mobile|palm|windows\s+ce|opera\ mini|avantgo|mobilesafari|docomo|KAIOS)`
+- Tablet: `(?:ipad|playbook|(?:android|bb\d+|meego|silk)(?! .+? mobile))`
+- Desktop: Everything else not matched above.
+
+1. Log in to your Cloudflare account.
+1. Select the appropriate domain.
+1. Select **Rules** > **Page Rules**.
+1. Click **Create Page Rule**.
+1. Enter the URL to cache by device type.
+1. Choose the **Cache By Device Type** setting.
+1. Select **On**.
+1. Click **Save and Deploy**.
+
+Once enabled, Cloudflare sends a `CF-Device-Type` HTTP header to your origin with a value of either `mobile`, `tablet`, or `desktop` for every request to specify the visitor’s device type. If your origin responds with the appropriate content for that device type, Cloudflare only caches the resource for that specific device type.
+
+To purge resources using Cache By Device Type, you must [purge by Cache-Tag](/how-to/purge-cache#purge-using-cache-tags).
+
+## Cache Everything
+
+Caching additional content at Cloudflare requires a **Cache Everything** Page Rule.  Without creating a Cache Everything Page Rule, dynamic assets are never cached even if a [public Cache-Control header](/about/cache-control) is returned. When combined with an Edge Cache TTL > 0, **Cache Everything** removes cookies from the origin web server response. 
+
+<Aside type="warning" header="Warning">
+
+Do not use **Cache Everything** for admin sections of your website or for pages that require a login. To prevent Cloudflare from caching specific URLs, create a page rule with **Cache Level** set to **Bypass**. Next, drag that rule above the **Cache Everything** Page Rule in the dashboard so that the **Bypass** rule is above the **Cache Everything**.
+
+</Aside>
+
+1. Log in to your Cloudflare account.
+1. Choose the appropriate domain.
+1. Click **Rules** > Page **Rules**.
+1. Click **Create Page Rule**.
+1. Under **If the URL matches**, create a URL pattern to differentiate your website’s static versus dynamic content. 
+1. Under **Then the settings are**, choose **Cache Level**. 
+1. For **Select Cache Level**, choose the **Cache Everything** submenu setting.  
+1. Click **Save and Deploy**.
+1. Verify your resources are cached by checking the [cache response returned by Cloudflare](/about/default-cache-behavior#cloudflare-cache-responses).
+
+Cloudflare caches XML responses when using Cache Everything. By default, jquery's getScript explicitly bypasses cache by appending a timestamp query string [unless the behavior is disabled](http://api.jquery.com/jQuery.getScript/). For further details on how to adjust Cloudflare’s behavior for query strings, refer to our article on [Caching Levels](/how-to/set-caching-levels).
diff --git a/products/cache/src/content/how-to/enable-always-online.md b/products/cache/src/content/how-to/enable-always-online.md
new file mode 100644
index 00000000000..fcf819ca570
--- /dev/null
+++ b/products/cache/src/content/how-to/enable-always-online.md
@@ -0,0 +1,27 @@
+---
+title: Enable Always Online
+order: 11
+pcx-content-type: how-to
+---
+
+# Enable Always Online
+
+Always Online with Internet Archive integration is a Beta feature and is not enabled by default. 
+
+1. Log in to your Cloudflare account.
+1. Choose the domain that will use Always Online with Internet Archive integration. 
+1. Click the **Caching** > **Configuration**.
+1. Under **Always Online**, set the toggle to **On**.
+1. To enable Internet Archive integration, click **Update**.
+
+To use Cloudflare's Always Online cache without Internet Archive integration, switch the toggle to On but do not click **Update**.
+
+Alternatives to globally enabling Always Online include:
+
+- Using Cloudflare [Page Rules](/how-to/create-page-rules) to enable Always Online
+- Allowing your origin web server to determine which content to cache for display if your origin web server is offline:
+  1. Disable **Always Online**.
+  1. Set [Origin Cache Control](/about/cache-control) for your resources.
+  1. Enable `stale-if-error` at your origin.
+
+For best practices and limitations for Always Online, see [Always Online Best Practices](/best-practices/always-online).
diff --git a/products/cache/src/content/how-to/index.md b/products/cache/src/content/how-to/index.md
new file mode 100644
index 00000000000..caac20c5ef1
--- /dev/null
+++ b/products/cache/src/content/how-to/index.md
@@ -0,0 +1,11 @@
+---
+title: How to
+order: 8
+pcx-content-type: navigation
+---
+
+# How to
+
+Learn how to complete different tasks to customize your cache behavior.
+
+<DirectoryListing path="/how-to"/>
diff --git a/products/cache/src/content/how-to/purge-cache.md b/products/cache/src/content/how-to/purge-cache.md
new file mode 100644
index 00000000000..207a2ab2dd5
--- /dev/null
+++ b/products/cache/src/content/how-to/purge-cache.md
@@ -0,0 +1,187 @@
+---
+title: Purge cache
+order: 12
+pcx-content-type: concept
+---
+
+# Purge cache
+
+You can purge cached resources by single-file (recommended), hostname or cache-tag (Enterprise plans only), or all cached content. All users can purge by single-file (by URL) or purge all cached assets. Cloudflare Enterprise users can also purge using hostnames and cache-tags.
+
+<Aside type="note" header="Note">
+
+Purge requests appear in Cloudflare Logs and are identified by the PURGE method and the Cloudflare-branded User Agent.
+
+</Aside>
+
+## Purge by single-file (by URL)
+
+With purge by single-file, cached resources are immediately removed from the stored assets in your Content Delivery Network (CDN) across all data centers. New requests for the purged asset receive the latest version from your origin web server and add it back to your CDN cache within the specific Cloudflare data center that served the request.
+
+The single-file purge rate limit for the Free subscription is 1000 urls/min. The rate limit is subject to change.
+
+A single-file purge performed through your Cloudflare dashboard does not clear objects that contain:
+- [Custom cache keys](/about/cache-keys)
+- [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin)
+- Any of these response headers:
+  - `X-Forwarded-Host`
+  - `X-Host`
+  - `X-Forwarded-Scheme`
+  - `X-Original-URL`
+  - `X-Rewrite-URL`
+  - `Forwarded`
+
+
+You can purge objects with these characteristics using an API call ([Purge files by URL](https://api.cloudflare.com/#zone-purge-files-by-url)). In the data/header section of the API call, you must include all headers and cache keys contained in the cached resource, along with their matching values.
+
+<Aside type="warning" header="Warning">
+
+Always use UTF-8 encoded URLs for single-file cache purges. Wildcards are not supported on single file purge, and you must use purge by hostname, prefix, or implement cache tags as an alternative solution. All of the listed options are Enterprise features.
+
+</Aside>
+
+1. Log in to your Cloudflare dashboard.
+1. Click **Caching** > **Configuration**.
+1. Under **Purge Cache**, click **Custom Purge**. The **Custom Purge** window appears.
+1. Under **Purge by**, select **URL**.
+1. Enter the appropriate value(s) in the text field using the format shown in the example.
+1. Perform any additional instructions to complete the form.
+1. Review your entries.
+1. Click **Purge**.
+
+## Purge everything
+
+To maintain optimal site performance, Cloudflare strongly recommends using single-file (by URL) purging instead of a complete cache purge.
+
+Purging everything immediately clears all resources from your CDN cache in all Cloudflare data centers. Each new request for a purged resource returns to your origin server to validate the resource. If Cloudflare cannot validate the resource, Cloudflare fetches the latest version from the origin server and replaces the cached version. When a site with heavy traffic contains a lot of assets, requests to your origin server can increase substantially and result in slow site performance.
+
+1. Log in to your Cloudflare dashboard.
+1. Click **Caching** > **Configuration**.
+1. Under **Purge Cache**, click **Purge Everything**. A warning window appears.
+1. If you agree, click **Purge Everything**.
+
+## Cache-Tags (Enterprise Only)
+
+Cache-tag purging makes multi-file purging easier because you can bulk purge by adding cache-tags to your assets, such as web pages, image files, and more. Note that Hostname and Tag purges are only available for Cloudflare Enterprise.
+
+### General workflow for cache-tags
+
+1. Add tags to the `Cache-Tag HTTP` response header from your origin web server for your web content, such as pages, static assets, etc.
+1. [Ensure your web traffic is proxied](https://support.cloudflare.com/hc/articles/205195708#h_815d1b1e-74cf-4a5f-b477-e441a76ac3fd) through Cloudflare.
+1. Cloudflare associates the tags in the `Cache-Tag HTTP` header with the content being cached.
+1. Use specific cache-tags to purge your Cloudflare CDN cache of all content containing that cache-tag from your dashboard or [using our API](https://api.cloudflare.com/#zone-purge-files-by-cache-tags-or-host).
+1. Cloudflare forces a [cache miss](/about/default-cache-behavior#cloudflare-cache-responses) on content with the purged cache-tag.
+
+<Aside type="warning" header="Warning">
+
+Be careful when purging. A cache miss can cause execution delays by requiring a fetch from your origin server.
+
+</Aside>
+
+## Add Cache-Tag HTTP response headers
+
+You add cache-tags to your web content in Cache-Tag HTTP response headers to allow the client and server to pass additional information in requests or responses. HTTP headers consist of a specific case-insensitive name followed by a colon `:` and the valid value, for example, `Cache-Tag:tag1,tag2,tag3`. Use commas to separate the tags when you want to use multiple cache-tags.
+
+When your content reaches our edge network, Cloudflare:
+- Removes the `Cache-Tag HTTP` header before sending the response to your website visitor. Your end users never see Cache-Tag HTTP headers on your Cloudflare-enabled website.
+- Removes whitespaces from the header and any before and after cache-tag names: `tag1`, `tag2` and `tag1,tag2` are considered the same.
+- Removes all repeated and trailing commas before applying cache-tags: `tag1,,,tag2` and `tag1,tag2` are considered the same.
+
+### A few things to remember:
+
+- A single HTTP response can have more than one `Cache-Tag HTTP` header field.
+- The minimum length of a cache-tag is 1 byte.
+- Individual tags don’t have a maximum length, but the aggregate `Cache-Tag HTTP` header cannot exceed 16 KB after the header field name, which is approximately 1000 unique tags. Length includes whitespace and commas but does not include the header field name.
+- For cache purges, the maximum length of cache-tags in an API call is 120 characters.
+- The `Cache-Tag HTTP` header must accept all valid characters allowable in HTTP headers, as specified in [RFC-5987](https://tools.ietf.org/html/rfc5987).
+- Spaces are not allowed in cache-tags.
+- Case does not matter. For example, `Tag1` and `tag1` are considered the same.
+
+## Purge using cache-tags
+
+1. Log in to your Cloudflare dashboard.
+1. Click **Caching** > **Configuration**.
+1. Under **Purge Cache**, click **Custom Purge**. The **Custom Purge** window appears.
+1. Under **Purge by**, select **URL**.
+1. In the text box, enter your tags to use to purge the cached resources. To purge multiple cache-tagged resources, separate each tag with a comma or have one tag per line.
+1. Click **Purge**.
+
+<Aside type="note" header="Note">
+
+You can purge using cache-tags or hostnames via the Cloudflare API. For more information, see the [API documentation](https://api.cloudflare.com/) for Purging by cache-tag or hostname. You can use up to 30 cache-tags in one API call and make up to 30,000 purge API calls in a 24-hour period.
+
+</Aside>
+
+## Purge cache by prefix (Enterprise Only)
+
+Enterprise customers can purge their cache by URL prefix or path separators in their URL. For an example URL like `https://www.example.com/foo/bar/baz/qux.jpg`, valid purge requests include: 
+
+- `www.example.com/`
+- `www.example.com/foo/`
+- `www.example.com/foo/bar/`
+- `www.example.com/foo/bar/baz/`
+- `www.example.com/foo/bar/baz/qux.jpg`
+
+Purging by prefix is useful in different scenarios, such as:
+
+- Purging everything within a directory
+- Increasing control over cached objects in a path 
+- Simplifying the number of purge calls sent 
+
+1. Log in to your Cloudflare dashboard.
+1. Select the appropriate domain.
+1. Click **Caching** > **Configuration**.
+1. Under **Purge Cache**, click **Custom Purge**. The **Custom Purge** window appears.
+1. Under **Purge by**, select **Prefix**.
+1. Follow the syntax instructions.
+    - One prefix per line.
+    - Maximum 30 prefixes per API call.
+1. Enter the appropriate value(s) in the text field using the format shown in the example.
+1. Click **Purge**.
+
+### Limitations
+
+There are several limitations regarding purge by prefix:
+
+- Path separators are limited to 31 for a prefix `(example.com/a/b/c/d/e/f/g/h/i/j/k/l/m…)`.
+- Purge requests are limited to 30 prefixes per request. 
+- [Purge rate-limits apply](https://api.cloudflare.com/#zone-purge-files-by-cache-tags-or-host)
+- URI query strings & fragments cannot purge by prefix: 
+  - `www.example.com/foo?a=b` (query string)
+  - `www.exmaple.com/foo#bar` (fragment)
+
+<Aside type="warning" header="Warning">
+
+Because purge by prefix purges a directory, any URI for a resource within the purged directory is purged regardless of query string or fragment (though fragments are not generally sent by browsers). Purge by prefix rules do not accept fragments and query strings.
+
+Example: If you purge `foo.com/bar`, any asset that starts with `foo.com/bar` will be purged, for example, `foo.com/bar/baz`, `foo.com/bar?good=bad`, etc. and purging `foo.com/bar?good=bad` itself will not work.
+
+</Aside>
+
+## Purge cache key resources
+
+Purge resources that use Cache Keys via the [Cloudflare API](https://api.cloudflare.com/#zone-purge-files-by-url). If you use [Cloudflare’s Purge by URL](https://api.cloudflare.com/#zone-purge-files-by-url), include the headers and query strings that are in your custom Cache Key. 
+
+To purge `device_type` or `geo,` use `CF-Device-Type` or `CF-IPCountry`. `lang` cannot currently be purged. [Purge by Tag / Host](https://api.cloudflare.com/#zone-purge-files-by-cache-tags-or-host) & [Purge Everything](https://api.cloudflare.com/#zone-purge-all-files) are not impacted by the use of custom Cache Keys.
+
+### Purge by device type
+
+For a Cache Key based on device type, purge the asset by passing the `CF-Device-Type` header with the API purge request (valid headers include mobile, desktop, and tablet).
+
+See the example API request below to purge all mobile assets on the root web page.
+
+```
+curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_tag}/purge_cache" 
+-H "X-Auth-Email: user@example.com" -H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" 
+-H "Content-Type: application/json" --data '{"files":[{"url":"http://my.website.com/","headers":{"CF-Device-Type":"mobile"}}]}'
+```
+
+### Purge by geo
+
+Purge resources for a location-based Cache Key by specifying the two-letter country code. Spain is used in the example below.
+
+```
+curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_tag}/purge_cache" 
+-H "X-Auth-Email: user@example.com" 
+-H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" -H "Content-Type: application/json" --data '{"files":[{"url":"http://my.website.com/", "headers":{"Cf-Ipcountry":"ES"}}]}'
+```
diff --git a/products/cache/src/content/how-to/set-browser-ttl.md b/products/cache/src/content/how-to/set-browser-ttl.md
new file mode 100644
index 00000000000..addd24a9ced
--- /dev/null
+++ b/products/cache/src/content/how-to/set-browser-ttl.md
@@ -0,0 +1,32 @@
+---
+title: Set Browser Cache TTL
+order: 13
+pcx-content-type: concept
+---
+
+# Browser Cache TTL
+
+Specify a time for a visitor’s Browser Cache TTL to accelerate the page load for repeat visitors to your website. To configure cache duration within Cloudflare’s data centers, see [Edge Cache TTL](/how-to/create-page-rules).
+
+By default, Cloudflare honors the cache expiration set in your `Expires` and `Cache-Control` headers. Cloudflare overrides any `Cache-Control` or Expires headers with values set via the **Browser Cache TTL** option under **Caching** on your dashboard if:
+
+- The value of the `Cache-Control` header from the origin web server is less than the **Browser Cache TTL =setting**.
+- The origin web server does not send a `Cache-Control` or an `Expires` header.
+
+Unless specifically set in a [Page Rule](/how-to/create-page-rules), Cloudflare does not override or `insert Cache-Control` headers if you set **Browser Cache TTL** to **Respect Existing Headers**.
+
+## Set Browser Cache TTL
+
+The Cloudflare UI and API both prohibit setting Browser Cache TTL to 0 for non-Enterprise domains. 
+
+<Aside type="note" header="Note">
+
+If you modify cached assets, the new asset is not displayed to repeat visitors before the Browser Cache TTL duration. [Purging Cloudflare’s cache](/how-to/purge-cache) does not affect assets cached in a visitor’s browser.
+
+</Aside>
+
+1. Log in to your Cloudflare dashboard.
+1. Click **Caching**.
+1. Under **Browser Cache TTL**, click the drop-down menu to select the desired cache expiration time.
+
+The **Respect Existing Headers** option tells Cloudflare to honor the settings in the `Cache-Control headers` from your origin web server.
diff --git a/products/cache/src/content/how-to/set-caching-levels.md b/products/cache/src/content/how-to/set-caching-levels.md
new file mode 100644
index 00000000000..1e15f8a9942
--- /dev/null
+++ b/products/cache/src/content/how-to/set-caching-levels.md
@@ -0,0 +1,21 @@
+---
+title: Set caching levels
+order: 14
+pcx-content-type: concept
+---
+
+# Caching levels
+
+Caching levels determine how much of your website’s static content Cloudflare should cache. Cloudflare’s CDN caches static content according to the levels below.
+
+- **No Query String**: Delivers resources from cache when there is no query string. Example URL: `example.com/pic.jpg`
+- **Ignore Query String**: Delivers the same resource to everyone independent of the query string. Example URL: `example.com/pic.jpg?ignore=this-query-string`
+- **Standard (Default)**: Delivers a different resource each time the query string changes. Example URL: `example.com/pic.jpg?with=query`
+
+You can adjust the caching level from the dashboard under **Caching** > **Configuration** > **Caching level**.
+
+<Aside type="note" header="Note">
+
+Ignore Query String only disregards the query string for static file extensions. For example, Cloudflare serves the `style.css resource` to requests for either `style.css?this` or `style.css?that`.
+
+</Aside>
diff --git a/products/cache/src/content/images/polish.png b/products/cache/src/content/images/polish.png
new file mode 100644
index 00000000000..39e295263cd
Binary files /dev/null and b/products/cache/src/content/images/polish.png differ
diff --git a/products/cache/src/content/index.md b/products/cache/src/content/index.md
new file mode 100644
index 00000000000..07d3c7f31d9
--- /dev/null
+++ b/products/cache/src/content/index.md
@@ -0,0 +1,20 @@
+---
+title: Overview
+order: 0
+pcx-content-type: concept
+---
+
+# Cache
+
+Cloudflare makes customer websites faster by storing a copy of the website’s content on the servers of our globally distributed data centers. Content can be either static or dynamic: static content is “cacheable” or eligible for caching, and dynamic content is “uncacheable” or ineligible for caching. The cached copies of content are stored physically closer to users, optimized to be fast, and do not require recomputing. 
+
+Cloudflare caches static content based on the following factors:
+
+- Cache level set at a zone or [page rule](/how-to/create-page-rules)
+- File extension
+- Presence of query strings
+- Origin cache-control headers
+- Origin headers that indicate dynamic content
+- Page rules that bypass cache on cookie
+
+Cloudflare only caches resources within the Cloudflare data center that serve the request. Cloudflare does not cache off-site or third-party resources, such as Facebook or Flickr, or content hosted on [unproxied (grey-clouded)](https://support.cloudflare.com/hc/articles/200169626) DNS records.
diff --git a/products/cache/src/content/reference/common-cf-published-statuses.md b/products/cache/src/content/reference/common-cf-published-statuses.md
new file mode 100644
index 00000000000..da446029f78
--- /dev/null
+++ b/products/cache/src/content/reference/common-cf-published-statuses.md
@@ -0,0 +1,16 @@
+---
+title: Common Cf-Polished statuses
+order: 21
+pcx-content-type: navigation
+---
+
+# Common Cf-Polished statuses
+
+Below is a list of common Cf-Polished statuses and how to troubleshoot them. If a Cf-Polished header is not returned, try using single-file cache purge to purge the image. The Cf-Polished header may also be missing if the origin is sending non-image Content-Type, or non-cacheable Cache-Control.
+
+- `input_too_large`: The input image is too large or complex to process and needs a lower resolution. Cloudflare recommends using .png or .jpeg images that are less than 1,000px and 10MB.
+- `not_compressed` or `not_needed`: The image was fully optimized at the origin server and no compression was applied.
+- `webp_bigger`: Polish attempted to convert to WebP, but the image was optimized at the origin server or was created using a low quality setting. Because the WebP version doesn’t exist, the status is set on the JPEG/PNG version of the response.
+- `cannot_optimize` or `internal_error`: The input image is corrupted or incomplete at the origin server. Upload a new version of the image to the origin server.
+- `format_not_supported`: The input image format is not supported (e.g. BMP, TIFF) or the origin server is using additional optimization software that is not compatible with Polish. Try converting the input image to a web-compatible format (e.g. PNG, JPEG) and/or disabling additional optimization software at the origin server.
+- `vary_header_present`: The origin web server has sent a `Vary` header with a value other than accept-encoding. If the origin web server is attempting to support WebP, disable WebP at the origin web server and let Polish perform the WebP conversion. Polish will still work if the accept-encoding is not the only header listed within the Vary header.
diff --git a/products/cache/src/content/reference/development-mode.md b/products/cache/src/content/reference/development-mode.md
new file mode 100644
index 00000000000..21724dfb1a1
--- /dev/null
+++ b/products/cache/src/content/reference/development-mode.md
@@ -0,0 +1,18 @@
+---
+title: Development Mode
+order: 22
+pcx-content-type: how-to
+---
+
+# Development Mode
+
+Development Mode temporarily suspends Cloudflare's edge caching, [minification](https://support.cloudflare.com/hc/en-us/articles/200168196), [Polish](/best-practices/activate-polish), and [Railgun](https://developers.cloudflare.com/railgun/) features for three hours unless disabled beforehand. Development Mode allows customers to immediately observe changes to their cacheable content like images, CSS, or JavaScript.  
+
+## Enable Development Mode
+
+Development Mode temporarily bypasses Cloudflare’s cache and does not purge cached files. To purge your Cloudflare cache, refer to [purge cache](/how-to/purge-cache).
+
+1. Log in to your Cloudflare account.
+1. Select your domain.
+1. Click **Caching**.
+1. Toggle **Development Mode** to **On**.
diff --git a/products/cache/src/content/reference/index.md b/products/cache/src/content/reference/index.md
new file mode 100644
index 00000000000..263fda2b627
--- /dev/null
+++ b/products/cache/src/content/reference/index.md
@@ -0,0 +1,11 @@
+---
+title: Reference
+order: 20
+pcx-content-type: navigation
+---
+
+# Reference
+
+Review the reference content to learn more about specific caching functionality.
+
+<DirectoryListing path="/reference"/>
diff --git a/products/cache/src/content/reference/wildcard-matching.md b/products/cache/src/content/reference/wildcard-matching.md
new file mode 100644
index 00000000000..0e6eacfa5f2
--- /dev/null
+++ b/products/cache/src/content/reference/wildcard-matching.md
@@ -0,0 +1,39 @@
+---
+title: Wildcard matching
+order: 23
+pcx-content-type: navigation
+---
+
+# Wildcard matching and referencing
+
+You can use the asterisk (`*`) in any URL segment to match certain patterns. For example,
+example.com/t*st would match:
+
+- `example.com/test`
+- `example.com/toast`
+- `example.com/trust`
+
+`example.com/foo/* `does not match `example.com/foo` but `example.com/foo*` does match.
+
+## Helpful tips
+
+- To match both `http` and `https`, `write example.com`. Writing `*example.com` is unnecessary.
+- To match every page on a domain, write `example.com/*`. Writing `example.com` will not work.
+- To match every page on a domain and its subdomains, write `*example.com/*`. Writing `example.com` won’t work.
+- A wildcard (`*`) in a Page Rule URL will match even if no characters are present and may include any part of the URL, including the query string.
+
+## Referencing wildcard matches
+
+You can reference a matched wildcard later using the `$X` syntax, where `X` indicates the index of a glob pattern. As a result, `$1` represents the first wildcard match, `$2` represents the second wildcard match, and so on.
+
+The `$X` syntax is especially useful with the Forwarding URL setting. For example, you could forward `http://*.example.com/*` to `http://example.com/images/$1/$2.jpg`.
+
+This rule would match `http://cloud.example.com/flare.jpg` which ends up being forwarded to `http://example.com/images/cloud/flare.jpg`.
+
+To add a $ character in the forwarding URL, escape it by adding a backslash `\` in front like `\$`.
+
+<Aside type="warning" header="Warning">
+
+Avoid creating a redirect where the domain points to itself as the destination. A domain that points to itself can cause an [infinite redirect error](https://support.cloudflare.com/hc/articles/115000219871#h_af6598f6-bc1c-4a4d-ac5f-538230a704b7), which makes your site inaccessible to visitors.
+
+</Aside>
diff --git a/products/cache/wrangler.toml b/products/cache/wrangler.toml
new file mode 100644
index 00000000000..2cef36f96c9
--- /dev/null
+++ b/products/cache/wrangler.toml
@@ -0,0 +1,14 @@
+name = "cache"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/cache*"
+
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
diff --git a/products/client-ip-geolocation/README.md b/products/client-ip-geolocation/README.md
new file mode 100644
index 00000000000..83e3138b26b
--- /dev/null
+++ b/products/client-ip-geolocation/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Client IP Geolocation docs
+
+[View docs →](https://developers.cloudflare.com/client-ip-geolocation)
+
+[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
\ No newline at end of file
diff --git a/products/client-ip-geolocation/docs-config.js b/products/client-ip-geolocation/docs-config.js
new file mode 100644
index 00000000000..f71f745f7c3
--- /dev/null
+++ b/products/client-ip-geolocation/docs-config.js
@@ -0,0 +1,23 @@
+module.exports = {
+    product: "Client IP Geolocation",
+    pathPrefix: "/client-ip-geolocation",
+    productLogoPathD: "M25.1197 7.00014H24.6978C22.411 6.99091 20.1448 7.43218 18.0285 8.29876C15.9122 9.16535 13.9874 10.4403 12.3639 12.0507C10.7403 13.6612 9.44991 15.5757 8.56626 17.6849C8.49258 17.8607 8.42185 18.0377 8.35409 18.2156C9.19131 17.979 10.0739 17.8526 10.9842 17.8526C11.1134 17.8526 11.242 17.8551 11.37 17.8602C12.7891 15.0161 15.0867 12.7005 17.9265 11.2598C16.554 13.3624 15.5906 15.7051 15.0868 18.165H13.4231C15.1953 18.6284 16.7716 19.5843 17.9939 20.8775H23.2176V27.7625H20.6152C20.5844 28.6491 20.4187 29.5548 20.1743 30.4416H23.2176V38.8269C21.5149 38.1039 20.0047 36.2833 18.9101 33.7943C18.4468 34.7943 17.9246 35.779 17.3938 36.7053C17.564 36.9969 17.7416 37.2845 17.9265 37.5677C17.6601 37.4327 17.3984 37.2899 17.1418 37.1398C17.0197 37.3479 16.8975 37.5526 16.7759 37.7534C16.4272 38.329 16.0791 38.8788 15.7444 39.3915C16.4351 39.8011 17.1547 40.1633 17.8986 40.4749C20.0077 41.3586 22.2703 41.8181 24.5571 41.8274H25.1197C29.7381 41.8274 34.1673 39.9927 37.433 36.7271C40.6987 33.4614 42.5333 29.0321 42.5333 24.4138C42.5333 19.7954 40.6987 15.3662 37.433 12.1005C34.1673 8.83479 29.7381 7.00014 25.1197 7.00014ZM13.6135 27.7625C13.5822 26.3425 12.4167 25.2 10.9846 25.2C9.53297 25.2 8.3552 26.374 8.3552 27.821C8.3552 29.2679 9.53297 30.4419 10.9846 30.4419C11.0042 30.4419 11.0237 30.4417 11.0432 30.4413C11.1026 30.44 11.1615 30.4367 11.2198 30.4315C12.5612 30.3127 13.6137 29.1888 13.6137 27.821C13.6137 27.8015 13.6135 27.782 13.613 27.7625H13.6135ZM7.47399 21.414C7.47397 21.4141 7.47396 21.4142 7.47394 21.4143C5.3859 22.6205 3.98185 24.8721 4.00018 27.4661C4.00018 32.5987 11.0668 41.4717 11.0668 41.4717C11.0668 41.4717 17.9965 32.5987 17.9965 27.4661C17.9965 23.6166 14.8466 20.4769 10.9846 20.4769C10.8362 20.4769 10.6887 20.4815 10.5425 20.4906C9.4301 20.5595 8.3867 20.8869 7.47399 21.414ZM23.2176 18.1984H17.8596C18.891 14.1196 20.8802 11.012 23.2176 10.0341V18.1984ZM37.912 18.1984H34.4829C34.001 15.8857 33.1218 13.674 31.8842 11.6616C34.5084 13.1655 36.6113 15.4343 37.912 18.165V18.1984ZM25.8966 9.8399C28.4417 10.5833 30.5849 13.8584 31.7168 18.165H25.8966V9.8399ZM25.8966 20.844H32.2258C32.3853 22.0272 32.4658 23.2198 32.4669 24.4138C32.4677 25.5333 32.3984 26.6517 32.2593 27.7625H25.8966V20.844ZM25.8966 38.9876V30.4416H31.7771C30.7055 34.8753 28.4886 38.2308 25.8966 38.9876ZM31.8842 37.1994C33.1633 35.1225 34.0614 32.834 34.5364 30.4416H38.0259C36.7393 33.2834 34.5905 35.6478 31.8842 37.1994ZM34.9651 27.7625C35.0885 26.6506 35.1489 25.5325 35.1459 24.4138C35.1457 23.2208 35.0764 22.0289 34.9383 20.844H38.8631C39.4277 23.1132 39.4483 25.4838 38.9233 27.7625H34.9651Z",
+    contentRepo: "cloudflare/cloudflare-docs",
+    contentRepoFolder: "products/client-ip-geolocation",
+    externalLinks: [{
+        title: "Cloudflare home",
+        url: "https://www.cloudflare.com/"
+    }],
+    search: {
+        indexName: "",
+        apiKey: "",
+        algoliaOptions: { 'facetFilters': ''}
+    },
+    siteMetadata: {
+        title: "Cloudflare Client IP Geolocation docs",
+        description: "Cloudflare Client IP Geolocation helps you understand where in the world a given client is located, even if their true client IP address is obscured by our proxy systems.",
+        author: "@cloudflare",
+        url: "https://developers.cloudflare.com/client-ip-geolocation",
+        image: "https://www.cloudflare.com/img/cf-twitter-card.png",
+    },
+  }
\ No newline at end of file
diff --git a/products/client-ip-geolocation/package.json b/products/client-ip-geolocation/package.json
new file mode 100644
index 00000000000..ea02638c7ca
--- /dev/null
+++ b/products/client-ip-geolocation/package.json
@@ -0,0 +1,14 @@
+{
+  "private": true,
+  "dependencies": {
+    "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+  },
+  "scripts": {
+    "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+    "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+    "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+    "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+    "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+    "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+  }
+}
diff --git a/products/client-ip-geolocation/src/content/about/index.md b/products/client-ip-geolocation/src/content/about/index.md
new file mode 100644
index 00000000000..dae7435ad1c
--- /dev/null
+++ b/products/client-ip-geolocation/src/content/about/index.md
@@ -0,0 +1,48 @@
+---
+order: 1
+pcx-content-type: concept
+---
+
+# About
+
+<Aside type="note">
+
+Client IP Geolocation is currently in closed Beta testing.
+
+</Aside>
+
+Cloudflare Client IP Geolocation helps you understand where in the world a given client is located, even if their true client IP address is obscured by Cloudflare's proxy systems. We offer this service to ensure customers have high-quality experiences interacting with origins that rely on geolocation — such as mapping providers — and origin operators can deliver the right content to the right users. Ensuring origins know where clients are located avoids problems associated with traditional VPNs that obscure a consumer’s geolocation and allow circumvention of geographic restrictions on content.
+
+**Users cannot opt out of this geolocation support and Cloudflare will always make a best effort to convey geolocation.**
+
+## Simple explanation
+
+When Cloudflare connects to your origin over **IPv4**, we geolocate our VPN users to 1 of 1,000 egress locations (a `cell`). The list of cells is a super set of all the countries in the world and all US Designated Market Areas and includes multiple cells for large metropolitan areas. For all supported cell locations, download [our list](https://api.cloudflare.com/local-ip-ranges.csv).
+
+When Cloudflare connects to your origin over **IPv6**, we geolocate our VPN users to one of thousands of locations distributed across the globe.
+
+If a VPN user tries to use an interposed VPN or proxy system that attempts to hide their location, we share that information with downstream entities.
+
+## Technical explanation
+
+We map our egress IP addresses for our forward-proxy offerings to specific geolocations and continuously share this information with major geolocation database providers like *MaxMind*, *IP 2 Location*, and *Neustar*. 
+
+When Cloudflare receives an inbound request from a WARP or 1.1.1.1 user, we first geolocate the IP address that made the connection to Cloudflare. Then, we select an egress IP that maps to the client geolocation. We then discard Client IP information to preserve user privacy but return their true geographic location. 
+
+If the Client IP is a known proxy or VPN service without strong commitments to preserving client location, we return an unmapped/unknown location.
+
+Because our cell list includes Designated Market Areas in the United States, you can use the returned geolocation information — or lack of it — to enforce content restrictions when delivering linear or on-demand video content subject to common licensing requirements.
+
+## Example scenario
+
+Jane is a Cloudflare WARP user in Glendive, Montana, USA. She is interested in the privacy benefits of using a VPN. Her client IP address is `108.59.112.0`, which is owned by [Mid-Rivers Telephone Cooperative](https://bgp.he.net/AS11961) and geolocates to 47.0984,-104.7275 (with a location accuracy of 50km using MaxMind’s GeoIP service).
+
+![Cloudflare reports accurate location information, even over VPN](../static/client-ip-geolocation-example.png)
+
+Jane connects to Cloudflare’s edge using a secure tunnel. Cloudflare operates an anycast network and dictates VPN ingress by anycast. Jane’s VPN traffic lands in the Cloudflare Minneapolis data center, [930km from Glendive](http://www.gcmap.com/mapui?P=GDV-MSP).
+
+A naive geolocation implementation would provide unacceptably inaccurate information. It would have Jane geolocated to Minneapolis, which is in a totally different state — Minnesota instead of Montana — and Designated Marketing Area — Glendive, MT, the [country’s smallest DMA](https://mediatracks.com/resources/nielsen-dma-rankings-2020/), instead of Minneapolis, MN — from her true location. From a content distribution perspective, this level of geolocation is **not acceptable**.
+
+Instead, Cloudflare uses its [own geolocation mapping](#how-it-works-detailed) to provide much more accurate information. Cloudflare’s edge would geolocate Jane’s client IP (`108.59.112.0`) to Glendive and select an egress IP address of `a.b.c.d` from its list of available egress IP addresses based on this geolocation result.
+
+Jane attempts to watch live television via an over-the-top (OTT) video provider. The video provider’s origin sees a connection from `a.b.c.d`. A geolocation lookup on `a.b.c.d` returns Glendale, MT, and Jane is able to access the linear video content because the OTT provider is able to geolocate the VPN traffic to the true client location.
\ No newline at end of file
diff --git a/products/client-ip-geolocation/src/content/faq/index.md b/products/client-ip-geolocation/src/content/faq/index.md
new file mode 100644
index 00000000000..04c6dcdd69d
--- /dev/null
+++ b/products/client-ip-geolocation/src/content/faq/index.md
@@ -0,0 +1,54 @@
+---
+order: 3
+pcx-content-type: faq
+---
+
+# FAQ
+
+<Aside type="note">
+
+Client IP Geolocation is currently in closed Beta testing.
+
+</Aside>
+
+## Website operators
+
+### What does this functionality mean for me as a website operator? 
+
+If you operate a website or ISP that needs to use IP address geolocation information for geographic content restriction, consider allowing IP addresses associated with a VPN. 
+
+You can now restrict content delivery to Cloudflare VPN users using the same client IP geolocation mechanisms used for non-VPN users. 
+
+### How does the above scenario change if I use Cloudflare to secure my infrastructure?
+There is significant cross pollination between Cloudflare forward- and reverse-proxy services. When a user connects through Cloudflare proxies to origin infrastructure protected by Cloudflare security tools, our origin-facing tools automatically consume information from our user-facing systems about client geography, IP reputation, and other client metadata. This process happens in a privacy-preserving manner that reduces unnecessary collection of personally identifiable information while ensuring customers can maintain their desired security posture.
+
+Cloudflare firewall rules specifying country- or region-level match criteria will match correctly on users passing through our VPN and forward-proxy systems with no action needed from you.
+
+### In the example, what happens when Cloudflare’s Minneapolis data center is removed from service for maintenance?
+
+The [example scenario](/about#example-scenario) still provides accurate geolocation data.
+
+Geography-specific egress IPs are not tightly coupled to physical Cloudflare network locations. We continue using geography-specific egress IPs even if the geographically closest network location or locations are rerouted.
+
+### What happens when a user nests or chains VPNs and connects to Cloudflare through a downstream proxy service?
+Cloudflare will make best efforts to identify such circumstances and communicate this information upstream to origins. Client IPs will geolocate as `unknown` when the entity that made the initial connection to Cloudflare appears to have originated from an open-proxy service or we are unsure of the location of the user.
+
+### I want greater geographic detail on egress locations. Can you provide it?
+
+Yes! We can provide much finer granularity for origins reachable over IPv6. We encourage adoption of IPv6 for the good of the Internet, as well as for providing much finer detail on user locations to origin operators.
+
+### What incentives does Cloudflare have to ensure location information is accurate?
+
+Cloudflare wants those using our consumer VPN and corporate forward-proxy services to have as smooth an experience as possible. We want our users to have uninterrupted browsing experiences. At the same time, we also want to give origin operators the information they need to distribute the right content to the right users at the right times.
+
+## Cloudflare VPN users
+
+### What does this mean for me as a Cloudflare VPN user?
+
+If you use [Cloudflare WARP](https://developers.cloudflare.com/warp-client/) or [1.1.1.1](https://developers.cloudflare.com/1.1.1.1/), geolocation improves your user experience. Because we communicate your geographic location accurately (but still in a non-identifiable way), you should have accurate, geography-specific experiences and uninterrupted access to the content you are licensed to consume in your local geography.
+
+We also maintain all of our [privacy commitments](https://www.cloudflare.com/trust-hub/privacy-and-data-protection/) regarding your use of our consumer application and will keep your Internet browsing private and secure. 
+
+### What if I am a user and want to spoof my location?
+
+Cloudflare does not permit or support the spoofing of location and will never offer such functionality in the future.
diff --git a/products/client-ip-geolocation/src/content/get-started/index.md b/products/client-ip-geolocation/src/content/get-started/index.md
new file mode 100644
index 00000000000..41cd23973f6
--- /dev/null
+++ b/products/client-ip-geolocation/src/content/get-started/index.md
@@ -0,0 +1,22 @@
+---
+order: 2
+pcx-content-type: how-to
+---
+
+# Get started
+
+<Aside type="note">
+
+Client IP Geolocation is currently in closed Beta testing.
+
+</Aside>
+
+There are several things you can do to best handle traffic from Cloudflare VPN and forward-proxy users:
+
+- **Origin operators**:
+    - Do not block IP addresses associated with our VPN and proxy products (see the [About section](/about) for more details)
+    - To get even more accurate geolocation data, ensure your origin is [reachable via IPv6](/faq)
+- **Geolocation data providers**:
+    - Regularly pull updated geolocation data from the [Cloudflare API](https://api.cloudflare.com/local-ip-ranges.csv)
+- **Users of WARP and 1.1.1.1**:
+    - Review the [FAQs](/faq#cloudflare-vpn-users) and [About section](/about) to learn exactly how, how much, and why we share geolocation data
diff --git a/products/client-ip-geolocation/src/content/index.md b/products/client-ip-geolocation/src/content/index.md
new file mode 100644
index 00000000000..f462f72cb8e
--- /dev/null
+++ b/products/client-ip-geolocation/src/content/index.md
@@ -0,0 +1,29 @@
+---
+order: 0
+title: Overview
+pcx-content-type: landing-page
+---
+
+# Client IP Geolocation
+
+<Aside type="note">
+
+Client IP Geolocation is currently in closed Beta testing.
+
+</Aside>
+
+Cloudflare designed [Cloudflare WARP](https://developers.cloudflare.com/warp-client/) and [1.1.1.1](https://developers.cloudflare.com/1.1.1.1/) to make Internet browsing more private and secure. These applications encrypt last-mile connections and make it more difficult for others to use client IP addresses in user fingerprinting. 
+
+However, unlike legacy VPN applications, we never designed WARP or 1.1.1.1 to hide user locations or allow users to misrepresent their true geographic location. As a web property operator, you can use **Client IP Geolocation** to map Cloudflare egress IP addresses to specific geolocations.
+
+<ButtonGroup>
+  <Button type="primary" href="/get-started">Get started</Button>
+  <Button type="secondary" href="/about">Learn more</Button>
+</ButtonGroup>
+
+
+<Aside type="note">
+
+Client IP Geolocation is different from the <strong>Cloudflare IP Geolocation</strong> setting in the <strong>Network</strong> app. For more details about Cloudflare IP Geolocation — which helps you capture country codes for visitors — see <a href="https://support.cloudflare.com/hc/articles/200168236">our Support documentation</a>.
+
+</Aside>
\ No newline at end of file
diff --git a/products/client-ip-geolocation/src/content/static/client-ip-geolocation-example.png b/products/client-ip-geolocation/src/content/static/client-ip-geolocation-example.png
new file mode 100644
index 00000000000..65e86392add
Binary files /dev/null and b/products/client-ip-geolocation/src/content/static/client-ip-geolocation-example.png differ
diff --git a/products/client-ip-geolocation/wrangler.toml b/products/client-ip-geolocation/wrangler.toml
new file mode 100644
index 00000000000..c7eee76d215
--- /dev/null
+++ b/products/client-ip-geolocation/wrangler.toml
@@ -0,0 +1,14 @@
+name = "client-ip-geolocation"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/client-ip-geolocation*"
+
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
diff --git a/products/cloudflare-one/docs-config.js b/products/cloudflare-one/docs-config.js
index fa1c1f51fe1..f514ed55762 100644
--- a/products/cloudflare-one/docs-config.js
+++ b/products/cloudflare-one/docs-config.js
@@ -28,6 +28,6 @@ module.exports = {
     description: "Cloudflare One™ is the culmination of engineering and technical development guided by conversations with thousands of customers about the future of the corporate network. It provides secure, fast, reliable, cost-effective network services, integrated with leading identity management and endpoint security providers. These docs contain step-by-step, use case driven, tutorials to use Cloudflare One products.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/cloudflare-one",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/cloudflare-one/src/content/analytics/access.md b/products/cloudflare-one/src/content/analytics/access.md
index 11f95ae4844..e3f9002cf12 100644
--- a/products/cloudflare-one/src/content/analytics/access.md
+++ b/products/cloudflare-one/src/content/analytics/access.md
@@ -1,21 +1,65 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
+ 
+# Shadow IT Discovery
+ 
+The Teams Shadow IT Discovery page gives you visibility over which SaaS applications your end users are visiting. This information enables you to create the appropriate Zero Trust or Secure Web Gateway policies in Cloudflare for Teams, so that you can have control over the security of your users and data.
 
-# Access overview 
+On the Shadow IT Discovery page, you can gather information on the [application status](#application-status) and [application type](#application-type) of the applications visited by your users. You can also change an application's status according to your organization's preferences. The page also gives you an overview of metrics such as who your top connected users are, how many applications have been accessed, or how many application logins have failed over a certain period of time.
+ 
+Shadow IT Discovery can be found under **Analytics > Access**.
 
-You can use the Overview page to see how many applications have been accessed, how many logins have failed, and how many users are currently connected to your applications.
+![Shadow IT Discovery](../static/documentation/shadow-it-discovery.png)
 
-In the top-right corner, specify the time period you are interested in looking into. 
+## Shadow IT view
+ 
+To see an in-depth breakdown of SaaS applications your users have visited, click on **Review all** in the **Shadow IT Discovery** chart. From this page, you can search for a specific application, or you can click **View** to see a full profile for that application.
 
-![Overview analytics](../static/documentation/logs/access-dash-overview-page.png)
+![Shadow IT view](../static/documentation/shadow-it-view.png)
 
-## Top applications accessed
+* **Application**. This field shows each SaaS application's name and logo.
+* **Application type**. This field shows the [application type](/policies/filtering/http-policies/application-app-types#app-types) Teams has assigned to each application.
+* **Application status**. This field shows an [application's status](#application-status).
+* **Secured**. This field shows whether the application is currently secured behind Access.
+* **Users**. This field shows how many users have connected to the application over the period of time you have specified in the Shadow IT Discovery overview page. 
 
-See which applications were the most accessed in the time period you've specified. By clicking **View all**, the Overview will show you a list of all applications accessed in that time period.
+## Application status
+ 
+Within Shadow IT Discovery, applications are labeled according to their status. Your organization can determine the status of each application, and decide to change it at any point in time. This is a list of possible values for the status field:
+ 
+<TableWrap>
 
-![Top accessed apps](../static/documentation/logs/top-accessed-apps.png)
+| Status | Description |
+| -------- | --------------- |
+| **Approved** | Applications that have been marked as sanctioned by your organization. |
+| **Unapproved** | Applications that have been marked as unsanctioned by your organization. |
+| **In review** | Applications in the process of being reviewed by your organization. |
+| **Unreviewed** | Unknown applications that are neither sanctioned nor being reviewed by your organization at this time. |
+ 
+</TableWrap>
 
-## Top connected users
+### Change an application's status
 
-See which users logged in most frequently. By clicking **View all**, the Overview will show you a list of all users who have authenticated in your time period of choice.
\ No newline at end of file
+You may need to update an application's status based on your organization's preferences. To change an application's status:
+
+1. From the **Application profile** view, click the status button under the application name.
+
+    ![Shadow IT application status](../static/documentation/shadow-it-app-profile.png)
+
+1. Select the status you want to assign to your application.
+
+The application's status will now be updated across charts and visualizations within Shadow IT Discovery. 
+
+### Change the status for multiple applications
+
+To change the status of multiple applications to Approved, Unapproved, In review or Unreviewed at the same time:
+
+1. From the **Shadow IT view**, select the checkboxes of all applications for which you would like to change the status.
+
+1. Click **Update Status**.
+
+1. Select the status you want to assign to your applications.
+
+Each application's status will now be updated across charts and visualizations within Shadow IT Discovery. 
diff --git a/products/cloudflare-one/src/content/analytics/gateway.md b/products/cloudflare-one/src/content/analytics/gateway.md
index e6baf358688..ae7154a08cb 100644
--- a/products/cloudflare-one/src/content/analytics/gateway.md
+++ b/products/cloudflare-one/src/content/analytics/gateway.md
@@ -1,10 +1,11 @@
 ---
-order: 1
+order: 2
+pcx-content-type: concept
 ---
 
-# Gateway overview 
+# Gateway 
 
-You can use the Overview page to see the top allowed and blocked requests across all of your locations. You can filter the data by selecting a specific location and/or a time.
+Use the Gateway Overview page to see the top allowed and blocked requests across all of your locations. You can filter the data by selecting a specific location and/or time.
 
 ![Overview analytics](../static/documentation/logs/gateway-dash-overview-page.png)
 
@@ -27,4 +28,4 @@ You can view most seen allowed and blocked requests across your locations.
 ## View top allowed and blocked categories
 
 You can view the top allowed and blocked categories across your locations.
-![Overview filter by time](../static/documentation/logs/gateway-dash-top-categories.png)
\ No newline at end of file
+![Overview filter by time](../static/documentation/logs/gateway-dash-top-categories.png)
diff --git a/products/cloudflare-one/src/content/analytics/index.md b/products/cloudflare-one/src/content/analytics/index.md
index 4a9b5bfa5be..be6ea0547e0 100644
--- a/products/cloudflare-one/src/content/analytics/index.md
+++ b/products/cloudflare-one/src/content/analytics/index.md
@@ -1,9 +1,10 @@
 ---
 order: 7
+pcx-content-type: navigation
 ---
 
 # Analytics
 
 Cloudflare for Teams gives you comprehensive and in-depth visibility into your network. Whether you need data on network usage, on security threats blocked by Teams, or on how many users have logged into your applications this month, the Teams dashboard provides you with the right tools for the job.
 
-<DirectoryListing path="/analytics"/>
\ No newline at end of file
+<DirectoryListing path="/analytics"/>
diff --git a/products/cloudflare-one/src/content/analytics/logs/activity-log.md b/products/cloudflare-one/src/content/analytics/logs/activity-log.md
index 38c10a41820..615848147bd 100644
--- a/products/cloudflare-one/src/content/analytics/logs/activity-log.md
+++ b/products/cloudflare-one/src/content/analytics/logs/activity-log.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Activity logs
@@ -59,4 +60,34 @@ When you click on the row, you can see information related to the identity that
 | **HTTP version** | The HTTP version of the origin that Gateway connected to on behalf of the user. |
 | **Policy details** | The policy corresponding to the decision Gateway made based on the traffic criteria of the request. |
 
-</TableWrap>
\ No newline at end of file
+</TableWrap>
+
+### Isolate requests
+
+When a user creates a policy to isolate traffic, the initial request that triggers isolation will be logged as an `Isolate` decision and the `is_isolated` field will return `false`. This is because that initial request is not isolated yet — but it initiates an isolated session.
+
+Since the request is generated in an isolated browser, the result is rendered in the isolated browser and rendered back to the user securely. This request and all subsequent requests in the isolated browser are logged to include the terminal Gateway action that gets applied (e.g. Allow / Block) and the `is_isolated` field as `true`. 
+
+## Cloudflare logpush integration
+
+<Aside>
+
+This feature is only available on the Teams Enterprise plan.
+
+</Aside>
+
+You can configure the automatic export of logs from Cloudflare Gateway to third-party storage destinations or to security information and event management (SIEM) tools. Once exported, your team can analyze and audit the data as needed. This feature builds on Cloudflare's Logpush Service. To enable this feature on the Teams dashboard:
+
+1. Navigate to **Logs > Logpush**.
+1. Click **Connect a service**.
+1. Enter a **Job name**.
+1. From the drop-down menu, choose whether to export the *Gateway DNS* or the *Gateway HTTP* dataset.
+1. Next, select the data fields you want to export.
+1. In the **Advanced settings** card, choose the timestamp format you prefer, and whether you want to enable logs sampling.
+1. Click **Next**.
+1. Select the service you want to export your Gateway logs to. 
+1. Next, follow the service-specific instructions on the Teams UI to validate your destination.
+
+The setup of your logpush integration is now complete. Logpush will send updated logs every five minutes to your selected destination. 
+
+You can configure multiple destinations and monitor for any issues by returning to the Logpush page.
diff --git a/products/cloudflare-one/src/content/analytics/logs/audit-logs.md b/products/cloudflare-one/src/content/analytics/logs/audit-logs.md
index 0d30024756e..628999a574f 100644
--- a/products/cloudflare-one/src/content/analytics/logs/audit-logs.md
+++ b/products/cloudflare-one/src/content/analytics/logs/audit-logs.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: reference
 ---
 
 # Access Audit logs
@@ -108,7 +109,7 @@ Enterprise customers have access to detailed logs of HTTP requests, on their Clo
 
 Once a member of your team authenticates to reach a resource behind Access, Cloudflare generates a token for that user that contains their SSO identity. The token is structured as a [JSON Web Token (JWT)](/glossary#json-web-token). Cloudflare relies on an RSA Signature with SHA-256, or RS256, an asymmetric algorithm, to perform that signature. Cloudflare also makes the public key available, so that you can validate their authenticity, as well.
 
-When a user requests a given URL, Access appends the user identity from that token as a request header, which we then log as the request passes through our network. Your team can collect these logs in your preferred third-party Security information and event management (SIEM) software or storage destination by using the [Cloudflare Logpush](https://developers.cloudflare.com/logs/logpush) platform.
+When a user requests a given URL, Access appends the user identity from that token as a request header, which we then log as the request passes through our network. Your team can collect these logs in your preferred third-party Security information and event management (SIEM) software or storage destination by using the [Cloudflare Logpush](https://developers.cloudflare.com/logs/about) platform.
 
 Cloudflare Logpush can be used to gather and send specific request headers from the requests made to sites behind Access. Once enabled, you can then configure the destination where Cloudflare should send these logs. When enabled with the Access user identity field, the logs will export to your systems as JSON similar to the logs below.
 
diff --git a/products/cloudflare-one/src/content/analytics/logs/index.md b/products/cloudflare-one/src/content/analytics/logs/index.md
index db03a54b2a2..5233ad38cd5 100644
--- a/products/cloudflare-one/src/content/analytics/logs/index.md
+++ b/products/cloudflare-one/src/content/analytics/logs/index.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: navigation
 ---
 
 # Teams logs
diff --git a/products/cloudflare-one/src/content/analytics/logs/tunnel-audit-logs.md b/products/cloudflare-one/src/content/analytics/logs/tunnel-audit-logs.md
index 18a23e31d76..6230db9faa2 100644
--- a/products/cloudflare-one/src/content/analytics/logs/tunnel-audit-logs.md
+++ b/products/cloudflare-one/src/content/analytics/logs/tunnel-audit-logs.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: reference
 ---
 
 # Tunnel Audit logs
diff --git a/products/cloudflare-one/src/content/analytics/logs/users.md b/products/cloudflare-one/src/content/analytics/logs/users.md
deleted file mode 100644
index e00522efe57..00000000000
--- a/products/cloudflare-one/src/content/analytics/logs/users.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-order: 3
----
-
-# User logs
-
-Teams allows you to consult a comprehensive list of users who have authenticated to Teams. For each user that logged in, you can see their name, their email address, and whether they’re actively utilizing a seat in both Access and Gateway. 
-
-![User list](../../static/documentation/logs/user-list.png)
-
-
-## Revoke user sessions
-
-Clicking **Revoke** will terminate all currently active sessions for that user, and revoke access to all their connected devices. If you want to prevent this user from logging in again, you need to manually remove this user from any existing policies that grant them access to your applications. 
-
-## View user details
-
-Clicking **View** for any given user will show you details for that user, such as:
-
-* Their user details
- ![User details](../../static/documentation/logs/user-summary.png)
-* Devices they have connected to Teams
-* Their recent logins
-
-Click **View all activity** to see a full list of the user’s login events.
-
-## Workplace records
-
-Wokplace records show the amount of unique sessions the user has initiated from a given country in the current billing period. To view workplace records:
-
-1. In the Users page, locate the user whose workplace records you want to see.
-1. Click **View**.
-1. In the **User details** section, under the **Most recent location** field, click on the View all button. 
-
- ![Workplace records](../../static/documentation/logs/workplace-records.png)
-
-To change the granularity with which workplace records are shown, adjust your [global session duration](/identity/users/session-management#global-session-duration). An informative threshold can be **24 hours**. 
diff --git a/products/cloudflare-one/src/content/analytics/users.md b/products/cloudflare-one/src/content/analytics/users.md
index 473d918ba07..b0e8aee46d8 100644
--- a/products/cloudflare-one/src/content/analytics/users.md
+++ b/products/cloudflare-one/src/content/analytics/users.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # User logs
diff --git a/products/cloudflare-one/src/content/api-terraform/access-with-terraform.md b/products/cloudflare-one/src/content/api-terraform/access-with-terraform.md
index e9dd6617704..290c4c8549f 100644
--- a/products/cloudflare-one/src/content/api-terraform/access-with-terraform.md
+++ b/products/cloudflare-one/src/content/api-terraform/access-with-terraform.md
@@ -1,12 +1,14 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Terraform
 
 | Requirements |
 | ------------ |
-| [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) installed on your machine. |
+| [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) installed on your machine |
+| The [Cloudflare provider](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) properly configured |
 
 [Terraform](https://learn.hashicorp.com/terraform/getting-started/install.html) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building [Cloudflare resources](https://www.terraform.io/docs/providers/cloudflare/). Listed below are examples to help you get started with building Access with Terraform. For a more generalized guide on configuring Cloudflare and Terraform, visit our [Getting Started with Terraform and Cloudflare](https://blog.cloudflare.com/getting-started-with-terraform-and-cloudflare-part-1/) blog post.
 
@@ -17,8 +19,6 @@ order: 3
  Here is an example configuration:
 
 ```
-provider "cloudflare" {}
-
 variable "domain" {
   default = "example.com"
 }
diff --git a/products/cloudflare-one/src/content/api-terraform/index.md b/products/cloudflare-one/src/content/api-terraform/index.md
index 2f05699cd1b..e530ad086e7 100644
--- a/products/cloudflare-one/src/content/api-terraform/index.md
+++ b/products/cloudflare-one/src/content/api-terraform/index.md
@@ -1,5 +1,6 @@
 ---
 order: 7
+pcx-content-type: navigation
 ---
 
 # API and Terraform
diff --git a/products/cloudflare-one/src/content/api-terraform/rule-api-examples.md b/products/cloudflare-one/src/content/api-terraform/rule-api-examples.md
index afff445d00f..4babc933d12 100644
--- a/products/cloudflare-one/src/content/api-terraform/rule-api-examples.md
+++ b/products/cloudflare-one/src/content/api-terraform/rule-api-examples.md
@@ -1,6 +1,7 @@
 ---
 type: overview
 order: 3
+pcx-content-type: configuration
 ---
 
 # Access API examples
diff --git a/products/cloudflare-one/src/content/api-terraform/scoped-api-tokens.md b/products/cloudflare-one/src/content/api-terraform/scoped-api-tokens.md
index 932fbe7280d..6dd72c47596 100644
--- a/products/cloudflare-one/src/content/api-terraform/scoped-api-tokens.md
+++ b/products/cloudflare-one/src/content/api-terraform/scoped-api-tokens.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Scoped API tokens
diff --git a/products/cloudflare-one/src/content/applications/app-launcher.md b/products/cloudflare-one/src/content/applications/app-launcher.md
index 1549997d36d..ce53fbd2549 100644
--- a/products/cloudflare-one/src/content/applications/app-launcher.md
+++ b/products/cloudflare-one/src/content/applications/app-launcher.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: how-to
 ---
 
 # App Launcher
@@ -22,12 +23,12 @@ The App Launcher policy defines which users can access the portal. It does not i
 
 To enable the App Launcher:
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Configuration > Authentication**.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Settings > Authentication**.
 
-1. Select the **App Launcher** tab.
+1. Under the **App Launcher** card, click **Manage**.
 
-1. In the **Configure a rule** dialog, select a rule type from the *Include* drop-down list and then fill in the rule criteria on the right.
+1. Build a rule to define who should access the App Launcher.
 
 1. Click **Save**.
 
-The App Launcher is now configured. To edit it, navigate to **Configuration > Authentication**, and click **Edit Access App Launcher**.
+The App Launcher is now configured. You can always edit your App Launcher rules by navigating to **Settings > Authentication**, and clicking **Manage**.
diff --git a/products/cloudflare-one/src/content/applications/configure-apps/app-paths.md b/products/cloudflare-one/src/content/applications/configure-apps/app-paths.md
deleted file mode 100644
index 06594280a23..00000000000
--- a/products/cloudflare-one/src/content/applications/configure-apps/app-paths.md
+++ /dev/null
@@ -1,86 +0,0 @@
----
-order: 4
----
-
-# Application paths
-
-Teams allows you to create unique rules for parts of an application that share a root path. Imagine an example application is deployed at `dashboard.com/eng` that anyone on the engineering team should be able to access. However, a tool deployed at `dashboard.com/eng/exec` should only be accessed by the executive team. 
-
-When multiple rules are set for a common root path, its subdomains do not inherit rules. For example, when setting rules for `dashboard.com/eng` and `dashboard.com/eng/exec` separately, `dashboard.com/eng/exec` does not inherit the rule set for `dashboard.com/eng`. Instead, the more specific rule takes precedence.
-
-In the Teams dashboard, when adding a [self-hosted web application](/applications/configure-apps/self-hosted-apps), you can choose to protect the entire website by entering its apex domain, or alternatively, you can specify any subdomains and paths in the dedicated fields.
-
-![Application domain](../../static/documentation/applications/path-subdomain.png)
-
-<Aside>
-
-Teams does not support port numbers in the URL. Requests to URLs with port numbers are redirected to the URL and the port numbers stripped.
-</Aside>
-
-## Using wildcards in subdomains and paths
-
-When you create an application for a specific subdomain or path, you can use asterisks (`*`) as wildcards. Wildcards allow you to extend the application you're creating to all the subdomains or paths of a given apex domain.
-
-This is how to use wildcards effectively:
-
-### Protect all subdomains of an apex domain
-
-Using a wildcard in the *subdomain* field **does not cover the apex domain**.
-
-<TableWrap>
-
-| Wildcard | Covers | Doesn't cover |
-| -------- | ------ | ------------- |
-| `*.example.com` | `alpha.example.com`, `beta.example.com` | `example.com` |
-
-</TableWrap>
-
-### Protect all paths of an apex domain
-
-Using a wildcard in the *path* field **does not cover the apex domain**.
-
-<TableWrap>
-
-| Wildcard | Covers | Doesn't cover |
-| -------- | ------ | ------------- |
-| `example.com/*` | `example.com/alpha`, `example.com/beta` | `example.com`,`alpha.example.com` |
-
-</TableWrap>
-
-### Protect multi-level subdomains
-
-Using a wildcard in the *subdomain* field to protect multi-level subdomains **does not cover that subdomain's top subdomain nor the apex domain**. 
-
-<TableWrap>
-
-| Wildcard | Covers | Doesn't cover |
-| -------- | ------ | ------------- |
-| `*.test.example.com` | `alpha.test.example.com`, `beta.test.example.com` | `example.com`, `test.example.com` |
-
-</TableWrap>
-
-### Protect multi-level paths
-
-Using a wildcard in the *path* field to protect multi-level paths **does not cover that subpath's parent path nor the apex domain**. 
-
-<TableWrap>
-
-| Wildcard | Covers | Doesn't cover |
-| -------- | ------ | ------------- |
-| `example.com/alpha/*` | `example.com/alpha/one`, `example.com/alpha/two` | `example.com`, `example.com/beta` |
-
-</TableWrap>
-
-<Aside type='warning' header='Important'>
-
-You cannot use wildcards to partially match subdomain and path names. Using asterisks in any way other than the ones outlined above **will cause the wildcard to be invalidated**. This means your application won't be effective, and neither will be any rules you may try to enforce on it at a later time.
-
-| Wildcard | Does NOT cover |
-| -------- | ------ | 
-| `example.com/cat-.*` | `example.com/cat`, `example.com/cat-food` |
-| `*ing.example.com` | `ing.example.com`, `engineering.example.com`|
-
-</Aside>
-
-
-
diff --git a/products/cloudflare-one/src/content/applications/configure-apps/index.md b/products/cloudflare-one/src/content/applications/configure-apps/index.md
index d3e5feed6c9..c9cd9a1c196 100644
--- a/products/cloudflare-one/src/content/applications/configure-apps/index.md
+++ b/products/cloudflare-one/src/content/applications/configure-apps/index.md
@@ -1,11 +1,12 @@
 ---
 order: 0
+pcx-content-type: navigation
 ---
 
 
-# Web applications
+# Add web applications
 
-You can protect two types of web applications: SaaS and self-hosted.
+With Teams, you can protect two types of web applications: SaaS and self-hosted.
 
 **SaaS applications** consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration.
 
diff --git a/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md b/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md
index 77fd9b67928..ca40c6712c8 100644
--- a/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md
+++ b/products/cloudflare-one/src/content/applications/configure-apps/saas-apps.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # SaaS applications
@@ -11,36 +12,40 @@ Cloudflare Access allows you to integrate your SaaS products by acting as an ide
 ### 1. Add your application
 
 1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Access > Applications**.
-2. Click **Add an application**.
-3. Select **SaaS**.
 
-![Access Saas and Self-Hosted](../../static/documentation/applications/add-saas-application.png)
+1. Click **Add an application**.
 
-4. In the **Configure app** section, select an application from the Application drop-down menu. If your application is not listed, type its name in the textbox and select it.
+1. Select **SaaS**.
 
-![Unlisted SaaS app](../../static/documentation/applications/new-saas-app.png)
+ ![Access Saas and Self-Hosted](../../static/documentation/applications/add-saas-application.png)
 
-5. In the **Entity ID** field, provide the unique identifier of your SaaS application.
+1. In the **Configure app** section, select an application from the Application drop-down menu. If your application is not listed, type its name in the textbox and select it.
+
+1. In the **Entity ID** field, provide the unique identifier of your SaaS application.
 SaaS applications store this information in different ways.
 
-6. In the **Assertion Consumer Service URL** field, input the service provider’s endpoint for receiving and parsing SAML assertions.
+1. In the **Assertion Consumer Service URL** field, input the service provider’s endpoint for receiving and parsing SAML assertions.
+
+1. If your SaaS application requires additional SAML statements, add the mapping of your IdP’s attributes you would like to include in the SAML statement sent to the SaaS application.
+
+  ![Custom SaaS statements](../../static/documentation/applications/custom-saas-statements.png)
 
-7. Scroll down to the **Application logo** card to choose a logo that will represent the application in the App Launcher and in the Applications page.
-You can either:
-  * Select **Default** if you want to show the SaaS application’s logo.
-  * Select **Custom** if you want to assign a custom logo to the application.
+
+1. Scroll down to the **Application logo** card to choose a logo that will represent the application in the App Launcher and in the Applications page.
 
   <Aside>
+  
   If you're having issues specifying a custom logo, check that the image is served from an HTTPS endpoint. For example, <code>http://www.example.com/upload/logo.png</code> will not work. However, <code>https://www.example.com/upload/logo.png</code> will.
+
   </Aside>
 
-![SaaS logo](../../static/documentation/applications/saas-logo.png)
+1. Next, scroll down to the **Identity Providers** card to select the identity providers you want to enable for your app.
 
-8. Next, scroll down to the **Identity Providers** card to select the identity providers you want to enable for your app.
+  ![Setup SaaS IdPs](../../static/documentation/applications/saas-idp.png)
 
- ![Setup SaaS IdPs](../../static/documentation/applications/saas-idp.png)
+1. Turn on **Instant Auth** if you are selecting only one login method for your application, and would like your end users to skip the identity provider selection step.
 
-9. Click **Next**.
+1. Click **Next**.
 
 ### 2. Add a policy
 You can now configure a policy to control who can access your app.
@@ -48,9 +53,9 @@ You can now configure a policy to control who can access your app.
 To learn more about how policies work, read our [Policies](/policies/).
 
 1. First, specify a name for your rule. This is a mandatory field.
-2. Specify a policy action.
-3. Specify one or more rules in the **Configure a rule** box. You can add as many include, exception, or require statements as needed.
-4. Click **Next** to add your application to Access.
+1. Specify a policy action.
+1. Specify one or more rules in the **Configure a rule** box. You can add as many include, exception, or require statements as needed.
+1. Click **Next** to add your application to Access.
 
 ### 3. Integrate your SaaS application with Access
 
@@ -64,4 +69,4 @@ Before you begin using your application through Access, your last step is to int
 
  ![Setup SaaS IdPs](../../static/documentation/applications/saas-integrate.png)
 
-4. Click **Done** to see your application listed on your Applications tab.
\ No newline at end of file
+1. Click **Done** to see your application listed on your Applications tab.
diff --git a/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md b/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md
index d19aefc1c5d..afdc27b7a9c 100644
--- a/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md
+++ b/products/cloudflare-one/src/content/applications/configure-apps/self-hosted-apps.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Self-hosted applications
@@ -17,11 +18,11 @@ Cloudflare Access allows you to securely publish internal tools and applications
 
 ![Self-hosted applications diagram](../../static/documentation/applications/network-diagram.png)
 
-Make sure you create [Zero Trust policies](/policies/zero-trust) before connecting your application to Cloudflare. To [connect your origin](/connections/connect-apps) to Cloudflare, you can use Argo Tunnel. If you do not wish to use Argo Tunnel, you must [validate the token](/identity/users/validating-json/) issued by Cloudflare on your origin.
+Make sure you create [Zero Trust policies](/policies/zero-trust) before connecting your application to Cloudflare. To [connect your origin](/connections/connect-apps) to Cloudflare, you can use [Cloudflare Tunnel](/glossary#cloudflare-tunnel). If you do not wish to use Cloudflare Tunnel, you must [validate the token](/identity/users/validating-json/) issued by Cloudflare on your origin.
 
 ### 1. Add your application
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to the **Applications** tab.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Access > Applications**.
 
 1. Click **Add an application**.
 
@@ -42,7 +43,7 @@ Make sure you create [Zero Trust policies](/policies/zero-trust) before connecti
 1. From the drop-down menu under **Application domain**, select a hostname that will represent the application. The hostname must be an active zone in your Cloudflare account.
 
   <Aside>
-  When specifying an application domain, you can use wildcards to protect multiple parts of an application that share a root path. For more information on how to use wildcards, see the instructions in the <a href="/applications/configure-apps/app-paths#using-wildcards-in-subdomains-and-paths">Application paths</a> page.
+  When specifying an application domain, you can use wildcards to protect multiple parts of an application that share a root path. For more information on how to use wildcards, see the instructions in the <a href="/policies/zero-trust/app-paths">Application paths</a> page.
   </Aside>
 
 1. Scroll down to the **Application logo** card to configure your application logo.
@@ -58,6 +59,8 @@ To add a custom logo, click **Custom** and input a link to your desired image.
 
  ![Select identity providers](../../static/documentation/applications/saas-idp.png)
 
+1. Turn on **Instant Auth** if you are selecting only one login method for your application, and would like your end users to skip the identity provider selection step.
+
 1. Click **Next**.
 
 ### 2. Add a policy
diff --git a/products/cloudflare-one/src/content/applications/index.md b/products/cloudflare-one/src/content/applications/index.md
index bf2bb789b50..40de4bce0fa 100644
--- a/products/cloudflare-one/src/content/applications/index.md
+++ b/products/cloudflare-one/src/content/applications/index.md
@@ -1,13 +1,10 @@
 ---
 order: 5
+pcx-content-type: navigation
 ---
 
 # Applications
 
-<Aside>
-Cloudflare Access only secures applications that use HTTPS.
-</Aside>
-
 Cloudflare for Teams can secure self-hosted and SaaS applications with Zero Trust rules.
 
 Learn how to secure your applications, and how to configure one dashboard for your users to reach all the applications you've secured behind Teams:
diff --git a/products/cloudflare-one/src/content/applications/non-http.md b/products/cloudflare-one/src/content/applications/non-http.md
index ea8792ddfa0..02c9eb0a726 100644
--- a/products/cloudflare-one/src/content/applications/non-http.md
+++ b/products/cloudflare-one/src/content/applications/non-http.md
@@ -1,8 +1,9 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
-# Non-HTTP applications
+# Add non-HTTP applications
 
 You can connect applications to Cloudflare for Teams over a number of different protocols.
 
@@ -16,9 +17,9 @@ You can connect applications to Cloudflare for Teams over a number of different
 
 Cloudflare can render certain non-web applications in your browser without the need for client software or end user configuration changes. Cloudflare currently supports rendering a terminal for SSH connections in a user's browser.
 
-To enable, follow the instructions [here](/tutorials/ssh) to connect a machine available over SSH to Cloudflare. Next, navigate to the application page of the Access section in the Cloudflare for Teams dashboard. Click **Edit** and select the Settings tab. In the `cloudflared settings` card, toggle `Enable browser rendering` to on.
+To enable, follow the instructions [here](/tutorials/ssh) to connect a machine available over SSH to Cloudflare. Next, navigate to the application page of the Access section in the Cloudflare for Teams dashboard. Click **Edit** and select the Settings tab. In the **`cloudflared` settings** card, select *SSH* from the **Browser Rendering** drop-down menu.
 
-![Auto Auth](../static/documentation/applications/render-browser.png)
+![Auto Auth](../static/documentation/applications/ssh-browser-rendering.png)
 
 Once enabled, when users authenticate and visit the URL of the application, Cloudflare will render a terminal in their browser.
 
diff --git a/products/cloudflare-one/src/content/cloudflare-teams-roles-permissions.md b/products/cloudflare-one/src/content/cloudflare-teams-roles-permissions.md
new file mode 100644
index 00000000000..d774e083af4
--- /dev/null
+++ b/products/cloudflare-one/src/content/cloudflare-teams-roles-permissions.md
@@ -0,0 +1,38 @@
+---
+order: 20
+pcx-content-type: reference
+---
+
+# Roles and permissions
+
+When creating a Cloudflare for Teams account, you will be given the Super Administrator role. With this role, you can invite members to join your Teams account, and assign them different roles depending on the permissions you’d like to give them.
+
+A member can be given one of six roles within a Teams account:
+
+<TableWrap>
+
+| Role | Permissions |
+| ---- | ----------- |
+| Super Administrator - All Privileges | <ul><li>Can edit any Cloudflare for Teams setting.</li><li>Can make purchases, update billing, and manage memberships.</li><li>Can revoke the access of other Super Administrators.</li></ul> |
+| Administrator | <ul><li>Can access the full Cloudflare for Teams account except for membership management and billing.</li></ul> |
+| Cloudflare for Teams | <ul><li>Can edit Cloudflare for Teams.</li></ul> |
+| Cloudflare for Teams PII | <ul><li>Can access Cloudflare for Teams PII data.</li></ul> |
+| Cloudflare for Teams Read Only | <ul><li>Can access Cloudflare for Teams in read only mode.</li></ul> |
+| Cloudflare for Teams Reporting | <ul><li>Can access Cloudflare for Teams reporting data.</li></ul> |
+
+</TableWrap>
+
+<Aside>
+
+Only Enterprise users can assign multiple roles to additional members.
+
+</Aside>
+
+To check the list of members in your account, or to add new members:
+
+1. Navigate to the [Cloudflare Dashboard](https://dash.cloudflare.com).
+1. From your Account Home, navigate to Members.
+1. Enter a member’s email address to add them to your account, and click **Invite**.
+1. Alternatively, scroll down to the Members card to find a list of members with their status and role.
+
+For more information on managing roles within your Cloudflare account, visit the [help center](https://support.cloudflare.com/hc/en-us/articles/205065067-Setting-up-Multi-User-accounts-on-Cloudflare#2K2NLky0NgEtThpHOwrgx8).
diff --git a/products/cloudflare-one/src/content/components/product-list.js b/products/cloudflare-one/src/content/components/product-list.js
index e0d91d64b42..df47445415e 100644
--- a/products/cloudflare-one/src/content/components/product-list.js
+++ b/products/cloudflare-one/src/content/components/product-list.js
@@ -4,8 +4,6 @@ import "../css/product-list.css"
 
 const $ = {}
 $["access"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/access.js").pathD
-$["argo-tunnel"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/argo-tunnel.js").pathD
-$["gateway"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/gateway.js").pathD
 $["warp-client"] = require("@cloudflare/cloudflare-brand-assets/resources/product-icons/warp-client.js").pathD
 
 const products = [
@@ -14,16 +12,6 @@ const products = [
     path: "access",
     icon: "access",
   },
-  {
-    title: "Argo Tunnel",
-    path: "argo-tunnel",
-    icon: "argo-tunnel",
-  },
-  {
-    title: "Gateway",
-    path: "gateway",
-    icon: "gateway",
-  },
   {
     title: "WARP Client",
     path: "warp-client",
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/configuration/config.md b/products/cloudflare-one/src/content/connections/connect-apps/configuration/config.md
index 658081af076..cfb33270963 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/configuration/config.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/configuration/config.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: reference
 ---
 
 # Configuration file
@@ -9,7 +10,7 @@ The configuration file format uses [YAML syntax](http://www.yaml.org/start.html)
 
 ## Example file
 
-The example file below uses a single Argo Tunnel to send traffic sent to two distinct hostnames to two services that `cloudflared` can address. The configuration file uses [ingress rules](/connections/connect-apps/configuration/ingress) to route traffic that arrives at `cloudflared`.
+The example file below uses a single Tunnel to send traffic sent to two distinct hostnames to two services that `cloudflared` can address. The configuration file uses [ingress rules](/connections/connect-apps/configuration/ingress) to route traffic that arrives at `cloudflared`.
 
 ```yml
 tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
@@ -72,6 +73,7 @@ hello-world: true
 - [`transport-loglevel`](#transport-loglevel)
 - [`retries`](#retries)
 - [`pidfile`](#pidfile)
+- [`protocol`](#protocol)
 - [`logfile`](#logfile)
 - [`help`](#help)
 - [`version`](#version)
@@ -116,7 +118,7 @@ Disables periodic check for updates, restarting the server with the new version.
 |--|--|--|
 | `origincert value` | `~/.cloudflared/cert.pem` | `TUNNEL_ORIGIN_CERT` |
 
-Specifies the Tunnel certificate for one of your zones, authorizing the client to serve as an origin for that zone. A certificate is required to use Argo Tunnel. You can obtain a certificate by using the login command or by visiting `https://dash.cloudflare.com/argotunnel`.
+Specifies the Tunnel certificate for one of your zones, authorizing the client to serve as an origin for that zone. A certificate is required to use Cloudflare Tunnel. You can obtain a certificate by using the login command or by visiting `https://dash.cloudflare.com/argotunnel`.
 
 ### `no-tls-verify`
 
@@ -192,6 +194,14 @@ Maximum number of retries for connection/protocol errors. Retries use exponentia
 
 Write the application's PID to this file after the first successful connection. Mainly useful for scripting and service integration.
 
+### `protocol`
+
+| Syntax | Default | Environment Variable |
+|--|--|--|
+| `protocol` | `auto` | `TUNNEL_TRANSPORT_PROTOCOL` |
+
+Specify the protocol used to establish a connection between `cloudflared` and the edge. The `auto` value will automatically configure the `http2` protocol. 
+
 ### `logfile`
 
 | Syntax | Environment Variable |
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/configuration/index.md b/products/cloudflare-one/src/content/connections/connect-apps/configuration/index.md
index db845846f21..803b05314bf 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/configuration/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/configuration/index.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: navigation
 ---
 
 # Configure a Tunnel
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/configuration/ingress.md b/products/cloudflare-one/src/content/connections/connect-apps/configuration/ingress.md
index 2a5deae3005..475b18dc287 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/configuration/ingress.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/configuration/ingress.md
@@ -1,10 +1,11 @@
 ---
 order: 11
+pcx-content-type: reference
 ---
 
 # Ingress rules
 
-You can configure ingress rules to proxy traffic from multiple hostnames to multiple services using a single instance of `cloudflared` and a single Argo Tunnel.
+You can configure ingress rules to proxy traffic from multiple hostnames to multiple services using a single instance of `cloudflared` and a single Tunnel.
 
 Each incoming request received by `cloudflared` causes `cloudflared` to send a request to a local service.
 By configuring **ingress rules** in the [configuration file](/connections/connect-apps/configuration/config), you can specify which local services a request should be proxied to.
@@ -64,7 +65,7 @@ ingress:
 
 In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and unix sockets. See a [list of supported protocols](/applications/non-http).
 
-You can also route traffic to the built-in *Hello World* test server. This is useful when you need to test your Argo Tunnel protocol.
+You can also route traffic to the built-in *Hello World* test server. This is useful when you need to test your Cloudflare Tunnel protocol.
 
 ```yml
 tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
@@ -94,7 +95,7 @@ With the catch-all rule, you can set `cloudflared` to respond to traffic with an
 | SSH | SSH connections are proxied to your local service. [Learn more](/tutorials/ssh). | `ssh://localhost:22` |
 | RDP | RDP connections are proxied to your local service. [Learn more](/tutorials/rdp). | `rdp://localhost:3389` |
 | kubectl bastion mode | `cloudflared` will act like a jumphost, allowing access to any local address. | `bastion` |
-| Hello World | Test server for validating your Argo Tunnel setup | `hello_world` |
+| Hello World | Test server for validating your Cloudflare Tunnel setup | `hello_world` |
 | HTTP status | Responds to all requests with the given HTTP status | `http_status:404` |
 
 ## Single-service configuration
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/configuration/origins-via-cli.md b/products/cloudflare-one/src/content/connections/connect-apps/configuration/origins-via-cli.md
index a043d12b8e8..c6d70d78b8a 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/configuration/origins-via-cli.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/configuration/origins-via-cli.md
@@ -76,7 +76,7 @@ Disables chunked transfer encoding; useful if you are running a WSGI server.
 |--|--|
 | `--hello-world` | `TUNNEL_HELLO_WORLD` |
 
-Use the established tunnel to expose a `Hello world` HTTP server for testing Argo Tunnel. Mutually exclusive with the `--url argument`.
+Use the established tunnel to expose a `Hello world` HTTP server for testing Cloudflare Tunnel. Mutually exclusive with the `--url argument`.
 
 ### `--proxy-connect-timeout`
 
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/configuration/ports-and-ips.md b/products/cloudflare-one/src/content/connections/connect-apps/configuration/ports-and-ips.md
new file mode 100644
index 00000000000..ca72d420c82
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-apps/configuration/ports-and-ips.md
@@ -0,0 +1,57 @@
+---
+order: 3
+pcx-content-type: reference
+---
+
+# Ports and IPs
+
+Users can implement a positive security model with Cloudflare Tunnel by restricting traffic originating from `cloudflared`. The parameters below can be configured for egress traffic inside of a firewall.
+
+**Edge connections**
+- TCP port 7844 (HTTPS)
+- IPs are those behind **region1.argotunnel.com** and **region2.argotunnel.com** \*
+
+**API requests**
+- TCP port 443 (HTTPS)
+- IPs are those behind **api.cloudflare.com** \*
+
+Below the output of `dig` commands towards the above hostnames:
+
+```bash
+$ dig region1.argotunnel.com
+...
+
+;; ANSWER SECTION:
+region1.argotunnel.com.	86400	IN	A	198.41.192.7
+region1.argotunnel.com.	86400	IN	A	198.41.192.47
+region1.argotunnel.com.	86400	IN	A	198.41.192.107
+region1.argotunnel.com.	86400	IN	A	198.41.192.167
+region1.argotunnel.com.	86400	IN	A	198.41.192.227
+
+...
+
+$ dig region2.argotunnel.com
+
+...
+
+;; ANSWER SECTION:
+region2.argotunnel.com.	300	IN	A	198.41.200.193
+region2.argotunnel.com.	300	IN	A	198.41.200.233
+region2.argotunnel.com.	300	IN	A	198.41.200.13
+region2.argotunnel.com.	300	IN	A	198.41.200.53
+region2.argotunnel.com.	300	IN	A	198.41.200.113
+
+...
+
+$ dig api.cloudflare.com
+
+...
+
+;; ANSWER SECTION:
+api.cloudflare.com.     41      IN      A       104.19.193.29
+api.cloudflare.com.     41      IN      A       104.19.192.29
+
+...
+```
+
+\* *These IP addresses are unlikely to change but in the event that they do, Cloudflare will update the information here.*
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/create-tunnel/index.md b/products/cloudflare-one/src/content/connections/connect-apps/create-tunnel/index.md
index 0b1f405de32..4ecc31fe901 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/create-tunnel/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/create-tunnel/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Create a Tunnel
@@ -83,4 +84,4 @@ Tunnels created in this method do not currently display in the **Traffic** tab o
 
 </Aside>
 
-Argo Tunnel deletes DNS records after 24-48 hours of a Tunnel being unregistered. Argo Tunnel does not delete TLS certificates on your behalf once the Tunnel is shut down. If you want to clean up a Tunnel you’ve shut down, you can delete DNS records [in the DNS editor](https://dash.cloudflare.com/?zone=dns) and revoke TLS certificates in the Origin Certificates section of the [SSL/TLS tab of the Cloudflare dashboard](https://dash.cloudflare.com?to=/:account/:zone/ssl-tls/origin).
+Cloudflare Tunnel deletes DNS records after 24-48 hours of a Tunnel being unregistered. Cloudflare Tunnel does not delete TLS certificates on your behalf once the Tunnel is shut down. If you want to clean up a Tunnel you’ve shut down, you can delete DNS records [in the DNS editor](https://dash.cloudflare.com/?zone=dns) and revoke TLS certificates in the Origin Certificates section of the [SSL/TLS tab of the Cloudflare dashboard](https://dash.cloudflare.com?to=/:account/:zone/ssl-tls/origin).
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/hosting-requirements.md b/products/cloudflare-one/src/content/connections/connect-apps/hosting-requirements.md
new file mode 100644
index 00000000000..0626dee37de
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-apps/hosting-requirements.md
@@ -0,0 +1,11 @@
+---
+order: 7
+---
+
+# Tunnel Hosting Requirements
+
+Running `cloudflared` instances on a server and proxying traffic through it require computing resources such as CPU and memory on the server. The actual amount of resource usage depends on many variables, including the number of requests per second, bandwidth, network latency and hardware environment.
+
+Although the limit to how much traffic a single `cloudflared` can proxy will be bound to the hardware capabilities of the underlying machine (including network-wise), you may easily scale up the capacity of your Tunnel by running many instances of `cloudflared` [over the same Tunnel multiple times](https://blog.cloudflare.com/highly-available-and-highly-scalable-cloudflare-tunnels/) on different machines or network cards, regardless of the baseline performance of one `cloudflared` instance.
+
+You may refer to this guide for how to [deploy cloudflared replicas](/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas) to deal with high-load cases.
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/index.md b/products/cloudflare-one/src/content/connections/connect-apps/index.md
index f8cd26ca523..4db92eba110 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/index.md
@@ -1,18 +1,19 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # Connect applications
 
-You can connect applications, servers, and other resources to Cloudflare's network using [Argo Tunnel](/glossary#argo-tunnel). When connected, Cloudflare can apply [Zero Trust policies](/policies/zero-trust) to determine who can reach the resource.
+You can connect applications, servers, and other resources to Cloudflare's network using [Cloudflare Tunnel](/glossary#cloudflare-tunnel). When connected, Cloudflare can apply [Zero Trust policies](/policies/zero-trust) to determine who can reach the resource.
 
 ![Tunnel Diagram](../../static/documentation/connections/connect-apps/tun-diagram.png)
 
-Argo Tunnel runs a lightweight [daemon](/glossary#daemon) ([`cloudflared`](/glossary#cloudflared)) in your infrastructure that establishes outbound connections (Tunnels) between your service and the Cloudflare edge. When Cloudflare receives a request for your chosen hostname, it proxies the request through those connections to `cloudflared`. In turn, `cloudflared` proxies the request to your applications.
+Cloudflare Tunnel runs a lightweight [daemon](/glossary#daemon) ([`cloudflared`](/glossary#cloudflared)) in your infrastructure that establishes outbound connections (Tunnels) between your service and the Cloudflare edge. When Cloudflare receives a request for your chosen hostname, it proxies the request through those connections to `cloudflared`. In turn, `cloudflared` proxies the request to your applications.
 
 This forces any requests to access your applications to go through Cloudflare. This way, you can be sure attack traffic is stopped with Cloudflare’s WAF and Unmetered DDoS mitigation, and authenticated with Access if you’ve enabled those features for your account. 
 
-Argo Tunnel can connect HTTP web servers, [SSH servers](/tutorials/ssh), [remote desktops](/tutorials/rdp), and other protocols. Additionally, a single connector, the `cloudflared` daemon, can connect multiple applications of different types.
+Cloudflare Tunnel can connect HTTP web servers, [SSH servers](/tutorials/ssh), [remote desktops](/tutorials/rdp), and other protocols. Additionally, a single connector, the `cloudflared` daemon, can connect multiple applications of different types.
 
 In order to create and manage Tunnels, you'll first need to:
 
@@ -25,12 +26,12 @@ Once `cloudflared` has been installed and authenticated, the process to get your
 2. [Route traffic to your Tunnel](/connections/connect-apps/routing-to-tunnel)
 3. [Run your Tunnel](/connections/connect-apps/run-tunnel)
 
-Steps 1-2 are executed once per Tunnel, normally by an administrator, and Step 3 is executed whenever the Tunnel is to be started, normally by the owner of the Tunnel (whom may be different from the administrator).
+Steps 1-2 are executed once per Tunnel, normally by an administrator, and Step 3 is executed whenever the Tunnel is to be started, normally by the owner of the Tunnel (whom may be different from the administrator). After running the Tunnel, you may [secure your server](/connections/connect-apps/secure-server) from all ingress traffic.
 
 Be sure to check out our [Tutorials](/tutorials), where you can also find
 best practices for managing Tunnels as an administrator.
 
-## Traffic encryption between Argo Tunnel and HTTPs origin servers
+## Traffic encryption between Cloudflare Tunnel and HTTPs origin servers
 
 `cloudflared` performs its own SSL termination that is distinct from the origin.
 
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md
index 70dec48f82f..7867571094e 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md
@@ -1,8 +1,9 @@
 ---
 order: 0
+pcx-content-type: navigation
 ---
 
-# Setup
+# Get started
 
 To create and manage Tunnels, you'll first need to install and authenticate [`cloudflared`](/glossary#cloudflared) on your machine. `cloudflared` runs alongside or on your origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
 
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md
index 69b3582ba90..0ae533e7469 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md
@@ -1,92 +1,37 @@
 ---
 order: 1
+pcx-content-type: reference
 ---
 
-# Install `cloudflared`
+# Download `cloudflared`
 
-Argo Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. `cloudflared` is an [open source project](https://github.com/cloudflare/cloudflared) maintained by Cloudflare.
+Cloudflare Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. `cloudflared` is an [open source project](https://github.com/cloudflare/cloudflared) maintained by Cloudflare.
 
 Releases can be [found on GitHub](https://github.com/cloudflare/cloudflared/releases). Downloads are available as standalone binaries or packages like Debian and RPM.
 
+Detailed release notes can be found on the [GitHub RELEASE_NOTES file](https://github.com/cloudflare/cloudflared/blob/master/RELEASE_NOTES).
+
 ## Linux
 
 <TableWrap>
 
-Type   | amd64 / x86-64 | x86 (32-bit) | ARMv6 | ARM64 |
--------|----------------|--------------|------|------|
-Binary | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.tgz) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.tgz) | [Download from GitHub](https://github.com/cloudflare/cloudflared/releases) |
-.deb   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.deb) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.deb) | - |
-.rpm   | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-386.rpm) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-arm.rpm) | - |
+Type   | amd64 / x86-64 | x86 (32-bit) | ARM  | ARM64 |
+-------|----------------|--------------|------|-------|
+Binary | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-386) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64) |
+.deb   | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-386.deb) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm.deb) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb) |
+.rpm   | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-386.rpm) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm.rpm) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-aarch64.rpm) |
 
 </TableWrap>
 
-### `.deb` install
-
-Use the `deb` package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` package in this example. 
-
-```bash
-wget -q https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb
-dpkg -i cloudflared-stable-linux-amd64.deb
-```
-
-### `.rpm` install
-
-Use the `rpm` package manager to install `cloudflared` on compatable machines. `amd64 / x86-64` is used in this example. 
-
-```bash
-wget -q https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.rpm
-rpm -ivh cloudflared-stable-linux-amd64.rpm
-```
-
-### Build from source
-
-You can also build the latest version of `cloudflared` from source with the following steps.
-
-```sh
-$ git clone https://github.com/cloudflare/cloudflared.git
-$ cd cloudflared
-$ make cloudflared
-$ go install github.com/cloudflare/cloudflared/cmd/cloudflared
-```
-
-Depending on where you installed `cloudflared`, you can move it to a known path as well.
-
-```bash
-mv /root/cloudflared/cloudflared /usr/bin/cloudflared
-```
-
-## Docker
-
-A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared).
-
 ## macOS
 
-You can install `cloudflared` on macOS systems via Homebrew:
-
-```sh
-$ brew install cloudflare/cloudflare/cloudflared
-```
-
-Alternatively, you can [download the latest Darwin amd64 release directly](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-darwin-amd64.zip).
+You can [download the latest Darwin amd64 release directly](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-amd64.tgz).
 
 ## Windows
 
 Type   | 32-bit | 64-bit |
 -------|----------------|-----|
-ZIP | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-386.zip) | [Download](https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-windows-amd64.zip) |
-
-Once `cloudflared` is installed:
-1. Navigate to the **Downloads** folder.
-2. Right-click on the ZIP folder and select `Extract All` to extract the executable.
-3. Next, open PowerShell.
-4. Navigate to the same Downloads folder.
-5. Run the `cloudflared.exe` executable as an administrator to confirm the installation, replacing the path in the example below with the specifics of your directory:
-
-```bash
-PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version
-```
-
-The command above should output the version of `cloudflared` if successfully installed.
+Executable | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-386.exe) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe) |
 
 <Aside>
 
@@ -94,24 +39,11 @@ Instances of `cloudflared` do not automatically update on Windows. You will need
 
 </Aside>
 
-## Build from source
-
-You can also build the latest version of `cloudflared` from source with the following steps.
-
-```sh
-$ git clone https://github.com/cloudflare/cloudflared.git
-$ cd cloudflared
-$ make cloudflared
-$ go install github.com/cloudflare/cloudflared/cmd/cloudflared
-```
-
-Depending on where you installed `cloudflared`, you can move it to a known path as well.
+## Docker
 
-```bash
-mv /root/cloudflared/cloudflared /usr/bin/cloudflared
-```
+A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared).
 
-## Updating `cloudflared`
+## Update `cloudflared`
 
 You can update cloudflared by running the following command.
 
@@ -123,9 +55,9 @@ The update will cause `cloudflared` to restart which would impact traffic curren
 
 ### Updating with Cloudflare Load Balancer
 
-You can update `cloudflared` without downtime by using Cloudflare's Load Balancer product with your Argo Tunnel deployment.
+You can update `cloudflared` without downtime by using Cloudflare's Load Balancer product with your Cloudflare Tunnel deployment.
 
-1. Install a new instance of `cloudflared` and [create](/connections/connect-apps/create-tunnel) a new Argo Tunnel.
+1. Install a new instance of `cloudflared` and [create](/connections/connect-apps/create-tunnel) a new Tunnel.
 2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`.
 3. [Add the address](/connections/connect-apps/routing-to-tunnel/lb) of the new instance of `cloudflared` into your Load Balancer pool as priority 2.
 4. Swap the priority such that the new instance is now priority 1 and monitor to confirm traffic is being served.
@@ -135,12 +67,11 @@ You can update `cloudflared` without downtime by using Cloudflare's Load Balance
 
 If you are not using Cloudflare's Load Balancer, you can use multiple instances of `cloudflared` to update without the risk of downtime.
 
-1. Install a new instance of `cloudflared` and [create](/connections/connect-apps/create-tunnel) a new Argo Tunnel.
+1. Install a new instance of `cloudflared` and [create](/connections/connect-apps/create-tunnel) a new Tunnel.
 2. Configure the instance to point traffic to the same locally-available service as your current, active instance of `cloudflared`.
 3. In the Cloudflare DNS dashboard, [replace](/connections/connect-apps/routing-to-tunnel/dns) the address of the current instance of `cloudflared` with the address of the new instance. Save the record.
 4. Remove the now-inactive instance of `cloudflared`.
 
-
 #### Running multiple instances in Windows
 
 Windows systems require services to have a unique name and display name. You can run multiple instances of `cloudflared` by creating `cloudflared` services with unique names.
@@ -159,12 +90,9 @@ sc.exe start <unique-name>
 
 ## Deprecated versions
 
-Cloudflare currently supports all versions of `cloudflared`. Starting on March 20, 2021, Cloudflare will no longer support versions released prior to 2020.5.1.
-
-All features available in versions released prior to 2020.5.1 are available in current versions. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1.
+Cloudflare currently supports versions of `cloudflared` 2020.5.1 and later. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#updating-cloudflared).
 
 | Version(s) | Deprecation status |
 |---|---|
 | 2020.5.1 and later | Supported |
-| Versions prior to 2020.5.1 | Will no longer be supported starting March 20, 2021 |
-
+| Versions prior to 2020.5.1 | No longer supported |
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md
index 15f0053cb96..a2eb2b784a0 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Authenticate `cloudflared`
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md
new file mode 100644
index 00000000000..3a03d50175a
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md
@@ -0,0 +1,187 @@
+---
+order: 3
+title: Tunnel guide
+pcx-content-type: how-to
+---
+
+# Set up your first tunnel
+
+Follow this step-by-step guide to getting your first tunnel up and running. Before you start, make sure you:
+1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
+1. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
+
+## 1. Download and install `cloudflared`
+
+<details>
+<summary>Windows</summary>
+<div>
+
+First, download `cloudflared` on your machine. Visit the [downloads](/connections/connect-apps/install-and-setup/installation) page to find the right package for your OS.
+
+Next, rename the executable to `cloudflared.exe`, and then open PowerShell. Change directory to your Downloads folder and run `.\cloudflared.exe --version`. It should output the version of `cloudflared`. Note that `cloudflared.exe` could be `cloudflared-windows-amd64.exe` or `cloudflared-windows-386.exe` if you haven't renamed it.
+
+Replace the path in the example with the specifics of your Downloads directory:
+
+```text
+PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version
+```
+
+### Build from source
+
+You can also build the latest version of `cloudflared` from source with the following steps:
+
+```bash
+$ git clone https://github.com/cloudflare/cloudflared.git
+$ cd cloudflared
+$ make cloudflared
+$ go install github.com/cloudflare/cloudflared/cmd/cloudflared
+```
+
+Depending on where you installed `cloudflared`, you can move it to a known path as well.
+
+```bash
+mv /root/cloudflared/cloudflared /usr/bin/cloudflared
+```
+
+</div>
+</details>
+
+<details>
+<summary>macOS</summary>
+<div>
+
+The first step to creating a tunnel is to download and install `cloudflared` on your machine.
+
+```sh
+$ brew install cloudflare/cloudflare/cloudflared
+```
+
+Alternatively, you can [download the latest Darwin amd64 release](/connections/connect-apps/install-and-setup/installation) directly.
+
+</div>
+</details>
+
+<details>
+<summary>Linux</summary>
+<div>
+
+First, download `cloudflared` on your machine. Visit the [downloads](/connections/connect-apps/install-and-setup/installation) page to find the right package for your OS.
+
+Next, install `cloudflared`. 
+
+### .deb install
+Use the deb package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` is used in this example.
+
+```sh
+wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb dpkg -i cloudflared-linux-amd64.deb
+```
+
+### ​.rpm install
+Use the rpm package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` is used in this example.
+
+```sh
+wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
+```
+
+### Build from source
+
+You can also build the latest version of `cloudflared` from source with the following steps.
+
+```sh
+$ git clone https://github.com/cloudflare/cloudflared.git
+$ cd cloudflared
+$ make cloudflared
+$ go install github.com/cloudflare/cloudflared/cmd/cloudflared
+```
+
+Depending on where you installed `cloudflared`, you can move it to a known path as well.
+
+```bash
+mv /root/cloudflared/cloudflared /usr/bin/cloudflared
+```
+
+</div>
+</details>
+
+## 2. Authenticate `cloudflared`
+
+```bash
+$ cloudflared tunnel login
+```
+
+Running this command will:
+
+* Open a browser window and prompt you to log into your Cloudflare account. After logging into your account, select your hostname. 
+* Generate a [cert.pem file](/connections/connect-apps/tunnel-useful-terms#cert-pem). The `cert.pem` file contains account-wide credentials.
+
+## 3. Create a tunnel and give it a name
+
+```bash
+$ cloudflared tunnel create <NAME>
+```
+
+Running this command will:
+* Create a tunnel by establishing a persistent relationship between the [name you provide](/connections/connect-apps/tunnel-useful-terms#tunnel-name) and a [UUID](/connections/connect-apps/tunnel-useful-terms#tunnel-uuid) for your tunnel. At this point, no connection is active within the tunnel yet. 
+* Generate a [credentials file](/connections/connect-apps/tunnel-useful-terms#credentials-file). 
+* Create a subdomain of `.cfargotunnel.com`.
+
+From the output of the command, take note of the tunnel’s UUID and the path to your tunnel’s credentials file.
+
+## 4. Create a configuration file
+
+Create a [configuration file](/connections/connect-apps/tunnel-useful-terms#configuration-file) in your `.cloudflared` directory using any text editor. This file will configure the tunnel to route traffic from a given origin to the hostname of your choice.
+
+Add the following fields to the file:
+
+**If you’re connecting an application**
+
+```txt
+url: http://localhost:8000
+tunnel: <Tunnel-UUID>
+credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
+```
+
+**If you’re connecting a network**
+
+```txt
+tunnel: <Tunnel-UUID>
+credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
+```
+
+## 5. Start routing traffic
+
+Now assign a CNAME record that points traffic to your tunnel subdomain. This record will be easier to remember and share. 
+
+```bash
+$ cloudflared tunnel route dns <UUID or NAME> <hostname>
+```
+
+You can confirm that the route has been successfully established by running:
+
+```bash
+$ cloudflared tunnel route ip show 
+```
+
+## 6. Run the tunnel 
+
+Run the tunnel to proxy incoming traffic from the Tunnel to any number of services running locally on your origin. 
+
+```bash
+$ cloudflared tunnel --config path/config.yaml run <UUID or NAME>
+```
+
+You can also run the tunnel without a configuration file. To do that, run it by adding the necessary [flags](/connections/connect-apps/configuration/config#arguments) after the `run` command and before the name or UUID. For example, running your tunnel with this command way will route all traffic to the given URL:
+
+```bash
+$ cloudflared tunnel run --url localhost:3000 <NAME or UUID>
+```
+
+Cloudflare Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS. For more information, refer to [Run as a service](/connections/connect-apps/run-tunnel/run-as-service).
+
+## 7. Check the tunnel
+
+Your tunnel configuration is complete! Navigate to **Access** > **Tunnels** on the Teams Dashboard to see your tunnel listed as active. If you want to see a list of active tunnels directly from your CLI, you can run:
+
+```bash
+$ cloudflared tunnel list
+```
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/license/copyrights.md b/products/cloudflare-one/src/content/connections/connect-apps/license/copyrights.md
index fa84a7fc3d1..1fe21e08e54 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/license/copyrights.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/license/copyrights.md
@@ -1,5 +1,6 @@
 ---
 order: 101
+pcx-content-type: reference
 ---
 
 # Copyrights
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/license/index.md b/products/cloudflare-one/src/content/connections/connect-apps/license/index.md
index 2d15446b8f5..f0238aef3b9 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/license/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/license/index.md
@@ -1,5 +1,6 @@
 ---
 order: 50
+pcx-content-type: reference
 ---
 
 # License
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/dns.md b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/dns.md
index 8b1072ff983..c8242d47b18 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/dns.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/dns.md
@@ -1,17 +1,18 @@
 ---
 order: 50
+pcx-content-type: how-to
 ---
 
 # DNS record
 
 | Before you start |
 |---|
-| 1. [Create an Argo Tunnel](/connections/connect-apps/create-tunnel) |
+| 1. [Create a Tunnel](/connections/connect-apps/create-tunnel) |
 | 2. [Configure the Tunnel](/connections/connect-apps/configuration) |
 
 ## Route traffic from the Cloudflare dashboard
 
-When you create an Argo Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
+When you create a Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
 
 Unlike publicly routable IP addresses, the subdomain will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.
 
@@ -41,4 +42,4 @@ Note: this command requires the `cert.pem` file.
 
 ## Optional: Configure additional Cloudflare settings
 
-The application will default to the Cloudflare settings of the hostname in your account that includes the Argo Tunnel DNS record, including [cache rules](https://support.cloudflare.com/hc/en-us/articles/202775670-Customizing-Cloudflare-s-cache) and [firewall policies](https://developers.cloudflare.com/firewall/). You can changes these settings for your hostname in Cloudflare's dashboard.
\ No newline at end of file
+The application will default to the Cloudflare settings of the hostname in your account that includes the Cloudflare Tunnel DNS record, including [cache rules](https://support.cloudflare.com/hc/en-us/articles/202775670-Customizing-Cloudflare-s-cache) and [firewall policies](https://developers.cloudflare.com/firewall/). You can changes these settings for your hostname in Cloudflare's dashboard.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/index.md b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/index.md
index c0ead263bb3..e83fd8e18bf 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/index.md
@@ -1,11 +1,12 @@
 ---
 order: 4
+pcx-content-type: concept
 ---
 
 # Route to a Tunnel
 
-Cloudflare can route traffic to your Argo Tunnel connection using a [DNS record](/connections/connect-apps/routing-to-tunnel/dns) or Cloudflare’s [Load Balancer](/connections/connect-apps/routing-to-tunnel/lb) product.
+Cloudflare can route traffic to your Cloudflare Tunnel connection using a [DNS record](/connections/connect-apps/routing-to-tunnel/dns) or Cloudflare’s [Load Balancer](/connections/connect-apps/routing-to-tunnel/lb) product.
 
-You can configure either option from the Cloudflare dashboard by pointing a DNS CNAME record or a Load Balancer pool to the Argo Tunnel subdomain for your connection. You can also associate these records with your Tunnel from `cloudflared` directly.
+You can configure either option from the Cloudflare dashboard by pointing a DNS CNAME record or a Load Balancer pool to the Cloudflare Tunnel subdomain for your connection. You can also associate these records with your Tunnel from `cloudflared` directly.
 
-Argo Tunnel can also [be configured](/connections/connect-apps/configuration/ingress) to route traffic to multiple hostnames to multiple services in your environment.
\ No newline at end of file
+Cloudflare Tunnel can also [be configured](/connections/connect-apps/configuration/ingress) to route traffic to multiple hostnames to multiple services in your environment.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/kubernetes.md b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/kubernetes.md
index 3c2c5f12e18..dff67452749 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/kubernetes.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/kubernetes.md
@@ -1,10 +1,11 @@
 ---
 order: 40
+pcx-content-type: how-to
 ---
 
 # Kubernetes
 
-You can deploy Argo Tunnel to route traffic to Kubernetes clusters. Cloudflare no longer maintains an ingress controller, but we recommend two options for connecting Kubernetes clusters to Cloudflare without introducing downtime caused by application restarts or `cloudflared` updates.
+You can deploy Cloudflare Tunnel to route traffic to Kubernetes clusters. Cloudflare no longer maintains an ingress controller, but we recommend two options for connecting Kubernetes clusters to Cloudflare without introducing downtime caused by application restarts or `cloudflared` updates.
 
 Both options rely on Cloudflare's Load Balancer to send traffic for a single hostname to two or more instances of `cloudflared`, allowing you to update or modify `cloudflared` without downtime. Those instances of `cloudflared` should point to a service or ingress controller that runs in front of your Kubernetes cluster.
 
@@ -23,7 +24,7 @@ Both options rely on Cloudflare's Load Balancer to send traffic for a single hos
 
 4. Create two deployments with one replica each using `cloudflared`. Configure `cloudflared` to point to the service IP of the upstream service. Mount the secrets created in Step 1 and point `cloudflared` to the right path.
 
-5. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/connections/connect-apps/routing-to-tunnel/lb) to the two or more Argo Tunnel connections.
+5. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/connections/connect-apps/routing-to-tunnel/lb) to the two or more Cloudflare Tunnel connections.
 
 Once configured, you can update `cloudflared` by updating one deployment and then proceeding to the next one once you've verified the newly updated cloudflared pod is running and connected.
 
@@ -35,4 +36,4 @@ Once configured, you can update `cloudflared` by updating one deployment and the
 
 3. Create two deployments with one replica each using `cloudflared`. Configure `cloudflared` to point to an ingress controller. Mount the secrets created in Step 1 and point `cloudflared` to the right path.
 
-4. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/connections/connect-apps/routing-to-tunnel/lb) to the two or more Argo Tunnel connections.
+4. In the Cloudflare dashboard, create a Load Balancer pool and [point the pool](/connections/connect-apps/routing-to-tunnel/lb) to the two or more Cloudflare Tunnel connections.
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/lb.md b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/lb.md
index 5fd11b8021f..271c225cc2b 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/lb.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/routing-to-tunnel/lb.md
@@ -1,30 +1,31 @@
 ---
 order: 50
+pcx-content-type: how-to
 ---
 
 # Load balancers
 
 | Before you start |
 |---|
-| 1. [Create an Argo Tunnel](/connections/connect-apps/create-tunnel) |
+| 1. [Create a Tunnel](/connections/connect-apps/create-tunnel) |
 | 2. [Configure the Tunnel](/connections/connect-apps/configuration) |
 | 3. [Create a Load Balancer pool in Cloudflare](https://developers.cloudflare.com/load-balancing/create-load-balancer-ui) |
 
 ## Route traffic from the dashboard
 
-When you create an Argo Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
+When you create a Tunnel, Cloudflare generates a subdomain of `cfargotunnel.com` with the UUID of the created Tunnel. You can treat that subdomain as if it were an origin target in the Cloudflare dashboard.
 
 Unlike publicly routable IP addresses, the subdomain will only proxy traffic for a DNS record or a Load Balancer pool in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.
 
-To add an Argo Tunnel connection to a Cloudflare Load Balancer pool:
+To add a Cloudflare Tunnel connection to a Cloudflare Load Balancer pool:
 
 1. Navigate to the Load Balancer page in the Cloudflare dashboard.
-2. Create or edit an existing Origin Pool. Add the Argo Tunnel subdomain as an Origin Address.
+2. Create or edit an existing Origin Pool. Add the Tunnel subdomain as an Origin Address.
 3. Click **Save**.
 
 ## Route traffic from the command line
 
-You can add Argo Tunnel to an existing load Balancer pool directly from `cloudflared`. The result is the same as creation from the dashboard above.
+You can add Cloudflare Tunnel to an existing load Balancer pool directly from `cloudflared`. The result is the same as creation from the dashboard above.
 
 To do so, run the following command:
 
@@ -36,4 +37,4 @@ $ cloudflared tunnel route lb <tunnel ID or NAME> <load balancer name> <load bal
 
 ## Optional: Configure additional Cloudflare settings
 
-The application will default to the Cloudflare settings of the hostname in your account that includes the Argo Tunnel Load Balancer records, including [cache rules](https://support.cloudflare.com/hc/en-us/articles/202775670-Customizing-Cloudflare-s-cache) and [firewall policies](https://developers.cloudflare.com/firewall/). You can changes these settings for your hostname in Cloudflare's dashboard.
\ No newline at end of file
+The application will default to the Cloudflare settings of the hostname in your account that includes the Cloudflare Tunnel Load Balancer records, including [cache rules](https://support.cloudflare.com/hc/en-us/articles/202775670-Customizing-Cloudflare-s-cache) and [firewall policies](https://developers.cloudflare.com/firewall/). You can changes these settings for your hostname in Cloudflare's dashboard.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md
index f43b183609c..e4723ceffdb 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: how-to
 ---
 
 # Deploy `cloudflared` replicas
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/index.md b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/index.md
index f3a968641e9..d89231f833b 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/index.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # Run a Tunnel
@@ -32,7 +33,7 @@ You can also run the Tunnel without a configuration file by appending the flags
 
 ![Run tunnels](../../../static/documentation/connections/connect-apps/create-tunnel/rt1.png)
 
-Once run, this command will establish an outbound-only connection to Cloudflare’s edge. That connection will not yet serve traffic. Any requests made to the Tunnel directly will fail. To route traffic from a hostname or load balancer pool, follow the routing instructions.
+Once run, this command will establish an outbound-only connection to Cloudflare’s edge. That connection will not yet serve traffic. Any requests made to the Tunnel directly will fail. To route traffic from a hostname or load balancer pool, follow the [routing instructions](../routing-to-tunnel).
 
 You can also:
 * [Run a tunnel as a service](/connections/connect-apps/run-tunnel/run-as-service)
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/run-as-service.md b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/run-as-service.md
index c17075e32ee..accc16ceecc 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/run-as-service.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/run-as-service.md
@@ -1,5 +1,6 @@
 ---
 order: 30
+pcx-content-type: how-to
 ---
 
 # Run as a service
@@ -10,9 +11,9 @@ order: 30
 | 2. [Configure the Tunnel](/connections/connect-apps/configuration) |
 | 3. [Configure routing to the Tunnel](/connections/connect-apps/routing-to-tunnel) |
 
-Argo Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS.
+Cloudflare Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS.
 
-By default, Argo Tunnel expects all of the configuration to exist in the `cloudflared/config.yml` configuration file. The available options are documented on the [configuration file reference](/connections/connect-apps/configuration/config/), but at a minimum you must specify the following arguments to run as a service:
+By default, Cloudflare Tunnel expects all of the configuration to exist in the `cloudflared/config.yml` configuration file. The available options are documented on the [configuration file reference](/connections/connect-apps/configuration/config/), but at a minimum you must specify the following arguments to run as a service:
 
 |Argument|Description|
 |---|---|
@@ -38,10 +39,20 @@ If you do not have a configuration file, you will need to create a config.yml fi
 
 <Aside>
 
-The above arguments are required for pre-configured Argo Tunnel deployments. If you are using legacy Argo Tunnel, without names, you can append the `--legacy` flag when running cloudflared tunnel install command.
+The above arguments are required for pre-configured Cloudflare Tunnel deployments. If you are using legacy Tunnels, without names, you can append the `--legacy` flag when running `cloudflared` tunnel install command.
 
 </Aside>
 
+Then, start the system service with the following command:
+```sh
+$ sudo systemctl start cloudflared
+``` 
+
+Or start on boot with:
+```sh
+$ sudo systemctl enable cloudflared
+```
+
 ## macOS
 
 ### Run at login
@@ -52,7 +63,7 @@ Open a Terminal and run the following command:
 $ cloudflared service install
 ```
 
-Argo Tunnel will be installed as a launch agent, and start whenever you log in, using your local user configuration found in `~/.cloudflared/`.
+Cloudflare Tunnel will be installed as a launch agent, and start whenever you log in, using your local user configuration found in `~/.cloudflared/`.
 
 #### Manually start the service
 
@@ -72,7 +83,7 @@ Run the following command:
 $ sudo cloudflared service install
 ```
 
-Argo Tunnel will be installed as a launch daemon, and start whenever your system boots, using your configuration found in `/etc/cloudflared`.
+Cloudflare Tunnel will be installed as a launch daemon, and start whenever your system boots, using your configuration found in `/etc/cloudflared`.
 
 #### Manually start the service
 
@@ -111,7 +122,7 @@ C:\Cloudflared\bin\cloudflared.exe
 C:\Cloudflared\bin\cloudflared.exe service install
 ```
 
-Assuming Windows is installed to `C:\`, when running as a service, Argo Tunnel expects the configuration to be available at the following path:
+Assuming Windows is installed to `C:\`, when running as a service, Cloudflare Tunnel expects the configuration to be available at the following path:
 
 `C:\Windows\system32\config\systemprofile\.cloudflared\config.yml` .
 
@@ -151,7 +162,7 @@ copy C:\Users\%USERNAME%\.cloudflared\cert.pem C:\Windows\System32\config\system
 
 ### Create, route, and configure the Tunnel
 
-You can now [create](/connections/connect-apps/create-tunnel) an Argo Tunnel and edit the configuration file to [configure](/connections/connect-apps/configuration) `cloudflared`. We recommend setting the [routing](/connections/connect-apps/routing-to-tunnel) before running the service in the next step.
+You can now [create](/connections/connect-apps/create-tunnel) an Cloudflare Tunnel and edit the configuration file to [configure](/connections/connect-apps/configuration) `cloudflared`. We recommend setting the [routing](/connections/connect-apps/routing-to-tunnel) before running the service in the next step.
 
 <Aside>
 
@@ -181,7 +192,7 @@ credentials-file: C:/UUID.json
 
 ### Start the service
 
-To start the service, open the Service Manager, select `Argo Tunnel agent` and open the `General` tab. In the `Start parameters` field, specify the location of the configuration file and place the `tunnel run` command after the path. For example:
+To start the service, open the Service Manager, select `Cloudflare Tunnel agent` and open the `General` tab. In the `Start parameters` field, specify the location of the configuration file and place the `tunnel run` command after the path. For example:
 
 ![DNS tab](../../../static/documentation/connections/start-param-1.png)
 
@@ -193,7 +204,7 @@ The Services UI in Windows will allow you to set Start parameters, and Start the
 
 </Aside>
 
-Alternatively, you can run the following commands to start Argo Tunnel as a service:
+Alternatively, you can run the following commands to start Cloudflare Tunnel as a service:
 
 ```
 C:\> sc start cloudflared tunnel run
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/secure-server.md b/products/cloudflare-one/src/content/connections/connect-apps/secure-server.md
new file mode 100644
index 00000000000..2217429c6ea
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-apps/secure-server.md
@@ -0,0 +1,62 @@
+---
+order: 6
+---
+
+# Secure the Server
+
+| Before you start |
+|---|
+| 1. [Create a Tunnel](/connections/connect-apps/create-tunnel) |
+| 2. [Configure the Tunnel](/connections/connect-apps/configuration) |
+| 3. [Configure routing to the Tunnel](/connections/connect-apps/routing-to-tunnel) |
+| 4. [Run the Tunnel](/connections/connect-apps/run-tunnel) |
+
+Once you can successfully run a Tunnel to proxy incoming traffic to any number of services running locally on your origin, you can lock down your origin to block out potentially malicious incoming traffic. By disallowing all ingress traffic and allowing only egress traffic, you can avoid “poking holes” on your server's firewall while exposing only the services you specified in the Tunnel's `config.yml` to the outside world.
+
+## Cloud VM instance-level firewall
+If you host your services on a Virtual Machine (VM) instance by a Cloud provider such as Google Cloud Platform (GCP), you may set up instance-level firewall rules to disallow all ingress traffic and allow only egress traffic. For example, on GCP, you may delete all ingress rules, leaving only the relevant egress rules. This is because GCP's firewall defaults to “Block” unless a rule explicitly allows certain traffic.
+
+![GCP firewall](../../static/documentation/connections/gcp-firewall.png)
+
+## OS-level firewall
+Alternatively, you may also use operating system (OS)-level firewall rules to disallow all ingress traffic and allow only egress traffic. For example, if your server runs on Linux, you may use `iptables` to set up firewall rules. Most Linux distributions are pre-installed with `iptables`. Note that in the example below, not all ingress traffic is blocked, just in case that the server is hosted on the Cloud and there would be no way to SSH back into the system again if the settings were configured wrongly.
+
+1. Check your current firewall rules.
+```sh
+$ sudo iptables -L
+```
+
+2. Allow `localhost` to communicate with itself.
+```sh
+$ sudo iptables -A INPUT -i lo -j ACCEPT
+```
+
+3. Allow already established connection and related traffic.
+```sh
+$ sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+```
+
+4. Allow new SSH connections.
+```sh
+$ sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
+```
+
+5. Drop all other ingress traffic.
+
+<Aside header='Warning:'>
+Be very careful with the following command because if you didn't preserve the current SSH connection or allow new SSH connections, you would be logged out and unable to SSH back into the system again.
+</Aside>
+
+```sh
+$ sudo iptables -A INPUT -j DROP
+```
+
+6. After setting the firewall rules, use this command to check the current `iptables` settings:
+```sh
+$ sudo iptables -L
+```
+
+Run your Tunnel and check that all the services specified in `config.yml` should still be accessible to the outside world via the Tunnel, but not via the external IP address of the server. 
+
+You can also:
+* [Secure your application with Cloudflare Access](/applications/configure-apps/self-hosted-apps)
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/trycloudflare.md b/products/cloudflare-one/src/content/connections/connect-apps/trycloudflare.md
index 99461f7dc05..97e24d6afce 100644
--- a/products/cloudflare-one/src/content/connections/connect-apps/trycloudflare.md
+++ b/products/cloudflare-one/src/content/connections/connect-apps/trycloudflare.md
@@ -1,10 +1,11 @@
 ---
 order: 100
+pcx-content-type: how-to
 ---
 
 # TryCloudflare
 
-Developers can use the TryCloudflare tool to experiment with Argo Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on `trycloudflare.com`. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost.
+Developers can use the TryCloudflare tool to experiment with Cloudflare Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on `trycloudflare.com`. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost.
 
 ### Using TryCloudflare
 1. Follow [these instructions](/connections/connect-apps/install-and-setup/installation) to install `cloudflared`. If you have an older copy, update to 2019.4.0 or later.
@@ -27,13 +28,13 @@ $ cloudflared tunnel --url http://localhost:7000
 
 #### What are some example use cases for TryCloudflare?
 * Create a web server for a project on your laptop that you want to share with others on different networks
-* Test browser compatibility for a new site by creating a free Argo Tunnel and testing the link in different browsers
+* Test browser compatibility for a new site by creating a free Tunnel and testing the link in different browsers
 * Run speed tests from different regions by using a tool like Pingdom or WebPageTest to connect to the randomly-generated subdomain created by TryCloudflare
 
 #### Why does Cloudflare provide this service for free?
-* We want more users to experience the speed and security improvements of Argo Tunnel (and Argo Smart Routing). We hope you test it with TryCloudflare and decide to add it to your production sites.
+* We want more users to experience the speed and security improvements of Cloudflare Tunnel (and Argo Smart Routing). We hope you test it with TryCloudflare and decide to add it to your production sites.
 * Cloudflare’s features historically require you to own a domain, set that domain’s DNS to Cloudflare’s nameservers, and configure its DNS records before you can begin to use any services. We hope to make more and more of our products available to trial without that burden.
-* We don’t guarantee any SLA or uptime of TryCloudflare - we plan to test new Argo Tunnel features and improvements on these free tunnels. This provides us with a group of connections to test before we deploy to production customers. Free tunnels are meant to be used for testing and development, not for deploying a production website.
+* We don’t guarantee any SLA or uptime of TryCloudflare - we plan to test new Cloudflare Tunnel features and improvements on these free tunnels. This provides us with a group of connections to test before we deploy to production customers. Free tunnels are meant to be used for testing and development, not for deploying a production website.
 
 #### Legal
-Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](https://developers.cloudflare.com/argo-tunnel/license/), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/).
+Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept the terms of the [Cloudflare License](/connections/connect-apps/license), [Terms](https://www.cloudflare.com/terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/).
diff --git a/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md
new file mode 100644
index 00000000000..0023efa18c4
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md
@@ -0,0 +1,30 @@
+---
+order: 2
+pcx-content-type: reference
+---
+
+# Useful terms
+
+## Tunnel
+A tunnel is a secure, outbound-only pathway you can establish between your origin and the Cloudflare edge. Each tunnel you create will be assigned a [name](#tunnel-name) and a [UUID](#tunnel-uuid).
+
+## Tunnel UUID
+A tunnel UUID is an alpha-numeric, unique ID assigned to a tunnel. The tunnel UUID can be used in [configuration files](#configuration-file), and in general, whenever you need to reference a specific tunnel. 
+
+## Tunnel name
+The `cloudflared tunnel create <NAME>` command creates a tunnel and assigns it a name. Once named, a tunnel is a persistent pathway within which you can stop and start as many [connectors](#connector) as needed, adding stability and ease of use to your tunnel experience. Tunnel names do not need to be hostnames; for example, you can assign your tunnel a name that represents your application/network, a particular server, or the cloud environment where it runs. A human-readable identifier lets you easily reference a tunnel whenever you need.
+
+## Connector
+Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors, or replicas. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity.
+
+## Configuration file
+This is a `.yaml` file that functions as the operating manual for `cloudflared`. By creating a configuration file, you can have fine-grained control over how their instance of cloudflared will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx`, or ssh to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/connections/connect-networks/private-net/create-tunnel#configure-the-tunnel)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`.
+
+## Cert.pem
+This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked.
+
+## Credentials file
+This file is created when you run `cloudflared tunnel create <NAME>`. It stores your tunnel’s credentials in a `.json` format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with.
+
+## Ingress rule
+Ingress rules let users specify which local services traffic should be proxied to. If a rule doesn't specify a path, all paths will be matched. Ingress rules can be listed in your [configuration file](#configuration-file) or when running `cloudflared tunnel ingress`.  
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-browsers/configuration.md b/products/cloudflare-one/src/content/connections/connect-browsers/configuration.md
index 885764e0e17..c7cd1148e33 100644
--- a/products/cloudflare-one/src/content/connections/connect-browsers/configuration.md
+++ b/products/cloudflare-one/src/content/connections/connect-browsers/configuration.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 --- 
 
 # Setup
@@ -10,7 +11,7 @@ Browser Isolation is enabled through Secure Web Gateway HTTP policies. By defaul
 
 1. Download the latest version of the [WARP client](/connections/connect-devices/warp/download-warp).
 
-1. Create a [Device enrollment policy](/connections/connect-devices/warp/device-enrollment).
+1. Create a [Device enrollment rule](/connections/connect-devices/warp/warp-settings#device-enrollment-permissions).
 
 1. Set up an [Isolation policy](/policies/filtering/http-policies/#isolate).
 
diff --git a/products/cloudflare-one/src/content/connections/connect-browsers/extensions.md b/products/cloudflare-one/src/content/connections/connect-browsers/extensions.md
new file mode 100644
index 00000000000..60b72511e4f
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-browsers/extensions.md
@@ -0,0 +1,36 @@
+---
+order: 4
+pcx-content-type: reference
+---
+
+# Extensions
+
+Browser Isolation supports running native Chromium Web Extensions in the remote browser.
+
+This capability allows extending tools that require DOM access (such as password managers and ad-blockers) to isolated pages.
+
+## Install an extension inside the remote browser
+
+### Prerequisite: Isolate Chrome Web Store
+
+Installing extensions requires that the Chrome Web Store is isolated, first create an [HTTP policy](/policies/filtering/http-policies) that isolates the Chrome Webstore (chrome.google.com).
+
+### Install an extension
+
+- Navigate to https://chrome.google.com/webstore while isolated.
+- Find and select your desired extension. 
+- Select "Add to Chrome".
+- Approve the extension installation by selecting "Add extension".
+
+Remote browser extensions are automatically reinstalled across isolated sessions.
+
+## Removing extensions from the remote browser
+
+Extensions may be uninstalled within the remote browser from any isolated page.
+
+- Navigate to any isolated webpage.
+- Right click to open the context menu and select "Show isolation toolbar"
+- Within the isolation toolbar on the bottom of the page, select the Jigsaw icon to open the extension manager.
+- Select the hamburger icon for the desired extension to open the extension controls.
+- Choose "Remove from Chromium..." 
+- Select "Remove" to confirm extension uninstallation.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-browsers/index.md b/products/cloudflare-one/src/content/connections/connect-browsers/index.md
index 7b7e437d628..b1d9596d55c 100644
--- a/products/cloudflare-one/src/content/connections/connect-browsers/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-browsers/index.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: concept
 ---
 
 # Connect browsers
@@ -14,7 +15,7 @@ Cloudflare Browser Isolation works by intercepting normal browsing traffic and s
 
 Remote browsing is invisible to the user who continues to use their browser normally without changing their preferred browser and habits. Every open tab and window is automatically isolated.
 
-![Diagram of how Browser Isolation integrates with WARP and Gateway](../../static/documentation/rbi/cloudflare-one-browser-diagram.png)
+![Diagram of how Browser Isolation integrates with WARP and Gateway](../../static/documentation/rbi/cloudflare-one-browser-diagram-background.png)
 
 Browser Isolation is integrated into Cloudflare for Teams [HTTP Policies](/policies/filtering/http-policies).
 
diff --git a/products/cloudflare-one/src/content/connections/connect-browsers/known-limitations.md b/products/cloudflare-one/src/content/connections/connect-browsers/known-limitations.md
index 94767e1736a..54d220f4579 100644
--- a/products/cloudflare-one/src/content/connections/connect-browsers/known-limitations.md
+++ b/products/cloudflare-one/src/content/connections/connect-browsers/known-limitations.md
@@ -1,6 +1,6 @@
 ---
-title: Known limitations
 order: 3
+pcx-content-type: reference
 ---
 
 # Known limitations
@@ -12,17 +12,9 @@ Our Network Vector Rendering (NVR) technology allows us to deliver a secure remo
 - Webcam / Microphone support is unavailable.
 - Websites that use WebGL may not function.
 - Netflix and Spotify Web Player are unavailable.
-- Browser extensions are currently unsupported.
 
 If one of these limitations affects you, please let us know by [submitting feedback](#submitting-feedback).
 
-## Browser plugins / extensions
-
-Browser extensions / plugins are not compatible with isolated pages at this time however we do plan to support them in future. Let us know what plugins you would like supported by [submitting feedback](#submitting-feedback).
-
-### Ad blockers
-Advertisement blocking extensions installed in your local browser such as AdBlock or uBlock Origin may negatively interfere with the web-based remoting client. While using isolated browsing it is recommended to disable ad blocking extensions.
-
 ## Device / Browser support
 
 - Modern Chromium, Google Chrome, Mozilla Firefox, Safari, Edge (Chromium) and Opera are supported.
@@ -39,7 +31,7 @@ We are still defining our minimum requirements but expect Browser Isolation to w
 
 ### Safari
 
-Safari's default configuration is susceptible to "[Maximum Sessions Reached](/faq/browser-isolation#why-do-i-see-a-maximum-sessions-reached)" alerts. To workaround this behaviour open Safari → Preferences → Privacy and uncheck **Prevent cross-site tracking**.
+Safari's default configuration is susceptible to "[Maximum Sessions Reached](/faq/teams-troubleshooting#i-see-a-maximum-sessions-reached-alert)" alerts. To workaround this behaviour open Safari → Preferences → Privacy and uncheck **Prevent cross-site tracking**.
 
 ## Submitting feedback
 
diff --git a/products/cloudflare-one/src/content/connections/connect-browsers/third-party-cookies.md b/products/cloudflare-one/src/content/connections/connect-browsers/third-party-cookies.md
new file mode 100644
index 00000000000..f3942f02289
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-browsers/third-party-cookies.md
@@ -0,0 +1,46 @@
+---
+order: 3
+pcx-content-type: how-to
+hidden: true
+---
+
+# Enable third-party cookies
+
+Browser Isolation currently depends on third-party cookies to maintain a short-lived session between your local browser and the remote isolated browser.
+
+Each web browser treats third-party cookies differently, and some browsers (for example, Chrome and Firefox) may only present this error while incognito / private browsing mode is active. Depending on how your browser is configured, you may need to enable third-party cookies to access isolated websites.
+
+Follow these instructions to enable third-party cookies in your browser:
+
+## Chrome (Incognito mode)
+
+1. Open Chrome.
+1. At the top right, click the three-dot menu and go to **Settings**.
+1. Scroll down to **Privacy and security**, click **Cookies and other site data**.
+1. Click **See all cookies and site data** > **Remove all**.
+1. Confirm by clicking **Clear all**.
+
+## Firefox (Private Browsing mode)
+
+1. Open Firefox.
+1. Click **Tools** > **Options**.
+1. Click **Privacy** in the top panel.
+1. Select the checkbox labeled *Accept cookies from sites*.
+1. Select the checkbox labeled *Accept third-party cookies*.
+1. Click **OK**.
+
+## Safari
+
+1. Open Safari.
+1. Go to **Preferences** > **Privacy**.
+1. Under the **Cookies and website data** section, un-select both:
+    * Prevent cross-site tracking
+    * Block all cookies
+1. Close the Preferences window.
+
+## Brave
+
+1. Open Brave.
+1. Click the menu and go to **Settings**.
+1. Go to **Additional settings** > **Privacy and Security** > **Cookies and other site data**.
+1. Click **Allow all cookies**.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md
index d44b4699ae2..83e5bb951a2 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-https.md
@@ -1,11 +1,14 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # DNS over HTTPS
 
 ## Browser
 
+Browsers can be configured to use any DoH endpoint. If you choose to configure DoH directly in your browser, you must choose a Gateway location as your DoH endpoint, otherwise Gateway DNS filtering will not occur in that browser. 
+
 ### Firefox
 
 <TableWrap>
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md
index a4bb1c3f7ff..9ab0ccc444a 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/agentless/dns-over-tls.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # DNS over TLS
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md
index 5ad6ba9e53e..1fe64576616 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/agentless/index.md
@@ -1,7 +1,14 @@
 ---
 order: 2
+pcx-content-type: navigation
 ---
 
 # Agentless options
 
+<Aside type="Warning">
+
+Enrolling devices using static IP addresses may prevent users from connecting to some public Wi-Fi networks that use captive portals.
+
+</Aside>
+
 <DirectoryListing path="/connections/connect-devices/agentless"/>
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/linux.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/linux.md
deleted file mode 100644
index bf0f9399594..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/linux.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-order: 2
-hidden: true
----
-
-# Linux
-
-## Ubuntu
-
-### IPv4
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **Edit**.
-4. Click **IPv4**.  
-Remove any IP addresses that may already be listed.
-6. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-7. Click **Apply**.
-
-### IPv6
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **IPv6**.
-4. Add the IPv6 address from that we listed based on your location configuration
-5. Click **Apply**.
-
-## Debian
-
-### IPv4
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Press the **i** key on your keyboard to edit the document
-3. Replace the nameserver lines with:
-    * **172.64.36.1**
-    * **172.64.36.2**
-4. Press the **ESC** key on your keyboard to save and exit vim.
-5. Type `:wq`.
-
-### IPv6
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Add the IPv6 address from that we listed based on your location configuration.
-3. Press the **ESC** key on your keyboard to save and exit vim.
-4. Type `:wq`.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/mac.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/mac.md
deleted file mode 100644
index 6f491e48b38..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/mac.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-order: 1
-hidden: true
----
-
-# Mac
-
-## IPv4
-1. Go to **System Preferences** > **Network**.
-2. Click **Advanced**.
-3. Select the **DNS** tab, and remove any IP addresses that may be already listed.
-4. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-5. Click **OK**.
-6. Click **Apply**.
-
-## IPv6
-
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to the **Locations** tab.
-2. Expand your location by clicking on it.
-3. Note the **IPv6 address**.
-4. On your computer, go to **System Preferences** > **Network**.
-5. Click **Advanced**.
-6. Select the **DNS** tab, and remove any IP addresses that may already be listed.
-7. Add the **IPv6 address** you got from your location card.
-8. Click **OK**.
-9. Click **Apply**.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md
index fa63ade5f28..f1e9d6cbe17 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/agentless/native-os.md
@@ -1,9 +1,21 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Native OS
 
+<Aside type="Warning" header="Warning">
+
+Enrolling devices using static IP addresses may prevent users from connecting to some of the public Wi-Fi networks that use captive portals. If users are experiencing connectivity issues related to captive portals, they should:
+1. Remove the static IP addresses from the device.
+1. Connect to the Wi-Fi network.
+1. Once the connection has been established, add the static IP addresses back.
+
+Alternatively, you can look into using the [WARP client](/connections/connect-devices) to connect your devices to Teams.
+
+</Aside>
+
 ## Linux
 
 ### Ubuntu
@@ -92,4 +104,4 @@ Remove any IP addresses that may already be listed.
 7. Click **Properties**.
 8. Click **Use The Following DNS Server Addresses**.
 9. Add the IPv6 address that we listed based on your location configuration
-10. Click **OK**.
\ No newline at end of file
+10. Click **OK**.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/router.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/router.md
index 8fb0a890160..5529c979bd8 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/router.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/agentless/router.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # Router setup
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/agentless/windows.md b/products/cloudflare-one/src/content/connections/connect-devices/agentless/windows.md
deleted file mode 100644
index 49909e1fd65..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/agentless/windows.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-order: 0
-hidden: true
----
-
-# Windows
-
-## IPv4
-1. Click on **Start** menu, then click on Control Panel.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 4**.
-7. Click **Properties**.
-8. Remove any IP addresses that may be already listed and add the following IP addresses in their place:
-    * **172.64.36.1**
-    * **172.64.36.2**
-9. Click **OK**.
-
-## IPv6
-1. Click on **Start** > **Control Panel**.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 6**.
-7. Click **Properties**.
-8. Click **Use The Following DNS Server Addresses**.
-9. Add the IPv6 address that we listed based on your location configuration
-10. Click **OK**.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/index.md b/products/cloudflare-one/src/content/connections/connect-devices/index.md
index cfb30adc5ac..27b36056a6d 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: navigation
 ---
 
 # Connect devices
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/control-proxy.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/control-proxy.md
deleted file mode 100644
index 8cf72fc5b6e..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/control-proxy.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-order: 0
----
-
-# Control proxy settings
-
-You can use the Cloudflare for Teams dashboard to control the proxy settings of your deployment.
-
-## Enable the proxy
-
-Once devices have enrolled in your account, via user action or administrator deployment, you must enable the proxy to begin inspecting HTTP traffic.
-
-<Aside>
-
-Ensure the Cloudflare root certificate has been installed first to avoid breaking user Internet connections.
-
-</Aside>
-
-Navigate to the **Settings** tab of the `Policies` page in the Gateway section of the Cloudflare for Teams dashboard. Toggle the `Proxy Settings` value to be "Enabled".
-
-![Enable Proxy](../../../static/documentation/connections/enable-proxy.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/Windows-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/Windows-Teams.md
deleted file mode 100644
index 24150177e30..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/Windows-Teams.md
+++ /dev/null
@@ -1,90 +0,0 @@
----
-order: 2
----
-
-# Windows
-
-<Aside>
-
-**Before you start**  
-
-Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for Windows and to download the Windows installer.
-
-Next, choose how you want to deploy the WARP Client in your organization:
-* [Automated configuration](#automated-install-via-command-prompt) (Intune, Command Prompt)
-* [Manual configuration](#manual-configuration), with end users manually configuring the client on their own device
-
-</Aside>
-
-## Automated configuration (Intune, Command Prompt)
-
-The WARP Client for Windows allows for an automated install via tools like Intune, AD, or any script or management tool that can execute a `.msi` file.
-
-* Example command line to **install** the client:
-
- ```
- Cloudflare_WARP_Release-x64.msi /quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" ENABLE="true" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"
- ```
- See the [deployment parameters](/connections/connect-devices/warp/deployment/parameters) for a description of each argument.
-
-* Example command line to **uninstall** the client:
-
- ```
- msiexec /x Cloudflare_WARP_Release-x64.msi /quiet
- ```
-
-### Example configuration with Microsoft Intune
-Below are the minimum required steps to deploy Cloudflare WARP with Intune:
-
-1. Login to your Microsoft Intune account.
-1. Navigate to **Apps** > **All Apps**.
-1. Click **+Add**.
-1. As **App type**, select *Line-of-business app* from the drop-down menu.
-1. Click **Select**.
-1. Click **Select app package file** and upload the ```Cloudflare_WARP_Release-x64.msi``` installer you downloaded previously.
-1. Click **OK**.
-1. In the **Name** field, we recommend entering the version number of the package being uploaded.
-1. In the **Publisher** field, we recommend entering `Cloudflare, Inc`.
-1. In the **Command-line arguments** field enter a valid set of command line arguments as describe above
-    - Example: `/quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" ENABLE="true" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"`
-1. You don't need to fill other optional fields. Once you've entered all the necessary values, click **Next**. 
-1. Add the users or groups who require Cloudflare WARP.
-1. Click **Next**.
-1. Review your configuration.
-1. Click **Create**.
-
-Intune is now configured to deploy the Cloudflare WARP Client.
-
-## Manual configuration
-
-If you plan to direct your users to manually download and configure the Cloudflare WARP Client application, they can do so in two ways, depending on your organization's Teams configuration:
-
-* If your organization uses Gateway DNS filtering, users will need to configure a [DoH subdomain](/glossary#doh-subdomain).
-* If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or Gateway L7 Filtering, users will need to [configure a Cloudflare for Teams device registration](#manually-configure-a-cloudflare-for-teams-device-registration).
-
-### Manually configure a Gateway DoH subdomain
-If your organization uses Gateway DNS filtering, you will need to instruct your users to configure the Gateway [DoH subdomain](/glossary#doh-subdomain) field.
-
-Then ask your users to complete the following steps:
-
-1. Click on the Cloudflare Logo in the System Tray.
-1. Select the gear icon.
-1. Next, click **Preferences**.
-1. Select the **Connection** tab.
-1. Enter a value for *Gateway DoH subdomain* (example: `fmxk762nrj`).
-1. Click **Save**.
-
-![Preferences UI in the connection tab with the Change button circled](../../../../static/documentation/connections/windows_GatewayButton.png)
-
-### Manually configure a Cloudflare for Teams device registration
-If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or is using the Gateway L7 Filtering and user or device-specific [Secure Web Gateway policies](/policies/filtering), your users will need to login to Cloudflare for Teams by following these instructions:
-
-1. Click on the Cloudflare Logo in the System Tray.
-1. Select the gear icon.
-1. Next, click **Preferences**.
-1. Select the **Account** tab.
-1. Click **Login with Cloudflare for Teams**.
-1. Enter your [team name](/glossary#team-name).
-1. Complete the authentication steps required by your organization.
-
-![Preferences UI in the Account tab with the Login to Teams button circled](../../../../static/documentation/connections/windows_TeamsButton.png)
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/android-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/android-Teams.md
deleted file mode 100644
index 1bdf5ef925a..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/android-Teams.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-order: 5
----
-
-# Android
-
-<Aside>
-
-**Before you start**  
-
-Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for Android and to download the Android installer.
-
-Next, choose how you want to deploy the WARP Client in your organization:
-* [Automated configuration](#automated-configuration) via command prompt
-* [Manual configuration](#manual-configuration), with end users manually configuring the client on their own device
-
-</Aside>
-
-## Automated configuration
-
-The Cloudflare WARP Android client (known in the Google Play store as [1.1.1.1: Faster & Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone&hl=en&gl=US)) allows for an automated install via tools like Intune, Google Endpoint Manager, and others.
-
-Accepted configuration values are as follows:
-
-```xml
-<key>organization</key>
-<string>yourorganization</string>
-<key>enable</key>
-<true />
-<key>gateway_unique_id</key>
-<string>your_gateway_doh_subdomain</string>
-<key>service_mode</key>
-<string>warp</string>
-<key>support_url</key>
-<string>https://support.example.com</string>
-```
-See the [deployment parameters](/connections/connect-devices/warp/deployment/parameters) for a description of each value.
-
-Cloudflare WARP (known in the Google Play store as [1.1.1.1: Faster & Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone&hl=en&gl=US)) is deployed
-
-## Manual configuration
-
-If you plan to direct your users to manually download and configure the Cloudflare WARP Client application, they can do so in two ways, depending on your organization's Teams configuration:
-* If your organization uses Gateway DNS filtering, users will need to manually configure a [DoH subdomain](/glossary#doh-subdomain).
-* If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or Gateway L7 Filtering, users will need to [configure a Cloudflare for Teams device registration](#manually-configure-a-cloudflare-for-teams-device-registration).
-
-### Manually configure a Gateway DoH subdomain
-If your organization uses Gateway DNS filtering, you will need to instruct your users to configure the Gateway [DoH subdomain](/glossary#doh-subdomain) field. 
-
-Then ask your users to complete the following steps:
-
-1. Fine the **1.1.1.1** application and tap to launch.
-1. Tap the **menu bar icon** (3 lines) in the upper right.
-1. Tap **Advanced**.
-1. Tap **Connection options**.
-1. Tap **DNS settings**.
-1. Enter a DoH Sub Domain and tap **Back** until you are back at the home screen.
-
-### Manually configure a Cloudflare for Teams device registration
-If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or is using the Gateway L7 Filtering and user or device specific Gateway policies, your users will need to login to Cloudflare for Teams by following these instructions:
-
-1. Fine the **1.1.1.1** application and tap to launch.
-1. Tap the **menu bar icon** (3 lines) in the upper right.
-1. Tap **Account**.
-1. Tap **Login with Cloudflare for Teams**.
-1. Enter your [team name](/glossary#team-name).
-1. Complete authentication steps required by your organization.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/firewall.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/firewall.md
index 464f6380c0d..bd2f9cf71c2 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/firewall.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/firewall.md
@@ -1,24 +1,19 @@
 ---
 order: 10
+pcx-content-type: reference
 ---
+
 # WARP with Firewall
+
 If your organization uses a firewall or other policies to restrict Internet traffic, you may need to make a few changes to allow WARP to connect.
 
 ## WARP Ingress IP
 These are the IP addresses that the WARP client will connect to. All traffic from your device to the Cloudflare edge will go through these IP addresses.
-- IPv4 Range: 162.159.192.0/24
-- IPv6 Range: 2606:4700:d0::/48
-
-
-<Aside>
-
-**Ingress IP's changing**
-In late May 2021 the ingress change for Cloudflare for Teams WARP Customers will change. The new range will be 162.159.193.0/24 and 2606:4700:100::/48
-
-</Aside>
+- IPv4 Range: 162.159.193.0/24
+- IPv6 Range: 2606:4700:100::/48
 
 ## UDP Ports
-WARP utilizes UDP for all of its communications. UDP Port required for WARP: UDP 2408. 
+WARP utilizes UDP for all of its communications. By default, the UDP Port required for WARP is: UDP 2408. WARP can fallback to: UDP 500, UDP 1701, or UDP 4500.
 
 ## Creating firewall rules
 If your organization does not currently allow Inbound/Outbound communication over the IP addresses and ports described above you must manually add an exception. The rule at a minimum needs to be scoped to the following process based on your platform:
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/iOS-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/iOS-Teams.md
deleted file mode 100644
index be0533b376d..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/iOS-Teams.md
+++ /dev/null
@@ -1,88 +0,0 @@
----
-order: 4
----
-
-# iOS
-
-<Aside>
-
-**Before you start**  
-
-Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for iOS and to download the iOS installer.
-
-Next, choose how you want to deploy the WARP Client in your organization:
-* [Automated configuration](#automated-configuration) via command prompt
-* [Manual configuration](#manual-configuration), with end users manually configuring the client on their own device
-
-</Aside>
-
-## Automated configuration
-
-The Cloudflare WARP iOS client, known in the App Store as [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), allows for an automated install via tools like Jamf, Intune, or SimpleMDM.
-
-To proceed with the installation, here is an example of the XML code you will need, with the accepted arguments: 
-
-```xml
-<dict>
-    <key>organization</key>
-    <string>yourorganization</string>
-    <key>auto_connect</key> 
-    <integer>1</integer>
-    <key>switch_locked</key> 
-    <false />
-    <key>service_mode</key>
-    <string>warp</string>
-    <key>support_url</key>
-    <string>https://support.example.com</string>
-</dict>
-```
-For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/parameters).
-
-### Example Configuration in Jamf
-Follow these steps to deploy the WARP Client via Jamf:
-
-#### Upload the package
-1. Login to your `jamfcloud.com` account.
-1. Navigate to **Devices**.
-1. Click the **Mobile Device Apps**.
-1. Click **+ New**.
-1. Select *App store app or apps purchased in volume*.
-1. Click **Next**.
-1. In the search box, enter: *1.1.1.1: Faster Internet*.
-1. Click **Next**.
-1. Click **Add** in the row for *1.1.1.1: Faster Internet by Cloudflare Inc.*. To verify it's the correct application, click on this [link](https://apps.apple.com/us/app/id1423538627).
-1. Navigate to **Scope**.
-1. Specify the devices in your organization that should receive the application.
-1. Navigate to **App Configuration** and copypaste the XML from above.
-1. Make sure you modify the default XML values to match your Cloudflare for Teams deployment.
-1. Click **Save**.
-
-Jamf is now configured to deploy the Cloudflare WARP Client.
-
-## Manual Configuration
-
-If you plan to direct your users to manually download and configure the Cloudflare WARP Client application, they can do so in two ways, depending on your organization's Teams configuration:
-* If your organization uses Gateway DNS filtering, users will need to configure a [DoH subdomain](/glossary#doh-subdomain).
-* If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or Gateway L7 Filtering, users will need to [configure a Cloudflare for Teams device registration](#manually-configure-a-cloudflare-for-teams-device-registration).
-
-### Manually configure a Gateway DoH subdomain
-If your organization uses Gateway DNS filtering, you will need to instruct your users to configure the Gateway [DoH subdomain](/glossary#doh-subdomain) field. 
-
-Then ask your users to complete the following steps:
-
-1. Find the **1.1.1.1** application and tap to launch.
-1. Tap the **menu bar icon** (3 lines) in the upper right corner.
-1. Tap **Advanced**.
-1. Tap **Connection options**.
-1. Tap **DNS settings**.
-1. Enter the DoH Sub Domain and tap **Back** until you are back at the home screen.
-
-### Manually configure a Cloudflare for Teams device registration
-If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or is using the Gateway L7 Filtering and user or device specific [Secure Web Gateway policies](/policies/filtering), your users will need to login to Cloudflare for Teams by following these instructions:
-
-1. Find the **1.1.1.1** application and tap to launch.
-1. Tap the **menu bar icon** (3 lines) in the upper right.
-1. Tap **Account**.
-1. Tap **Login with Cloudflare for Teams**.
-1. Enter your [team name](/glossary#team-name).
-1. Complete the authentication steps required by your organization.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md
index 5c5c1c53f44..51f38442dbb 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/index.md
@@ -1,23 +1,15 @@
 ---
-order: 1
+order: 2
+pcx-content-type: how-to
+title: Deploy WARP
 ---
 
-# Deployment
+# Deploy WARP to your organization
 
-The Cloudflare WARP client can be deployed via a device management platform like JAMF or InTune or through end user self-enrollment.
+Depending on how your organization is structured, you can deploy WARP in one of two ways:
 
-To get started, you'll first need to create a **device enrollment policy** in your Teams dashboard. The device enrollment policy will determine who can enroll a device into your organization. To do so:
+* [Manual deployment](/connections/connect-devices/warp/deployment/manual-deployment). If you are a small organization, asking your users to download the client themselves and type in the required settings is the ideal way to get started with WARP.
 
-1. Make sure you've set up a [team domain](/glossary#team-domain). You can find your team domain under **Configuration > Authentication > Team domain**.
+* [Managed deployment](/connections/connect-devices/warp/deployment/mdm-deployment). Bigger organizations with MDM tools like Intune or JAMF can deploy WARP to their entire fleet of devices from a single operation.
 
-1. On your [Teams dashboard](https://dash.teams.cloudflare.com/), navigate to **My Team** > **Devices**.
 
-1. Under **Device enrollment**, create a [device enrollment policy](/connections/connect-devices/warp/device-enrollment) to define who can connect a device to your organization.
-
-1. Once your device enrollment policy is set up, configure [Secure Web Gateway policies](/policies/filtering) for your organization. If you are configuring [HTTP policies](/policies/filtering/http-policies), make sure to deploy the [root certificate](/connections/connect-devices/warp/install-cloudflare-cert) to your devices. 
-
-1. As a last step, verify your devices meet the WARP [system requirements](../download-warp) for installation.
-
-You're now ready to follow the deployment instructions for your devices.
-
-<DirectoryListing path="/connections/warp/deployment"/>
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/macOS-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/macOS-Teams.md
deleted file mode 100644
index f497064f6cb..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/macOS-Teams.md
+++ /dev/null
@@ -1,203 +0,0 @@
----
-order: 3
----
-
-# macOS
-
-<Aside>
-
-**Before you start**  
-
-Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for macOS and to download the macOS installer.
-
-Next, choose how you want to deploy the WARP Client in your organization:
-* [Automated configuration](#automated-configuration) (Jamf, Intune, Script)
-* [Manual configuration](#manual-configuration), with end users manually configuring the client on their own device
-
-</Aside>
-
-## Automated configuration (Jamf, Intune, Script)
-
-The Cloudflare WARP macOS client allows for an automated install via tools like Jamf, Intune, Kandji, or JumpCloud or any script or management tool that can place a `com.cloudflare.warp.plist` file in `/Library/Managed Preferences` on a supported macOS device. Additionally this plist can be wrapped in a `.mobileconfig`.
-
-Here is an example plist file with the accepted arguments: 
-
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>organization</key>
-    <string>yourorganization</string>
-    <key>auto_connect</key> 
-    <integer>1</integer>
-    <key>switch_locked</key> 
-    <false />
-    <key>service_mode</key>
-    <string>warp</string>
-    <key>support_url</key>
-    <string>https://support.example.com</string>
-</dict>
-</plist>
-```
-
-Here is an example `.mobileconfig` file with the accepted arguments:
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-<key>PayloadContent</key>
-<array/>
-<key>PayloadDisplayName</key>
-<string>Cloudflare WARP</string>
-<key>PayloadIdentifier</key>
-<string>cloudflare_warp</string>
-<key>PayloadOrganization</key>
-<string>Cloudflare, Ltd.</string>
-<key>PayloadRemovalDisallowed</key>
-<false/>
-<key>PayloadType</key>
-<string>Configuration</string>
-<key>PayloadUUID</key>
-<string>F5046847-2B1C-4DA0-A872-F6E040B1B20E</string>
-<key>PayloadVersion</key>
-<integer>1</integer>
-    <key>PayloadContent</key>
-    <array>
-        <dict>
-            <key>PayloadDisplayName</key>
-            <string>Custom</string>
-            <key>PayloadIdentifier</key>
-            <string>com.cloudflare.warp</string>
-            <key>PayloadOrganization</key>
-            <string>Cloudflare Ltd.</string>
-            <key>PayloadType</key>
-            <string>com.apple.ManagedClient.preferences</string>
-            <key>PayloadUUID</key>
-            <string>C2575334-358E-4925-8B29-30B4348D31E3</string>
-            <key>PayloadVersion</key>
-            <integer>1</integer>
-            <key>PayloadEnabled</key>
-            <true/>
-            <key>PayloadContent</key>
-            <dict>
-                <key>com.cloudflare.warp</key>
-                <dict>
-                    <key>Forced</key>
-                    <array>
-                        <dict>
-                            <key>mcx_preference_settings</key>
-                            <dict>
-                                <key>organization</key>
-                                <string>yourorganization</string>
-                                <key>auto_connect</key> 
-                                <integer>1</integer>
-                                <key>switch_locked</key> 
-                                <false />
-                                <key>service_mode</key>
-                                <string>warp</string>
-                                <key>support_url</key>
-                                <string>https://support.example.com</string>
-                            </dict>
-                        </dict>
-                    </array>
-                </dict>
-            </dict>
-        </dict>
-    </array>
-</dict>
-</plist>
-
-```
-
-For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/parameters).
-
-[Click here](../../../../static/documentation/connections/com.cloudflare.warp.plist) to download this example plist. If you manually plan to download the plist file and place it in `/Library/Managed Preferences`, convert the plist into into binary format first. To do that:
-1. Open a Terminal window.
-2. Run the following command:
-
- ```
- % plutil -convert binary1 com.cloudflare.warp.plist
- ```
-
-[Click here](../../../../static/documentation/connections/CloudflareWARP.mobileconfig) to download this example `.mobileconfig`. Before doing so, you may need to run `uuidgen` from your macOS terminal. This will generate a value for `PayloadUUID`, which you can use to replace the default value used for `PayloadUUID` in the example above.
-
-### Example configuration in Jamf
-
-With Jamf, the WARP Client deployment is performed in three distinct steps: 
-1. Upload the WARP Client `pkg` file.
-1. Create a policy that deploys the WARP Client `pkg` file.
-1. Create a configuration profile with the settings you want pushed down. 
-
-The following sections will walk you through each of these steps.
-
-#### Upload the package
-1. Login to your `jamfcloud.com` account.
-1. Navigate to **Computer**.
-1. Click the **All Settings** (gear) in the upper right corner.
-1. Click **Computer Management**.
-1. Click **Packages**.
-1. Select **New**.
-1. Upload the `Cloudflare_WARP.pkg` file.
-  For *Display name*, we recommend entering the version number of the package being uploaded.
-1. Click **Save** to complete the upload.
-
-#### Create the policy
-1. Select **Computers** > **Policies** on the menu to your left.
-1. Click **+ New**.
-1. Enter a Display name such as "Cloudflare WARP Client".  
- For *Triggers*, our recommendation is to select *Startup*, *Login*, *Enrollment Complete* and *Recurring Check-in*, but you can select the value that works best for your organization.
-1. Navigate to **Packages**.
-1. Click **Configure**.
-1. Click **Add** next to the package you previously uploaded.
-1. Click **Save**.
-
-#### Add Configuration Profile
-1. Navigate to **Configuration Profiles**.
-1. Click **New**.
-1. Enter a name for your new profile, such as *Cloudflare for Teams*.
-1. Scroll down the options list and click on **Application & Custom Settings**.
-1. Click **Configure**.
-1. In *Preference Domain*, enter `com.cloudflare.warp`.
-1. Upload a valid plist file. You can start with our example above and modify for your organization.
-1. Click **Save**.
-1. Navigate to **Scope** to configure which devices in your organization should receive this profile.
-1. Click **Save**.
-
-Jamf is now configured to deploy the Cloudflare WARP Client.
-
-## Manual configuration
-
-If you plan to direct your users to manually download and configure the Cloudflare WARP Client application, they can do so in two ways, depending on your organization's Teams configuration:
-* If your organization uses Gateway DNS filtering, users will need to configure a [DoH subdomain](/glossary#doh-subdomain)).
-* If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or Gateway L7 Filtering, users will need to [configure a Cloudflare for Teams device registration](#manually-configure-a-cloudflare-for-teams-device-registration).
-
-### Manually configure a Gateway DoH subdomain
-If your organization uses Gateway DNS filtering, you will need to instruct your users to configure the Gateway [DoH subdomain](/glossary#doh-subdomain) field.
-
-Then ask your users to complete the following steps:
-
-1. Click on the Cloudflare Logo in the Menu Bar.
-1. Select the gear icon.
-1. Navigate to **Preferences**.
-1. Select the **Connect** tab.
-1. Click **Change** next to *Gateway DoH Subdomain*, and enter your DoH Subdomain.
-
-![Preferences UI in the connection tab with the Change button circled](../../../../static/documentation/connections/macOS_GatewayButton.png)
-
-### Manually configure a Cloudflare for Teams device registration
-If your organization uses [Zero Trust policies](/policies/zero-trust) to control device registration, or is using the Gateway L7 Filtering and user or device-specific [Secure Web Gateway policies](/policies/filtering), your users will need to login to Cloudflare for Teams by following these instructions:
-
-1. Click on the Cloudflare Logo in the Menu Bar.
-2. Select the gear icon.
-3. Navigate to **Preferences**.
-4. Select the **Account** tab.
-5. Click **Login with Cloudflare for Teams**.
-
- ![Preferences UI in the Account tab with the Login to Teams button circled](../../../../static/documentation/connections/macOS_TeamsButton.png)
-
-6. Enter your [team name](/glossary#team-name).
-7. Complete the authentication steps required by your organization.
-
-
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/manual-deployment.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/manual-deployment.md
new file mode 100644
index 00000000000..4adfb379beb
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/manual-deployment.md
@@ -0,0 +1,30 @@
+---
+order: 0
+pcx-content-type: how-to
+---
+
+# Manual deployment
+
+If you plan to direct your users to manually download and configure the WARP client, users will need to connect the client to your organization's Cloudflare for Teams instance.
+
+## On desktop
+
+End users will need to log in to Cloudflare for Teams by following these instructions:
+
+1. Click on the Cloudflare logo in the menu bar.
+1. Click the gear icon.
+1. Navigate to **Preferences** > **Account**.
+1. Click **Login with Cloudflare for Teams**.
+1. Enter your [team name](/glossary#team-name).
+1. Complete the authentication steps required by your organization.
+
+## On mobile devices
+
+End users will need to log in to Cloudflare for Teams by following these instructions:
+
+1. Find the 1.1.1.1 application and tap to launch it.
+1. Tap the menu bar icon.
+1. Tap **Account**.
+1. Tap **Login with Cloudflare for Teams**.
+1. Enter your [team name](/glossary#team-name).
+1. Complete the authentication steps required by your organization.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/Windows-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/Windows-Teams.md
new file mode 100644
index 00000000000..1cbda0ee618
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/Windows-Teams.md
@@ -0,0 +1,54 @@
+---
+order: 2
+pcx-content-type: how-to
+---
+
+# Windows
+
+<Aside>
+
+**Before you start**  
+
+Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for Windows and to download the Windows installer.
+
+If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/connections/connect-devices/warp/deployment/manual-deployment).
+
+</Aside>
+
+The WARP Client for Windows allows for an automated install via tools like Intune, AD, or any script or management tool that can execute a `.msi` file.
+
+* Example command line to **install** the client:
+
+ ```
+ Cloudflare_WARP_Release-x64.msi /quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"
+ ```
+ See the [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters) for a description of each argument.
+
+* Example command line to **uninstall** the client:
+
+ ```
+ msiexec /x Cloudflare_WARP_Release-x64.msi /quiet
+ ```
+
+### Example configuration with Microsoft Intune
+
+Below are the minimum required steps to deploy Cloudflare WARP with Intune:
+
+1. Login to your Microsoft Intune account.
+1. Navigate to **Apps** > **All Apps**.
+1. Click **+Add**.
+1. As **App type**, select *Line-of-business app* from the drop-down menu.
+1. Click **Select**.
+1. Click **Select app package file** and upload the ```Cloudflare_WARP_Release-x64.msi``` installer you downloaded previously.
+1. Click **OK**.
+1. In the **Name** field, we recommend entering the version number of the package being uploaded.
+1. In the **Publisher** field, we recommend entering `Cloudflare, Inc`.
+1. In the **Command-line arguments** field enter a valid set of command line arguments as describe above
+    - Example: `/quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"`
+1. You don't need to fill other optional fields. Once you've entered all the necessary values, click **Next**. 
+1. Add the users or groups who require Cloudflare WARP.
+1. Click **Next**.
+1. Review your configuration.
+1. Click **Create**.
+
+Intune is now configured to deploy the Cloudflare WARP Client
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/android-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/android-Teams.md
new file mode 100644
index 00000000000..c0fb9f58074
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/android-Teams.md
@@ -0,0 +1,34 @@
+---
+order: 5
+pcx-content-type: how-to
+---
+
+# Android
+
+<Aside>
+
+**Before you start**  
+
+Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for Android and to download the Android installer.
+
+If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/connections/connect-devices/warp/deployment/manual-deployment).
+
+</Aside>
+
+The Cloudflare WARP Android client (known in the Google Play store as [1.1.1.1: Faster & Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone&hl=en&gl=US)) allows for an automated install via tools like Intune, Google Endpoint Manager, and others.
+
+Accepted configuration values are as follows:
+
+```xml
+<key>organization</key>
+<string>yourorganization</string>
+<key>enable</key>
+<true />
+<key>gateway_unique_id</key>
+<string>your_gateway_doh_subdomain</string>
+<key>service_mode</key>
+<string>warp</string>
+<key>support_url</key>
+<string>https://support.example.com</string>
+```
+See the [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters) for a description of each value.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/iOS-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/iOS-Teams.md
new file mode 100644
index 00000000000..70ab5f92049
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/iOS-Teams.md
@@ -0,0 +1,57 @@
+---
+order: 4
+pcx-content-type: how-to
+---
+
+# iOS
+
+<Aside>
+
+**Before you start**  
+
+Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for iOS and to download the iOS installer.
+
+If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/connections/connect-devices/warp/deployment/manual-deployment).
+
+</Aside>
+
+The Cloudflare WARP iOS client, known in the App Store as [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), allows for an automated install via tools like Jamf, Intune, or SimpleMDM.
+
+To proceed with the installation, here is an example of the XML code you will need, with the accepted arguments: 
+
+```xml
+<dict>
+    <key>organization</key>
+    <string>yourorganization</string>
+    <key>auto_connect</key> 
+    <integer>1</integer>
+    <key>switch_locked</key> 
+    <false />
+    <key>service_mode</key>
+    <string>warp</string>
+    <key>support_url</key>
+    <string>https://support.example.com</string>
+</dict>
+```
+For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+### Example Configuration in Jamf
+Follow these steps to deploy the WARP Client via Jamf:
+
+#### Upload the package
+1. Login to your `jamfcloud.com` account.
+1. Navigate to **Devices**.
+1. Click the **Mobile Device Apps**.
+1. Click **+ New**.
+1. Select *App store app or apps purchased in volume*.
+1. Click **Next**.
+1. In the search box, enter: *1.1.1.1: Faster Internet*.
+1. Click **Next**.
+1. Click **Add** in the row for *1.1.1.1: Faster Internet by Cloudflare Inc.*. To verify it's the correct application, click on this [link](https://apps.apple.com/us/app/id1423538627).
+1. Navigate to **Scope**.
+1. Specify the devices in your organization that should receive the application.
+1. Navigate to **App Configuration** and copypaste the XML from above.
+1. Make sure you modify the default XML values to match your Cloudflare for Teams deployment.
+1. Click **Save**.
+
+Jamf is now configured to deploy the Cloudflare WARP client.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/index.md
new file mode 100644
index 00000000000..a97493aaa22
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/index.md
@@ -0,0 +1,28 @@
+---
+order: 1
+pcx-content-type: how-to
+---
+
+# Managed deployment
+
+Bigger organizations with MDM tools like Intune or JAMF can deploy WARP to their entire fleet of devices from a single operation.
+
+---
+
+## Scripted deployment
+
+The WARP client for Windows allows for an automated install via any management tool that can execute an `.msi` file.
+
+* Example command line to **install** the client:
+
+ ```txt
+ Cloudflare_WARP_Release-x64.msi /quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"
+ ```
+ 
+ Refer to the [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters) for a description of each argument.
+
+* Example command line to **uninstall** the client:
+
+ ```txt
+ msiexec /x Cloudflare_WARP_Release-x64.msi /quiet
+ ```
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/intune.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/intune.md
new file mode 100644
index 00000000000..080fe440d98
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/intune.md
@@ -0,0 +1,178 @@
+---
+order: 1
+hidden: true
+---
+
+# Intune
+
+## Windows
+
+1. Log in to your Microsoft Intune account.
+1. Navigate to **Apps** > **All Apps**.
+1. Click **+Add**.
+1. In **App type**, select *Line-of-business app* from the drop-down menu.
+1. Click **Select**.
+1. Click **Select app package file** and upload the `Cloudflare_WARP_Release-x64.msi` installer you downloaded previously.
+1. Click **OK**.
+1. In the **Name** field, we recommend entering the version number of the package being uploaded.
+1. In the **Publisher** field, we recommend entering `Cloudflare, Inc`.
+1. In the **Command-line arguments** field, enter a valid set of command-line arguments as described above.
+    - Example: `/quiet ORGANIZATION="exampleorg" SERVICE_MODE="warp" GATEWAY_UNIQUE_ID="fmxk762nrj" SUPPORT_URL="http://support.example.com"`
+1. You do not need to fill other optional fields. Once you have entered all the necessary values, click **Next**. 
+1. Add the users or groups who require Cloudflare WARP.
+1. Click **Next**.
+1. Review your configuration.
+1. Click **Create**.
+
+Intune is now configured to deploy the WARP client.
+
+## iOS
+
+The WARP client, known in the App Store as [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), allows for an automated install via Intune.
+
+To proceed with the installation, here is an example of the XML code you will need, with the accepted arguments: 
+
+```xml
+<dict>
+    <key>organization</key>
+    <string>yourorganization</string>
+    <key>auto_connect</key> 
+    <integer>1</integer>
+    <key>switch_locked</key> 
+    <false />
+    <key>service_mode</key>
+    <string>warp</string>
+    <key>support_url</key>
+    <string>https://support.example.com</string>
+</dict>
+```
+
+For a description of each argument and what it means, refer to the [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+## Android
+
+The WARP client, known in the Google Play store as [1.1.1.1: Faster & Safer Internet](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone&hl=en&gl=US), allows for an automated install via Intune.
+
+To proceed with the installation, here is an example of the XML code you will need, with the accepted arguments:
+
+```xml
+<key>organization</key>
+<string>yourorganization</string>
+<key>enable</key>
+<true />
+<key>gateway_unique_id</key>
+<string>your_gateway_doh_subdomain</string>
+<key>service_mode</key>
+<string>warp</string>
+<key>support_url</key>
+<string>https://support.example.com</string>
+```
+
+Refer to the [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters) for a description of each value.
+
+## MacOS
+
+The Cloudflare WARP client allows for an automated install via tools like Jamf, Intune, Kandji, or JumpCloud or any script or management tool that can place a `com.cloudflare.warp.plist` file in `/Library/Managed Preferences` on a supported macOS device. Additionally, this `plist` can be wrapped in a `.mobileconfig`.
+
+Here is an example `plist` file with the accepted arguments: 
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>organization</key>
+        <string>yourorganization</string>
+        <key>auto_connect</key> 
+        <integer>1</integer>
+        <key>switch_locked</key> 
+        <false />
+        <key>service_mode</key>
+        <string>warp</string>
+        <key>support_url</key>
+        <string>https://support.example.com</string>
+    </dict>
+</plist>
+```
+
+Here is an example `.mobileconfig` file with the accepted arguments:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+    <key>PayloadContent</key>
+    <array/>
+    <key>PayloadDisplayName</key>
+    <string>Cloudflare WARP</string>
+    <key>PayloadIdentifier</key>
+    <string>cloudflare_warp</string>
+    <key>PayloadOrganization</key>
+    <string>Cloudflare, Ltd.</string>
+    <key>PayloadRemovalDisallowed</key>
+    <false/>
+    <key>PayloadType</key>
+    <string>Configuration</string>
+    <key>PayloadUUID</key>
+    <string>F5046847-2B1C-4DA0-A872-F6E040B1B20E</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+        <key>PayloadContent</key>
+        <array>
+            <dict>
+                <key>PayloadDisplayName</key>
+                <string>Custom</string>
+                <key>PayloadIdentifier</key>
+                <string>com.cloudflare.warp</string>
+                <key>PayloadOrganization</key>
+                <string>Cloudflare Ltd.</string>
+                <key>PayloadType</key>
+                <string>com.apple.ManagedClient.preferences</string>
+                <key>PayloadUUID</key>
+                <string>C2575334-358E-4925-8B29-30B4348D31E3</string>
+                <key>PayloadVersion</key>
+                <integer>1</integer>
+                <key>PayloadEnabled</key>
+                <true/>
+                <key>PayloadContent</key>
+                <dict>
+                    <key>com.cloudflare.warp</key>
+                    <dict>
+                        <key>Forced</key>
+                        <array>
+                            <dict>
+                                <key>mcx_preference_settings</key>
+                                <dict>
+                                    <key>organization</key>
+                                    <string>yourorganization</string>
+                                    <key>auto_connect</key> 
+                                    <integer>1</integer>
+                                    <key>switch_locked</key> 
+                                    <false />
+                                    <key>service_mode</key>
+                                    <string>warp</string>
+                                    <key>support_url</key>
+                                    <string>https://support.example.com</string>
+                                </dict>
+                            </dict>
+                        </array>
+                    </dict>
+                </dict>
+            </dict>
+        </array>
+    </dict>
+</plist>
+```
+
+For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+[Click here to download](../../../../../static/documentation/connections/com.cloudflare.warp.plist) this example `plist`. If you plan to download the `plist` file and manually place it in `/Library/Managed Preferences`, convert the `plist` into binary format first. To do that:
+1. Open a Terminal window.
+2. Run the following command:
+
+ ```
+ % plutil -convert binary1 com.cloudflare.warp.plist
+ ```
+
+[Click here to download](../../../../../static/documentation/connections/CloudflareWARP.mobileconfig) this example `.mobileconfig`. Before doing so, you may need to run `uuidgen` from your macOS terminal. This will generate a value for `PayloadUUID`, which you can use to replace the default value used for `PayloadUUID` in the example above.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jamf.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jamf.md
new file mode 100644
index 00000000000..5a1b8c65fd1
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jamf.md
@@ -0,0 +1,191 @@
+---
+order: 1
+hidden: true
+---
+
+# Jamf
+
+## MacOS
+
+The Cloudflare WARP client allows for an automated install via tools like Jamf, Intune, Kandji, or JumpCloud or any script or management tool that can place a `com.cloudflare.warp.plist` file in `/Library/Managed Preferences` on a supported macOS device. Additionally, this plist can be wrapped in a `.mobileconfig`.
+
+Here is an example plist file with the accepted arguments: 
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>organization</key>
+        <string>yourorganization</string>
+        <key>auto_connect</key> 
+        <integer>1</integer>
+        <key>switch_locked</key> 
+        <false />
+        <key>service_mode</key>
+        <string>warp</string>
+        <key>support_url</key>
+        <string>https://support.example.com</string>
+    </dict>
+</plist>
+```
+
+Here is an example `.mobileconfig` file with the accepted arguments:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+    <key>PayloadContent</key>
+    <array/>
+    <key>PayloadDisplayName</key>
+    <string>Cloudflare WARP</string>
+    <key>PayloadIdentifier</key>
+    <string>cloudflare_warp</string>
+    <key>PayloadOrganization</key>
+    <string>Cloudflare, Ltd.</string>
+    <key>PayloadRemovalDisallowed</key>
+    <false/>
+    <key>PayloadType</key>
+    <string>Configuration</string>
+    <key>PayloadUUID</key>
+    <string>F5046847-2B1C-4DA0-A872-F6E040B1B20E</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+        <key>PayloadContent</key>
+        <array>
+            <dict>
+                <key>PayloadDisplayName</key>
+                <string>Custom</string>
+                <key>PayloadIdentifier</key>
+                <string>com.cloudflare.warp</string>
+                <key>PayloadOrganization</key>
+                <string>Cloudflare Ltd.</string>
+                <key>PayloadType</key>
+                <string>com.apple.ManagedClient.preferences</string>
+                <key>PayloadUUID</key>
+                <string>C2575334-358E-4925-8B29-30B4348D31E3</string>
+                <key>PayloadVersion</key>
+                <integer>1</integer>
+                <key>PayloadEnabled</key>
+                <true/>
+                <key>PayloadContent</key>
+                <dict>
+                    <key>com.cloudflare.warp</key>
+                    <dict>
+                        <key>Forced</key>
+                        <array>
+                            <dict>
+                                <key>mcx_preference_settings</key>
+                                <dict>
+                                    <key>organization</key>
+                                    <string>yourorganization</string>
+                                    <key>auto_connect</key> 
+                                    <integer>1</integer>
+                                    <key>switch_locked</key> 
+                                    <false />
+                                    <key>service_mode</key>
+                                    <string>warp</string>
+                                    <key>support_url</key>
+                                    <string>https://support.example.com</string>
+                                </dict>
+                            </dict>
+                        </array>
+                    </dict>
+                </dict>
+            </dict>
+        </array>
+    </dict>
+</plist>
+
+```
+
+For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+[Click here to download](../../../../../static/documentation/connections/com.cloudflare.warp.plist) this example `plist`. If you manually plan to download the plist file and place it in `/Library/Managed Preferences`, convert the plist into into binary format first. To do that:
+1. Open a Terminal window.
+1. Run the following command:
+
+ ```bash
+ % plutil -convert binary1 com.cloudflare.warp.plist
+ ```
+
+[Click here to download](../../../../../static/documentation/connections/CloudflareWARP.mobileconfig) this example `.mobileconfig`. Before doing so, you may need to run `uuidgen` from your macOS terminal. This will generate a value for `PayloadUUID`, which you can use to replace the default value used for `PayloadUUID` in the example above.
+
+### Upload the package
+
+1. Log in to your `jamfcloud.com` account.
+1. Navigate to **Computer**.
+1. Click **All Settings** (gear) in the upper right corner.
+1. Click **Computer Management**.
+1. Click **Packages**.
+1. Select **New**.
+1. Upload the `Cloudflare_WARP.pkg` file.
+  For *Display name*, we recommend entering the version number of the package being uploaded.
+1. Click **Save** to complete the upload.
+
+### Create the policy
+
+1. Select **Computers** > **Policies** on the menu on the left side.
+1. Click **+ New**.
+1. Enter a Display name such as `Cloudflare WARP Client`.  
+ For *Triggers*, our recommendation is to select *Startup*, *Login*, *Enrollment Complete* and *Recurring Check-in*, but you can select the value that works best for your organization.
+1. Navigate to **Packages**.
+1. Click **Configure**.
+1. Click **Add** next to the package you previously uploaded.
+1. Click **Save**.
+
+### Add a Configuration Profile
+
+1. Navigate to **Configuration Profiles**.
+1. Click **New**.
+1. Enter a name for your new profile, such as *Cloudflare for Teams*.
+1. Scroll through the options list and click on **Application & Custom Settings**.
+1. Click **Configure**.
+1. In *Preference Domain*, enter `com.cloudflare.warp`.
+1. Upload a valid plist file. You can start with our example above and modify it for your organization.
+1. Click **Save**.
+1. Navigate to **Scope** to configure which devices in your organization will receive this profile.
+1. Click **Save**.
+
+Jamf is now configured to deploy the Cloudflare WARP client.
+
+## iOS
+
+The WARP client, known in the App Store as [1.1.1.1: Faster Internet](https://apps.apple.com/us/app/1-1-1-1-faster-internet/id1423538627), allows for an automated install via Jamf.
+
+To proceed with the installation, here is an example of the XML code you will need, with the accepted arguments: 
+
+```xml
+<dict>
+    <key>organization</key>
+    <string>yourorganization</string>
+    <key>auto_connect</key> 
+    <integer>1</integer>
+    <key>switch_locked</key> 
+    <false />
+    <key>service_mode</key>
+    <string>warp</string>
+    <key>support_url</key>
+    <string>https://support.example.com</string>
+</dict>
+```
+For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+1. Log in to your `jamfcloud.com` account.
+1. Navigate to **Devices**.
+1. Click **Mobile Device Apps**.
+1. Click **+ New**.
+1. Select *App store app or apps purchased in volume*.
+1. Click **Next**.
+1. In the search box, enter: `1.1.1.1: Faster Internet`.
+1. Click **Next**.
+1. Click **Add** in the row for *1.1.1.1: Faster Internet by Cloudflare Inc.*. To verify that it is the correct application, [click on this App Store link](https://apps.apple.com/us/app/id1423538627).
+1. Navigate to **Scope**.
+1. Specify the devices in your organization that will receive the application.
+1. Navigate to **App Configuration** and copy/paste the XML from above.
+1. Make sure you modify the default XML values to match your Cloudflare for Teams deployment.
+1. Click **Save**.
+
+Jamf is now configured to deploy the WARP client.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jumpcloud.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jumpcloud.md
new file mode 100644
index 00000000000..1f14bb3da5a
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/jumpcloud.md
@@ -0,0 +1,65 @@
+---
+order: 1
+hidden: true
+---
+
+# JumpCloud
+
+## Windows
+
+1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com).
+1. Navigate to **Device Management** > **Software Management**.
+1. Select the *Windows* tab, then click (+).
+
+    ![JumpCloud Software Management for Windows](../../../../../static/documentation/connections/jumpcloud.png)
+
+1. Enter a unique display name in the *Software Name* field.
+1. Enter `warp` into the *Package ID* field.
+1. Select **Install this software**.
+1. (Optional) Select *Keep software package up to date* to automatically update this app as updates become available.
+1. (Optional) Select *Allow end users to delay updates for up to one week* to avoid updates during a busy time.
+1. Click **save**.
+
+### Deploy the client to a single MDM-managed device
+
+1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com).
+1. Navigate to **Device Management** > **Software Management**.
+1. Select the *Windows* tab and select the app you want to deploy.
+1. Select the *Devices* tab.
+1. Select the devices where you want to deploy the app.
+1. Click **save**.
+1. Click **save** again.
+
+### Deploy the client to an MDM-managed device group
+
+1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com).
+1. Navigate to **Device Management** > **Software Management**.
+1. Select the *Windows* tab and select the app you want to deploy.
+1. Select the *Device Groups* tab.
+1. Select the groups that you want to deploy the app to.
+1. Click **save**.
+1. Click **save** again.
+
+## Mac
+
+1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com).
+1. Navigate to **Device Management** > **Software Management**.
+1. Select the *Apple* tab, then click (+).
+
+    ![JumpCloud Software Management for Mac](../../../../../static/documentation/connections/jumpcloud.png)
+
+1. On the *Details* tab, enter a unique display name in **Software Description**.
+1. Add the app's URL location to **Software Package URL**.
+
+### Deploy the client to a single MDM-managed device
+
+1. Select the *Devices* tab.
+1. Select the devices where this app will be deployed. To select all devices, select the checkbox next to **Type**.
+1. Click **save** to install the client.
+Verify that Cloudflare was installed by selecting the app and selecting the Status tab.
+
+### Deploy the client to an MDM-managed device group
+
+1. Select the *Device Groups* tab.
+1. Select the groups where this app will be deployed. To select all device groups, select the checkbox next to **Type**.
+1. Click **save** to install the client.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/macOS-Teams.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/macOS-Teams.md
new file mode 100644
index 00000000000..e5dad2fc4a3
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/macOS-Teams.md
@@ -0,0 +1,167 @@
+---
+order: 3
+pcx-content-type: how-to
+---
+
+# macOS
+
+<Aside>
+
+**Before you start**  
+
+Visit the [requirements section](/connections/connect-devices/warp/download-warp) to review the system requirements for macOS and to download the macOS installer.
+
+If you want to deploy the WARP client manually, refer to the [instructions for manual deployment](/connections/connect-devices/warp/deployment/manual-deployment).
+
+</Aside>
+
+The Cloudflare WARP macOS client allows for an automated install via tools like Jamf, Intune, Kandji, or JumpCloud or any script or management tool that can place a `com.cloudflare.warp.plist` file in `/Library/Managed Preferences` on a supported macOS device. Additionally this plist can be wrapped in a `.mobileconfig`.
+
+Here is an example plist file with the accepted arguments: 
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>organization</key>
+    <string>yourorganization</string>
+    <key>auto_connect</key> 
+    <integer>1</integer>
+    <key>switch_locked</key> 
+    <false />
+    <key>service_mode</key>
+    <string>warp</string>
+    <key>support_url</key>
+    <string>https://support.example.com</string>
+</dict>
+</plist>
+```
+
+Here is an example `.mobileconfig` file with the accepted arguments:
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+<key>PayloadContent</key>
+<array/>
+<key>PayloadDisplayName</key>
+<string>Cloudflare WARP</string>
+<key>PayloadIdentifier</key>
+<string>cloudflare_warp</string>
+<key>PayloadOrganization</key>
+<string>Cloudflare, Ltd.</string>
+<key>PayloadRemovalDisallowed</key>
+<false/>
+<key>PayloadType</key>
+<string>Configuration</string>
+<key>PayloadUUID</key>
+<string>F5046847-2B1C-4DA0-A872-F6E040B1B20E</string>
+<key>PayloadVersion</key>
+<integer>1</integer>
+    <key>PayloadContent</key>
+    <array>
+        <dict>
+            <key>PayloadDisplayName</key>
+            <string>Custom</string>
+            <key>PayloadIdentifier</key>
+            <string>com.cloudflare.warp</string>
+            <key>PayloadOrganization</key>
+            <string>Cloudflare Ltd.</string>
+            <key>PayloadType</key>
+            <string>com.apple.ManagedClient.preferences</string>
+            <key>PayloadUUID</key>
+            <string>C2575334-358E-4925-8B29-30B4348D31E3</string>
+            <key>PayloadVersion</key>
+            <integer>1</integer>
+            <key>PayloadEnabled</key>
+            <true/>
+            <key>PayloadContent</key>
+            <dict>
+                <key>com.cloudflare.warp</key>
+                <dict>
+                    <key>Forced</key>
+                    <array>
+                        <dict>
+                            <key>mcx_preference_settings</key>
+                            <dict>
+                                <key>organization</key>
+                                <string>yourorganization</string>
+                                <key>auto_connect</key> 
+                                <integer>1</integer>
+                                <key>switch_locked</key> 
+                                <false />
+                                <key>service_mode</key>
+                                <string>warp</string>
+                                <key>support_url</key>
+                                <string>https://support.example.com</string>
+                            </dict>
+                        </dict>
+                    </array>
+                </dict>
+            </dict>
+        </dict>
+    </array>
+</dict>
+</plist>
+
+```
+
+For a description of each argument and what it means, see [deployment parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters).
+
+[Click here to download](../../../../../static/documentation/connections/com.cloudflare.warp.plist) this example `plist`. If you plan to download the `plist` file and place it manually in `/Library/Managed Preferences`, convert the `plist` into into binary format first. To do that:
+
+1. Open a Terminal window.
+2. Run the following command:
+
+ ```
+ % plutil -convert binary1 com.cloudflare.warp.plist
+ ```
+
+[Click here to download](../../../../../static/documentation/connections/CloudflareWARP.mobileconfig) this example `.mobileconfig`. Before doing so, you may need to run `uuidgen` from your macOS Terminal. This will generate a value for `PayloadUUID`, which you can use to replace the default value used for `PayloadUUID` in the example above.
+
+### Example configuration in Jamf
+
+With Jamf, the WARP Client deployment is performed in three distinct steps: 
+1. Upload the WARP Client `pkg` file.
+1. Create a policy that deploys the WARP Client `pkg` file.
+1. Create a configuration profile with the settings you want pushed down. 
+
+The following sections will walk you through each of these steps.
+
+#### Upload the package
+1. Login to your `jamfcloud.com` account.
+1. Navigate to **Computer**.
+1. Click the **All Settings** (gear) in the upper right corner.
+1. Click **Computer Management**.
+1. Click **Packages**.
+1. Select **New**.
+1. Upload the `Cloudflare_WARP.pkg` file.
+  For *Display name*, we recommend entering the version number of the package being uploaded.
+1. Click **Save** to complete the upload.
+
+#### Create the policy
+1. Select **Computers** > **Policies** on the menu to your left.
+1. Click **+ New**.
+1. Enter a Display name such as "Cloudflare WARP Client".  
+ For *Triggers*, our recommendation is to select *Startup*, *Login*, *Enrollment Complete* and *Recurring Check-in*, but you can select the value that works best for your organization.
+1. Navigate to **Packages**.
+1. Click **Configure**.
+1. Click **Add** next to the package you previously uploaded.
+1. Click **Save**.
+
+#### Add Configuration Profile
+1. Navigate to **Configuration Profiles**.
+1. Click **New**.
+1. Enter a name for your new profile, such as *Cloudflare for Teams*.
+1. Scroll down the options list and click on **Application & Custom Settings**.
+1. Click **Configure**.
+1. In *Preference Domain*, enter `com.cloudflare.warp`.
+1. Upload a valid plist file. You can start with our example above and modify for your organization.
+1. Click **Save**.
+1. Navigate to **Scope** to configure which devices in your organization should receive this profile.
+1. Click **Save**.
+
+Jamf is now configured to deploy the Cloudflare WARP client.
+
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/parameters.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/parameters.md
new file mode 100644
index 00000000000..69a29fcee8f
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/mdm-deployment/parameters.md
@@ -0,0 +1,148 @@
+---
+order: 0
+pcx-content-type: reference
+---
+
+# Parameters
+
+Each client supports the following set of parameters as part of their deployment, regardless of the deployment mechanism.
+
+## Required for full Cloudflare One features
+
+For the vast majority of Cloudflare for Teams features to work, you need to specify a team name. Examples of Teams features depending on the team name are [HTTP policies](/policies/filtering/http-policies), [Browser Isolation](/connections/connect-browsers), and [device posture](/identity/devices).
+
+### `organization`
+
+| Field | Value Type |
+| ----- | -------- |
+| `organization` | string |
+
+**Description.** Instructs the client to register device with your organization. Registration requires authentication via an [IDP](/identity/idp-integration) or [Service Auth](/identity/service-auth).
+
+**Value:** Your [team name](/glossary#team-name). 
+
+## Required field for DNS only policy enforcemet
+This field is only required to enforce DNS policies when deploying the client in DoH-only mode.
+
+### `gateway_unique_id`
+
+| Field | Value Type |
+| ----- | -------- |
+| `gateway_unique_id` | string |
+
+**Description.** Instructs the client to direct all DNS queries to a specific policy location. This value is only necessary if deploying without a team name *or* in an organization with multiple policy locations.
+
+**Value:** Your [DoH subdomain](/glossary#doh-subdomain).
+
+## Optional fields
+
+### `service_mode`
+
+| Field | Value Type |
+| ----- | -------- |
+| `service_mode` | string |
+
+**Description.** 	Allows you to choose the opertional mode of the client.
+
+**Value:**
+- `1dot1` Gateway enforcement of DNS policies only through [DoH](/glossary#doh). All other traffic is handled by your devices default mechanisms
+- `warp`  [default value] All traffic sent through [Cloudflare Gateway](/glossary#cloudflare-gateway) via our encrypted tunnel. This mode is required for features such as HTTP policies, Browser Isolation, identity-based rules, or device posture.
+
+### `onboarding`
+
+| Field | Value Type |
+| ----- | -------- |
+| `onboarding` | boolean |
+
+**Description.** 	Controls the visibility of the onboarding screens that ask the user to review the privacy policy during an application's first launch.
+
+**Value:**
+- `false` Screens hidden.
+- `true`  [default value] Screen visible.
+
+### `switch_locked`
+
+| Field | Value Type |
+| ----- | -------- |
+| `switch_locked` | boolean |
+
+**Description.** 	Allows the user to control the connected state of the application (main toggle switch).
+
+**Value:**
+- `false` [default value] The user is able to turn switch on/off at their discretion. When the switch is off, the user will not have the ability to reach sites protected by Access that leverage certain device posture checks.
+- `true`  The user is prevented from turning off the switch.
+
+On new deployments, you must also include the `auto_connect` parameter with at least a value of 0. This will prevent clients from being deployed in the off state without a way for users to manually enable them.
+
+<Aside type='note'> 
+
+  This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
+</Aside>
+
+
+### `auto_connect`
+
+| Field | Value Type |
+| ----- | -------- |
+| `auto_connect` | integer |
+
+**Description.** 	If switch has been turned off by user the client will automatically turn itself back on after the specified number of minutes. We recommend keeping this set to a very low value, usually just enough time for a user to login to hotel or airport wifi.
+
+**Value:**
+- `0` Allow the switch to stay in the off position indefinitely until the user turns it back on.
+- `1-1440`  Turn switch back on automatically after the specified number of minutes.
+
+<Aside> 
+  This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
+</Aside>
+
+### `support_url`
+
+| Field | Value Type |
+| ----- | -------- |
+| `support_url` | string |
+
+**Description.** 	When the WARP client is deployed via MDM, the in-app Send Feedback button is disabled by default. This parameter allows you to re-enable the button and direct it towards your organization.
+
+**Value:**
+- `https://support.example.com` Use an https:// link to open your companies internal help site.
+- `mailto:yoursupport@example.com`  Use a mailto: link to open your default mail client.
+
+## Authentication with service tokens
+
+<Aside> 
+  Devices that connect to Cloudflare for Teams with Service Token authentication are not subject to identity based rules.
+</Aside>
+
+Instead of requiring users to authenticate with their credentials, you can deploy the WARP client with a pre-generated [Service Token](/identity/service-auth/service-tokens).
+
+Both a `auth_client_id` and `auth_client_secret` are required when using this authentication method. 
+
+
+### `auth_client_id`
+
+| Field | Value Type |
+| ----- | -------- |
+| `auth_client_id` | string |
+
+**Description.** The automatically genereated ID when you created your [Service Token](/identity/service-auth/service-tokens).
+
+**Value:** `Client ID` from your service token. 
+
+### `auth_client_secret`
+
+| Field | Value Type |
+| ----- | -------- |
+| `auth_client_secret` | string |
+
+**Description.** The automatically genereated secret when you created your [Service Token](/identity/service-auth/service-tokens).
+
+**Value:** `Client Secret` from your service token. 
+
+## Frequently Asked Questions
+
+* **What happens if I don't supply a Gateway DoH subdomain?**
+If you specify an `organization` we will automatically use the default location specified in Gateway.
+
+* **How do I obtain logs in the event of an issue with client?**
+The macOS and Windows clients installations each contain an application in their installed folders called warp-diag that can be used to obtain logs.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/parameters.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/parameters.md
deleted file mode 100644
index 01ef284eb34..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/deployment/parameters.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-order: 1
----
-
-# Parameters
-
-Each client supports the following set of parameters as part of their deployment, regardless of the deployment mechanism.
-
-## Required for full Cloudflare One features
-For the vast majority of Cloudflare for Teams features to work, you need to specify a team name. Examples of Teams features depending on the team name are [HTTP policies](/policies/filtering/http-policies), [Browser Isolation](/connections/connect-browsers), and [device posture](/identity/devices).
-
-### `organization`
-
-| Field | Value Type |
-| ----- | -------- |
-| `organization` | string |
-
-**Description.** Instructs the client to register device with your organization. Registration requires authentication via an [IDP](/identity/idp-integration) or [Service Auth](/identity/service-auth).
-
-**Value:** Your [team name](/glossary#team-name). 
-
-## Required field for DNS only policy enforcemet
-This field is only required to enforce DNS policies when deploying the client in DoH-only mode.
-
-### `gateway_unique_id`
-
-| Field | Value Type |
-| ----- | -------- |
-| `gateway_unique_id` | string |
-
-**Description.** Instructs the client to direct all DNS queries to a specific policy location. This value is only necessary if deploying without a team name *or* in an organization with multiple policy locations.
-
-**Value:** Your [DoH subdomain](/glossary#doh-subdomain).
-
-## Optional fields
-
-### `service_mode`
-
-| Field | Value Type |
-| ----- | -------- |
-| `service_mode` | string |
-
-**Description.** 	Allows you to choose the opertional mode of the client.
-
-**Value:**
-- `1dot1` Gateway enforcement of DNS policies only through [DoH](/glossary#doh). All other traffic is handled by your devices default mechanisms
-- `warp`  [default value] All traffic sent through [Cloudflare Gateway](/glossary#cloudflare-gateway) via our encrypted tunnel. This mode is required for features such as HTTP policies, Browser Isolation, identity-based rules, or device posture.
-
-### `onboarding`
-
-| Field | Value Type |
-| ----- | -------- |
-| `onboarding` | boolean |
-
-**Description.** 	Controls the visibility of the onboarding screens that ask the user to review the privacy policy during an application's first launch.
-
-**Value:**
-- `false` Screens hidden.
-- `true`  [default value] Screen visible.
-
-### `switch_locked`
-
-| Field | Value Type |
-| ----- | -------- |
-| `switch_locked` | boolean |
-
-**Description.** 	Allows the user to control the connected state of the application (main toggle switch).
-
-**Value:**
-- `false` [default value] The user is able to turn switch on/off at their discretion. When the switch is off, the user will not have the ability to reach sites protected by Access that leverage certain device posture checks.
-- `true`  The user is prevented from turning off the switch.
-
-**Warning**
-<Aside>
-On new deployments, you must also include the `auto_connect` parameter with at least a value of 0. This will prevent clients from being deployed in the off state without a way for users to manually enable them.
-</Aside>
-
-<Aside> 
-  This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
-</Aside>
-
-
-### `auto_connect`
-
-| Field | Value Type |
-| ----- | -------- |
-| `auto_connect` | integer |
-
-**Description.** 	If switch has been turned off by user the client will automatically turn itself back on after the specified number of minutes. We recommend keeping this set to a very low value, usually just enough time for a user to login to hotel or airport wifi.
-
-**Value:**
-- `0` Allow the switch to stay in the off position indefinitly until the user turns it back on.
-- `1-1440`  Turn switch back on automatically after the specified number of minutes.
-
-<Aside> 
-  This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
-</Aside>
-
-### `support_url`
-
-| Field | Value Type |
-| ----- | -------- |
-| `support_url` | string |
-
-**Description.** 	When the WARP client is deployed via MDM, the in-app Send Feedback button is disabled by default. This parameter allows you to re-enable the button and direct it towards your organization.
-
-**Value:**
-- `https://support.example.com` Use an https:// link to open your companies internal help site.
-- `mailto://yoursupport@example.com`  Use a mailto:// link to open your default mail client.
-
-## Frequently Asked Questions
-
-* **What happens if I don't supply a Gateway DoH subdomain?**
-If you specify an `organization` we will automatically use the default location specified in Gateway.
-
-* **How do I obtain logs in the event of an issue with client?**
-The macOS and Windows clients installations each contain an application in their installed folders called warp-diag that can be used to obtain logs.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md
deleted file mode 100644
index 6a7bc1f57c9..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/device-enrollment.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-order: 3
----
-
-# Device enrollment
-
-## Build an enrollment policy
-
-<Aside>
-
-Revoking a user's permission to manage devices will not prevent that user from authenticating to applications. If you wish to revoke access to that user, you can do so by [revoking their user session](/identity/users/session-management#revoke-user-sessions). 
-
-</Aside>
-
-Cloudflare for Teams allows you to establish which users in your organization can enroll new devices or revoke access to connected devices. To do that, you can create a **device enrollment rule** on the Teams dashboard.
-
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **My Team > Devices**.
-
-2. Click **Device enrollment** on the top-right corner.
-
-3. In the rule builder, configure a rule to define who can enroll or revoke devices. 
-
- In this example, only users with `cloudflare.com` email addresses who successfully authenticate during device enrollment through the WARP client will be able to enroll in the organization. This rule prevents outsider users from sending traffic through your account and will give your organization the ability to capture user profile logs and apply profile-specific rules.
-
-![Enroll Rule](../../../static/secure-web-gateway/secure-dns-devices/enroll-rule.png)
-
-4. Click **Save**.
-
-## Enroll devices
-
-End users can now download WARP (or have it made available via MDM) and enroll their device.
-
-Once installed, click the gear icon.
-
-![WARP](../../../static/secure-web-gateway/secure-dns-devices/warp.png)
-
-Under the **Account** tab, click **Login with Cloudflare for Teams**.
-
-![Account View](../../../static/secure-web-gateway/secure-dns-devices/account-view.png)
-
-The user must input your Cloudflare for Teams org name. You can find your team's name under the **Authentication** tab in the **Access** section of the sidebar.
-
-![Org Name](../../../static/secure-web-gateway/secure-dns-devices/org-name.png)
-
-The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to *Teams mode*. You can click the gear to toggle between DNS filtering or full proxy.
-
-![Confirm WARP](../../../static/secure-web-gateway/block-uploads/with-warp.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/download-warp.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/download-warp.md
index ffaedb908ac..7bec8e9f1fc 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/download-warp.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/download-warp.md
@@ -1,9 +1,14 @@
 ---
-order: 4
+order: 1
+pcx-content-type: reference
 ---
 
 # Download WARP
 
+You can download the WARP client from the Teams Dashboard. To do that, navigate to **Settings** > **Devices** and scroll down to **Download the WARP client**.
+
+Alternatively, download the client from one of the following links after checking requirements:
+
 ## Windows
 <table>
   <tbody>
@@ -30,7 +35,9 @@ order: 4
   </tbody>
 </table>
 
-__[Download Cloudflare_WARP_Release-x64.msi](https://www.cloudflarewarp.com/Cloudflare_WARP_Release-x64.msi)__
+__[Windows Release Builds](https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release)__
+
+__[Windows Beta Builds](https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows/distribution_groups/beta)__
 
 ## macOS
 <table>
@@ -58,7 +65,39 @@ __[Download Cloudflare_WARP_Release-x64.msi](https://www.cloudflarewarp.com/Clou
   </tbody>
 </table>
 
-__[Download Cloudflare_WARP.zip](https://www.cloudflarewarp.com/Cloudflare_WARP.zip)__
+__[macOS Release Builds](https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-macos-1/distribution_groups/release)__
+
+__[macOS Beta Builds](https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-macos/distribution_groups/beta)__
+
+## Linux
+<table>
+  <tbody>
+    <tr>
+      <td><strong>OS Ver</strong></td>
+      <td>CentOS 8, RHEL, Ubuntu, Debian</td>
+    </tr>
+    <tr>
+      <td><strong>OS Type</strong></td>
+      <td>64bit only</td>
+    </tr>
+    <tr>
+      <td><strong>HD Space</strong></td>
+      <td>75MB</td>
+    </tr>
+    <tr>
+      <td><strong>Memory</strong></td>
+      <td>35MB</td>
+    </tr>
+    <tr>
+      <td><strong>Network Types</strong></td>
+      <td>WIFI or LAN</td>
+    </tr>
+  </tbody>
+</table>
+
+__[Package Download](https://pkg.cloudflareclient.com/packages/cloudflare-warp)__
+
+__[APT/YUM Repository Setup](https://pkg.cloudflareclient.com/install)__
 
 ## iOS
 <table>
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/index.md
index e0d3f05ddeb..5b418eccc4d 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/index.md
@@ -1,20 +1,15 @@
 ---
-order: 4
+order: 14
+pcx-content-type: concept
 ---
  
 # Exclude network traffic from WARP
 
- <Aside>
- 
-In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.
- 
-</Aside>
-
-When the WARP Client is deployed, all DNS requests and/or network traffic on the device are processed by Cloudflare Gateway by default. However, under certain circumstances, you may need to exclude DNS requests and/or network traffic from being processed by Gateway.
+When the WARP client is deployed, all DNS requests and/or network traffic on the device are processed by Cloudflare Gateway by default. However, under certain circumstances, you may need to exclude DNS requests and/or network traffic from being processed by Gateway.
  
 To do that, there are two settings you can use depending on your needs:
 
-* **Use [Local Domain Fallback](/connections/connect-devices/warp/exclude-traffic/local-domains)** to instruct the WARP Client to ignore DNS requests to a given list of domains. These DNS requests will be passed back to other DNS servers configured on existing network interfaces on the device.
+* **Use [Local Domain Fallback](/connections/connect-devices/warp/exclude-traffic/local-domains)** to instruct the WARP client to ignore DNS requests to a given list of domains. These DNS requests will be passed back to other DNS servers configured on existing network interfaces on the device.
  
 This is useful when you have defined private hostnames that wouldn’t otherwise resolve on the public internet.
 
@@ -25,13 +20,13 @@ DNS requests to domain names entered here will not be encrypted, managed or moni
  
 </Aside>
 
-* **Use the [Split Tunnels](/connections/connect-devices/warp/exclude-traffic/split-tunnels) mode** to instruct the WARP client to ignore traffic to a specified set of IP addresses. Any traffic that is destined to an IP address defined in the split tunnel configuration will be ignored by the WARP client and handled by the local machine.
+* **Use the [Split Tunnels](/connections/connect-devices/warp/exclude-traffic/split-tunnels) mode** to instruct the WARP client to ignore traffic to a specified set of IP addresses or hostnames. Any traffic that is destined to an IP address or hostname defined in the split tunnel configuration will be ignored by the WARP client and handled by the local machine.
  
 This is useful when you want to run another VPN alongside WARP or when you need traffic to flow over the open Internet.
 
 <Aside type="warning">
  
-Any traffic to IP addresses defined in the Split Tunnel configuration will not be encrypted, managed or monitored by Cloudflare Gateway.
+Traffic excluded from WARP by Split Tunnel configuration will not be encrypted, managed or monitored by Cloudflare Gateway.
  
 </Aside>
 
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/local-domains.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/local-domains.md
index b172be0a6c7..89fb5440f05 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/local-domains.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/local-domains.md
@@ -1,43 +1,37 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
  
 # Local Domain Fallback
- 
- <Aside>
- 
-In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.
- 
-</Aside>
 
-By default, Cloudflare for Teams excludes common top level domains used for local resolution from being sent to the Cloudflare proxy. Excluded domains are listed on the Teams dashboard under **Gateway** > **Policies** > **Settings** > **Local Domains - WARP**. All domains in that list rely on the local DNS resolver configured for the device.
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All systems | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+By default, Cloudflare for Teams excludes common top level domains used for local resolution from being sent to the Cloudflare proxy. Excluded domains are listed on the Teams dashboard under **Settings** > **Network** > **Local Domain Fallback** . All domains in that list rely on the local DNS resolver configured for the device.
  
 You can add or remove domains from the Local Domains list at any time.
 
-1. On the Teams dashboard, navigate to **Policies** > **Settings**.
- 
-![Settings](../../../../static/secure-web-gateway/split-tunnel/settings-page.png)
+1. On the Teams dashboard, navigate to **Settings** > **Network**.
  
-1. Click **Manage Local Domains**.
- 
-![Settings End](../../../../static/secure-web-gateway/split-tunnel/settings-end.png)
- 
-1. On this page, you'll find a list of domains Cloudflare for Teams excludes. You can customize this list to add or remove any items from it.
- 
-![Manage local domains](../../../../static/secure-web-gateway/split-tunnel/local-resolution.png)
+1. Under **Local Domain Fallback**, click **Manage**.
  
+1. On this page, you will find a list of domains Cloudflare for Teams excludes. You can customize this list to add or remove any items from it.
+
 ## Add a domain
  
-On the Manage Local Domains page, in the **Add Local Domain Record** card, enter the domain and an optional description in the relevant fields.  Then, click **Add**.
+On the Local Domains page, enter the domain and an optional description in the relevant fields. Then, click **Add domain**.
  
-The domain will appear in the list below.
- 
- ![Add domain](../../../../static/documentation/connections/delete-domains.png)
+The domain will appear in the list of Local Domain entries.
  
 ## Delete a domain
  
 To remove a domain from the list, locate the domain and then click **Delete**.
- 
-If you wish to remove multiple domains at the same time, click the checkbox to the left of each domain to select it, and click **Delete** in the top right corner of the box.
-
- ![Delete domain](../../../../static/documentation/connections/delete-domains.png)
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/split-tunnels.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/split-tunnels.md
index 969467b1f16..40009a27d1d 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/split-tunnels.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/exclude-traffic/split-tunnels.md
@@ -1,43 +1,67 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
  
 # Split Tunnels
- 
-<Aside>
- 
-In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.
- 
-</Aside>
 
-Split Tunnels mode can be configured to exclude IP addresses commonly used for private routing, including those defined in [RFC 1918](https://tools.ietf.org/html/rfc1918). You can find a list of excluded IP addresses under **Gateway** > **Policies** > **Settings** > **Split Tunnels - WARP**.
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All systems | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+Split Tunnels mode can be configured to exclude IP addresses or domains from going through WARP. This is commonly used for private routing, including those defined in [RFC 1918](https://tools.ietf.org/html/rfc1918). You can find a list of excluded IP addresses under **Settings** > **Network** > **Split Tunnels**.
  
-You can add or remove IP addresses from the Split Tunnels list at any time.
+You can add or remove items from the Split Tunnels list at any time.
  
 ![Settings End](../../../../static/secure-web-gateway/split-tunnel/settings-end.png)
  
-1. On the Teams dashboard, navigate to **Policies** > **Settings**.
- 
-![Settings](../../../../static/secure-web-gateway/split-tunnel/settings-page.png)
+1. On the Teams Dashboard, navigate to **Settings** > **Network**.
  
-1. Click **Manage Split Tunnels**.
- 
-![Settings End](../../../../static/secure-web-gateway/split-tunnel/settings-end.png)
+1. Under **Split Tunnels**, click **Manage**.
  
-1. On this page, you'll find a list of the IP addresses Cloudflare for Teams excludes. You can customize this list to add or remove any items from it.
+    On this page, you will find a list of the networks Cloudflare for Teams excludes. You can customize this list to add or remove any items from it.
  
 ### Add an IP address
  
-On the Manage Split Tunnels page, in the **Add Split Tunneling Record** card, enter the IP address or CIDR and an optional description in the relevant fields. Then, click **Add**.
- 
- ![Add IP address](../../../../static/documentation/connections/add-IP-address.png)
- 
-The IP address will appear in the list below.
- 
-### Remove an IP address
+On the Split Tunnels page, choose **IP Address** from the list of selectors and enter the IP address or CIDR you want to exclude. Next, add an optional description in the relevant field. Then, click **Save destination**.
+
+The IP address will appear in the list of Split Tunnel entries.
+
+### Add a domain
  
-On the Manage Split Tunnels page, locate the IP address in the list and then click **Delete**.
+On the Split Tunnels page, choose **Domain** from the list of selectors and enter the domain you want to exclude. Next, add an optional description in the relevant field. Then, click **Save destination**.
+
+The domain will appear in the list of Split Tunnel entries.
+
+Valid domains include:
+- `example.com`
+- `example.example.com`
+- `*.example.com`
+
+<Aside header='Warning about using domains in Split Tunnels'>
+
+Domain-based split tunneling works alongside DNS by dynamically excluding the route to the IP address(es) returned in the DNS lookup request. This has a few ramifications you should be aware of before deploying in your organization:
  
-If you wish to remove multiple IP addresses at the same time, click the checkbox to the left of each IP address to select it, and click **Delete** in the top right corner of the box.
+1. Routes exclduded from WARP and Gateway visibility may change day to day, and may be different for each user depending on where they are.
+2. You may inadvertently exclude additional hostnames that happen to share an IP address.
+3. Most services are a collection of hostnames. Until Split Tunnels mode supports [App Types](/policies/filtering/http-policies/application-app-types), you will need to ensure you include all domains used by a particular app or service.
+4. If a DNS result has been previously cached it will not be dynamically included in the Split Tunnel result until the next time the DNS lookup happens.
+
+</Aside>
+
+### Remove an item from Split Tunnels
  
- ![Delete IP address](../../../../static/documentation/connections/delete-IP-address.png)
+On the Split Tunnels page, locate the IP address or hostname in the list and then click **Delete**.
+
+<Aside>
+
+If you need to revert to the default Split Tunnels entries, delete all entries from the list. Once the list is empty, the page will re-populate with the default values.
+
+</Aside>
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md
index 89bcc0c4e16..758c3450b78 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/index.md
@@ -1,38 +1,62 @@
 ---
 order: 0
+pcx-content-type: concept
+title: WARP
 ---
 
-# WARP client
+# Connect devices with the WARP client
 
-You can use Cloudflare WARP client to connect devices to Cloudflare for DNS or HTTP filtering. The WARP client can be deployed in the following modes:
+The Cloudflare WARP client allows you to protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's edge, where Cloudflare Gateway can apply advanced web filtering. The WARP client also makes it possible to apply advanced Zero Trust policies that check for a device's health before it connects to corporate applications.
 
-|Mode|Description|DNS filtering|HTTP filtering|
-|---|---|---|---|
-|DNS only|DoH-based filtering|Yes|No|
-|DNS with WARP+|DoH-based filtering with encrypted WARP+ traffic|Yes|No|
-|HTTP filtering|DoH-based filtering, HTTP filtering, and encrypted WARP+ traffic|Yes|Yes|
+Downloading and deploying the WARP client to your devices enhances the protection Cloudflare for Teams can provide to your users and data, wherever they are.
 
-Cloudflare WARP is [available](/connections/connect-devices/warp/download-warp) on iOS, Android, Mac, and Windows.
+Here are a few ways in which the WARP client provides in-depth protection for your organization:
 
-## DNS filtering
+* **WARP lets you enforce security policies anywhere**.  
+    With the WARP client deployed in the Gateway with WARP mode, Gateway policies are not location-dependent — they can be enforced anywhere.
 
-The Cloudflare WARP client can be configured to send all DNS queries from roaming devices, on any network, to Cloudflare for DNS filtering. Deploying DNS filtering with WARP does not require your team to configure source or destination IPs. To begin, follow the steps below:
+* **WARP lets you enforce HTTP filtering and user-based policies**.  
+    Download and install the WARP client to enable Gateway features such as [Anti-Virus scanning](/policies/filtering/http-policies/antivirus-scanning), [HTTP filtering](/policies/filtering/http-policies), [Browser Isolation](/policies/filtering/http-policies#isolate), and [identity-based policies](/policies/filtering/network-policies).
 
-1. Determine which devices can enroll.
-2. Create a DNS-over-HTTPS destination.
-3. [Deploy](/connections/connect-devices/warp/deployment) Cloudflare WARP to devices.
+* **WARP lets you have in-depth, application-specific insights**.  
+    With WARP installed on your corporate devices, you can populate the [Teams Shadow IT Discovery](/analytics/access) page with visibility down to the application and user level. This makes it easy to discover, analyze, and take action on any shadow IT your users may be using every day. 
 
-Alternatively, you can deploy Cloudflare DNS filtering on [networks](/connections/connect-networks) or [devices](/connections/connect-devices/agentless) without the WARP client.
+* **WARP allows you to build rich device posture rules.**  
+    The WARP client provides advanced Zero Trust protection by making it possible to check for [device posture](/identity/devices). By setting up device posture checks, you can build Zero Trust policies that check for a device's location, disk encryption status, OS version, and more.
 
-## Web proxying
+The WARP client can be configured in three modes.
 
-You can proxy all traffic leaving devices through Cloudflare for HTTP inspection and filtering using the Cloudflare WARP client. To begin, follow the steps below:
+## WARP client modes
 
-1. [Determine which devices](/connections/connect-devices/warp/device-enrollment) can enroll or deploy the agent [with an MDM provider](/connections/connect-devices/warp/deployment).
-2. [Enroll a device](/connections/connect-devices/warp/device-enrollment).
-3. [Install](/connections/connect-devices/warp/install-cloudflare-cert) the Cloudflare root certificate on the devices.
-4. [Enable web inspection](/connections/connect-devices/warp/control-proxy) in the Cloudflare for Teams dashboard.
+<Aside type="note">
 
-## Port Handling
+**Proxy mode** can only be used by applications/operating systems that support SOCKS5/HTTPS proxy communication. 
 
-By default, WARP allows traffic on any port other than 25.
+</Aside>
+
+### Gateway with WARP (default)
+
+| DNS filtering | HTTP filtering | Features enabled |
+| ------------- | -------------- | ---------------- | 
+| Yes | Yes | DNS policies, HTTP policies, Browser Isolation, identity-based policies, AV scanning, DLP, device posture |
+
+### Gateway with DoH
+
+This mode is best suited for organizations that want to use advanced firewall/proxy functionalities and enforce device posture rules.  
+
+| DNS filtering | HTTP filtering | Features enabled |
+| ------------- | -------------- | ---------------- | 
+| Yes | No | DNS policies |
+
+This mode is best suited for organizations that only want to apply DNS filtering to outbound traffic from their company devices.  
+
+### Proxy mode
+
+| DNS filtering | HTTP filtering | Features enabled |
+| ------------- | -------------- | ---------------- | 
+| No | Yes | HTTP policies, Browser Isolation, identity-based policies, AV scanning, DLP for traffic sent through localhost proxy|
+
+This mode is best suited for organizations that want to filter traffic directed to specific applications. 
+
+
+Cloudflare WARP is [available](/connections/connect-devices/warp/download-warp) for iOS, Android, ChromeOS, Mac, Linux, and Windows.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md
index fd4630c9131..ba4ddee748f 100644
--- a/products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/install-cloudflare-cert.md
@@ -1,5 +1,6 @@
 ---
-order: 0
+order: 3
+pcx-content-type: how-to
 ---
 
 # Install the Cloudflare root certificate
@@ -308,6 +309,40 @@ The command to install the certificate with Python on Windows automatically incl
 
 The root certificate is now installed and ready to be used.
 
+### ChromeOS
+
+1. Download the Cloudflare certificate [here](../../../static/documentation/connections/Cloudflare_CA.crt).
+
+2. Navigate to your **ChromeOS Settings**.
+
+![Chrome OS Settings cog](../../../static/documentation/connections/chromeOS1_cert.png)
+
+3. Navigate to **Apps** and then click **Google Play Store**.
+
+![Click google play store in Apps section](../../../static/documentation/connections/chromeOS2_cert.png)
+
+4. Click **Manage Android preferences**.
+
+![Click manage android preferences](../../../static/documentation/connections/chromeOS3_cert.png)
+
+5. Click **Security & location** then click **Credentials** then click **Install from SD card**.
+
+<TableWrap>
+
+|  |  |  |
+|------|------|------|
+| ![Click security & location](../../../static/documentation/connections/chromeOS4_cert.png) | ![click credentials](../../../static/documentation/connections/chromeOS5_cert.png) | ![click install from SD card](../../../static/documentation/connections/chromeOS6_cert.png) |
+
+</TableWrap>
+
+6. In the file open dialog select the `Cloudflare_CA.crt` file downloaded in step #1 and click **Open**.
+
+![Choose the Cloudflare_CA.crt file to install](../../../static/documentation/connections/chromeOS7_cert.png)
+
+7. Enter anything you want for the certificate name and click **OK**.
+
+![Name the certificate with anything](../../../static/documentation/connections/chromeOS8_cert.png)
+
 <Aside>
 
 Common dev tools provide the option to trust root certificates. To trust the Cloudflare root certificate, run the following command and update it with the location for your Cloudflare root certificate:
@@ -317,4 +352,4 @@ Common dev tools provide the option to trust root certificates. To trust the Clo
  ```
 If you're using the AWS CLI, you need to set the `AWS_CA_BUNDLE` environment variable to use the Cloudflare root certificate.
 
-</Aside>
\ No newline at end of file
+</Aside>
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/remove-warp.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/remove-warp.md
new file mode 100644
index 00000000000..5b3bfae0ccd
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/remove-warp.md
@@ -0,0 +1,35 @@
+---
+order: 15
+pcx-content-type: how-to
+---
+
+# Remove WARP
+
+## Windows
+
+1. Navigate to Windows Settings (Windows Key + I).
+1. Click **Apps**.
+1. Click **App & Features**.
+1. Scroll to find the Cloudflare WARP application and click **Uninstall**.
+
+## macOS
+
+We include an uninstall script as part of the macOS package that you originally used. Use the following commands to find and run the script:
+
+```sh
+$ cd /Applications/Cloudflare\ WARP.app/Contents/Resources
+$ ./uninstall.sh
+```
+
+<Aside>
+
+You may be prompted to provide your credentials while removing the application.
+
+</Aside>
+
+## iOS and Android
+
+1. Find the 1.1.1.1 application on the home screen.
+1. Touch and hold on the application tile.
+1. Tap **Remove App**.
+1. Select **Delete App**.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/set-up-warp.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/set-up-warp.md
new file mode 100644
index 00000000000..d2555fc235e
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/set-up-warp.md
@@ -0,0 +1,71 @@
+---
+order: 0
+pcx-content-type: how-to
+title: First-time setup
+---
+
+# Set up WARP for your organization
+
+This is a high-level, step-by-step walkthrough on how to get started with WARP in your organization. From downloading the client to sending the first queries to Cloudflare's edge, here is a guide on how to do it for the first time.
+
+## Gateway with WARP (default)
+
+### 1. Create a Cloudflare for Teams account.
+
+The Cloudflare for Teams Dashboard will be your go-to place to check device connectivity data, as well as create Secure Web Gateway and Zero Trust policies for your organization. 
+
+As you complete the [Teams onboarding](/setup), you will be asked to create a [team name](/glossary#team-name) for your organization. You will need the team name when you deploy the WARP client on your devices; it will allow your users to connect to your organization's Cloudflare for Teams instance.
+
+### 2. Set up a login method.
+
+Configure [One-time PIN](/identity/one-time-pin) or connect a [third-party identity provider](/identity/idp-integration) on the Teams Dashboard. This is the login method your users will utilize when authenticating to add a new device to your Teams setup.
+
+### 3. Next, define [device enrollment permissions](/connections/connect-devices/warp/warp-settings#device-enrollment-permissions).
+
+Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Teams setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with.
+
+### 4. Install the [Cloudflare root certificate](/connections/connect-devices/warp/install-cloudflare-cert) on your devices.
+
+Advanced security features including HTTP traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all your devices, these steps will need to be performed on each new device that is to be subject to HTTP filtering.
+
+### 5. Download and deploy the WARP client to your devices.
+
+Choose one of the [different ways](/connections/connect-devices/warp/deployment) to deploy the WARP client, depending on what works best for your organization.
+
+### 6. Enable the Proxy setting in the Teams Dashboard.
+
+Navigate to **Settings** > **Network** and enable the **Proxy** setting. This will allow you to start routing your HTTP traffic to Gateway.  
+
+### 7. Go through this checklist.
+
+To begin inspecting DNS and HTTP traffic on your devices, you need to ensure all of the following:
+
+* Your devices have the WARP client installed and connected.
+* The [Cloudflare root certificate](/connections/connect-devices/warp/install-cloudflare-cert) has been installed on your devices.
+* The [proxy setting](/connections/connect-devices/warp/warp-settings#enable-proxy) has been enabled on the Cloudflare for Teams Dashboard.
+
+## Gateway with DoH
+
+This mode is best suited for organizations that only want to apply DNS filtering to outbound traffic from their company devices. It does not enable advanced HTTP filtering features such as HTTP policies, identity-based policies, device posture checks, or Browser Isolation.
+
+### 1. Create a Cloudflare for Teams account.
+
+The Cloudflare for Teams Dashboard will be your go-to place to check device connectivity data, as well as create Secure Web Gateway and Zero Trust policies for your organization. 
+
+As you complete the [Teams onboarding](/setup), you will be asked to create a [team name](/glossary#team-name) for your organization. You will need the team name when you deploy the WARP client on your devices; it will allow your users to connect to your organization's Cloudflare for Teams instance.
+
+### 2. Set up a login method.
+
+Configure [One-time PIN](/identity/one-time-pin) or connect a [third-party identity provider](/identity/idp-integration) on the Teams Dashboard. This is the login method your users will utilize when authenticating to add a new device to your Teams setup.
+
+### 3. Next, define [device enrollment permissions](/connections/connect-devices/warp/warp-settings#device-enrollment-permissions).
+
+Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Teams setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with.
+
+### 4. Add a [location](/connections/connect-networks/locations) to Gateway. 
+
+Add your office as a location on Gateway. Gateway will assign a [DoH subdomain](/glossary#doh-subdomain) to that location — you will then need this value when deploying the WARP client to your devices.
+
+### 5. Download and deploy the WARP client to your devices.
+
+Choose one of the [different ways](/connections/connect-devices/warp/deployment) to deploy the WARP client, depending on what works best for your organization.
diff --git a/products/cloudflare-one/src/content/connections/connect-devices/warp/warp-settings.md b/products/cloudflare-one/src/content/connections/connect-devices/warp/warp-settings.md
new file mode 100644
index 00000000000..44dd6c2216a
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-devices/warp/warp-settings.md
@@ -0,0 +1,100 @@
+---
+order: 5
+pcx-content-type: reference
+---
+
+# WARP settings
+
+<Aside type="note">
+
+If you are deploying [WARP in Managed mode](/connections/connect-devices/warp/deployment/mdm-deployment), refer to this [list of parameters](/connections/connect-devices/warp/deployment/mdm-deployment/parameters) instead. Any settings you configure on the Teams Dashboard will be overridden by an MDM deployment. To ensure Dashboard settings are applied as intended, remove the corresponding parameters from your MDM deployment.
+
+</Aside>
+
+To manage WARP settings and device connectivity preferences, navigate to **Settings** > **Devices** on the Teams Dashboard.
+
+## Admin override
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | Any mode | All plans | 
+
+</div>
+</details>
+
+When the toggle is enabled, users will be able to make changes to the WARP client configuration if they have a one-time password. When the toggle is disabled, no one-time passwords are generated, and the users will not be able to change the client's configuration.
+
+## Device enrollment permissions
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All systems | Any mode | All plans | 
+
+</div>
+</details>
+
+Cloudflare for Teams allows you to establish which users in your organization can enroll new devices or revoke access to connected devices. To do that, you can create a device enrollment rule on the Teams Dashboard:
+
+1. Click **Manage** in the **Device enrollment permissions** card.
+1. In the rule builder, configure one or more rules to define who can enroll or revoke devices.
+1. Set a session duration. Once the session expires, users will be asked to log in when attempting to connect a device. 
+1. Click **Save**.
+
+## Captive portal detection
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+Captive Portal detection is the ability for the WARP client to detect a third-party onboarding flow before Internet access is obtained. This is most frequent in places such as airports, cafes, and hotels. 
+
+When the toggle is enabled, the WARP client will automatically turn off when it detects a captive portal, and it will automatically turn on after the amount of time you specify in the card.
+
+## Mode switch
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+When the toggle is enabled, users have the option to turn off the [Gateway with WARP](/connections/connect-devices/warp#gateway-with-warp-default) mode and switch to [Gateway with DoH mode](/connections/connect-devices/warp#gateway-with-doh). When the toggle is disabled, end users will not be able to switch between WARP modes.
+
+---
+
+## Enable Proxy
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | All plans | 
+
+</div>
+</details>
+
+1. Navigate to **Settings** > **Network**.
+1. Scroll down to **L7 Firewall**.
+1. Set the **Proxy** switch to *Enabled*.
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/index.md b/products/cloudflare-one/src/content/connections/connect-networks/index.md
index 2a0e13e11aa..8eec545319b 100644
--- a/products/cloudflare-one/src/content/connections/connect-networks/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-networks/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: navigation
 ---
 
 # Connect networks
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md
index d7d4b51e653..0e027f47ff4 100644
--- a/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md
+++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/configuring-a-location.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Add locations
@@ -12,7 +13,12 @@ To add a location to Teams:
 
 1. Choose a name for your location.
 
-1. If the location you are sending requests from is only using IPv6 or sending all DNS requests using DNS over HTTPS, click **Delete** on the right side of the IPv4 address field, as the field is not required.
+1. You may not need the IPv4 address field if: 
+ * The location you're adding only uses IPv6
+ * Users will be sending all DNS requests from this location using DNS over HTTPS via a browser
+ * You will be deploying the [WARP client](/connections/connect-devices/warp)
+ 
+ If any of the above apply to your case, click **Delete** to the right of the IPv4 field.
 
    <Aside>
 
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/dedicated-ipv4-ipv6.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/dedicated-ipv4-ipv6.md
new file mode 100644
index 00000000000..dfb05b5b159
--- /dev/null
+++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/dedicated-ipv4-ipv6.md
@@ -0,0 +1,38 @@
+---
+order: 1
+pcx-content-type: concept
+---
+
+# Dedicated destination IPv4 and IPv6 addresses
+
+When you create a location, default destination IP addresses are assigned to the location that users can use to forward queries. 
+
+A unique, dedicated destination IPv6 address is provisioned for every location you create. That destination address is how Gateway will identify which account and location to apply DNS filtering rules.  
+
+For queries over IPv4, the default destination addresses are anycast IP addresses, and they are shared across every Cloudflare Gateway account. The source IPv4 address the query came from is used to determine which account and location should apply DNS policies to the query. Enterprise customers can request a dedicated IPv4 address to be provisioned for a location in lieu of the default anycast addresses. Like IPv6, queries forwarded to that address will be identified using the dedicated destination IPv4 address.
+
+By default, DNS queries forwarded to a dedicated destination IPv4 or IPv6 address are correlated to an account and the DNS filtering policy applied. Follow these steps if you would like to restrict which IPv4 and IPv6 networks can send queries to your dedicated addresses:
+
+1. [Create a location](/connections/connect-networks/configuring-a-location) and take note of the destination address. Enterprise customers can obtain a dedicated IPv4 address for a location.
+1. [Create an IP list](/policies/lists) with the IPv4 and/or IPv6 addresses that your organization will source queries from.
+1. Create your DNS policies with an added condition to match where the query came from using the “Source IP” selector.
+
+If you want to block security threats and only allow queries from specific networks to a dedicated IPv4 or IPv6 address, you could create the following policy:
+
+**Policy name**: for example, `Block security threats`
+
+**Condition 1**:
+
+| Selector | Operator | Value |
+| -- | -- | -- | -- |
+| Security Categories | In | Select all categories that apply |
+
+**Condition 2**:
+
+| Selector | Operator | Value |
+| -- | -- | -- |
+| Source IP | In List | The name of the IP list containing your organization's networks |
+
+**Action**: Block
+
+DNS queries made to the destination addresses but from IP addresses not included in the IP list will not be filtered or populate your organization’s [Gateway activity logs](/analytics/logs/activity-log). 
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md
index 20fa3c48d7f..052b1b5e7ae 100644
--- a/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-networks/locations/index.md
@@ -1,9 +1,16 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # Locations
 
+<Aside type="Warning" header="Warning">
+
+Deploying Gateway DNS filtering using static IP addresses may prevent users from connecting to public Wi-Fi networks through captive portals. To avoid this issue, use the [WARP client](/connections/connect-devices/warp) to connect your devices to Teams.
+
+</Aside>
+
 Locations are usually physical entities like offices, homes, retail stores, movie theatres, or data centers. The fastest way to start sending DNS queries from a location and protect it from security threats is by changing the DNS resolvers at the router.
 
 * If you have an IPv6 network, you can change your DNS resolvers to the dedicated IPv6 address for your location.
@@ -56,7 +63,7 @@ When trying to configure a location over IPv4, you may run into this error:
 
 This may mean someone else in the same network signed up for Cloudflare Gateway before you did. If your network supports IPv6, you can still use Cloudflare Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client.
 
-If you think someone else is wrongfully using this IPv4 address, please [let us know](https://forms.gle/MUtjTheQh24MRY2aA).
+If you think someone else is wrongfully using this IPv4 address, please [let us know](https://forms.gle/o9dLMjmCg6QtaDJ88).
 
 </Aside>
 
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md b/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md
deleted file mode 100644
index 210992b3d0d..00000000000
--- a/products/cloudflare-one/src/content/connections/connect-networks/locations/troubleshooting-locations.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-order: 3
----
-
-# Troubleshoot locations
-
-## Why am I not seeing Analytics in my Overview page?
-![Overview empty](../../../static/documentation/connections/gateway-dash-overview-empty.png)
-
-If you're seeing this message, there may be different reasons:
-
-##### 1. You are not sending DNS queries to Gateway
-Verify that the destination IP addresses you are sending DNS queries to are correct. You can check the destination IP addresses for your location by going to your locations page and then expanding the location:
-
-![Location with destinations](../../../static/documentation/connections/expanded-location-with-destinations.png)
-
-##### 2. You are using other DNS resolvers
-If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for those resolvers that are not part of Gateway. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
-
-##### 3. The source IPv4 address for your location is incorrect
-If you are using IPv4, check that the source IPv4 address that you entered for the location matches with the network's source IPv4 address.
-
-##### 4. Analytics is not available yet
-It takes some time to generate the analytics for Cloudflare Gateway. If don't see anything even after 5 minutes, please file a support ticket.
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md b/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md
index 23decd76d84..0c25a43774b 100644
--- a/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Create a Tunnel
diff --git a/products/cloudflare-one/src/content/connections/connect-networks/private-net/index.md b/products/cloudflare-one/src/content/connections/connect-networks/private-net/index.md
index d72894eca7d..799a7e5797a 100644
--- a/products/cloudflare-one/src/content/connections/connect-networks/private-net/index.md
+++ b/products/cloudflare-one/src/content/connections/connect-networks/private-net/index.md
@@ -1,21 +1,22 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # Private networks
 
-You can connect private networks and the services running in those networks to Cloudflare using [Argo Tunnel](/glossary#argo-tunnel). End users can connect to those resources using the Cloudflare WARP agent by first authenticating into your organization's account.
+You can connect private networks and the services running in those networks to Cloudflare using [Cloudflare Tunnel](/glossary#cloudflare-tunnel). End users can connect to those resources using the Cloudflare WARP agent by first authenticating into your organization's account.
 
-Argo Tunnel runs a lightweight [daemon](/glossary#daemon) named ([`cloudflared`](/glossary#cloudflared)) in your infrastructure that establishes outbound connections (Tunnels) between your environment and the Cloudflare edge. Administrators define the IPs available in that environment and associate them with the Tunnel.
+Cloudflare Tunnel runs a lightweight [daemon](/glossary#daemon) named ([`cloudflared`](/glossary#cloudflared)) in your infrastructure that establishes outbound connections (Tunnels) between your environment and the Cloudflare edge. Administrators define the IPs available in that environment and associate them with the Tunnel.
 
-When users connect to an IP made available through Argo Tunnel, WARP sends their connection through Cloudflare's network to the corresponding Argo Tunnel.
+When users connect to an IP made available through Cloudflare Tunnel, WARP sends their connection through Cloudflare's network to the corresponding Tunnel.
 
 In order to connect private networks, you'll first need to:
 
 1. [Download and install `cloudflared`](/connections/connect-apps/install-and-setup/installation) in your private network
 2. [Authenticate `cloudflared`](/connections/connect-apps/install-and-setup/setup)
 
-Once `cloudflared` has been installed and authenticated, you will need 3 high-level steps to connect your network to users enrolled in your organization's Cloudflare for Teams account.
+Once `cloudflared` has been installed and authenticated, you will need 4 high-level steps to connect your network to users enrolled in your organization's Cloudflare for Teams account.
 
 1. [Create a Tunnel](/connections/connect-networks/private-net/create-tunnel)
 2. [Configure IPs in WARP](/connections/connect-devices/warp/exclude-traffic)
diff --git a/products/cloudflare-one/src/content/connections/index.md b/products/cloudflare-one/src/content/connections/index.md
index 180ffaefa63..2d55a602f7f 100644
--- a/products/cloudflare-one/src/content/connections/index.md
+++ b/products/cloudflare-one/src/content/connections/index.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: navigation
 ---
 
 # Connections
diff --git a/products/cloudflare-one/src/content/faq/cloudflare-tunnels-faq.md b/products/cloudflare-one/src/content/faq/cloudflare-tunnels-faq.md
index 2694b81c6d3..39a0ba2fd09 100644
--- a/products/cloudflare-one/src/content/faq/cloudflare-tunnels-faq.md
+++ b/products/cloudflare-one/src/content/faq/cloudflare-tunnels-faq.md
@@ -97,9 +97,9 @@ If your server is correctly locked down, you will see:
 [ip-address] 443 (https): Connection refused
 ```
 
-## What is the difference between Tunnel creating a CNAME or AAAA record in the hostname's DNS setting?
+## What records are created for routing to a Named Tunnel's hostname?
 
-Tunnels that use Cloudflare's Load Balancer use CNAME records. Tunnels that do not use the Load Balancer product will create AAAA records.
+Named Tunnels can be routed via DNS records, in which case we use CNAME records to point to the `<UUID>.cfargotunnel.com`; Or as Load Balancer origins, which also point to `<UUID>.cfargotunnel.com`.
 
 ## Does Cloudflare Tunnel send visitor IPs to my origin?
 
@@ -109,4 +109,31 @@ To log external visitor IPs, you will need to [configure an alternative method](
 
 ## Why does the name "warp" appear in some legacy materials?
 
-Cloudflare Tunnel was previously named Warp during the beta phase. As Warp was added to the Argo product family, we changed the name to match.
\ No newline at end of file
+Cloudflare Tunnel was previously named Warp during the beta phase. As Warp was added to the Argo product family, we changed the name to match.
+
+## How can I troubleshoot a Tunnel?
+
+### Run Tunnel with debug logging
+
+Use the following command to run your Tunnel in the debug mode:
+```sh
+$ cloudflared tunnel --loglevel debug run
+```
+
+The `--loglevel` flag indicates the logging level, which can be one of {`debug`, `info`, `warn`, `error`, `fatal`} (default: `info`). At the `debug` level, `cloudflared` will log and display the request URL, method, protocol, content length, as well as all request and response headers. However, please note that this can expose sensitive information in your logs. 
+
+### Check SSL/TLS encryption mode
+1. On the Cloudflare dashboard for your zone, navigate to **SSL/TLS** > **Overview**.
+1. If your SSL/TLS encryption mode is **Off (not secure)**, make sure that it is set to **Flexible**, **Full** or **Full (strict)**.
+
+![SSL encryption mode](../static/documentation/connections/ssl-encryption-mode.png)
+
+When the encryption mode is set to **Off (not secure)**, you may encounter connection issues when running a Tunnel.
+
+### Check location of credentials file
+If you encouter the following error when running a Tunnel, double check your `config.yml` file and ensure that the `credentials-file` points to the correct location. You may need to change `/root/` to your home directory.
+```sh
+$ cloudflared tunnel run
+2021-06-04T06:21:16Z INF Starting tunnel tunnelID=928655cc-7f95-43f2-8539-2aba6cf3592d
+Tunnel credentials file '/root/.cloudflared/928655cc-7f95-43f2-8539-2aba6cf3592d.json' doesn't exist or is not a file
+```
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/faq/index.md b/products/cloudflare-one/src/content/faq/index.md
index 15a0d3cf983..ef080eeb6d1 100644
--- a/products/cloudflare-one/src/content/faq/index.md
+++ b/products/cloudflare-one/src/content/faq/index.md
@@ -8,10 +8,10 @@ hideChildren: true
 # FAQ
 
 <ContentColumn>
-  
-Below you'll find answers to commonly asked questions on Cloudflare for Teams, as well as a troubleshooting section to help you navigate common issues and errors you may come across.
 
-If you can't find the answer you're looking for, feel free to head over to our [community page](https://community.cloudflare.com/) and post your question there.  
+Below you'll find answers to the most commonly asked questions on Cloudflare for Teams, as well as a troubleshooting section to help you navigate common issues and errors you may come across.
+
+If you can't find the answer you're looking for, feel free to head over to our [community page](https://community.cloudflare.com/) and post your question there. 
 
 </ContentColumn>
 
@@ -57,4 +57,4 @@ For questions on connecting applications with Tunnels.
 
 Got an unexpected error? See if it's covered in our troubleshooting section.
 
-<Button type="primary" href="/faq/teams-troubleshooting/">Troubleshooting ❯</Button>
+<Button type="primary" href="/faq/teams-troubleshooting/">Troubleshooting ❯</Button>
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/faq/teams-authentication-faq.md b/products/cloudflare-one/src/content/faq/teams-authentication-faq.md
index fde344a4b4a..88eaad76dfd 100644
--- a/products/cloudflare-one/src/content/faq/teams-authentication-faq.md
+++ b/products/cloudflare-one/src/content/faq/teams-authentication-faq.md
@@ -13,4 +13,20 @@ Yes. Your team can simultaneously use multiple providers, reducing friction when
 
 ## What if the identity provider my team uses is not listed?
 
-You can add your preferred identity providers to Cloudflare Access even if you don't see them listed on the Teams dashboard, as long as these providers support SAML 2.0 or [OpenID Connect (OIDC)](/identity/idp-integration/generic-oidc). 
\ No newline at end of file
+You can add your preferred identity providers to Cloudflare Access even if you do not see them listed on the Teams dashboard, as long as these providers support SAML 2.0 or [OpenID Connect (OIDC)](/identity/idp-integration/generic-oidc). 
+
+## How do end users log out of an application protected by Access?
+
+Access provides a URL that will end a user's current session. To force log out of an Access application, use the following URL:
+
+```
+[your-application-domain]/cdn-cgi/access/logout
+```
+
+To log out of an App Launcher session, use the following URL:
+
+```
+[your-team-name].cloudflareaccess.com/cdn-cgi/access/logout
+```
+
+You can use these URLs to create custom logout buttons or links directly within applications.
diff --git a/products/cloudflare-one/src/content/faq/teams-devices-faq.md b/products/cloudflare-one/src/content/faq/teams-devices-faq.md
index 1eace8f289d..9854522f460 100644
--- a/products/cloudflare-one/src/content/faq/teams-devices-faq.md
+++ b/products/cloudflare-one/src/content/faq/teams-devices-faq.md
@@ -19,4 +19,7 @@ Cloudflare WARP Client in WARP mode was meant to ensure all your traffic is kept
 Sites inside Cloudflare network are able to see this information. If a site is showing you your IP address, chances are they are in our network. Most sites outside our network (orange clouded sites) however are unable to see this information and instead see the nearest egress colo to their server. We are working to see if in the future we can't find a way to more easily share this information with a limited number of gray clouded sites where it is relevant to both parties.
 
 ## ​Why has my throughput dropped while using WARP?
-Cloudflare WARP is in part powered by 1.1.1.1. When visiting sites or going to a new location on the Internet, you should see blazing fast DNS lookups. However, WARP is built to trade some throughput for enhanced privacy, because it encryps all traffic both to and from your device. While this isn't noticeable at most mobile speeds, on desktop systems in countries where high speed broadband is available, you may notice a drop. We think the tradeoff is worth it though and continue to work on improving performance all over the system.
\ No newline at end of file
+Cloudflare WARP is in part powered by 1.1.1.1. When visiting sites or going to a new location on the Internet, you should see blazing fast DNS lookups. However, WARP is built to trade some throughput for enhanced privacy, because it encryps all traffic both to and from your device. While this isn't noticeable at most mobile speeds, on desktop systems in countries where high speed broadband is available, you may notice a drop. We think the tradeoff is worth it though and continue to work on improving performance all over the system.
+
+## Firefox is showing a network protocol violation when I use the WARP client.
+If you see this warning, you may have to disable DNS over HTTPs setting in Firefox. If you need help doing that, see [these instructions](https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_manually-enabling-and-disabling-dns-over-https).
diff --git a/products/cloudflare-one/src/content/faq/teams-policies-faq.md b/products/cloudflare-one/src/content/faq/teams-policies-faq.md
index 9a28cbdfe45..3d1286e78a2 100644
--- a/products/cloudflare-one/src/content/faq/teams-policies-faq.md
+++ b/products/cloudflare-one/src/content/faq/teams-policies-faq.md
@@ -38,4 +38,16 @@ Isolation policies, like all HTTP policies, are evaluated in stages. When a user
 Isolation policies are applied to requests that include Accept: `text/html*`. This allows Browser Isolation policies to co-exist with API and command line requests.
 
 ## Can Access enforce policies on a specific nonstandard port?
-No. Cloudflare Access cannot enforce a policy that would contain a port appended to the URL. However, you can use Cloudflare Argo Tunnel to point traffic to non-standard ports. For example, if Jira is available at port `8443` on your origin, you can proxy traffic to that port via Argo Tunnel.
\ No newline at end of file
+No. Cloudflare Access cannot enforce a policy that would contain a port appended to the URL. However, you can use Cloudflare Tunnel to point traffic to non-standard ports. For example, if Jira is available at port `8443` on your origin, you can proxy traffic to that port via Cloudflare Tunnel.
+
+## Why can I still reach domains blocked by a DNS policy?
+
+Here is a list of possible causes:
+
+* **Your policy is still being updated.** After you edit or create a policy, Cloudflare updates the new setting across all of our data centers around the world. It takes about 60 seconds for the change to propagate.
+
+* **Your device is using another DNS resolver.** If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. As a result, the domain you are trying to block is still accessible from your device. Make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
+
+* **Your policy is not assigned to a location.** If your policy is not assigned to a location and you send a DNS query from that location, Gateway will not apply that policy. Assign a policy to a location to make sure the desired policy is applied when you send a DNS query from that location.
+
+* **Your DoH endpoint is not a Gateway location**. Browsers can be configured to use any DoH endpoint. If you chose to configure DoH directly in your browser, make sure that the DoH  endpoint is a Gateway location. 
diff --git a/products/cloudflare-one/src/content/faq/teams-troubleshooting.md b/products/cloudflare-one/src/content/faq/teams-troubleshooting.md
index dea2593764f..edc3e2cbf97 100644
--- a/products/cloudflare-one/src/content/faq/teams-troubleshooting.md
+++ b/products/cloudflare-one/src/content/faq/teams-troubleshooting.md
@@ -52,10 +52,6 @@ You may not see analytics on the Overview page for the following reasons:
 * **The source IPv4 address for your location is incorrect**. If you are using IPv4, check the source IPv4 address that you entered for the location matches with the network's source IPv4 address.
 * **Analytics is not available yet**. It takes some time to generate the analytics for Cloudflare Gateway. If you are not seeing anything even after 5 minutes, please file a support ticket.
 
-## I see a `websocket: bad handshake` error.
-
-If your Cloudflare account has Universal SSL enabled and the SSL/TLS encryption mode is set to Off, cloudflared will return a "websocket: bad handshake" error. To resolve, set the SSL/TLS encryption mode to any setting other than Off.
-
 ## ​I see a "No Browsers Available" alert.
 
 If you encounter this error please [file feedback](https://developers.cloudflare.com/cloudflare-one/connections/connect-browsers/known-limitations#submitting-feedback) via the WARP client and we will investigate.
@@ -66,6 +62,17 @@ A browser isolation session is a connection from your local browser to a remote
 
 Safari is more susceptible to presenting this error. See [workaround](/connections/connect-browsers/known-limitations#safari).
 
+## I see `Error 400 admin_policy_enforced` when using GSuite as an identity provider.
+
+<div class="small-img"><img alt="Google Error 400" src="../static/documentation/faq/google-error-400.png"/></div>
+
+This is due to a Google policy change requiring you to flag your applications as trusted in the GSuite Admin console:
+1. In the Google Admin console, navigate to **Security > Settings > API Permissions**.
+1. Locate the domain you would like to mark as trusted.
+1. Click on the three-dots menu to the right.
+1. Select **Trust**.
+
+
 ## Mobile applications warn of an invalid certificate, even though I installed the Cloudflare certificate on my system.
 
 These mobile applications may use [certificate pinning](/glossary#certificate-pinning). Cloudflare Gateway dynamically generates a certificate for all encrypted connections in order to inspect the content of HTTP traffic. This certificate will not match the expected certificate by applications that use certificate pinning.
@@ -73,11 +80,11 @@ To allow these applications to function normally, administrators can configure b
 
 ## My tunnel fails to authenticate. 
 
-To start using Argo Tunnel, a super administrator in the Cloudflare account must first log in through `cloudflared login`. The client will launch a browser window and prompt the user to select a hostname in their Cloudflare account. Once selected, Cloudflare generates a certificate that consists of three components:
+To start using Cloudflare Tunnel, a super administrator in the Cloudflare account must first log in through `cloudflared login`. The client will launch a browser window and prompt the user to select a hostname in their Cloudflare account. Once selected, Cloudflare generates a certificate that consists of three components:
 
 * The public key of the origin certificate for that hostname
 * The private key of the origin certificate for that domain
-* A token that is unique to Argo Tunnel
+* A token that is unique to Cloudflare Tunnel
 
 Those three components are bundled into a single PEM file that is downloaded one time during that login flow. The host certificate is valid for the root domain and any subdomain one-level deep. Cloudflare uses that certificate file to authenticate `cloudflared` to create DNS records for your domain in Cloudflare.
 
@@ -85,4 +92,24 @@ The third component, the token, consists of the zone ID (for the selected domain
 
 ## Firefox shows network protocol violation when using the WARP client
 
-You may have to disable the DNS over HTTPs setting in Firefox. To do so, navigate to Firefox Preferences, scroll down to **Network Settings**, and uncheck **Enable DNS over HTTPS > OK**.
\ No newline at end of file
+You may have to disable the DNS over HTTPs setting in Firefox. To do so, navigate to Firefox Preferences, scroll down to **Network Settings**, and uncheck **Enable DNS over HTTPS > OK**.
+
+## `cloudflared access` shows an error `websocket: bad handshake`
+
+This means that your `cloudflared access` client is unable to reach your `cloudflared tunnel` origin.
+To diagnose this, you should look at the `cloudflared tunnel` logs. A very often root cause is that the `cloudflared tunnel` is unable to proxy to your origin (e.g. because the ingress is mis-configured, or the origin is down, or because the origin HTTPS certificate cannot be validated by `cloudflared tunnel`).
+If `cloudflared tunnel` has no logs, it means Cloudflare Edge is not even able to route the websocket traffic to it.
+
+There are a few different possible root causes behind the `websocket: bad handshake` error:
+
+* Your `cloudflared tunnel` is either not running or not connected to Cloudflare Edge.
+* WebSockets are not enabled. To enable them, navigate to `dash.cloudflare.com` > **Network**.
+* Your Cloudflare account has Universal SSL enabled and the SSL/TLS encryption mode is set to *Off*. To resolve, set the SSL/TLS encryption mode to any setting other than *Off*.
+* Your requests are blocked by [Super Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/pro). To resolve, make sure you set **Definitely automated** to *Allow* in the bot fight mode settings.
+
+## I see an error: x509: certificate signed by unknown authority
+
+This means the origin is using a certificate that `cloudflared` does not trust. For example, you may get this error if you are using SSL inspection in a proxy between your server and Cloudflare. To solve this:
+1. Add the certificate to the system certificate pool.
+1. Use the `--origin-ca-pool` flag and specify the path to the certificate.
+1. Use the `--no-tls-verify` flag to stop `cloudflared` checking the certificate for a trust chain.
diff --git a/products/cloudflare-one/src/content/glossary/index.md b/products/cloudflare-one/src/content/glossary/index.md
index 36f95db273b..b32d2509bda 100644
--- a/products/cloudflare-one/src/content/glossary/index.md
+++ b/products/cloudflare-one/src/content/glossary/index.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: reference
 ---
 
 # Glossary
@@ -13,8 +14,8 @@ Cloudflare Access replaces corporate VPNs with Cloudflare’s network. Instead o
 ## [Cloudflare Gateway](https://www.cloudflare.com/en-gb/teams/gateway/)
 Cloudflare Gateway is a modern next generation firewall between your user, device or network and the public Internet. Once you setup Cloudflare Gateway, Gateway's DNS filtering service will inspect all Internet bound DNS queries, log them and apply corresponding policies.
 
-## [Argo Tunnel](https://www.cloudflare.com/en-gb/products/argo-tunnel/)
-A secure outbound connection which runs in your infrastructure to connect the applications and machines to Cloudflare.
+## [Cloudflare Tunnel](https://www.cloudflare.com/en-gb/products/tunnel/)
+Cloudflare Tunnel (formerly *Argo Tunnel*) establishes a secure outbound connection which runs in your infrastructure to connect the applications and machines to Cloudflare.
 
 ## WARP client
 Teams customers can use the Cloudflare WARP application to connect corporate desktops to Cloudflare Gateway for advanced web filtering. The Gateway features rely on the same performance and security benefits of the underlying WARP technology, with security filtering available to the connection.
@@ -33,10 +34,7 @@ The resource being protected by Cloudflare for Teams. An application can be a su
 
 ## Authenticated Origin Pulls
 
-Authenticated Origin Pulls let origin web servers validate that a web request came from Cloudflare. Cloudflare uses TLS client certificate authentication, a feature supported by most web servers, to present a Cloudflare certificate when establishing a connection between Cloudflare and the origin web server.
-
-| Related products: | [Cloudflare SSL](https://developers.cloudflare.com/ssl/) |
-|---|---|
+[Authenticated Origin Pulls](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull) let origin web servers validate that a web request came from Cloudflare. Cloudflare uses TLS client certificate authentication, a feature supported by most web servers, to present a Cloudflare certificate when establishing a connection between Cloudflare and the origin web server.
 
 ## certificate pinning
 
@@ -44,9 +42,10 @@ Certificate pinning is a security mechanism used to prevent man-in-the-middle (M
 
 ## cloudflared
 
-`cloudflared` is the software that powers [Argo Tunnel](#argo-tunnel). `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
+`cloudflared` is the software that powers [Cloudflare Tunnel](#cloudflare-tunnel). `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
 
 ## daemon
+
 A program that performs tasks without active management or maintenance.
 
 ## DNS filtering
@@ -59,7 +58,12 @@ Each device connected to the Internet has a unique IP address which other machin
 
 ## DNS over HTTPS
 
-With [DNS over HTTPS](/connections/connect-devices/agentless/dns-over-https) (DoH), DNS queries and responses are encrypted, and they are sent via the HTTP or HTTP/2 protocols. Like [DNS over TLS](#dns-over-tls), DoH ensures that attackers can't forge or alter DNS traffic. DoH traffic looks like other HTTPS traffic – e.g. normal user-driven interactions with websites and web apps – from a network administrator's perspective.
+By default, DNS queries and responses are sent from a DNS client to a DNS server using the UDP or TCP protocols — which means they’re sent in plaintext, without encryption. This has a huge impact on security: unencrypted queries can be tracked and spoofed by malicious actors, advertisers, ISPs, and others.
+
+[DNS over TLS (DoT)](#dns-over-tls) and [DNS over HTTPS (DoH)](/connections/connect-devices/agentless/dns-over-https) are two standards developed for encrypting plaintext DNS traffic to prevent untrustworthy entities from interpreting and manipulating it. The main difference between DoT and DoH is the port they use to encrypt traffic, and the encryption method they use.
+
+DoH uses port 443, which is the standard HTTPS traffic port, to wrap the DNS request in an HTTPS request. It uses HTTPS and HTTP/2 to encrypt traffic at the application layer. With DoH, DNS queries and responses are camouflaged within other HTTPS traffic, since it all comes and goes from the same port. This means they cannot easily be blocked without blocking all other HTTPS traffic as well, but it also provides users with greater privacy, as network administrators will have no visibility on the DNS queries hidden within the larger flow of HTTPS traffic. 
+
 
 ## DoH subdomain
 
@@ -71,7 +75,11 @@ Each location in Teams has a unique DoH subdomain (previously known as a *unique
 
 ## DNS over TLS
 
-[DNS over TLS](/connections/connect-devices/agentless/dns-over-tls) (DoT), is a standard for encrypting DNS queries to keep them secure and private. DoT uses the same security protocol, TLS, that HTTPS websites use to encrypt and authenticate communications (TLS is also known as "SSL"). DoT adds TLS encryption on top of the user datagram protocol (UDP), which is used for DNS queries. Additionally, it ensures that DNS requests and responses are not tampered with or forged via on-path attacks.
+By default, DNS queries and responses are sent from a DNS client to a DNS server using the UDP or TCP protocols — which means they’re sent in plaintext, without encryption. This lack of privacy has a huge impact on security: unencrypted queries can be tracked and spoofed by malicious actors, advertisers, ISPs, and others.
+
+[DNS over TLS (DoT)](/connections/connect-devices/agentless/dns-over-tls) and [DNS over HTTPS (DoH)](#dns-over-https) are two standards developed for encrypting plaintext DNS traffic to prevent untrustworthy entities from interpreting and manipulating it. The main difference between DoT and DoH is the port they use to encrypt traffic, and the encryption method they use.
+
+DNS over TLS uses its own port, 853, to wrap DNS requests within a TLS connection. With DoT, the encryption happens at the transport layer, where it adds TLS encryption on top of the user datagram protocol (UDP). Because DoT has a dedicated port, anyone with network visibility can see DoT traffic coming and going, even though the requests and responses themselves are encrypted. This gives administrators the ability to monitor and block DNS queries, which is important for identifying and stopping malicious traffic.
 
 ## hostname
 The name given to a server or node on a network. In most cases, the public DNS name of a server.
@@ -84,7 +92,7 @@ An identity provider (IdP or IDP) stores and manages users' digital identities.
 
 An open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
 
-## [location](/policies/filtering/dns-policies/configuring-locations)
+## [location](/connections/connect-networks/locations)
 Locations are physical entities like offices, homes, retail stores, movie theatres or a data center.
 
 ## mTLS
@@ -104,7 +112,7 @@ A simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to v
 
 ## origin certificate
 
-Cloudflare Origin Certificates are free SSL certificates issued by Cloudflare for installation on your origin server to facilitate end-to-end encryption for your visitors using HTTPS.
+[Cloudflare Origin Certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca) are free SSL certificates issued by Cloudflare for installation on your origin server to facilitate end-to-end encryption for your visitors using HTTPS.
 
 ## [policy](/policies)
 A set of rules that regulate your network activity, such as who logs into your applications, or which websites your users can reach.
@@ -166,7 +174,9 @@ The customizable portion of your [team domain](#team-domain). You can change thi
 [Terraform](https://www.terraform.io/) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building Cloudflare resources.
 
 ## Tunnel certificate
-The Argo Tunnel software, `cloudflared`, generates a certificate when you login with your Cloudflare account. The certificate consists of a [service token](#service-token) and [origin certificate](#origin-certificate).
+
+The Cloudflare Tunnel software, `cloudflared`, generates a certificate when you login with your Cloudflare account. The certificate consists of a [service token](#service-token) and [origin certificate](#origin-certificate).
 
 ## Zero Trust Security
+
 An IT security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter. No single specific technology is associated with zero trust architecture; it is a holistic approach to network security that incorporates several different principles and technologies.
diff --git a/products/cloudflare-one/src/content/identity/devices/application-check.md b/products/cloudflare-one/src/content/identity/devices/application-check.md
new file mode 100644
index 00000000000..60c7e4cc4e4
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/application-check.md
@@ -0,0 +1,103 @@
+---
+order: 11
+pcx-content-type: how-to
+---
+
+# Application Check
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+<Aside type="note">
+
+You can create multiple instances of the Application Check for each operating system you need to run it on, or if you need to check for multiple applications.
+
+</Aside>
+
+The Application Check device posture attribute checks that a specific application process is running on a device.
+
+To enable Application Check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **Application Check**.
+1. Enter a descriptive name for the check.
+1. Select your operating system.
+1. Enter a file path (for example, `c:\my folder\myfile.exe`).
+1. Next, you can choose to enter a [**Signing certificate thumbprint**](#determine-the-signing-thumbprint). 
+
+    Adding this information will enable the check to ensure that the application was signed by the expected software developer. 
+
+1. You can also opt to enter a [**SHA-256** value](#determine-the-sha-256-value). 
+
+    This enables the check to ensure the integrity of the binary file on the device.
+
+1. Click **Save**.
+
+Your device posture attribute is now visible on the **Device posture** page.
+
+## Determine the signing thumbprint
+
+The process to determine the signing thumbprint of an application varies depending on the operating system. This is how you would look up the signing thumbprint of the Cloudflare WARP application on macOS and Windows.
+
+### On macOS
+
+1. Create a directory.
+
+    ```sh
+    $ ~/Desktop % mkdir tmp
+
+    $ ~/Desktop % cd tmp
+    ```
+
+1. Run the following command to extract certificates for the WARP application:
+
+    ```sh
+    $ ~/Desktop/tmp % codesign -d --extract-certificates "/Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP" Executable=/Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP
+    ```
+
+1. Next, run the following commant to extract the SHA1 thumbprint:
+
+    ```sh
+    $ ~/Desktop/tmp % openssl x509 -inform DER -in codesign0 -fingerprint -sha1 -noout | tr -d :                              
+    SHA1 Fingerprint=FE2C359D79D4CEAE6BDF7EFB507326C6B4E2436E
+    ```
+
+### On Windows
+
+1. Open a PowerShell window.
+1. Use the `Get-AuthenticodeSignature` command to find the thumbprint. For example:
+
+```txt
+Get-AuthenticodeSignature -FilePath c:\myfile.exe
+```
+
+## Determine the SHA-256 value
+
+The SHA-256 value almost always changes between versions of a file/application. 
+
+### On macOS
+
+1. Open a Terminal window.
+1. Use the `shasum` command to find the SHA256 value of the file. For example:
+
+```sh
+$ shasum -a 256 myfile
+```
+
+### On Windows
+
+1. Open a PowerShell window.
+1. Use the `get-filehash` command to find the SHA256 value of the file. For example:
+
+```txt
+get-filehash -path "C:\myfile.exe" -Algorithm SHA256 | format-list
+```
diff --git a/products/cloudflare-one/src/content/identity/devices/azure-ad.md b/products/cloudflare-one/src/content/identity/devices/azure-ad.md
index ef415111f4b..9a5ce3ac87f 100644
--- a/products/cloudflare-one/src/content/identity/devices/azure-ad.md
+++ b/products/cloudflare-one/src/content/identity/devices/azure-ad.md
@@ -1,9 +1,21 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Azure AD
 
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| Windows | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
 Cloudflare Access can integrate with Azure AD's Conditional Access feature to require that users connect to certain applications from managed devices. To enable, you must integrate Azure AD with Cloudflare Access as a cloud app that requires managed device connections. You can use Cloudflare Access' [per-app IdP feature](/identity/idp-integration) to segment which Access applications require Azure AD with managed devices and which only require Azure AD.
 
 ## Azure AD Configuration
@@ -32,4 +44,4 @@ In the Cloudflare for Teams dashboard, you can configure which applications requ
 
 2. Open the **Authentication** tab.
 
-3. Toggle the *Azure AD* integration that requires managed device usage.
\ No newline at end of file
+3. Toggle the *Azure AD* integration that requires managed device usage.
diff --git a/products/cloudflare-one/src/content/identity/devices/carbon-black.md b/products/cloudflare-one/src/content/identity/devices/carbon-black.md
index 4ffb34f4dc7..42d65d1af99 100644
--- a/products/cloudflare-one/src/content/identity/devices/carbon-black.md
+++ b/products/cloudflare-one/src/content/identity/devices/carbon-black.md
@@ -1,19 +1,27 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
  
 # Carbon Black
 
-Cloudflare for Teams can check if [Carbon Black](https://www.carbonblack.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | Minimum WARP version required | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---------- | ---- |
+| macOS, Windows | WARP with Gateway | macOS: 1.4.34, Windows: 1.4.33.0 | All plans | 
 
-| Prerequisites |
-| ------------- |
-| The WARP client installed on a user machine and updated to the latest version (minimum version required - macOS: Version 1.4.34 and Windows: Version 1.4.33.0) |
-| Carbon Black installed on a user machine |
+</div>
+</details>
 
+Cloudflare for Teams can check if [Carbon Black](https://www.carbonblack.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
 
 ## Configuring the Cloudflare integration
 
+Before you start, make sure Carbon Black installed on your machine.
+
 1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **My Team > Devices > Device posture**.
 
 1. Select **+Add**.
@@ -26,7 +34,7 @@ Cloudflare for Teams can check if [Carbon Black](https://www.carbonblack.com/) i
     * **Name:** A unique identifier for this Carbon Black device posture check
     * **Operating system:** You’ll need to configure one posture check per operating system (macOS and Windows currently supported)
     * **Application Path:** Enter the full path to the Carbon Black process to be checked (for example, `c:\program files\CarbonBlack\CarbonBlack.exe`)
-    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from Carbon Black and is the recommended way to validated the process
+    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from Carbon Black and is the recommended way to validate the process
     * **SHA256 checksum (optional):** Used to validate the SHA256 signature of the binary. This verifies the binary exactly matches the one you expect to be there. Note: do not fill out this field unless you strictly control updates to Carbon Black, as this will change between versions
 
 1. Once you have configured your Carbon Black instance, you can then add Carbon Black device posture checks to any application protected by Access.
diff --git a/products/cloudflare-one/src/content/identity/devices/corp-device.md b/products/cloudflare-one/src/content/identity/devices/corp-device.md
index b5c722cecce..0fa4e36b355 100644
--- a/products/cloudflare-one/src/content/identity/devices/corp-device.md
+++ b/products/cloudflare-one/src/content/identity/devices/corp-device.md
@@ -1,9 +1,21 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # Device serial numbers
 
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
 Cloudflare for Teams allows you to build Zero Trust rules based on device serial numbers. You can create these rules so that access to applications is granted only to users connecting from company devices.
 
 To create rules based on device serial numbers you'll need to create a list of numbers using the [Lists](/policies/lists) functionality in the Teams Dashboard.
@@ -16,11 +28,9 @@ In order for your users to be able to authenticate, you must [deploy the WARP ag
 
 </Aside>
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Configuration > Lists**.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **My Team > Lists**.
 
-1. Click **Create manual list** or **Upload CSV**. For larger teams, we recommend uploading a CSV or using Cloudflare's API endpoint.
-
-   ![Add List](../../static/zero-trust-security/corp-device/list-start.png)
+1. Click **Create manual list** or **Upload CSV**. For larger teams, it is recommended to upload a CSV or use Cloudflare's API endpoint.
 
 1. Give your list a descriptive name, as this name will appear when configuring your Access policies.
 
@@ -36,7 +46,7 @@ In order for your users to be able to authenticate, you must [deploy the WARP ag
 
   Once saved, the serial number list will appear in your list view.
 
-   ![Saved List](../../static/zero-trust-security/corp-device/list-save-list.png)
+   ![List](../../static/zero-trust-security/corp-device/list-saved.png)
 
 Now you can create or update an existing Access policy to require that any device requesting access belongs to your list of serial numbers.
 
@@ -62,4 +72,3 @@ To do that:
 
 Once saved, any device attempting to reach the application will need to connect from a device that uses Cloudflare WARP and presents a serial number in the list created.
 
-
diff --git a/products/cloudflare-one/src/content/identity/devices/crowdstrike.md b/products/cloudflare-one/src/content/identity/devices/crowdstrike.md
index 14c9356b1e5..d97fdd1b986 100644
--- a/products/cloudflare-one/src/content/identity/devices/crowdstrike.md
+++ b/products/cloudflare-one/src/content/identity/devices/crowdstrike.md
@@ -1,19 +1,27 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # CrowdStrike
 
-Cloudflare for Teams can check if [CrowdStrike](https://www.crowdstrike.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | Minimum WARP version required | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---------- | ---- |
+| macOS, Windows | WARP with Gateway | macOS: 1.4.27, Windows: 1.4.25.0 | All plans | 
 
-| Prerequisites |
-| ------------- |
-| The WARP client installed on a user machine and updated to the latest version (minimum version required - Windows: 1.4.25.0, macOS: 1.4.27) |
-| CrowdStrike installed on a user machine |
+</div>
+</details>
 
+Cloudflare for Teams can check if [CrowdStrike](https://www.crowdstrike.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
 
 ## Configuring the Cloudflare integration
 
+Before you start, make sure CrowdStrike installed on your machine.
+
 1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **My Team > Devices > Device posture**.
 
 1. Select **+Add**.
@@ -26,7 +34,7 @@ Cloudflare for Teams can check if [CrowdStrike](https://www.crowdstrike.com/) is
     * **Name:** A unique identifier for this CrowdStrike device posture check
     * **Operating system:** You’ll need to configure one posture check per operating system (macOS and Windows currently supported)
     * **Application Path:** Enter the full path to the CrowdStrike process to be checked (for example, `c:\program files\CrowdStrike\CrowdStrike.exe`)
-    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from CrowdStrike and is the recommended way to validated the process
+    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from CrowdStrike and is the recommended way to validate the process
     * **SHA256 checksum (optional):** Used to validate the SHA256 signature of the binary. This verifies the binary exactly matches the one you expect to be there. Note: do not fill out this field unless you strictly control updates to CrowdStrike, as this will change between versions
 
 1. Once you have configured your CrowdStrike instance, you can then add CrowdStrike device posture checks to any application protected by Access.
diff --git a/products/cloudflare-one/src/content/identity/devices/disk-encryption.md b/products/cloudflare-one/src/content/identity/devices/disk-encryption.md
new file mode 100644
index 00000000000..beccab7bba8
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/disk-encryption.md
@@ -0,0 +1,32 @@
+---
+order: 15
+pcx-content-type: how-to
+title: Disk Encryption
+---
+
+# Disk Encryption (beta)
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Status | Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| --- | ----------------- | --------- | ---- |
+| Beta | macOS, Windows, Linux | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+The Disk Encryption device posture attribute ensures that disks are encrypted on a device.
+
+To enable the Disk Encryption check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **Disk Encryption**.
+1. Enter a descriptive name for the check.
+1. Select your operating system.
+1. Toggle on the **Enable Disk Encryption** switch.
+1. Click **Save**.
+
+Your device posture attribute is now visible on the **Device posture** page.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/identity/devices/domain-joined.md b/products/cloudflare-one/src/content/identity/devices/domain-joined.md
new file mode 100644
index 00000000000..dccf2eaa710
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/domain-joined.md
@@ -0,0 +1,31 @@
+---
+order: 14
+pcx-content-type: how-to
+title: Domain Joined
+---
+
+# Domain Joined (beta)
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Status | Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| --- | ----------------- | --------- | ---- |
+| Beta | Windows | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+The Domain Joined device posture attribute ensures that a user is a member of a specific Windows Active Directory domain.
+
+To enable the Domain Joined check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **Domain Joined**.
+1. Enter a descriptive name for the check.
+1. Enter the domain you want Domain Joined to check for.
+1. Click **Save**.
+
+Your device posture attribute is now visible on the **Device posture** page.
diff --git a/products/cloudflare-one/src/content/identity/devices/file-check.md b/products/cloudflare-one/src/content/identity/devices/file-check.md
new file mode 100644
index 00000000000..c5ce79bfc6d
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/file-check.md
@@ -0,0 +1,103 @@
+---
+order: 12
+pcx-content-type: how-to
+---
+
+# File Check
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| macOS, Windows, Linux | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+<Aside type="note">
+
+You can create multiple instances of the File Check for each operating system you need to run it on, or if you need to check for multiple files.
+
+</Aside>
+
+The File Check device posture attribute checks for the presence of a file on a device.
+
+To enable File Check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **File Check**.
+1. Enter a descriptive name for the check.
+1. Select your operating system.
+1. Enter a file path (for example: `c:\my folder\myfile.exe`).
+1. Next, you can choose to enter a [**Signing certificate thumbprint**](#determine-the-signing-thumbprint). 
+
+    Adding this information will enable the check to ensure that the file was signed by the expected software developer. 
+
+1. You can also opt to enter a [**SHA-256** value](#determine-the-sha-256-value). 
+
+    This enables the check to ensure the integrity of the binary file on the device.
+
+1. Click **Save**.
+
+Your device posture attribute is now visible on the **Device posture** page.
+
+## Determine the signing thumbprint
+
+The process to determine the signing thumbprint of a file varies depending on the operating system. This is how you would look up the signing thumbprint of the Cloudflare WARP application on macOS and Windows.
+
+### On macOS
+
+1. Create a directory.
+
+    ```sh
+    $ ~/Desktop % mkdir tmp
+    
+    $ ~/Desktop % cd tmp
+    ```
+
+1. Run the following command to extract certificates for the WARP application:
+
+    ```sh
+    $ ~/Desktop/tmp % codesign -d --extract-certificates "/Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP" Executable=/Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP
+    ```
+
+1. Next, run the following commant to extract the SHA1 thumbprint:
+
+    ```sh
+    $ ~/Desktop/tmp % openssl x509 -inform DER -in codesign0 -fingerprint -sha1 -noout | tr -d :                              
+    SHA1 Fingerprint=FE2C359D79D4CEAE6BDF7EFB507326C6B4E2436E
+    ```
+
+### On Windows
+
+1. Open a PowerShell window.
+1. Use the `Get-AuthenticodeSignature` command to find the thumbprint. For example:
+
+```txt
+Get-AuthenticodeSignature -FilePath c:\myfile.exe
+```
+
+## Determine the SHA-256 value
+
+The SHA-256 value almost always changes between versions of a file/application. 
+
+### On macOS
+
+1. Open a Terminal window.
+1. Use the `shasum` command to find the SHA256 value of the file. For example:
+
+```sh
+$ shasum -a 256 myfile
+```
+
+### On Windows
+
+1. Open a PowerShell window.
+1. Use the `get-filehash` command to find the SHA256 value of the file. For example:
+
+```txt
+get-filehash -path "C:\myfile.exe" -Algorithm SHA256 | format-list
+```
diff --git a/products/cloudflare-one/src/content/identity/devices/firewall.md b/products/cloudflare-one/src/content/identity/devices/firewall.md
new file mode 100644
index 00000000000..ccea7f43f8d
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/firewall.md
@@ -0,0 +1,32 @@
+---
+order: 16
+pcx-content-type: how-to
+title: Firewall
+---
+
+# Firewall (beta)
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Status | Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| --- | ----------------- | --------- | ---- |
+| Beta | macOS, Windows | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+The Firewall device posture attribute ensures that a firewall is running on a device.
+
+To enable the Firewall check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **Firewall**.
+1. Enter a descriptive name for the check.
+1. Select your operating system.
+1. Toggle on the **Enable firewall check** switch.
+1. Click **Save**.
+
+Your device posture attribute is now visible on the **Device posture** page.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/identity/devices/index.md b/products/cloudflare-one/src/content/identity/devices/index.md
index 3baa37ec045..14434daa6d8 100644
--- a/products/cloudflare-one/src/content/identity/devices/index.md
+++ b/products/cloudflare-one/src/content/identity/devices/index.md
@@ -1,11 +1,35 @@
 ---
 order: 3
+pcx-content-type: how-to
+title: Device posture
 ---
 
-# Device posture
+# Device posture attributes
 
-Cloudflare for Teams can integrate with endpoint protection providers to check requests for device posture. This allows you to configure security policies that rely on additional signals from endpoint security providers to allow or deny connections to your applications. 
+With Teams, you can configure Zero Trust policies that rely on additional signals from endpoint security providers to allow or deny connections to your applications. 
 
-When device posture checks are configured, users will only be allowed to connect to a protected application when they are using a managed or healthy device, as determined by the endpoint security provider.
+When device posture checks are configured, users can only connect to a protected application if they have a managed or healthy device, as determined by the endpoint security provider associated to the Zero Trust policy regulating access to the protected application.
 
-<DirectoryListing path="/identity/devices"/>
\ No newline at end of file
+To enable one or more device posture attributes, navigate to **My Team** > **Devices** > **Device posture** on the [Teams Dashboard](https://dash.teams.cloudflare.com) and click **+Add**.
+
+<Aside>
+
+When setting up new device posture checks, we recommend first testing them without setting certificate thumbprint or SHA256 checksum values. 
+
+</Aside>
+
+## Available device posture attributes
+
+<DirectoryListing path="/identity/devices"/>
+
+## Verify device posture checks in the WARP client
+
+On desktop clients, you can always verify which device posture checks are active on your devices. To do that:
+
+1. Open the WARP client.
+1. Go to **Settings** > **Advanced**.
+1. Click on **Device posture information**.
+
+This will show a list of active device posture checks.
+
+   ![Device posture attributes](../../static/documentation/identity/devices/device-posture-client-ui.png)
diff --git a/products/cloudflare-one/src/content/identity/devices/mutual-tls-authentication.md b/products/cloudflare-one/src/content/identity/devices/mutual-tls-authentication.md
index f444504eb61..9ad9b292ca1 100644
--- a/products/cloudflare-one/src/content/identity/devices/mutual-tls-authentication.md
+++ b/products/cloudflare-one/src/content/identity/devices/mutual-tls-authentication.md
@@ -1,9 +1,21 @@
 ---
-order: 2
+order: 4
+pcx-content-type: how-to
 ---
 
 # Mutual TLS
 
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All sytems | WARP not required | Enterprise plans | 
+
+</div>
+</details>
+
 <Aside type='warning' header='Important'>
 
 Adding mTLS to your application is only available on the [**Cloudflare enterprise plan**](https://www.cloudflare.com/en-gb/plans/enterprise/). For more information, please contact your Cloudflare customer success manager.
@@ -29,7 +41,7 @@ The mTLS certificate is used **only** to verify the client certificate. It does
 
 To enforce mTLS authentication from the [Teams dashboard](https://dash.teams.cloudflare.com):
 
-1. Navigate to **Configuration > Service Auth > Mutual TLS**.
+1. Navigate to **Access > Service Auth > Mutual TLS**.
 
 2. Click **Add mTLS Certificate**.
 
diff --git a/products/cloudflare-one/src/content/identity/devices/os-version.md b/products/cloudflare-one/src/content/identity/devices/os-version.md
new file mode 100644
index 00000000000..1c6f49839ef
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/os-version.md
@@ -0,0 +1,48 @@
+---
+order: 4
+pcx-content-type: how-to
+title: OS Version 
+---
+
+# OS Version (beta)
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Status | Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| --- | ----------------- | --------- | ---- |
+| Beta | macOS, Windows | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+The OS Version device posture attribute checks whether the version of a device’s operating system matches, is greater than or lesser than a given value.
+
+To enable the OS version check:
+
+1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**.
+1. Click **+Add**.
+1. Select **OS version**.
+1. Enter a descriptive name for the check.
+1. Combine the **Operating system**, **Operator**, and **Value** fields to specify the OS version you want devices to match.
+1. Click **Save**.
+
+## Determine the OS Version
+Operating systems display version numbers in different ways. This section covers how to retrieve the version number in each OS, in a format matching what the OS Version posture check expects.
+
+### On macOS
+1. Open a terminal window
+1. Use the `defaults` command to check for the value of `SystemVersionStampAsString`
+
+```txt
+defaults read loginwindow SystemVersionStampAsString
+```
+
+### On Windows
+1. Open a powershell windows
+1. Use the `Get-CimInstance` command to get the version property of the `Win32_OperatingSystem` class
+
+```txt
+(Get-CimInstance Win32_OperatingSystem).version
+```
diff --git a/products/cloudflare-one/src/content/identity/devices/require-gateway.md b/products/cloudflare-one/src/content/identity/devices/require-gateway.md
index 042940cc9e5..7cde2f9411b 100644
--- a/products/cloudflare-one/src/content/identity/devices/require-gateway.md
+++ b/products/cloudflare-one/src/content/identity/devices/require-gateway.md
@@ -1,36 +1,52 @@
 ---
-order: 2
+order: 1
+title: Gateway
+pcx-content-type: how-to
 ---
 
-#  Require Gateway
+# Require Gateway
 
-With Access, you can require that all traffic to specific applications is monitored by Cloudflare Gateway. With Gateway protecting and filtering all requests to your applications, you will be able to see all user traffic and activity in each of these applications, broken down by user and device.
+<details>
+<summary>Feature availability</summary>
+<div>
 
-Alternatively, you can require users to run WARP (Cloudflare's secure and modern VPN) in order to access an application. This ensures that all user traffic is encrypted and routed through Cloudflare.
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All systems | WARP with Gateway | All plans | 
 
-You can choose to require Gateway or WARP by configuring dedicated actions within your [Zero Trust policies](/policies/zero-trust).
+</div>
+</details>
 
-The first step you need to take in order to require Gateway or WARP is to add a device posture integration.
+With Require Gateway you can allow access to your applications only to devices enrolled in your organization's instance of Gateway. Unlike [Require WARP](/identity/devices/require-warp), which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees.
 
-To do that:
+The process involves two steps:
+
+1. Setting up **Require Gateway** as a device posture check.
+1. Adding the check to new or existing [Zero Trust policies](/policies/zero-trust) to enforce the check for one or more of your applications.
+
+## Set up a device posture check
 
 1. On your [Teams dashboard](https://dash.teams.cloudflare.com/), navigate to **My Team > Devices > Device Posture**.
-1. Select **Gateway** if you’d like to require all traffic to flow through your Gateway instance. Select **WARP** if you’d like to require all traffic to flow through Cloudflare’s VPN.
 
-![Device Posture](../../static/documentation/identity/devices/device-posture.png)
+    ![Device Posture](../../static/documentation/identity/devices/device-posture.png)
+
+1. Select **Gateway**. 
+
+1. Click **Save**.
 
-You are now ready to start requiring Gateway or WARP for your Access applications.
+
+You are now ready to start requiring Gateway for your Access applications.
+
+## Add the check to a Zero Trust policy
 
 1. On the Teams dashboard, navigate to **Access > Applications**.
 
-1. Locate the application for which you want to require Gateway or WARP.
+1. Locate the application for which you want to require Gateway.
 
 1. Click **Edit**.
 
-1. To have an existing policy require Gateway or WARP, click **Edit** for that specific policy. Then, and add an **Include** or **Require** rule with the option *Gateway* selected. If you'd like to require WARP instead, select *WARP*.
-
- To create a new policy requiring Gateway or WARP, click **Add a rule**. Then, add an **Include** or **Require** rule with the option *Gateway* selected. If you'd like to require WARP instead, select *WARP*. 
+1. To have an existing policy require Gateway, click **Edit** for that specific policy. Then, add an **Include** or **Require** rule with the option *Gateway* selected.
 
 1. Click **Save rule**.
 
-Before granting access to the application, your policy will now check that the user is running your organization's Gateway configuration, or the WARP client, on their machine. 
\ No newline at end of file
+Before granting access to the application, your policy will now check that the user is running your organization's Gateway configuration, or the WARP client, on their machine. 
diff --git a/products/cloudflare-one/src/content/identity/devices/require-warp.md b/products/cloudflare-one/src/content/identity/devices/require-warp.md
new file mode 100644
index 00000000000..da22f82debc
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/devices/require-warp.md
@@ -0,0 +1,57 @@
+---
+order: 2
+title: WARP
+pcx-content-type: how-to
+---
+
+# Require WARP
+
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| All systems | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
+<Aside type="note">
+
+This device posture attribute will check for all versions of WARP, including the consumer version. 
+
+</Aside>
+
+Cloudflare for Teams enables you to restrict access to your applications to devices running the Cloudflare WARP client. This allows you to flexibly ensure that a user's traffic is secure and encrypted before allowing access to a resource protected behind Teams.
+
+The process involves two steps:
+
+1. Setting up **Require WARP** as a device posture check.
+1. Adding the check to new or existing [Zero Trust policies](/policies/zero-trust) to enforce the check for one or more of your applications.
+
+## Set up a device posture check
+
+1. On your [Teams dashboard](https://dash.teams.cloudflare.com/), navigate to **My Team > Devices > Device Posture**.
+
+    ![Device Posture](../../static/documentation/identity/devices/device-posture.png)
+
+1. Select **WARP**. 
+
+1. Click **Save**.
+
+You are now ready to start requiring WARP for your Access applications.
+
+## Add the check to a Zero Trust policy
+
+1. On the Teams dashboard, navigate to **Access > Applications**.
+
+1. Locate the application for which you want to require WARP.
+
+1. Click **Edit**.
+
+1. To have an existing policy require WARP, click **Edit** for that specific policy. Then, add an **Include** or **Require** rule with the option *WARP* selected.
+
+1. Click **Save rule**.
+
+Before granting access to the application, your policy will now check that the user is running the WARP client on their machine. 
diff --git a/products/cloudflare-one/src/content/identity/devices/sentinel-one.md b/products/cloudflare-one/src/content/identity/devices/sentinel-one.md
index 3335a31a051..2caecf007e6 100644
--- a/products/cloudflare-one/src/content/identity/devices/sentinel-one.md
+++ b/products/cloudflare-one/src/content/identity/devices/sentinel-one.md
@@ -1,20 +1,27 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # SentinelOne
 
-Cloudflare for Teams can check if [SentinelOne](https://www.sentinelone.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
+<details>
+<summary>Feature availability</summary>
+<div>
 
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | Minimum WARP version required | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---------- | ---- |
+| macOS, Windows | WARP with Gateway | macOS: 1.4.27, Windows: 1.4.25.0 | All plans | 
 
-| Prerequisites |
-| ------------- |
-| The WARP client installed on a user machine and updated to the latest version (minimum version required - Windows: 1.4.25.0, macOS: 1.4.27) |
-| SentinelOne installed on a user machine |
+</div>
+</details>
 
+Cloudflare for Teams can check if [SentinelOne](https://www.sentinelone.com/) is running on a device to determine if a request should be allowed to reach a protected resource.
 
 ## Configuring the Cloudflare integration
 
+Before you start, make sure SentinelOne is installed on your machine.
+
 1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **My Team > Devices > Device posture**.
 
 1. Select **+Add**.
@@ -28,7 +35,7 @@ Cloudflare for Teams can check if [SentinelOne](https://www.sentinelone.com/) is
     * **Name:** A unique identifier for this SentinelOne device posture check
     * **Operating system:** You’ll need to configure one posture check per operating system (macOS and Windows currently supported)
     * **Application Path:** Enter the full path to the SentinelOne process to be checked (for example, `c:\program files\SentinelOne\SentinelOne.exe`)
-    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from SentinelOne and is the recommended way to validated the process
+    * **Certificate thumbprint (optional):** The thumbprint of the publishing certificate used to sign the binary. This proves the binary came from SentinelOne and is the recommended way to validate the process
     * **SHA256 checksum (optional):** Used to validate the SHA256 signature of the binary. This verifies the binary exactly matches the one you expect to be there. Note: do not fill out this field unless you strictly control updates to SentinelOne, as this will change between versions
 
 1. Once you have configured your SentinelOne instance, you can then add SentinelOne device posture checks to any application protected by Access.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/identity/devices/tanium.md b/products/cloudflare-one/src/content/identity/devices/tanium.md
index cc8cd0599f1..7d0367f573e 100644
--- a/products/cloudflare-one/src/content/identity/devices/tanium.md
+++ b/products/cloudflare-one/src/content/identity/devices/tanium.md
@@ -1,9 +1,21 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Tanium
 
+<details>
+<summary>Feature availability</summary>
+<div>
+
+| Operating Systems | [WARP mode required](/connections/connect-devices/warp#warp-client-modes) | [Teams plans](https://www.cloudflare.com/teams-pricing/) |
+| ----------------- | --------- | ---- |
+| Any OS supported by Tanium | WARP with Gateway | All plans | 
+
+</div>
+</details>
+
 Cloudflare Access can use endpoint data from [Tanium™](https://www.tanium.com/) to determine if a request should be allowed to reach a protected resource.
 
 ## Tanium Configuration
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/adfs.md b/products/cloudflare-one/src/content/identity/idp-integration/adfs.md
index c64a40ed774..fd57513b7f3 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/adfs.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/adfs.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # SAML | Active Directory® 
@@ -202,12 +203,9 @@ Set-ADFSRelyingPartyTrust -TargetName "Name of RPT Display Name" -SamlResponseSi
 
 To enable Cloudflare for Teams to accept the claims and assertions sent from ADFS, follow these steps:
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
-1. Click *+ Add* under **Login Methods**, and select **SAML**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 1. The **Add a SAML identity provider** card displays.
-
-    ![Cloudflare Access Login Methods](../../static/documentation/identity/adfs/adfs-19-b.png)
-
 1. Enter an IdP **Name**.
 1. Under **Single Sign On URL** enter:
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/azuread.md b/products/cloudflare-one/src/content/identity/idp-integration/azuread.md
index e4945469fff..b7ce76b3293 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/azuread.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/azuread.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Microsoft Azure AD®
@@ -71,9 +72,9 @@ You can integrate Microsoft Azure AD® (Active Directory) with Cloudflare for Te
 
  ![Azure AD API Permissions](../../static/documentation/identity/azure/configured-perms.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Under **Login methods**, click *+ Add*.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **Azure AD** on the next page.
 
@@ -81,8 +82,6 @@ You can integrate Microsoft Azure AD® (Active Directory) with Cloudflare for Te
 
  If you are using Azure AD groups, toggle **Support Groups** slider **On** in the **Edit your Azure AD identity provider** window.
 
- ![Azure AD Add Identity](../../static/documentation/identity/azure/add-azure.png)
-
 1. Click **Save**.
 
 To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to Azure AD.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/centrify.md b/products/cloudflare-one/src/content/identity/idp-integration/centrify.md
index ac64c3b84bd..c02d620cc67 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/centrify.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/centrify.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Centrify
@@ -58,8 +59,8 @@ These steps help you set up Centrify as your identity provider:
 
     ![Centrify User Access](../../static/documentation/identity/centrify/centrify-7.png)
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
-1. Click *+ Add* under **Login Methods**, and select Centrify as your IdP.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 1. Paste in the **Client ID**, **Client Secret**, **Centrify account URL** and **Application ID**.
 1. Click **Save**.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md
index 792ecf4ed92..7d49469c10e 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md
@@ -1,5 +1,6 @@
 ---
 order: 7
+pcx-content-type: how-to
 ---
 
 # SAML | Citrix ADC
@@ -78,9 +79,8 @@ To set up Citrix ADC (SAML) as your identity provider:
 
     ```
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
-
-1. Click *+ Add* under **Login Methods**, and select SAML.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 
 1. Configure the fields as follows:
     
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/facebook-login.md b/products/cloudflare-one/src/content/identity/idp-integration/facebook-login.md
index 5d391bfbd3d..f35cf1503e3 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/facebook-login.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/facebook-login.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Facebook
@@ -43,8 +44,8 @@ Use these steps to set up Facebook as your identity provider.
 
     ![Facebook Settings](../../static/documentation/identity/facebook/fb6.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
-1. Click *+ Add* under **Login Methods**, and select Facebook as your IdP. 
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 
 1. Copy the App ID and App Secret into the **OAuth ID** and **OAuth Secret** fields.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/generic-oidc.md b/products/cloudflare-one/src/content/identity/idp-integration/generic-oidc.md
index 5b521a3139e..e0bbd9dc75f 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/generic-oidc.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/generic-oidc.md
@@ -1,5 +1,6 @@
 ---
 order: 11
+pcx-content-type: how-to
 ---
 
 # Generic OIDC
@@ -12,6 +13,12 @@ To set up a generic OIDC:
 
 1. Visit your identity provider and create a client/app.
 
+1. When creating a client/app, your IdP may request an **authorized redirect URI**. Enter your [team domain](/glossary#team-domain) followed by this callback at the end of the path: `/cdn-cgi/access/callback`. For example:
+
+    ```txt
+    https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback
+    ```
+
 1. Copy the content of these fields:
    * Client ID
    * Client secret
@@ -19,24 +26,15 @@ To set up a generic OIDC:
    * Token URL: The token_endpoint URL of your IdP
    * Certificate URL: The `jwks_uri` endpoint of your IdP to allow the IdP keys to sign the tokens
 
-    You can find these values on your identity provider’s OIDC discovery endpoint. Some providers call this the “well-known URL.”
-
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+    You can find these values on your identity provider’s **OIDC discovery endpoint**. Some providers call this the “well-known URL.”
 
-1. Under **Login methods**, click *+ Add*.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **OpenID Connect** on the next page.
 
-   ![ODIC Provider option](../../static/documentation/identity/generic-oidc/oidc.png)
-
 1. In the **Name** field, enter your IdP. Then, paste in the **Client ID** and **Client secret**.
 
-1. In the **authorized redirect URI** field for your IdP, enter your [team domain](/glossary#team-domain) followed by this callback at the end of the path: `/cdn-cgi/access/callback`. For example:
-
-    ```txt
-    https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback
-    ```
-
 1. Click **Save**.
 
 1. To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to the login method you want to test.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/generic-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/generic-saml.md
new file mode 100644
index 00000000000..8ea82644162
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/idp-integration/generic-saml.md
@@ -0,0 +1,77 @@
+---
+order: 0
+pcx-content-type: how-to
+---
+
+# Generic SAML 2.0
+
+Cloudflare for Teams integrates with any identity provider that supports SAML 2.0. If your identity provider is not listed in the integration list of login methods on the Teams Dashboard, it can be configured using SAML 2.0 (or OpenID if OIDC based). Generic SAML can also be used if you would like to pass additional SAML headers or claims for an IdP in the integration list.
+
+Most identity providers allow users to create an **application**. In this context, an application is a set of parameters that the identity provider will then pass on to Cloudflare to establish an integration. 
+
+Minimum requirements for identity providers:
+
+* The IdP must conform to SAML 2.0 
+* The IdP must provide: A Single Sign on URL, an Entity ID, and a signing certificate
+
+Depending on the identity provider you would like to integrate, the following steps may happen in a different order.
+
+## Create an application in your identity provider
+
+The typical setup requirements are:
+
+1. Create a new integration in the identity provider with the type set as **SAML**.
+1. Set the Entity/Issuer ID to: `https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback`, where `<your-team-name>` should be your Cloudflare for Teams [team name](/glossary#team-name).
+1. Set the Single Sign On URL (or similarly named) to: `https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback`, where `<your-team-name>` should be your Cloudflare for Teams [team name](/glossary#team-name).
+1. Set the Name ID/Email format to `emailAddress`.
+1. [Optional] Set the signature policy to *Always Sign*.
+1. [Optional] If your identity provider supports metadata file configuration, use the endpoint:  `https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/saml-metadata` to download and generate an XML file. Upload this XML file to the identity provider.
+
+## Add a SAML identity provider to the Teams Dashboard
+
+1. On the Teams Dashboard, navigate to **Settings** > **Authentication**.
+1. In the Login methods card, click **Add new** and select *SAML*.
+    
+    ![SAML dialog](../../static/documentation/identity/generic-saml-dashboard.png)
+
+1. Choose a descriptive name for your identity provider.
+1. Enter the Single Sign on URL, IdP Entity ID or Issuer URL, and Signing certificate.
+1. If you do not wish to enter any of the [additional SAML configurations](#additional-saml-configurations), click **Save**.
+
+## Additional SAML configurations
+
+SAML integrations allow users to include additional headers or claims that can be passed to applications.
+
+### Sign SAML authentication request
+
+This optional configuration signs the Access JWT with the Cloudflare Access public key to ensure that the JWT is coming from a legitimate source. The Cloudflare public key can be obtained at `https://<your-team-name>.com/cdn-cgi/access/certs`.
+
+### Email attribute name
+
+Many [Zero Trust policies](/policies/zero-trust) depend on a user’s email address. Some identity providers have a different naming for the email address attribute (for example, `Email`, `e-mail`, `emailAddress`). This can typically be checked in the identity provider's SAML test option.
+
+Example in Okta:
+
+![SAML dialog](../../static/documentation/identity/saml-assertion.png)
+![SAML dialog](../../static/documentation/identity/saml-attributes.png)
+
+### SAML attributes
+
+SAML attributes can be added to the Access JWT. These can then be consumed by self-hosted or SaaS applications connected to Access. Any SAML attribute configured in the SAML integration must also be sent from the IdP.
+
+Example in Okta:
+
+![SAML dialog](../../static/documentation/identity/attribute-statements.png)
+
+How to receive these Attributes in Cloudflare:
+
+![SAML dialog](../../static/documentation/identity/attributes-cloudflare.png)
+
+
+### SAML header attributes
+
+If an application only requires specific SAML attributes on sign-in, then the attributes can be passed as headers. The **Attribute Name** should be the values coming from the IdP. The **Header Name** is what will appear in the initial authorization header from Access.
+
+## Testing the connection
+
+Save the initial SAML configuration and click **Test**. This will prompt an error or success message. The error message will provide instructions on how to update the configuration to successfully integrate your identity provider with Cloudflare.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/github.md b/products/cloudflare-one/src/content/identity/idp-integration/github.md
index b6c4dd34fa0..83e2ed1cc77 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/github.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/github.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # GitHub
@@ -38,9 +39,8 @@ To configure GitHub access in both GitHub and Cloudflare for Teams:
 
     ![Client ID and Client secret](../../static/documentation/identity/github/github4.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
-
-1. Under **Login methods**, click *+ Add*.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **GitHub** on the next page. 
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/google.md b/products/cloudflare-one/src/content/identity/idp-integration/google.md
index b4e7e9fed6b..10779216645 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/google.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/google.md
@@ -1,9 +1,16 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Google
 
+<Aside header="Note">
+
+You don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
+
+</Aside>
+
 You can integrate Google authentication with Cloudflare Access without a Google Workspace account. The integration will allow any user with a Google account to login (if the [Zero Trust policy](/policies/zero-trust) allows them to reach the resource). Unlike the instructions for [Google Workspace](/identity/idp-integration/gsuite), the steps below will not allow you to pull group membership information from a Google Workspace account.
 
 1. Visit the Google Cloud Platform console. Create a new project.
@@ -68,9 +75,9 @@ You can integrate Google authentication with Cloudflare Access without a Google
 
  ![Secret Field](../../static/documentation/identity/google/oauth-created.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Under **Login methods**, click *+ Add*.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **Google** on the next page.
 
@@ -78,8 +85,6 @@ You can integrate Google authentication with Cloudflare Access without a Google
 
 1. Click **Save**.
 
-![Add Google Suite](../../static/documentation/identity/google/input-client-id.png)
-
 To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to Google.
 
 Your user identity should return.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md b/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md
index f7faf213e89..edc4cffad6a 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md
@@ -1,12 +1,19 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
-# Google Suite
+# Google Workspace
+
+<Aside header="Note">
+
+You don't need to be a Google Cloud Platform user to integrate Google Workspace as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
+
+</Aside>
 
 You can integrate a Google Workspace (formerly Google Suite) account with Cloudflare Access. Unlike the instructions for [generic Google authentication](/identity/idp-integration/google), the steps below will allow you to pull group membership information from your Google Workspace account.
 
-Once integrated, users will login with their Google Suite credentials to reach resources protected by Cloudflare Access or to enroll their device into Cloudflare Gateway.
+Once integrated, users will login with their Google Workspace credentials to reach resources protected by Cloudflare Access or to enroll their device into Cloudflare Gateway.
 
 1. Log into the Google Cloud Platform [console](https://console.cloud.google.com/). This is separate from your Google Workspace console.
 
@@ -96,21 +103,16 @@ Once integrated, users will login with their Google Suite credentials to reach r
 
 ![Client ID Visible](../../static/documentation/identity/gsuite/client-id-visible.png)
 
-1. Navigate to the Cloudflare for Teams dashboard. In the `Authentication` page of the Access section, click **+ Add**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
- ![Add IdP](../../static/documentation/identity/gsuite/add-idp.png)
+1. Under **Login methods**, click **Add new**.
 
-1. Select `Google Suite`.
-
- ![Add Google Suite](../../static/documentation/identity/gsuite/add-gsuite.png)
+1. Select **Google Workspace**.
 
 1. Input the Client ID and Client Secret fields generated previously. Additionally, input the domain of your Google Workspace account. Click **Save**.
 
- ![Add Google Suite](../../static/documentation/identity/gsuite/input-client.png)
-
 1. To complete setup, you must scroll below and visit the link generated. If you are not the Google Workspace administrator, share the link with the administrator.
 
- ![Visit Link](../../static/documentation/identity/gsuite/visit-link.png)
 
 1. The generated link will prompt you to login to your Google account and to authorize Cloudflare Access to view group information.
 
@@ -120,7 +122,7 @@ Once integrated, users will login with their Google Suite credentials to reach r
 
  ![Group Success](../../static/documentation/identity/gsuite/group-success.png)
 
-1. You can now return to the list of identity providers in the **Authentication** page of the Cloudflare for Teams dashboard. Select Google Suite and click **Test**.
+1. You can now return to the list of identity providers in the **Authentication** page of the Cloudflare for Teams dashboard. Select Google Workspace and click **Test**.
 
  Your user identity and group membership should return.
 
@@ -137,4 +139,4 @@ Once integrated, users will login with their Google Suite credentials to reach r
     },
     "type": "google-apps",
     "name": "my example idp"
-}
\ No newline at end of file
+}
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/index.md b/products/cloudflare-one/src/content/identity/idp-integration/index.md
index 551167ed304..7c064b4e239 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/index.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/index.md
@@ -1,5 +1,6 @@
 ---
-order: 0
+order: 2
+pcx-content-type: how-to
 ---
 
 # SSO integration
@@ -15,29 +16,25 @@ Cloudflare Access supports social identity providers that do not require adminis
 
 ## Set up IdPs on the Teams dashboard
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Configuration > Authentication**.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Settings > Authentication**.
 
-2. In the **Login methods** card, click *+Add*.
+1. In the **Login methods** card, click **Add new**.
 
-![Login methods](../../static/documentation/identity/login-methods-auth.png)
+1. Select the identity provider you want to add. You can add multiple providers of the same type.
 
-3. Select the identity provider you want to add. You can add multiple providers of the same type.
-
-4. Fill in the necessary fields to set up your identity provider.
+1. Fill in the necessary fields to set up your identity provider.
 
 Each identity provider will have different required fields for you to fill in. If you need help, step-by-step instructions can be expanded below the input form.
 
-![IdP Setup Fields](../../static/documentation/identity/idp-setup-card.png)
-
 If you do not see your identity provider listed, but they support SAML or OAuth, these providers can typically still be enabled. If they support SAML select the SAML option. If they support OAuth select the **OpenID Connect** option.
 
-4. Once you have filled in the necessary fields, click **Save**.
+1. Once you have filled in the necessary fields, click **Save**.
 
 Your IdP will now be listed in the **Login methods** card.
 
 ## Test IdPs on the Teams dashboard
 
-To test if an IdP is correctly configured, navigate to **Configuration** > **Authentication**. Next, click **Test** next to the IdP you'd like to test. This will attempt to connect to the IdP to verify if a valid connection is established.
+To test if an IdP is correctly configured, navigate to **Settings** > **Authentication**. Next, click **Test** next to the IdP you would like to test. This will attempt to connect to the IdP to verify if a valid connection is established.
 
 ### Your provider is connected
 
@@ -51,4 +48,4 @@ If your provider is not connected, another window will open in your browser. Alo
 
 ## Using The API
 
-We recommend that you use our dashboard to configure your identity providers. However, if you would like to use the [Cloudflare API](https://api.cloudflare.com/), each of the identity provider topics covered here include an example API configuration snippet as well.
\ No newline at end of file
+We recommend that you use our dashboard to configure your identity providers. However, if you would like to use the [Cloudflare API](https://api.cloudflare.com/), each of the identity provider topics covered here include an example API configuration snippet as well.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/jumpcloud-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/jumpcloud-saml.md
index 9d3a0652898..9853b68c58f 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/jumpcloud-saml.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/jumpcloud-saml.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # SAML | Jumpcloud
@@ -77,9 +78,11 @@ To set up JumpCloud SAML as your identity provider:
 
     ![JumpCloud Application dialog](../../static/documentation/identity/jumpcloud/jumpcloud-saml-2.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select SAML.
+1. Under **Login methods**, click **Add new**.
+
+1. Select **SAML**.
 
 1. Input a **Name**, a **Single Sign on URL**, **IdP Entity ID or Issuer URL**, and **Signing Certificate**.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/keycloak.md b/products/cloudflare-one/src/content/identity/idp-integration/keycloak.md
index 786a9fdfbaf..ba4847b7a6d 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/keycloak.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/keycloak.md
@@ -1,5 +1,6 @@
 ---
 order: 9
+pcx-content-type: how-to
 ---
 
 # SAML | Keycloak 
@@ -32,9 +33,11 @@ To set up Keycloak (SAML) as your identity provider:
 
     ![Mapper](../../static/documentation/identity/keycloak/protocol-mapper.png)
 
-1. Next, you'll need to integrate with Cloudflare Access. On the Teams dashboard, navigate to **Configuration > Authentication**.
+    Next, you will need to integrate with Cloudflare Access.
+    
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Under **Login methods**, click *+ Add*.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **SAML** on the next page.
 
@@ -46,8 +49,6 @@ To set up Keycloak (SAML) as your identity provider:
     | IdP Entity ID or Issuer URL | `https://<unique_id>.cloudflareaccess.com/cdn-cgi/access/callback` |
     | Signing certificate | Use the X509 Certificate in the Realm Settings from Keycloak |
 
-    ![Access Config](../../static/documentation/identity/keycloak/access-config-keycloak.png)
-
 1. Click **Save**.
 
-To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to the login method you want to test.
\ No newline at end of file
+To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to the login method you want to test.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/linkedin.md b/products/cloudflare-one/src/content/identity/idp-integration/linkedin.md
index f9e441cf9b8..f2c5be0749b 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/linkedin.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/linkedin.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # LinkedIn
@@ -54,9 +55,11 @@ To configure LinkedIn as an IdP:
 
 1. Copy the **Client ID** and **Client Secret**.
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select LinkedIn as your IdP.
+1. Under **Login methods**, click **Add new**.
+
+1. Select **LinkedIn** as your IdP.
 
 1. In the **App ID** and **Client secret** fields, input the **Client ID** and **Client secret** values you've copied from the Application credentials tab in the LinkedIn Developer Portal.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/okta.md b/products/cloudflare-one/src/content/identity/idp-integration/okta.md
index 29f04283ced..6d7b2975a01 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/okta.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/okta.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Okta
@@ -58,17 +59,19 @@ You can integrate Okta with Cloudflare Access to allow users to reach applicatio
 
  ![Credentials](../../static/documentation/identity/okta/credentials.png)
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select **Okta** as your IdP.
+1. Under **Login methods**, click **Add new**.
+
+1. Select **Okta** as your IdP.
 
 1. Input the ID, secret, and the Okta account URL.
 
-1. Click **Save**.
+1. (optional) [Create an Okta API Token](https://developer.okta.com/docs/guides/create-an-api-token/overview/) and input the token. This will prevent your Okta groups from failing if you have more than 100 groups.
 
-   ![Input](../../static/documentation/identity/okta/add-okta.png)
+1. Click **Save**.
 
-To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to Okta.
+To test that your connection is working, navigate to **Settings > Authentication > Login methods** and click **Test** next to Okta.
 
 ## Example API Configuration
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/one-time-pin.md b/products/cloudflare-one/src/content/identity/idp-integration/one-time-pin.md
deleted file mode 100644
index 92b96deea91..00000000000
--- a/products/cloudflare-one/src/content/identity/idp-integration/one-time-pin.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-order: 12
----
-
-# One-Time Pin Login
-
-Cloudflare Access can send a one-time PIN (OTP) to approved email addresses as an alternative to configuring an identity provider. You can simultaneously configure an OTP and IdP to allow users to use their own authentication method.
-
-For example, if your team uses Okta® but you’re collaborating with someone outside your organization, use OTP to grant them access.
-
-## Set up OTP
-
-To set up OTP to allow guest-user access, you simply add the guest user's email address to a [Zero Trust rule](/policies/zero-trust/policy-management#add-a-policy) and to the [group](/identity/users/groups) that allows your team to reach the application.
-
-This is the workflow for your guest user:
-
-1. Select OTP on login to your application.
-2. Enter their email address and click **Send me a code**.
-
-    ![Login page](../../static/documentation/identity/otp/otp1.png)
-
-    Access sends a one-time PIN they use to authenticate. This secure PIN expires 10 minutes after the initial request.
-
-3. Receive a PIN when the email address matches a Policy.
-4. Paste PIN in login page and click **Sign in**.
-
-    ![PIN field](../../static/documentation/identity/otp/otp2.png)
-
-5. Access logs them in.
-
-## Example API Config
-
-```json
-{
-    "config": {},
-    "type": "onetimepin",
-    "name": "my example idp"
-}
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-oidc.md b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-oidc.md
index acdc5200bfa..4c809edb5ae 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-oidc.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-oidc.md
@@ -1,5 +1,6 @@
 ---
 order: 11
+pcx-content-type: how-to
 ---
 
 # OneLogin OIDC
@@ -53,12 +54,17 @@ To set up OneLogin as your identity provider:
     ![OneLogin OIDC Add Application SSO page](../../static/documentation/identity/onelogin/onelogin-oidc-7.png)
 
 1. Click **Show client secret**.
+
 1. Copy both the **Client ID** and **Client Secret**.
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+
+1. Under **Login methods**, click **Add new**.
+
+1. Select Centrify as your IdP.
 
-1. Click *+ Add* under **Login Methods**, and select Centrify as your IdP.
 1. Paste in your copied **Client ID** and **Client secret**.
+
 1. Click **Save**.
 
 To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to OneLogin.
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md
index 217c2170344..fbdc7f71a65 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md
@@ -1,12 +1,13 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # SAML | OneLogin
 
 OneLogin provides SSO identity management. Cloudflare Access supports OneLogin as an SAML identity provider.
 
-## Set up neLogin (SAML)
+## Set up OneLogin (SAML)
 
 To set up OneLogin (SAML) as your identity provider:
 
@@ -49,9 +50,11 @@ To set up OneLogin (SAML) as your identity provider:
 
     ![OneLogin SAML Application SSO](../../static/documentation/identity/onelogin/onelogin-saml-7.png)
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select SAML.
+1. Under **Login methods**, click **Add new**.
+
+1. Select SAML.
 
 1. Input the details from your OneLogin account in the fields.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/ping-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/ping-saml.md
index 7c5352b8679..72b27a0eda0 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/ping-saml.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/ping-saml.md
@@ -1,5 +1,6 @@
 ---
 order: 6
+pcx-content-type: how-to
 ---
 
 # SAML | PingIdentity®
@@ -33,10 +34,14 @@ To set up PingIdentity (SAML) as your identity provider:
 
 4. A prompt displays to download the SAML metadata from Ping.
 
-    This file shares several fields with Cloudflare Access so you don’t have to input this data.
+    This file shares several fields with Cloudflare Access so you do not have to input this data.
+
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
+
+1. Under **Login methods**, click **Add new**.
+
+1. Select SAML.
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
-1. Click *+ Add* under **Login Methods**, and select SAML.
 1. In the **IdP Entity ID** field, enter your [team domain](/glossary#team-domain) followed by this callback at the end of the path: `/cdn-cgi/access/callback`. For example:
 
     ```txt
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/saml-centrify.md b/products/cloudflare-one/src/content/identity/idp-integration/saml-centrify.md
index 9781763d8d2..36a699616e6 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/saml-centrify.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/saml-centrify.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # SAML | Centrify
@@ -80,9 +81,11 @@ To set up SAML with Centrify as your identity provider:
 
 1. Select the **Manual Configuration** option.
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select SAML.
+1. Under **Login methods**, click **Add new**.
+
+1. Select SAML.
 
 1. Copy and paste the corresponding information from Centrify into the fields.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/saml-okta.md b/products/cloudflare-one/src/content/identity/idp-integration/saml-okta.md
index a6e4693e944..dffc44308a4 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/saml-okta.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/saml-okta.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # SAML | Okta
@@ -74,14 +75,18 @@ To set up SAML with Okta as your identity provider:
 
     ![Okta SAML Settings Sign On page](../../static/documentation/identity/saml-okta/saml-okta-9.png)
 
-1. Copy and paste the following information into the Cloudflare Access **Edit a SAML identity provider** card.
+1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
 
-   * **Provider Name**: Name your IdP.
+1. Click *+ Add* under **Login Methods**, and select SAML.
+
+1. Copy and paste the following information into the relevant fields.
+
+   * **Name**: Name your IdP.
    * **Single Sign On URL**: Enter the IdP Single-Sign-On URL.
    * **IdP Entity ID**: Enter the IdP issuer.
    * **Signing Certificate**: Copy the certificate from Okta in **X.509 Certificate** between **Begin Certificate** and **End Certificate**.
 
-1. After completing the information, enter the name “email” as your email attribute for the **SAML assertion** field.
+1. Under **Optional configurations**, enter the name “email” as your SAML attribute.
 
 1. Click **Save**.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md b/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md
index c6f5b22d323..e565f2f595d 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md
@@ -1,5 +1,6 @@
 ---
 order: 8
+pcx-content-type: how-to
 ---
 
 # SAML | Signed AuthN requests
@@ -14,9 +15,9 @@ Cloudflare Access supports this requirement in the form of Signed AuthN requests
 
 To set up Signed AuthN requests:
 
-1. On the Teams dashboard, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Under **Login methods**, click *+ Add*.
+1. Under **Login methods**, click **Add new**.
 
 1. Choose **SAML** on the next page.
 
diff --git a/products/cloudflare-one/src/content/identity/idp-integration/yandex.md b/products/cloudflare-one/src/content/identity/idp-integration/yandex.md
index a11bec39c76..31dd4b31512 100644
--- a/products/cloudflare-one/src/content/identity/idp-integration/yandex.md
+++ b/products/cloudflare-one/src/content/identity/idp-integration/yandex.md
@@ -1,5 +1,6 @@
 ---
 order: 12
+pcx-content-type: how-to
 ---
 
 # Yandex
@@ -40,9 +41,11 @@ To set up Yandex for Cloudflare Access:
 
     ![Yandex Platform card](../../static/documentation/identity/yandex/yandex-4.png)
 
-1. On the **Teams dashboard**, navigate to **Configuration > Authentication**.
+1. On the Teams dashboard, navigate to **Settings > Authentication**.
 
-1. Click *+ Add* under **Login Methods**, and select Yandex.
+1. Under **Login methods**, click **Add new**.
+
+1. Select Yandex.
 
 1. Paste the ID and password in the appropriate fields.
 
diff --git a/products/cloudflare-one/src/content/identity/index.md b/products/cloudflare-one/src/content/identity/index.md
index cbd7dc524be..086ed1d886f 100644
--- a/products/cloudflare-one/src/content/identity/index.md
+++ b/products/cloudflare-one/src/content/identity/index.md
@@ -1,12 +1,17 @@
 ---
 order: 3
+pcx-content-type: navigation
 ---
 
 # Identity
 
 Cloudflare for Teams integrates with your organization's identity provider to apply Zero Trust and Secure Web Gateway policies. If you work with partners, contractors, or other organizations, you can integrate multiple identity providers simultaneously.
 
-You can also build rules based on device posture using mutual TLS authentication, third party integrations, or the Cloudflare WARP client.
+As an alternative to configuring an identity provider, Cloudflare for Teams can send a [one-time PIN (OTP)](/identity/one-time-pin) to approved email addresses. No configuration needed — simply add a user's email address to a [Zero Trust policy](/policies/zero-trust) and to the group that allows your team to reach the application.
+
+You can simultaneously configure an OTP and an identity provider to allow users to use their own authentication method.
+
+Additionally, Cloudflare for Teams can integrate with [endpoint protection providers](/identity/devices) to check requests for device posture. This allows you to configure security policies that rely on additional signals from endpoint security providers to allow or deny connections to your applications.
 
 <DirectoryListing path="/identity"/>
 
diff --git a/products/cloudflare-one/src/content/identity/login-page.md b/products/cloudflare-one/src/content/identity/login-page.md
index b4284abe89c..71e6eb8f34b 100644
--- a/products/cloudflare-one/src/content/identity/login-page.md
+++ b/products/cloudflare-one/src/content/identity/login-page.md
@@ -1,43 +1,15 @@
 ---
 order: 10
+pcx-content-type: concept
 ---
 
 # Login page
 
-The **Authentication > Login** tab lets you customize your end users' login experience, so that it meets your organization's needs. 
+Under **Settings > General**, you can customize the login page your end users will see when trying to reach applications behind Teams. 
 
-This means you can:
-* Choose your preferred [login methods](#login-methods)
-* Specify your [team domain](/glossary#team-domain)
-* Customize your [login page](#login-page)
+Click **Customize** to give the login page the look and feel of your organization by adding your organization's name and by choosing a custom header and footer, a logo, and a preferred background color.
 
-## Login methods
-
-Use the **Login Methods** card to add new login methods, or edit/test any login methods you may have already added.
-
-![Login Methods](../static/documentation/identity/devices/login-methods.png)
-
-## Team domain
-
-Use the **Team domain** card to edit your team domain. To do so, click **Edit** and input your desired domain name.
-
- This domain is shared across all sites in your Cloudflare account where you have configured Access.
-
-![Team Domain](../static/documentation/identity/devices/auth-domain.png)
-
-## Login page
-
-Use the **Login Page** card to customize the login page your end users will see. To do so, click **Customize**.
-
-This will allow you to add an organization name, a custom header and footer, a logo, and a preferred background color to your login page.
-
-![Login Customize Card](../static/documentation/identity/devices/customize-login-card.png)
-
-Any changes you make will be reflected in real time in the **Preview** card.
-
-![Preview Card](../static/documentation/identity/devices/preview-card-login.png)
-
-Once you’re satisfied with your customization, click **Save**.
+Any changes you make will be reflected in real time in the **Preview** card. Once you’re satisfied with your customization, click **Save**.
 
 Your login page will now reflect your changes.
 
diff --git a/products/cloudflare-one/src/content/identity/one-time-pin.md b/products/cloudflare-one/src/content/identity/one-time-pin.md
new file mode 100644
index 00000000000..a7c49deee7e
--- /dev/null
+++ b/products/cloudflare-one/src/content/identity/one-time-pin.md
@@ -0,0 +1,39 @@
+---
+order: 1
+pcx-content-type: how-to
+---
+
+# One-time PIN login
+
+Cloudflare Access can send a one-time PIN (OTP) to approved email addresses as an alternative to integrating an identity provider. You can simultaneously configure OTP login and the identity provider of your choice to allow users to use their own authentication method.
+
+For example, if your team uses Okta® but you’re collaborating with someone outside your organization, you can use OTP to grant access to external resources.
+
+## Set up OTP
+
+To set up OTP to allow guest-user access, you simply add the guest user's email address to a [Zero Trust policy](/policies/zero-trust/policy-management#add-a-policy) and to the [group](/identity/users/groups) that allows your team to reach the application.
+
+This is the workflow for your guest user:
+
+1. When logging in to your application, they will select **OTP**.
+1. Then, they will enter their email address and click **Send me a code**.
+
+    ![Login page](../static/documentation/identity/otp/otp1.png)
+
+    Access will send a one-time PIN they can use to authenticate. This secure PIN expires 10 minutes after the initial request.
+
+1. If their email address matches a policy, they will receive a PIN.
+1. Next, they will paste the PIN in the login page and click **Sign in**.
+
+    ![PIN field](../static/documentation/identity/otp/otp2.png)
+
+Access will then log them in.
+
+## Example API Config
+
+```json
+{
+    "config": {},
+    "type": "onetimepin",
+    "name": "my example idp"
+}
diff --git a/products/cloudflare-one/src/content/identity/service-auth/index.md b/products/cloudflare-one/src/content/identity/service-auth/index.md
index f4561a5f244..2655e017bb9 100644
--- a/products/cloudflare-one/src/content/identity/service-auth/index.md
+++ b/products/cloudflare-one/src/content/identity/service-auth/index.md
@@ -1,5 +1,6 @@
 ---
-order: 2
+order: 5
+pcx-content-type: navigation
 ---
 
 # Service auth
diff --git a/products/cloudflare-one/src/content/identity/service-auth/service-tokens.md b/products/cloudflare-one/src/content/identity/service-auth/service-tokens.md
index 5c9a6811bd5..90ad699e868 100644
--- a/products/cloudflare-one/src/content/identity/service-auth/service-tokens.md
+++ b/products/cloudflare-one/src/content/identity/service-auth/service-tokens.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Service tokens
@@ -15,11 +16,11 @@ This section covers how to create, renew, and revoke a service token.
 
 ## Create a service token
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Configuration > Service Auth**.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Access > Service Auth**.
 
-1. Click **Create Service Token**.
+1. Go to the **Service Tokens** tab.
 
-   ![Access Service Token card](../../static/documentation/identity/users/service-token-list.png)
+1. Click **Create Service Token**.
 
 1. Next, name the service token.
 
@@ -58,21 +59,18 @@ When a request is made to an application behind our network, the request will su
 By default, service tokens expire one year after creation. You can extend a token’s lifecycle by navigating to the **Service Tokens** tab and clicking the **Refresh** button for the token you want to renew.
 The `Refresh` operation will extend the token's lifetime by **one year** from the date of the refresh.
 
-![Access Service Token card](../../static/documentation/identity/users/service-token-list.png)
-
 ## Revoke service tokens
 
-By default, Access service tokens expire one year after they’re created. If you need to revoke access earlier, simply delete the token.
+By default, Access service tokens expire one year after they are created. If you need to revoke access earlier, simply delete the token.
 
 To revoke a service token immediately:
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Configuration > Service Auth > Service Tokens**.
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Access > Service Auth > Service Tokens**.
 
 1. Click **Delete** for the token you need to revoke and delete.
 
-   ![Access Service Token card](../../static/documentation/identity/users/service-token-list.png)
-
 When revoking service tokens, keep in mind:
+
 * Services that rely on a deleted service token can no longer reach your application.
 * Clicking **Revoke Existing Tokens** when editing a policy in the **Edit Access Policy** dialog revokes existing sessions but does not revoke access.
 
@@ -101,5 +99,3 @@ To configure a service token expiration alert:
 1. Click **Create**.
 
 Your alert has now been set, and is now visible in the **Notifications** tab of the Cloudflare dashboard.
-
-
diff --git a/products/cloudflare-one/src/content/identity/users/groups.md b/products/cloudflare-one/src/content/identity/users/groups.md
index 591709c0e23..03975d1fdc8 100644
--- a/products/cloudflare-one/src/content/identity/users/groups.md
+++ b/products/cloudflare-one/src/content/identity/users/groups.md
@@ -1,11 +1,12 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # Groups
 
 ## Definition
-A group is a set of rules that can be configured once and then quickly applied across many Access applications. You can select a group as a selector in any zero-trust rule, and all the criteria from the selected group will apply to that application.
+A group is a set of rules that can be configured once and then quickly applied across many Access applications. You can select a group as a selector in any Zero Trust policy, and all the criteria from the selected group will apply to that application.
 
 <Aside>
 
@@ -43,7 +44,7 @@ To create and manage groups:
 
 Group criteria determine whether or not a user is a member of a particular group.
 
-Groups follow the same [logic](/policies/) as rules for zero-trust policies in Access.
+Groups follow the same [logic](/policies/) as rules for Zero Trust policies in Access.
 
 Group criteria help define whether to include or exclude a team member from a  group. Here is a list of criteria and examples:
 * **Emails** — `you@company.com`
diff --git a/products/cloudflare-one/src/content/identity/users/index.md b/products/cloudflare-one/src/content/identity/users/index.md
index 076b47436ec..0a4e203cba7 100644
--- a/products/cloudflare-one/src/content/identity/users/index.md
+++ b/products/cloudflare-one/src/content/identity/users/index.md
@@ -1,5 +1,6 @@
 ---
-order: 0
+order: 4
+pcx-content-type: navigation
 ---
 
 # User management
diff --git a/products/cloudflare-one/src/content/identity/users/session-management.md b/products/cloudflare-one/src/content/identity/users/session-management.md
index 82788d624ff..f44d76dd195 100644
--- a/products/cloudflare-one/src/content/identity/users/session-management.md
+++ b/products/cloudflare-one/src/content/identity/users/session-management.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Session management
diff --git a/products/cloudflare-one/src/content/identity/users/short-lived-certificates.md b/products/cloudflare-one/src/content/identity/users/short-lived-certificates.md
index 12a5387f252..8773414fa93 100644
--- a/products/cloudflare-one/src/content/identity/users/short-lived-certificates.md
+++ b/products/cloudflare-one/src/content/identity/users/short-lived-certificates.md
@@ -1,6 +1,7 @@
 ---
 order: 3
 title: Short-lived certificates
+pcx-content-type: how-to
 ---
 
 # Configure short-lived certificates
@@ -15,7 +16,7 @@ To protect a resource behind Cloudflare Access, first follow [these instructions
 
 ## 2. **Generate a short-lived certificate public key**.
 
-1. On the Teams dashboard, navigate to **Configuration > Service Auth**.
+1. On the Teams dashboard, navigate to **Access > Service Auth**.
 
 2. In the drop-down, choose the application that represents the resource you secured in Step 1.
 
diff --git a/products/cloudflare-one/src/content/identity/users/validating-json.md b/products/cloudflare-one/src/content/identity/users/validating-json.md
index ba8c7361569..9aef0890917 100644
--- a/products/cloudflare-one/src/content/identity/users/validating-json.md
+++ b/products/cloudflare-one/src/content/identity/users/validating-json.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # JSON web tokens
@@ -218,7 +219,7 @@ A typical JWT looks like this:
 eyJhbGciOiJSUzI1NiIsImtpZCI6IjkzMzhhYmUxYmFmMmZlNDkyZjY0.eyJhdWQiOlsiOTdlMmFhZ TEyMDEyMWY5MDJkZjhiYzk5ZmMzNDU5MTNh.zLYsHmLEginAQUXdygQo08gLTExWNXsN4jBc6PKdB
 ```
 
-JWTs generated by Access are available in a request header as `Cf-Access-Jwt-Assertion` and as cookies as `CF_Authorization`. When not using Argo Tunnel, the tokens must be validated by the application to ensure the authenticity of the token and the security of the origin. Validation of the header alone is not sufficient — the JWT and signature must be confirmed to avoid identity spoofing.
+JWTs generated by Access are available in a request header as `Cf-Access-Jwt-Assertion` and as cookies as `CF_Authorization`. When not using Cloudflare Tunnel, the tokens must be validated by the application to ensure the authenticity of the token and the security of the origin. Validation of the header alone is not sufficient — the JWT and signature must be confirmed to avoid identity spoofing.
 Cloudflare signs the JWT using the RSA Signature with `SHA-256` (`RS256`). `RS256` follows an asymmetric algorithm; a private key signs the JWTs and a separate public key verifies the signature.
 
 When you configure Access, the public certificates are available at this URL, where `your-team-name` is your [team name](/glossary#team-name): `https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs`.
diff --git a/products/cloudflare-one/src/content/index.md b/products/cloudflare-one/src/content/index.md
index 093ae5d3847..ff0cadfbec9 100755
--- a/products/cloudflare-one/src/content/index.md
+++ b/products/cloudflare-one/src/content/index.md
@@ -2,6 +2,7 @@
 title: Overview
 order: 0
 type: overview
+pcx-content-type: landing-page
 ---
 
 # Cloudflare for Teams documentation
diff --git a/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md b/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md
index bf374cebe93..2d1a80c666b 100644
--- a/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md
+++ b/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: reference
 ---
 
 # Applications changelog
diff --git a/products/cloudflare-one/src/content/policies/filtering/configuring-block-page.md b/products/cloudflare-one/src/content/policies/filtering/configuring-block-page.md
new file mode 100644
index 00000000000..9eb55e7baf6
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/filtering/configuring-block-page.md
@@ -0,0 +1,112 @@
+---
+order: 5
+pcx-content-type: how-to
+---
+
+# Block page
+
+Gateway responds to any blocked domain with 0.0.0.0, and does not return that blocked domain's IP address. As a result, the browser will show a default error page, and users will not be able to reach that website. This may cause confusion and lead some users to think that their Internet is not working.
+
+Configuring a **block page** on the Teams dashboard helps avoid this confusion. Your block page will display information such as the rule ID of the policy blocking the website, a policy-specific block message, your organization's name, and a global message you may want to show — for example, a message explaining that the website has been blocked by Gateway, and whom in the organizations users should contact for support.
+
+To configure a block page:
+
+1. [Download the Cloudflare certificate](#download-the-cloudflare-certificate).
+1. [Add the certificate to your system](#add-the-certificate-to-your-system).
+1. Enable the block page for [HTTP](#enable-the-block-page-for-http-policies) or [DNS](#enable-the-block-page-for-dns-policies) policies.
+1. [Customize the block page](#customize-the-block-page).
+
+## Download the Cloudflare certificate
+
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Settings > Devices**.
+
+1. Scroll down to the **Certificates** card.
+
+1. Click on **Download certificate**.
+
+Now you will need to add the certificate to your system. This ensures your web browser can use it to establish HTTPS connections.
+
+## Add the certificate to your system
+
+1. If you are on a Mac, **double-click** on the `.pem` file.
+
+ The certificate is now listed in the **Keychain Access** application.
+
+ ![Keychain](../../static/documentation/policies/listed-in-keychain.png)
+
+1. Double-click on the certificate.
+
+1. Click **Trust**.
+
+ ![Keychain](../../static/documentation/policies/cert-click-on-trust.png)
+
+1. Select **Always Trust** from the drop-down menu for **When using this certificate**.
+
+1. Close the menu.
+
+If your system asks for admin permission, enter your password or use your fingerprint ID to confirm the changes.
+
+### Firefox
+
+If you are not using Firefox, you can skip this section.
+
+Follow the instructions below to finish configuring the block page:
+
+1. Enter **about:config** in the address bar.
+1. If you see a prompt from Firefox, click **Accept the risk!**.
+1. Set `security.enterprise_roots.enabled` to `true`.
+
+## Enable the block page for HTTP policies
+
+The block page is automatically enabled for all HTTP policies. When a user is blocked at the HTTP layer, the block page is displayed. As you configure a policy with a Block action, you can specify a policy-specific block message.
+
+ ![Enable HTTP block page](../../static/documentation/policies/http-block-page.png)
+
+## Enable the block page for DNS policies
+
+For DNS policies:
+
+1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Policies > DNS**.
+1. Find the policy for which you would like to set up a block page.
+1. Click **Edit**.
+1. Scroll down to find the **Configure policy settings** step.
+1. Toggle the **Display block page** switch.
+
+ ![Enable block page](../../static/documentation/policies/display-block-page.png)
+
+1. Click **Save**.
+
+Your block page is now enabled for this policy. 
+
+<Aside header='Warning: Potential Security Risk'>
+
+If your users are seeing the following error when navigating to a blocked page, double-check that you have downloaded the Cloudflare certificate and you have added it correctly to your system.
+
+![Block page](../../static/documentation/policies/https-browser-error.png)
+
+</Aside>
+
+## Customize the block page
+
+You can customize the block page by making global changes that will show up every time a user navigates to a block page, independently of the type of rule (DNS or HTTP) that's blocking the website. These global customizations include:
+
+* Adding your organization's name
+* Adding a logo 
+* Adding a header text
+* Adding a global block message
+* Choosing a background color
+
+All of these elements will display in addition to two fields specific to the policy that's blocking the website:
+
+* **The policy-specific block message** you've specified while creating the policy. This message is displayed under your global block message, and above the Rule ID.
+
+* **The Rule ID**, which will make it easier for admins to debug possible policy issues in relation to blocked websites.
+
+To apply customizations to your block page, navigate to the **Block page** card under **Settings > General**.
+
+
+ ![Block page](../../static/documentation/policies/customize-settings-page.png)
+
+Once you have completed your customization, click **Save**. Your customers will now see your custom block page when navigating to a blocked website.
+
+ ![Final block page](../../static/documentation/policies/final-block-page.png)
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/dns-categories.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/dns-categories.md
index 86ca704f67b..b2fdc3f2480 100644
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/dns-categories.md
+++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/dns-categories.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: reference
 ---
 
 # DNS Categories
@@ -46,7 +47,7 @@ If you wish to block a hostname or URL that belongs to a security risk category,
 |Business & Economy	|	Sites that are related to business, economy, finance, education, science and technology.|
 |Deceptive Ads	|	Sites that spoof clicks, impressions, conversions for ads.|
 |Drugs	|	Sites related to the use and promotion of illegal drugs or illegal use of prescribed drugs.|
-|Education	|	Site hosting educational content that are not included in other categories like Science, Technology or Educational institutions.|
+|Education	|	Sites hosting educational content that are not included in other categories like Science, Technology or Educational institutions.|
 |Entertainment	|	Sites that are hosting entertaining content that are not included in other categories like Comic books, Audio streaming, Video streaming etc.|
 |Gambling	|	Sites that are providing online gambling or are related to gambling.|
 |Government & Politics	|	Sites related to government and politics.|
@@ -74,6 +75,129 @@ If you wish to block a hostname or URL that belongs to a security risk category,
 
 </TableWrap>
 
+### DNS Category and Subcategory IDs
+
+<TableWrap>
+
+| Category ID | Category Name | Subcategory ID |Subcategory Name |
+|-----------|----------------------|---------------|------------------------------------------|
+|1          |Ads                   |66             |Advertisements                            |
+|2          |Adult Themes          |67             |Adult Themes                              |
+|2          |Adult Themes          |125            |Nudity                                    |
+|2          |Adult Themes          |133            |Pornography                               |
+|3          |Business & Economy    |75             |Business                                  |
+|3          |Business & Economy    |89             |Economy & Finance                         |
+|6          |Education             |90             |Education                                 |
+|6          |Education             |91             |Educational Institutions                  |
+|6          |Education             |144            |Science                                   |
+|6          |Education             |150            |Space & Astronomy                         |
+|7          |Entertainment         |70             |Arts                                      |
+|7          |Entertainment         |74             |Audio Streaming                           |
+|7          |Entertainment         |76             |Cartoons & Anime                          |
+|7          |Entertainment         |79             |Comic Books                               |
+|7          |Entertainment         |92             |Entertainment                             |
+|7          |Entertainment         |96             |Fine Art                                  |
+|7          |Entertainment         |100            |Gaming                                    |
+|7          |Entertainment         |106            |Home Video/DVD                            |
+|7          |Entertainment         |107            |Humor                                     |
+|7          |Entertainment         |116            |Magazines                                 |
+|7          |Entertainment         |120            |Movies                                    |
+|7          |Entertainment         |121            |Music                                     |
+|7          |Entertainment         |122            |News & Media                              |
+|7          |Entertainment         |127            |Paranormal                                |
+|7          |Entertainment         |139            |Radio                                     |
+|7          |Entertainment         |156            |Television                                |
+|7          |Entertainment         |164            |Video Streaming                           |
+|8          |Gambling              |99             |Gambling                                  |
+|9          |Government & Politics |101            |Government                                |
+|9          |Government & Politics |137            |Politics, Advocacy, and Government-Related|
+|10         |Health                |103            |Health & Fitness                          |
+|10         |Health                |146            |Sex Education                             |
+|12         |Internet Communication|77             |Chat                                      |
+|12         |Internet Communication|98             |Forums                                    |
+|12         |Internet Communication|108            |Information Security                      |
+|12         |Internet Communication|110            |Instant Messengers                        |
+|12         |Internet Communication|111            |Internet Phone & VOIP                     |
+|12         |Internet Communication|118            |Messaging                                 |
+|12         |Internet Communication|126            |P2P                                       |
+|12         |Internet Communication|129            |Personal Blogs                            |
+|12         |Internet Communication|168            |Webmail                                   |
+|12         |Internet Communication|172            |Photo Sharing                             |
+|13         |Job Search & Careers  |113            |Job Search & Careers                      |
+|15         |Miscellaneous         |119            |Miscellaneous                             |
+|15         |Miscellaneous         |141            |Redirect                                  |
+|17         |Questionable Content  |85             |Deceptive Ads                             |
+|17         |Questionable Content  |87             |Drugs                                     |
+|17         |Questionable Content  |102            |Hacking                                   |
+|17         |Questionable Content  |135            |Profanity                                 |
+|17         |Questionable Content  |138            |Questionable Activities                   |
+|17         |Questionable Content  |157            |Militancy, Hate & Extremism               |
+|17         |Questionable Content  |162            |Unreliable Information                    |
+|18         |Real Estate           |140            |Real Estate                               |
+|19         |Religion              |142            |Religion                                  |
+|20         |Safe for Kids         |143            |Safe for Kids                             |
+|21         |Security threats      |68             |Anonymizer                                |
+|21         |Security threats      |80             |Command and Control & Botnet              |
+|21         |Security threats      |83             |Cryptomining                              |
+|21         |Security threats      |117            |Malware                                   |
+|21         |Security threats      |131            |Phishing                                  |
+|21         |Security threats      |134            |Private IP Address                        |
+|21         |Security threats      |151            |Spam                                      |
+|21         |Security threats      |153            |Spyware                                   |
+|21         |Security threats      |175            |DNS Tunneling                             |
+|21         |Security threats      |176            |Domain Generation Algorithm               |
+|21         |Security threats      |178            |Typosquatting & Impersonation             |
+|22         |Shopping & Auctions   |73             |Auctions & Marketplaces                   |
+|22         |Shopping & Auctions   |82             |Coupons                                   |
+|22         |Shopping & Auctions   |88             |Ecommerce                                 |
+|22         |Shopping & Auctions   |148            |Shopping                                  |
+|24         |Society & Lifestyle   |65             |Abortion                                  |
+|24         |Society & Lifestyle   |71             |Arts & Crafts                             |
+|24         |Society & Lifestyle   |72             |Astrology                                 |
+|24         |Society & Lifestyle   |78             |Clothing                                  |
+|24         |Society & Lifestyle   |84             |Dating & Relationships                    |
+|24         |Society & Lifestyle   |86             |Digital Postcards                         |
+|24         |Society & Lifestyle   |93             |Parenting                                 |
+|24         |Society & Lifestyle   |94             |Fashion                                   |
+|24         |Society & Lifestyle   |97             |Food & Drink                              |
+|24         |Society & Lifestyle   |104            |Hobbies & Interests                       |
+|24         |Society & Lifestyle   |105            |Home & Garden                             |
+|24         |Society & Lifestyle   |112            |Jewelry                                   |
+|24         |Society & Lifestyle   |114            |Lifestyle                                 |
+|24         |Society & Lifestyle   |130            |Pets                                      |
+|24         |Society & Lifestyle   |132            |Photography                               |
+|24         |Society & Lifestyle   |136            |Professional Networking                   |
+|24         |Society & Lifestyle   |147            |Sexuality                                 |
+|24         |Society & Lifestyle   |149            |Social Networks                           |
+|24         |Society & Lifestyle   |154            |Swimsuits                                 |
+|24         |Society & Lifestyle   |158            |Tobacco                                   |
+|24         |Society & Lifestyle   |171            |LGBTQ                                     |
+|24         |Society & Lifestyle   |173            |Body Art                                  |
+|24         |Society & Lifestyle   |174            |Lingerie & Bikini                         |
+|25         |Sports                |152            |Sports                                    |
+|26         |Technology            |155            |Technology                                |
+|26         |Technology            |95             |File Sharing                              |
+|26         |Technology            |69             |APIs                                      |
+|26         |Technology            |81             |Content Servers                           |
+|26         |Technology            |109            |Information Technology                    |
+|26         |Technology            |123            |News, Portal & Search                     |
+|26         |Technology            |145            |Search Engines                            |
+|26         |Technology            |159            |Translator                                |
+|27         |Travel                |160            |Travel                                    |
+|28         |Vehicles              |163            |Vehicles                                  |
+|29         |Violence              |165            |Violence                                  |
+|29         |Violence              |166            |Weapons                                   |
+|30         |Weather               |167            |Weather                                   |
+|31         |Blocked               |170            |Child Abuse                               |
+|32         |Security Risks        |128            |Parked & For Sale Domains                 |
+|32         |Security Risks        |169            |New Domains                               |
+|32         |Security Risks        |177            |Newly Seen Domains                        |
+|32         |Security Risks        |115            |Login Screens                             |
+|32         |Security Risks        |124            |No Content                                |
+|32         |Security Risks        |161            |Unreachable                               |
+
+</TableWrap>
+
 ## Test a policy
 
 If you are blocking a security threat or content category, you can test that the policy is working by using the **test domain** associated with each category.
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/index.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/index.md
index f513aa285bc..3762486ff15 100644
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/index.md
+++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies-builder/index.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: concept
 ---
 
 # DNS policies (New)
@@ -8,7 +9,7 @@ When a user makes a DNS request to Gateway, Gateway matches the request against
 
 ![Gateway DNS flow](../../../static/documentation/policies/gateway-dns-diagram.png)
 
-When creating a DNS policy, you can select as many security risk and content categories as you want to affect with the policy. 
+When creating a DNS policy, you can select as many security risk categories and content categories as needed to fully secure your network. 
 
 Build a DNS policy by configuring the following elements:
 * [Actions](#actions)
@@ -17,10 +18,11 @@ Build a DNS policy by configuring the following elements:
 * [Operators](#operators)
 
 <Aside>
-Unless a more specific selector is configured in a policy (e.g., user email or source IP address for a registered location), then the policy will be evaluated against all DNS queries that reach Gateway from your organization.
+Unless a more specific selector is configured in a policy (e.g., <code>user email</code> or <code>source IP address</code> for a registered location), then the policy will be evaluated against all DNS queries that reach Gateway from your organization.
 </Aside>
 
 ## Actions
+
 Just like actions in HTTP policies, actions in DNS policies allow you to choose what to do with a given set of elements. You can assign one action per policy.
 
 These are the action types you can choose from:
@@ -33,7 +35,7 @@ These are the action types you can choose from:
 
 ### Allow
 
-Policies with Allow actions allow DNS queries you specify within the Selectors and Value fields. For example, the following configuration allows DNS queries to domains we categorize as belonging to the Education content category:
+Policies with Allow actions allow DNS queries to reach destinations you specify within the Selector and Value fields. For example, the following configuration allows DNS queries to reach domains we categorize as belonging to the Education content category:
 
 | Selector | Operator | Value | Action |
 | --- | --- | --- | --- |
@@ -41,7 +43,7 @@ Policies with Allow actions allow DNS queries you specify within the Selectors a
 
 ### Block
 
-Policies with Block actions block DNS queries you specify within the Selectors and Value fields. For example, the following configuration blocks DNS queries to domains we categorize as belonging to the Adult Themes content category:
+Policies with Block actions block DNS queries to reach destinations you specify within the Selector and Value fields. For example, the following configuration blocks DNS queries from reaching domains we categorize as belonging to the Adult Themes content category:
 
 | Selector | Operator | Value | Action |
 | --- | --- | --- | --- |
@@ -49,7 +51,7 @@ Policies with Block actions block DNS queries you specify within the Selectors a
 
 ### Override
 
-Policies with Override actions allow you to respond to all DNS queries for a given domain to another destination. For example, you can provide a custom response IP of 1.2.3.4 for all queries to www.example.com with the following policy:
+Policies with Override actions allow you to respond to all DNS queries for a given domain to another destination. For example, you can provide a custom response IP of `1.2.3.4` for all queries to www.example.com with the following policy:
 
 | Selector | Operator | Value | Action |
 | --- | --- | --- | --- |
@@ -57,7 +59,7 @@ Policies with Override actions allow you to respond to all DNS queries for a giv
 
 ### SafeSearch
 
-SafeSearch is a feature of search engines that can help you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children, you or at work.
+SafeSearch is a feature of search engines that helps you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children or at work.
 
 You can use Cloudflare Gateway to enable SafeSearch on search engines like Google, Bing, Yandex, YouTube and DuckDuckGo. For example, to enable SafeSearch for Google, you can create the following policy:
 
@@ -67,7 +69,7 @@ You can use Cloudflare Gateway to enable SafeSearch on search engines like Googl
 
 #### Test SafeSearch
 
-You can test if SafeSearch is working by performing dig on the search engines. Instead of returning the regular IP address, you should see the CNAMEs returned like below:
+You can test if SafeSearch is working by performing `dig` on the search engines. Instead of returning the regular IP address, you should see the CNAMEs returned like below:
 
 ##### Google
 Google will return `forcesafesearch.google.com`.
@@ -91,7 +93,7 @@ DuckDuckGo will return `safe.duckduckgo.com`.
 
 ### YouTube Restricted Mode
 
-Similarly, you can enforce YouTube Restricted mode by choosing the Youtube Restricted Mode action. YouTube Restricted Mode is an automated filter for adult and offensive content that's built into YouTube. To enable Youtube Restricted Mode, you could set up a policy like the following:
+Similarly, you can enforce YouTube Restricted mode by choosing the *Youtube Restricted* action. YouTube Restricted Mode is an automated filter for adult and offensive content built into YouTube. To enable Youtube Restricted Mode, you could set up a policy like the following:
 
 | Selector | Operator | Value | Action |
 | --- | --- | --- | --- |
@@ -126,15 +128,30 @@ Gateway matches DNS traffic against the following selectors, or criteria:
 
 | Selector | Description |
 | -------- | ----------- |
+| DNS Subdomain | Use this selector to match against DNS queries that arrive via DNS-over-HTTPS (DoH) destined for the DoH endpoint configured for each location. For example, a location with a DoH endpoint of `abcdefg.cloudflare-gateway.com` could be used in a DNS rule by choosing the DoH Subdomain selector and inputting a value of `abcdefg`. |
 | DNS Domain | Use this selector to match against a domain and all subdomains—for example, if you want to block example.com and all subdomains of example.com. |
 | DNS Host | Use this selector to match against only the hostname specified—for example, if you want to block only example.com but not subdomain.example.com. |
-| DNS Query Rtype | Use this selector to choose the DNS resource record type that you’d like to apply policies against—for example, you can choose to block A records for a domain but not MX records. |
+| DNS Query Rtype | Use this selector to choose the DNS resource record type that you’d like to apply policies against — for example, you can choose to block A records for a domain but not MX records. |
 | DNS Resolver IP | Use this selector to apply policies to DNS queries that arrived to your Gateway Resolver IP address aligned with a registered location. For most Gateway customers, this is an IPv4 AnyCast address and policies created using this IPv4 address will apply to all locations. However, each location has a dedicated IPv6 address and some Gateway customers have been supplied with a dedicated IPv4 address—these both can be used to apply policies to specific registered locations. |
-| DNS Src IP | Use this selector to apply DNS policies to a specific source IP address that queries arrived to Gateway from—for example, this could be the WAN IP address of the stub resolver used by an organization to send queries upstream to Gateway |
+| DNS Src IP | Use this selector to apply DNS policies to a specific source IP address that queries arrive to Gateway from — for example, this could be the WAN IP address of the stub resolver used by an organization to send queries upstream to Gateway. |
 | Location | Use this selector to apply DNS policies to a specific location or set of locations. |
 
 </TableWrap>
 
+These selectors require Gateway with WARP mode to be enabled in the Cloudflare for Teams WARP client and the user to be enrolled in the organization via the WARP client:
+
+<TableWrap>
+
+| Selector | Description |
+| -------- | ----------- |
+| User Email | Use this selector to create identity-based DNS rules based on a user’s email. |
+| User Group Emails | Use this selector to create identity-based DNS rules based on an IdP group email address of which the user is configured as a member in the IdP. |
+| User Group IDs | Use this selector to create identity-based DNS rules based on an IdP group ID of which the user is configured as a member in the IdP. |
+| User Group Names | Use this selector to create identity-based DNS rules based on an IdP group name of which the user is configured as a member in the IdP. | 
+| User Name | Use this selector to create identity-based DNS rules based on an IdP username for a particular user in the IdP. |
+
+</TableWrap>
+
 For more detailed information on DNS categories, see the [DNS categories page](/policies/filtering/dns-policies-builder/dns-categories).
 
 ### Operators
@@ -170,5 +187,5 @@ Blocking a popular TLD like `.com` will prevent users from connecting to signifi
 
 ## Custom block page
 
-When choosing the Block action, toggle the **Display custom block page** setting to respond to queries with a block page, and to specify the message you want to display to users who navigate to blocked websites. If disabled, Gateway will respond to blocked queries with `0.0.0.0`.
+When choosing the Block action, toggle the **Display custom block page** setting to respond to queries with a block page, and to specify the message you want to display to users who navigate to blocked websites. If disabled, Gateway will respond to blocked queries with `0.0.0.0`. For more information, see the dedicated documentation on [customizing the block page](/policies/filtering/configuring-block-page).
 
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies/configuring-block-page.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies/configuring-block-page.md
deleted file mode 100644
index 707bb510750..00000000000
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies/configuring-block-page.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-order: 5
----
-
-# Custom block page
-
-When trying to visit a blocked website, users will see a default browser error page like this one:  
-
-![No block page](../../../static/documentation/policies/no-block-page.png)
-
-This is because Gateway responds to any blocked domain with 0.0.0.0, and does not return the blocked domain's IP address. As a result, the browser cannot take the user to that website. However, this may be confusing for some people, as they may think that their Internet is not working.
-
-To avoid this confusion, you can configure Cloudflare Gateway's block page to explain to the end user why a website is being blocked.  
-
-Follow these three steps to configure a block page:
-
-1. **[Enable](#enable-block-page)** the block page.
-2. **[Download](#download-certificate)** the Cloudflare certificate.
-3. **[Add](#add-certificate-to-your-system)** the certificate to your system.
-
-## Enable block page
-
-1. Navigate to the **Policies** tab in the [Teams dashboard](https://dash.teams.cloudflare.com).
-2. Find the policy for which you would like to set up a block page.
-3. Click **Edit**.
-4. Scroll down to find the **Block page** card.
-5. Toggle the **Enable** switch.
-
-![Enable block page](../../../static/documentation/policies/enable-block-page.png)
-
-6. Click **Save**.
-
-Enabling block page alone will not work for HTTPS connections. When your users try to visit a blocked website, they will now see the following error:
-
-![HTTPS browser error](../../../static/documentation/policies/https-browser-error.png)
-
-To fix the browser error, you need to download and add a certificate to your system.
-
-## Download certificate
-1. Navigate to the **Settings** tab on your [Teams dashboard](https://dash.teams.cloudflare.com).
-1. Click on **Account**.
-1. Scroll down to find the **Certificates** card.
-1. Click on **Download**.
-
-![Download certificate](../../../static/documentation/policies/update-certificates-page.png)
-
-You will now need to add the certificate to your system to ensure your web browser will use this certificate to establish HTTPS connections.
-
-## Add certificate to your system
-
-1. If you are on a Mac, **double-click** on the .pem file.
-2. The certificate is now listed in the **Keychain Access** application.
-
-![Keychain](../../../static/documentation/policies/listed-in-keychain.png)
-
-3. Double-click on the certificate and then click on **Trust**.
-
-![Keychain](../../../static/documentation/policies/cert-click-on-trust.png)
-
-4. Select **Always Trust** from the drop-down menu for **When using this certificate**.
-
-![Always trust](../../../static/documentation/policies/cert-select-always-trust.png)
-
-5. Close the menu.
-
-If your system asks for admin permission, enter your password or use your fingerprint ID to confirm the changes.
-
-### Firefox
-If you are not using Firefox, you can skip this section.
-
-Follow the instructions below to finish configuring the block page:
-
-1. Enter **about:config** in the address bar.
-1. Click on **Accept the risk!** if you see a prompt from Firefox.
-1. Set `security.enterprise_roots.enabled` to `true`.
-
-## See the block page
-When you visit a blocked website you will now see the following block page:
-
-![Block page](../../../static/documentation/policies/cert-block-page.png)
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md
index 62db4c7eaab..eaa556004c0 100644
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md
+++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md
@@ -1,9 +1,16 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # DNS policies
 
+<Aside>
+
+To take full advantage of the DNS filtering experience with Gateway, build any new DNS policy in the DNS (New) tab.
+
+</Aside>
+
 When a user makes a DNS request to Gateway, Gateway matches the request against the content or security categories you have set up for your organization. If the domain does not belong to any blocked categories, or if it matches an override rule, the user's client receives the DNS resolution and initiates an HTTP connection. 
 
 ![Gateway DNS flow](../../../static/documentation/policies/gateway-flow-1.jpg)
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies/policy-management.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies/policy-management.md
index 242c4cd8712..280dcb72db8 100644
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies/policy-management.md
+++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies/policy-management.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Policy management
diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies/safesearch.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies/safesearch.md
index 4183cb33019..25ffba11c64 100644
--- a/products/cloudflare-one/src/content/policies/filtering/dns-policies/safesearch.md
+++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies/safesearch.md
@@ -1,5 +1,6 @@
 ---
 order: 6
+pcx-content-type: how-to
 ---
 
 # SafeSearch
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/antivirus-scanning.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/antivirus-scanning.md
index 0c0ed48c91a..808305c0bce 100644
--- a/products/cloudflare-one/src/content/policies/filtering/http-policies/antivirus-scanning.md
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/antivirus-scanning.md
@@ -1,24 +1,23 @@
 ---
 order: 6
+pcx-content-type: concept
 ---
 
 # AV scanning
 
-Cloudflare Gateway protects users as they navigate the Internet. When you download or upload a file to an origin on the Internet, that file could potentially contain malicious code that, if executed on your machine, may cause the device to perform undesired behavior. To prevent this, Cloudflare Gateway allows admins to enable **Anti-Virus (AV) scanning** of files that are uploaded and/or downloaded by users as the file passes through Gateway. 
+Cloudflare Gateway protects users as they navigate the Internet. When users download or upload a file to an origin on the Internet, that file could potentially contain malicious code that may cause their device to perform undesired behavior.
 
-AV scanning of files requires organizations to enable HTTP traffic filtering.
+To prevent this, Cloudflare Gateway allows admins to enable **Anti-Virus (AV) scanning** of files that are uploaded or downloaded by users as the file passes through Gateway. 
+
+AV scanning of files requires organizations to enable Proxy mode under **Settings** > **Network** > **Layer 7 Firewall**.
 
 ## Enable AV scanning
 
 To enable AV scanning:
 
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to **Gateway > Policies**.
-
-1. Select the **Settings** tab.
+1. On the [Teams Dashboard](https://dash.teams.cloudflare.com), navigate to **Settings > Network**.
 
-1. In the section titled **AntiVirus Scanning**, toggle whether to scan files for malicious payloads during uploads, downloads, or both.
-
-  ![AV Scanning settings](../../../static/documentation/policies/av-toggles.png)
+1. In the section titled **AV Scanning**, toggle whether to scan files for malicious payloads during uploads, downloads, or both.
 
   When a file is blocked due to the presence of malware, it is logged as a Block decision:
 
@@ -26,7 +25,7 @@ To enable AV scanning:
 
 ## How Gateway determines if a file should be scanned
 
-If enabled, Gateway will use the following to determine whether a file is present in a request or response, and whether to scan that file (first match will result in the file being scanned):
+If AV scanning is enabled, Gateway will use the following to determine whether a file is present in a request or response, and whether to scan that file (first match will result in the file being scanned):
 
 * If the Content-Disposition HTTP header is `Attachment`
 * If the byte signature of the body of the request matches a signature we identify as one of the following file type categories:
@@ -43,7 +42,7 @@ If a file does not trigger a scan based on the three methods above but also does
 
 ## Non-scannable files
 
-Not all files are able to be scanned — for example, password protected files that cannot be opened due to encryption. Admins can choose whether to **fail open** (allow the file to pass through unscanned) or to **fail closed** (deny the file transfer).
+Not all files are able to be scanned. For example, this is the case for password protected files that cannot be opened due to encryption. Admins can choose whether to **fail open** (allow the file to pass through unscanned) or to **fail closed** (deny the file transfer).
 
 The following files cannot be scanned and will be blocked or allowed based on whether the admin configured Gateway to fail open or closed:
 
@@ -56,6 +55,7 @@ The following files cannot be scanned and will be blocked or allowed based on wh
 ## Opt content out from scanning
 
 When an admin enables AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning by leveraging the HTTP rules. The following selectors can be used to opt HTTP traffic out from AV scanning using the Do Not Scan action:
+
 * Application
 * Hostname
 * URL
@@ -75,7 +75,7 @@ For example, an enables AV scanning for all files uploaded and downloaded throug
 | - | - | - | - | - |
 | Hostname | Matches Regex | `.*example.com` | Do Not Scan |
 
-Opting out of AV scanning applies to both uploads and downloads of files (i.e., it matches the global AV scanning setting). If an admin has chosen, for example, to only globally scan uploads then opting out of AV scanning only applies to uploads.  
+Opting out of AV scanning applies to both uploads and downloads of files (i.e., it matches the global AV scanning setting). If an admin has chosen, for example, to only globally scan uploads, then opting out of AV scanning only applies to uploads.  
 
 ## Supported compressed file types
 
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/application-app-types.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/application-app-types.md
index 02808d2802a..70ea0211839 100644
--- a/products/cloudflare-one/src/content/policies/filtering/http-policies/application-app-types.md
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/application-app-types.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # Applications and app types
@@ -15,6 +16,7 @@ Using these two selectors in the HTTP rule builder, you can have more granular c
 1. Navigate to the **HTTP tab**.
 
 1. [Create a new rule](/policies/filtering/http-policies/policy-management#create-your-first-http-policy), or edit an existing one.
+
 1. In the **Selector** drop-down menu, select the *Application* option. 
 
 1. In the **Operator** drop-down menu, select *in* or *not in*, depending on whether you want to include or exclude applications or app types from your rule.
@@ -31,6 +33,7 @@ Using these two selectors in the HTTP rule builder, you can have more granular c
 ## Supported applications and app types
 
 ### Applications
+
 A full list of supported applications and their respective app types are available to download [here](../../../static/documentation/applications.csv).
 
 ### App types
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/global-rules.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/global-rules.md
index 0fe9773df19..e46c1b9e32e 100644
--- a/products/cloudflare-one/src/content/policies/filtering/http-policies/global-rules.md
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/global-rules.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Global rules
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/index.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/index.md
index 11da318abdb..b11943d134f 100644
--- a/products/cloudflare-one/src/content/policies/filtering/http-policies/index.md
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: concept
 ---
 
 # HTTP policies
@@ -53,7 +54,7 @@ Rules with Block actions block outbound traffic from reaching destinations you s
 
 ### Isolate
 
-When a HTTP policy applies the Isolate action, the user's web browser is transparently served a HTML compatible remote browser client. Isolation policies can be applied to requests that include `Accept: text/html*`. This allows Browser Isolation policies to co-exist with API traffic.
+When an HTTP policy applies the Isolate action, the user's web browser is transparently served a HTML compatible remote browser client. Isolation policies can be applied to requests that include `Accept: text/html*`. This allows Browser Isolation policies to co-exist with API traffic.
 
 If you'd like to isolate **all security threats**, you can set up a policy with the following configuration:
 
@@ -67,12 +68,6 @@ If instead you need to isolate **specific hostnames**, you can list the domains
 | - | - | - | - |
 | Host | In | `example.com`, `example.net` | Isolate
 
-If you would like to isolate an **entire domain name**, you can use a regular expression match such as:
-
-| Selector | Operator | Value | Action |
-| - | - | - | - |
-| Host | matches regex | `example\.com|.*\.example\.com` | Isolate
-
 <Aside type='note' header='Isolate identity providers for applications'>
 
 Existing cookies and sessions from non-isolated browsing are not sent to the remote browser. Websites that implement single sign on using third-party cookies will also need to be isolated.
@@ -97,7 +92,7 @@ When a *Do Not Inspect* rule is created for a given hostname, application, or ap
 
 </Aside>
 
-*Do Not Inspect* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occuring on both encrypted and plaintext traffic.
+*Do Not Inspect* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic.
 
 The *Do Not Inspect* action is only available when matching against the host criteria.
 
@@ -105,6 +100,12 @@ The L7 firewall will evaluate *Do Not Inspect* rules before any subsequent Allow
 
 ## Selectors
 
+<Aside>
+
+Policies created using the URL selector are case-sensitive.
+
+</Aside>
+
 Gateway matches HTTP traffic against the following selectors, or criteria:
 * **Host**
 * **URL**
@@ -113,40 +114,10 @@ Gateway matches HTTP traffic against the following selectors, or criteria:
 * **URL Path and Query**
 * **HTTP Method**
 * **HTTP Response**
-* **Uploaded and Downloaded File Extension**
 * **Uploaded and Downloaded Mime Type**
 * **Content categories**
 * **Applications**
 
-List of file extensions Gateway can match against:
-
-<TableWrap>
-
-| Image | Executable | Audio | Documents | Data | Compressed | System | Video |
-|------|------|-------|------|--------|--------|--------|-----|
-| avif | apk | m4a | doc | avro | 7z | bak | avi |
-| bmp | bat | mid | docx | csv | arj | cab | flv |
-| gif | bin | mp3 | odp | dat | bz2 | cpl | h264 |
-| ico | cgi | mpa | ods | dmg | deb | cur | m4v |
-| jpeg | com | wav | odt | iso | gz | emu | mkv |
-| png | dll | wma | pdf | json | lz | ini | mov |
-| psd | exe | ppt | | log | lz4 | scr | mp4 |
-| svg | hta | pptx | | mdb | lzh | sys | mpeg |
-| tif | jar | rtf | | nzb | lzma | tmp | wmv |
-| webp | moo | txt | | orc | pak
-|  | pif | xls | | parquet | rar
-|  | pl | xlsx | | rc | rpm
-|  | prg | | | sav | sz
-|  | | | | wasm | xz | | 
-|  |      | | | sql lite | z
-|  |      | | | tar | zip
-|  |      | | | toml | zlib |
-|  |      | | | torrent | zst |
-|  |      | | | xml |  |
-|  |      | | | yaml | | 
-
-</TableWrap>
-
 ## Operators
 Operators are the way Gateway matches traffic to a selector. Matching happens as follows:
 
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/order-of-enforcement-http-policies.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/order-of-enforcement-http-policies.md
new file mode 100644
index 00000000000..24e3064713f
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/order-of-enforcement-http-policies.md
@@ -0,0 +1,18 @@
+---
+order: 3
+pcx-content-type: concept
+---
+
+# Order of enforcement
+
+Gateway evaluates HTTP policies as follows:
+
+1. First, it evaluates all Do Not Inspect policies in order of precedence.
+1. If no policies match, it evaluates all Isolate policies in order of precedence.
+1. If no policies match, it evaluates all Allow, Block and Do Not Scan rules in order of precedence.
+
+This order of enforcement allows Gateway to determine first if decryption should occur.
+
+Once that's been established, Isolation policies are evaluated. When a user makes a request which triggers an Isolation policy, the request will be rerouted to an isolated browser and re-evaluated for HTTP policies.
+
+This makes it possible for an isolated browser to remotely render a block page or have malicious content within the isolated browser blocked by HTTP policies.
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/policy-management.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/policy-management.md
index c2d41f11d83..6517ac1e2b1 100644
--- a/products/cloudflare-one/src/content/policies/filtering/http-policies/policy-management.md
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/policy-management.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Policy management
diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md
new file mode 100644
index 00000000000..4da7155c030
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md
@@ -0,0 +1,64 @@
+---
+order: 5
+pcx-content-type: how-to
+---
+
+# Tenant control
+
+Cloudflare for Teams offers IT administrators a way to ensure users have access to SaaS applications for corporate use, while at the same time blocking access to their personal accounts. This helps prevent the loss of sensitive or confidential data from a corporate network.
+
+You can create Gateway HTTP policies to control access to your corporate SaaS applications. When creating an HTTP policy with an Allow action, you will have the option to configure **custom headers**. The policy will use these headers to grant access to an application if a user’s request is headed to your organization’s account for the SaaS application, and to deny access if the request is headed to an account that does not match the information in the header.
+
+Not all SaaS applications support tenant control. Examples of common applications that do support tenant control through the injection of HTTP headers are:
+
+* Microsoft 365
+* Slack
+* GSuite
+* Dropbox
+* YouTube
+
+## Add custom headers for a SaaS application (Microsoft 365 example)
+
+This is a walkthrough of how to add custom headers for Microsoft 365. The procedure is the same for other SaaS applications, except for the values you will add for **Custom Header Name**. Values for **Custom Header Value** are specific to your organization; consult the documentation for your SaaS application for more information on where to find them.
+
+1. On the [Teams Dashboard](https://dash.teams.cloudflare.com), navigate to **Gateway** > **Policies** > **HTTP**.
+1. Create a policy with the following values:
+    * Action: `Allow`
+    * Selector: `Application`
+    * Operator: `In`
+    * Value: select the application you would like to inject custom headers for.
+1. Under **Policy Settings**, add a custom header. You can add as many custom headers as needed.
+    * Custom Header Name: Restrict-Access-To-Tenants
+    * Custom Header Value: contoso.com,fabrikam.onmicrosoft.com,72f988bf-86f1-41af-91ab-2d7cd011db4
+
+1. Click **Create policy**.
+
+Your Allow policy is now displayed in the list of HTTP rules. When an end user attempts to authenticate to an Office 365 application with a personal account, authentication will fail.
+
+## Common policy configurations 
+
+This section covers policy configurations for common SaaS applications. 
+
+## Dropbox
+
+| Selector | Operator | Value | Action | Header name |
+| -- | -- | -- | -- | -- |
+| Application | In | Dropbox | Allow | `X-Dropbox-allowed-Team-Ids` |
+
+## G Suite
+
+| Selector | Operator | Value | Action | Header name |
+| -- | -- | -- | -- | -- |
+| Application | In | Google Workspace | Allow | `X-GooGApps-Allowed-Domains` |
+
+## Microsoft 365
+
+| Selector | Operator | Value | Action | Header name |
+| -- | -- | -- | -- | -- |
+| Application | In | Microsoft Office365 | Allow | `Restrict-Access-To-Tenants`, `Restrict-Access-Context` |
+
+## YouTube
+
+| Selector | Operator | Value | Action | Header name |
+| -- | -- | -- | -- | -- |
+| Application | In | YouTube | Allow | `YouTube-Restrict` |
diff --git a/products/cloudflare-one/src/content/policies/filtering/index.md b/products/cloudflare-one/src/content/policies/filtering/index.md
index 7bc69d6b3ee..8e212eabcda 100644
--- a/products/cloudflare-one/src/content/policies/filtering/index.md
+++ b/products/cloudflare-one/src/content/policies/filtering/index.md
@@ -1,19 +1,18 @@
 ---
 order: 0
+pcx-content-type: concept
+title: Secure Web Gateway
 ---
 
-# Secure Web Gateway
+# Secure Web Gateway policies
 
 <Aside>
 When creating or editing policies, keep in mind that it may take up to 60 seconds for that policy to be updated across all of our data centers.
 </Aside>
 
-With Secure Web Gateway polices, Cloudflare for Teams allows you to set up two types of filtering:
+With Secure Web Gateway polices, Cloudflare for Teams allows you to set up policies to inspect DNS, HTTP, and Network traffic.
 
-* **DNS filtering:** filtering DNS queries from networks or devices.
-* **HTTP filtering:** inspecting and filtering HTTP traffic over port 80 and 443 from enrolled devices. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule).
-
-This section describes how to create both DNS and HTTP policies in Cloudflare for Teams. To review how to connect networks and devices to Cloudflare, check out the [Connections section](/connections).
+This section describes how to create DNS, HTTP and Network policies on the Cloudflare for Teams Dashboard. To review how to connect networks and devices to Cloudflare, check out the [Connections section](/connections).
 
 <DirectoryListing path="/policies/filtering"/>
 
@@ -31,10 +30,10 @@ If you are using a policy to block `example.com`, you can do the following to se
 
 2. Type `dig example.com` (`nslookup example.com`) if you are using Windows) and press enter
 
-3. If the Block page is **disabled** for the policy, then you should see `REFUSED` in the answer section like below:
+3. If the Block page is **disabled** for the policy, then you should see `REFUSED` in the answer section:
 
  ![Blocked when block page disabled](../../static/documentation/faq/blocked-disabled.png)
 
- If the Block page is **enabled** for the policy, then you should see `NOERROR` in the answer section and **162.159.36.12** and **162.159.46.12** as the answers when the domain is successfully blocked.
+ If the Block page is **enabled** for the policy, then you should see `NOERROR` in the answer section and `162.159.36.12` and `162.159.46.12` as the answers when the domain is successfully blocked.
 
  ![Blocked when block page enabled](../../static/documentation/faq/blocked-enabled.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/policies/filtering/network-policies/index.md b/products/cloudflare-one/src/content/policies/filtering/network-policies/index.md
new file mode 100644
index 00000000000..521593930de
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/filtering/network-policies/index.md
@@ -0,0 +1,100 @@
+---
+order: 3
+pcx-content-type: concept
+---
+
+# Network policies
+
+<Aside type="note">
+
+To enable this feature, download and deploy the [WARP client](/connections/connect-devices/warp/deployment) on your devices.
+
+</Aside>
+
+With Teams, you can configure policies to control network-level traffic leaving your endpoints. Using network selectors like IP addresses and ports, your policies will control access to any network origin. Because Cloudflare for Teams [integrates with your identity provider](/identity/idp-integration), it also gives you the ability to create identity-based network policies. This means you can now control access to non-HTTP resources on a per-user basis regardless of where they are or what device they’re accessing that resource from.
+
+Build a network policy by configuring the following elements:
+
+* [Actions](#actions)
+* [Expressions](#expressions)
+* [Selectors](#selectors)
+* [Operators](#operators)
+
+## Actions
+
+Just like actions in DNS and HTTP policies, actions in network policies define which decision you want to apply to a given set of elements. You can assign one action per policy.
+
+These are the action types you can choose from:
+
+* [Allow](#allow)
+* [Block](#block)
+* [Network Override](#network-override)
+
+### Allow
+
+Policies with Allow actions allow network traffic to reach certain IPs or ports. For example, the following configuration allows specific users to reach a given IP address:
+
+| Selector | Operator | Value | Action |
+| --- | --- | --- | --- |
+| Destination IP | In | `92.100.02.102` | Allow |
+| Email | In | `*@example.com` |  |
+
+### Block
+
+Policies with Block actions block network traffic from reaching certain IPs or ports. For example, the following configuration blocks all traffic directed to port 443:
+
+| Selector | Operator | Value | Action |
+| --- | --- | --- | --- |
+| Destination Port | In | `443` | Block |
+
+
+### Network Override
+
+Policies with Network Override actions do not inspect traffic directed to, or coming from, certain IPs or ports. For example, the following configuration overrides traffic to a public IP to a Private IP based on a user’s identity:
+
+| Selector | Operator | Value | Action |
+| --- | --- | --- | --- |
+| Destination IP | In | `95.92.143.151` | Network Override |
+| User Email | In | `*@example.com` | |
+| Override IP |  | 10.0.0.1 | | 
+
+## Expressions 
+
+Build expressions to determine the set of elements you want to impact with your policy. To build an expression, you need to choose a **Selector** and an **Operator**, and enter a value or range of values in the **Value** field. 
+
+### Selectors
+
+Gateway matches network traffic against the following selectors, or criteria:
+
+* Destination IP
+* Destination Port
+* Source IP
+* Source Port
+
+| Selector | Description |
+| - | - |
+| Destination IP | The IP address of the request’s target |
+| Destination Port | The port number of the request’s target |
+| Source IP | The IP address of the user making the request |
+| Source Port | The port number of the user’s request |
+
+### Operators
+
+Operators are the way Gateway matches traffic to a selector. Matching happens as follows:
+
+| Operator              |          Meaning
+|:---------------------:|:---------------------------:|
+|  is                   |  exact match, equals        |
+|  is not               |  all except exact match     |
+|  in                   |  in any of defined entries  |
+|  not in               |  not in defined entries     |
+|  matches regex        | regex evaluates to true         |
+|  does not match regex |  all except when regex evals to true   |
+
+<Aside>
+
+The <code>in</code> operator allows you to specify IP addresses or networks using CIDR notation. 
+
+</Aside>
+
+
diff --git a/products/cloudflare-one/src/content/policies/filtering/network-policies/policy-management.md b/products/cloudflare-one/src/content/policies/filtering/network-policies/policy-management.md
new file mode 100644
index 00000000000..616369c8bfc
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/filtering/network-policies/policy-management.md
@@ -0,0 +1,35 @@
+---
+order: 3
+pcx-content-type: how-to
+---
+
+# Policy management
+
+To manage your network policies, navigate to **Policies** > **Network**.
+
+## Create a network policy
+
+1. Under **Policies** > **Network**, click **Create a policy**.
+1. Enter a policy name and an optional description.
+1. Next, [build an expression](/policies/filtering/network-policies#expressions) by choosing a selector, operator, and value to match against.
+1. Select an Action to perform on network traffic that matches the expression.
+1. Click **Create policy**.
+
+Your network policy has now been created. 
+
+## Edit a network policy
+
+1. Under **Policies** > **Network**, find the policy you want to edit.
+1. Click **Edit**.
+1. Make the desired changes to the policy configuration.
+1. Click **Save policy**.
+
+Your changes will now be reflected in your network policy.
+
+## Delete a network policy
+
+1. Under **Policies** > **Network**, find the policy you want to edit.
+1. Click **Delete**.
+1. A pop-up message will ask you to confirm your decision to delete the policy. Click **Delete**.
+
+Your policy has now been deleted.
diff --git a/products/cloudflare-one/src/content/policies/index.md b/products/cloudflare-one/src/content/policies/index.md
index a1a9a000d9f..484de13f816 100644
--- a/products/cloudflare-one/src/content/policies/index.md
+++ b/products/cloudflare-one/src/content/policies/index.md
@@ -1,13 +1,14 @@
 ---
 order: 6
+pcx-content-type: navigation
 ---
 
 # Policies
 
-Policies are sets of rules that allow you to create:
+With Cloudflare for Teams, you can create: 
 
-* [**Secure Web Gateway**](/policies/filtering) rules to filter traffic to the Internet, with [Cloudflare Gateway](/glossary#cloudflare-gateway)
-* [**Zero Trust**](/policies/zero-trust) rules to secure applications with [Cloudflare Access](/glossary#cloudflare-access)
+* [**Secure Web Gateway**](/policies/filtering) policies to inspect outbound traffic to the Internet, with [Cloudflare Gateway](/glossary#cloudflare-gateway)
+* [**Zero Trust**](/policies/zero-trust) policies to secure inbound traffic to your applications with [Cloudflare Access](/glossary#cloudflare-access)
 
 
 ## Related tutorials
diff --git a/products/cloudflare-one/src/content/policies/lists.md b/products/cloudflare-one/src/content/policies/lists.md
index 0b331cbe11e..e1cde1c215b 100644
--- a/products/cloudflare-one/src/content/policies/lists.md
+++ b/products/cloudflare-one/src/content/policies/lists.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: how-to
 ---
 
 # Lists
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/app-paths.md b/products/cloudflare-one/src/content/policies/zero-trust/app-paths.md
index c2a36fb238b..fabd36ad729 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/app-paths.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/app-paths.md
@@ -1,12 +1,13 @@
 ---
 order: 4
+pcx-content-type: common-configurations
 ---
 
 # Application paths
 
 Teams allows you to create unique rules for parts of an application that share a root path. Imagine an example application is deployed at `dashboard.com/eng` that anyone on the engineering team should be able to access. However, a tool deployed at `dashboard.com/eng/exec` should only be accessed by the executive team. 
 
-When multiple rules are set for a common root path, its subdomains do not inherit rules. For example, when setting rules for `dashboard.com/eng` and `dashboard.com/eng/exec` separately, `dashboard.com/eng/exec` does not inherit the rule set for `dashboard.com/eng`. Instead, the more specific rule takes precedence.
+When multiple rules are set for a common root path, the more specific rule takes precedence. For example, when setting rules for `dashboard.com/eng` and `dashboard.com/eng/exec` separately, the more specific rule for `dashboard.com/eng/exec` takes precedence, and no rule is inherited from `dashboard.com/eng`. If no separate, specific rule is set for `dashboard.com/eng/exec`, it will inherit any rules set for `dashboard.com/eng`.
 
 In the Teams dashboard, when adding a [self-hosted web application](/applications/configure-apps/self-hosted-apps), you can choose to protect the entire website by entering its apex domain, or alternatively, you can specify any subdomains and paths in the dedicated fields.
 
@@ -29,7 +30,7 @@ Using a wildcard in the *subdomain* field **does not cover the apex domain**.
 
 <TableWrap>
 
-| Wildcard | Covers | Doesn't cover |
+| Entry | Covers | Doesn't cover |
 | -------- | ------ | ------------- |
 | `*.example.com` | `alpha.example.com`, `beta.example.com` | `example.com` |
 
@@ -37,13 +38,23 @@ Using a wildcard in the *subdomain* field **does not cover the apex domain**.
 
 ### Protect all paths of an apex domain
 
-Using a wildcard in the *path* field **does cover the apex domain**.
+If you want to protect an apex domain and all of the paths under it, leave the path field empty.
 
 <TableWrap>
 
-| Wildcard | Covers | Doesn't cover |
+| Entry | Covers | Doesn't cover |
 | -------- | ------ | ------------- |
-| `example.com/*` | `example.com`, `example.com/alpha`, `example.com/beta` | `alpha.example.com` |
+| `example.com` | `example.com`, `example.com/alpha`, `example.com/beta` | `alpha.example.com` |
+
+</TableWrap>
+
+To protect all the paths under an apex domain, but not the apex domain itself, use a wildcard in the *path* field.
+
+<TableWrap>
+
+| Entry | Covers | Doesn't cover |
+| -------- | ------ | ------------- |
+| `example.com/*` | `example.com/alpha`, `example.com/beta` | `example.com` |
 
 </TableWrap>
 
@@ -53,7 +64,7 @@ Using a wildcard in the *subdomain* field to protect multi-level subdomains **do
 
 <TableWrap>
 
-| Wildcard | Covers | Doesn't cover |
+| Entry | Covers | Doesn't cover |
 | -------- | ------ | ------------- |
 | `*.test.example.com` | `alpha.test.example.com`, `beta.test.example.com` | `example.com`, `test.example.com` |
 
@@ -65,7 +76,7 @@ Using a wildcard in the *path* field to protect multi-level paths **does not cov
 
 <TableWrap>
 
-| Wildcard | Covers | Doesn't cover |
+| Entry | Covers | Doesn't cover |
 | -------- | ------ | ------------- |
 | `example.com/alpha/*` | `example.com/alpha/one`, `example.com/alpha/two` | `example.com`, `example.com/beta` |
 
@@ -75,7 +86,7 @@ Using a wildcard in the *path* field to protect multi-level paths **does not cov
 
 You cannot use wildcards to partially match subdomain and path names. Using asterisks in any way other than the ones outlined above **will cause the wildcard to be invalidated**. This means your application won't be effective, and neither will be any rules you may try to enforce on it at a later time.
 
-| Wildcard | Does NOT cover |
+| Entry | Does NOT cover |
 | -------- | ------ | 
 | `example.com/cat-*` | `example.com/cat`, `example.com/cat-food` |
 | `*ing.example.com` | `ing.example.com`, `engineering.example.com`|
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/common-configs.md b/products/cloudflare-one/src/content/policies/zero-trust/common-configs.md
index e62fb15df14..e94dc71b93a 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/common-configs.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/common-configs.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: configuration
 ---
 
 # Common configurations
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/cors.md b/products/cloudflare-one/src/content/policies/zero-trust/cors.md
index 42739a3ffa1..8bd7cc2fef2 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/cors.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/cors.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: concept
 ---
 
 # CORS
@@ -21,7 +22,11 @@ To handle CORS headers for the policy protecting the path that requires CORS, na
 ## Access and CORS
 
 <Aside type='Warning' header='Important'>
-Safari, in particular Safari 13.1, handles cookies in a unique format. In some cases, this can cause CORS to fail. This will be dependent on Apple releasing a patch for handling cookies. This is known to impact macOS 10.15.4 when running Safari 13.1 (15609.1.20.111.8).
+
+* Safari, in particular Safari 13.1, handles cookies in a unique format. In some cases, this can cause CORS to fail. This will be dependent on Apple releasing a patch for handling cookies. This is known to impact macOS 10.15.4 when running Safari 13.1 (15609.1.20.111.8).
+
+* Do not troubleshoot CORS in Incognito mode, as this will cause disruptions with Access due to `CF-Authorization` being blocked as a third-party cookie on cross origin requests"
+
 </Aside>
 
 If you have two sites protected by Cloudflare Access, `app1.site.com` and `app2.hostname.com`, requests made between the two will be subject to CORS checks. Users who login to `app1.site.com` will be issued cookies for `app1.site.com` and your Cloudflare Access [team domain](/glossary#team-domain).
@@ -86,10 +91,10 @@ cf-request-id: 0244b54354000082d7b991f200000001
 
 In general, we recommend the following steps when troubleshooting CORS issues:
 
-1. Capture a HAR file with the issue described.
+1. Capture a HAR file with the issue described, as well as the JS console log output recorded simultaneously. This is because the HAR file alone will not give full visibility on the reason behind cross-origin issues.
 2. Ensure that the application has set `credentials: 'same-origin'` in all fetch or XHR requests.
 3. If you are using the [cross-origin setting](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin) on script tags, these must be set to "use-credentials".
 
 <Aside type='Warning' header='CORS is failing on the same domain'>
 CORS checks do not occur on the same domain. If this error occurs, it is likely the user flow is making a sub-request without the cookie.
-</Aside>
\ No newline at end of file
+</Aside>
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/index.md b/products/cloudflare-one/src/content/policies/zero-trust/index.md
index a21f2b24f58..51575db9ce9 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/index.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/index.md
@@ -1,26 +1,28 @@
 ---
 order: 4
+pcx-content-type: concept
+title: Zero Trust
 ---
 
-# Zero Trust
+# Zero Trust policies
 
-Access determines who can reach your applications by applying the zero-trust policies you configure. To build a zero-trust policy, you will have to combine different elements; the way you assemble these "building blocks" determines the scope and effectiveness of your policy.
+Access determines who can reach your applications by applying the Zero Trust policies you configure. To build a Zero Trust policy, you will have to combine different elements; the way you assemble these building blocks determines the scope and effectiveness of your policy.
 
-The elements that make up a zero-trust policy are:
+The elements that make up a Zero Trust policy are:
 
 * **Actions**
 * **Rules**
 * **Criteria**
 
-### Actions
+## Actions
 
 Actions let you define which *action* you want to take on a certain user or user group. Do you want to allow someone access to your applications? Do you want to deny someone access to your applications? Do you want to bypass certain users?
 
-The action is the first element you'll be asked to configure when you create a zero-trust policy in the Teams dash. You can set only one action per policy.
+The action is the first element you'll be asked to configure when you create a Zero Trust policy in the Teams Dash. You can set only one action per policy.
 
 These are the action types you can choose from:
 
-* **​Allow**.  
+* **Allow**.  
     The allow action allows users that meet certain criteria to reach an application behind Access. 
 * **Block**.  
     The block action prevents users from reaching an application behind Access. 
@@ -29,9 +31,13 @@ These are the action types you can choose from:
 * **Service Auth**.  
     Service Auth rules enforce authentication flows that do not require an identity provider IdP) login, such as service tokens and mutual TLS.
 
-**Note.** When applying a Bypass action, security settings revert to the defaults configured for the zone and any configured page rules. If Always use HTTPS is enabled for the site, then traffic to the bypassed destination continues in HTTPS. If it is not or you applied page rules to disable it, traffic is HTTP.
+<Aside type='note'>
 
-### Rules
+When applying a Bypass action, security settings revert to the defaults configured for the zone and any configured page rules. If Always use HTTPS is enabled for the site, then traffic to the bypassed destination continues in HTTPS. If it is not or you applied page rules to disable it, traffic is HTTP.
+
+</Aside>
+
+## Rules
 
 Rules work like logical operators. They help you define which categories of users your policy will affect. Each action needs at least an Include rule; for each action, you can set as many rules as you need. 
 
@@ -41,7 +47,7 @@ These are the rule types you can choose from:
 | ------- | ------- | ------- |
 | The Include action is similar to an OR logical operator. In case more than one Include rule is specified, users need to meet only one of the criteria. | The Exclude rule works like a NOT logical operator. A user meeting any Exclude criteria won’t be allowed access to the application. | The Require rule works like an AND logical operator. A user must meet all specified Require rules to be allowed access. |
 
-### Criteria
+## Criteria
 
 When you add a rule to your policy, you will be asked to specify the criteria you want users to meet in order for the rule to be applied to them. For example, you may want your policy to apply to all your team members in a specific country, except the ones whose email ends in `@contractor.company.com`. 
 
@@ -55,14 +61,14 @@ Here is a list of all the criteria you can apply:
 * **Country** – uses the IP address to determine country.
 * **Valid Certificate** - the request will need to present any valid client certificate.
 * **Common Name** - the request will need to present a valid certificate with an expected common name.
-* **Any Access Service Token** - the request will need to present the headers for any [service token](/access-service-auth/service-tokens) created for this account.
+* **Any Access Service Token** - the request will need to present the headers for any [service token](/identity/service-auth/service-tokens) created for this account.
 * **Service Token** - the request will need to present the correct service token headers configured for the specific application
 * **Identity provider groups** — employs the user groups (if supported) you configured with your identity provider (IdP) or LDAP with Access. The IdP group option only displays if you use an identity provider that passes groups using SAML or OAuth Scope.
 * **Authentication Method** - checks the [multifactor authentication](/policies/zero-trust/mfa-requirements) method used by the user, if supported by the identity provider.
 * **Login Method** - checks the identity provider used at the time of login.
 
 
-### Example scenarios
+## Example scenarios
 
 
 | Action | Rule | Criteria |
@@ -84,3 +90,17 @@ Here is a list of all the criteria you can apply:
 | Block  | Include | `Everyone` |
 
 **Result**: this configuration blocks every request to the application.
+
+## Order of execution
+
+Policies are evaluted based on their action type and ordering. Bypass and Service Auth policies are evaluated first based on their order. Then, Block and Allow policies are evaluated based on their order.
+
+For example, if you have a list of policies that reflects the following:
+
+* Allow A
+* Block B
+* Service Auth C
+* Bypass D
+* Allow E
+
+The policies will execute in this order: Service Auth C > Bypass D > Allow A > Block B > Allow E.
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/mfa-requirements.md b/products/cloudflare-one/src/content/policies/zero-trust/mfa-requirements.md
index bb94606f307..fc5d2346395 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/mfa-requirements.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/mfa-requirements.md
@@ -1,10 +1,11 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # Enforce MFA
 
-With zero-trust policies, you can require that users log in to certain applications with specific types of multifactor authentication (MFA) methods. For example, you can create rules that only allow users to reach a given application if they authenticate with a physical hard key.
+With Zero Trust policies, you can require that users log in to certain applications with specific types of multifactor authentication (MFA) methods. For example, you can create rules that only allow users to reach a given application if they authenticate with a physical hard key.
 
 This feature is only available if you are using the following identity providers:
 
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/policy-management.md b/products/cloudflare-one/src/content/policies/zero-trust/policy-management.md
index bcf620d6e30..c77c6484c45 100644
--- a/products/cloudflare-one/src/content/policies/zero-trust/policy-management.md
+++ b/products/cloudflare-one/src/content/policies/zero-trust/policy-management.md
@@ -1,28 +1,34 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Policy management
 
 Policies are properties of applications. Creating the first policy for an application is part of the setup process for that application.
 
-You can then choose to edit or delete that first policy after completing the application setup, or you can decide to add new policies to the application, all from the Applications section of the Teams dashboard.
+You can then choose to edit or delete that first policy after completing the application setup, or you can decide to add new policies to the application, all from the Applications section of the Teams Dashboard.
 
-There is no limit to the number of policies you can set up for your applications.
+You can create up to 1,000 policies per application.
 
-## Add a policy
+## Create a policy
 
-To add a zero-trust policy:
+To create a Zero Trust policy for an existing application:
+
+1. On the Teams Dashboard, navigate to the **Access > Applications** page.
 
-1. On the Teams dashboard, navigate to the **Access > Applications** page.
 1. Locate the application for which you want to create the policy.
+
 1. Click **Add a Rule**.
 
- ![Add rule](../../static/documentation/policies/add-rule.png)
+  ![Add rule](../../static/documentation/policies/add-rule.png)
 
 1. Select a **Rule name**. This name will identify your policy in the list of application policies.
+
 1. Select a **[Rule action](/policies/zero-trust#actions)**. 
+
 1. Configure as many **[Rules](/policies/zero-trust#rules)** as needed.
+
 1. Click **Save rule**.
 
 Your policy has now been added to the application.
@@ -31,24 +37,32 @@ Your policy has now been added to the application.
 
 To make any changes to an application’s policies:
 
-1. On the Teams dashboard, navigate to the **Access > Applications** page.
+1. On the Teams Dashboard, navigate to the **Access > Applications** page.
+
 1. Locate the application for which you want to change the policies.
+
 1. Click **Edit**. This will automatically redirect you to the app’s **Rules** section.
 
-![Policies section](../../static/documentation/policies/policies-section.png)
+  ![Policies section](../../static/documentation/policies/policies-section.png)
 
 1. Once in the **Policies** section, you can edit the **Rule name**, the **Rule action**, and any rules you had configured.
+
 1. Once you’ve made all the necessary changes, click **Save application**.
 
 ## Delete a policy
 
-To delete a zero-trust policy:
+To delete a Zero Trust policy:
+
+1. On the Teams Dashboard, navigate to the **Access > Applications** page.
 
-1. On the Teams dashboard, navigate to the **Access > Applications** page.
 1. Locate the application for which you want to delete the policy.
+
 1. Click **Edit**. This will automatically redirect you to the app’s **Rules** section.
+
 1. Locate the policy you want to delete and click **Delete**.
+
 1. A pop-up message will ask you to confirm your decision to delete the policy. Click **Delete**.
+
 1. Click **Save application**.
 
 Your policy has now been deleted.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/policies/zero-trust/require-purpose-justification.md b/products/cloudflare-one/src/content/policies/zero-trust/require-purpose-justification.md
new file mode 100644
index 00000000000..59c2409eb7c
--- /dev/null
+++ b/products/cloudflare-one/src/content/policies/zero-trust/require-purpose-justification.md
@@ -0,0 +1,23 @@
+---
+order: 1
+pcx-content-type: how-to
+title: Require Purpose Justification
+---
+
+# Require Purpose Justification After Login
+
+Cloudflare Access allows security and IT teams to present users with a purpose justification screen directly after they log into an Access application. This allows organizations to audit not only for *who* is accessing their resources, but also for *why* they are requesting access.
+
+The purpose justification screen will show for any new sessions of an application. For example, if an Access application has a session time of eight hours, a user will see the purpose justification screen once every eight hours.
+
+Configuring a purpose justification screen is done as part of configuring an Access policy.
+
+1. On the Teams Dashboard, navigate to **Access** > **Applications**.
+1. Select an application and click **Edit**.
+1. Select the policy you want to configure with purpose justification.
+1. Open **Optional Configurations**.
+1. Enable purpose justification.
+1. (Optional) set a custom purpose justification message. This will appear on the purpose justification screen and will be visible to the user.
+1. Once configured, a user will see the following screen:
+
+  ![Purpose Justification](../../static/documentation/policies/purpose-justification.png)
diff --git a/products/cloudflare-one/src/content/setup/index.md b/products/cloudflare-one/src/content/setup/index.md
index 71cc5555d46..604b7130ae0 100644
--- a/products/cloudflare-one/src/content/setup/index.md
+++ b/products/cloudflare-one/src/content/setup/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: getting-started
 ---
 
 # Get started
diff --git a/products/cloudflare-one/src/content/static/documentation/applications/custom-saas-statements.png b/products/cloudflare-one/src/content/static/documentation/applications/custom-saas-statements.png
new file mode 100644
index 00000000000..02c6de9274f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/applications/custom-saas-statements.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/applications/new-saas-app.png b/products/cloudflare-one/src/content/static/documentation/applications/new-saas-app.png
deleted file mode 100644
index 1eada04f259..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/applications/new-saas-app.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/applications/render-browser.png b/products/cloudflare-one/src/content/static/documentation/applications/render-browser.png
deleted file mode 100644
index c0d0e748520..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/applications/render-browser.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/applications/saas-logo.png b/products/cloudflare-one/src/content/static/documentation/applications/saas-logo.png
deleted file mode 100644
index c54a0ce7d39..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/applications/saas-logo.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/applications/ssh-browser-rendering.png b/products/cloudflare-one/src/content/static/documentation/applications/ssh-browser-rendering.png
new file mode 100644
index 00000000000..7ac34d9c0be
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/applications/ssh-browser-rendering.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS1_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS1_cert.png
new file mode 100644
index 00000000000..10cece43d10
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS1_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS2_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS2_cert.png
new file mode 100644
index 00000000000..2d3ec2229b3
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS2_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS3_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS3_cert.png
new file mode 100644
index 00000000000..b1a0bbba428
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS3_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS4_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS4_cert.png
new file mode 100644
index 00000000000..30eac3a5e76
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS4_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS5_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS5_cert.png
new file mode 100644
index 00000000000..e2c00a8ec70
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS5_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS6_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS6_cert.png
new file mode 100644
index 00000000000..d2ccde826ed
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS6_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS7_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS7_cert.png
new file mode 100644
index 00000000000..f9c691c822e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS7_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/chromeOS8_cert.png b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS8_cert.png
new file mode 100644
index 00000000000..a58fdb79e7c
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/chromeOS8_cert.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/gcp-firewall.png b/products/cloudflare-one/src/content/static/documentation/connections/gcp-firewall.png
new file mode 100644
index 00000000000..3a5cdf15ece
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/gcp-firewall.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud-mac.png b/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud-mac.png
new file mode 100644
index 00000000000..d86c3fa540b
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud-mac.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud.png b/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud.png
new file mode 100644
index 00000000000..882d4c17478
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/jumpcloud.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/macOS_GatewayButton.png b/products/cloudflare-one/src/content/static/documentation/connections/macOS_GatewayButton.png
deleted file mode 100644
index 5bb261c6c34..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/connections/macOS_GatewayButton.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/macOS_TeamsButton.png b/products/cloudflare-one/src/content/static/documentation/connections/macOS_TeamsButton.png
deleted file mode 100644
index c1267aba54c..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/connections/macOS_TeamsButton.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/ssl-encryption-mode.png b/products/cloudflare-one/src/content/static/documentation/connections/ssl-encryption-mode.png
new file mode 100644
index 00000000000..14a0c218a3e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/ssl-encryption-mode.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/connections/windows_TeamsButton.png b/products/cloudflare-one/src/content/static/documentation/connections/windows_TeamsButton.png
deleted file mode 100644
index 7e8f0f593d2..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/connections/windows_TeamsButton.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/faq/google-error-400.png b/products/cloudflare-one/src/content/static/documentation/faq/google-error-400.png
new file mode 100644
index 00000000000..f40df1dc3fe
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/faq/google-error-400.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19-b.png b/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19-b.png
deleted file mode 100644
index 93cb8040f79..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19-b.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19.png b/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19.png
deleted file mode 100644
index cb10e1b3f67..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-19.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-20.png b/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-20.png
deleted file mode 100644
index 7f4b742fd1e..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/adfs/adfs-20.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/attribute-statements.png b/products/cloudflare-one/src/content/static/documentation/identity/attribute-statements.png
new file mode 100644
index 00000000000..1295e07c491
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/attribute-statements.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/attributes-cloudflare.png b/products/cloudflare-one/src/content/static/documentation/identity/attributes-cloudflare.png
new file mode 100644
index 00000000000..ecbfeede884
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/attributes-cloudflare.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/azure/add-azure.png b/products/cloudflare-one/src/content/static/documentation/identity/azure/add-azure.png
deleted file mode 100644
index 91b0e9d474b..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/azure/add-azure.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-5.png b/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-5.png
deleted file mode 100644
index dee546e4c87..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-5.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-7.png b/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-7.png
deleted file mode 100644
index 17cc6fac195..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/citrixadc/citrixadc-saml-7.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/devices/device-posture-client-ui.png b/products/cloudflare-one/src/content/static/documentation/identity/devices/device-posture-client-ui.png
new file mode 100644
index 00000000000..12119d3cbfb
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/devices/device-posture-client-ui.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/facebook/fb10.png b/products/cloudflare-one/src/content/static/documentation/identity/facebook/fb10.png
deleted file mode 100644
index ef9a9d47bd4..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/facebook/fb10.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-2.png b/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-2.png
deleted file mode 100644
index 2bcb1348e87..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-2.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-3.png b/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-3.png
deleted file mode 100644
index 07e19ae5818..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/generic-oidc-3.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/oidc.png b/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/oidc.png
deleted file mode 100644
index 9cd63cb2a42..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/generic-oidc/oidc.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/generic-saml-dashboard.png b/products/cloudflare-one/src/content/static/documentation/identity/generic-saml-dashboard.png
new file mode 100644
index 00000000000..bd129a895e1
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/generic-saml-dashboard.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/add-gsuite.png b/products/cloudflare-one/src/content/static/documentation/identity/gsuite/add-gsuite.png
deleted file mode 100644
index a2c7c3eaf59..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/add-gsuite.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/input-client.png b/products/cloudflare-one/src/content/static/documentation/identity/gsuite/input-client.png
deleted file mode 100644
index fda56f2a8a0..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/input-client.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/visit-link.png b/products/cloudflare-one/src/content/static/documentation/identity/gsuite/visit-link.png
deleted file mode 100644
index 312975aeeed..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/gsuite/visit-link.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/okta/Add_Okta_Cred_API_Token.png b/products/cloudflare-one/src/content/static/documentation/identity/okta/Add_Okta_Cred_API_Token.png
new file mode 100644
index 00000000000..57acb24cb15
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/okta/Add_Okta_Cred_API_Token.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/okta/add-okta.png b/products/cloudflare-one/src/content/static/documentation/identity/okta/add-okta.png
deleted file mode 100644
index 83eb9fdab18..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/identity/okta/add-okta.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/saml-assertion.png b/products/cloudflare-one/src/content/static/documentation/identity/saml-assertion.png
new file mode 100644
index 00000000000..5e081150c17
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/saml-assertion.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/identity/saml-attributes.png b/products/cloudflare-one/src/content/static/documentation/identity/saml-attributes.png
new file mode 100644
index 00000000000..5fb2dac6e96
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/identity/saml-attributes.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/cert-select-always-trust.png b/products/cloudflare-one/src/content/static/documentation/policies/cert-select-always-trust.png
deleted file mode 100644
index df8293aed2e..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/policies/cert-select-always-trust.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/customize-block-page.png b/products/cloudflare-one/src/content/static/documentation/policies/customize-block-page.png
new file mode 100644
index 00000000000..7c3e00c59b3
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/customize-block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/customize-settings-page.png b/products/cloudflare-one/src/content/static/documentation/policies/customize-settings-page.png
new file mode 100644
index 00000000000..c70ba3db460
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/customize-settings-page.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/display-block-page.png b/products/cloudflare-one/src/content/static/documentation/policies/display-block-page.png
new file mode 100644
index 00000000000..b4c1d753514
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/display-block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/enable-block-page.png b/products/cloudflare-one/src/content/static/documentation/policies/enable-block-page.png
deleted file mode 100644
index 097cd2e8e39..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/policies/enable-block-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/final-block-page.png b/products/cloudflare-one/src/content/static/documentation/policies/final-block-page.png
new file mode 100644
index 00000000000..2defe7dfaad
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/final-block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/http-block-page.png b/products/cloudflare-one/src/content/static/documentation/policies/http-block-page.png
new file mode 100644
index 00000000000..0d78dcf39f0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/http-block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/purpose-justification.png b/products/cloudflare-one/src/content/static/documentation/policies/purpose-justification.png
new file mode 100644
index 00000000000..9975e83907c
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/policies/purpose-justification.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/policies/update-certificates-page.png b/products/cloudflare-one/src/content/static/documentation/policies/update-certificates-page.png
deleted file mode 100644
index ee23ca3a628..00000000000
Binary files a/products/cloudflare-one/src/content/static/documentation/policies/update-certificates-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/documentation/rbi/cloudflare-one-browser-diagram-background.png b/products/cloudflare-one/src/content/static/documentation/rbi/cloudflare-one-browser-diagram-background.png
new file mode 100644
index 00000000000..cc41ee17c6f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/rbi/cloudflare-one-browser-diagram-background.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/shadow-it-app-profile.png b/products/cloudflare-one/src/content/static/documentation/shadow-it-app-profile.png
new file mode 100644
index 00000000000..200bf1a4bc6
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/shadow-it-app-profile.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/shadow-it-discovery.png b/products/cloudflare-one/src/content/static/documentation/shadow-it-discovery.png
new file mode 100644
index 00000000000..6eb5d1ba17c
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/shadow-it-discovery.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/shadow-it-view.png b/products/cloudflare-one/src/content/static/documentation/shadow-it-view.png
new file mode 100644
index 00000000000..a0e64b9cdfd
Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/shadow-it-view.png differ
diff --git a/products/cloudflare-one/src/content/static/documentation/teams-illustration.svg b/products/cloudflare-one/src/content/static/documentation/teams-illustration.svg
new file mode 100644
index 00000000000..ba44ff25023
--- /dev/null
+++ b/products/cloudflare-one/src/content/static/documentation/teams-illustration.svg
@@ -0,0 +1,408 @@
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 546 348">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: none;
+      }
+
+      .cls-12, .cls-2 {
+        fill: #0050e4;
+      }
+
+      .cls-3 {
+        fill: #b9e9f4;
+      }
+
+      .cls-4 {
+        fill: #6ecce5;
+      }
+
+      .cls-5 {
+        fill: #e2f5fa;
+      }
+
+      .cls-6 {
+        fill: #f8fbfb;
+      }
+
+      .cls-11, .cls-7 {
+        fill: #fff;
+      }
+
+      .cls-10, .cls-12, .cls-7 {
+        fill-rule: evenodd;
+      }
+
+      .cls-8 {
+        fill: #0050e5;
+      }
+
+      .cls-9 {
+        fill: #bbebf6;
+      }
+
+      .cls-10, .cls-24 {
+        fill: #bcecf7;
+      }
+
+      .cls-13 {
+        clip-path: url(#clip-path);
+      }
+
+      .cls-14 {
+        fill: #c3e9f3;
+      }
+
+      .cls-15 {
+        fill: #10377e;
+      }
+
+      .cls-16 {
+        fill: #0055da;
+      }
+
+      .cls-17 {
+        fill: #003681;
+      }
+
+      .cls-18 {
+        clip-path: url(#clip-path-2);
+      }
+
+      .cls-19 {
+        fill: #c9e7f1;
+      }
+
+      .cls-20 {
+        fill: #193979;
+      }
+
+      .cls-21 {
+        fill: #1b59d0;
+      }
+
+      .cls-22 {
+        clip-path: url(#clip-path-3);
+      }
+
+      .cls-23 {
+        fill: #003487;
+      }
+
+      .cls-25 {
+        clip-path: url(#clip-path-4);
+      }
+
+      .cls-26 {
+        fill: #ff5912;
+      }
+
+      .cls-27 {
+        fill: #fa1;
+      }
+
+      .cls-28 {
+        fill: #f6821f;
+      }
+
+      .cls-29 {
+        fill: #ddf5fa;
+      }
+    </style>
+    <clipPath id="clip-path">
+      <rect class="cls-1" x="263.39" y="175.22" width="45.48" height="34.37"/>
+    </clipPath>
+    <clipPath id="clip-path-2">
+      <rect class="cls-1" x="263.39" y="209.59" width="45.48" height="34.37"/>
+    </clipPath>
+    <clipPath id="clip-path-3">
+      <rect class="cls-1" x="263.39" y="243.95" width="45.48" height="34.37"/>
+    </clipPath>
+    <clipPath id="clip-path-4">
+      <rect class="cls-1" x="137.93" y="175.22" width="125.45" height="103.1"/>
+    </clipPath>
+  </defs>
+  <g>
+    <rect class="cls-2" y="270.86" width="545.28" height="1.46"/>
+    <g>
+      <path class="cls-3" d="M409.46,109.06c0-47-41.65-78.23-74.65-78.23-35.5,0-69.91,22.08-78.79,56.83-31.48-6.07-64.67,19.25-64.67,56.15,0,34.9,30.09,56.73,50,56.73H421.11c22.37,0,42.65-21.49,42.65-43.75C463.76,124.93,440.22,105.08,409.46,109.06Z"/>
+      <path class="cls-4" d="M386.77,116.15c0-34-30.11-56.55-54-56.55-25.67,0-50.54,16-57,41.09-22.76-4.4-46.76,13.91-46.76,40.59,0,25.23,21.76,41,36.16,41h130c16.17,0,30.84-15.54,30.84-31.63C426,127.63,409,113.28,386.77,116.15Z"/>
+      <path class="cls-5" d="M364,123.21c0-20.91-18.51-34.76-33.17-34.76-15.78,0-31.07,9.81-35,25.25-14-2.7-28.74,8.55-28.74,25,0,15.51,13.37,25.21,22.22,25.21h79.87c9.95,0,19-9.55,19-19.44C388.08,130.26,377.62,121.44,364,123.21Z"/>
+      <path class="cls-6" d="M350.06,127.71c0-13-11.48-21.57-20.58-21.57-9.79,0-19.28,6.09-21.73,15.67-8.67-1.67-17.83,5.31-17.83,15.49,0,9.62,8.3,15.64,13.79,15.64h49.56c6.17,0,11.77-5.93,11.77-12.07C365,132.09,358.54,126.62,350.06,127.71Z"/>
+    </g>
+    <g>
+      <g>
+        <g>
+          <path class="cls-5" d="M38,260.31H54.69q1.68-2,3.23-4.28c9.37-13.8,10.36-29.47,10.36-29.47S53.32,234.5,44,248.3Z"/>
+          <path class="cls-2" d="M55,261H36.86l6.48-13.15c9.37-13.79,24.45-21.89,24.6-22l1.15-.62L69,226.61c0,.15-1.11,16-10.49,29.83-1,1.46-2.09,2.92-3.27,4.34Zm-15.82-1.46H54.35c1.06-1.29,2.06-2.63,3-4,7.55-11.12,9.6-23.62,10.09-27.72-3.72,2.2-15.21,9.57-22.83,20.77Z"/>
+        </g>
+        <g>
+          <path class="cls-5" d="M33.19,250.93c-7-10.28-18.19-16-18.19-16a49.16,49.16,0,0,0,7.72,22c.77,1.13,1.58,2.19,2.41,3.19H37.54Z"/>
+          <path class="cls-2" d="M38.7,260.81H24.79l-.22-.26a40.66,40.66,0,0,1-2.45-3.25A49.31,49.31,0,0,1,14.27,235l-.08-1.28,1.14.59c.47.23,11.46,5.93,18.47,16.24l.05.1Zm-13.23-1.46H36.39l-3.83-8.05c-5.46-8-13.63-13.27-16.68-15.05a48.79,48.79,0,0,0,7.44,20.23C24,257.45,24.71,258.41,25.47,259.35Z"/>
+        </g>
+      </g>
+      <g>
+        <path class="cls-5" d="M46.83,260.31a49.29,49.29,0,0,0,1.75-12.72c0-13.69-8.3-24.79-8.3-24.79s-8.85,11.11-8.84,24.8c0,4.65,1.33,9,2.33,12.71H46.83Z"/>
+        <path class="cls-2" d="M47.39,261H33.21l-.45-1.68A44.6,44.6,0,0,1,30.7,247.6c0-13.79,8.64-24.79,9-25.25l.59-.74.57.76c.35.46,8.44,11.44,8.45,25.22a50.37,50.37,0,0,1-1.77,12.91Zm-13.06-1.46H46.27a48.33,48.33,0,0,0,1.58-12c0-11.19-5.74-20.74-7.59-23.53-2,2.76-8.1,12.33-8.09,23.54a43.27,43.27,0,0,0,2,11.37Z"/>
+      </g>
+      <g>
+        <path class="cls-3" d="M53.77,281H26c-3.53,0-6.39-2.57-6.39-5.74V259.74H60.16v15.48C60.16,278.39,57.3,281,53.77,281Z"/>
+        <path class="cls-2" d="M53.77,281.69H26c-3.92,0-7.12-2.9-7.12-6.47V259h42v16.21C60.89,278.79,57.7,281.69,53.77,281.69ZM20.36,260.47v14.75c0,2.76,2.53,5,5.65,5H53.77c3.12,0,5.66-2.25,5.66-5V260.47Z"/>
+      </g>
+    </g>
+    <g>
+      <g>
+        <g id="bottom">
+          <g>
+            <path id="Shape" class="cls-7" d="M356.55,306.7H91.35c-13.79,0-23.07-2.12-23.07-4.12v-6.12a1.23,1.23,0,0,1,1.35-1.09H378.29a1.24,1.24,0,0,1,1.35,1.09v6.11C379.63,304.15,372.44,306.7,356.55,306.7Z"/>
+            <path class="cls-8" d="M356.56,307.43H91.35c-9.57,0-23.8-1.3-23.8-4.85v-6.12a2,2,0,0,1,2.08-1.82H378.29a2,2,0,0,1,2.07,1.82v6.11C380.35,305.38,370.33,307.43,356.56,307.43ZM69.63,296.1c-.38,0-.62.21-.62.36v6.12c.25.95,7.25,3.39,22.34,3.39H356.56c15.87,0,22-2.57,22.35-3.45v-6.06c0-.15-.24-.36-.61-.36Z"/>
+          </g>
+        </g>
+        <path class="cls-9" d="M68.82,296.41v6.15H379.06v-6.15a.51.51,0,0,0-.51-.51H69.32A.51.51,0,0,0,68.82,296.41Z"/>
+        <g>
+          <path class="cls-10" d="M335.37,137.22H112.24A11.28,11.28,0,0,0,101,148.37V295.13H346.62V148.38A11.27,11.27,0,0,0,335.37,137.22Z"/>
+          <path class="cls-8" d="M347.35,295.86H100.27V148.37a11.94,11.94,0,0,1,12-11.88H335.37a11.94,11.94,0,0,1,12,11.89ZM101.73,294.4H345.89v-146A10.49,10.49,0,0,0,335.37,138H112.24a10.6,10.6,0,0,0-10.51,10.42Z"/>
+        </g>
+        <rect class="cls-11" x="110.88" y="154.99" width="225.41" height="131.37"/>
+        <circle id="webcam" class="cls-2" cx="223.8" cy="146.43" r="1.97"/>
+        <path id="touchpad" class="cls-12" d="M257.54,295.9v1.29c0,1-2,1.29-3.42,1.29H193.58c-1.55,0-3.52-.29-3.52-1.29V295.9Z"/>
+        <rect class="cls-2" x="110.88" y="154.99" width="225.41" height="10.23"/>
+        <circle class="cls-11" cx="118.86" cy="160.11" r="1.71"/>
+        <circle class="cls-11" cx="124.4" cy="160.11" r="1.71"/>
+        <circle class="cls-11" cx="129.94" cy="160.11" r="1.71"/>
+      </g>
+      <g>
+        <rect class="cls-5" x="137.93" y="175.22" width="125.45" height="103.1"/>
+        <path class="cls-8" d="M263.75,278.68H137.57V174.86H263.75ZM138.3,278H263V175.59H138.3Z"/>
+      </g>
+      <rect class="cls-6" x="263.39" y="175.22" width="45.48" height="103.1"/>
+      <g>
+        <g class="cls-13">
+          <g>
+            <g>
+              <path class="cls-14" d="M280.85,206.05a13.77,13.77,0,0,0,2.76-2V199l6.68.08v4.77c.3.59,1.45,1.32,3,2.18,0,0-2.86,4.26-6.45,4.26S280.85,206.05,280.85,206.05Z"/>
+              <path class="cls-15" d="M286.83,210.63c-3.76,0-6.19-4.22-6.29-4.4l-.18-.31.3-.18a14.61,14.61,0,0,0,2.59-1.85V198.6l7.4.09v5a10.09,10.09,0,0,0,2.81,2l.34.2-.22.32C293.46,206.38,290.57,210.63,286.83,210.63Zm-5.47-4.46c.61.93,2.69,3.73,5.47,3.73s5.18-2.82,5.91-3.78A7.52,7.52,0,0,1,290,204l0-.08v-4.5l-5.94-.07v4.85l-.11.1A12.55,12.55,0,0,1,281.36,206.17Z"/>
+            </g>
+            <g>
+              <path class="cls-16" d="M286.91,215.25a19.14,19.14,0,0,0,12.9-5,30,30,0,0,0-6.49-4.25s-2.9,4.23-6.49,4.23-6-4.17-6-4.17h0c-2.2,1.24-4.9,2.41-6.93,4.08A19.16,19.16,0,0,0,286.91,215.25Z"/>
+              <path class="cls-15" d="M286.91,215.61a19.53,19.53,0,0,1-13.25-5.17l-.31-.29.32-.26a28.53,28.53,0,0,1,5-3.08c.67-.35,1.33-.69,1.94-1l.32-.18.18.32s2.35,4,5.68,4,6.16-4,6.19-4.07l.17-.26.28.13a29.74,29.74,0,0,1,6.58,4.31l.3.27-.3.27A19.55,19.55,0,0,1,286.91,215.61Zm-12.44-5.43a18.85,18.85,0,0,0,24.79.1,29.78,29.78,0,0,0-5.83-3.78c-.71.94-3.34,4.13-6.6,4.13s-5.47-3.06-6.12-4l-1.66.88A30.06,30.06,0,0,0,274.47,210.18Z"/>
+            </g>
+            <g>
+              <g>
+                <path class="cls-17" d="M284.08,196.69c0,.13-.82.19-.84.31s.75.42.72.54-.84,0-.89.06.6.61.53.71-.79-.28-.87-.19.41.75.32.83-.68-.49-.79-.43.18.84.07.89-.51-.66-.63-.63-.06.86-.19.87-.3-.78-.42-.78-.31.8-.43.78-.07-.83-.19-.87-.52.68-.63.63.17-.82.07-.89-.69.51-.78.43.39-.74.31-.83-.8.29-.87.19.59-.6.54-.71-.86.05-.89-.06.73-.41.71-.54-.83-.18-.83-.31.82-.19.83-.31-.75-.41-.71-.53.84.05.89-.06-.61-.61-.54-.72.79.29.87.2-.4-.76-.31-.84.68.5.78.43-.18-.84-.07-.89.51.67.63.63.07-.85.19-.87.3.79.43.79.3-.81.42-.79.07.84.19.87.52-.68.63-.63-.17.83-.07.89.69-.51.79-.43-.4.75-.32.84.81-.3.87-.19-.58.6-.53.71.85-.06.89.06-.74.41-.72.53S284.08,196.57,284.08,196.69Z"/>
+                <path class="cls-17" d="M281.5,199.84c-.18,0-.26-.21-.37-.51l0-.11a.76.76,0,0,0,0,.11c-.13.32-.21.55-.41.51s-.23-.28-.26-.61c0,0,0-.07,0-.11s-.05.07-.06.09c-.21.28-.35.46-.54.37s-.15-.32-.08-.65l0-.11-.09.07c-.28.2-.46.34-.62.2s-.05-.34.11-.64l.05-.1-.1,0c-.33.12-.54.2-.65,0s0-.34.29-.59l.07-.07h-.1c-.35,0-.58,0-.64-.16s.14-.31.44-.48l.1-.06-.1,0c-.33-.07-.57-.13-.57-.34s.24-.26.57-.34l.1,0-.1-.05c-.3-.17-.5-.28-.44-.48s.3-.19.64-.17h.1l-.07-.08c-.25-.25-.41-.41-.29-.59s.33-.09.65,0l.1,0-.05-.09c-.16-.3-.27-.51-.11-.65s.34,0,.62.21l.09.06a.44.44,0,0,1,0-.1c-.08-.34-.12-.57.07-.66s.32.1.54.37a.47.47,0,0,0,.06.09s0-.07,0-.1c0-.34.05-.58.26-.61s.28.18.41.5a.49.49,0,0,0,0,.11,1,1,0,0,1,0-.1c.12-.33.21-.55.41-.51s.23.27.25.61a.31.31,0,0,1,0,.1l.07-.09c.21-.27.35-.45.54-.37s.14.33.07.66c0,0,0,.06,0,.1l.08-.06c.28-.21.47-.34.63-.21s.05.34-.12.65a.41.41,0,0,1-.05.09l.1,0c.33-.12.55-.2.66,0s-.05.33-.29.58l-.08.08h.11c.33,0,.57,0,.63.17s-.14.31-.44.48l-.09.05.1,0c.32.08.56.13.56.34s-.24.27-.56.34l-.1,0,.09.05c.3.17.5.28.44.48s-.28.19-.63.16h-.11l.08.07c.24.25.4.42.29.59s-.33.1-.66,0l-.1,0a.93.93,0,0,1,.05.1c.17.3.27.51.12.64s-.35,0-.63-.2l-.08-.07a.36.36,0,0,0,0,.11c.07.34.12.56-.07.65s-.33-.09-.54-.37l-.07-.09a.37.37,0,0,1,0,.11c0,.33,0,.58-.25.61Zm-1-1.25h.06c.17.05.2.23.22.5.1-.25.18-.42.35-.42s.25.17.34.42c0-.27.06-.45.22-.5s.28.09.45.3c-.06-.26-.08-.44.06-.53s.3,0,.52.16c-.13-.24-.2-.41-.09-.53s.28-.08.54,0c-.19-.2-.3-.34-.23-.49s.25-.16.52-.14c-.24-.13-.39-.24-.36-.4s.19-.22.47-.29c-.28-.06-.45-.11-.47-.28s.12-.27.36-.4c-.28,0-.45,0-.52-.14s0-.3.23-.49c-.25.09-.43.13-.54,0s0-.29.09-.53c-.22.16-.37.25-.52.16s-.12-.27-.06-.54c-.17.22-.29.35-.45.3s-.19-.22-.22-.49c-.09.25-.17.41-.34.41s-.25-.16-.35-.41c0,.27-.05.44-.21.49s-.29-.08-.45-.3c.05.27.07.45-.07.54s-.29,0-.51-.16c.12.24.19.4.08.53s-.28.08-.54,0c.19.19.3.33.23.48s-.23.16-.51.15c.23.13.38.23.36.4s-.19.22-.47.28c.28.07.44.12.47.29s-.13.27-.36.4c.26,0,.45,0,.51.14s0,.29-.23.49c.26-.09.43-.14.54,0s0,.29-.09.53c.22-.16.38-.25.52-.16s.12.27.07.53C280.22,198.72,280.33,198.59,280.46,198.59Z"/>
+              </g>
+              <g>
+                <path class="cls-17" d="M295.63,196.69c0,.13-.82.19-.84.31s.75.42.72.54-.84,0-.89.06.6.61.54.71-.8-.28-.88-.19.41.75.32.83-.68-.49-.79-.43.18.84.07.89-.51-.66-.63-.63-.06.86-.19.87-.3-.78-.42-.78-.31.8-.43.78-.07-.83-.18-.87-.52.68-.63.63.17-.82.06-.89-.69.51-.78.43.39-.74.31-.83-.8.29-.87.19.59-.6.54-.71-.86.05-.89-.06.73-.41.72-.54-.84-.18-.84-.31.82-.19.84-.31-.76-.41-.72-.53.84.05.89-.06-.6-.61-.54-.72.79.29.88.2-.41-.76-.32-.84.68.5.78.43-.18-.84-.06-.89.51.67.63.63.06-.85.18-.87.3.79.43.79.3-.81.43-.79.07.84.18.87.52-.68.63-.63-.17.83-.06.89.69-.51.78-.43-.4.75-.32.84.81-.3.88-.19-.59.6-.54.71.85-.06.89.06-.73.41-.72.53S295.63,196.57,295.63,196.69Z"/>
+                <path class="cls-17" d="M293.05,199.84c-.18,0-.25-.21-.37-.51,0,0,0-.07,0-.11a.76.76,0,0,0,0,.11c-.13.32-.21.55-.41.51s-.23-.28-.26-.61a.45.45,0,0,0,0-.11l-.06.09c-.21.28-.35.46-.54.37s-.14-.32-.07-.65a.52.52,0,0,1,0-.11l-.09.07c-.28.2-.46.34-.62.2s-.05-.34.11-.64a.31.31,0,0,0,.05-.1l-.1,0c-.32.12-.54.2-.65,0s0-.34.29-.59l.07-.07h-.1c-.35,0-.58,0-.64-.16s.14-.31.44-.48l.1-.06-.1,0c-.33-.07-.57-.13-.57-.34s.24-.26.57-.34l.1,0-.1-.05c-.3-.17-.5-.28-.44-.48s.31-.19.64-.17h.1l-.07-.08c-.24-.25-.41-.41-.29-.59s.33-.09.65,0l.1,0a.41.41,0,0,0-.05-.09c-.16-.31-.27-.51-.11-.65s.34,0,.62.21l.09.06a.44.44,0,0,1,0-.1c-.07-.34-.12-.57.07-.66s.33.1.54.37l.06.09a.38.38,0,0,0,0-.1c0-.34.05-.58.26-.61s.28.18.41.5a.49.49,0,0,0,0,.11s0-.07,0-.11c.12-.32.21-.54.41-.5s.23.26.26.61v.1l.07-.08c.21-.28.35-.46.54-.38s.14.33.07.66a.44.44,0,0,1,0,.1l.09-.06c.28-.21.46-.34.62-.21s0,.34-.11.65l-.06.09.11,0c.32-.12.54-.2.65,0s-.05.33-.29.58l-.08.08h.11c.33,0,.58,0,.64.17s-.14.31-.45.48l-.09.05.1,0c.33.08.57.13.57.34s-.24.27-.57.34l-.1,0,.09.05c.29.16.51.28.45.48s-.3.18-.64.16h-.11l.08.07c.24.25.4.42.29.59s-.33.1-.66,0l-.1,0,.05.1c.16.29.28.51.12.64s-.34,0-.62-.2l-.09-.07s0,.08,0,.11c.07.34.12.56-.07.65s-.33-.09-.54-.37l-.07-.09v.11c0,.33-.05.58-.26.61Zm-1-1.25h.07c.16.05.19.23.21.5.1-.25.18-.42.35-.42s.25.17.35.42c0-.27.05-.45.21-.5s.28.09.45.3c-.06-.26-.08-.44.07-.53s.29,0,.51.16c-.13-.24-.2-.41-.09-.53s.29-.08.54,0c-.19-.2-.3-.34-.23-.49s.25-.16.52-.14c-.24-.13-.38-.24-.36-.4s.2-.22.47-.29c-.28-.06-.45-.11-.47-.28s.12-.27.36-.4c-.28,0-.45,0-.52-.14s0-.3.23-.49c-.25.09-.43.13-.54,0s0-.29.09-.53c-.22.16-.37.25-.51.16s-.12-.27-.07-.54c-.17.22-.29.35-.45.3s-.19-.22-.21-.49c-.1.25-.18.41-.35.41s-.25-.16-.35-.41c0,.27-.05.44-.21.49s-.28-.08-.45-.3c.05.27.07.45-.07.54s-.29,0-.51-.16c.12.24.19.4.08.53s-.28.08-.54,0c.19.19.31.33.24.48s-.24.16-.52.15c.23.13.38.23.36.4s-.19.22-.47.28c.28.07.44.12.47.29s-.13.27-.36.4c.27,0,.45,0,.52.14s-.05.29-.24.49c.26-.09.44-.14.54,0s0,.29-.08.53c.22-.16.37-.25.51-.16s.12.27.07.53C291.77,198.72,291.88,198.59,292,198.59Z"/>
+              </g>
+              <g>
+                <path class="cls-14" d="M293.28,192.56a1.06,1.06,0,0,1,1.38-.73c.84.25.37,3.28-2,3.17A20.92,20.92,0,0,0,293.28,192.56Z"/>
+                <path class="cls-15" d="M292.81,195.37h-.13l-.48,0,.14-.45a21.94,21.94,0,0,0,.58-2.38h0a1.43,1.43,0,0,1,1.85-1c.5.15.74.8.6,1.61A2.63,2.63,0,0,1,292.81,195.37Zm.83-2.74c-.08.54-.29,1.38-.45,2a1.94,1.94,0,0,0,1.46-1.63c.09-.5,0-.78-.09-.8a.75.75,0,0,0-.61.06A.72.72,0,0,0,293.64,192.63Z"/>
+              </g>
+              <g>
+                <path class="cls-14" d="M280.54,192.56a1.08,1.08,0,0,0-1.42-.73c-.73.29-.37,3.28,2,3.17A18.39,18.39,0,0,1,280.54,192.56Z"/>
+                <path class="cls-15" d="M281,195.37a2.54,2.54,0,0,1-2.48-2.11c-.18-.85,0-1.58.5-1.77a1.32,1.32,0,0,1,1.18.06,1.52,1.52,0,0,1,.74.95v0a16.33,16.33,0,0,0,.53,2.37l.14.45-.48,0Zm-1.45-3.26a.85.85,0,0,0-.26,0,1.54,1.54,0,0,0,0,1.22,1.75,1.75,0,0,0,1.32,1.22,18.29,18.29,0,0,1-.42-2,.78.78,0,0,0-.37-.43A.67.67,0,0,0,279.51,192.11Z"/>
+              </g>
+              <g>
+                <path class="cls-14" d="M293.58,189.78a19.54,19.54,0,0,1-1.74,7.39c-.83,1.58-3,3.34-4.89,3.34s-3.85-1.76-4.89-3.34c-1.33-2-1.75-5.66-1.75-7.39a6.64,6.64,0,1,1,13.27,0Z"/>
+                <path class="cls-15" d="M287,200.87c-2.13,0-4.13-1.88-5.2-3.5-1.33-2-1.81-5.64-1.81-7.59a7,7,0,0,1,14,0,19.71,19.71,0,0,1-1.79,7.56C291.27,199,289,200.87,287,200.87Zm0-17.36a6.28,6.28,0,0,0-6.28,6.27c0,1.79.46,5.33,1.69,7.19,1,1.58,2.87,3.17,4.59,3.17s3.77-1.62,4.56-3.14a19.2,19.2,0,0,0,1.71-7.22A6.27,6.27,0,0,0,287,183.51Z"/>
+              </g>
+              <g>
+                <path class="cls-17" d="M293.24,192c-.31-2.64-2.87-6.15-5.72-6.15l-.48-2.18-.38,2.22c-2.52.38-5.82,3.49-6.12,6.65l-.11-.11a19,19,0,0,1-.24-2.79,6.65,6.65,0,0,1,6.76-6.52,6.74,6.74,0,0,1,6.75,6.64,14.09,14.09,0,0,1-.37,2.7Z"/>
+                <path class="cls-17" d="M280.54,192.69a.18.18,0,0,1-.13-.06l-.11-.11a.16.16,0,0,1-.05-.11,19.5,19.5,0,0,1-.24-2.81,6.94,6.94,0,0,1,13.87.12,13.68,13.68,0,0,1-.38,2.75c0,.08-.1.16-.18.13a.18.18,0,0,1-.18-.15l-.08-.46h0c-.39-3.31-3.35-6-5.54-6a.19.19,0,0,1-.19-.15l-.27-1.26-.22,1.29a.19.19,0,0,1-.16.15c-2.44.37-5.67,3.43-5.95,6.49a.19.19,0,0,1-.12.15Zm6.41-9.43a6.47,6.47,0,0,0-6.57,6.34,18.73,18.73,0,0,0,.13,2,8.71,8.71,0,0,1,6-5.92l.36-2.1a.19.19,0,0,1,.18-.15.18.18,0,0,1,.18.15l.44,2c2.64.11,5.11,3.1,5.68,5.79a11.88,11.88,0,0,0,.17-1.7A6.52,6.52,0,0,0,287,183.26Z"/>
+              </g>
+            </g>
+          </g>
+        </g>
+        <g class="cls-18">
+          <g>
+            <g>
+              <g>
+                <polygon class="cls-19" points="290 242.87 290 234.36 282.07 234.27 282.07 242.87 290 242.87"/>
+                <path class="cls-20" d="M290.36,243.24h-8.65V233.9l8.65.09Zm-7.92-.73h7.19v-7.79l-7.19-.08Z"/>
+              </g>
+              <g>
+                <g>
+                  <g>
+                    <path class="cls-11" d="M291.63,231.17a31.1,31.1,0,0,0,.79-3.64"/>
+                    <path class="cls-15" d="M291.63,231.35h0a.17.17,0,0,1-.14-.21c0-.14.09-.37.16-.65a21.8,21.8,0,0,0,.63-3,.18.18,0,0,1,.2-.17.18.18,0,0,1,.16.2,22,22,0,0,1-.63,3c-.08.27-.13.5-.16.64A.19.19,0,0,1,291.63,231.35Z"/>
+                  </g>
+                  <g>
+                    <path class="cls-19" d="M292.38,227.53c.06-.52.89-1.68,1.78-1.09s-.09,4.89-2.53,4.73"/>
+                    <path class="cls-20" d="M291.76,231.54h-.16l0-.73c1.12.06,1.88-1,2.23-2.07s.24-1.87.08-2a.51.51,0,0,0-.54-.05,1.45,1.45,0,0,0-.68.87l-.72-.09a2.09,2.09,0,0,1,1.1-1.44,1.23,1.23,0,0,1,1.24.1c.65.43.57,1.76.21,2.83C294.15,230.22,293.19,231.54,291.76,231.54Z"/>
+                  </g>
+                </g>
+                <g>
+                  <g>
+                    <path class="cls-11" d="M280.43,231.17a31.1,31.1,0,0,1-.79-3.64"/>
+                    <path class="cls-15" d="M280.43,231.52a.36.36,0,0,1-.34-.28c0-.14-.09-.36-.16-.63a22.32,22.32,0,0,1-.64-3.05.34.34,0,0,1,.32-.38.35.35,0,0,1,.38.31,20.38,20.38,0,0,0,.62,2.95c.07.28.13.51.16.65a.35.35,0,0,1-.26.42Z"/>
+                  </g>
+                  <g>
+                    <path class="cls-19" d="M279.68,227.53c-.06-.52-.89-1.68-1.78-1.09s.09,4.89,2.53,4.73"/>
+                    <path class="cls-20" d="M280.3,231.54c-1.43,0-2.39-1.32-2.81-2.57-.36-1.07-.44-2.4.2-2.83a1.25,1.25,0,0,1,1.25-.1,2.09,2.09,0,0,1,1.1,1.44l-.72.09a1.43,1.43,0,0,0-.68-.87.51.51,0,0,0-.54.05c-.17.11-.28.9.08,2s1.13,2.13,2.23,2.07l0,.73Z"/>
+                  </g>
+                </g>
+                <g>
+                  <path class="cls-19" d="M292.66,223.49A19,19,0,0,1,292,229c-.25.82-.55,3.35-.89,4-.87,1.65-3.09,3.49-5.12,3.49s-4-1.84-5.11-3.49c-.42-.63-.75-3.17-1-4a18.37,18.37,0,0,1-.51-5.46,6.64,6.64,0,1,1,13.26,0Z"/>
+                  <path class="cls-20" d="M286,236.82c-2.21,0-4.3-2-5.42-3.66a9.88,9.88,0,0,1-.75-2.73c-.11-.56-.21-1.09-.3-1.37A17.23,17.23,0,0,1,279,224v-.47a7,7,0,1,1,14,0,19.51,19.51,0,0,1-.64,5.56c-.09.32-.2.92-.32,1.56a12,12,0,0,1-.6,2.52C290.54,234.9,288.2,236.82,286,236.82Zm0-19.91a6.28,6.28,0,0,0-6.26,6.58V224a16.77,16.77,0,0,0,.49,4.88c.1.32.21.85.33,1.45a10.71,10.71,0,0,0,.64,2.47c1.1,1.66,3,3.33,4.81,3.33s4-1.71,4.8-3.3a14,14,0,0,0,.53-2.31c.12-.66.23-1.29.33-1.64a18.85,18.85,0,0,0,.61-5.35A6.29,6.29,0,0,0,286,216.91Z"/>
+                </g>
+              </g>
+              <g>
+                <path class="cls-21" d="M286,249.42a19.09,19.09,0,0,0,13.31-5.37c-3.35-2.64-7.89-3.08-9.32-4.46h0c-1.64,1.27-6,1.27-7.93,0-1.39,1-6,1.56-9.14,4.69A19.15,19.15,0,0,0,286,249.42Z"/>
+                <path class="cls-15" d="M286,249.79a19.53,19.53,0,0,1-13.33-5.24l-.28-.26.28-.27a17.4,17.4,0,0,1,6.92-3.77,10.22,10.22,0,0,0,2.25-.95l.21-.15.21.13c1.85,1.19,6,1.2,7.5,0l.1-.07h.27l.11.1a9.94,9.94,0,0,0,3.15,1.44,20.82,20.82,0,0,1,6.14,3l.33.26-.3.29A19.49,19.49,0,0,1,286,249.79Zm-12.54-5.52a18.8,18.8,0,0,0,25.28-.19,21.27,21.27,0,0,0-5.59-2.62,12.13,12.13,0,0,1-3.19-1.41c-1.84,1.16-5.79,1.15-7.89,0a13.18,13.18,0,0,1-2.24.92A17.42,17.42,0,0,0,273.47,244.27Z"/>
+              </g>
+            </g>
+            <g>
+              <path class="cls-15" d="M279.4,225.36c0-.72,0-1.37,0-1.87a6.64,6.64,0,1,1,13.26,0c0,.48,0,1.1,0,1.79h0l-1.82-1.42v-2.48h-9.65v2.48l-1.75,1.5Z"/>
+              <path class="cls-15" d="M279.4,225.73a.4.4,0,0,1-.15,0,.38.38,0,0,1-.22-.33c0-.51,0-1,0-1.41v-.47a7,7,0,1,1,14,0c0,.49,0,1.11,0,1.8a.37.37,0,0,1-.21.32.38.38,0,0,1-.38-.05l-1.81-1.42a.35.35,0,0,1-.14-.28v-2.12h-8.92v2.12a.37.37,0,0,1-.13.27l-1.75,1.51A.38.38,0,0,1,279.4,225.73Zm6.63-8.82a6.29,6.29,0,0,0-6.27,6.58V224c0,.2,0,.4,0,.62l1-.89v-2.31a.37.37,0,0,1,.36-.37h9.65a.37.37,0,0,1,.37.37v2.3l1.11.87c0-.4,0-.76,0-1.06A6.28,6.28,0,0,0,286,216.91Z"/>
+            </g>
+          </g>
+        </g>
+        <g class="cls-22">
+          <g>
+            <path class="cls-21" d="M292,260.25a15.49,15.49,0,0,1-.48-2.74,20.45,20.45,0,0,1-10.35-2.82l.19-.23a19.94,19.94,0,0,0,10.28,2.74l.15,0v.15a17.36,17.36,0,0,0,.47,2.79Z"/>
+            <g>
+              <path class="cls-23" d="M272.4,277.28a4.7,4.7,0,0,1-.42-2.18c.07-2.09,5.37-3.71,5.37-4.89s-2.63-3.82-2.63-5.76,3.37-3.63,3.37-7.41c0-6.47,6.56-6.32,7.16-6.32,7.12,0,8,5.54,8.71,6.58.4.62,2.46,1,2.46,2.88s-1.56,2.81-1.79,4.27.27,2.35,2.78,3.74c3.59,2,3.13,7.51-2,8.64,0,0-5.52-2.2-6.64-3.93v-5.12l-7.17-.08v5.43c-1.6,1.74-6.28,3.92-8.33,5.06Z"/>
+              <path class="cls-23" d="M273.24,278.64l-1.17-1.21a5.21,5.21,0,0,1-.46-2.34c.05-1.39,1.85-2.46,3.44-3.42.77-.46,1.94-1.16,1.94-1.46a6,6,0,0,0-1-2c-.75-1.19-1.61-2.54-1.61-3.74a4.77,4.77,0,0,1,1.34-2.68,7.54,7.54,0,0,0,2-4.74,6.33,6.33,0,0,1,1.72-4.66,8.21,8.21,0,0,1,5.73-2h0c6.28,0,8,4.22,8.72,6a5,5,0,0,0,.33.73,2.49,2.49,0,0,0,.63.46,3.08,3.08,0,0,1,1.89,2.62,4.84,4.84,0,0,1-1,2.72,4.33,4.33,0,0,0-.77,1.61c-.19,1.25.13,2,2.6,3.36a4.82,4.82,0,0,1,2.47,4.92,5.41,5.41,0,0,1-4.54,4.39l-.11,0-.11,0c-.23-.09-5.64-2.27-6.81-4.08l-.06-.09v-4.86l-6.43-.07v5.21l-.1.1c-1.28,1.39-4.42,3-6.72,4.23-.65.34-1.24.64-1.7.9Zm-.54-1.58.67.68,1.48-.78c2.18-1.14,5.16-2.69,6.42-4v-5.66l7.89.09v5.36c1,1.3,4.76,3,6.31,3.67a4.7,4.7,0,0,0,3.87-3.77,4.08,4.08,0,0,0-2.11-4.17c-2.5-1.39-3.22-2.39-3-4.11a4.87,4.87,0,0,1,.88-1.9,4.09,4.09,0,0,0,.91-2.32c0-1.07-.82-1.56-1.54-2a2.75,2.75,0,0,1-.87-.68,6,6,0,0,1-.39-.85c-.73-1.81-2.26-5.57-8-5.57h0a7.67,7.67,0,0,0-5.25,1.8,5.64,5.64,0,0,0-1.51,4.15,8.24,8.24,0,0,1-2.18,5.18,4.4,4.4,0,0,0-1.19,2.24,7.73,7.73,0,0,0,1.5,3.35,5.85,5.85,0,0,1,1.13,2.41c0,.72-1,1.29-2.3,2.09s-3,1.83-3.08,2.81A4.47,4.47,0,0,0,272.7,277.06Z"/>
+            </g>
+            <g>
+              <path class="cls-24" d="M278.66,275.33a14.7,14.7,0,0,0,2.95-2.15v-5.44l7.17.09v5.11c.33.64,1.56,1.42,3.21,2.34a15,15,0,0,1-6.92,1.82A12.14,12.14,0,0,1,278.66,275.33Z"/>
+              <path class="cls-23" d="M285.07,277.46a12.39,12.39,0,0,1-6.62-1.83l-.47-.32.49-.29a15.16,15.16,0,0,0,2.78-2v-5.66l7.89.1v5.37a10.66,10.66,0,0,0,3,2.12l.55.31-.55.33A15.29,15.29,0,0,1,285.07,277.46Zm-5.7-2.13a12.41,12.41,0,0,0,5.7,1.4,14.78,14.78,0,0,0,6.15-1.46,7.53,7.53,0,0,1-2.77-2.16l0-.08v-4.84l-6.43-.08v5.22l-.1.1A13.31,13.31,0,0,1,279.37,275.33Z"/>
+            </g>
+            <g>
+              <path class="cls-8" d="M285.86,282.86a19.15,19.15,0,0,0,11.87-4.11,34.39,34.39,0,0,0-5.68-3.48,15.17,15.17,0,0,1-7,1.84,12.2,12.2,0,0,1-6.43-1.78h0c-1.66.93-3.57,1.82-5.32,2.89A19.13,19.13,0,0,0,285.86,282.86Z"/>
+              <path class="cls-23" d="M285.86,283.23a19.55,19.55,0,0,1-12.76-4.74l-.38-.32.43-.26c1.05-.64,2.15-1.22,3.22-1.77.73-.38,1.44-.75,2.11-1.13l.19-.11.19.13a12,12,0,0,0,6.23,1.71,14.91,14.91,0,0,0,6.77-1.78l.17-.1.17.08a35,35,0,0,1,5.75,3.52l.37.29L298,279A19.36,19.36,0,0,1,285.86,283.23Zm-11.89-5a18.83,18.83,0,0,0,11.89,4.23,18.64,18.64,0,0,0,11.26-3.75,35.34,35.34,0,0,0-5.06-3.07,15.45,15.45,0,0,1-7,1.79,12.91,12.91,0,0,1-6.45-1.71c-.61.34-1.26.68-1.92,1C275.81,277.25,274.87,277.74,274,278.27Z"/>
+            </g>
+            <g>
+              <g>
+                <path class="cls-24" d="M292.33,257.84a21,21,0,0,1-1.87,7.92c-.89,1.7-3.17,3.58-5.25,3.58s-4.12-1.88-5.24-3.58c-1.43-2.15-1.88-6.07-1.88-7.92a7.12,7.12,0,0,1,14.24,0Z"/>
+                <path class="cls-23" d="M285.21,269.71c-2.26,0-4.41-2-5.55-3.75-1.42-2.14-1.93-6-1.93-8.12a7.49,7.49,0,1,1,15,0,21.21,21.21,0,0,1-1.92,8.09C289.83,267.75,287.43,269.71,285.21,269.71Zm0-18.63a6.76,6.76,0,0,0-6.75,6.76c0,2,.48,5.71,1.81,7.72,1.13,1.7,3.09,3.42,4.94,3.42s4.07-1.75,4.93-3.39a20.67,20.67,0,0,0,1.83-7.75A6.76,6.76,0,0,0,285.21,251.08Z"/>
+              </g>
+              <g>
+                <path class="cls-23" d="M292.12,260.18a18.69,18.69,0,0,1-.49-2.83,20.15,20.15,0,0,1-10.38-2.77s-1.33,5.2-2.91,6.24h0a20.45,20.45,0,0,1-.25-3,7.12,7.12,0,0,1,14.24,0,16.2,16.2,0,0,1-.21,2.34Z"/>
+                <path class="cls-23" d="M278.2,261.15l0-.3a21,21,0,0,1-.26-3,7.31,7.31,0,1,1,14.62,0,16.21,16.21,0,0,1-.21,2.37l-.1.6-.26-.55a15.22,15.22,0,0,1-.49-2.71,21,21,0,0,1-10.1-2.66c-.3,1.1-1.49,5.15-2.91,6.09Zm7-10.24a6.93,6.93,0,0,0-6.93,6.93,21.38,21.38,0,0,0,.2,2.62c1.4-1.33,2.57-5.88,2.58-5.93l.07-.28.23.17a19.6,19.6,0,0,0,10.26,2.74l.18,0,0,.18c0,.39.14,1.17.25,1.81a12.75,12.75,0,0,0,.07-1.29A6.93,6.93,0,0,0,285.21,250.91Z"/>
+              </g>
+              <g>
+                <path class="cls-24" d="M292,260.82a1.13,1.13,0,0,1,1.48-.79c.9.27.39,3.52-2.11,3.41A26.11,26.11,0,0,0,292,260.82Z"/>
+                <path class="cls-23" d="M291.51,263.8h-.15l-.48,0,.15-.45a25.49,25.49,0,0,0,.62-2.56h0a1.5,1.5,0,0,1,.68-.94,1.53,1.53,0,0,1,1.27-.14c.52.16.77.84.63,1.7A2.76,2.76,0,0,1,291.51,263.8Zm.86-2.92a20.26,20.26,0,0,1-.5,2.16,2.13,2.13,0,0,0,1.64-1.78c.09-.56-.05-.86-.13-.88a.77.77,0,0,0-.67.06A.79.79,0,0,0,292.37,260.88Z"/>
+              </g>
+              <g>
+                <path class="cls-24" d="M278.34,260.82a1.17,1.17,0,0,0-1.53-.79c-.78.32-.39,3.52,2.12,3.41A20.83,20.83,0,0,1,278.34,260.82Z"/>
+                <path class="cls-23" d="M278.8,263.8a2.69,2.69,0,0,1-2.64-2.23c-.2-.9,0-1.67.52-1.88a1.39,1.39,0,0,1,1.24.07,1.58,1.58,0,0,1,.78,1v0a18.25,18.25,0,0,0,.57,2.55l.14.45-.48,0Zm-1.57-3.49a.74.74,0,0,0-.28.06,1.49,1.49,0,0,0,0,1.22,2,2,0,0,0,1.52,1.46,22,22,0,0,1-.46-2.17.92.92,0,0,0-.41-.48A.69.69,0,0,0,277.23,260.31Z"/>
+              </g>
+            </g>
+          </g>
+        </g>
+        <path class="cls-8" d="M309.23,278.68H263V243.59h46.21ZM263.75,278H308.5V244.32H263.75Z"/>
+        <path class="cls-8" d="M309.23,244.32H263v-35.1h46.21Zm-45.48-.73H308.5V210H263.75Z"/>
+        <path class="cls-8" d="M309.23,210H263V174.86h46.21Zm-45.48-.73H308.5V175.59H263.75Z"/>
+      </g>
+      <g class="cls-25">
+        <g>
+          <g>
+            <path class="cls-14" d="M239,278.94c-11.65-6.19-24.56-7.85-27-13.5-1.82-4.27,0-18.59,0-18.59l-28.15-.29s1.78,14.51,0,18.88c-2.16,5.31-13.89,7-24.66,13"/>
+            <path class="cls-15" d="M238.8,279.28a105.11,105.11,0,0,0-13.44-5.65c-6.79-2.48-12.16-4.43-13.7-8-1.68-3.95-.37-15.89-.08-18.36L184.3,247c.29,2.5,1.57,14.6-.08,18.64-1.37,3.39-6.26,5.29-12.44,7.7a96.13,96.13,0,0,0-12.38,5.53l-.37-.68a98.28,98.28,0,0,1,12.47-5.58c6-2.34,10.76-4.18,12-7.26,1.72-4.23,0-18.55,0-18.7l0-.44,29,.31-.06.43c0,.14-1.78,14.26,0,18.39,1.4,3.3,6.63,5.2,13.25,7.61a107,107,0,0,1,13.53,5.7Z"/>
+          </g>
+          <g>
+            <path class="cls-16" d="M199.36,293.67A60.49,60.49,0,0,0,239,278.94c-11.65-6.19-24.56-7.85-27-13.5a12.67,12.67,0,0,1-.71-3.69,72.77,72.77,0,0,1-13.38,1.44,72.63,72.63,0,0,1-13.38-1.44,12.93,12.93,0,0,1-.68,3.69c-2.16,5.31-13.89,7-24.65,13A60.43,60.43,0,0,0,199.36,293.67Z"/>
+            <path class="cls-17" d="M199.36,294.06A61,61,0,0,1,159,278.78l-.42-.37.48-.27a97.6,97.6,0,0,1,12.48-5.58c6-2.34,10.75-4.19,12-7.26a12.68,12.68,0,0,0,.66-3.58l0-.45.45.1a73.22,73.22,0,0,0,13.29,1.43,73.54,73.54,0,0,0,13.3-1.43l.44-.1,0,.45a12.07,12.07,0,0,0,.68,3.57c1.4,3.29,6.63,5.2,13.25,7.61a104.88,104.88,0,0,1,13.53,5.69l.51.27-.44.38A61.1,61.1,0,0,1,199.36,294.06ZM159.9,278.55a60.26,60.26,0,0,0,78.38.47,107.69,107.69,0,0,0-12.92-5.38c-6.8-2.48-12.17-4.44-13.7-8a11.67,11.67,0,0,1-.7-3.38,73.06,73.06,0,0,1-13,1.36,72.91,72.91,0,0,1-13-1.36,12.11,12.11,0,0,1-.68,3.37c-1.38,3.39-6.26,5.29-12.45,7.7A100.22,100.22,0,0,0,159.9,278.55Z"/>
+          </g>
+          <g>
+            <g>
+              <path class="cls-14" d="M176.7,221.73c-.22-1.81-2.91-5.08-6.09-3s-.13,17.34,8.55,16.77"/>
+              <path class="cls-15" d="M178.71,235.92c-3.79,0-7-3-8.74-8.06-1.24-3.68-1.42-8.22.42-9.44a3.84,3.84,0,0,1,3.88-.38,5.22,5.22,0,0,1,2.82,3.65l-.77.09a4.43,4.43,0,0,0-2.38-3,3.06,3.06,0,0,0-3.12.33c-1.3.86-1.36,4.85-.12,8.55.62,1.85,3.06,7.85,8.44,7.51l.05.77Z"/>
+            </g>
+            <g>
+              <path class="cls-14" d="M219.29,221.73c.22-1.81,2.91-5.08,6.09-3s.12,17.34-8.55,16.77"/>
+              <path class="cls-15" d="M217.28,235.92l-.48,0,0-.77c5.36.34,7.82-5.66,8.44-7.51,1.24-3.7,1.18-7.69-.12-8.55a3.06,3.06,0,0,0-3.12-.33,4.43,4.43,0,0,0-2.38,3l-.77-.09a5.22,5.22,0,0,1,2.82-3.65,3.84,3.84,0,0,1,3.88.38c1.84,1.22,1.66,5.76.42,9.44C224.31,233,221.07,235.92,217.28,235.92Z"/>
+            </g>
+            <g>
+              <path class="cls-14" d="M219.83,211.09a63.11,63.11,0,0,1-2,17.78c-.83,2.93-1.81,11.92-2.94,14.25-2.83,5.88-10.12,12.41-16.75,12.41S185,249,181.36,243.13c-1.36-2.25-2.45-11.26-3.3-14.25-2-6.94-1.65-13.3-1.65-17.79,0-13.62,9.14-22.69,21.7-22.69S219.83,197.47,219.83,211.09Z"/>
+              <path class="cls-15" d="M198.12,255.92c-6.94,0-13.54-6.78-17.09-12.59-.91-1.5-1.67-5.69-2.34-9.38-.36-2-.7-3.9-1-5-1.75-6.17-1.7-12-1.67-16.22,0-.58,0-1.14,0-1.67,0-13.58,9.08-23.07,22.09-23.07s22.11,9.49,22.11,23.07a63.18,63.18,0,0,1-2,17.88c-.33,1.17-.69,3.35-1.07,5.65-.59,3.56-1.19,7.23-1.89,8.67C212.29,249.37,204.92,255.92,198.12,255.92Zm0-67.13c-12.55,0-21.32,9.17-21.32,22.3,0,.54,0,1.09,0,1.67a54.44,54.44,0,0,0,1.65,16c.31,1.1.66,3,1,5,.63,3.45,1.41,7.74,2.24,9.11,3.71,6.09,10.23,12.23,16.43,12.23s13.57-6.31,16.41-12.19c.64-1.34,1.27-5.13,1.82-8.46.38-2.33.74-4.53,1.08-5.74a62.23,62.23,0,0,0,2-17.67C219.45,198,210.67,188.79,198.11,188.79Z"/>
+            </g>
+            <g>
+              <path class="cls-17" d="M216,208.22s-22.44,2.11-32.68-5.27c0,0-3,12.57-6.63,18.78,0,0-4.49-19.07,2.05-21.6,0,0-.54-10.59,11.13-13.3,0,0-.6,2.64,1.36,2.56s17.5-9,28.59-2,2.58,17.24,2.58,17.24.3,10.82-2.37,15.39l-1,3.1S216.26,213.29,216,208.22Z"/>
+              <path class="cls-17" d="M219.07,223.37h0a.29.29,0,0,1-.27-.2c0-.1-2.71-9.52-3-14.64-2.65.2-22.53,1.51-32.23-5.11-.55,2.21-3.31,12.91-6.56,18.46a.3.3,0,0,1-.29.14.29.29,0,0,1-.23-.22c-.19-.78-4.39-19,2-21.86,0-1.51.49-10.86,11.36-13.39a.29.29,0,0,1,.34.34,2.64,2.64,0,0,0,.22,1.91,1,1,0,0,0,.84.31,15.55,15.55,0,0,0,2.54-.88c5.15-2,17.21-6.8,26.22-1.11,3.32,2.09,5.24,4.68,5.72,7.7.77,4.89-2.47,9.21-3,9.88,0,1.2.16,11-2.42,15.43l-.94,3A.29.29,0,0,1,219.07,223.37ZM216,207.93a.32.32,0,0,1,.19.07.27.27,0,0,1,.09.2c.21,4.08,2.1,11.32,2.79,13.88l.69-2.17c2.62-4.51,2.36-15.19,2.36-15.3a.26.26,0,0,1,.06-.19s3.73-4.56,2.94-9.51c-.45-2.85-2.28-5.31-5.45-7.31-8.77-5.54-20.21-1-25.71,1.16a13.51,13.51,0,0,1-2.72.92,1.52,1.52,0,0,1-1.31-.52,2.78,2.78,0,0,1-.41-1.95C178.66,190,179,199.7,179,200.11a.28.28,0,0,1-.19.28c-5.52,2.14-2.76,17.06-2,20.55,3.41-6.29,6.2-17.94,6.23-18.06a.28.28,0,0,1,.18-.2.32.32,0,0,1,.27,0c10,7.24,32.26,5.25,32.48,5.22Z"/>
+            </g>
+          </g>
+        </g>
+      </g>
+    </g>
+    <g>
+      <g>
+        <g>
+          <g>
+            <path class="cls-24" d="M394.7,320.9h-63a4.38,4.38,0,0,1-4.38-4.38v-124a4.38,4.38,0,0,1,4.38-4.38h63a4.37,4.37,0,0,1,4.38,4.38v124A4.39,4.39,0,0,1,394.7,320.9Z"/>
+            <path class="cls-8" d="M394.7,321.63h-63a5.11,5.11,0,0,1-5.11-5.11v-124a5.11,5.11,0,0,1,5.11-5.11h63a5.11,5.11,0,0,1,5.11,5.11v124A5.11,5.11,0,0,1,394.7,321.63Zm-63-132.79a3.66,3.66,0,0,0-3.65,3.65v124a3.66,3.66,0,0,0,3.65,3.65h63a3.66,3.66,0,0,0,3.66-3.65v-124a3.65,3.65,0,0,0-3.65-3.65Z"/>
+          </g>
+          <path class="cls-2" d="M394.7,321.75h-63a5.23,5.23,0,0,1-5.23-5.23v-124a5.23,5.23,0,0,1,5.23-5.23h63a5.23,5.23,0,0,1,5.23,5.23v124A5.24,5.24,0,0,1,394.7,321.75ZM331.69,189a3.53,3.53,0,0,0-3.53,3.53v124a3.53,3.53,0,0,0,3.53,3.53h63a3.54,3.54,0,0,0,3.54-3.53v-124a3.54,3.54,0,0,0-3.54-3.53Z"/>
+        </g>
+        <rect class="cls-11" x="331.43" y="200.54" width="63.53" height="111.08"/>
+        <g>
+          <path class="cls-21" d="M368.47,196.05H356.65a.88.88,0,0,1-.88-.89h0a.88.88,0,0,1,.88-.88h11.82a.89.89,0,0,1,.89.88h0A.9.9,0,0,1,368.47,196.05Z"/>
+          <circle class="cls-21" cx="352.41" cy="195.15" r="1.51"/>
+        </g>
+      </g>
+      <g>
+        <circle class="cls-11" cx="363.1" cy="255.22" r="23.29"/>
+        <path class="cls-26" d="M363.1,279.24a24,24,0,1,1,24-24A24,24,0,0,1,363.1,279.24Zm0-46.57a22.56,22.56,0,1,0,22.56,22.55A22.58,22.58,0,0,0,363.1,232.67Z"/>
+      </g>
+      <g>
+        <path class="cls-27" d="M353.41,244l-.54-.85c5.32-3.38,13.94-3.37,19.21,0l-.54.84C366.56,240.77,358.43,240.77,353.41,244Z"/>
+        <path class="cls-28" d="M349.77,251.66l-.85-.54a16.55,16.55,0,0,1,27.28,0l-.86.52A15.59,15.59,0,0,0,362.42,245,15.75,15.75,0,0,0,349.77,251.66Z"/>
+        <path class="cls-26" d="M367,269.87a12.44,12.44,0,0,1-6-3.32,9.51,9.51,0,0,1-3.06-6.76c0-3.34,2.16-5,4.16-5.11a4,4,0,0,1,4.23,3.82,3.84,3.84,0,0,0,1.43,2.86,4.06,4.06,0,0,0,2.92.46l.08,0c.11,0,2.59-.29,2.36-3.93a10.24,10.24,0,0,0-10.67-9.44,10.66,10.66,0,0,0-9.17,4.69,12.44,12.44,0,0,0-1,11.55l-.94.38a13.49,13.49,0,0,1,1.14-12.49,11.63,11.63,0,0,1,10-5.14,11.24,11.24,0,0,1,11.68,10.39c.26,4.33-2.79,4.93-3.23,5a5,5,0,0,1-3.7-.61,4.73,4.73,0,0,1-1.87-3.57,3,3,0,0,0-3.18-2.93c-1.59.09-3.2,1.39-3.2,4.1,0,4.84,4.79,8.39,8.25,9.09Z"/>
+        <path class="cls-28" d="M359,269.18a11.3,11.3,0,0,1-4.39-12.53c1.1-3.56,3.88-5.76,7.25-5.76,6.19,0,8.39,4.68,8.39,8.68h-1c0-1.28-.36-7.68-7.39-7.68-3,0-5.31,1.89-6.29,5.05a10.28,10.28,0,0,0,4,11.41Z"/>
+        <path class="cls-27" d="M370.69,266.89a9.7,9.7,0,0,1-6.73-2.44,7.81,7.81,0,0,1-2.33-5.85h1a6.76,6.76,0,0,0,2,5.12,8.9,8.9,0,0,0,6.57,2.15l0,1Z"/>
+      </g>
+    </g>
+    <g>
+      <g>
+        <g>
+          <path class="cls-29" d="M526.59,216l-20.2-9a81.16,81.16,0,0,0,6.6-23l17.48,7.83h0A47.27,47.27,0,0,1,526.59,216Z"/>
+          <path class="cls-11" d="M506.39,207l20.2,9a47.14,47.14,0,0,1-15.48,19.05h0l-17.49-7.82c1.39-1.59,2.75-3.29,4.06-5.09A85.37,85.37,0,0,0,506.39,207Z"/>
+          <path class="cls-11" d="M530.48,191.82h0L513,184c1.79-14.72-1.78-26.76-10.32-30.58A47.41,47.41,0,0,1,530.48,191.82Z"/>
+          <path class="cls-29" d="M493.62,227.27l17.49,7.82A47.39,47.39,0,0,1,464,240C472.49,243.78,483.85,238.42,493.62,227.27Z"/>
+          <path class="cls-11" d="M506.39,207l-23.08-10.33L493,175.05,513,184A81.16,81.16,0,0,1,506.39,207Z"/>
+          <path class="cls-29" d="M483.31,196.68,506.39,207a85.37,85.37,0,0,1-8.71,15.17c-1.31,1.8-2.67,3.5-4.06,5.09l-20-9Z"/>
+          <path class="cls-29" d="M513,184l-20-8.94,9.68-21.64C511.21,157.23,514.78,169.27,513,184Z"/>
+          <path class="cls-11" d="M473.63,218.32l20,9C483.85,238.42,472.49,243.78,464,240Z"/>
+          <path class="cls-29" d="M473.63,218.32,464,240c-8.54-3.82-12.11-15.86-10.31-30.58Z"/>
+          <path class="cls-11" d="M483.31,196.68l-9.68,21.64-20-8.94a81.22,81.22,0,0,1,6.59-23Z"/>
+          <path class="cls-29" d="M493,175.05l-9.68,21.63-23.08-10.32A81.67,81.67,0,0,1,473,166.1Z"/>
+          <path class="cls-11" d="M502.67,153.41,493,175.05l-20-9C482.77,155,494.12,149.59,502.67,153.41Z"/>
+          <path class="cls-29" d="M502.67,153.41c-8.55-3.82-19.9,1.54-29.68,12.69l-17.48-7.82A47.36,47.36,0,0,1,502.67,153.41Z"/>
+          <path class="cls-11" d="M453.64,209.38c-1.8,14.72,1.77,26.76,10.31,30.58a47.4,47.4,0,0,1-27.81-38.41Z"/>
+          <path class="cls-29" d="M453.64,209.38l-17.5-7.83a47.23,47.23,0,0,1,3.9-24.23l20.19,9A81.22,81.22,0,0,0,453.64,209.38Z"/>
+          <path class="cls-11" d="M455.51,158.28,473,166.1a81.67,81.67,0,0,0-12.76,20.26l-20.19-9A47.14,47.14,0,0,1,455.51,158.28Z"/>
+        </g>
+        <g>
+          <path class="cls-2" d="M483.27,244.8a48,48,0,1,1,28.27-9.11l-.85-1.19a46.7,46.7,0,1,0-46.44,4.79,46.68,46.68,0,0,0,46.44-4.79l.86,1.18A48.26,48.26,0,0,1,483.27,244.8Z"/>
+          <path class="cls-2" d="M469.79,241.89a14.81,14.81,0,0,1-6.14-1.27c-8.52-3.81-12.63-15.81-10.74-31.33a85.64,85.64,0,0,1,19.54-43.67c10.31-11.75,22-16.69,30.52-12.88s12.63,15.82,10.74,31.34a82.35,82.35,0,0,1-6.65,23.23,85.63,85.63,0,0,1-8.79,15.3c-1.31,1.79-2.69,3.52-4.1,5.14C486.17,236.88,477.33,241.89,469.79,241.89Zm27-89c-7.1,0-15.54,4.85-23.27,13.65a84.25,84.25,0,0,0-19.18,42.89c-1.81,14.85,2,26.28,9.89,29.82s19-1.25,28.82-12.5c1.39-1.58,2.74-3.28,4-5h0a83.09,83.09,0,0,0,8.64-15,80.54,80.54,0,0,0,6.54-22.8c1.81-14.87-2-26.3-9.89-29.83A13.34,13.34,0,0,0,496.81,152.93Z"/>
+          <rect class="cls-2" x="482.58" y="149.28" width="1.46" height="94.82" transform="translate(106.4 557.53) rotate(-65.9)"/>
+          <rect class="cls-2" x="435.9" y="195.95" width="94.82" height="1.46" transform="translate(106.5 557.64) rotate(-65.91)"/>
+          <rect class="cls-2" x="492.26" y="133.98" width="1.46" height="82.13" transform="translate(131.88 553.57) rotate(-65.9)"/>
+          <polygon class="cls-2" points="510.83 235.76 435.85 202.22 436.44 200.89 511.41 234.43 510.83 235.76"/>
+        </g>
+      </g>
+      <g>
+        <g>
+          <rect class="cls-5" x="465.78" y="254.24" width="7.23" height="29.36" transform="translate(938.78 537.84) rotate(-180)"/>
+          <path class="cls-8" d="M473.73,284.33h-8.68V253.51h8.68Zm-7.22-1.46h5.76V255h-5.76Z"/>
+        </g>
+        <g>
+          <path class="cls-5" d="M503.35,145,459.61,246a18.52,18.52,0,0,0,2.06,1,55.12,55.12,0,0,0,43.8-101.16,19.36,19.36,0,0,0-2.12-.82l2.61-6c.73.31,1.41.51,2.13.82a61.7,61.7,0,0,1-49,113.24,17.71,17.71,0,0,1-2.06-1ZM457,252m49-113.07"/>
+          <path class="cls-8" d="M483.49,258.79a62,62,0,0,1-24.72-5.14,20.87,20.87,0,0,1-2.14-1l-.56-.33,3.2-7.39.7.41a21.43,21.43,0,0,0,2,1,54.39,54.39,0,1,0,43.22-99.82,19.67,19.67,0,0,0-2.05-.79l-.78-.24,3.23-7.46.67.29c.35.15.69.27,1,.4s.72.26,1.1.42a62.43,62.43,0,0,1-24.89,119.72Zm-25.56-7.12c.45.22.9.41,1.39.63A61,61,0,1,0,507.8,140.41c-.35-.15-.69-.27-1-.39l-.42-.16-2,4.66c.49.19.95.39,1.43.6a55.84,55.84,0,1,1-44.38,102.49c-.48-.21-.94-.41-1.41-.64Z"/>
+        </g>
+        <g>
+          <rect class="cls-5" x="465.78" y="259.29" width="7.23" height="56.9" transform="translate(181.65 757.13) rotate(-90)"/>
+          <path class="cls-8" d="M498.57,292.08H440.21V283.4h58.36Zm-56.9-1.46h55.44v-5.76H441.67Z"/>
+        </g>
+        <g>
+          <rect class="cls-5" x="465.78" y="261.87" width="7.23" height="37.91" transform="translate(188.56 750.21) rotate(-90)"/>
+          <path class="cls-8" d="M489.07,285.17H449.7v-8.69h39.37Zm-37.91-1.46h36.45v-5.77H451.16Z"/>
+        </g>
+      </g>
+    </g>
+  </g>
+</svg>
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/add-rule-sam.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/add-rule-sam.png
deleted file mode 100644
index 1ef958ca197..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/add-rule-sam.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/after-block-espn.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/after-block-espn.png
new file mode 100644
index 00000000000..a235dffde5e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/after-block-espn.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/allow-cf-users.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/allow-cf-users.png
new file mode 100644
index 00000000000..087fd0810aa
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/allow-cf-users.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-action.png
new file mode 100644
index 00000000000..9ad5b8a3417
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb-url.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb-url.png
deleted file mode 100644
index 016d9bb5dae..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb-url.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb.png
new file mode 100644
index 00000000000..c3385dc431b
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-cfb.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-action.png
new file mode 100644
index 00000000000..e09dec2d777
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host-sam.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host-sam.png
deleted file mode 100644
index 863ebed694b..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host-sam.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host.png
deleted file mode 100644
index 11629ab8fc2..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-host.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-sam.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-sam.png
new file mode 100644
index 00000000000..fb31c2d58fb
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn-sam.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn.png
new file mode 100644
index 00000000000..493a388c2c6
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-espn.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-log.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-log.png
index 8d14154b23a..437d5fca2a8 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-log.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-log.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-page.png
deleted file mode 100644
index 298c6a0d12d..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/block-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-add-rule.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-add-rule.png
new file mode 100644
index 00000000000..d2ebb155011
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-add-rule.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-settings.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-settings.png
new file mode 100644
index 00000000000..f8256d11fa1
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/device-enrollment-settings.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/enable-proxy-decrypt.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/enable-proxy-decrypt.png
new file mode 100644
index 00000000000..7ee8c5e1ff0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/enable-proxy-decrypt.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/expand-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/expand-list.png
new file mode 100644
index 00000000000..100d8aee69a
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/expand-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/policy-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/policy-start.png
new file mode 100644
index 00000000000..cde0f6b9de7
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/policy-start.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-cfb.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-cfb.png
deleted file mode 100644
index 8925194af91..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-cfb.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn-sam.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn-sam.png
deleted file mode 100644
index c00c0aab48a..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn-sam.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn.png
deleted file mode 100644
index e98643b7b5f..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/post-espn.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/saved-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/saved-list.png
new file mode 100644
index 00000000000..af9f4614dbc
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/saved-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/warp-mode.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/warp-mode.png
new file mode 100644
index 00000000000..a25277c736e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/warp-mode.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/with-warp.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/with-warp.png
deleted file mode 100644
index bd3a9fa8106..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-football/with-warp.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/add-tld-block.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/add-tld-block.png
deleted file mode 100644
index 1a45ebdd374..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/add-tld-block.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-action.png
new file mode 100644
index 00000000000..33a3cf048df
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-fail.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-fail.png
new file mode 100644
index 00000000000..8db55aad6ea
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/block-fail.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/custom.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/custom.png
deleted file mode 100644
index daea6b98db3..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/custom.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/dashboard.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/dashboard.png
deleted file mode 100644
index c798d463ebf..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/dashboard.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/policies.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/policies.png
index 96d24c509c4..d1edb34b8ec 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/policies.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/policies.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-filter.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-filter.png
new file mode 100644
index 00000000000..791aa159344
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-filter.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-start.png
new file mode 100644
index 00000000000..033540247a7
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-tld/review-logs-start.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/add-http-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/add-http-policy.png
index bf77ba4f31b..28327133585 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/add-http-policy.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/add-http-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-action.png
new file mode 100644
index 00000000000..598b3a63da5
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-first.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-first.png
index 1b0e918282f..044119449a3 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-first.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-first.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-last.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-last.png
new file mode 100644
index 00000000000..3f7ba7265ae
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-last.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-users.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-users.png
new file mode 100644
index 00000000000..f23cb1786d8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/allow-users.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-action.png
new file mode 100644
index 00000000000..a7812eca7c8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-gateway-logs.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-gateway-logs.png
deleted file mode 100644
index 2de143781cc..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/block-gateway-logs.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/drive-allow.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/drive-allow.png
deleted file mode 100644
index d218d64b696..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/drive-allow.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/filter-toggle.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/filter-toggle.png
deleted file mode 100644
index 3f6e374b212..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/filter-toggle.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/http-rule-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/http-rule-list.png
deleted file mode 100644
index 5dd8d25018a..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/http-rule-list.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/name-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/name-policy.png
new file mode 100644
index 00000000000..6337944a9b4
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/name-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/select-google-drive.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/select-google-drive.png
index c24d2a58935..73a1daaaeb1 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/select-google-drive.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/select-google-drive.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/upload-mime-type.png b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/upload-mime-type.png
index bc14ff02c51..b8c45b263b8 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/upload-mime-type.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/block-uploads/upload-mime-type.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/block-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/block-page.png
new file mode 100644
index 00000000000..28e083c9066
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/custom-text.png b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/custom-text.png
new file mode 100644
index 00000000000..bd32bebb1f3
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/custom-text.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/edit-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/edit-page.png
new file mode 100644
index 00000000000..c734ae1ec17
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/edit-page.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/general-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/general-list.png
new file mode 100644
index 00000000000..da40611277f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/general-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/rule-order.png b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/rule-order.png
new file mode 100644
index 00000000000..92d2409b436
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/custom-block/rule-order.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/do-not-selected.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/do-not-selected.png
deleted file mode 100644
index db34e383832..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/do-not-selected.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/name-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/name-policy.png
new file mode 100644
index 00000000000..8b3cb220ab3
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/name-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rule-precedence.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rule-precedence.png
deleted file mode 100644
index 3a27a81fc76..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rule-precedence.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-first.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-first.png
new file mode 100644
index 00000000000..eb1d090ef72
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-first.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-last.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-last.png
new file mode 100644
index 00000000000..e2b7fcea95b
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/rules-last.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-action.png
index 47dfac317c1..e674415a2b3 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-action.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-do-not.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-do-not.png
deleted file mode 100644
index 5c11dfad428..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-do-not.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-microsoft.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-microsoft.png
new file mode 100644
index 00000000000..f7e6c566501
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/select-microsoft.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/starter-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/starter-list.png
index dc84d109d40..50330d2f44d 100644
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/starter-list.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/exempt-cert-pinning/starter-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/edit-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/edit-list.png
new file mode 100644
index 00000000000..a74615d64bf
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/edit-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-edit.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-edit.png
deleted file mode 100644
index 1e748c04459..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-edit.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-save.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-save.png
deleted file mode 100644
index 5b42f0e7ab9..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/list-save.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/lists.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/lists.png
new file mode 100644
index 00000000000..e17e37ffd52
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/gateway-list/lists.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/choose-name.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/choose-name.png
deleted file mode 100644
index 1c0aa0f3bb4..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/choose-name.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/confirm-free.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/confirm-free.png
deleted file mode 100644
index f2d477d7333..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/confirm-free.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-create-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-create-policy.png
deleted file mode 100644
index 3be0dff9b20..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-create-policy.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-download.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-download.png
deleted file mode 100644
index 6d60040c21e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-download.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-empty.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-empty.png
deleted file mode 100644
index d6bb0c9edb9..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-empty.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-name.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-name.png
deleted file mode 100644
index faa21e446b4..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-name.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-view.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-view.png
deleted file mode 100644
index b1cb0db6840..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/device-view.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-add-ip.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-add-ip.png
deleted file mode 100644
index 88f8e397174..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-add-ip.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-location-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-location-list.png
deleted file mode 100644
index 3fdb77b3da0..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-location-list.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-overview.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-overview.png
deleted file mode 100644
index a6fd4ead209..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-overview.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-start.png
deleted file mode 100644
index 402afd1202c..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-start.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-sec-rules.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-sec-rules.png
deleted file mode 100644
index 06793245b60..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-sec-rules.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-setup-location-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-setup-location-start.png
deleted file mode 100644
index 70b07cd7d40..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/dns-filter-setup-location-start.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/free-bundle.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/free-bundle.png
deleted file mode 100644
index 923e99ec18c..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/free-bundle.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-added-security.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-added-security.png
deleted file mode 100644
index b6dbb5642f0..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-added-security.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-all-rules.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-all-rules.png
deleted file mode 100644
index 657cb69b93e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-all-rules.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-block-social.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-block-social.png
deleted file mode 100644
index 3fa64ce13cf..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-block-social.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-create.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-create.png
deleted file mode 100644
index 46bfa496bb9..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-create.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-default.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-default.png
deleted file mode 100644
index a45faecd1dd..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-default.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-no-settings.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-no-settings.png
deleted file mode 100644
index 23d7b9f2381..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-no-settings.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-security.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-security.png
deleted file mode 100644
index fd7fb3891de..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-security.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-inspect.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-inspect.png
deleted file mode 100644
index 9f8d624f0aa..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-inspect.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-on.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-on.png
deleted file mode 100644
index d2a66106823..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-on.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-user-security.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-user-security.png
deleted file mode 100644
index 4b66c7be253..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/http-user-security.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-add-user.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-add-user.png
deleted file mode 100644
index ff4c7ef0bb0..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-add-user.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-create.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-create.png
deleted file mode 100644
index 03df10f7f8e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-create.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-list.png
deleted file mode 100644
index c253141805f..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/list-list.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/pick-teams-onboard.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/pick-teams-onboard.png
deleted file mode 100644
index d31a1f66306..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/pick-teams-onboard.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/quick-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/quick-start.png
deleted file mode 100644
index be8d2220b1a..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/quick-start.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/user-view.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/user-view.png
deleted file mode 100644
index ec62accdb0e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/user-view.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct-name.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct-name.png
deleted file mode 100644
index 0c2c321a88d..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct-name.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct.png
deleted file mode 100644
index e99d56990e5..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-acct.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-enroll.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-enroll.png
deleted file mode 100644
index 9e658053c6a..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-enroll.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-post-enroll.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-post-enroll.png
deleted file mode 100644
index a23d0ffe01c..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-post-enroll.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-pref.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-pref.png
deleted file mode 100644
index 3353a693d86..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-pref.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-start.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-start.png
deleted file mode 100644
index 1897d51ea6e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-start.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-doh.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-doh.png
deleted file mode 100644
index f3ee118d875..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-doh.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-gateway.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-gateway.png
deleted file mode 100644
index ba47dccee1e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/warp-with-gateway.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/welcome-to-teams.png b/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/welcome-to-teams.png
deleted file mode 100644
index a1e444b6f44..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/gw-rollout-guide/welcome-to-teams.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/id-dns/rule-order.png b/products/cloudflare-one/src/content/static/secure-web-gateway/id-dns/rule-order.png
new file mode 100644
index 00000000000..92d2409b436
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/id-dns/rule-order.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png
new file mode 100644
index 00000000000..ffe5ac55502
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png
new file mode 100644
index 00000000000..2e19eeaedae
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png
new file mode 100644
index 00000000000..c9ee8e47a73
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png
new file mode 100644
index 00000000000..90ac7731293
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/after-order.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/after-order.png
new file mode 100644
index 00000000000..603291d26f7
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/after-order.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/allow-rule.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/allow-rule.png
new file mode 100644
index 00000000000..3a41d221306
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/allow-rule.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/before-order.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/before-order.png
new file mode 100644
index 00000000000..d9157f857b2
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/before-order.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/block-social.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/block-social.png
new file mode 100644
index 00000000000..bd94f1e0e32
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/block-social.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked-expand.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked-expand.png
new file mode 100644
index 00000000000..7d63a49544e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked-expand.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked.png
new file mode 100644
index 00000000000..fe9dfd737b0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocked.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocks-filter.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocks-filter.png
deleted file mode 100644
index b73b09d4b6a..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/blocks-filter.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/custom.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/custom.png
deleted file mode 100644
index ad6f871e83e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/custom.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-radar.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-radar.png
new file mode 100644
index 00000000000..6190a98c4b1
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-radar.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-row.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-row.png
deleted file mode 100644
index 3b73b4beaaa..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/facebook-row.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-page.png
new file mode 100644
index 00000000000..5d8ad562d33
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-page.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-unfiltered.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-unfiltered.png
deleted file mode 100644
index 89c1c1ec97e..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/logs-unfiltered.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/override.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/override.png
deleted file mode 100644
index 93352bd8f33..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/override.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/policies.png b/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/policies.png
deleted file mode 100644
index 58980b38b7d..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/review-gateway-block/policies.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/account-view.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/account-view.png
old mode 100755
new mode 100644
index a566d7cb005..47ca43acff5
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/account-view.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/account-view.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/add-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/add-policy.png
deleted file mode 100755
index d507918abfa..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/add-policy.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/apply-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/apply-policy.png
deleted file mode 100755
index 054288c70da..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/apply-policy.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-rules.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-rules.png
deleted file mode 100755
index 65c596c4403..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-rules.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-threats.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-threats.png
new file mode 100644
index 00000000000..47724cf4432
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/block-threats.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/device-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/device-page.png
deleted file mode 100755
index 723a157e947..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/device-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/dns-rule-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/dns-rule-list.png
new file mode 100644
index 00000000000..2329482a405
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/dns-rule-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-mode.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-mode.png
new file mode 100644
index 00000000000..959aae7fd7f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-mode.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-subdomain.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-subdomain.png
deleted file mode 100755
index 133872c0497..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/doh-subdomain.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/enroll-rule.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/enroll-rule.png
deleted file mode 100755
index df0a851bf10..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/enroll-rule.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/login.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/login.png
new file mode 100644
index 00000000000..ed50453a495
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/login.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/name-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/name-policy.png
new file mode 100644
index 00000000000..76faff7b48f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/name-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/org-name.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/org-name.png
old mode 100755
new mode 100644
index bd6ba57509b..a6cbb69cd4a
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/org-name.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/org-name.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-device-rules.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-device-rules.png
new file mode 100644
index 00000000000..223349773a4
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-device-rules.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-dns-block.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-dns-block.png
new file mode 100644
index 00000000000..5fe213e0338
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/save-dns-block.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/start-filtering.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/start-filtering.png
new file mode 100644
index 00000000000..34115fb9572
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/start-filtering.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-mode.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-mode.png
new file mode 100644
index 00000000000..f2390986e00
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-mode.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-name.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-name.png
new file mode 100644
index 00000000000..f04a72e9548
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/team-name.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/warp.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/warp.png
old mode 100755
new mode 100644
index 0c614050403..b8480fe3e11
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/warp.png and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/warp.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/with-doh.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/with-doh.png
deleted file mode 100755
index f6c5c332b10..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-devices/with-doh.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-action.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-action.png
new file mode 100644
index 00000000000..f733c6f1e85
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-action.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-threats.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-threats.png
new file mode 100644
index 00000000000..92cefdf35ad
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/block-threats.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/create-dns-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/create-dns-policy.png
new file mode 100644
index 00000000000..23331a55827
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/create-dns-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/dns-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/dns-list.png
new file mode 100644
index 00000000000..da69a8f8ac8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/dns-list.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png
new file mode 100644
index 00000000000..cb4581b1150
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/include-location.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/include-location.png
new file mode 100644
index 00000000000..14fd8c1075f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/include-location.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/name-dns-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/name-dns-policy.png
new file mode 100644
index 00000000000..0048ac74670
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/name-dns-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/rule-listed.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/rule-listed.png
new file mode 100644
index 00000000000..b8e81523247
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/rule-listed.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/save-dns-block.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/save-dns-block.png
new file mode 100644
index 00000000000..73ac62f4a66
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/save-dns-block.png differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/settings-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/settings-page.png
deleted file mode 100644
index fedd3a8374f..00000000000
Binary files a/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/settings-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/split-tunnel-entries.png b/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/split-tunnel-entries.png
new file mode 100644
index 00000000000..8ca42596059
Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/split-tunnel/split-tunnel-entries.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-application.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-application.png
new file mode 100644
index 00000000000..55fb79e949a
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-application.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-cloudflare-metadata.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-cloudflare-metadata.png
new file mode 100644
index 00000000000..51e575280c8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-cloudflare-metadata.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-metadata.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-metadata.png
new file mode 100644
index 00000000000..849d64375f0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-metadata.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-portal.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-portal.png
new file mode 100644
index 00000000000..e97a4518544
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-portal.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-settings.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-settings.png
new file mode 100644
index 00000000000..88450dca5a8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-settings.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-sso-search.png b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-sso-search.png
new file mode 100644
index 00000000000..905cd0e0186
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/aws-sso-saas/aws-sso-search.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-save-list.png b/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-save-list.png
deleted file mode 100644
index 503c93b4c02..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-save-list.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-saved.png b/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-saved.png
new file mode 100644
index 00000000000..744512b033d
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-saved.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-start.png b/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-start.png
deleted file mode 100644
index a7a8f3eacd4..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/corp-device/list-start.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ssh/enable-websockets.png b/products/cloudflare-one/src/content/static/zero-trust-security/ssh/enable-websockets.png
new file mode 100644
index 00000000000..315b9f34e4a
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ssh/enable-websockets.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-new-rule.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-new-rule.png
new file mode 100644
index 00000000000..83e8d18fe76
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-new-rule.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-rule.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-rule.png
deleted file mode 100644
index 35c8db56b7e..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/add-rule.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launch-page.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launch-page.png
deleted file mode 100644
index 3e2f59c8a8d..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launch-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launcher-rules.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launcher-rules.png
new file mode 100644
index 00000000000..b1e0dd0d4ed
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/app-launcher-rules.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/auth-page.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/auth-page.png
deleted file mode 100644
index f140b560df3..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/auth-page.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/save-app.png b/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/save-app.png
deleted file mode 100644
index 27807b6c000..00000000000
Binary files a/products/cloudflare-one/src/content/static/zero-trust-security/user-diagnostics/save-app.png and /dev/null differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-domain-application.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-domain-application.png
new file mode 100644
index 00000000000..27060172062
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-domain-application.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-login-screen.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-login-screen.png
new file mode 100644
index 00000000000..3f9acc05945
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-login-screen.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-password.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-password.png
new file mode 100644
index 00000000000..93645e31eef
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-password.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-policy.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-policy.png
new file mode 100644
index 00000000000..e9841b35163
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-rfbport.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-rfbport.png
new file mode 100644
index 00000000000..47113e2211e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-rfbport.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-run-tunnel.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-run-tunnel.png
new file mode 100644
index 00000000000..9377502c8f5
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-run-tunnel.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server-password.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server-password.png
new file mode 100644
index 00000000000..e3ed15ed862
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server-password.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server.png
new file mode 100644
index 00000000000..ffdd552c55f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-server.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-xstartup.png b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-xstartup.png
new file mode 100644
index 00000000000..34c00adc163
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/vnc-client-in-browser/vnc-xstartup.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-attributes.png b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-attributes.png
new file mode 100644
index 00000000000..029f49cec0e
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-attributes.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-external-auth.png b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-external-auth.png
new file mode 100644
index 00000000000..497de86997b
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-external-auth.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-fingerprint.png b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-fingerprint.png
new file mode 100644
index 00000000000..e58ad14933c
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-fingerprint.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-policy.png b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-policy.png
new file mode 100644
index 00000000000..184e570ebcf
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-saas-app.png b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-saas-app.png
new file mode 100644
index 00000000000..38879122686
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/zendesk-sso-saas/zendesk-saas-app.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/create-network-policy.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/create-network-policy.png
new file mode 100644
index 00000000000..a52715181f0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/create-network-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/device-enrollment-rules.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/device-enrollment-rules.png
new file mode 100644
index 00000000000..ff9bf7c3884
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/device-enrollment-rules.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/first-network-policy.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/first-network-policy.png
new file mode 100644
index 00000000000..4a42082c2f0
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/first-network-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/run-tunnel.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/run-tunnel.png
new file mode 100644
index 00000000000..df14838b5d8
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/run-tunnel.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/second-network-policy.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/second-network-policy.png
new file mode 100644
index 00000000000..51f6d247835
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/second-network-policy.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/split-tunnels.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/split-tunnels.png
new file mode 100644
index 00000000000..310ced26d05
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/split-tunnels.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/tunnel-id.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/tunnel-id.png
new file mode 100644
index 00000000000..9567756286f
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/tunnel-id.png differ
diff --git a/products/cloudflare-one/src/content/static/zero-trust-security/ztna/warp-preferences.png b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/warp-preferences.png
new file mode 100644
index 00000000000..6aa6d74dbbe
Binary files /dev/null and b/products/cloudflare-one/src/content/static/zero-trust-security/ztna/warp-preferences.png differ
diff --git a/products/cloudflare-one/src/content/teams-docs-changes.md b/products/cloudflare-one/src/content/teams-docs-changes.md
index e5b733a516e..f4fa58d9b0f 100644
--- a/products/cloudflare-one/src/content/teams-docs-changes.md
+++ b/products/cloudflare-one/src/content/teams-docs-changes.md
@@ -2,6 +2,7 @@
 order: 0
 title: "Welcome"
 hidden: true
+pcx-content-type: reference
 ---
 
 # What's new?
@@ -11,7 +12,7 @@ Welcome to the brand new **Cloudflare for Teams documentation**.
 Starting on **February 8, 2021**, this space will replace the separate, independent documentation for:
 * **Cloudflare Access**
 * **Cloudflare Gateway**
-* **Argo Tunnel**
+* **Cloudflare Tunnel**
 * **WARP client for Teams**
 
 
diff --git a/products/cloudflare-one/src/content/technical-limitations.md b/products/cloudflare-one/src/content/technical-limitations.md
index 395923ca524..7e836bf611a 100644
--- a/products/cloudflare-one/src/content/technical-limitations.md
+++ b/products/cloudflare-one/src/content/technical-limitations.md
@@ -1,29 +1,33 @@
 ---
 order: 20
+pcx-content-type: reference
 ---
 
 # Technical limitations
 
-This lists covers limitations for rules, applications, fields, and other features. 
+This lists covers limitations for rules, applications, fields, and other features.
 
 All values are per organization.
 
 <TableWrap>
 
 | Feature | Limit |
-| ------- | ----- | 
+| ------- | ----- |
 | Applications count | 500 |
-| Group size | 1000 | 
 | Email addresses per rule | 1000 |
 | IP addresses per rule | 1000 |
 | Application name length (characters) | 350 |
+| Group count | 300 |
 | Group name length (characters) | 350 |
+| Group size | 1000 |
 | mTLS root certificates count | 50 |
-| Service Tokens count | 50 |
 | mTLS certificates name length (characters) | 350 |
+| Service Tokens count | 500 |
 | Service Token name length | 350 |
 | IdP count | 50 |
 | IdP name length (characters) | 350 |
+| Rules count per application | 1000 |
+| Rules count per group | 1000 |
 | Application URL length (characters) | <= 63 |
 | Team Domain max length (characters) | <= 63 |
 | Lists: total number of lists | 100 |
@@ -35,15 +39,14 @@ All values are per organization.
 
 </TableWrap>
 
-## Argo Tunnel limitations
+## Cloudflare Tunnel limitations
 
 All values are per account.
 
 <TableWrap>
 
 | Feature | Limit |
-| ------- | ----- | 
-| Number of concurrently running Tunnels | 1000 |
+| ------- | ----- |
+| Replicas per Tunnel | 100 |
 
 </TableWrap>
-
diff --git a/products/cloudflare-one/src/content/tutorials/aws-sso-saas.md b/products/cloudflare-one/src/content/tutorials/aws-sso-saas.md
new file mode 100644
index 00000000000..f127969430c
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/aws-sso-saas.md
@@ -0,0 +1,112 @@
+---
+updated: 2021-08-03
+category: 🔐 Zero Trust
+difficulty: Intermediate
+pcx-content-type: tutorial
+---
+
+# Configure AWS SSO with Access for SaaS
+
+In this tutorial we will configure AWS SSO with Access for SaaS. Cloudflare Access for SaaS allows you to layer additional network and device posture policies on top of existing identity authentication from your identity provider. In this example, we are using Okta as an identity provider, but any supported identity provider can be leveraged.
+
+<Aside>
+
+For this tutorial, you will need:
+    
+* A Cloudflare for Teams account
+* An integrated IdP
+* Admin access to an AWS account
+
+</Aside>
+
+**⏲️ Time to complete:**
+
+20 minutes
+
+## Configure AWS
+
+1. In the AWS admin panel, search for `SSO`.
+
+    ![AWS SSO](../static/zero-trust-security/aws-sso-saas/aws-sso-search.png)
+
+1. Add **AWS Single Sign** on to your AWS account.
+
+1. Click **Choose an identity source**.
+
+1. Change the identity source to **External Identity provider**.
+
+1. Click **Show individual metadata values**. These will be the fields that are added to the Cloudflare Access for SaaS app.
+
+    ![AWS metadata](../static/zero-trust-security/aws-sso-saas/aws-metadata.png)
+
+1. Copy the **AWS SSO ACS URL**.
+
+## Configure Cloudflare
+
+1. In a separate tab or window, open the [Cloudflare for Teams Dashboard](https://dash.teams.cloudflare.com) and navigate to **Access** > **Applications**.
+
+1. Select *SaaS* as the application type to begin creating a SaaS application.
+
+1. Copy the following fields from your AWS account and input them in the Cloudflare for Teams application configuration:
+
+    | AWS value | Cloudflare value |
+    | ----- | ---- |
+    | **AWS SSO ACS URL** | **Assertion Consumer Service URL** |
+    | **AWS SSO Issuer URL** | **Entity ID** |
+
+    The **Name ID Format** must be set to: Email.
+
+    ![AWS application](../static/zero-trust-security/aws-sso-saas/aws-application.png)
+
+1. (Optional) Additional Attribute Statements can be passed from your IdP to AWS SSO. More information about AWS Attribute mapping can be found at [Attribute mappings - AWS Single Sign-On](https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappingsconcept.html#supportedidpattributes).
+
+1. Copy the Cloudflare IdP metadata values and save them for the Final AWS configuration:
+
+    ![AWS Cloudflare metadata](../static/zero-trust-security/aws-sso-saas/aws-cloudflare-metadata.png)
+
+1. Click **Next**.
+
+1. Now create a [Zero Trust policy](/policies/zero-trust) to determine who has access to your application.
+
+1. Save your policy and return to the AWS SSO dashboard.
+
+## Complete the AWS configuration
+
+1. Paste the Cloudflare IdP metadata into your AWS account with these mappings:
+
+    | Cloudflare value | AWS value |
+    | ----- | ---- |
+    | **SSO Endpoint** | **IdP Sign-in URL** |
+    | **Access Entity ID** | **IdP Issuer URL** |
+    | **Public Key** | **IdP Certificate** |
+
+    <Aside>
+
+    The Public key must be transformed into a fingerprint. To do that:
+    1. Copy the Public Key Value.
+    1. Paste the Public Key into VIM or another code editor.
+    1. Wrap the value in `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.
+    1. Set the file extension to `.crt` and save.
+
+    </Aside>
+
+1. Click **Next: Review**.
+
+1. Set Provisioning to *Manual*.
+
+    ![AWS settings](../static/zero-trust-security/aws-sso-saas/aws-settings.png)
+
+    <Aside type='Warning' header='Important'>
+
+    Access for SaaS does not currently support System for Cross-domain Identity Management (SCIM). Please make sure that:
+    1. Users are created in both your identity provider and AWS
+    1. Users have matching usernames in your identity provider and AWS.
+    1. Usernames are email addresses. This is the only format AWS supports with third-party SSO providers.
+
+    </Aside>
+
+## Test your connection
+
+User should now be able to successfully log in. To test your connection, open the user portal URL.
+
+![AWS portal](../static/zero-trust-security/aws-sso-saas/aws-portal.png)
diff --git a/products/cloudflare-one/src/content/tutorials/block-football-users.md b/products/cloudflare-one/src/content/tutorials/block-football-users.md
index ee7ab0d3cea..29f690c35bd 100644
--- a/products/cloudflare-one/src/content/tutorials/block-football-users.md
+++ b/products/cloudflare-one/src/content/tutorials/block-football-users.md
@@ -2,6 +2,7 @@
 updated: 2020-12-20
 category: 🛡️ Web Gateway
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Block sites for specific users
@@ -10,99 +11,117 @@ You can use Cloudflare Gateway and the Cloudflare WARP client application to blo
 
 **🗺️ This tutorial covers how to:**
 
+* Create a Gateway policy to block URLs that contain a hostname for a specific set of users
 * Enroll devices into Gateway
-* Create a Gateway policy to block URLs that contain a hostname for certain users
 * Review the block events in the Gateway logs
 
 **⏲️Time to complete:**
 
-25 minutes
+35 minutes
 
-## Add Cloudflare Gateway
+## Before you start
+1. [Add Gateway to your account](/setup)
 
-Before you begin, you'll need to follow [these instructions](/setup) to set up Cloudflare Gateway in your account. Cloudflare Gateway operates in two modes:
+---
 
-* DNS filtering
-* Proxy (HTTP filtering)
+## Build a hostname policy
 
-The proxy mode in Gateway requires a Gateway Standard or Cloudflare for Teams Standard [plan](https://www.cloudflare.com/teams-pricing/).
+To begin, navigate to the `Gateway` section of the Cloudflare for Teams dashboard and click on `Policies`. Select the `HTTP tab`. By default, Cloudflare Gateway create a rule that [skips inspection](/policies/filtering/http-policies#do-not-inspect) for applications that break when traffic is decrypted. You can remove this rule, but it will likely cause certain applications to break for end users.
 
-To filter all Internet-bound traffic in the proxy mode, devices must install and enroll the Cloudflare for Teams WARP client. The WARP client will send all Internet traffic to a Cloudflare data center near the user where it can be filtered and logged before reaching the rest of the Internet.
+![Policy Start](../static/secure-web-gateway/block-football/policy-start.png)
 
-Building a rule in Access to enforce Gateway connections requires the use of the WARP client and its configuration to proxy Internet traffic to Cloudflare.
+Click **Create a policy** to add a new HTTP policy. Give the policy a name and description.
 
-## Determine which devices can enroll
+Next, create a rule to block any subdomain that uses a particular host. This example uses `espn.com` as the host. The rule below uses the `matches regex` operator to block any subdomain that uses `espn.com` as the host.
+
+```
+.*espn\.com
+```
 
-To proxy traffic through Gateway, devices must run the Cloudflare WARP client and [be enrolled in your Teams account](/connections/connect-devices/warp/device-enrollment). When devices enroll, users will be prompted to authenticate with your identity provider or a consumer identity service. You can also deploy the client and its configurations [via a device management platform](/connections/connect-devices/warp/deployment) like JAMF or InTune.
+![Block ESPN](../static/secure-web-gateway/block-football/block-espn.png)
 
-First, determine which devices can enroll based on user identity. If you have already integrated your identity provider when setting up Cloudflare Access you can reuse that integration. If you have not set up an identity provider, follow [these instructions](/identity/idp-integration) to add Access and integrate a free identity option or a specific provider.
+Next, click **+ Add condition** to apply this rule to a specific user or group of users. This example uses the user email address. You can also build rules using your identity provider's directory groups.
 
-Next, build a rule to decide which devices can enroll into your Gateway account. Navigate to the `Devices` page in the `My Teams` section of the sidebar.
+![Block ESPN](../static/secure-web-gateway/block-football/block-espn-sam.png)
 
-![Device List](../static/secure-web-gateway/secure-dns-devices/device-page.png)
+You can now select **Block** as the action. You can add optional text to present to the user in the block page.
 
-Click `Device Settings` to build the enrollment rule. In the policy, define who should be allowed to enroll a device and click `Save`.
+![Block Action](../static/secure-web-gateway/block-football/block-espn-action.png)
 
-![Enroll Rule](../static/secure-web-gateway/secure-dns-devices/enroll-rule.png)
+Click **Create policy** to save the rule.
 
-## Enroll a device
+![ESPN List](../static/secure-web-gateway/block-football/after-block-espn.png)
+
+## Integrate your identity provider
 
-Follow the [instructions here](/connections/connect-devices/warp) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+The HTTP filtering policy created will apply to any HTTP requests sent from configured locations or enrolled devices. You can begin to [enroll devices](/connections/connect-devices/warp/deployment) by determining which users are allowed to enroll.
 
-Once installed, click the gear icon.
+Navigate to the `Configuration` section of the Cloudflare for Teams dashboard and select `Authentication`. Cloudflare for Teams will automatically create a "One-time PIN" option which will rely on your user's emails. You can begin using the one-time PIN option immediately or you can integrate your corporate [identity provider](/identity/idp-integration) as well.
 
-![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+## Determine which devices can enroll
 
-Under the `Account` tab, click `Login with Cloudflare for Teams`.
+Next, build a rule to decide which devices can enroll in your account. 
 
-![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+1. Navigate to **Settings > Devices > Device enrollment**.
 
-Input your Cloudflare for Teams org name. You will have created this during the Cloudflare Access setup flow. You can find it under the `Authentication` tab in the `Access` section of the sidebar.
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
 
-![Org Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+1. Click **Manage**.
 
-The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+1. Click **Add a rule**.
+
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
 
-![Confirm WARP](../static/secure-web-gateway/block-uploads/with-warp.png)
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
+
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
+
+1. Click **Save**.
+
+Your rule will now be visible under the **Device enrollment rules** list.
 
 ## Configure the Cloudflare certificate
 
-To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below follows a manual distribution flow.
+To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below describes the manual distribution flow.
 
-Download the Cloudflare certificate provided in the [instructions here](/connections/connect-devices/warp/install-cloudflare-cert). You can also find the certificate in the Cloudflare for Teams dashboard. Navigate to the `Account` page in the `Settings` section of the sidebar and scroll to the bottom.
+To download the Cloudflare certificate:
+* Follow the link provided in [these instructions](/connections/connect-devices/warp/install-cloudflare-cert), or
+* Find the certificate in the Teams Dashboard, by navigating to **Settings > Devices > Certificates**.
 
-Next, follow [these instructions](/connections/connect-devices/warp/install-cloudflare-cert#add-the-certificate-to-your-system) to install the certificate on your system.
+Next, follow [these instructions](/connections/connect-devices/warp/install-cloudflare-cert) to install the certificate on your system.
 
-Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to the `Policies` page in the Gateway section. Click the **Settings** tab and toggle `Proxy Settings` to enabled.
+## Enable the Cloudflare proxy
 
-![Add Policy](../static/secure-web-gateway/block-uploads/filter-toggle.png)
+Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to **Settings > Network**. Toggle **Proxy** to *Enabled*. This will tell Cloudflare to begin proxying any traffic from enrolled devices, except the traffic excluded using the [split tunnel](/connections/connect-devices/warp/exclude-traffic) settings.
 
-## Build a hostname policy
+Next, enable TLS decryption. This will tell Cloudflare to begin decrypting traffic for inspection from enrolled devices, except the traffic excluded from inspection.
 
-Click **Add a rule** to add a new HTTP policy. You can build rules that match an exact hostname or, like the example here, rules that use regular expressions to match for patterns.
+![Policy settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
 
-![Add Rule](../static/secure-web-gateway/block-football/add-rule-sam.png)
+## Enroll a device
 
-The rule below uses the `matches regex` operator to block any subdomain that uses `espn.com` as the host. You can also build a rule with an `is` operator and input `espn.com` directly.
+1. Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
 
-```
-.*espn\.com
-```
+1. Once the client is installed, click the gear icon.
+
+    ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
 
-![Block ESPN](../static/secure-web-gateway/block-football/block-espn-host-sam.png)
+1. Under the **Account** tab, click **Login with Cloudflare for Teams**.
 
-You can also build rules by user group (including name or ID).
+    ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
 
-Once you have clicked **Create rule** you should see it appear at the bottom of the rule list. Gateway enforces rules from top to bottom. If you had a rule with higher precedence (ranked higher in the list) that allowed ESPN, that rule would allow the user before this rule could block.
+1. Input your [team name](/glossary#team-name). You can find it on the Teams Dashboard under **Settings > General**.
 
-![Post ESPN](../static/secure-web-gateway/block-football/post-espn-sam.png)
+    ![Team Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+
+The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
 
-## Blocks
+![Confirm WARP](../static/secure-web-gateway/block-football/warp-mode.png)
 
-When users visit that section of Reddit (and any page within it), they will receive a block page. Any attempt to reach ESPN will also be blocked.
+## Confirm blocks
 
-![Block Page](../static/secure-web-gateway/block-football/block-page.png)
+When users visit that section of Reddit (and any page within it), they will see a block page. Any attempt to reach ESPN will also be blocked.
 
-You can review the blog event in the HTTP logs. Navigate to the `Gateway` page in the `Logs` section of the Cloudflare for Teams dashboard. Filter for `Block` as the decision type. The block logs will also list the user who made the request.
+You can review the blog event in the HTTP logs. Navigate to the `Gateway` page in the `Logs` section of the Cloudflare for Teams dashboard. Filter for `Block` as the decision type.
 
 ![Block Log](../static/secure-web-gateway/block-football/block-log.png)
diff --git a/products/cloudflare-one/src/content/tutorials/block-football.md b/products/cloudflare-one/src/content/tutorials/block-football.md
index 23db02aad1f..550f1ce097c 100644
--- a/products/cloudflare-one/src/content/tutorials/block-football.md
+++ b/products/cloudflare-one/src/content/tutorials/block-football.md
@@ -2,122 +2,158 @@
 updated: 2020-12-07
 category: 🛡️ Web Gateway
 difficulty: Medium
+pcx-content-type: tutorial
 ---
 
 # Block sites by host and URL
 
-You can use Cloudflare Gateway and the Cloudflare WARP client application to block attempts to reach hostnames or to block URL paths without blocking the rest of the hostname.
+You can use Cloudflare Gateway and the Cloudflare WARP client to inspect HTTP traffic in order to block attempts to reach hostnames or to block URL paths without blocking the entire hostname.
+
+In this mode, the Cloudflare WARP client runs on user devices and proxies all Internet-bound traffic to Cloudflare's network. Cloudflare's network will then inspect the HTTP traffic to apply policies based on user identity and destination. You can also decide to [exclude some traffic from inspection](/policies/filtering/http-policies#do-not-inspect) while filtering all other traffic.
 
 **🗺️ This tutorial covers how to:**
 
-* Enroll devices into Gateway
 * Create a Gateway policy to block URLs that contain a hostname
 * Create a Gateway policy to block URLs that contain a URL path
+* Enroll devices into Gateway
 * Review the block events in the Gateway logs
 
 **⏲️Time to complete:**
 
-25 minutes
+35 minutes
 
-## Add Cloudflare Gateway
+## Before you start
+1. [Add Gateway to your account](/setup)
 
-Before you begin, you'll need to follow [these instructions](/setup) to set up Cloudflare Gateway in your account. Cloudflare Gateway operates in two modes:
+---
 
-* DNS filtering
-* Proxy (HTTP filtering)
+## Build a hostname policy
 
-The proxy mode in Gateway requires a Gateway Standard or Cloudflare for Teams Standard [plan](https://www.cloudflare.com/teams-pricing/).
+To begin, navigate to the `Gateway` section of the Cloudflare for Teams dashboard and click on `Policies`. Select the `HTTP tab`. By default, Cloudflare Gateway create a rule that [skips inspection](/policies/filtering/http-policies#do-not-inspect) for applications that break when traffic is decrypted. You can remove this rule, but it will likely cause certain applications to break for end users.
 
-To filter all Internet-bound traffic in the proxy mode, devices must install and enroll the Cloudflare for Teams WARP client. The WARP client will send all Internet traffic to a Cloudflare data center near the user where it can be filtered and logged before reaching the rest of the Internet.
+![Policy Start](../static/secure-web-gateway/block-football/policy-start.png)
 
-Building a rule in Access to enforce Gateway connections requires the use of the WARP client and its configuration to proxy Internet traffic to Cloudflare.
+Click **Create a policy** to add a new HTTP policy. Give the policy a name and description.
 
-## Determine which devices can enroll
+Next, create a rule to block any subdomain that uses a particular host. This example uses `espn.com` as the host. The rule below uses the `matches regex` operator to block any subdomain that uses `espn.com` as the host.
 
-To proxy traffic through Gateway, devices must run the Cloudflare WARP client and [be enrolled in your Teams account](/connections/connect-devices/warp). When devices enroll, users will be prompted to authenticate with your identity provider or a consumer identity service. You can also deploy the client and its configurations [via a device management platform](/connections/connect-devices/warp/deployment) like JAMF or InTune.
+```
+.*espn\.com
+```
 
-First, determine which devices can enroll based on user identity. If you have already integrated your identity provider when setting up Cloudflare Access you can reuse that integration. If you have not set up an identity provider, follow [these instructions](/setup) to add Access and integrate a free identity option or a specific provider.
+![Block ESPN](../static/secure-web-gateway/block-football/block-espn.png)
 
-Next, build a rule to decide which devices can enroll into your Gateway account. Navigate to the `Devices` page in the `My Teams` section of the sidebar.
+You can now select **Block** as the action. You can add optional text to present to the user in the block page.
 
-![Device List](../static/secure-web-gateway/secure-dns-devices/device-page.png)
+![Block Action](../static/secure-web-gateway/block-football/block-espn-action.png)
 
-Click `Device Settings` to build the enrollment rule. In the policy, define who should be allowed to enroll a device and click `Save`.
+Click **Create policy** to save the rule.
 
-![Enroll Rule](../static/secure-web-gateway/secure-dns-devices/enroll-rule.png)
+![ESPN List](../static/secure-web-gateway/block-football/after-block-espn.png)
 
-## Enroll a device
 
-Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+## Build a URL policy
 
-Once installed, click the gear icon.
+Some websites are organized by URL path, so blocking by subdomain is not sufficient. Instead, you must build rules for a specific URL path.
 
-![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+In the example below, `reddit.com` is a website where different areas of interest are grouped into a URL string that follows `/r/`. In this case, your team can block a section of Reddit without blocking all of Reddit. The "subreddit" `CFB`, available at `https://www.reddit.com/r/CFB/`, is the section of Reddit that discusses college football.
 
-Under the `Account` tab, click `Login with Cloudflare for Teams`.
+Matching for this URL requires a regular expression rule. Create a new policy and choose `URL` as the Selector. For the operator value, select `matches regex` and input `/r/CFB/` in the Value field.
 
-![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+```
+/r/CFB
+```
 
-Input your Cloudflare for Teams org name. You will have created this during the Cloudflare Access setup flow. You can find it under the `Authentication` tab in the `Access` section of the sidebar.
+![Block CFB](../static/secure-web-gateway/block-football/block-cfb.png)
 
-![Org Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+You can now select **Block** as the action. You can add optional text to present to the user in the block page.
 
-The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+![Block CFB](../static/secure-web-gateway/block-football/block-action.png)
 
-![Confirm WARP](../static/secure-web-gateway/block-uploads/with-warp.png)
+Click **Create policy** to save the rule.
 
-## Configure the Cloudflare certificate
+<Aside>
 
-To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below follows a manual distribution flow.
+The policy created will apply to any traffic sent to Gateway where HTTP filtering is applied. If you want to only apply one rule in this policy to specific groups of users, you can split this polity into two and add selectors that specific groups of users.
 
-Download the Cloudflare certificate provided in the [instructions here](/connections/connect-devices/warp/install-cloudflare-cert). You can also find the certificate in the Cloudflare for Teams dashboard. Navigate to the `Account` page in the `Settings` section of the sidebar and scroll to the bottom.
+</Aside>
 
-Next, follow [these instructions](/connections/connect-devices/warp/install-cloudflare-cert) to install the certificate on your system.
+Once saved, the policy should now appear in your policy list.
 
-Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to the `Policies` page in the Gateway section. Scroll to the bottom and toggle `Proxy Settings` to enabled.
+![Policy Start](../static/secure-web-gateway/block-football/saved-list.png)
 
-![Add Policy](../static/secure-web-gateway/block-uploads/filter-toggle.png)
+You can click the arrow in the policy list to expand a policy and quickly view its contents.
 
-## Build a hostname policy
+![Policy Start](../static/secure-web-gateway/block-football/expand-list.png)
 
-Click **Add a rule** to add a new HTTP policy. You can build rules that match an exact hostname or, like the example here, rules that use regular expressions to match for patterns.
+## Integrate your identity provider
 
-The rule below uses the `matches regex` operator to block any subdomain that uses `espn.com` as the host. You can also build a rule with an `is` operator and input `espn.com` directly.
+The HTTP filtering policy created will apply to any HTTP requests sent from configured locations or enrolled devices. You can begin to [enroll devices](/connections/connect-devices/warp/deployment) by determining which users are allowed to enroll.
 
-```
-.*espn\.com
-```
+Navigate to the `Settings` section of the Cloudflare for Teams dashboard and select `Authentication`. Cloudflare for Teams will automatically create a "One-time PIN" option which will rely on your user's emails. You can begin using the one-time PIN option immediately or you can also integrate your corporate [identity provider](/identity/idp-integration).
 
-![Block ESPN](../static/secure-web-gateway/block-football/block-espn-host.png)
+## Determine which devices can enroll
 
-Once you have clicked **Create rule** you should see it appear at the bottom of the rule list. Gateway enforces rules from top to bottom. If you had a rule with higher precedence (ranked higher in the list) that allowed ESPN, that rule would allow the user before this rule could block.
+Next, build a rule to decide which devices can enroll in your account. 
 
-![Post ESPN](../static/secure-web-gateway/block-football/post-espn.png)
+1. Navigate to **Settings > Devices > Device enrollment**.
 
-## Build a URL policy
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
 
-Some websites are organized by URL path, so blocking by host or subdomain is not sufficient. Instead, you must build rules for a specific URL path.
+1. Click **Manage**.
 
-In the example below, `reddit.com` is a website where different areas of interest are grouped into a URL string that follows `/r/`. In this case, `CFB` is the section of Reddit that discusses college football.
+1. Click **Add a rule**.
 
-Matching for this URL requires a regular expression rule.
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
 
-```
-/r/CFB
-```
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
+
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
 
-![Block CFB](../static/secure-web-gateway/block-football/block-cfb-url.png)
+1. Click **Save**.
 
-Click **Create rule** and you should see it appear in your rule list.
+Your rule will now be visible under the **Device enrollment rules** list.
 
-![Block CFB](../static/secure-web-gateway/block-football/post-cfb.png)
+## Configure the Cloudflare certificate
 
-## Blocks
+To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below describes the manual distribution flow.
 
-When users visit that section of Reddit (and any page within it), they will receive a block page. Any attempt to reach ESPN will also be blocked.
+To download the Cloudflare certificate:
+* Follow the link provided in [these instructions](/connections/connect-devices/warp/install-cloudflare-cert).
+* Find the certificate in the Teams Dashboard, by navigating to **Settings > Devices > Certificates**.
+
+## Enable the Cloudflare proxy
+
+Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to **Settings > Network**. Toggle **Proxy** to *Enabled*. This will tell Cloudflare to begin proxying any traffic from enrolled devices, except the traffic excluded using the [split tunnel](/connections/connect-devices/warp/exclude-traffic) settings.
+
+Next, enable TLS decryption. This will tell Cloudflare to begin decrypting traffic for inspection from enrolled devices, except the traffic excluded from inspection.
+
+![Policy settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
+
+## Enroll a device
+
+1. Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
 
-![Block Page](../static/secure-web-gateway/block-football/block-page.png)
+1. Once the client is installed, click the gear icon.
+
+    ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+
+1. Under the **Account** tab, click **Login with Cloudflare for Teams**.
+
+    ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+
+1. Input your [team name](/glossary#team-name). You can find it on the Teams Dashboard under **Settings > General**.
+
+    ![Team Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+
+The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+
+![Confirm WARP](../static/secure-web-gateway/block-football/warp-mode.png)
+
+## Confirm blocks
+
+When users visit that section of Reddit (and any page within it), they will receive a block page. Any attempt to reach ESPN will also be blocked.
 
 You can review the blog event in the HTTP logs. Navigate to the `Gateway` page in the `Logs` section of the Cloudflare for Teams dashboard. Filter for `Block` as the decision type.
 
-![Block Log](../static/secure-web-gateway/block-football/block-log.png)
\ No newline at end of file
+![Block Log](../static/secure-web-gateway/block-football/block-log.png)
diff --git a/products/cloudflare-one/src/content/tutorials/block-tld.md b/products/cloudflare-one/src/content/tutorials/block-tld.md
index fbf66c94204..4dfaa3a6be3 100644
--- a/products/cloudflare-one/src/content/tutorials/block-tld.md
+++ b/products/cloudflare-one/src/content/tutorials/block-tld.md
@@ -2,6 +2,7 @@
 updated: 2020-12-13
 category: 🛡️ Web Gateway
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Block sites by TLD
@@ -16,24 +17,41 @@ You can use Cloudflare Gateway to block DNS queries a entire top level domain (T
 
 5 minutes
 
-## Configure Cloudflare Gateway
+## Before you start
+1. [Add Gateway to your account](/setup)
 
-Before you begin, you'll need to follow [these instructions](/setup) to set up Cloudflare Gateway in your account. TLD blocking is available on any plan.
+## Build a policy to block by TLD
 
-## Block by TLD
+Visit the Cloudflare for Teams dashboard. Open the `Policies` page in the Gateway section and select the `DNS` tab.
 
-Visit the Cloudflare for Teams dashboard.
+![Dashboard](../static/secure-web-gateway/block-tld/policies.png)
 
-![Dashboard](../static/secure-web-gateway/block-tld/dashboard.png)
+Click **Create a policy**. In the policy builder, name the policy and optionally provide a description.
 
-Open the `Policies` page in the Gateway section and select the `DNS` tab.
+Choose `DNS Domain` in the Selector, `matches regex`, in the Operator, and input the following value:
 
-![Dashboard](../static/secure-web-gateway/block-tld/policies.png)
+```
+[.]fail
+```
+
+Replacing `fail` with the TLD you intend to block.
+
+![Fail Policy](../static/secure-web-gateway/block-tld/block-fail.png)
+
+Choose `Block` as the action. Optionally, enable the block page to present a block page to users. Users must have the Cloudflare certificate installed to see the block page.
 
-Create a new policy or edit an existing policy. In the policy builder, select the `Custom` tab and click **Add a destination**
+Finish the policy by clicking **Create policy**.
 
-![Dashboard](../static/secure-web-gateway/block-tld/custom.png)
+![Block Action](../static/secure-web-gateway/block-tld/block-action.png)
 
 Input the TLD you need to block. If you need to block `.fail` remove the leading `.` and only input `fail`. Click **Add to policy** and save the policy.
 
-![Dashboard](../static/secure-web-gateway/block-tld/add-tld-block.png)
\ No newline at end of file
+## Review logs
+
+You can test your policy by attempting to visit a domain with the blocked TLD. To review logs of the block, navigate to the `Logs` section of the Cloudflare for Teams dashboard, select `Gateway`, and choose the `DNS` tab.
+
+![Logs](../static/secure-web-gateway/block-tld/review-logs-start.png)
+
+You can filter for events by policy. Select the name of the policy in the `Policy` drop down menu.
+
+![Logs](../static/secure-web-gateway/block-tld/review-logs-filter.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/block-uploads.md b/products/cloudflare-one/src/content/tutorials/block-uploads.md
index a5345c44376..2f00571ae29 100755
--- a/products/cloudflare-one/src/content/tutorials/block-uploads.md
+++ b/products/cloudflare-one/src/content/tutorials/block-uploads.md
@@ -2,6 +2,7 @@
 updated: 2021-03-09
 category: 🛡️ Web Gateway
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Block file uploads to Google Drive
@@ -18,17 +19,16 @@ You can use Cloudflare Gateway and the Cloudflare WARP client application to pre
 
 10 minutes
 
-## Before you start
-
-1. [Connect devices](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp) to Cloudflare's edge with the WARP client and [install the root certificate](/connections/connect-devices/warp/install-cloudflare-cert)
-1. [ Enable web inspection](/connections/connect-devices/warp/control-proxy)
-
 ## Create a Gateway HTTP policy
 
-You can [build a policy](/policies/filtering/http-policies) that will block file uploads to Google Drive. Navigate to the `Policies` page. On the HTTP tab, click `Add a policy`.
+You can [build a policy](/policies/filtering/http-policies) that will block file uploads to Google Drive. Navigate to the `Policies` page. On the HTTP tab, click `Create a policy`.
 
 ![Add Policy](../static/secure-web-gateway/block-uploads/add-http-policy.png)
 
+Name the policy and provide an optional description.
+
+![Add Policy](../static/secure-web-gateway/block-uploads/name-policy.png)
+
 Cloudflare curates a constantly-updating list of the hostnames, URLs, and endpoints used by common applications. In this example, "Google Drive" list containst the destinations used by Google Drive.
 
 In the rule builder, select "Application" in the **Selector** field, "in" in the **Operator** field, and under "File Sharing" select "Google Drive" in the **Value** field.
@@ -41,26 +41,94 @@ Next, click **+ Add Condition** and choose "Upload Mime Type" and "matches regex
 
 Scroll to **Action** and choose "Block". Click **Create rule** to save the rule.
 
-## Change rule precedence
+![Block Drive](../static/secure-web-gateway/block-uploads/block-action.png)
+
+## Exempt some users
+
+You can allow certain users to upload to Google Drive, while blocking all others, by adding a second policy and modifying the order of rule operations in Gateway.
 
-You can control the order of rule operations in the Gateway policies page. If you need to allow certain users in your organization to upload files, create a rule with the same first two expressions and add a condition that specifies the user or group. Instead of "Block" choose "Allow" in the **Action** field.
+Create a new policy and include the first two values from the previous policy. Add a third condition and input the value of user identity that should be allowed to upload. This example uses the name of a group from an integrated identity provider.
 
-![Allow Drive](../static/secure-web-gateway/block-uploads/http-rule-list.png)
+![Allow Drive](../static/secure-web-gateway/block-uploads/allow-users.png)
 
-Rank the Allow rule higher than the Block rule.
+Select `Allow` for the action and save the rule.
+
+![Allow Drive](../static/secure-web-gateway/block-uploads/allow-action.png)
+
+Next, modify the existing rule order.
+
+![Rule List](../static/secure-web-gateway/block-uploads/allow-last.png)
+
+Drag the `Allow` rule higher than the `Block` rule.
 
 ![Rule List](../static/secure-web-gateway/block-uploads/allow-first.png)
 
-## Test policy
+## Integrate your identity provider
 
-You can test the policy by attempting to upload a file to Google Drive. Google Drive should return an error message when blocked.
+The HTTP filtering policy created will apply to any HTTP requests sent from configured locations or enrolled devices. You can begin to [enroll devices](/connections/connect-devices/warp/deployment) by determining which users are allowed to enroll.
 
-![Block Action](../static/secure-web-gateway/block-uploads/block-result.png)
+Navigate to the `Settings` section of the Cloudflare for Teams Dashboard and select `Authentication`. Cloudflare for Teams will automatically create a "One-time PIN" option which will rely on your user's emails. You can begin using the one-time PIN option immediately or you can also integrate your corporate [identity provider](/identity/idp-integration).
+
+## Determine which devices can enroll
+
+Next, build a rule to decide which devices can enroll in your account. 
+
+1. Navigate to **Settings > Devices > Device enrollment**.
+
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
+
+1. Click **Manage**.
+
+1. Click **Add a rule**.
+
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
+
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
+
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
 
-## View Logs
+1. Click **Save**.
 
-Once enabled, if a user attempts to upload a file you can view logs of the block.
+Your rule will now be visible under the **Device enrollment rules** list.
 
-Navigate to the `Logs` section of the sidebar and choose `Gateway`. Open the Filter action and select `Block` from the dropdown under `Decision`.
+## Configure the Cloudflare certificate
 
-![Block Action](../static/secure-web-gateway/block-uploads/block-gateway-logs.png)
+To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below describes the manual distribution flow.
+
+To download the Cloudflare certificate:
+* Follow the link provided in [these instructions](/connections/connect-devices/warp/install-cloudflare-cert).
+* Find the certificate in the Teams Dashboard, by navigating to **Settings > Devices > Certificates**.
+
+## Enable the Cloudflare proxy
+
+Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to **Settings > Network**. Toggle **Proxy** to *Enabled*. This will tell Cloudflare to begin proxying any traffic from enrolled devices, except the traffic excluded using the [split tunnel](/connections/connect-devices/warp/exclude-traffic) settings.
+
+Next, enable TLS decryption. This will tell Cloudflare to begin decrypting traffic for inspection from enrolled devices, except the traffic excluded from inspection.
+
+![Policy settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
+
+## Enroll a device
+
+1. Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+
+1. Once the client is installed, click the gear icon.
+
+    ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+
+1. Under the **Account** tab, click **Login with Cloudflare for Teams**.
+
+    ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+
+1. Input your [team name](/glossary#team-name). You can find it on the Teams Dashboard under **Settings > General**.
+
+    ![Team Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+
+The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+
+![Confirm WARP](../static/secure-web-gateway/block-football/warp-mode.png)
+
+## Test policy
+
+You can test the policy by attempting to upload a file to Google Drive. Google Drive should return an error message when blocked.
+
+![Block Action](../static/secure-web-gateway/block-uploads/block-result.png)
diff --git a/products/cloudflare-one/src/content/tutorials/cli.md b/products/cloudflare-one/src/content/tutorials/cli.md
index 75b43238398..013957b6190 100644
--- a/products/cloudflare-one/src/content/tutorials/cli.md
+++ b/products/cloudflare-one/src/content/tutorials/cli.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-03-23
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Connect through Cloudflare Access using a CLI
@@ -86,7 +87,7 @@ Set up a token as an environment variable as follows:
 1. Run the following command to export the token to the shell environment:
 
     ```sh
-    $ export TOKEN $(cloudflared access token -app=http://example.com
+    $ export TOKEN=$(cloudflared access token -app=http://example.com)
     ```
 
 2. Confirm the token was saved with the following:
diff --git a/products/cloudflare-one/src/content/tutorials/corp-device-tag.md b/products/cloudflare-one/src/content/tutorials/corp-device-tag.md
index 187b050b086..51be113d5c9 100644
--- a/products/cloudflare-one/src/content/tutorials/corp-device-tag.md
+++ b/products/cloudflare-one/src/content/tutorials/corp-device-tag.md
@@ -12,8 +12,8 @@ You can use Cloudflare Access to require team members to connect to self-hosted
 **🗺️ This walkthrough covers how to:**
 
 * Create or upload a list of devices in your inventory
-* Deploy Cloudflare WARP, the Cloudflare for Teams agent, to collect device information
-* Build a Zero Trust rule that requires users to connect from devices in your inventory
+* Deploy the Cloudflare WARP client to collect device information
+* Build a Zero Trust policy that requires users to connect from devices in your inventory
 
 **⏲️Time to complete:**
 
@@ -21,43 +21,42 @@ You can use Cloudflare Access to require team members to connect to self-hosted
 
 ## Create or upload a list of devices
 
-Navigate to `dash.teams.cloudflare.com` and select the `Lists` page from the Configuration section of the sidebar. Click **Create manual list**. You can also upload a CSV list.
+1. Navigate to the [Teams Dashboard](dash.teams.cloudflare.com).
+1. Go to **My Team > Lists**.
+1. Click **Create manual list**. You can also upload a CSV list.
+1. Give your list a name and choose `Serial numbers` from the List type field.
 
-![Add List](../static/zero-trust-security/corp-device/list-start.png)
+    ![Create List](../static/zero-trust-security/corp-device/list-create.png)
 
-Give your list a name and choose `Serial numbers` from the List type field.
-
-![Create List](../static/zero-trust-security/corp-device/list-create.png)
-
-Input the serial numbers of the devices your team manages. For larger teams, we recommend uploading a CSV or using Cloudflare's API endpoint. Click **Save**.
+1. Input the serial numbers of the devices your team manages. For larger teams, we recommend uploading a CSV or using Cloudflare's API endpoint. Click **Save**.
 
 ![Add Serial Number](../static/zero-trust-security/corp-device/list-add-serial.png)
 
 Once saved, the serial number list will appear in your list view.
 
-![Saved List](../static/zero-trust-security/corp-device/list-save-list.png)
-
 ## Deploy Cloudflare WARP
 
-Cloudflare Access relies on the Cloudflare for Teams agent, WARP, to gather the serial number of a device attempting to reach a policy.
+Cloudflare Access relies on the Cloudflare for Teams client, WARP, to gather the serial number of a device attempting to reach a policy.
 
 In order to allow users to authenticate, you must [deploy the WARP agent](/tutorials/gw-rollout-guide#configure-device-policies) in proxy mode and [users must enroll](/tutorials/gw-rollout-guide#enroll-the-cloudflare-for-teams-agent-for-dns-filtering) into your Cloudflare for Teams account.
 
-## Build a Zero Trust rule
+## Build a Zero Trust policy
+
+You can now add this corporate device requirement to existing or new applications.
 
-You can now add this corporate device requirement to existing or new applications. Navigate to `dash.teams.cloudflare.com` to begin.
+1. Navigate to the [Teams Dashboard](dash.teams.cloudflare.com) to begin.
 
-To add to an existing application, choose the specific resource from the `Applications` page in the Access section of the sidebar. Click **Edit**.
+1. To add to an existing application, choose the specific resource from the **Applications** page in the Access section of the sidebar. Click **Edit**.
 
-![App List](../static/zero-trust-security/corp-device/app-list.png)
+    ![App List](../static/zero-trust-security/corp-device/app-list.png)
 
-Select the **Rules** tab and edit the existing rule in place.
+1. Select the **Rules** tab and edit the existing rule in place.
 
-![Edit App](../static/zero-trust-security/corp-device/edit-app.png)
+    ![Edit App](../static/zero-trust-security/corp-device/edit-app.png)
 
-Add a `Require` rule and choose `Device Posture - Serial Number List` from the drop down menu. Choose the list of devices to require and click **Save rule**.
+1. Add a `Require` rule and choose `Device Posture - Serial Number List` from the drop down menu. Choose the list of devices to require and click **Save rule**.
 
-![Add Require](../static/zero-trust-security/corp-device/add-require.png)
+    ![Add Require](../static/zero-trust-security/corp-device/add-require.png)
 
 Once saved, any device attempting to reach the application in this example will both need to be in the `@cloudflare.com` domain and connecting from a device that uses Cloudflare WARP and presents a serial number in the list created.
 
diff --git a/products/cloudflare-one/src/content/tutorials/country-rules.md b/products/cloudflare-one/src/content/tutorials/country-rules.md
index 1f4f3a29474..30c7a6b4542 100755
--- a/products/cloudflare-one/src/content/tutorials/country-rules.md
+++ b/products/cloudflare-one/src/content/tutorials/country-rules.md
@@ -2,6 +2,7 @@
 updated: 2020-11-28
 category: 🔐 Zero Trust
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Require specific countries
@@ -37,7 +38,7 @@ Click `Save`.
 
 ![Full Groups](../static/zero-trust-security/country-rules/later-groups.png)
 
-## Build a policy
+## Build or edit a policy
 
 You can now build [Zero Trust policies](/policies/zero-trust) that will require at least one country in the approved countries list. Navigate to the `Applications` page in the `Access` section of the Cloudflare for Teams dashboard.
 
diff --git a/products/cloudflare-one/src/content/tutorials/credentials-only.md b/products/cloudflare-one/src/content/tutorials/credentials-only.md
index e41b09fd901..86700223d55 100755
--- a/products/cloudflare-one/src/content/tutorials/credentials-only.md
+++ b/products/cloudflare-one/src/content/tutorials/credentials-only.md
@@ -2,11 +2,12 @@
 updated: 2020-11-28
 category: 🌐 Connections
 difficulty: Medium
+pcx-content-type: tutorial
 ---
 
 # Connect without long-lived API keys
 
-You can use [Argo Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network without leaving sensitive API keys lingering in your environment. These applications can be both public-facing or protected by [Cloudflare Access](/glossary#cloudflare-access).
+You can use [Cloudflare Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network without leaving sensitive API keys lingering in your environment. These applications can be both public-facing or protected by [Cloudflare Access](/glossary#cloudflare-access).
 
 **🗺️ This tutorial covers how to:**
 
@@ -24,7 +25,7 @@ In this example, the resource being connected is a [Hugo site](https://gohugo.io
 
 ![New Hugo](../static/secure-origin-connections/share-new-site/hugo-new.png)
 
-To share this work-in-progress with an audience on the Internet, start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation here](https://docs.brew.sh/Installation) to install it.
+To share this work-in-progress with an audience on the Internet, start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation here](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
@@ -32,19 +33,19 @@ Once installed, run the following command in your Terminal to authenticate this
 
 `$ cloudflared login`
 
-The command will launch a browser window and prompt you to login with your Cloudflare account. Choose a website that you have added into your account.
+The command will launch a browser window and prompt you to login with your Cloudflare account. Choose a website that you have added into your account. The website selected does not need to be the website where the environment will be made available.
 
 ![Choose Site](../static/secure-origin-connections/share-new-site/pick-site.png)
 
 Once you click one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes.
 
-You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ## Create a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
 
 Run the following command to create a Tunnel. You can replace `new-website` with any name that you choose. This command requires the `cert.pem` file.
 
@@ -56,7 +57,7 @@ Cloudflare will create the Tunnel with that name and generate an ID and credenti
 
 ## Delete the `cert.pem` file
 
-The credentials file is separate from the `cert.pem` file. Unlike the `cert.pem` file, the credentials file consists of a token that authenticates only the Named Tunnel you just created. Formatted as `JSON`, the file cannot make changes to your Cloudflare account or create additional Tunnels.
+The credentials file created in the previous step is separate from the `cert.pem` file. Unlike the `cert.pem` file, the credentials file consists of a token that authenticates only the Named Tunnel you just created. Formatted as `JSON`, the file cannot make changes to your Cloudflare account or create additional Tunnels.
 
 If you are done creating Tunnels, you can delete the `cert.pem` file, leave only the credentials file, and continue to manage DNS records directly in the Cloudflare dashboard or API. For additional information on the different functions of the two files, see the table in [this section](/connections/connect-apps/create-tunnel).
 
@@ -76,11 +77,9 @@ tunnel: 5157d321-5933-4b30-938b-d889ca87e11b
 credentials-file: /Users/username/.cloudflared/5157d321-5933-4b30-938b-d889ca87e11b.json
 ```
 
-If you are using the credentials file without the `cert.pem` file, you must specify the Tunnel ID in the `tunnel:` value. You cannot use the Name alone with the credentials file.
+## Run Cloudflare Tunnel
 
-## Run Argo Tunnel
-
-At this point, you have created and configured your Argo Tunnel connection. You can now [run that](/connections/connect-apps/run-tunnel) Tunnel. Running it will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
+At this point, you have created and configured your Cloudflare Tunnel connection. You can now [run that](/connections/connect-apps/run-tunnel) Tunnel. Running it will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
 
 `$ cloudflared tunnel run`
 
diff --git a/products/cloudflare-one/src/content/tutorials/custom-block-page.md b/products/cloudflare-one/src/content/tutorials/custom-block-page.md
new file mode 100644
index 00000000000..17911cf82e2
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/custom-block-page.md
@@ -0,0 +1,53 @@
+---
+updated: 2021-06-08
+category: 🛡️ Web Gateway
+pcx-content-type: tutorial
+---
+
+# Customize the block page users see
+
+Cloudflare Gateway can present users with a [block page](/policies/filtering/configuring-block-page) when a DNS or HTTP filtering policy applies a block action. Your team can customize the block page with branding from your organization, additional messaging, and messaging specific to particular rules.
+
+To present this block page, in either DNS or HTTP filtering mode, users must have the Cloudflare certifiate [installed on their devices](/connections/connect-devices/warp/install-cloudflare-cert).
+
+**🗺️ This walkthrough covers how to:**
+
+* Create a custom block page for your users
+* Customize the text presented for specific rules
+
+**⏲️ Time to complete:**
+
+10 minutes
+
+## Before you start
+
+1. [Add Gateway to your account](/setup)
+1. [Add the Cloudflare certificate to devices in your organization](/connections/connect-devices/warp/install-cloudflare-cert)
+
+---
+
+## Customize the block page
+
+Navigate to the `Settings` page of the Cloudflare for Teams dashboard. Select `General`.
+
+![General Settings](../static/secure-web-gateway/custom-block/general-list.png)
+
+Click **Customize** on the **Block page** row.
+
+You can use the next page to modify the name of your organization and the text presented. You can also add a URL for your team's logo and modify the background color. Click **Save** once you have finished your edits.
+
+![General Settings](../static/secure-web-gateway/custom-block/edit-page.png)
+
+## Customize text for a specific rule
+
+Cloudflare Gateway can also show a policy-specific message in the block page. When you create a policy and select the **Block** action, Gateway gives you the option to enter a particular block message to show users when they navigate to websites blocked by that policy. The block page will then display the policy-specific message just above that policy's Rule ID.
+
+Edit one of your existing policies or create a new one. If the policy is a `Block`, you will see the option to customize the block page presented.
+
+Input the additional text to be presented to the user.
+
+![General Settings](../static/secure-web-gateway/custom-block/custom-text.png)
+
+Now, when the user is blocked by that particular rule they will see your custom block page and the specific text configured.
+
+![General Settings](../static/secure-web-gateway/custom-block/block-page.png)
diff --git a/products/cloudflare-one/src/content/tutorials/default-groups.md b/products/cloudflare-one/src/content/tutorials/default-groups.md
index 3648a7cbf05..559f5761a20 100755
--- a/products/cloudflare-one/src/content/tutorials/default-groups.md
+++ b/products/cloudflare-one/src/content/tutorials/default-groups.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-01-26
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Create reuseable Zero Trust rules
diff --git a/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md b/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md
index b912fdb10c6..b6f0ef500cf 100644
--- a/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md
+++ b/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md
@@ -2,13 +2,16 @@
 updated: 2021-03-09
 category: 🛡️ Web Gateway
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Skip inspection for groups of applications
 
-Some common applications and resources, like endpoints used by Zoom or Apple, rely on certificate pinning. The TLS inspection performed by a service like Cloudflare Gatway will cause errors when users visit those applications.
+You can configure Cloudflare for Teams to skip inspection for certain groups of applications.
 
-Cloudflare for Teams has compiled a list of resources that rely on this mechanism and you can use this list to quickly exclude these endpoints from inspection. You can also use this same workflow to exclude any application from Cloudflare Gateway's inspection.
+By default, Cloudflare Gateway creates a rule that includes the hostnames used by certain client applications, like Zoom or Apple's services, that rely on certificate pinning. The TLS inspection performed by a service like Cloudflare Gatway will cause errors when users visit those applications.
+
+This tutorial skips inspection for additional appilcations beyond those in the list curated by Cloudflare.
 
 **🗺️ This walkthrough covers how to:**
 
@@ -22,7 +25,7 @@ Cloudflare for Teams has compiled a list of resources that rely on this mechanis
 ## Before you start
 
 1. [Connect devices](/connections/connect-devices/warp) to Cloudflare's edge with the WARP client and [install the root certificate](/connections/connect-devices/warp/install-cloudflare-cert)
-1. [ Enable web inspection](/connections/connect-devices/warp/control-proxy)
+1. [Enable web inspection](/connections/connect-devices/warp/warp-settings#enable-proxy)
 
 ## Build the policy
 
@@ -30,13 +33,13 @@ Navigate to the **HTTP** tab of the `Policies` page in Cloudflare Gateway. Click
 
 ![Starter List](../static/secure-web-gateway/exempt-cert-pinning/starter-list.png)
 
-Under **Selector** choose **Application**. Select **in** in the **Operator field**. For value, type "Do Not Decrypt" or scroll to that section. Select the top-level "Do Not Decrypt" item.
+Name the policy and, optionally, provide a description.
 
-![Selctor](../static/secure-web-gateway/exempt-cert-pinning/select-do-not.png)
+![Name Policy](../static/secure-web-gateway/exempt-cert-pinning/name-policy.png)
 
-Cloudflare Gateway will automatically include all of the endpoints known to perform certificate pinning. However, this list does not mean that all of Google will be excluded from inspection for example - only those resources within Google that perform certificate pinning.
+Under **Selector** choose **Application**. Select **in** in the **Operator field**. This example uses Microsoft 365, categorized as Productivity.
 
-![Choose](../static/secure-web-gateway/exempt-cert-pinning/do-not-selected.png)
+![Selctor](../static/secure-web-gateway/exempt-cert-pinning/select-microsoft.png)
 
 Scroll to the bottom of the page and select **Do Not Inspect** and click **Create rule**.
 
@@ -44,6 +47,10 @@ Scroll to the bottom of the page and select **Do Not Inspect** and click **Creat
 
 ## Change rule precedence
 
-New rules are saved at the bottom of the rule list in Gateway. Gateway evaluates rules from top-to-bottom. We recommend dragging the **Do Not Inspect** rule to the top of the list so that it always applies first.
+New rules are saved at the bottom of the rule list in Gateway. Gateway evaluates rules from top-to-bottom, except for do-not-inspect rules. Those are always evaluated first.
+
+![Rule Order](../static/secure-web-gateway/exempt-cert-pinning/rules-first.png)
+
+We do recommend dragging the **Do Not Inspect** rule to the top of the list to reduce confusion.
 
-![Rule Order](../static/secure-web-gateway/exempt-cert-pinning/rule-precedence.png)
\ No newline at end of file
+![Rule Order](../static/secure-web-gateway/exempt-cert-pinning/rules-last.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/gateway-list.md b/products/cloudflare-one/src/content/tutorials/gateway-list.md
index d658b6d4ecb..e8580dae5c2 100644
--- a/products/cloudflare-one/src/content/tutorials/gateway-list.md
+++ b/products/cloudflare-one/src/content/tutorials/gateway-list.md
@@ -2,6 +2,7 @@
 updated: 2021-03-02
 category: 🛡️ Web Gateway
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Upload and use a list of objects
@@ -30,13 +31,17 @@ You can then use these lists in Gateway policies to block, allow, isolate or exc
 
 ## Upload a CSV
 
-You can manually create a list or upload a CSV to Cloudflare for Teams. To begin, navigate to the Cloudflare for Teams dashboard and click on the `Lists` page. Click **Upload CSV** to add a CSV.
+You can manually create a list or upload a CSV to Cloudflare for Teams.
 
-![List Create](../static/secure-web-gateway/gateway-list/list-start.png)
+1. To begin, navigate to the [Teams Dashboard](https://dash.teams.cloudflare.com) and go to **My Team > Lists** page.
 
-Name the list and choose its type. A list can only include objects of the same type. You can add an optional comment. Next, click **select a file** and then **Create**.
+![List Create](../static/secure-web-gateway/gateway-list/lists.png)
 
-![List Add](../static/secure-web-gateway/gateway-list/list-create.png)
+1. Click **Upload CSV** to add a CSV.
+
+1. Name the list and choose its type. A list can only include objects of the same type. You can add an optional comment. Next, click **select a file** and then **Create**.
+
+    ![List Add](../static/secure-web-gateway/gateway-list/list-create.png)
 
 The list will begin to upload and confirm if successful.
 
@@ -46,12 +51,10 @@ The list will begin to upload and confirm if successful.
 
 The next page will present the items uploaded through the CSV. You can edit or remove individual items. You can also return to this page if you want to make edits, additions, or removals in the future.
 
-![List Upload](../static/secure-web-gateway/gateway-list/list-edit.png)
+![List Upload](../static/secure-web-gateway/gateway-list/edit-list.png)
 
 Click **Save** to proceed.
 
-![List Upload](../static/secure-web-gateway/gateway-list/list-save.png)
-
 ## Use a list
 
 You can now use the list in the Cloudflare gateway rule builder. This example uses a hostname list, so the selector is `Host`. Choose `in list` and select the specific list from the drop down.
diff --git a/products/cloudflare-one/src/content/tutorials/gitlab.md b/products/cloudflare-one/src/content/tutorials/gitlab.md
index 975651d896e..ad64c89cfba 100755
--- a/products/cloudflare-one/src/content/tutorials/gitlab.md
+++ b/products/cloudflare-one/src/content/tutorials/gitlab.md
@@ -2,15 +2,16 @@
 updated: 2020-12-10
 category: 🔐 Zero Trust
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 # Zero Trust GitLab SSH & HTTP
 
-You can use Cloudflare Access to add Zero Trust rules to a self-hosted instance of GitLab. Combined with Argo Tunnel, users can connect through HTTP and SSH and authenticate with your team's identity provider.
+You can use Cloudflare Access to add Zero Trust rules to a self-hosted instance of GitLab. Combined with Cloudflare Tunnel, users can connect through HTTP and SSH and authenticate with your team's identity provider.
 
 **🗺️ This walkthrough covers how to:**
 
 * Deploy an instance of GitLab
-* Lock down all inbound connections to that instance and use Argo Tunnel to set outbound connections to Cloudflare
+* Lock down all inbound connections to that instance and use Cloudflare Tunnel to set outbound connections to Cloudflare
 * Build policies with Cloudflare Access to control who can reach GitLab
 * Connect over HTTP and SSH through Cloudflare
 
@@ -90,7 +91,7 @@ Users connect to GitLab over SSH (port 22 here) and HTTP for the web app (port 8
 
 You can use Cloudflare Access to build Zero Trust rules to determine who can connect to both the web application of GitLab (HTTP) and who can connect over SSH.
 
-When a user makes a request to a site protected by Access, that request hits Cloudflare's network first. Access can then check if the user is allowed to reach the application. When integrated with Argo Tunnel, the zero-trust architecture looks like this:
+When a user makes a request to a site protected by Access, that request hits Cloudflare's network first. Access can then check if the user is allowed to reach the application. When integrated with Cloudflare Tunnel, the Zero Trust architecture looks like this:
 
 ![GitLab Services](../static/zero-trust-security/gitlab/teams-diagram.png)
 
@@ -100,7 +101,7 @@ For GitLab, start by building two policies. Users will connect to GitLab in a co
 
 Before you build the rule, you'll need to follow [these instructions](/setup) to set up Cloudflare Access in your account.
 
-Once enabled, navigate to the `Applications` page in the Cloudflare for Teams dashboard. Click `Add an application`.
+Once enabled, navigate to the `Applications` page in the Cloudflare for Teams Dashboard. Click `Add an application`.
 
 ![Applications Page](../static/secure-origin-connections/share-new-site/applications.png)
 
@@ -122,17 +123,15 @@ You can then add rules to determine who can reach the site.
 
 Click `Next` and `Next` again on the `Setup` page - this example does not require advanced CORS configuration. Repeat these steps for the second application, `gitlab-ssh.widgetcorp.tech`.
 
-![App List](../static/secure-origin-connections/gitlab/app-list.png)
+## Cloudflare Tunnel
 
-## Cloudflare Argo Tunnel
+Cloudflare Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
 
-Cloudflare Argo Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
-
-Argo Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install that on the Digital Ocean machine with the two commands below.
+Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install that on the Digital Ocean machine with the two commands below.
 
 ```bash
-sudo wget https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb
-sudo dpkg -i ./cloudflared-stable-linux-amd64.deb
+sudo wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+sudo dpkg -i ./cloudflared-linux-amd64.deb
 ```
 
 Once installed, authenticate the instance of `cloudflared` with the following command.
@@ -147,13 +146,13 @@ Choose a website that you have added into your account.
 
 ![Choose Site](../static/secure-origin-connections/share-new-site/pick-site.png)
 
-Once you click one of the sites in your account, Cloudflare will download a certificate file to authenticate this instance of `cloudflared`. You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+Once you click one of the sites in your account, Cloudflare will download a certificate file to authenticate this instance of `cloudflared`. You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ### Connecting to Cloudflare
 
-You can now connect GitLab to Cloudflare using Argo Tunnel.
+You can now connect GitLab to Cloudflare using Cloudflare Tunnel.
 
 First, create a new Tunnel by running the following command.
 
@@ -165,7 +164,7 @@ cloudflared tunnel create gitlab
 
 ![Self Hosted](../static/zero-trust-security/gitlab/tunnel-create.png)
 
-Next, you will need to configure Argo Tunnel to proxy traffic to both destinations. The configuration below will take traffic bound for the DNS record that will be created for the web app and the DNS record to represent SSH traffic to the right port.
+Next, you will need to configure Cloudflare Tunnel to proxy traffic to both destinations. The configuration below will take traffic bound for the DNS record that will be created for the web app and the DNS record to represent SSH traffic to the right port.
 
 You use the text editor of your choice to edit the configuration file. The example relies on `Vi`.
 
@@ -287,10 +286,10 @@ You can now configure your Digital Ocean firewall with a single rule, block any
 
 ![Download Cert](../static/zero-trust-security/gitlab/disable-ingress.png)
 
-Argo Tunnel will continue to run outbound-only connections and I can avoid this machine getting caught up in a crypto mining operation, or something worse.
+Cloudflare Tunnel will continue to run outbound-only connections and I can avoid this machine getting caught up in a crypto mining operation, or something worse.
 
 ## View logs
 
-You can also view logs of the events that are allowed and blocked. Open the `Access` page of the `Logs` section in the Cloudflare for Teams dashboard.
+You can also view logs of the events that are allowed and blocked. Open the `Access` page of the `Logs` section in the Cloudflare for Teams Dashboard.
 
 ![View Logs](../static/zero-trust-security/gitlab/view-logs.png)
diff --git a/products/cloudflare-one/src/content/tutorials/gw-rollout-guide.md b/products/cloudflare-one/src/content/tutorials/gw-rollout-guide.md
deleted file mode 100644
index 17e7f293ab7..00000000000
--- a/products/cloudflare-one/src/content/tutorials/gw-rollout-guide.md
+++ /dev/null
@@ -1,241 +0,0 @@
----
-updated: 2021-03-23
-category: 🛡️ Web Gateway
----
-
-# Deploy Cloudflare's Secure Web Gateway
-
-Cloudflare Gateway feaures two modes:
-
-|Mode|On-Ramps|Description|
-|---|---|---|
-|**DNS filtering**|* Router or device resolver configuration <br />* Cloudflare WARP agent|A secure DNS recursive resolver built on top of the world's fastest DNS resolver, 1.1.1.1. Filter DNS queries from networks and devices|
-|**HTTP filtering**|* Cloudflare WARP agent|A forward proxy that sends all traffic leaving a device through an encrypted Wiregaurd tunnel to Cloudflare's network. Inspect and filter HTTP traffic, including file control and virus scanning|
-
-In both modes, Cloudflare Gateway filters traffic based on rules that you configure, including rules that can be applied based on user identity. Both deployment options log all events, including allowed queries and requests.
-
-Cloudflare recommends a phased deployment of Cloudflare Gateway that begins with DNS filtering for networks, extends DNS filtering to roaming devices with the WARP agent, and then uses the WARP agent and a certificate provided by Cloudflare to inspect and filter HTTP traffic.
-
-This guide walks through an end-to-end Gateway deployment that includes both modes. [Additional tutorials](https://developers.cloudflare.com/cloudflare-one/tutorials) are available for specific use cases.
-
-**🗺️ This tutorial covers how to:**
-
-1. Choose a Cloudflare for Teams plan
-1. Configure DNS filtering policies for networks and roaming users
-1. Deploy a lightweight agent for roaming users
-1. Enroll users and devices into your account
-1. Deploy HTTP filtering rules for roaming users in a phased rollout
-1. Enable HTTP filtering globally
-
-**⏲️ Time to complete:**
-
-45 minutes
-
-## Choose a Cloudflare for Teams plan
-
-Both modes Cloudflare Gateway is available in [three Cloudflare for Teams plans](https://www.cloudflare.com/teams-pricing/). The **Free** plan includes DNS and HTTP filtering for up to 50 users at no cost. The **Standard** plan allows your organization to deploy Gateway to 51 or more users and adds additional logging, support, and filtering features. The Cloudflare for Teams **Enterprise** plan includes additional features and support options.
-
-This deployment guide uses the **Free** plan. You do not need any additional Cloudflare subscriptions to use the Cloudflare for Teams **Free** plan.
-
-Begin by navigating to `dash.teams.cloudflare.com` and signing in with your Cloudflare account. If you do not have a Cloudflare account, create one.
-
-Choose **Cloudflare for Teams** and click **Get Started**.
-
-![Choose plan](../static/secure-web-gateway/gw-rollout-guide/pick-teams-onboard.png)
-
-Click **Next** to begin setting up your account.
-
-![Welcome](../static/secure-web-gateway/gw-rollout-guide/welcome-to-teams.png)
-
-Choose a name for your organization. This can be your company's name or an internal name for your team. End users in your organization will use this name to enroll into your account.
-
-![Choose name](../static/secure-web-gateway/gw-rollout-guide/choose-name.png)
-
-Next, select a Cloudflare for Teams plan. This tutorial uses the **Free** plan.
-
-![Choose plan](../static/secure-web-gateway/gw-rollout-guide/free-bundle.png)
-
-Click **Proceed to payment** and input payment details. Your card will not be charged on this plan.
-
-![Payment](../static/secure-web-gateway/gw-rollout-guide/confirm-free.png)
-
-## Configure a DNS filtering location
-
-After selecting a plan, you can start configuring Cloudflare Gateway. Click **Add a location** to begin setting up DNS filtering for your account.
-
-![Quick Start](../static/secure-web-gateway/gw-rollout-guide/quick-start.png)
-
-Cloudflare Gateway will create a default location for your account. This location can represent romaing users and a network.
-
-![Default Location](../static/secure-web-gateway/gw-rollout-guide/dns-filter-setup-location-start.png)
-
-If you are on an office or home network, you can configure this location to represent your network by returning to this page and clicking **Add IP**.
-
-![Default Location](../static/secure-web-gateway/gw-rollout-guide/dns-filter-add-ip.png)
-
-Cloudflare Gateway will gather the IP address you are currently using and set that as the source IP for your location. You will then need to change the settings of your router to use Cloudflare Gateway's destination IP as the network's recursive resolver.
-
-![Location List](../static/secure-web-gateway/gw-rollout-guide/dns-filter-location-list.png)
-
-## Configure a DNS filtering policy
-
-You can now create a DNS filtering policy that can apply to this location and others. Click on the `Policies` page in the `Gateway` section of the navigation bar. Click **Add a policy** to begin.
-
-![Add Policy](../static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-start.png)
-
-You can control DNS filtering by security risks, content categories, as well as custom resolution rules. Name your policy and toggle the locations where it should be applied. Next, select the **Security risks** tab.
-
-![Policy Overview](../static/secure-web-gateway/gw-rollout-guide/dns-filter-policy-overview.png)
-
-In the **Security risks** tab, click **Block all** to block DNS queries to websites that Cloudflare has flagged as security risks. You can add additional content-based rules or custom rules. Click **Save** to save the policy.
-
-![Policy Overview](../static/secure-web-gateway/gw-rollout-guide/dns-filter-sec-rules.png)
-
-Once saved, the policy will apply to any DNS queries made from the source IP of the location to the destination IP of Cloudflare Gateway's recursive DNS resolver.
-
-## Configure device policies
-
-You can extend Cloudflare Gateway's DNS filtering to roaming devices in any location by configuring the Cloudflare for Teams agent. This agent can also enable the HTTP filtering policies described later in this tutorial. To begin, select `Devices` under `My Team` in the navigation bar.
-
-![Device empty](../static/secure-web-gateway/gw-rollout-guide/device-empty.png)
-
-In the first step, click **Create an enrollment policy**. This policy will determine who can enroll a device into your Cloudflare for Teams account. The default policy allows a user in your organization's email domain to enroll, for example anyone with a `@cloudflare.com` email domain.
-
-You can customize the policy to:
-* integrate your identity provider for login,
-* allow additional users outside of your organization,
-* limit who can login further based on identity provider groups.
-
-![Device](../static/secure-web-gateway/gw-rollout-guide/device-create-policy.png)
-
-Next, download the Cloudflare for Teams agent, called the WARP client, for your system. You can also deploy this agent using a device management platform.
-
-![Device Download](../static/secure-web-gateway/gw-rollout-guide/device-download.png)
-
-Once downloaded, you will need the team name that you configured during the initial setup. The UI provides the name here to copy. You do not need the Cloudflare root certificate at this stage to configure DNS filtering for roaming agents.
-
-![Device Name](../static/secure-web-gateway/gw-rollout-guide/device-name.png)
-
-## Enroll the Cloudflare for Teams agent for DNS filtering
-
-You can use the Cloudflare for Teams agent to apply DNS filtering for a device on any network. The agent will configure the device to use the DNS-over-HTTPS hostname for the default location in your account. Any policies that apply to the default location will apply to the device and logs will be captured as well.
-
-<Aside>
-
-The following manual steps can be skipped for deployments to groups of end users using a managed device platform.
-
-</Aside>
-
-To begin, open the client on your machine. Click the gear icon.
-
-![Open client](../static/secure-web-gateway/gw-rollout-guide/warp-start.png)
-
-Click **Preferences**.
-
-![Warp pref](../static/secure-web-gateway/gw-rollout-guide/warp-pref.png)
-
-In the Preferences window, select the **Account** tab. Click **Login with Cloudflare for Teams**.
-
-![Warp Acct](../static/secure-web-gateway/gw-rollout-guide/warp-acct.png)
-
-Input your organization name and click **Done**.
-
-![Org Name](../static/secure-web-gateway/gw-rollout-guide/warp-acct-name.png)
-
-Enroll the device by inputting an email address that matches the device enrollment policy previously configured. Cloudflare will email you a code to complete enrollment. If you have configured an identity provider, you can click the identity provider to authenticate instead.
-
-![Enroll](../static/secure-web-gateway/gw-rollout-guide/warp-enroll.png)
-
-The enrollment will associate your device with your Cloudflare for Teams account and configure the DNS-over-HTTPS address to match your default location. To begin filtering DNS queries, click the gear icon again.
-
-![Configure](../static/secure-web-gateway/gw-rollout-guide/warp-post-enroll.png)
-
-Choose **Gateway with DoH** and toggle the setting to on.
-
-![With DoH](../static/secure-web-gateway/gw-rollout-guide/warp-with-doh.png)
-
-You can also view and revoke enrolled devices in the `Devices` page under `My Team`.
-
-![Device view](../static/secure-web-gateway/gw-rollout-guide/device-view.png)
-
-## Begin proxying all device traffic
-
-You can begin securing all traffic leaving the device using the same agent. To get started, navigate to the `Policies` page in the `Gateway` section of the navigation bar and click **Settings**.
-
-![Settings](../static/secure-web-gateway/gw-rollout-guide/settings-no-toggle.png)
-
-Toggle **Proxy Settings** to allow devices to begin proxying all traffic through Cloudflare's network. Do not enable **TLS Decrypt** at this stage.
-
-![Proxy Only](../static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-on.png)
-
-Next, return to the Cloudflare for Teams agent. Click the gear icon and switch from `Gateway with DoH` to `Gateway with WARP`. This setting can also be configured for automated deployments. Once enabled, all traffic leaving the device will be proxied through Cloudflare's network.
-
-![WARP On](../static/secure-web-gateway/gw-rollout-guide/warp-with-gateway.png)
-
-## Enable inspection
-
-You can now begin inspecting HTTP traffic from enrolled devices.
-
-First, [ensure that the Cloudflare root certificate is installed](/connections/connect-devices/warp/install-cloudflare-cert) on any enrolled device.
-
-Next, [exempt sites that break when decrypted](/tutorials/do-not-decrypt) from the list of inspected resources.
-
-Finally, return to the Settings page in the Cloudflare for Teams dashboard and enable **TLS Decrypt**.
-
-![Inspect](../static/secure-web-gateway/gw-rollout-guide/http-settings-proxy-inspect.png)
-
-Once enabled, Gateway will begin inspecting and logging all HTTP traffic from enrolled devices.
-
-## Apply HTTP policies to a group of users
-
-You can deploy in a phased rollout by creating security policies that only apply to a group of users in your organization. To begin, navigate to the `List` page in the `Configuration` sidebar.
-
-Click **Create manual list** to create a list of early adopters in your organization. You can also upload a CSV of the users.
-
-![Create List](../static/secure-web-gateway/gw-rollout-guide/list-create.png)
-
-Add users by email address who should be in the early adopter group.
-
-![Add Users](../static/secure-web-gateway/gw-rollout-guide/list-add-user.png)
-
-Click **Save** to save the list.
-
-![Save list](../static/secure-web-gateway/gw-rollout-guide/list-list.png)
-
-You can now begin building HTTP policies that apply to this group of users only. All other users will have traffic proxied and inspected, but not filtered.
-
-To begin, navigate to the **HTTP** tab in the `Policies` page of the Gateway section. Click **Create rule**.
-
-![Create rule](../static/secure-web-gateway/gw-rollout-guide/http-create.png)
-
-Click **Add a rule**.
-
-![HTTP default](../static/secure-web-gateway/gw-rollout-guide/http-default.png)
-
-This first rule will block security threats discovered in HTTP traffic. Select `Security Risks` from the Selector, choose `In` for the Operator, and click **All security risks** as the value.
-
-![HTTP Security](../static/secure-web-gateway/gw-rollout-guide/http-security.png)
-
-Next, click **+ Add Condition** to apply this rule to users in your early adopter group. Select `User Email` from the Selector, choose `in list` for the Operator, and click `Test Team` or the name of your early adopter list. Select `Block` for Action and click **Create rule**.
-
-![HTTP User Security](../static/secure-web-gateway/gw-rollout-guide/http-user-security.png)
-
-Your rule will now appear in the rule list.
-
-![Rule List](../static/secure-web-gateway/gw-rollout-guide/http-added-security.png)
-
-You can repeat this process to add a rule to block social media. Create a new rule and select `Application` from the Selector, `in` as the Operator, and in the value type in "Social Network" and choose the group that contains all catalogued networks or select or remove specific detinations.
-
-![Social](../static/secure-web-gateway/gw-rollout-guide/http-block-social.png)
-
-Repeate the identity-based rule, select `Block` as the Action and click **Create rule**.
-
-![Social](../static/secure-web-gateway/gw-rollout-guide/http-block-social.png)
-
-The rules will now appear in the rule list.
-
-![All Rules](../static/secure-web-gateway/gw-rollout-guide/http-all-rules.png)
-
-## Apply HTTP policies globally
-
-Once you are comfortable with the results in the early adopter group, you can appy these policies globally by removing the identity-based selector in your rules.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/identity-dns.md b/products/cloudflare-one/src/content/tutorials/identity-dns.md
index fb7bcda06a9..12c338295f6 100644
--- a/products/cloudflare-one/src/content/tutorials/identity-dns.md
+++ b/products/cloudflare-one/src/content/tutorials/identity-dns.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-04-27
 category: 🛡️ Web Gateway
+pcx-content-type: tutorial
 ---
 
 # Filter DNS based on users and groups
@@ -14,7 +15,9 @@ To apply these types of rules, you will need to deploy Cloudflare's agent on the
 * Build a DNS filtering rule that applies to a group of users
 * Use DNS filtering rule precedence to allow some users to reach a destination
 
-**⏲️ Time to complete: 10 minutes**
+**⏲️ Time to complete:**
+
+10 minutes
 
 ## Before you start
 
@@ -26,7 +29,7 @@ To apply these types of rules, you will need to deploy Cloudflare's agent on the
 
 ## Allow a team to reach social media
 
-Navigate to the Gateway section of the Cloudflare for Teams dashboard and open the `Policies` page. Select the `DNS` tab; if you see two `DNS` tabs, select the one marked `NEW`. Click **Create a DNS policy** to get started.
+Navigate to the Gateway section of the Cloudflare for Teams Dashboard and open the `Policies` page. Select the `DNS` tab; if you see two `DNS` tabs, select the one marked `NEW`. Click **Create a DNS policy** to get started.
 
 ![Start Process](../static/secure-web-gateway/id-dns/start-policy.png)
 
@@ -34,7 +37,7 @@ This first rule will allow users of your marketing team to reach social media. S
 
 ![Add Rule](../static/secure-web-gateway/id-dns/add-second-rule.png)
 
-Next, click **And** to add a second rule. In this rule, select **User Group Names**. You can also select individual user emails or group IDs, as well as locations. Input the name of the group in your identity provider that should be allowed to reach social media.
+Next, click **+Add condition** to add a second rule. In this rule, select **User Group Names**. You can also select individual user emails or group IDs, as well as locations. Input the name of the group in your identity provider that should be allowed to reach social media.
 
 In the **Action** section, select **Allow** and save the rule at the top of the page.
 
@@ -52,4 +55,8 @@ In the **Action** section, select **Block** and save the rule at the top of the
 
 ![Block Action](../static/secure-web-gateway/id-dns/block-action.png)
 
-Once saved, ensure that the `Allow` rule has higher precedence than the `Block` rule. You can drag-and-drop rules as needed in the UI. Rules are evaluated from top to bottom, so when the `Allow` rule is ranked first, users in the marketing group will be allowed to reach social media. Users who do not meet that criteria will have the next rule applied and will be blocked.
+Once saved, ensure that the `Allow` rule has higher precedence than the `Block` rule. You can drag-and-drop rules as needed in the UI.
+
+![Block Action](../static/secure-web-gateway/id-dns/rule-order.png)
+
+Rules are evaluated from top to bottom, so when the `Allow` rule is ranked first, users in the marketing group will be allowed to reach social media. Users who do not meet that criteria will have the next rule applied and will be blocked.
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/index.md b/products/cloudflare-one/src/content/tutorials/index.md
index 19712ec8a42..4a449ee9a43 100644
--- a/products/cloudflare-one/src/content/tutorials/index.md
+++ b/products/cloudflare-one/src/content/tutorials/index.md
@@ -2,6 +2,7 @@
 type: overview
 hideChildren: true
 order: 2
+pcx-content-type: navigation
 ---
 
 import DocsTutorial from "../components/content-table"
diff --git a/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md b/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md
new file mode 100644
index 00000000000..17afe962236
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md
@@ -0,0 +1,92 @@
+---
+updated: 2021-08-19
+category: 🔐 Zero Trust
+pcx-content-type: tutorial
+---
+
+# Integrate Microsoft MCAS with Teams
+
+Many security teams rely on Microsoft MCAS (Microsoft Cloud App Security), Microsoft's CASB solution, to identify and block threats on the Internet, as well as allow or block access to cloud applications. This tutorial covers how to integrate MCAS with Cloudflare for Teams, and create Gateway HTTP policies to ensure visibility and control over data.
+
+Microsoft provides an MCAS API endpoint to allow queries to see which applications have been marked as blocked or allowed. With an MCAS API call, you can manage a URL category that contains the blocked URLs returned by the API query, and use the output to create a Hostname List that can be used by Gateway HTTP policies to block them.
+
+
+**⏲️ Time to complete:**
+
+20 minutes
+
+## Basic configuration
+
+In your Microsoft account, you first need to create an API token and URL endpoint to use to query the URLs blocked by MCAS.
+Follow the guide for [Managing API tokens for Microsoft Cloud App Security](https://docs.microsoft.com/en-us/cloud-app-security/api-authentication) to generate a new API token and a custom API URL for the API endpoint.
+
+## Using the API to query banned applications
+
+Once you have the API token and API URL, use curl to get the list of banned applications from Microsoft MCAS:
+
+```txt
+curl -v "https://<MCAS API URL>/api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token <API token>"
+```
+
+This will return a list of banned hostnames. In this case, Angie's List is the banned application.
+
+![Banned hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-domains.png)
+
+### Processing the output
+
+As you can see, the banned hostnames are preceded by a `.`. To use this output for a Teams List, we need to do some text processing.
+
+1. Run the curl API call and direct the output to a file, in this case `mcas.txt`:
+
+    ```txt
+    curl -v "https://<MCAS API URL>/api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token <API token>" > mcas.txt
+    ```
+
+1. Remove the leading `.`, for example by running `sed` from the CLI: 
+
+    ```txt
+    sed -i 's/^.//' mcas.txt
+    ```
+
+1. This will give you the list of hostnames without leading `.`.
+
+1. Replace the file's `.txt` extension with `.csv`. The file can now be imported into Teams as a Hostname list.
+
+
+## Using the API to query allowed applications
+
+If you would like to get a list of all of the MCAS allowed applications, you can use the same API query, but instead of using `type=banned`, use `type=allowed`. This will return a much larger list.
+
+```sh
+curl -v "https://<MCAS API URL>/api/discovery_block_scripts/?format=120&type=allowed" -H "Authorization: Token <API token>"
+```
+
+## Adding a hostname list in the Teams Dashboard
+
+1. In the Teams Dashboard, navigate to **My Team** > **Lists**
+1. Click on **Upload CSV**. Even though the hostname list is not really in CSV format, it will work with no issues. 
+1. Add a name for the list, specify "Hostnames" as the list type, and give it a description.
+1. Drag and drop your MCAS output file created via the API call, or you can click **Select a file**.
+1. Click **Create**. You will see the list of hostnames that have been added to the list.
+1. Save the list.
+
+Your list is now ready to be referenced by Gateway HTTP policies.
+
+![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-list.png)
+
+## Creating an HTTP policy
+
+1. Navigate to **Gateway** > **Policies** > **HTTP policies**.
+1. Click **Create a policy**.
+
+    ![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-policy.png)
+
+1. Set the expression to:
+    * Selector: `Host`
+    * Operator: `In List`
+    * Value: your newly created list name.
+1. Set the Action to `Block`.
+
+Now when trying to visit one of the MCAS defined sites, the user will be blocked.
+
+![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-block-page.png)
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/kubectl.md b/products/cloudflare-one/src/content/tutorials/kubectl.md
index 06a8f23c19b..0de7b4c1d0f 100644
--- a/products/cloudflare-one/src/content/tutorials/kubectl.md
+++ b/products/cloudflare-one/src/content/tutorials/kubectl.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-03-23
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Connect through Cloudflare Access using kubectl
@@ -25,7 +26,7 @@ You can connect to machines over `kubectl` using Cloudflare's Zero Trust platfor
 
 ## Create a Zero Trust policy
 
-First, navigate to the [Cloudflare for Teams dashboard](https://dash.teams.cloudflare.com/) to create a new application. Select the `Applications` page from the sidebar. Click **Add application**.
+First, navigate to the [Cloudflare for Teams Dashboard](https://dash.teams.cloudflare.com/) to create a new application. Select the `Applications` page from the sidebar. Click **Add application**.
 
 ![App List](../static/zero-trust-security/ssh/app-list.png)
 
@@ -33,7 +34,7 @@ Choose **Self-hosted** on the next page.
 
 ![Add App](../static/zero-trust-security/ssh/add-app.png)
 
-Input a subdomain where your application will be availble to users.
+Input a subdomain where your application will be available to users.
 
 ![Configure](../static/zero-trust-security/ssh/configure-app.png)
 
@@ -47,13 +48,13 @@ Finally, click **Save** to save the policy. You can return to edit the policy to
 
 ## Install `cloudflared`
 
-Cloudflare Argo Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
+Cloudflare Tunnel creates a secure, outbound-only connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
 
-Argo Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install `cloudflared` with the commands below. You can find releases for other operating systems [here](https://github.com/cloudflare/cloudflared/releases).
+Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install `cloudflared` with the commands below. You can find releases for other operating systems [here](https://github.com/cloudflare/cloudflared/releases).
 
 ```sh
-sudo wget https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb
-sudo dpkg -i ./cloudflared-stable-linux-amd64.deb
+sudo wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+sudo dpkg -i ./cloudflared-linux-amd64.deb
 ```
 
 ## Authenticate `cloudflared`
@@ -68,15 +69,15 @@ $ cloudflared tunnel login
 
 Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel.
 
-## Create an Argo Tunnel
+## Create a Tunnel
 
-Next, [create an Argo Tunnel](/connections/connect-apps/create-tunnel) with the command below.
+Next, [create a Tunnel](/connections/connect-apps/create-tunnel) with the command below.
 
 ```sh
 $ cloudflared tunnel create <NAME>
 ```
 
-Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Argo Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
+Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
 
 The command will output an ID for the Tunnel and generate an associated credentials file. At any time you can list the Tunnels in your account with the following command.
 
diff --git a/products/cloudflare-one/src/content/tutorials/many-cfd-one-tunnel.md b/products/cloudflare-one/src/content/tutorials/many-cfd-one-tunnel.md
index 57f2b3a906e..29a254d331f 100644
--- a/products/cloudflare-one/src/content/tutorials/many-cfd-one-tunnel.md
+++ b/products/cloudflare-one/src/content/tutorials/many-cfd-one-tunnel.md
@@ -2,9 +2,10 @@
 updated: 2021-05-11
 category: 🌐 Connections
 Difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
-# Run the same Tunnel across many `cloudflared` processes
+# Use `cloudflared` to expose a Kubernetes app to the Internet
 
 You can use [Cloudflare Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network. Tunnel relies on a piece of software, [cloudflared](https://github.com/cloudflare/cloudflared), to create those connections.
 
@@ -23,7 +24,7 @@ This architecture allows `cloudflared` instances to proxy Internet traffic into
 
 ## Install `cloudflared`
 
-Start by [downloading and installing](/connections/connect-apps/install-and-setup/installation) the lightweight Cloudflare Tunnel daemon, `cloudflared`. Reference our installation guide for instructions on how to install `cloudflared` on your operating system. 
+Start by [downloading and installing](/connections/connect-apps/install-and-setup/installation) the lightweight Cloudflare Tunnel daemon, `cloudflared`. Reference our installation guide for instructions on how to install `cloudflared` on your operating system.
 
 ## Login to Cloudflare
 
@@ -44,7 +45,7 @@ Tunnel credentials written to /Users/cf000197/.cloudflared/ef824aef-7557-4b41-a3
 Created tunnel example-tunnel with id ef824aef-7557-4b41-a398-4684585177ad
 ```
 
-## Upload the Tunnel credentials file to Kubernetes 
+## Upload the Tunnel credentials file to Kubernetes
 
 Next, you will upload the generated Tunnel credential file as a secret to your Kubernetes cluster. You will also need to provide the filepath that the Tunnel credentials file was created under. You can find that path in the output of `cloudflared tunnel create <example-tunnel>` above.
 
@@ -57,15 +58,15 @@ $ kubectl create secret generic tunnel-credentials \
 
 1. Go to the Cloudflare dashboard.
 2. Navigate to the [DNS tab](https://dash.cloudflare.com/dns).
-3. Now create a CNAME targeting `.cfargotunnel.com`. In this example, the tunnel ID is ef824aef-7557-4b41-a398-4684585177ad, so create a CNAME record specifically targeting `ef824aef-7557-4b41-a398-4684585177ad.cfargotunnel.com`. 
+3. Now create a CNAME targeting `.cfargotunnel.com`. In this example, the tunnel ID is ef824aef-7557-4b41-a398-4684585177ad, so create a CNAME record specifically targeting `ef824aef-7557-4b41-a398-4684585177ad.cfargotunnel.com`.
 
 You can also create multiple CNAME records targeting the same Tunnel, if desired.
 
 ![Create CNAME](../static/secure-origin-connections/replica-support/create-cname.png)
 
 Alternatively, you can perform this step from the command line by running `cloudflared tunnel route dns <tunnel> <hostname>`. For example, `cloudflared tunnel route dns example-tunnel tunnel.example.com`. You can use a similar method to route traffic to `cloudflared` from a [Cloudflare Load Balancer](https://www.cloudflare.com/load-balancing/), see [docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb) for details.
-  
-## Deploy `cloudflared` 
+
+## Deploy `cloudflared`
 
 Now, we'll deploy `cloudflared` by applying its [manifest](https://github.com/cloudflare/argo-tunnel-examples/blob/master/named-tunnel-k8s/cloudflared.yaml). This will start a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) for running `cloudflared` and a [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) with `cloudflared`'s config. When Cloudflare receives traffic for the DNS or Load Balancing hostname you configured in the previous step, it will send that traffic to the `cloudflared` instances running in this deployment. Then, those `cloudflared` instances will proxy the request to your [application's Service](https://github.com/cloudflare/argo-tunnel-examples/blob/master/named-tunnel-k8s/app.yaml).
 
diff --git a/products/cloudflare-one/src/content/tutorials/migrate-lb-tunnel.md b/products/cloudflare-one/src/content/tutorials/migrate-lb-tunnel.md
index 9209e1fb2fd..7c2bba2e9eb 100644
--- a/products/cloudflare-one/src/content/tutorials/migrate-lb-tunnel.md
+++ b/products/cloudflare-one/src/content/tutorials/migrate-lb-tunnel.md
@@ -1,11 +1,12 @@
 ---
 updated: 2021-01-12
 category: 🌐 Connections
+pcx-content-type: tutorial
 ---
 
 # Migrate to Named Tunnels with Load Balancer
 
-Cloudflare Argo Tunnel is available in two deployment modes: "Legacy" Argo Tunnel and "Named" Argo Tunnel. [Named Argo Tunnel](https://blog.cloudflare.com/argo-tunnels-that-live-forever/) mode improves maintainability and stability by distinguishing between routing and configuration.
+Cloudflare Tunnel is available in two deployment modes: "Legacy" Tunnel and "Named" Argo Tunnel. [Named Tunnel](https://blog.cloudflare.com/argo-tunnels-that-live-forever/) mode improves maintainability and stability by distinguishing between routing and configuration.
 
 Unlike Legacy mode, Named Argo Tunnels give users the ability to manage routing in the Cloudflare dashboard and to run `cloudflared` once for [multiple services](https://blog.cloudflare.com/many-services-one-cloudflared/).
 
@@ -77,7 +78,7 @@ You can save the configuration file.
 
 ## Run the Tunnel
 
-You can now run the Tunnel. Running the Tunnel will connect `cloudflared` to Cloudflare's edge in a connection only avaialble to your account. You can use the Tunnel ID value to treat that connection like the IP address of an origin, without the risk of someone reaching it directly and bypassing Cloudflare.
+You can now run the Tunnel. Running the Tunnel will connect `cloudflared` to Cloudflare's edge in a connection only available to your account. You can use the Tunnel ID value to treat that connection like the IP address of an origin, without the risk of someone reaching it directly and bypassing Cloudflare.
 
 Run the following command, replacing `lisbon-app` with the name of your Tunnel.
 
@@ -89,7 +90,7 @@ $ cloudflared tunnel run lisbon-app
 
 ## Migrate the Load Balancer configuration
 
-You can now begin migrating your Load Balancer deployment to use the new Named Tunnel. Create a new Origin Pool in the Load Balancer.Add a new origin to the list.
+You can now begin migrating your Load Balancer deployment to use the new Named Tunnel. Create a new Origin Pool in the Load Balancer. Add a new origin to the list.
 
 In the origin address field, input the ID of the tunnel followed by `cfargotunnel.com`. In this example, the origin address value would be `6b9b8f72-b655-46fb-b008-a45366e26b48.cfargotunnel.com`.
 
diff --git a/products/cloudflare-one/src/content/tutorials/mongodb-tunnel.md b/products/cloudflare-one/src/content/tutorials/mongodb-tunnel.md
index d1f025d36f1..fb2e5fc01dc 100644
--- a/products/cloudflare-one/src/content/tutorials/mongodb-tunnel.md
+++ b/products/cloudflare-one/src/content/tutorials/mongodb-tunnel.md
@@ -2,11 +2,12 @@
 updated: 2020-12-29
 category: 🌐 Connections
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # MongoDB SSH
 
-You can build Zero Trust rules to secure connections to MongoDB deployments using Cloudflare Access and Argo Tunnel. Argo Tunnel requires a lightweight daemon, `cloudflared`, running alongisde the deployment and as on the client side.
+You can build Zero Trust rules to secure connections to MongoDB deployments using Cloudflare Access and Cloudflare Tunnel. Cloudflare Tunnel requires a lightweight daemon, `cloudflared`, running alongisde the deployment and as on the client side.
 
 In this tutorial, a client running `cloudflared` connects over SSH to a MongoDB deployment running on Kubernetes. The deployment example is structured to connect [Compass](https://www.mongodb.com/products/compass) to the MongoDB instance. The MongoDB Kubernetes deployment runs both the MongoDB database service and `cloudflared` as a ingress service that operates like a jump host.
 
@@ -14,7 +15,7 @@ In this tutorial, a client running `cloudflared` connects over SSH to a MongoDB
 
 * Create a Cloudflare Access rule to secure a MongoDB deployment
 * Configure a StatefulSet and service definition for the deployment
-* Configure an Argo Tunnel connection to Cloudflare's edge
+* Configure an Cloudflare Tunnel connection to Cloudflare's edge
 * Create an SSH configuration file for the client
 
 **⏲️ Time to complete:**
@@ -198,9 +199,9 @@ do sleep 30;
 done;
 ```
 
-## Configure Argo Tunnel
+## Configure Cloudflare Tunnel
 
-Next, you can use `cloudflared` to connect to Cloudflare's Edge using Argo Tunnel. Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`.
+Next, you can use `cloudflared` to connect to Cloudflare's Edge using Cloudflare Tunnel. Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`.
 
 Once installed, run the following command to authenticate the instance of `cloudflared` into your Cloudflare account.
 
@@ -212,13 +213,13 @@ The command will launch a browser window and prompt you to login with your Cloud
 
 Once you click one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes.
 
-You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ### Create a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
 
 Run the following command to create a Tunnel. You can replace `mongodb` with any name that you choose. This command requires the `cert.pem` file.
 
@@ -232,11 +233,11 @@ Cloudflare will create the Tunnel with that name and generate an ID and credenti
 
 The credentials file is separate from the `cert.pem` file. Unlike the `cert.pem` file, the credentials file consists of a token that authenticates only the Named Tunnel you just created. Formatted as `JSON`, the file cannot make changes to your Cloudflare account or create additional Tunnels.
 
-If you are done creating Tunnels, you can delete the `cert.pem` file, leave only the credentials file, and continue to manage DNS records directly in the Cloudflare dashboard or API. For additional information on the different functions of the two files, see the table in [this section](connections/connect-apps/create-tunnel).
+If you are done creating Tunnels, you can delete the `cert.pem` file, leave only the credentials file, and continue to manage DNS records directly in the Cloudflare dashboard or API. For additional information on the different functions of the two files, see the table in [this section](/connections/connect-apps/create-tunnel).
 
 Store the `JSON` file as a Kubernetes secret.
 
-### Configure Argo Tunnel
+### Configure Cloudflare Tunnel
 
 The previous setps used `cloudflared` to generate a credentials file for your Cloudflare account. When run as a service alongside the MongoDB Kubernetes deployment you will need to use a Docker image of `cloudflared`. Cloudflare makes an [official image available](https://hub.docker.com/r/cloudflare/cloudflared) in DockerHub.
 
diff --git a/products/cloudflare-one/src/content/tutorials/multi-origin.md b/products/cloudflare-one/src/content/tutorials/multi-origin.md
index 0b4f1e55bb7..7b4ce6f7ce6 100755
--- a/products/cloudflare-one/src/content/tutorials/multi-origin.md
+++ b/products/cloudflare-one/src/content/tutorials/multi-origin.md
@@ -2,11 +2,12 @@
 updated: 2020-12-03
 category: 🌐 Connections
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Connect multiple HTTP origins
 
-You can use [Argo Tunnel](/connections/connect-apps) to connect one or more applications and servers to Cloudflare's network. Argo Tunnel relies on a piece of software, `cloudflared`, to create those connections. Instead of pointing a DNS record to a public IP address and relying on IP-based network firewall rules, Argo Tunnel ensures traffic to your origin server passes through Cloudflare's network where firewall or Zero Trust rules can be applied.
+You can use [Cloudflare Tunnel](/connections/connect-apps) to connect one or more applications and servers to Cloudflare's network. Cloudflare Tunnel relies on a piece of software, `cloudflared`, to create those connections. Instead of pointing a DNS record to a public IP address and relying on IP-based network firewall rules, Cloudflare Tunnel ensures traffic to your origin server passes through Cloudflare's network where firewall or Zero Trust rules can be applied.
 
 You can deploy a single instance of `cloudflared` to proxy traffic to a single service with a single hostname or multiple destinations for multiple hostnames.
 
@@ -28,7 +29,7 @@ In this example, two resources are running and need to be connected to the Inter
 * a [Hugo site](https://gohugo.io/getting-started/quick-start/). Hugo, a static site generator, provides a built-in server that can be used for testing changes. That server is available at `localhost:1313`.
 * Grafana, a charting application. Grafana is available at `localhost:3000`
 
-Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
+Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
@@ -42,13 +43,13 @@ The command will launch a browser window and prompt you to login with your Cloud
 
 Once you click one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes.
 
-You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ## Create a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
 
 Run the following command to create a Tunnel. You can replace `new-website` with any name that you choose. This command requires the `cert.pem` file.
 
@@ -82,17 +83,15 @@ ingress:
   - service: http_status:404
 ```
 
-The configuration above will send traffic received for `grafana` to the Grafana address and traffic bound for `blog` to the Hugo address. The last service rule specifies a catch-all which will respond to requests that do not meet the previous rules. You must include a catch-all. In this case, the catch-all returns a 404.
+The configuration above will send traffic received for the `grafana` subdomain to the Grafana address and traffic bound for the `blog` subdomain to the Hugo address. The last service rule specifies a catch-all which will respond to requests that do not meet the previous rules. You must include a catch-all. In this case, the catch-all returns a 404.
 
 You can run the following command to validate the configuration file before you start your tunnel. If an error is present, `cloudflared` will alert you first.
 
 `$ cloudflared tunnel validate`
 
-If you are using the credentials file without the `cert.pem` file, you must specify the Tunnel ID in the `tunnel:` value. You cannot use the Name alone with the credentials file.
+## Run Cloudflare Tunnel
 
-## Run Argo Tunnel
-
-At this point, you have created and configured your Argo Tunnel connection. You can now [run](/connections/connect-apps/run-tunnel) that Tunnel. Running it will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
+At this point, you have created and configured your Cloudflare Tunnel connection. You can now [run](/connections/connect-apps/run-tunnel) that Tunnel. Running it will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
 
 `$ cloudflared tunnel run`
 
@@ -102,7 +101,11 @@ We recommend running `cloudflared` [as a service](/connections/connect-apps/run-
 
 You can now [route traffic](/connections/connect-apps/routing-to-tunnel) to your Tunnel, and on to both applications, using Cloudflare DNS. Visit the [Cloudflare dashboard](https://dash.cloudflare.com), select a website, and click on the `DNS` tab.
 
-Click `+Add record` and choose `CNAME`. In the `Name` field, add the name of the subdomain of your new site. In the `Content` field, paste the ID of your Tunnel created earlier and append `cfargotunnel.com`. Repeat this process for the second subdomain - they will both share the same Tunnel address.
+Click `+Add record` and choose `CNAME`. In the `Name` field, add the name of the subdomain of your new site. In this example, that would be `grafana` and `blog`.
+
+In the `Content` field, paste the ID of your Tunnel created earlier and append `cfargotunnel.com`. Repeat this process for the second subdomain - they will both share the same Tunnel address.
+
+For example, the `CNAME` entry for `grafana` and `blog` should point to the same value; in this example, that would be the following string:
 
 `5157d321-5933-4b30-938b-d889ca87e11b.cfargotunnel.com`
 
diff --git a/products/cloudflare-one/src/content/tutorials/okta-u2f.md b/products/cloudflare-one/src/content/tutorials/okta-u2f.md
index 6d18fa2ba95..d8d03c97ea0 100644
--- a/products/cloudflare-one/src/content/tutorials/okta-u2f.md
+++ b/products/cloudflare-one/src/content/tutorials/okta-u2f.md
@@ -2,6 +2,7 @@
 updated: 2020-12-07
 category: 🔐 Zero Trust
 difficulty: Medium
+pcx-content-type: tutorial
 ---
 
 # Require U2F with Okta
@@ -31,7 +32,7 @@ Before you begin, you'll need to follow [these instructions](/setup) to set up C
 
 ## Integrate Okta
 
-Follow [these instructions](https://developers.cloudflare.com/access/authentication/configuring-identity-providers/okta) to integrate Okta with your Cloudflare Access account.
+Follow [these instructions](https://developers.cloudflare.com/access/authentication/configuring-identity-providers/okta) to integrate Okta with your Cloudflare Access account. Once integrated, Access will be able to apply rules using identity, group membership, and multifactor method from Okta.
 
 ## Configure Okta for U2F
 
@@ -39,17 +40,19 @@ An Okta administrator in your organization must first [enable U2F support](https
 
 ## Test U2F in Access
 
-You can begin building U2F policies by testing your Okta integration. Navigate to the `Authentication` page in the `Access` section of the Cloudflare for Teams dashboard. Choose the row for Okta and click **Test**.
+You can begin building U2F policies by testing your Okta integration. 
+
+Navigate to the **Settings > Authentication** section of the Teams Dashboard. Next, choose the row for Okta and click **Test**.
 
 ![Test MFA](../static/zero-trust-security/require-yubikey/idp-list.png)
 
 Cloudflare Access will prompt you to login with your Okta account. For the purposes of the test, use a second factor option like an app-based code. Okta will return `amr` values to Cloudflare Access - these are standard indicators of multifactor methods shared between identity control systems.
 
-Since you used an app-based code, you will see `otp` in addition to `mfa` (you used an MFA option) and `pwd` (you logged in with a password).
+The `mfa` value is sent by Okta to tell Cloudflare Access that you used a multifactor authentication option. The `pwd` value indicates you used a password. In this example, the `otp` value is sent because the user authenticatd with an app-based code.
 
 ![Test MFA](../static/zero-trust-security/require-yubikey/with-mfa.png)
 
-Log out of Okta and return to the list of providers in Access. Click **Test** again, but this time use your hardware key as a second factor. Cloudflare Access will now see Okta share `hwk` in the `amr` fields.
+You can test with a hardkey by logging out of Okta and returning to the list of providers in Access. Click **Test** again, but this time use your hardware key as a second factor. Cloudflare Access will now see Okta share `hwk` in the `amr` fields.
 
 ![Test MFA](../static/zero-trust-security/require-yubikey/with-hwk.png)
 
diff --git a/products/cloudflare-one/src/content/tutorials/rdp.md b/products/cloudflare-one/src/content/tutorials/rdp.md
index 6235d76d361..d291886dae9 100644
--- a/products/cloudflare-one/src/content/tutorials/rdp.md
+++ b/products/cloudflare-one/src/content/tutorials/rdp.md
@@ -1,6 +1,7 @@
 ---
-updated: 2021-03-23
+updated: 2021-06-14
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Connect through Cloudflare Access over RDP
@@ -23,51 +24,58 @@ You can connect to machines over RDP using Cloudflare's Zero Trust platform.
 
 ## Create a Zero Trust policy
 
-First, navigate to the Cloudflare for Teams dashboard to create a new application. Select the `Applications` page from the sidebar. Click **Add application**.
+1. Navigate to the Teams Dashboard to create a new application.
 
-![App List](../static/zero-trust-security/ssh/app-list.png)
+1. Select the `Applications` page from the sidebar.
 
-Choose **Self-hosted** on the next page.
+1. Click **Add application**.
 
-![Add App](../static/zero-trust-security/ssh/add-app.png)
+  ![App List](../static/zero-trust-security/ssh/app-list.png)
 
-Input a subdomain where your application will be availble to users.
+1. Choose **Self-hosted** on the next page.
 
-![Configure](../static/zero-trust-security/ssh/configure-app.png)
+  ![Add App](../static/zero-trust-security/ssh/add-app.png)
 
-Next, create rules that control who can reach the application.
+1. Input a subdomain where your application will be available to users.
 
-![Add Rules](../static/zero-trust-security/ssh/app-rules.png)
+  ![Configure](../static/zero-trust-security/ssh/configure-app.png)
 
-Finally, click **Save** to save the policy. You can return to edit the policy to make changes to who should be allowed or to choose what authentication providers can be used.
+1. Next, create rules that control who can reach the application.
+
+  ![Add Rules](../static/zero-trust-security/ssh/app-rules.png)
+
+1. Finally, click **Save** to save the policy.
+
+You can always edit the policy to change who should be allowed access to the application, or to change which authentication providers can be used to access the application.
 
 ![Save](../static/zero-trust-security/ssh/save-app.png)
 
 ## Install `cloudflared`
 
-Cloudflare Argo Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
+Cloudflare Tunnel creates a secure, outbound-only connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
 
-Download the version of `cloudflared` that matches your architecture from the releases [available here](https://github.com/cloudflare/cloudflared/releases).
+1. Download the version of `cloudflared` that matches your architecture from the [available releases](https://github.com/cloudflare/cloudflared/releases).
 
-Place the `cloudflared` executable in a location accessible to the OS, for example:
+1. Place the `cloudflared` executable in a location accessible to the OS, for example:
 
-```sh
-C:\Cloudflared\bin\cloudflared.exe
-```
+  ```sh
+  C:\Cloudflared\bin\cloudflared.exe
+  ```
 
-Next, run `CMD` as an administrator to install the service.
+1. Next, run `CMD` as an administrator to install the service.
 
-```bash
-C:\Cloudflared\bin\cloudflared.exe service install
-```
+  ```bash
+  C:\Cloudflared\bin\cloudflared.exe service install
+  ```
 
-By default, the agent will run as a Local Account service and will look for the configuration and certificate file in the systemprofile.
+  By default, the agent will run as a Local Account service and will look for the configuration and certificate file in the systemprofile.
 
-Run the following command to create a new directory within systemprofile, replacing the `System32` value if needed to match your architecture.
+1. Run the following command to create a new directory within systemprofile, replacing the `System32` value if needed to match your architecture.
+
+  ```bash
+  mkdir C:\Windows\System32\config\systemprofile\.cloudflared
+  ```
 
-```bash
-mkdir C:\Windows\System32\config\systemprofile\.cloudflared
-```
 <Aside>
 
 Ensure that the machine's firewall permits egress on ports `80`, `443`, and `3389`, otherwise cloudflared will return an error.
@@ -76,110 +84,122 @@ Ensure that the machine's firewall permits egress on ports `80`, `443`, and `338
 
 ## Authenticate `cloudflared`
 
-Run the following command to authenticate cloudflared into your Cloudflare account.
+1. Run the following command to authenticate `cloudflared` into your Cloudflare account.
 
-```sh
-C:\Cloudflared\bin\cloudflared.exe login
-```
+ ```txt
+ C:\Cloudflared\bin\cloudflared.exe login
+ ```
 
-`cloudflared` will open a browser window and prompt you to login to your Cloudflare account. If you are working on a machine that does not have a browser, or a browser window does not launch, you can copy the URL from the command-line output and visit the URL in a browser on any machine.
+1. `cloudflared` will open a browser window and prompt you to login to your Cloudflare account.
 
-Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel.
+  If you are working on a machine that does not have a browser, or a browser window does not launch, you can copy the URL from the command-line output and visit the URL in a browser on any machine.
 
-Copy the file to the `systemprofile` directory created previously.
+1. Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel.
 
-```bash
-copy C:\Users\%USERNAME%\.cloudflared\cert.pem C:\Windows\System32\config\systemprofile\.cloudflared
-```
+1. Copy the file to the `systemprofile` directory created previously.
+
+ ```txt
+ copy C:\Users\%USERNAME%\.cloudflared\cert.pem C:\Windows\System32\config\systemprofile\.cloudflared
+ ```
 
-## Create an Argo Tunnel
+## Create a Tunnel
 
-Next, [create an Argo Tunnel](/connections/connect-apps/create-tunnel) with the command below.
+Next, [create a Tunnel](/connections/connect-apps/create-tunnel) with the command below.
 
 ```sh
 $ cloudflared tunnel create <NAME>
 ```
 
-Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Argo Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
+Replace `<NAME>` with a name for the Tunnel. This name can be any value. A single Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
 
 The command will output an ID for the Tunnel and generate an associated credentials file. At any time you can list the Tunnels in your account with the following command.
 
-```sh
-C:\Cloudflared\bin\cloudflared.exe tunnel create <NAME>
+```txt
+C:\Cloudflared\bin\cloudflared.exe tunnel list
 ```
 
 ## Configure the Tunnel
 
 You can now [configure the Tunnel](/connections/connect-apps/configuration) to serve traffic.
 
-Create a `YAML` file that `cloudflared` can reach. By default, `cloudflared` will look for the file in the same folder where `cloudflared` has been installed.
+1. Create a `YAML` file that `cloudflared` can reach. By default `cloudflared` will look for the file in the `C:\Users\%USERNAME%\.cloudflared\` folder of your Windows machine.
 
-Run `Notepad.exe` as an administrator. Next, configure the Tunnel, replacing the example ID below with the ID of the Tunnel created above. Additionally, replace the hostname in this example with the hostname of the application configured with Cloudflare Access.
+1. Run `Notepad.exe` as an administrator. Next, configure the Tunnel, replacing the example ID below in the first two lines with the ID of the Tunnel created above. Additionally, replace the hostname in this example with the hostname of the application configured with Cloudflare Access.
 
-```yaml
-tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
-credentials-file: C:\Users\%USERNAME%\.cloudflared\6ff42ae2-765d-4adf-8112-31c55c1551ef.json
+  ```yaml
+  tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
+  credentials-file: C:\Users\%USERNAME%\.cloudflared\6ff42ae2-765d-4adf-8112-31c55c1551ef.json
 
-ingress:
-  - hostname: azure.widgetcorp.tech
-    service: rdp://localhost:3389
-  - service: http_status:404
-  # Catch-all rule, which responds with 404 if traffic doesn't match any of
-  # the earlier rules
-```
+  ingress:
+    - hostname: azure.widgetcorp.tech
+      service: rdp://localhost:3389
+    - service: http_status:404
+    # Catch-all rule, which responds with 404 if traffic doesn't match any of
+    # the earlier rules
+  ```
 
-Save the file to the following location:
+1. Make sure the file is saved to the following location:
 
-```bash
-C:\Windows\System32\config\systemprofile\.cloudflared\config.yml
-```
+ ```txt
+ C:\Users\%USERNAME%\.cloudflared\config.yml
+ ```
+ 
+ with `%USERNAME%` being your Windows username (this is your user folder).
 
 ## Route to the Tunnel
 
+<Aside>
+ 
+<strong>IMPORTANT</strong>: Make sure you have enabled WebSockets in the "Network" section of your domain in the Cloudflare control panel:
+
+![Enable WebSockets](../static/zero-trust-security/ssh/enable-websockets.png)
+
+</Aside>
+
 You can now create a DNS record that will route traffic to this Tunnel. Multiple DNS records can point to a single Tunnel and will send traffic to the service configured as long as the hostname is defined with an [ingress rule](/connections/connect-apps/configuration/ingress).
 
-Navigate to `dash.cloudflare.com` and choose the hostname where you want to create a Tunnel. This should match the hostname of the Access policy. Click **+ Add record**.
+1. Navigate to `dash.cloudflare.com` and choose the hostname where you want to create a Tunnel. This should match the hostname of the Access policy. Click **+ Add record**.
 
-![DNS List](../static/zero-trust-security/ssh/dns-list.png)
+  ![DNS List](../static/zero-trust-security/ssh/dns-list.png)
 
-Select `CNAME` as the record type. For the target, input the ID of your Tunnel followed by `cfargotunnel.com`. In this example, the target would be:
+1. Select `CNAME` as the record type. For the target, input the ID of your Tunnel followed by `cfargotunnel.com`. In this example, the target would be:
 
-`6ff42ae2-765d-4adf-8112-31c55c1551ef.cfargotunnel.com`
+  `6ff42ae2-765d-4adf-8112-31c55c1551ef.cfargotunnel.com`
 
-Click **Save**.
+1. Click **Save**.
 
-![Add DNS](../static/zero-trust-security/ssh/add-dns.png)
+  ![Add DNS](../static/zero-trust-security/ssh/add-dns.png)
 
 ## Run the Tunnel
 
 You can now run the Tunnel to connect the target service to Cloudflare. Use the following command to run the Tunnel, replacing `<NAME>` with the name created for your Tunnel.
 
-```sh
-C:\Cloudflared\bin\cloudflared.exe tunnel run <NAME>
-```
+ ```txt
+ C:\Cloudflared\bin\cloudflared.exe tunnel run <NAME>
+ ```
 
 We recommend that you run `cloudflared` [as a service](/connections/connect-apps/run-tunnel/run-as-service) that is configured to launch on start.
 
 ## Connect from a client machine
 
-### 1. Install cloudflared On The Client Machine
+### Install `cloudflared` on the client machine
 
-Follow steps 1 through 3 above to download and install cloudflared on the client desktop that will connect to the remote desktop.
-cloudflared will need to be installed on each user device that will connect.
+Follow steps 1 through 3 above to download and install `cloudflared` on the client desktop that will connect to the remote desktop.
+`cloudflared` will need to be installed on each user device that will connect.
 
-### 2. Connect To The Remote Desktop
+### Connect to the remote desktop
 
-1. Run the following command to create a connection from the device to Cloudflare. Any available port can be specified.
+1. Run the following command to create a connection from the device to Cloudflare. Any available port can be specified, but in this example we will use `3389` as it is the default port for RDP connections.
 
-```bash
-\cloudflared.exe access rdp --hostname rdp.site.com --url localhost:2244
-```
+ ```txt
+ C:\Cloudflared\bin\cloudflared.exe access rdp --hostname rdp.site.com --url localhost:3389
+ ```
 
-This command can be wrapped as a desktop shortcut so that end users do not need to use the command line.
+ This command can be wrapped as a desktop shortcut so that end users do not need to use the command line.
 
-2. Open your RDP client and configure the client to point to `localhost:2244`. Do not input the hostname.
+1. Open your RDP client and configure the client to point to `localhost:3389`. Do not input the hostname.
 
-3. When the client launches, `cloudflared` will launch a browser window and prompt the user to authenticate with your SSO provider.
+1. When the client launches, `cloudflared` will launch a browser window and prompt the user to authenticate with your SSO provider.
 
 ## Configuring A Desktop Shortcut
 
@@ -189,14 +209,14 @@ You can help end users connect without requiring the command line by providing t
 
 1. Ensure that `cloudflared.exe` is installed on the end user device and available in the Windows Path.
 
-2. Right-click on the Windows desktop and select **New > Shortcut**.
+1. Right-click on the Windows desktop and select **New > Shortcut**.
 
-3. In the wizard that appears, paste in the following command with the hostname your team uses:
+1. In the wizard that appears, paste in the path to your `cloudflared.exe` file, followed by this command with the hostname your team uses:
 
-```sh
-$ cloudflared access rdp --hostname monday.example.com --url localhost:2244
-```
-4. Click **Next** and complete the wizard.
+ ```txt
+ C:\Cloudflared\bin\cloudflared.exe access rdp --hostname monday.example.com --url localhost:3389
+ ```
+1. Click **Next** and complete the wizard.
 
 At this point the shortcut will appear on the desktop, and users can launch with a double-click. The shortcut can then be distributed to end users along with `cloudflared`.
 
@@ -208,44 +228,39 @@ At this point the shortcut will appear on the desktop, and users can launch with
 
 ### MacOS
 
+<Aside type="note">
+  
+  Before you start, make sure you download an RDP client for macOS.
+  
+</Aside>
+
 MacOS users can save a command shortcut that will launch the RDP flow.
 
 1. The command below can be saved as a `.command` file that can be launched on login:
 
-```bash
-var=/Applications/CF-RDP-Tunnel.command &&
-echo "`which cloudflared` access rdp --hostname monday.example.com --url localhost:2244 &" > $var &&
-chmod +x $var
-```
+ ```txt
+ var=/Applications/CF-RDP-Tunnel.command &&
+ echo "`which cloudflared` access rdp --hostname monday.example.com --url localhost:3389 &" > $var &&
+ chmod +x $var
+ ```
 
-2. Check that everything is successful by running the following command:
+1. Check that everything is successful by running the following command:
 
-```sh
-$ lsof -nP -iTCP:2244 | grep LISTEN
-```
-If needed, you can kill the process by running the following command:
+ ```sh
+ $ lsof -nP -iTCP:3389 | grep LISTEN
+ ```
+ If needed, you can kill the process by running the following command: 
 
-```sh
-$ sudo kill -9 [process id]
-```
+ ```sh
+ $ sudo kill -9 [process id]
+ ```
 
-The command from Step 1 can then be configured to run at device login by navigating to **System Preferences > Users & Groups**.
+ The command from Step 1 can then be configured to run at device login by navigating to **System Preferences > Users & Groups**.
 
-3. Select the `+` sign.
+1. Select the `+` sign.
 
-4. Navigate to **Macintosh HD/Applications**.
+1. Navigate to **Macintosh HD > Applications**.
 
-5. Double click on the previously created `CF-RDP-Tunnel.command` file.
+1. Double click on the previously created `CF-RDP-Tunnel.command` file.
 
 The default behavior in MacOS is for the Terminal window to stay open. You can configure it to close automatically.
-
-<Aside>
-
-Ensure that the machine's firewall permits egress on ports `80`, `443`, and `2244`, otherwise cloudflared will return an error.
-</Aside>
-
-## Video Guides
-
-In this video, you’ll learn how to use Cloudflare Access to protect a Remote Desktop Protocol (RDP) connection by setting up a secure link with Argo Tunnel.
-
-<StreamVideo id="2a3073fb7881b4fcba4b9e3709dfaacf"/>
diff --git a/products/cloudflare-one/src/content/tutorials/require-swg.md b/products/cloudflare-one/src/content/tutorials/require-swg.md
index 82c8c7acc78..903d177814e 100644
--- a/products/cloudflare-one/src/content/tutorials/require-swg.md
+++ b/products/cloudflare-one/src/content/tutorials/require-swg.md
@@ -2,6 +2,7 @@
 updated: 2020-12-20
 category: 🔐 Zero Trust
 difficulty: Medium
+pcx-content-type: tutorial
 ---
 
 # Require Gateway connections
@@ -36,55 +37,61 @@ Building a rule in Access to enforce Gateway connections requires the use of the
 
 ## Determine which devices can enroll
 
-To proxy traffic through Gateway, devices must run the Cloudflare WARP client and [be enrolled in your Teams account](/connections/connect-devices/warp). When devices enroll, users will be prompted to authenticate with your identity provider or a consumer identity service. You can also deploy the client and its configurations [via a device management platform](/connections/connect-devices/warp/deployment) like JAMF or InTune.
+Next, build a rule to decide which devices can enroll in your account. 
 
-First, determine which devices can enroll based on user identity. If you have already integrated your identity provider when setting up Cloudflare Access you can reuse that integration. If you have not set up an identity provider, follow [these instructions](/setup) to add Access and integrate a free identity option or a specific provider.
+1. Navigate to **Settings > Devices > Device enrollment**.
 
-Next, build a rule to decide which devices can enroll into your Gateway account. Navigate to the `Devices` page in the `My Teams` section of the sidebar.
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
 
-![Device List](../static/secure-web-gateway/secure-dns-devices/device-page.png)
+1. Click **Manage**.
 
-Click `Device Settings` to build the enrollment rule. In the policy, define who should be allowed to enroll a device and click `Save`.
+1. Click **Add a rule**.
 
-![Enroll Rule](../static/secure-web-gateway/secure-dns-devices/enroll-rule.png)
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
 
-## Enroll a device
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
 
-Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
 
-Once installed, click the gear icon.
+1. Click **Save**.
 
-![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+Your rule will now be visible under the **Device enrollment rules** list.
 
-Under the `Account` tab, click `Login with Cloudflare for Teams`.
+## Configure the Cloudflare certificate
 
-![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below describes the manual distribution flow.
 
-Input your Cloudflare for Teams org name. You will have created this during the Cloudflare Access setup flow. You can find it under the `Authentication` tab in the `Access` section of the sidebar.
+To download the Cloudflare certificate:
+* Follow the link provided in [these instructions](/connections/connect-devices/warp/install-cloudflare-cert).
+* Find the certificate in the Teams Dashboard, by navigating to **Settings > Devices > Certificates**.
 
-![Org Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+## Enable the Cloudflare proxy
 
-The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to **Settings > Network**. Toggle **Proxy** to *Enabled*. This will tell Cloudflare to begin proxying any traffic from enrolled devices, except the traffic excluded using the [split tunnel](/connections/connect-devices/warp/exclude-traffic) settings.
 
-![Confirm WARP](../static/secure-web-gateway/block-uploads/with-warp.png)
+Next, enable TLS decryption. This will tell Cloudflare to begin decrypting traffic for inspection from enrolled devices, except the traffic excluded from inspection.
 
-## Configure the Cloudflare certificate
+![Policy settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
 
-To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below follows a manual distribution flow.
+## Enroll a device
+
+1. Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
 
-Download the Cloudflare certificate provided in the [instructions](/connections/connect-devices/warp/install-cloudflare-cert). You can also find the certificate in the Cloudflare for Teams dashboard. Navigate to the `Account` page in the `Settings` section of the sidebar and scroll to the bottom.
+1. Once the client is installed, click the gear icon.
 
-Next, follow [these instructions](/connections/connect-devices/warp/install-cloudflare-cert) to install the certificate on your system.
+    ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
 
-Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to the `Policies` page in the Gateway section. Scroll to the bottom and toggle `Proxy Settings` to enabled.
+1. Under the **Account** tab, click **Login with Cloudflare for Teams**.
 
-![Add Policy](../static/secure-web-gateway/block-uploads/filter-toggle.png)
+    ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
 
-## View enrolled devices
+1. Input your [team name](/glossary#team-name). You can find it on the Teams Dashboard under **Settings > General**.
 
-You can view enrolled devices and their associated users in the Cloudflare for Teams dashboard. To do so, navigate to the `My Teams` section and open the `Devices` page.
+    ![Team Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+
+The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
 
-![Add Policy](../static/zero-trust-security/require-swg/device-view.png)
+![Confirm WARP](../static/secure-web-gateway/block-football/warp-mode.png)
 
 ## Build a Gateway rule in Access
 
diff --git a/products/cloudflare-one/src/content/tutorials/review-gateway-block.md b/products/cloudflare-one/src/content/tutorials/review-gateway-block.md
index a7c8fc5a135..6799ec8d7fe 100644
--- a/products/cloudflare-one/src/content/tutorials/review-gateway-block.md
+++ b/products/cloudflare-one/src/content/tutorials/review-gateway-block.md
@@ -2,11 +2,12 @@
 updated: 2020-11-28
 category: 🛡️ Web Gateway
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Review Gateway blocks
 
-You can use Cloudflare Gateway and the Cloudflare WARP client application to filter and log DNS queries from devices on any network. You can also use Cloudflare Radar to review why a site has been blocked.
+You can use Cloudflare Gateway to filter and log DNS queries from devices on any network. You can also use Cloudflare Radar to review why a site has been blocked.
 
 **🗺️ This tutorial covers how to:**
 
@@ -20,43 +21,50 @@ You can use Cloudflare Gateway and the Cloudflare WARP client application to fil
 
 ## Before you start
 1. [Add Gateway to your account](/setup)
+2. Deploy Gateway rules to a network or group of [devices](/policies/filtering/dns-policies)
 
 ---
 
 ## Review Gateway events
 
-Once deployed, you can review which policies apply to which locations in the `Policies` page of the `Gateway` section in the Cloudflare for Teams dashboard.
+In this example, a Cloudflare Gateway DNS filtering rule has been applied to all locations to block social media.
 
-![Policies](../static/secure-web-gateway/review-gateway-block/policies.png)
+![Policies](../static/secure-web-gateway/review-gateway-block/block-social.png)
 
-To see how these impact real traffic, navigate to the `Gateway` page in the `Logs` section.
+Once deployed, Cloudflare Gateway will begin to block DNS queries to sites categorized by Cloudflare as social media networks. You can review each block in the Cloudflare for Teams dashboard.
 
-![Logs](../static/secure-web-gateway/review-gateway-block/logs-unfiltered.png)
+Navigate to the `Logs` section of the sidebar and choose `Gateway`.
 
-You can filter by date and by decision type. Select `Block` as the type to review blocked events.
+![Logs](../static/secure-web-gateway/review-gateway-block/logs-page.png)
 
-![Blocks Filter](../static/secure-web-gateway/review-gateway-block/blocks-filter.png)
+Click the **Filter** action to filter by date range, user, action, and policy. In this example, choose `Blocked` as the action taken.
 
-## Review block reason
+![Blocked](../static/secure-web-gateway/review-gateway-block/blocked.png)
 
-You can select any of the events in the logs view to review the initial reason for the block. In this example, the policy configured blocks Social Media, which is the category that `facebook.com` belongs to.
+You can expand the record to identify more information about the event, including user identity if you have deployed the [Cloudflare for Teams agent](/connections/connect-devices).
 
-![Blocks Filter](../static/secure-web-gateway/review-gateway-block/facebook-row.png)
+![Blocked Expand](../static/secure-web-gateway/review-gateway-block/blocked-expand.png)
 
-You can review more information in Cloudflare Radar, Cloudflare's Internet security and trends tool. Click `View domain details` to launch the Radar page for the hostname selected.
+## Review block reason
 
-![Radar](../static/secure-web-gateway/review-gateway-block/facebook-row.png)
+Review details about the domain blocked by Cloudflare by clicking **View domain details in Radar**. Cloudflare Radar provides information like site ranking, certificate history, and WHOIS information. If you believe the site was not categorized appropriately, click `Submit Categorization Feedback` beneath the `Content Categories` section.
 
-You can review information like site ranking, certificate history, and WHOIS information. If you believe the site was not categorized appropriately, click `Submit Categorization Feedback` beneath the `Content Categories` section.
+![Facebook Radar](../static/secure-web-gateway/review-gateway-block/facebook-radar.png)
 
 ## Override a rule
 
-If you need to allow a specific hostname immediately, you can override a hostname in a rule that takes precedence over content or security categories.
+If you need to allow a specific hostname that was blocked as part of a larger group, you can create an exception in Cloudflare Gateway.
+
+Return to the `Policies` page in the `Gateway` section. Add a new policy by clicking **Create a policy**.
+
+Choose `DNS Domain` and input the domain to be allowed as the value.  Select `Allow` as the action and create the policy.
+
+![Facebook Allow](../static/secure-web-gateway/review-gateway-block/allow-rule.png)
 
-Navigate to the policy being applied and click `Edit`. Select the `Custom` tab of the policy.
+Cloudflare Gateway enforces policies in an order from top-to-bottom. Drag the new policy to the top of the list.
 
-![Custom](../static/secure-web-gateway/review-gateway-block/custom.png)
+![Initial Order](../static/secure-web-gateway/review-gateway-block/before-order.png)
 
-Click `Add a destination`. In the next screen, select the `Allow` button and input the hostname that should override the category-based policies. Click save. This hostname will now resolve even if blocked by a content or security policy.
+Once added to the top of the list, DNS queries to this host will be allowed based on the first matching rule before DNS queries to other social media sites are blocked with the subsequent rules.
 
-![Custom](../static/secure-web-gateway/review-gateway-block/override.png)
\ No newline at end of file
+![Saved Order](../static/secure-web-gateway/review-gateway-block/after-order.png)
diff --git a/products/cloudflare-one/src/content/tutorials/salesforce-saas.md b/products/cloudflare-one/src/content/tutorials/salesforce-saas.md
index 3e477b79d83..5753453ecba 100644
--- a/products/cloudflare-one/src/content/tutorials/salesforce-saas.md
+++ b/products/cloudflare-one/src/content/tutorials/salesforce-saas.md
@@ -2,6 +2,7 @@
 updated: 2021-03-09
 category: 🔐 Zero Trust
 difficulty: Intermediate
+pcx-content-type: tutorial
 ---
 
 # Salesforce with Access for SaaS configuration
@@ -25,7 +26,7 @@ difficulty: Intermediate
 1. Select the SaaS application type. 
 1. Next, select *Salesforce* from the **Application** drop-down menu.
 1. Fill the remaining fields as follows:
-    * **Entity ID**: `https://salesforce.com`
+    * **Entity ID**: https://[YOUR_SFDC_DOMAIN].my.salesforce.com
     * **Assertion consumer service URL**: https://[YOUR_SFDC_DOMAIN].my.salesforce.com
     * **Name ID format**: Email
 1. Click **Next**.
@@ -52,8 +53,8 @@ difficulty: Intermediate
 
    ![Salefsorce configuration](../static/zero-trust-security/access/salesforce.png)
 
-2. Navigate to **Security Controls > Single Sign-On Settings**
-3. Set the following global settings:
+1. Navigate to **Security Controls > Single Sign-On Settings**.
+1. Set the following global settings:
     * **SAML Enabled:** true
     * **Make federation ID case-insensitive:** true
 
@@ -67,10 +68,16 @@ Configure as follows:
   * **API name:** (this will pre-populate)
   * **Issuer:** `<your-team-name>.cloudflareaccess.com`, where your-team-name is your [team name](/glossary#team-name).
   * **Identity Provider Certificate**: upload the `.crt` certificate file you’ve created in the previous step. 
-  * **EntityID**: `https://salesforce.com`
+  * **EntityID**: `https://[YOUR_SFDC_DOMAIN].my.salesforce.com`
   * **SAML Identity type:** Assertion contains the Federation ID from the User object
   * **Identity Provider Login URL**: This is the SSO endpoint provided in the Teams dashboard for that application.
 
 1. Click **Save**.
 
-  ![Salefsorce configuration](../static/zero-trust-security/access/salesforce-sso.png)
\ No newline at end of file
+  ![Salefsorce configuration](../static/zero-trust-security/access/salesforce-sso.png)
+  
+1. From the navigation panel on the left, click **Domain Management** > **My Domain** and select your domain.
+1. At the bottom, find **Authentication Configuration**. Click **Edit** and select your Authentication Service you created.
+1. (Optional) To force all users to sign in through Cloudflare Access:
+    1. Click **Security Controls** > **Single Sign-On Settings** > **Edit**. 
+    1. Click `Disable login with Salesforce credentials`.
diff --git a/products/cloudflare-one/src/content/tutorials/secure-dns-devices.md b/products/cloudflare-one/src/content/tutorials/secure-dns-devices.md
index e090756f424..49db64e21f6 100755
--- a/products/cloudflare-one/src/content/tutorials/secure-dns-devices.md
+++ b/products/cloudflare-one/src/content/tutorials/secure-dns-devices.md
@@ -1,71 +1,93 @@
 ---
 updated: 2020-11-30
 category: 🛡️ Web Gateway
-difficulty: Medium
+pcx-content-type: tutorial
 ---
 
 # Filter DNS on devices
 
-You can use Cloudflare Gateway and the Cloudflare WARP client application to filter and log DNS queries from devices on any network.
+You can use Cloudflare Gateway and the Cloudflare WARP client application to filter and log DNS queries from devices on any network. Cloudflare Gateway will continue to secure devices in any location by filtering all DNS queries using the WARP client on the roaming devices.
 
 **🗺️ This tutorial covers how to:**
 
 * Create a DNS filtering policy that secures devices by blocking malicious hostnames
 * Apply that policy to devices on any network
+* Enroll devices into a Cloudflare Gateway deployment
 
 **⏲️ Time to complete:**
 
-45 minutes
+30 minutes
 
+## Before you start
 1. [Add Gateway to your account](/setup)
 
-## Create a default location
+---
+
+## Create a DNS filtering policy
 
-When you [enable Cloudflare Gateway](/setup) for the first time, you will be prompted to configure your first location. You can use that Location to represent a physical office and/or roaming users.
+You can [build a policy](/policies/filtering/dns-policies) that will filter DNS queries for known malicious hostnames and other types of threats. Navigate to the `Policies` page. On the DNS tab, click `Create a DNS policy`.
 
-Start by navigating to the `Locations` page in the `Gateway` section of the sidebar. You will see the first location that you added has been set as the Default. Any device that enrolls into your Gateway account will follow the policies set for the default location by using the `DNS over HTTPS` address.
+![Add Policy](../static/secure-web-gateway/secure-dns-devices/start-filtering.png)
 
-![Add DNS](../static/secure-web-gateway/secure-dns-devices/locations.png)
+First, assign the policy a name and add an optional description. Next, build an expression to determine what is blocked.
 
-If you wish to [use a different Location](/connections/connect-networks/locations) as your Default, and subsequently the one used for roaming devices, click `Add a location`. During location creation, toggle the `Default location` toggle and the new location will be the Default.
+![Name Policy](../static/secure-web-gateway/secure-dns-devices/name-policy.png)
 
-![New Default](../static/secure-web-gateway/secure-dns-devices/new-default.png)
+In this example, the policy will block any hostnames that Cloudflare's data intelligence platform identifies as containing security risks like malware or phishing campaigns. You can click `All security risks` to include all options or check individual types of threats in the dropdown.
 
-## Create a Secure Web Gateway policy
+![Block Threats](../static/secure-web-gateway/secure-dns-devices/block-threats.png)
 
-Next, you can [build a policy](/policies/filtering/dns-policies) that will filter DNS queries for known malicious hostnames and other types of threats. Navigate to the `Policies` page. On the DNS tab, click `Add a policy`.
+The policy will block security threats for any location or device in your Cloudflare for Teams deployment. You can specify that this should only apply to specific locations or to specific users and [directory groups](/tutorials/identity-dns).
 
-![Add Policy](../static/secure-web-gateway/secure-dns-devices/add-policy.png)
+Choose `Block` as the action. You can optionally [enable a block page](/policies/filtering/configuring-block-page) that will be presented to users if they have the [Cloudflare certificate](/connections/connect-devices/warp/install-cloudflare-cert) on their devices. Click **Save policy** to conclude.
 
-Assign the policy a name and choose which locations will adhere to this policy. In this example, `Austin Office` is the only location and also the Default. Any devices which enroll will be grouped into this location using its `DNS over HTTPS` hostname.
+![Save Block](../static/secure-web-gateway/secure-dns-devices/save-dns-block.png)
 
-![Apply Policy](../static/secure-web-gateway/secure-dns-devices/apply-policy.png)
+The policy will now appear in your DNS policies list.
 
-Under the `Security threats` tab you can toggle which types of threats to block. In this case, choosing `Block all` will toggle all threats to be blocked.
+![Policy List](../static/secure-web-gateway/secure-dns-devices/dns-rule-list.png)
 
-![Block Rules](../static/secure-web-gateway/secure-dns-devices/block-rules.png)
+## Integrate your identity provider
 
-You can also configure content or custom blocks. Once complete, click `Save`.
+The DNS filtering policy created will apply to any DNS queries sent from configured locations or enrolled devices. You can begin to [enroll devices](/connections/connect-devices/warp/deployment) by determining which users are allowed to enroll.
+
+Navigate to the `Settings` section of the Cloudflare for Teams Dashboard and select `Authentication`. Cloudflare for Teams will automatically create a "One-time PIN" option which will rely on your user's emails. You can begin using the one-time PIN option immediately or you can also integrate your corporate [identity provider](/identity/idp-integration).
 
 ## Determine which devices can enroll
 
-Now that you have a default location and DNS filtering policy, you can [begin to enroll devices](/connections/connect-devices/warp/deployment). When devices enroll, users will be prompted to authenticate with your identity provider or a consumer identity service. By authenticating, you can attribute devices and DNS queries to users while also limiting who can enroll.
+Next, build a rule to decide which devices can enroll in your account. 
+
+1. Navigate to **Settings > Devices > Device enrollment**.
+
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
+
+1. Click **Manage**.
+
+1. Click **Add a rule**.
 
-To begin, you will need to enable Cloudflare Access for your account. Cloudflare Access provides the identity integration to enroll users. This feature of Cloudflare Access is available in the Teams Free plan or in the Gateway plan at no additional cost. Follow [these instructions](/setup) to add Access and integrate a free identity option or a specific provider.
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
 
-Next, build a rule to decide which devices can enroll into your Gateway account. Navigate to the `Devices` page in the `My Teams` section of the sidebar.
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
 
-![Device List](../static/secure-web-gateway/secure-dns-devices/device-page.png)
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
 
-Click `Device Settings` to build the enrollment rule. In the policy, define who should be allowed to enroll a device and click `Save`.
+1. Click **Save**.
 
-![Enroll Rule](../static/secure-web-gateway/secure-dns-devices/enroll-rule.png)
+## Collect your Team domain
+
+When you first created your Cloudflare for Teams account, the dashboard prompted you to choose a [team domain](/glossary#team-domain). The domain will be in the format `team.cloudflareaccess.com` where `team` is replaced with the [team name](/glossary#team-name) you selected.
+
+You will need this name to enroll devices. You can confirm the team name selected by visiting the `Settings` section of the dashboard and selecting `General`.
+
+![Device List](../static/secure-web-gateway/secure-dns-devices/team-name.png)
 
 ## Enroll a device
 
-You can use the WARP client to enroll a device into your security policies. Follow the [instructions here](/connections/connect-devices/warp) to install the client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+Your team members can run the WARP client to enroll in your Gateway account and send DNS queries to your configured policies. This section documents a self-serve user flow; you can alternatively [deploy the agent with an MDM](/connections/connect-devices/warp/deployment) so that users do not need to take any action.
 
-Once installed, click the gear icon.
+To begin the self-serve flow, follow the [instructions here](/connections/connect-devices/warp) to install the client depending on your device type.
+
+Once installed, click the logo in the toolbar and select the gear icon in the top right of the panel.
 
 ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
 
@@ -73,18 +95,22 @@ Under the `Account` tab, click `Login with Cloudflare for Teams`.
 
 ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
 
-Input your Cloudflare for Teams [team name](/glossary#team-name). You will have created this during the Cloudflare Access setup flow. You can find it under the `Authentication` tab in the `Access` section of the sidebar.
+Input the Cloudflare for Teams [team name](/glossary#team-name).
 
 ![Org Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
 
-The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you only need DNS filtering.
+The user will be prompted to login with the identity provider configured or with the one-time PIN flow.
+
+![Login](../static/secure-web-gateway/secure-dns-devices/login.png)
+
+Once authenticated, the client will update to `Teams` mode.
 
-![DoH](../static/secure-web-gateway/secure-dns-devices/with-doh.png)
+![Team Mode](../static/secure-web-gateway/secure-dns-devices/team-mode.png)
 
-You can confirm that the device is using the default location under the `Connection` tab. The DoH address will match that of the default location.
+You can click the gear to toggle between `Gateway with DoH`, which only filters DNS, or `Gateway with WARP`, which functions as a full forward proxy and can filter HTTP requests. In this use case, you only need DNS filtering.
 
-![Confirm DoH](../static/secure-web-gateway/secure-dns-devices/doh-subdomain.png)
+![DoH](../static/secure-web-gateway/secure-dns-devices/doh-mode.png)
 
-## Optional: deploy via MDM
+## Review logs and devices
 
-You can deploy the WARP client on corporate devices in a way that does not require users to configure the Org Name. To do so, [follow these instructions](/connections/connect-devices/warp/deployment).
\ No newline at end of file
+As users enroll, you can review the users and associated devices by visiting the `My Team` section of the dashboard. You can also [review logs](/tutorials/review-gateway-block) in the `Logs` section by selecting `Gateway`. To add identity into the logs, your users will need to switch to `Gateway with WARP` mode.
diff --git a/products/cloudflare-one/src/content/tutorials/secure-dns-network.md b/products/cloudflare-one/src/content/tutorials/secure-dns-network.md
index f4ce54236f0..80381476edf 100755
--- a/products/cloudflare-one/src/content/tutorials/secure-dns-network.md
+++ b/products/cloudflare-one/src/content/tutorials/secure-dns-network.md
@@ -2,11 +2,12 @@
 updated: 2020-11-28
 category: 🛡️ Web Gateway
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Filter DNS on home or office network
 
-You can use Cloudflare Gateway to filter and log DNS queries from any device using your network without installing client software.
+You can use Cloudflare Gateway to filter and log DNS queries from any device in your network without installing client software.
 
 **🗺️ This tutorial covers how to:**
 
@@ -17,6 +18,9 @@ You can use Cloudflare Gateway to filter and log DNS queries from any device usi
 
 15 minutes
 
+## Before you start
+1. [Add Gateway to your account](/setup)
+
 ---
 
 ## Configure Cloudflare Gateway
@@ -37,19 +41,27 @@ If you want to create a different location, one that you are not currently using
 
 ## Create a Gateway policy
 
-Next, you can [build a policy](/policies/filtering/dns-policies) that will filter DNS queries for known malicious hostnames and other types of threats. Navigate to the `Policies` page. On the DNS tab, click `Add a policy`.
+Next, you can [build a policy](/policies/filtering/dns-policies) that will filter DNS queries for known malicious hostnames and other types of threats. Navigate to the `Policies` page. On the DNS tab, click `Create a DNS policy`.
+
+![Add Policy](../static/secure-web-gateway/secure-dns-network/create-dns-policy.png)
+
+First, assign the policy a name and add an optional description. Next, build an expression to determine what is blocked.
+
+In this example, the policy will block any hostnames that Cloudflare's data intelligence platform identifies as containing security risks like malware or phishing campaigns. You can click `All security risks` to include all options or check individual types of threats in the dropdown.
+
+![Block Threats](../static/secure-web-gateway/secure-dns-network/block-threats.png)
 
-![Add Policy](../static/secure-web-gateway/secure-dns-devices/add-policy.png)
+The policy will block security threats for any location in your Cloudflare for Teams deployment. If you want to only block the security risks selected above for the location created previously, add an `AND` rule to the selector. Choose `Location` and check the location to include in this policy.
 
-Assign the policy a name and choose which locations will adhere to this policy. In this example, `Austin Office` is the only location and also the Default.
+![Include Location](../static/secure-web-gateway/secure-dns-network/include-location.png)
 
-![Apply Policy](../static/secure-web-gateway/secure-dns-devices/apply-policy.png)
+Finally, choose `Block` as the action and create the policy.
 
-Under the `Security threats` tab you can toggle which types of threats to block. In this case, choosing `Block all` will toggle all threats to be blocked.
+![Block Action](../static/secure-web-gateway/secure-dns-network/block-action.png)
 
-![Block Rules](../static/secure-web-gateway/secure-dns-devices/block-rules.png)
+The rule will appear in your DNS policies list.
 
-You can also configure content or custom blocks. Once complete, click `Save`. The policy will now filter DNS queries from that location once you have configured your router.
+![Rule Listed](../static/secure-web-gateway/secure-dns-network/rule-listed.png)
 
 ## Configure your router
 
diff --git a/products/cloudflare-one/src/content/tutorials/share-new-site.md b/products/cloudflare-one/src/content/tutorials/share-new-site.md
index ea31dd8e030..bb62163bd44 100755
--- a/products/cloudflare-one/src/content/tutorials/share-new-site.md
+++ b/products/cloudflare-one/src/content/tutorials/share-new-site.md
@@ -2,15 +2,16 @@
 updated: 2020-11-28
 category: 🌐 Connections
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Share development environments
 
-You can use Cloudflare's reverse proxy and [Argo Tunnel](/glossary#argo-tunnel) to share local development environments with team members or customers.
+You can use Cloudflare's reverse proxy and [Cloudflare Tunnel](/glossary#cloudflare-tunnel) to share local development environments with team members or customers across the Internet.
 
-Instead of pointing DNS records to the external IP of a web service, you can connect that service to Cloudflare's network using Argo Tunnel. Argo Tunnel relies on a lightweight service, `cloudflared`, that you run in your infrastructure. `cloudflared` makes outbound-only connections to Cloudflare's network, so that you do not need to open holes in your firewall.
+Instead of pointing DNS records to the external IP of a web service, you can connect that service to Cloudflare's network using Cloudflare Tunnel. Cloudflare Tunnel relies on a lightweight service, `cloudflared`, that you run in your infrastructure. `cloudflared` makes outbound-only connections to Cloudflare's network, so that you do not need to open holes in your firewall.
 
-You can use Argo Tunnel to quickly share projects you are working on with team members. In this example, you can use Argo Tunnel to give users a preview of a new website. At the end, as an optional step, you'll be able to add a [Zero Trust policy](/policies/zero-trust) to only allow certain people to reach the site.
+You can use Cloudflare Tunnel to quickly share projects you are working on with team members without a virtual private network (VPN). In this example, you can use Cloudflare Tunnel to give users a preview of a new website. At the end, as an optional step, you'll be able to add a [Zero Trust policy](/policies/zero-trust) to only allow certain people to reach the site.
 
 **🗺️ This tutorial covers how to:**
 
@@ -18,7 +19,9 @@ You can use Argo Tunnel to quickly share projects you are working on with team m
 * Give that application a hostname where users can reach the resource
 * Optionally require a simple login to reach the application with Cloudflare Access
 
-**⏲️ Time to complete: ~30 minutes**
+**⏲️ Time to complete:**
+
+15 minutes
 
 ## Before you start
 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
@@ -33,7 +36,7 @@ In this example, the new website is a [Hugo site](https://gohugo.io/getting-star
 
 ![New Hugo](../static/secure-origin-connections/share-new-site/hugo-new.png)
 
-To share this work-in-progress with an audience on the Internet, start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
+To share this work-in-progress, start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
@@ -41,17 +44,17 @@ Once installed, run the following command in your Terminal to authenticate this
 
 `$ cloudflared login`
 
-The command will launch a browser window and prompt you to login with your Cloudflare account. Choose a website that you have added into your account.
+The command will launch a browser window and prompt you to login with your Cloudflare account. Choose a website that you have added into your Cloudflare account. The website selected does not need to be the website where the environment will be made available.
 
 ![Choose Site](../static/secure-origin-connections/share-new-site/pick-site.png)
 
-Once you click one of the sites in your account, Cloudflare will download a certificate file to authenticate this instance of `cloudflared`. You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+Once you click one of the sites in your account, Cloudflare will download a certificate file to authenticate this instance of `cloudflared`. You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ## Create a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step.
 
 Run the following command to create a Tunnel. You can replace `new-website` with any name that you choose.
 
@@ -69,7 +72,7 @@ By default, `cloudflared` expects the configuration file at a specific location:
 
 `$ vim ~/.cloudflared/config.yml`
 
-The `url` value is the destination where the new website is available locally. The `tunnel` and `credentials-file` value can be copied from the output of the last command.
+The `url` value is the destination where the new website is available locally. The `tunnel` and `credentials-file` value can be copied from the output of the last command where you created the Tunnel.
 
 ```yml
 url: http://localhost:1313
@@ -77,9 +80,9 @@ tunnel: 5157d321-5933-4b30-938b-d889ca87e11b
 credentials-file: /Users/username/.cloudflared/5157d321-5933-4b30-938b-d889ca87e11b.json
 ```
 
-## Run Argo Tunnel
+## Run Cloudflare Tunnel
 
-At this point, you have created and configured your Argo Tunnel connection. You can now [run that](https://developers.cloudflare.com/argo-tunnel/create-tunnel) Tunnel. Running it will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
+At this point, you have created and configured your Cloudflare Tunnel connection. You can now [run the Tunnel](/connections/connect-apps/create-tunnel). Running the Tunnel will create connections to Cloudflare's edge. Those connections will not respond to traffic, yet. You'll add DNS records in the next step to share the resource across the Internet.
 
 `$ cloudflared tunnel run`
 
@@ -93,10 +96,12 @@ Click `+Add record` and choose `CNAME`. In the `Name` field, add the name of the
 
 ![Add DNS](../static/secure-origin-connections/share-new-site/add-dns.png)
 
-Alternatively, you can create a DNS record from `cloudflared` directly.
-
 Once saved, you can share the subdomain created and visitors can reach your local web server environment.
 
+Alternatively, you can create a DNS record from `cloudflared` directly. To do so, run the following command, replacing the `UUID` value and DNS record with your own equivalents.
+
+`$ cloudflared tunnel route 5157d321-5933-4b30-938b-d889ca87e11b new-website.mopacthedog.com`
+
 ## Optional: Add a Zero Trust policy
 
 When you create the DNS record, any visitor will be able to view that new site. You can restrict the audience to certain users by adding a rule in Cloudflare Access. You can also build this Access rule before creating the DNS record so that the site is never accessible to the rest of the Internet.
@@ -111,7 +116,7 @@ Choose self-hosted from the options presented.
 
 ![App Picker](../static/secure-origin-connections/share-new-site/self-hosted.png)
 
-In the policy builder, add the subdomain of your new DNS record that represents your Argo Tunnel connection.
+In the policy builder, add the subdomain of your new DNS record that represents your Cloudflare Tunnel connection.
 
 ![App Picker](../static/secure-origin-connections/share-new-site/configure-app.png)
 
@@ -121,4 +126,4 @@ You can then add rules to determine who can reach the site.
 
 ## Additional Materials
 
-* You can use this model to [share more complex development environments](https://blog.cloudflare.com/how-argo-tunnel-engineering-uses-argo-tunnel/) with other team members.
\ No newline at end of file
+* You can use this model to [share more complex development environments](https://blog.cloudflare.com/how-argo-tunnel-engineering-uses-argo-tunnel/) with other team members.
diff --git a/products/cloudflare-one/src/content/tutorials/single-command.md b/products/cloudflare-one/src/content/tutorials/single-command.md
index b12c54c299b..de99971d449 100755
--- a/products/cloudflare-one/src/content/tutorials/single-command.md
+++ b/products/cloudflare-one/src/content/tutorials/single-command.md
@@ -2,19 +2,20 @@
 updated: 2021-02-16
 category: 🌐 Connections
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Create and connect an application with a single command
 
-You can use [Argo Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network. Argo Tunnel relies on a piece of software, `cloudflared`, to create those connections.
+You can use [Cloudflare Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network. Cloudflare Tunnel relies on a piece of software, `cloudflared`, to create those connections.
 
-Argo Tunnels are [persistent objects](https://blog.cloudflare.com/argo-tunnels-that-live-forever/) that, once created, do not need to be recreated each time. The connections inside of an Argo Tunnel are ephemeral; your service can restart or be taken offline without deleting and recreating the Tunnel or associated DNS entries.
+Tunnels are [persistent objects](https://blog.cloudflare.com/argo-tunnels-that-live-forever/) that, once created, do not need to be recreated each time. The connections inside of a Tunnel are ephemeral; your service can restart or be taken offline without deleting and recreating the Tunnel or associated DNS entries.
 
-You can create and configure Argo Tunnel connections to [support multiple HTTP origins](/tutorials/multi-origin) or [multiple protocols simultaneously](/tutorials/gitlab). Doing so requires the use of a [configuration file](/connections/connect-apps/configuration/config), which Cloudflare recommends in most use cases. However, if you want to quickly spin up a new Tunnel, you can also use a single command to create, run, and route traffic to an Argo Tunnel.
+You can create and configure Cloudflare Tunnel connections to [support multiple HTTP origins](/tutorials/multi-origin) or [multiple protocols simultaneously](/tutorials/gitlab). Doing so requires the use of a [configuration file](/connections/connect-apps/configuration/config), which Cloudflare recommends in most use cases. However, if you want to quickly spin up a new Tunnel, you can also use a single command to create, run, and route traffic to a Tunnel.
 
 <Aside>
 
-If you are migrating from "classic" Argo Tunnel deployments to the new, persistent, model you can [follow the instructions](/tutorials/migrate-lb-tunnel) to migrate without downtime.
+If you are migrating from "classic" Cloudflare Tunnel deployments to the new, persistent, model you can [follow the instructions](/tutorials/migrate-lb-tunnel) to migrate without downtime.
 
 </Aside>
 
@@ -32,7 +33,7 @@ If you are migrating from "classic" Argo Tunnel deployments to the new, persiste
 
 ## Install `cloudflared`
 
-Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
+Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
@@ -46,15 +47,15 @@ The command will launch a browser window and prompt you to login with your Cloud
 
 Once you click one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes.
 
-You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
 ## Create and run a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. In this example, you can use a single command to perform all of the steps required to connect an application to Cloudflare's edge. The command will perform the following functions:
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge. In this example, you can use a single command to perform all of the steps required to connect an application to Cloudflare's edge. The command will perform the following functions:
 
-1. [Create an Argo Tunnel](/connections/connect-apps/create-tunnel) with an associated name. That Argo Tunnel can serve traffic for multiple services and multiple hostnames; this example uses a single service and single hostname.
+1. [Create a Tunnel](/connections/connect-apps/create-tunnel) with an associated name. That Tunnel can serve traffic for multiple services and multiple hostnames; this example uses a single service and single hostname.
 2. [Create DNS records](/connections/connect-apps/routing-to-tunnel) for the Tunnel. These DNS records will send traffic to the Tunnel. The records created will not be deleted if the Tunnel is interrupted or if `cloudflared` or your origin service restarts.
 3. [Configure the Tunnel](/connections/connect-apps/configuration) by sending traffic to the URL specified. In this example, the only configuration argument required is the URL where traffic should be directed.
 4. [Run the Tunnel](/connections/connect-apps/run-tunnel) and begin serving traffic.
diff --git a/products/cloudflare-one/src/content/tutorials/smb.md b/products/cloudflare-one/src/content/tutorials/smb.md
index e45dda302e8..80ce30ff498 100644
--- a/products/cloudflare-one/src/content/tutorials/smb.md
+++ b/products/cloudflare-one/src/content/tutorials/smb.md
@@ -1,13 +1,14 @@
 ---
 updated: 2021-03-30
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
-# SMB file shares
+# Connect through Cloudflare Access to SMB file shares
 
 The Server Message Block (SMB) protocol allows users to access, read, and write to shared files. Cloudflare for Teams provides a mechanism for end users to authenticate with their single sign-on (SSO) provider and connect to shared files over SMB without being on a virtual private network (VPN).
 
-You can set up this connection by downloading and installing the Cloudflare daemon, `cloudflared`, on the machine hosting the file share and on the client machine. `cloudflared` will maintain a secure, persistent, outbound-only connection from the machine to Cloudflare. SMB traffic will then be proxied over this connection using [Argo Tunnel](https://www.cloudflare.com/products/argo-tunnel/). 
+You can set up this connection by downloading and installing the Cloudflare daemon, `cloudflared`, on the machine hosting the file share and on the client machine. `cloudflared` will maintain a secure, persistent, outbound-only connection from the machine to Cloudflare. SMB traffic will then be proxied over this connection using [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/).
 
 🗺️ This walkthrough covers how to:
 1. [How to connect the machine hosting the file share to Cloudflare](#host-machine)
diff --git a/products/cloudflare-one/src/content/tutorials/split-tunnel.md b/products/cloudflare-one/src/content/tutorials/split-tunnel.md
index 93b8f5e45f3..674ee73f083 100644
--- a/products/cloudflare-one/src/content/tutorials/split-tunnel.md
+++ b/products/cloudflare-one/src/content/tutorials/split-tunnel.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-02-02
 category: 🛡️ Web Gateway
+pcx-content-type: tutorial
 ---
 
 # Configure local domains and split tunnel mode
@@ -22,47 +23,31 @@ You can configure Cloudflare for Teams to exclude domains and IP addresses from
 
 You can configure domains to use the device's local resolver. Cloudflare for Teams excludes a list of domains by default and you can also remove those default domains if needed.
 
-Navigate to the `Policies` page in the `Gateway` section of the Cloudflare for Teams dashboard.
+1. On the Teams Dashboard, navigate to **Settings > Network**.
 
-![Policies](../static/secure-web-gateway/split-tunnel/policies-page.png)
+1. Scroll down to **Local Domain Fallback** and click **Manage**.
 
-Click on the **Settings** tab.
+    ![Network Settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
 
-![Settings](../static/secure-web-gateway/split-tunnel/settings-page.png)
+By default, Cloudflare for Teams excludes common top-level domains used for local resolution. Everything listed will be excluded. To delete a default domain from this list, toggle the box to the left of the domain name and click **Confirm delete**.
 
-Scroll to the bottom of the `Settings`. Click **Manage Local Domains**.
-
-![Settings End](../static/secure-web-gateway/split-tunnel/settings-end.png)
-
-By default, Cloudflare for Teams excludes common top-level domains used for local resolution. Everything listed will be excluded. To include a default domain, toggle the box to the left of the domain name and click **Delete**.
-
-To exclude a domain not in the default list, input the domain in the `Domain` field of the `Add Local Domain Record` card. You can add an optional description. Click **Add**.
-
-![Split Tunnel](../static/secure-web-gateway/split-tunnel/local-resolution.png)
-
-Domains on the list will rely on the local DNS resolver configured for the device.
+To add a domain to the default list, input the domain in the `Domain` field. You can add an optional description and click **Add**.
 
 ## Configure split tunnel mode
 
 You can deploy Cloudflare for Teams in split tunnel mode and exclude IP addresses for devices enrolled in your account.
 
-Navigate to the `Policies` page in the `Gateway` section of the Cloudflare for Teams dashboard.
-
-![Policies](../static/secure-web-gateway/split-tunnel/policies-page.png)
-
-Click on the **Settings** tab.
-
-![Settings](../static/secure-web-gateway/split-tunnel/settings-page.png)
+1. On the Teams Dashboard, navigate to **Settings > Network**.
 
-Scroll to the bottom of the `Settings`. Click **Split Tunnels**.
+1. Scroll down to **Local Domain Fallback** and click **Manage**.
 
-![Settings End](../static/secure-web-gateway/split-tunnel/settings-end.png)
+    ![Network Settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
 
-By default, Cloudflare for Teams excludes IP addresses commonly used for private routing, including those defined in [RFC 1918](https://tools.ietf.org/html/rfc1918). Everything listed in the page will be excluded. To include an IP address already excluded, toggle the box to the left of the IP address range and click **Delete**.
+By default, Cloudflare for Teams excludes IP addresses commonly used for private routing, including those defined in [RFC 1918](https://tools.ietf.org/html/rfc1918). Everything listed under **Split Tunnel entries** will be excluded. To delete an IP address from the list of excluded IP addresses, toggle the box to the left of the IP address range and click **Confirm delete**.
 
-To exclude IP addresses not in the default list, input the address or CIDR in the `Selector` field of the `Add Split Tunneling Record` card. You can add an optional description. Click **Add**.
+To add IP addresses to the default list, input the address or CIDR in the **Selector** field. You can add an optional description and click **Add**.
 
-![Split Tunnel](../static/secure-web-gateway/split-tunnel/split-tunnel.png)
+![Split Tunnel](../static/secure-web-gateway/split-tunnel/split-tunnel-entries.png)
 
 ## Enroll devices
 
diff --git a/products/cloudflare-one/src/content/tutorials/ssh-browser.md b/products/cloudflare-one/src/content/tutorials/ssh-browser.md
index e80c87dc13b..692e3acaf22 100644
--- a/products/cloudflare-one/src/content/tutorials/ssh-browser.md
+++ b/products/cloudflare-one/src/content/tutorials/ssh-browser.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-04-15
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Render an SSH client in a browser
@@ -24,16 +25,136 @@ Administrators can deploy Cloudflare Tunnel to connect one or more machines avai
 
 ---
 
-## Enable browser-based rendering
+## Create a Zero Trust policy
 
-First, navigate to the application page of the Access section in the Cloudflare for Teams dashboard. Choose an application created using the guide lined above. Click **Edit**.
+First, navigate to the Cloudflare for Teams dashboard to create a new application. Select the `Applications` page from the sidebar. Click **Add application**.
 
-Next, select the Settings tab. In the `cloudflared settings` card, toggle `Enable browser rendering` to on.
+![App List](../static/zero-trust-security/ssh/app-list.png)
 
-![Auto Auth](../static/documentation/applications/render-browser.png)
+Choose **Self-hosted** on the next page.
+
+![Add App](../static/zero-trust-security/ssh/add-app.png)
+
+Input a subdomain where your application will be available to users.
+
+![Configure](../static/zero-trust-security/ssh/configure-app.png)
+
+Next, create rules that control who can reach the application.
+
+![Add Rules](../static/zero-trust-security/ssh/app-rules.png)
+
+Finally, click **Save** to save the policy. You can return to edit the policy to make changes to who should be allowed or to choose what authentication providers can be used.
+
+![Save](../static/zero-trust-security/ssh/save-app.png)
+
+## Install `cloudflared`
+
+Cloudflare Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
+
+Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install `cloudflared` with the commands below. You can find releases for other operating systems [here](https://github.com/cloudflare/cloudflared/releases).
+
+```sh
+$ sudo wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+$ sudo dpkg -i ./cloudflared-linux-amd64.deb
+```
+
+## Authenticate `cloudflared`
+
+Run the following command to authenticate cloudflared into your Cloudflare account.
+
+```sh
+$ cloudflared tunnel login
+```
+
+`cloudflared` will open a browser window and prompt you to login to your Cloudflare account. If you are working on a machine that does not have a browser, or a browser window does not launch, you can copy the URL from the command-line output and visit the URL in a browser on any machine.
+
+Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel.
+
+## Create a Tunnel
+
+Next, [create a Tunnel](/connections/connect-apps/create-tunnel) with the command below.
+
+```sh
+$ cloudflared tunnel create <NAME>
+```
+
+Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
+
+The command will output an ID for the Tunnel and generate an associated credentials file. At any time you can list the Tunnels in your account with the following command.
+
+```sh
+$ cloudflared tunnel list
+```
+
+## Configure the Tunnel
+
+You can now [configure the Tunnel](/connections/connect-apps/configuration) to serve traffic.
+
+Create a `YAML` file that `cloudflared` can reach. By default, `cloudflared` will look for the file in the same folder where `cloudflared` has been installed.
+
+```sh
+$ vim ~/.cloudflared/config.yml
+```
+
+Next, configure the Tunnel, replacing the example ID below with the ID of the Tunnel created above. Additionally, replace the hostname in this example with the hostname of the application configured with Cloudflare Access.
+
+```yaml
+tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
+credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
+
+ingress:
+  - hostname: azure.widgetcorp.tech
+    service: ssh://localhost:22
+  - service: http_status:404
+  # Catch-all rule, which responds with 404 if traffic doesn't match any of
+  # the earlier rules
+```
+
+## Route to the Tunnel
+
+You can now create a DNS record that will route traffic to this Tunnel. Multiple DNS records can point to a single Tunnel and will send traffic to the service configured as long as the hostname is defined with an [ingress rule](/connections/connect-apps/configuration/ingress).
+
+Navigate to `dash.cloudflare.com` and choose the hostname where you want to create a Tunnel. This should match the hostname of the Access policy. Click **+ Add record**.
+
+![DNS List](../static/zero-trust-security/ssh/dns-list.png)
+
+Select `CNAME` as the record type. For the target, input the ID of your Tunnel followed by `cfargotunnel.com`. In this example, the target would be:
+
+`6ff42ae2-765d-4adf-8112-31c55c1551ef.cfargotunnel.com`
+
+Click **Save**.
+
+![Add DNS](../static/zero-trust-security/ssh/add-dns.png)
+
+## Run the Tunnel
+
+You can now run the Tunnel to connect the target service to Cloudflare. Use the following command to run the Tunnel, replacing `<NAME>` with the name created for your Tunnel.
+
+```sh
+cloudflared tunnel run <NAME>
+```
+
+We recommend that you run `cloudflared` [as a service](/connections/connect-apps/run-tunnel/run-as-service) that is configured to launch on start.
+
+## Connect from a browser-rendered terminal
+
+Cloudflare can render an SSH client in your browser without the need for client software or end user configuration changes.
+
+To enable this feature, navigate to the **Access > Applications** page in the Teams Dashboard. Click **Edit** and select the **Settings** tab. In the **`cloudflared` settings** card, select *SSH* from the **Browser Rendering** drop-down menu.
+
+![Auto Auth](../static/documentation/applications/ssh-browser-rendering.png)
 
 Once enabled, when users authenticate and visit the URL of the application, Cloudflare will render a terminal in their browser.
 
+<iframe
+  src="https://iframe.videodelivery.net/9e62cddf4ac40dc7237f4136f946fa12"
+  style="border: none;"
+  height="200"
+  width="400"
+  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
+  allowfullscreen="true"
+></iframe>
+
 ## Recommended: enable short-lived certificates
 
 Cloudflare's browser-based terminal does not access the device's certificate store to gather SSH keys. Instead, users can input a username and password for password-based authentication or paste their private key. The terminal is rendered entirely in the user's browser - Cloudflare never stores or has access to the private key.
diff --git a/products/cloudflare-one/src/content/tutorials/ssh-cert-bastion.md b/products/cloudflare-one/src/content/tutorials/ssh-cert-bastion.md
index 41def350270..10b9bfff74b 100644
--- a/products/cloudflare-one/src/content/tutorials/ssh-cert-bastion.md
+++ b/products/cloudflare-one/src/content/tutorials/ssh-cert-bastion.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-01-19
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # SSH with short-lived certificates
@@ -52,21 +53,21 @@ Build a policy to determine who will be able to reach these resources. You can u
 
 ## Connect a host to Cloudflare
 
-You can now connect the host to Cloudflare with Argo Tunnel. Argo Tunnel, powered by its `cloudflared` daemon, will create an outbound-only connection from your environment and send SSH connections from users to protected resources once authorized.
+You can now connect the host to Cloudflare with Cloudflare Tunnel. Cloudflare Tunnel, powered by its `cloudflared` daemon, will create an outbound-only connection from your environment and send SSH connections from users to protected resources once authorized.
 
 First, [install and authenticate](/connections/connect-apps/install-and-setup) an instance of `cloudflared` in a location that can address the resources you are connecting to Cloudflare.
 
-Next, create a new Argo Tunnel with the following command. You can replace `ssh-pool` with any name.
+Next, create a new Tunnel with the following command. You can replace `ssh-pool` with any name.
 
 ```sh
 $ cloudflared tunnel create ssh-pool
 ```
 
-`cloudflared` will create the Tunneland generate a UUID and corresponding credentials file.
+`cloudflared` will create the Tunnel and generate a UUID and corresponding credentials file.
 
 You can now configure your Tunnel. The example configuration file below uses the UUID value of the Tunnel, adds the path to the credentials file, and sets an optional logging location.
 
-In the `ingress` section, input the hostname of the application created in the Cloudflare for Teams dashboard. Placing the service in bastion mode will allow any connections that reach `cloudflared` to connect onward to resources avaialble to `cloudflared`, similar to a jump host.
+In the `ingress` section, input the hostname of the application created in the Cloudflare for Teams dashboard. Placing the service in bastion mode will allow any connections that reach `cloudflared` to connect onward to resources available to `cloudflared`, similar to a jump host.
 
 ![Bastion](../static/zero-trust-security/ssh-slc/bastion-mode.png)
 
@@ -159,4 +160,4 @@ When users authenticate through Cloudflare Access, Cloudflare will generate a ce
 
 The username in the identity provider must match the username on the SSH server.
 
-</Aside>
\ No newline at end of file
+</Aside>
diff --git a/products/cloudflare-one/src/content/tutorials/ssh-service-token.md b/products/cloudflare-one/src/content/tutorials/ssh-service-token.md
index 3db806eddbc..a114506d993 100644
--- a/products/cloudflare-one/src/content/tutorials/ssh-service-token.md
+++ b/products/cloudflare-one/src/content/tutorials/ssh-service-token.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-01-04
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Service tokens for SSH connections
@@ -68,7 +69,5 @@ You can use the `Client ID` and `Client Secret` to connect to the resource over
 The following `cloudflared` command is structured to use the Service Token generated to connect over SSH to the GitLab instance previously configured. The command relies on the [SSH configuration file being set](/tutorials/gitlab#configuring-ssh) to proxy the connection through `cloudflared`.
 
 ```sh
-
-cloudflared access ssh --hostname gitlab-ssh.widgetcorp.tech --id a61c032ee4510f8b7e2749ea0896cc14.access --secret 85dcb2301975e8b8e40deb6097645995aa4bed35c2badf098028652097c69eeb
-
+$ cloudflared access ssh --hostname gitlab-ssh.widgetcorp.tech --id a61c032ee4510f8b7e2749ea0896cc14.access --secret 85dcb2301975e8b8e40deb6097645995aa4bed35c2badf098028652097c69eeb
 ```
\ No newline at end of file
diff --git a/products/cloudflare-one/src/content/tutorials/ssh.md b/products/cloudflare-one/src/content/tutorials/ssh.md
index ed8dfec37bd..59ae53776e5 100644
--- a/products/cloudflare-one/src/content/tutorials/ssh.md
+++ b/products/cloudflare-one/src/content/tutorials/ssh.md
@@ -1,6 +1,7 @@
 ---
 updated: 2021-03-23
 category: 🔐 Zero Trust
+pcx-content-type: tutorial
 ---
 
 # Connect through Cloudflare Access over SSH
@@ -33,7 +34,7 @@ Choose **Self-hosted** on the next page.
 
 ![Add App](../static/zero-trust-security/ssh/add-app.png)
 
-Input a subdomain where your application will be availble to users.
+Input a subdomain that will become the hostname where your application will be available to users.
 
 ![Configure](../static/zero-trust-security/ssh/configure-app.png)
 
@@ -45,20 +46,22 @@ Finally, click **Save** to save the policy. You can return to edit the policy to
 
 ![Save](../static/zero-trust-security/ssh/save-app.png)
 
-## Install `cloudflared`
+## Install `cloudflared` on the server
 
-Cloudflare Argo Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can  prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
+Cloudflare Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports.
 
-Argo Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install `cloudflared` with the commands below. You can find releases for other operating systems [here](https://github.com/cloudflare/cloudflared/releases).
+Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and then install `cloudflared` with the commands below. You can find instructions for installing `cloudflared` on other operating systems [here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation). The release history can be found [here](https://github.com/cloudflare/cloudflared/releases).
+
+For example, `cloudflared` can be installed on Debian and its derivatives with these commands:
 
 ```sh
-$ sudo wget https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb
-$ sudo dpkg -i ./cloudflared-stable-linux-amd64.deb
+$ sudo wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+$ sudo dpkg -i ./cloudflared-linux-amd64.deb
 ```
 
 ## Authenticate `cloudflared`
 
-Run the following command to authenticate cloudflared into your Cloudflare account.
+Run the following command on the server to authenticate cloudflared into your Cloudflare account.
 
 ```sh
 $ cloudflared tunnel login
@@ -68,15 +71,15 @@ $ cloudflared tunnel login
 
 Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel.
 
-## Create an Argo Tunnel
+## Create a Tunnel
 
-Next, [create an Argo Tunnel](/connections/connect-apps/create-tunnel) with the command below.
+Next, [create a Tunnel](/connections/connect-apps/create-tunnel) on the server with the command below.
 
 ```sh
 $ cloudflared tunnel create <NAME>
 ```
 
-Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Argo Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
+Replacing `<NAME>` with a name for the Tunnel. This name can be any value. A single Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP.
 
 The command will output an ID for the Tunnel and generate an associated credentials file. At any time you can list the Tunnels in your account with the following command.
 
@@ -165,8 +168,8 @@ You can now test the SSH flow by running a command to reach the service. When th
 
 Cloudflare can render an SSH client in your browser without the need for client software or end user configuration changes.
 
-To enable, navigate to the application page of the Access section in the Cloudflare for Teams dashboard. Click **Edit** and select the Settings tab. In the `cloudflared settings` card, toggle `Enable browser rendering` to on.
+To enable, navigate to the application page of the Access section in the Cloudflare for Teams dashboard. Click **Edit** and select the Settings tab. In the **`cloudflared` settings** card, select *SSH* from the **Browser Rendering** drop-down menu.
 
-![Auto Auth](../static/documentation/applications/render-browser.png)
+![Auto Auth](../static/documentation/applications/ssh-browser-rendering.png)
 
-Once enabled, when users authenticate and visit the URL of the application, Cloudflare will render a terminal in their browser.
\ No newline at end of file
+Once enabled, when users authenticate and visit the URL of the application, Cloudflare will render a terminal in their browser.
diff --git a/products/cloudflare-one/src/content/tutorials/user-diagnostics.md b/products/cloudflare-one/src/content/tutorials/user-diagnostics.md
index a78c7edf628..083b86e2be9 100644
--- a/products/cloudflare-one/src/content/tutorials/user-diagnostics.md
+++ b/products/cloudflare-one/src/content/tutorials/user-diagnostics.md
@@ -2,16 +2,17 @@
 updated: 2020-12-13
 category: 🔐 Zero Trust
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Troubleshoot user login details
 
-Cloudflare Access provides a user-facing portal, the [Access App Launcher](https://blog.cloudflare.com/announcing-the-cloudflare-access-app-launch/), which displays all applications that a user can reach in a single view. The same portal also can be used by a member of your team to gather diagnostic information about their account for troubleshooting.
+Cloudflare Access provides a user-facing portal, the [App Launcher](https://blog.cloudflare.com/announcing-the-cloudflare-access-app-launch/), which displays all applications that a user can reach in a single view. The same portal also can be used by a member of your team to gather diagnostic information about their account for troubleshooting.
 
 **🗺️ This tutorial covers how to:**
 
-* Configure the Access App Launcher
-* Visit the Access App Launcher as an end user
+* Configure the App Launcher
+* Visit the App Launcher as an end user
 * Review login diagnostics as an end user
 
 **⏲️Time to complete:**
@@ -20,23 +21,23 @@ Cloudflare Access provides a user-facing portal, the [Access App Launcher](https
 
 ---
 
-## Configure Cloudflare Access App Launcher
+## Configure the App Launcher
 
-To enable the Cloudflare Access App Launch, navigate to the Cloudflare for Teams dashboard. Open the `Authentication` page in the Access section of the sidebar.
+1. On the Teams Dashboard, navigate to **Settings > Authentication**.
 
-![Auth Page](../static/zero-trust-security/user-diagnostics/auth-page.png)
+1. Under **App Launcher**, click the **Manage**.
 
-Click the **App Launcher** tab. The App Launcher works like other Access policies - you can define who is able to reach the App Launcher. When users visit the App Launcher, Cloudflare Access will display only the applications they have permission to reach.
+   The App Launcher works like other Access policies - you can define who is able to reach the App Launcher. When users visit the App Launcher, Cloudflare Access will display only the applications they have permission to reach.
 
-![App Launch](../static/zero-trust-security/user-diagnostics/app-launch-page.png)
+1. To define who is able to use the App Launcher, add a new rule.
 
-To define who is able to use the App Launcher, add a new rule.
+   ![Add Rule](../static/zero-trust-security/user-diagnostics/add-new-rule.png)
 
-![Add Rule](../static/zero-trust-security/user-diagnostics/add-rule.png)
+1. Once you have defined at least one rule, click **Save**. Your rule will appear under the **App Launcher rules** list.
 
-Once you have defined at least one rule, click **Save application**.
+   ![Add Rule](../static/zero-trust-security/user-diagnostics/app-launcher-rules.png)
 
-![Add Rule](../static/zero-trust-security/user-diagnostics/save-app.png)
+1. Click **Save** to finalize your edits.
 
 ## Visiting the Access App Launcher
 
diff --git a/products/cloudflare-one/src/content/tutorials/vnc-client-in-browser.md b/products/cloudflare-one/src/content/tutorials/vnc-client-in-browser.md
new file mode 100644
index 00000000000..03f065c88ba
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/vnc-client-in-browser.md
@@ -0,0 +1,192 @@
+---
+updated: 2021-06-18
+category: 🔐 Zero Trust
+difficulty: Advanced
+pcx-content-type: tutorial
+---
+
+# Render a VNC client in browser
+
+Cloudflare can render a Virtual Network Computer (VNC) terminal in your browser without any client software or configuration required.
+
+Administrators can use Cloudflare Tunnel to connect a VNC host to Cloudflare’s network. Using Cloudflare Access, you can apply Zero Trust policies to determine who can access your VNC server. Cloudflare’s network will then enforce the Zero Trust policies and, when a user is allowed, render the client in the browser.
+
+**🗺️ This walkthrough covers how to:**
+- Install and run a Cloudflare Tunnel on a Linux virtual machine
+- Install and configure VNC on a Linux virtual machine
+- Build a Zero Trust policy to determine who can reach the host
+- Render the VNC server in your browser
+
+**⏲️ Time to complete:**
+
+10 minutes
+
+<Aside>
+
+There are a number of VNC versions, deployments and instances. This tutorial focuses on configuring a Tight VNC server on an Azure hosted Linux virtual machine. For help with other configurations, please post your questions in our [community](https://community.cloudflare.com/t/feedback-for-browser-vnc/280619/3).
+
+</Aside>
+
+## Before you start
+
+1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
+1. [Enable Cloudflare for Teams on your account](/setup)
+1. [Connect your identity provider to Cloudflare for Teams](/identity/sso-integration)
+
+## Configure VNC on your virtual machine
+
+This section covers how to install a VNC server with TightVNC and the Gnome User Interface. If you already have a VNC server installed, you can skip this step.
+
+1. Open a terminal window for your VM.
+
+1. Run the following commands to install the VNC software.
+
+    ```bash
+    $ sudo apt-get update
+    ```
+
+    ```bash
+    $ sudo apt-get install gnome-core
+    ```
+
+    ```bash
+    $ sudo apt install tightvncserver
+    ```
+
+    ```bash
+    $ sudo apt-get install gnome-panel
+    ```
+
+    ```bash
+    $ sudo apt-get install ubuntu-gnome-desktop
+    ```
+
+1. Once installed, you can create the VNC server instance with the following command:
+
+    ```bash
+    $ sudo tightvncserver
+    ```
+    ![VNC password](../static/zero-trust-security/vnc-client-in-browser/vnc-password.png)
+
+1. Select a password for the VNC server. This password will be used during login for your browser VNC server.
+
+1. Run the following command, which will take you to your VNC server configuration directory.
+
+    ```bash
+    $ cd .vnc
+    ```
+
+1. Open your `xstartup` file.
+
+    ```bash
+    $ vim xstartup
+    ```
+
+1. Update the file to the following configuration (this is for demonstration purposes, browser based VNC will work with most configurations):
+
+    ```txt
+    xsetroot -solid grey
+    x-terminal-emulator -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
+    #x-window-manager &
+
+    # Fix to make GNOME work
+    export XKL_XMODMAP_DISABLE=1
+    /etc/X11/Xsession
+
+    #gnome-session &
+    gnome-panel &
+    nautilus &
+    ```
+
+    ![VNC xstartup file](../static/zero-trust-security/vnc-client-in-browser/vnc-xstartup.png)
+
+1. Run the following command to create your VNC server:
+
+    ```bash
+    $ vncserver
+    ```
+
+At this point, you have a VNC server ready to test with browser-based VNC. We recommend performing a brief test with an existing VNC browser to verify any missing packages or configuration changes that might need to be made before continuing. Once your VNC server appears as desired, continue with your setup.
+
+## Configure Cloudflare Tunnel on your machine
+
+1. Follow [these instructions](/connections/connect-apps/install-and-setup/installation#build-from-source) to install `cloudflared`
+
+1. Authenticate `cloudflared` with the command:
+
+    ```bash
+    $ cloudflared tunnel login
+    ```
+
+1. Create a Tunnel with the command:
+
+    ```bash
+    $ cloudflared tunnel create <NAME>
+    ```
+
+1. Create a Tunnel configuration file with the command:
+
+    ```bash
+    $ vim config.yml
+    ```
+
+1. Add the following configuration to your configuration file.
+
+    ```txt
+    tunnel: <NAME>
+    ingress:
+    - hostname: vnc.kennyatx.com
+      service: tcp://localhost:5901
+    - service: http_status:404
+    ```
+
+    As you do that, replace the `hostname` value with the domain you wish to use to expose your VNC server in the browser. Also, replace `5901` with the port your VNC server is running on. To get a list of ports, run `sudo ss -lnpt` and look for `VNC` to get the value that should be specified in your configuration file.
+
+1. [Route your Tunnel](/connections/connect-apps/routing-to-tunnel/dns) to your website.
+
+1. Run your Tunnel:
+
+    ```bash
+    $ cloudflared tunnel --config path/config.yaml run <NAME>
+    ```
+
+    ![Run Tunnel](../static/zero-trust-security/vnc-client-in-browser/vnc-run-tunnel.png)
+
+1. Follow [this guide](/connections/connect-apps/configuration/ports-and-ips) to open outbound connections for Cloudflare Tunnel if you have a firewall enabled.
+
+At this point you have a running VNC server and a Cloudflare Tunnel on your machine ready to accept inbound VNC requests.
+
+## Create a Zero Trust VNC application
+
+The last step is to create a Zero Trust application to run your VNC server in the Browser.
+
+1. Open your [Teams Dashboard](https://dash.teams.cloudflare.com) and go to the **Access > Applications** tab.
+
+1. Click **Add an application**.
+
+1. Select **Self-hosted**.
+
+1. Name the application and set the domain to which you would like to expose the VNC server:
+
+    ![Name application](../static/zero-trust-security/vnc-client-in-browser/vnc-domain-application.png)
+
+1. Add a Zero Trust policy. In this example we are only allowing users with emails ending in `@example.com`.
+
+    ![Create policy](../static/zero-trust-security/vnc-client-in-browser/vnc-policy.png)
+
+1. In **`cloudflared` settings**, set **Application Type** to be *VNC*.
+
+And now you are ready to use the VNC terminal directly in the browser. Users will first see a login screen with your configured identity providers:
+
+![VNC login screen](../static/zero-trust-security/vnc-client-in-browser/vnc-login-screen.png)
+
+After successful authentication, they may be prompted to enter the VNC server’s password:
+
+![VNC password prompt](../static/zero-trust-security/vnc-client-in-browser/vnc-server-password.png)
+
+
+Then your user will be directed into your VNC server:
+
+![VNC server](../static/zero-trust-security/vnc-client-in-browser/vnc-server.png)
+
+You’ve now successfully deployed a Zero Trust VNC server in the browser. You can define granular access controls across each individual VNC instance.
diff --git a/products/cloudflare-one/src/content/tutorials/warp-to-tunnel.md b/products/cloudflare-one/src/content/tutorials/warp-to-tunnel.md
index 03c89690b7b..cd7dc638932 100755
--- a/products/cloudflare-one/src/content/tutorials/warp-to-tunnel.md
+++ b/products/cloudflare-one/src/content/tutorials/warp-to-tunnel.md
@@ -2,13 +2,14 @@
 updated: 2021-03-23
 category: 🌐 Connections
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
-# Connect from WARP to a private network on Cloudflare using Argo Tunnel
+# Connect from WARP to a private network on Cloudflare using Cloudflare Tunnel
 
-You can use [Argo Tunnel](/connections/connect-apps) to connect applications and services to Cloudflare's network. Argo Tunnel relies on a piece of software, `cloudflared`, to create those connections.
+You can use [Cloudflare Tunnel](/connections/connect-apps) to connect applications and services to Cloudflare's network. Cloudflare Tunnel relies on a piece of software, `cloudflared`, to create those connections.
 
-You can create and configure Argo Tunnel connections to [support multiple HTTP origins](/tutorials/multi-origin) or [multiple protocols simultaneously](/tutorials/gitlab). You can also use Argo Tunnel to connect any service that relies on a TCP-based protocol to Cloudflare's network. Users in your organization can then reach the service by enrolling into your organization's Cloudflare for Teams account and using the WARP agent.
+You can create and configure Cloudflare Tunnel connections to [support multiple HTTP origins](/tutorials/multi-origin) or [multiple protocols simultaneously](/tutorials/gitlab). You can also use Cloudflare Tunnel to connect any service that relies on a TCP-based protocol to Cloudflare's network. Users in your organization can then reach the service by enrolling into your organization's Cloudflare for Teams account and using the WARP agent.
 
 Once enrolled, user endpoints will be able to connect to private [RFC 1918](https://tools.ietf.org/html/rfc1918) IP space and other ranges that you control. Applications running on those endpoints will be able to reach those private IPs as well in a private network model. Coming soon, administrators will be able to build Zero Trust rules to determine who within your organization can reach those IPs.
 
@@ -32,7 +33,7 @@ Once enrolled, user endpoints will be able to connect to private [RFC 1918](http
 
 ## Install `cloudflared`
 
-Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
+Start by [downloading and installing](/connections/connect-apps/install-and-setup) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
@@ -46,7 +47,7 @@ The command will launch a browser window and prompt you to login with your Cloud
 
 Once you click one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes.
 
-You can now use `cloudflared` to control Argo Tunnel connections in your Cloudflare account.
+You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account.
 
 ![Download Cert](../static/secure-origin-connections/share-new-site/cert-download.png)
 
@@ -56,9 +57,9 @@ You can now use `cloudflared` to control Argo Tunnel connections in your Cloudfl
 
 ## Create a Tunnel
 
-You can now [create an Argo Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge.
+You can now [create a Tunnel](/connections/connect-apps/create-tunnel) that will connect `cloudflared` to Cloudflare's edge.
 
-Begin by [creating an Argo Tunnel](/connections/connect-apps/create-tunnel) with an associated name. This example uses the name `grafana`.
+Begin by [creating a Tunnel](/connections/connect-apps/create-tunnel) with an associated name. This example uses the name `grafana`.
 
 ```bash
 cloudflared tunnel create grafana
@@ -74,9 +75,9 @@ cloudflared tunnel list
 
 ![List Tunnel](../static/secure-origin-connections/warp-to-tunnel/list-tunnel.png)
 
-Next, you will need to create a route. Routes map a Tunnel ID to a CIDR range that you specify. You can use private IP space specified by [RFC 1918](https://tools.ietf.org/html/rfc1918) or other routes. The private IP space specified should match the private IP space of your subnet or environment where Argo Tunnel will send connections.
+Next, you will need to create a route. Routes map a Tunnel ID to a CIDR range that you specify. You can use private IP space specified by [RFC 1918](https://tools.ietf.org/html/rfc1918) or other routes. The private IP space specified should match the private IP space of your subnet or environment where Cloudflare Tunnel will send connections.
 
-This example tells Argo Tunnel that, for users in this organization, connections to `100.64.0.0/10` should be served by this Tunnel. For the purposes of this tutorial, Grafana is running in a Digital Ocean environment where a virtual interface has been applied that will send traffic bound for localhost to `100.64.0.1`.
+This example tells Cloudflare Tunnel that, for users in this organization, connections to `100.64.0.0/10` should be served by this Tunnel. For the purposes of this tutorial, Grafana is running in a Digital Ocean environment where a virtual interface has been applied that will send traffic bound for localhost to `100.64.0.1`.
 
 ```bash
 cloudflared tunnel route ip add 100.64.0.0/10 8e343b13-a087-48ea-825f-9783931ff2a5
@@ -115,17 +116,89 @@ This example runs it from the command-line but we recommend running `cloudflared
 
 ## Route private IP ranges through WARP
 
+<Aside>
+
+Make sure **HTTP traffic filtering** is enabled. This lets Cloudflare proxy your private IP ranges to corresponding Cloudflare Tunnels.
+
+</Aside>
+
 Users can reach this private service by logging into their Cloudflare for Teams account and the WARP agent.
 
 By default, Cloudflare WARP excludes traffic bound for RFC 1918 space and certain other routes as part of its [Split Tunnel feature](/tutorials/split-tunnel). To use this feature the IPs that you specified for your Tunnel must be included which will send traffic for those destinations through the WARP agent and to the Tunnel.
 
-Navigate to the `Policies` page of the Gateway section in the Cloudflare for Teams dashboard. Click the **Settings** tab. The IP ranges listed are those that Cloudflare excludes by default. Choose the range being used for this private connection and delete it.
+1. On the Teams Dashboard, navigate to **Settings > Network**.
 
-![Split Tunnel](../static/secure-origin-connections/warp-to-tunnel/split-tunnel.png)
+1. Click **Manage**. The IP ranges listed are those that Cloudflare excludes by default. Choose the range being used for this private connection and delete it.
 
-## Connect via WARP
+![Split Tunnel](../static/secure-web-gateway/split-tunnel/split-tunnel-entries.png)
+
+## Integrate your identity provider
+
+Users can now connect over this private network by [enrolling their devices into the WARP agent](/connections/connect-devices/warp) in the same account as the Cloudflare Tunnel configuration. They must use the `Gateway with WARP` mode.
+
+You can begin to [enroll devices](/connections/connect-devices/warp/deployment) by determining which users are allowed to enroll.
+
+Navigate to the `Settings` section of the Cloudflare for Teams dashboard and select `Authentication`. Cloudflare for Teams will automatically create a "One-time PIN" option which will rely on your user's emails. You can begin using the one-time PIN option immediately or you can also integrate your corporate [identity provider](/identity/idp-integration).
+
+## Determine which devices can enroll
+
+Next, build a rule to decide which devices can enroll in your account. 
+
+1. Navigate to **Settings > Devices > Device enrollment**.
+
+    ![Device settings](../static/secure-web-gateway/block-football/device-enrollment-settings.png)
+
+1. Click **Manage**.
+
+1. Click **Add a rule**.
+
+    ![Device Enrollment](../static/secure-web-gateway/block-football/device-enrollment-add-rule.png)
+
+    Determine who is allowed to enroll by using criteria including Access groups, groups from your identity provider, email domain, or named users. This example allows any user with a `@cloudflare.com` account to enroll.
+
+    ![Allow Cloudflare users](../static/secure-web-gateway/block-football/allow-cf-users.png)
+
+1. Click **Save**.
 
-Users can now connect over this private network by [enrolling their devices into the WARP agent](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp) in the same account as the Argo Tunnel configuration. They must use the `Gateway with WARP` mode. A specific tutorial for enrollment is also [available](https://developers.cloudflare.com/cloudflare-one/tutorials/block-football-users).
+Your rule will now be visible under the **Device enrollment rules** list.
+
+## Configure the Cloudflare certificate
+
+To inspect traffic, Cloudflare Gateway requires that a [certificate be installed](/connections/connect-devices/warp/install-cloudflare-cert) on enrolled devices. You can also distribute this certificate through an MDM provider. The example below describes the manual distribution flow.
+
+To download the Cloudflare certificate:
+* Follow the link provided in [these instructions](/connections/connect-devices/warp/install-cloudflare-cert).
+* Find the certificate in the Teams Dashboard, by navigating to **Settings > Devices > Certificates**.
+
+## Enable the Cloudflare proxy
+
+Once the certificate has been installed, you can configure Gateway to inspect HTTP traffic. To do so, navigate to **Settings > Network**. Toggle **Proxy** to *Enabled*. This will tell Cloudflare to begin proxying any traffic from enrolled devices, except the traffic excluded using the [split tunnel](/connections/connect-devices/warp/exclude-traffic) settings.
+
+Next, enable TLS decryption. This will tell Cloudflare to begin decrypting traffic for inspection from enrolled devices, except the traffic excluded from inspection.
+
+![Policy settings](../static/secure-web-gateway/block-football/enable-proxy-decrypt.png)
+
+## Enroll a device
+
+1. Follow the [instructions](/connections/connect-devices/warp/deployment) to install the WARP client depending on your device type. Cloudflare Gateway does not need a special version of the client.
+
+1. Once the client is installed, click the gear icon.
+
+    ![WARP](../static/secure-web-gateway/secure-dns-devices/warp.png)
+
+1. Under the **Account** tab, click **Login with Cloudflare for Teams**.
+
+    ![Account View](../static/secure-web-gateway/secure-dns-devices/account-view.png)
+
+1. Input your [team name](/glossary#team-name). You can find it on the Teams Dashboard under **Settings > General**.
+
+    ![Team Name](../static/secure-web-gateway/secure-dns-devices/org-name.png)
+
+The user will be prompted to login with the identity provider configured in Cloudflare Access. Once authenticated, the client will update to `Teams` mode. You can click the gear to toggle between DNS filtering or full proxy. In this use case, you must toggle to `Gateway with WARP`. These settings can be configured globally for an organization through a device management platform.
+
+![Confirm WARP](../static/secure-web-gateway/block-football/warp-mode.png)
+
+## Connect via WARP
 
 Once enrolled, they will be able to connect to the private IPs configured for HTTP traffic in this example or arbitrary TCP traffic.
 
diff --git a/products/cloudflare-one/src/content/tutorials/zendesk-sso-saas.md b/products/cloudflare-one/src/content/tutorials/zendesk-sso-saas.md
new file mode 100644
index 00000000000..520226668d0
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/zendesk-sso-saas.md
@@ -0,0 +1,78 @@
+---
+updated: 2021-08-03
+category: 🔐 Zero Trust
+difficulty: Advanced
+pcx-content-type: tutorial
+---
+
+# Configure Zendesk SSO with Access for SaaS
+
+This tutorial covers how to configure Zendesk SSO with Access for SaaS.
+
+<Aside>
+
+For this tutorial, you will need:
+* A Cloudflare for Teams Account
+* An integrated identity provider (IdP)
+* Admin access to your Zendesk account
+
+</Aside>
+
+**⏲️ Time to complete:**
+
+20 minutes
+
+## Configure Zendesk and Cloudflare
+
+1. To begin, navigate to your Zendesk administrator dashboard, typically available at `<yourdomain>.zendesk.com/admin/security/sso`.
+
+1. In a separate tab or window, open the [Cloudflare for Teams Dashboard](https://dash.teams.cloudflare.com) and navigate to **Access** > **Applications**.
+
+1. Select *SaaS* as the application type to begin creating a SaaS application.
+
+1. Copy the following fields from your Zendesk account and input them in the Cloudflare for Teams application configuration:
+    * **Assertion Consumer Service URL**. This URL appears as `SAML SSO URL` in your Zendesk account.
+    * **Entity ID**: `https://yoursubdomain.zendesk.com`
+    * **NameID**: Email
+
+1. Configure these Attribute Statements to include a user’s first and last name:
+
+    * `<Cloudflare Firstname attribute name>` => `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
+    * `<Cloudflare Last name attribute name>` => `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
+
+    [Additional Attributes](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname) can also be synchronized with Zendesk.
+
+    <Aside>
+    This step is optional. If the name is not provided, Zendesk will [use the user’s email address as their name](https://support.zendesk.com/hc/en-us/articles/203663676#topic_dzb_gl5_2v))
+    </Aside>
+
+    ![Zendesk attributes](../static/zero-trust-security/zendesk-sso-saas/zendesk-attributes.png)
+
+1. Create an Access policy to determine who can access Zendesk.
+
+    ![Zendesk policy](../static/zero-trust-security/zendesk-sso-saas/zendesk-policy.png)
+
+1. Copy the Cloudflare IdP values and add them to the following Zendesk Fields:
+
+    * SSO Endpoint => SAML SSO URL
+    * Public Key => Certificate Fingerprint
+
+    <Aside>
+
+    The Public key must be transformed into a fingerprint. To do that:
+    1. Copy the Public Key Value.
+    1. Paste the Public Key into [SAML X.509 Certificate Fingerprint - Online SHA1 Decoder | SAMLTool.com](https://www.samltool.com/fingerprint.php).
+    1. Wrap the value in `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.
+    1. Set the algorithm to SHA256.
+    1. Copy the Formatted Fingerprint Value.
+
+    </Aside>
+    
+    ![Zendesk fingerprint](../static/zero-trust-security/zendesk-sso-saas/zendesk-fingerprint.png)
+
+1. Go to `https://<yourdomain>.zendesk.com/admin/security/staff_members` and enable **External Authentication** > **Single Sign On**.
+
+    ![Zendesk external authentication](../static/zero-trust-security/zendesk-sso-saas/zendesk-external-auth.png)
+
+
+Users should now be able to log into Zendesk if their Email address exists in the Zendesk user list.
diff --git a/products/cloudflare-one/src/content/tutorials/zero-trust-network-access.md b/products/cloudflare-one/src/content/tutorials/zero-trust-network-access.md
new file mode 100644
index 00000000000..fe1c4072c64
--- /dev/null
+++ b/products/cloudflare-one/src/content/tutorials/zero-trust-network-access.md
@@ -0,0 +1,127 @@
+---
+updated: 2021-06-11
+category: 🔐 Zero Trust
+difficulty: Advanced
+pcx-content-type: tutorial
+---
+
+# Configure Zero Trust Network Access in Cloudflare for Teams
+
+In this tutorial we will cover how to configure a Zero Trust Private Network in Cloudflare for Teams by combining device enrollment rules, Cloudflare Tunnels, and identity-based network policies.
+
+**🗺️ This tutorial covers how to:**
+
+* Create device enrollment rules and connect a device to Teams
+* Connect your private network server to Cloudflare's edge using Cloudflare Tunnels
+* Create identity-aware network policies
+
+**⏲️Time to complete:**
+
+45 minutes
+
+<Aside header="Prerequisites">
+
+* A Teams account setup
+* The [WARP client](/connections/connect-devices/warp) installed on a device
+* Admin access to server with Internet access
+
+</Aside>
+
+---
+
+## Device enrollment
+
+The first step is to enroll your devices into the WARP client. The WARP client is responsible for forwarding your traffic to Cloudflare and eventually to your private network.
+
+1. Define [device enrollment rules](/connections/connect-devices/warp/warp-settings#device-enrollment-permissions) under **Settings > Devices > Device enrollment permissions > Manage**.
+
+ In this example, we require that users have a hard key inserted and are connecting from the United States.
+
+ ![Device enrollment rules](../static/zero-trust-security/ztna/device-enrollment-rules.png)
+ 
+1. Enroll your device into your Teams account. To do that, click the WARP icon in your navigation bar, open **Settings** and select **Account > Login** with Cloudflare for Teams.
+
+  ![WARP preferences](../static/zero-trust-security/ztna/warp-preferences.png)
+
+1. Enable the WARP client on the device to forward traffic to Cloudflare.
+
+
+## Server configuration
+
+Next, you will need to configure your private network server to connect to Cloudflare’s edge using Cloudflare Tunnel. This will establish a secure outbound connection to Cloudflare.
+
+1. Identify the server you want to use to securely make your private network available to users. This can be the origin server directly, a jumphost, or load balancer.
+
+1. If your server or network has a firewall, follow [this guide](/connections/connect-devices/warp/deployment/firewall) to open up the correct ports and IP addresses. Only outbound openings are required. You do not need to open any inbound holes in your firewall.
+
+1. [Install `cloudflared`](/connections/connect-apps/install-and-setup/installation) on the server.
+
+1. Authenticate `cloudflared` on the server by running the following command, then follow the prompt to authenticate via URL provided.
+ 
+ ```sh
+ $ cloudflared tunnel login
+ ```
+
+1. Next, create a tunnel for the device:
+
+ ```sh
+ $ cloudflared tunnel create <TUNNEL NAME>
+ ```
+
+1. Create a YAML config file for the tunnel with the following configuration:
+
+ ```txt
+ tunnel: <YOUR TUNNEL ID>
+ credentials-file: /root/.cloudflared/<YOUR TUNNEL ID>.json
+ warp-routing:
+   enabled: true
+ ```
+ 
+ <Aside>
+ Tunnel ID can be found by running <code>cloudflared tunnel list</code>.
+
+   ![Tunnel ID](../static/zero-trust-security/ztna/tunnel-id.png)
+ 
+ </Aside>
+
+1. Now run the tunnel:
+
+ ```sh
+ $ cloudflared tunnel run <TUNNEL NAME>
+ ```
+
+   ![Run the Tunnel](../static/zero-trust-security/ztna/run-tunnel.png)
+
+
+## Network configuration
+
+Finally, you will need to establish the private RFC 1918 IP address or range that you would like to advertise to Cloudflare, as well as set the identity policies determining which users can access that particular IP or range.
+
+1. Route the private IP addresses of your server’s network to Cloudflare, where:
+
+  * `10.0.0.0/10` is the IP or CIDR range of your server
+  * `8e343b13-a087-48ea-825f-9783931ff2a5` is your tunnel ID
+ 
+ ```sh
+ $ cloudflared tunnel route ip add 10.0.0.0/10 8e343b13-a087-48ea-825f-9783931ff2a5
+ ```
+
+1. Open your Teams dashboard to the **Gateway > Policies** tab.
+
+   ![First network policy](../static/zero-trust-security/ztna/first-network-policy.png)
+
+1. [Create a network policy](/policies/filtering/network-policies) to allow traffic from specific users to reach that application.
+
+   ![Second network policy](../static/zero-trust-security/ztna/second-network-policy.png)
+
+1. Create a second network policy to block all traffic to the IP range that was routed.
+
+   ![Create network policy](../static/zero-trust-security/ztna/create-network-policy.png)
+
+1. Verify that you do not have the desired target private IP range in the Split Tunnel configuration menu. This menu can be found at **Settings > Network > Split Tunnels**.
+
+   ![Split Tunnel](../static/secure-web-gateway/split-tunnel/split-tunnel-entries.png)
+
+Your setup is now complete. For more in-depth information on how identity-aware network policies work, read our [dedicated documentation page](/policies/filtering/network-policies).
+
+
diff --git a/products/cloudflare-one/src/content/tutorials/zsh-env-var.md b/products/cloudflare-one/src/content/tutorials/zsh-env-var.md
index 527fca7527b..a9cb2a8a2a4 100644
--- a/products/cloudflare-one/src/content/tutorials/zsh-env-var.md
+++ b/products/cloudflare-one/src/content/tutorials/zsh-env-var.md
@@ -2,11 +2,12 @@
 updated: 2021-03-16
 category: 🔐 Zero Trust
 difficulty: Advanced
+pcx-content-type: tutorial
 ---
 
 # Output an app's token to a variable with one command
 
-You can use [Argo Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network. Argo Tunnel relies on a piece of software, `cloudflared`, to create those connections.
+You can use [Cloudflare Tunnel](/connections/connect-apps) to connect applications and servers to Cloudflare's network. Cloudflare Tunnel relies on a piece of software, `cloudflared`, to create those connections.
 
 You can also secure those applications with [Cloudflare Access](/applications/configure-apps/self-hosted-apps). With Cloudflare Access, you can build Zero Trust rules which restrict who can reach your application based on signals like identity, multifactor method, device posture, and geography.
 
@@ -27,7 +28,7 @@ You can also use `cloudflared` to quickly gather the JWT from an application and
 
 ## Install `cloudflared`
 
-Start by [downloading and installing](/connections/connect-apps/install-and-setup/installation) the Argo Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
+Start by [downloading and installing](/connections/connect-apps/install-and-setup/installation) the Cloudflare Tunnel daemon, `cloudflared`. On Mac, you can do so by running the following `brew` command. If you do not have Homebrew, follow the [documentation](https://docs.brew.sh/Installation) to install it.
 
 `$ brew install cloudflare/cloudflare/cloudflared`
 
diff --git a/products/distributed-web/docs-config.js b/products/distributed-web/docs-config.js
index bc4e9468af3..5fe98bc7974 100644
--- a/products/distributed-web/docs-config.js
+++ b/products/distributed-web/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "View files stored on the InterPlanetary File System in your browser. Interact with the Ethereum blockchain. Explore the Distributed Web.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/distributed-web",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/distributed-web/src/content/ethereum-gateway/about-eth.md b/products/distributed-web/src/content/ethereum-gateway/about-eth.md
index 36b4083216d..66d0fb350cb 100644
--- a/products/distributed-web/src/content/ethereum-gateway/about-eth.md
+++ b/products/distributed-web/src/content/ethereum-gateway/about-eth.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # About Ethereum
@@ -57,13 +58,13 @@ sent to the wider network and added to the consensus.
 
 Reading and writing content to the Ethereum network can be done using
 Cloudflare's Gateway. To learn more about how to do this see [Interacting with
-the Ethereum network](./interacting-with-the-eth-gateway).
+the Ethereum network](../interacting-with-the-eth-gateway).
 
 ## Connect your website to the gateway
 
 If you want to be able to access the Ethereum network accessible from a custom
 domain name, you can do that using Cloudflare’s Ethereum Gateway. To
-learn how, check out [Connecting your Website](./connecting-your-website).
+learn how, refer to [Connecting your Website](../connecting-your-website).
 
 ## Going Further
 
diff --git a/products/distributed-web/src/content/ethereum-gateway/connecting-your-website.md b/products/distributed-web/src/content/ethereum-gateway/connecting-your-website.md
index 9240b1d3d62..75aea0dc0e1 100644
--- a/products/distributed-web/src/content/ethereum-gateway/connecting-your-website.md
+++ b/products/distributed-web/src/content/ethereum-gateway/connecting-your-website.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: tutorial
 ---
 
 # Connecting your Website
@@ -7,7 +8,7 @@ order: 3
 You can connect your own domain name to <https://cloudflare-eth.com> to allow
 Ethereum network access from your own domain. This means that anyone can send
 the HTTP (JSON RPC) queries as given in [Interacting with the Ethereum
-Gateway](./interacting-with-the-eth-gateway/)
+Gateway](../interacting-with-the-eth-gateway/)
 to your own domain. To do this, you should replace `https://cloudflare-eth.com`
 with your domain, e.g. `myethereumgateway.xyz`, as the target of the HTTP
 query.
diff --git a/products/distributed-web/src/content/ethereum-gateway/getting-started.md b/products/distributed-web/src/content/ethereum-gateway/getting-started.md
index 23a507756c2..47c02ae6ba7 100644
--- a/products/distributed-web/src/content/ethereum-gateway/getting-started.md
+++ b/products/distributed-web/src/content/ethereum-gateway/getting-started.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # Getting started
diff --git a/products/distributed-web/src/content/ethereum-gateway/index.md b/products/distributed-web/src/content/ethereum-gateway/index.md
index ed31cc13d1c..2d68ac552ab 100644
--- a/products/distributed-web/src/content/ethereum-gateway/index.md
+++ b/products/distributed-web/src/content/ethereum-gateway/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: concept
 ---
 
 # Ethereum Gateway
diff --git a/products/distributed-web/src/content/ethereum-gateway/interacting-with-the-eth-gateway.md b/products/distributed-web/src/content/ethereum-gateway/interacting-with-the-eth-gateway.md
index 28aec59ccc4..57ac6a8a82d 100644
--- a/products/distributed-web/src/content/ethereum-gateway/interacting-with-the-eth-gateway.md
+++ b/products/distributed-web/src/content/ethereum-gateway/interacting-with-the-eth-gateway.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: configuration
 ---
 
 # Interacting with Ethereum
diff --git a/products/distributed-web/src/content/ethereum-gateway/kill-switches.md b/products/distributed-web/src/content/ethereum-gateway/kill-switches.md
index 82cd70101ae..b6ca31b5531 100644
--- a/products/distributed-web/src/content/ethereum-gateway/kill-switches.md
+++ b/products/distributed-web/src/content/ethereum-gateway/kill-switches.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: concept
 ---
 
 # Kill Switches
diff --git a/products/distributed-web/src/content/index.md b/products/distributed-web/src/content/index.md
index 26165fff2e9..8b16c86cbfd 100644
--- a/products/distributed-web/src/content/index.md
+++ b/products/distributed-web/src/content/index.md
@@ -1,7 +1,8 @@
 ---
-title: Welcome
+title: Overview
 order: 0
 type: overview
+pcx-content: landing-page
 ---
 
 # Cloudflare Distributed Web docs
diff --git a/products/distributed-web/src/content/ipfs-gateway/automated-deployment.md b/products/distributed-web/src/content/ipfs-gateway/automated-deployment.md
index e59f1d2aa04..1bce75a9f89 100644
--- a/products/distributed-web/src/content/ipfs-gateway/automated-deployment.md
+++ b/products/distributed-web/src/content/ipfs-gateway/automated-deployment.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: reference
 ---
 
 # Automated Deployment
@@ -23,3 +24,6 @@ hash. There are several tools that help with different parts of this:
 - [dnslink-cloudflare](https://github.com/ipfs-shipyard/dnslink-cloudflare) is a
   script to programmatically update DNSLink records. This can be run with the
   `-Q` flag of `ipfs add` that only outputs the top-level hash.
+- [Fission's IPNS support](https://guide.fission.codes/developers/custom-domains/using-cloudflare-ipfs-gateway) 
+  lets you use the Fission IPFS app publishing system from the CLI
+  or from GitHub Actions, while using Cloudflare-managed DNS and gateway.
diff --git a/products/distributed-web/src/content/ipfs-gateway/browsing-ipfs.md b/products/distributed-web/src/content/ipfs-gateway/browsing-ipfs.md
index e2be8bb01ea..d1e8e9de0ca 100755
--- a/products/distributed-web/src/content/ipfs-gateway/browsing-ipfs.md
+++ b/products/distributed-web/src/content/ipfs-gateway/browsing-ipfs.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: tutorial
 ---
 
 # Browsing Content on IPFS
diff --git a/products/distributed-web/src/content/ipfs-gateway/connecting-website.md b/products/distributed-web/src/content/ipfs-gateway/connecting-website.md
index 744728ccd81..065bcf106f6 100755
--- a/products/distributed-web/src/content/ipfs-gateway/connecting-website.md
+++ b/products/distributed-web/src/content/ipfs-gateway/connecting-website.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: tutorial
 ---
 
 # Connecting Your Website
@@ -120,7 +121,7 @@ If your website is on Cloudflare, the DNS settings are accessible from your
 dashboard and can be managed through [our
 API](https://api.cloudflare.com/#dns-records-for-a-zone-update-dns-record). If
 your website is not on Cloudflare, and you need help finding the DNS records,
-[look here](https://support.google.com/projectshield/answer/6358886?hl=en/).
+[refer to Project Shield's guide.](https://support.projectshield.withgoogle.com/s/article/Find-your-Domain-Name-System-DNS-records?language=en_US).
 Serving your website from Cloudflare's gateway without the domain itself being
 on Cloudflare is called a *CNAME setup* (meaning that you manage the DNS records
 directly with your registrar). While our gateway supports CNAME setups, there's
diff --git a/products/distributed-web/src/content/ipfs-gateway/index.md b/products/distributed-web/src/content/ipfs-gateway/index.md
index eb05fe3ea15..7e42b06e5b3 100755
--- a/products/distributed-web/src/content/ipfs-gateway/index.md
+++ b/products/distributed-web/src/content/ipfs-gateway/index.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # IPFS Gateway
diff --git a/products/distributed-web/src/content/ipfs-gateway/setting-up-a-server.md b/products/distributed-web/src/content/ipfs-gateway/setting-up-a-server.md
index 907d725c7f7..be338dafeb9 100644
--- a/products/distributed-web/src/content/ipfs-gateway/setting-up-a-server.md
+++ b/products/distributed-web/src/content/ipfs-gateway/setting-up-a-server.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: tutorial
 ---
 
 # Setting Up a Server
diff --git a/products/distributed-web/src/content/ipfs-gateway/troubleshooting.md b/products/distributed-web/src/content/ipfs-gateway/troubleshooting.md
index 5dcac8cdd0d..a5f3126fea5 100644
--- a/products/distributed-web/src/content/ipfs-gateway/troubleshooting.md
+++ b/products/distributed-web/src/content/ipfs-gateway/troubleshooting.md
@@ -1,5 +1,6 @@
 ---
 order: 10
+pcx-content-type: reference
 ---
 
 # Troubleshooting
diff --git a/products/distributed-web/src/content/ipfs-gateway/updating-for-ipfs.md b/products/distributed-web/src/content/ipfs-gateway/updating-for-ipfs.md
index b0e1a4008c8..e802e5860ca 100644
--- a/products/distributed-web/src/content/ipfs-gateway/updating-for-ipfs.md
+++ b/products/distributed-web/src/content/ipfs-gateway/updating-for-ipfs.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: reference
 ---
 
 # Updating your Website for IPFS
diff --git a/products/docs-engine/docs-config.js b/products/docs-engine/docs-config.js
index 846ec849b96..85210cc4ff1 100644
--- a/products/docs-engine/docs-config.js
+++ b/products/docs-engine/docs-config.js
@@ -24,6 +24,6 @@ module.exports = {
     description: "Documentation for the open-source Cloudflare Documentation engine which powers Cloudflare's open-source documentation.",
     author: "@cloudflare",
     url: "http://developers.cloudflare.com/docs-engine",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png",
   }
 }
diff --git a/products/docs-engine/src/content/contributing/content/accessibility.md b/products/docs-engine/src/content/contributing/content/accessibility.md
index 83bf0108eff..6850c6229f2 100644
--- a/products/docs-engine/src/content/contributing/content/accessibility.md
+++ b/products/docs-engine/src/content/contributing/content/accessibility.md
@@ -1,6 +1,7 @@
 ---
 title: Accessibility
 order: 3
+pcx-content-type: best-practices
 ---
 
 # Writing accessible content
diff --git a/products/docs-engine/src/content/contributing/content/content-framework.md b/products/docs-engine/src/content/contributing/content/content-framework.md
index da8527b8edb..be53c64082f 100644
--- a/products/docs-engine/src/content/contributing/content/content-framework.md
+++ b/products/docs-engine/src/content/contributing/content/content-framework.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: configuration
 ---
 
 # Content framework
diff --git a/products/docs-engine/src/content/contributing/content/formatting.md b/products/docs-engine/src/content/contributing/content/formatting.md
index b8f16cbb45f..698f41ffeb9 100644
--- a/products/docs-engine/src/content/contributing/content/formatting.md
+++ b/products/docs-engine/src/content/contributing/content/formatting.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: best-practices
 ---
 
 # Formatting
diff --git a/products/docs-engine/src/content/contributing/content/index.md b/products/docs-engine/src/content/contributing/content/index.md
index 31818778ad0..ad746f9e194 100644
--- a/products/docs-engine/src/content/contributing/content/index.md
+++ b/products/docs-engine/src/content/contributing/content/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: navigation
 ---
 
 # Content
diff --git a/products/docs-engine/src/content/contributing/content/working-with-github.md b/products/docs-engine/src/content/contributing/content/working-with-github.md
index 662812cf66a..bdcdecad8a2 100644
--- a/products/docs-engine/src/content/contributing/content/working-with-github.md
+++ b/products/docs-engine/src/content/contributing/content/working-with-github.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: best-practices
 ---
 
 # Working with GitHub
diff --git a/products/docs-engine/src/content/contributing/content/writing-style.md b/products/docs-engine/src/content/contributing/content/writing-style.md
index a5e36f6f0c8..415a9ab57a3 100644
--- a/products/docs-engine/src/content/contributing/content/writing-style.md
+++ b/products/docs-engine/src/content/contributing/content/writing-style.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: interim
 ---
 
 # Writing style
diff --git a/products/docs-engine/src/content/contributing/development-setup.md b/products/docs-engine/src/content/contributing/development-setup.md
index e9870009c96..88c51d4b6f9 100644
--- a/products/docs-engine/src/content/contributing/development-setup.md
+++ b/products/docs-engine/src/content/contributing/development-setup.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # Development setup
diff --git a/products/docs-engine/src/content/contributing/index.md b/products/docs-engine/src/content/contributing/index.md
index 4f118597b05..48281f77d4d 100644
--- a/products/docs-engine/src/content/contributing/index.md
+++ b/products/docs-engine/src/content/contributing/index.md
@@ -1,6 +1,7 @@
 ---
 type: overview
 order: 3
+pcx-content-type: navigation
 ---
 
 # Contributing
diff --git a/products/docs-engine/src/content/contributing/to-cloudflare-docs.md b/products/docs-engine/src/content/contributing/to-cloudflare-docs.md
index ea205528bb5..7b5d81d525d 100644
--- a/products/docs-engine/src/content/contributing/to-cloudflare-docs.md
+++ b/products/docs-engine/src/content/contributing/to-cloudflare-docs.md
@@ -1,6 +1,7 @@
 ---
 title: To Cloudflare’s docs
 order: 2
+pcx-content-type: configuration
 ---
 
 # Contribute to Cloudflare’s docs
diff --git a/products/docs-engine/src/content/contributing/to-docs-engine.md b/products/docs-engine/src/content/contributing/to-docs-engine.md
index 60b2a032949..e0a6add9c1e 100644
--- a/products/docs-engine/src/content/contributing/to-docs-engine.md
+++ b/products/docs-engine/src/content/contributing/to-docs-engine.md
@@ -1,6 +1,7 @@
 ---
 title: To Docs Engine
 order: 3
+pcx-content-type: how-to
 ---
 
 # Contribute to the Docs Engine
diff --git a/products/docs-engine/src/content/examples/code-block-examples.md b/products/docs-engine/src/content/examples/code-block-examples.md
index 432f7ce2590..1fd5fcf8ee1 100644
--- a/products/docs-engine/src/content/examples/code-block-examples.md
+++ b/products/docs-engine/src/content/examples/code-block-examples.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: reference
+---
+
 # Code block examples
 
 Code blocks inside [Docs Engine Markdown](/reference/markdown) offer a variety of custom presentation mechanisms. This page contains practical examples for inspiration.
diff --git a/products/docs-engine/src/content/examples/index.md b/products/docs-engine/src/content/examples/index.md
index 99441d4f1c6..d28848aa11a 100644
--- a/products/docs-engine/src/content/examples/index.md
+++ b/products/docs-engine/src/content/examples/index.md
@@ -1,6 +1,6 @@
 ---
-type: overview
 order: 5
+pcx-content-type: navigation
 ---
 
 # Examples
diff --git a/products/docs-engine/src/content/examples/pages/class.md b/products/docs-engine/src/content/examples/pages/class.md
index 9ae109e107d..429fd5aa1fd 100644
--- a/products/docs-engine/src/content/examples/pages/class.md
+++ b/products/docs-engine/src/content/examples/pages/class.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: interim
+---
+
 # Class
 
 ## Background
diff --git a/products/docs-engine/src/content/examples/pages/example.md b/products/docs-engine/src/content/examples/pages/example.md
index 92197b7ac8b..68d7d6ded71 100644
--- a/products/docs-engine/src/content/examples/pages/example.md
+++ b/products/docs-engine/src/content/examples/pages/example.md
@@ -1,11 +1,11 @@
 ---
-type: example
 summary: A short summary of the example. Should be no more than 100 characters or so.
 demo: https://example.com
 tags:
   - Tag1
   - Tag2
   - Tag3
+pcx-content-type: interim
 ---
 
 # Example
diff --git a/products/docs-engine/src/content/examples/pages/index.md b/products/docs-engine/src/content/examples/pages/index.md
index 0329cf65fc0..ad0f83a0821 100644
--- a/products/docs-engine/src/content/examples/pages/index.md
+++ b/products/docs-engine/src/content/examples/pages/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: navigation
 ---
 
 # Example pages
diff --git a/products/docs-engine/src/content/faq.md b/products/docs-engine/src/content/faq.md
index 637d2e391c8..618a131d8a3 100644
--- a/products/docs-engine/src/content/faq.md
+++ b/products/docs-engine/src/content/faq.md
@@ -1,6 +1,7 @@
 ---
 type: overview
 order: 6
+pcx-content-type: faq
 ---
 
 # FAQ
@@ -38,6 +39,6 @@ For pages with the [`"document"` type](/reference/pages#title) (the default), th
 
 ## How does the search work?
 
-Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/adamschwartz/docs-engine-example/blob/6d725ffa554454e1daa4c0d2a8a7e44408056e6b/docs-config.js#L21-L24)).
+Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/cloudflare/cloudflare-docs/blob/fc6f1b834f60bb9f5d425bbf6c2c6e7770f77f2e/products/docs-engine/docs-config.js#L17-20)).
 
 </ContentColumn>
diff --git a/products/docs-engine/src/content/how-it-works.md b/products/docs-engine/src/content/how-it-works.md
index 1baf2e999e7..9fd8f35c1e5 100644
--- a/products/docs-engine/src/content/how-it-works.md
+++ b/products/docs-engine/src/content/how-it-works.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: interim
 ---
 
 # How it works
@@ -24,7 +25,7 @@ Each docs site built with the engine needs the following structure:
 4. A `.gitignore` which ignores at least `.docs`, `dist/worker.js`, and `node_modules`.
 5. Content in `src/content/` — A single `index.md` will do.
 
-For a repo holding a single docs site, everything but the content should be in the root, as is the case with the [Docs Engine minimal example](https://github.com/adamschwartz/docs-engine-example/tree/c45fa9f0a8affc68baf5d3517f8b890ba0522531).
+For a repo holding a single docs site, everything but the content should be in the root.
 
 However, these files can also be placed inside any sub-folder of your project. When doing this, you’ll need to then customize the `contentRepoFolder` property in `docs-config.js`, which is how the [products inside @cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products) are all set up, e.g. the [Workers product](https://github.com/cloudflare/cloudflare-docs/blob/1efd366c25bc1bdd1a40f7bc4737310c6b00d15e/products/workers/docs-config.js#L6).
 
@@ -61,31 +62,33 @@ You’ll also need a `docs-config.js` file, which is used to customize the proje
 filename: docs-config.js
 ---
 module.exports = {
-  product: "Example",
-  pathPrefix: "",
-  productLogoPathD: "M8 8v32h32V26H22V8zm18-2h16v16H26z",
-  contentRepo: "adamschwartz/docs-engine-example",
+  product: "Docs Engine",
+  pathPrefix: "/docs-engine",
+  productIconKey: "docs-engine",
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/docs-engine",
   externalLinks: [
     {
       title: "Docs Engine on GitHub",
       url: "https://github.com/cloudflare/cloudflare-docs-engine"
     },
     {
-      title: "example.com",
-      url: "https://example.com"
+      title: "Cloudflare Developer documentation",
+      url: "https://developers.cloudflare.com/docs"
     },
   ],
   search: {
     indexName: "",
     apiKey: "",
+    algoliaOptions: { "facetFilters": "" }
   },
   siteMetadata: {
-    title: "Example docs",
-    description: "These docs are an example of of a docs site built with the Cloudflare Docs Engine.",
-    author: "@adamschwartz",
-    url: "https://docs-engine-example.adam.workers.dev/",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
-  },
+    title: "Cloudflare Docs Engine docs",
+    description: "Documentation for the open-source Cloudflare Documentation engine which powers Cloudflare's open-source documentation.",
+    author: "@cloudflare",
+    url: "http://developers.cloudflare.com/docs-engine",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png",
+  }
 }
 ```
 
@@ -149,24 +152,6 @@ Learn more about the [content framework](/contributing/content/content-framework
 
 --------------------------------
 
-## Example site
-
-Here’s a minimal example site built with Docs Engine:
-
-<div className="docs-engine-example-demo"><div><div>
-<Demo src="https://docs-engine-example.adam.workers.dev" title="Docs Engine example site" aspectRatio={16/9}/>
-<style dangerouslySetInnerHTML={{__html:`
-  .docs-engine-example-demo { position: relative; pointer-events: none; overflow: hidden }
-  @media (max-width: 1430px) { .docs-engine-example-demo {display: none } /* Fix MDX parsing */ }
-  .docs-engine-example-demo > div {width: 200%; height: 400px; }
-  .docs-engine-example-demo > div > div {transform: scale(.5); transform-origin: 0 0; }
-`}}/>
-</div></div></div>
-
-__[Open demo](https://docs-engine-example.adam.workers.dev)__ · ([GitHub](https://github.com/adamschwartz/docs-engine-example))
-
---------------------------------
-
 ## See also
 
 - [Markdown reference](/reference/markdown)
diff --git a/products/docs-engine/src/content/index.md b/products/docs-engine/src/content/index.md
index 8ef75a02345..929dd1ddf49 100644
--- a/products/docs-engine/src/content/index.md
+++ b/products/docs-engine/src/content/index.md
@@ -1,10 +1,10 @@
 ---
-title: Home
-type: overview
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
-# Docs Engine docs
+# Docs Engine
 
 <ContentColumn>
 
@@ -27,9 +27,7 @@ It’s __open-source__ and [available on GitHub](https://github.com/cloudflare/c
 
 | Docs site                                                             | GitHub                                                                                                                            |
 |-----------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
-| [Minimal example](https://docs-engine-example.adam.workers.dev)       | [@adamschwartz/docs-engine-example](https://github.com/adamschwartz/docs-engine-example)                                          |
-| [Docs Engine](https://docs-engine-docs.adam.workers.dev) — This site. | [@cloudflare/cloudflare-docs/.../docs-engine](https://github.com/cloudflare/cloudflare-docs/tree/production/products/docs-engine) |
-| [Access](https://developers.cloudflare.com/access)                    | [@cloudflare/cloudflare-docs/.../access](https://github.com/cloudflare/cloudflare-docs/tree/production/products/access)           |
+| [Docs Engine (this site)](https://developers.cloudflare.com/docs-engine/) | [@cloudflare/cloudflare-docs/.../docs-engine](https://github.com/cloudflare/cloudflare-docs/tree/production/products/docs-engine) |
 | [Images](https://developers.cloudflare.com/images)                    | [@cloudflare/cloudflare-docs/.../images](https://github.com/cloudflare/cloudflare-docs/tree/production/products/images)           |
 | [Stream](https://developers.cloudflare.com/stream)                    | [@cloudflare/cloudflare-docs/.../stream](https://github.com/cloudflare/cloudflare-docs/tree/production/products/stream)           |
 | [Terraform](https://developers.cloudflare.com/terraform)              | [@cloudflare/cloudflare-docs/.../terraform](https://github.com/cloudflare/cloudflare-docs/tree/production/products/terraform)     |
diff --git a/products/docs-engine/src/content/reference/configuration.md b/products/docs-engine/src/content/reference/configuration.md
index b972fce60d3..3335372d418 100644
--- a/products/docs-engine/src/content/reference/configuration.md
+++ b/products/docs-engine/src/content/reference/configuration.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: configuration
 ---
 
 # Configuration
@@ -76,49 +77,6 @@ Create a `docs-config.js` file which exports (by setting `module.exports`) a Jav
 
 ## Examples
 
-Here’s the `docs-config.js` file for the [example project](https://github.com/adamschwartz/docs-engine-example):
-
-```js
----
-filename: docs-config.js
----
-module.exports = {
-  product: "Example",
-  pathPrefix: "",
-  productLogoPathD: "M8 8v32h32V26H22V8zm18-2h16v16H26z",
-  contentRepo: "adamschwartz/docs-engine-example",
-  externalLinks: [
-    {
-      title: "Adam Schwartz website",
-      url: "https://adamschwartz.co"
-    },
-    {
-      title: "Docs Engine on GitHub",
-      url: "https://github.com/adamschwartz/cloudflare-docs-engine"
-    },
-    {
-      title: "example.com",
-      url: "https://example.com"
-    },
-  ],
-  search: {
-    indexName: "",
-    apiKey: "",
-  },
-  siteMetadata: {
-    title: "Example docs",
-    description: "These docs are an example of of a docs site built with https://github.com/cloudflare/workers-docs-engine.",
-    author: "@adamschwartz",
-    url: "http://adamschwartz.co/docs-engine-example",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
-  },
-}
-```
-
-([Source](https://github.com/adamschwartz/docs-engine-example/blob/c45fa9f0a8affc68baf5d3517f8b890ba0522531/docs-config.js))
-
---------------------------------
-
 Here’s the `docs-config.js` file for [these docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products/docs-engine):
 
 ```js
@@ -150,7 +108,7 @@ module.exports = {
     description: "Documentation for the open-source Cloudflare Documentation engine which powers Cloudflare's open-source documentation.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/docs-engine",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png",
   }
 }
 ```
diff --git a/products/docs-engine/src/content/reference/index.md b/products/docs-engine/src/content/reference/index.md
index 9ed58709564..ce0dc9917a1 100644
--- a/products/docs-engine/src/content/reference/index.md
+++ b/products/docs-engine/src/content/reference/index.md
@@ -1,6 +1,7 @@
 ---
 type: overview
 order: 4
+pcx-content-type: navigation
 ---
 
 # Reference
diff --git a/products/docs-engine/src/content/reference/markdown.md b/products/docs-engine/src/content/reference/markdown.md
index a5f6c065182..6b35d348355 100644
--- a/products/docs-engine/src/content/reference/markdown.md
+++ b/products/docs-engine/src/content/reference/markdown.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: best-practices
 ---
 
 # Markdown
@@ -349,9 +350,9 @@ Custom presentation options like [row highlights](#highlight) and [filename head
 
 ### Highlight
 
-You can highlight rows by specifying `highlight: [...]` with an array of row numbers.
+You can highlight rows by specifying `highlight: [...]` with an array of row numbers. The array can only contain individual row numbers — for example, `5,6,7`. Currently, you cannot specify a range of rows like `5-7`.
 
-For example, here we’re specifying `highlight: [5,6,7]` in order to highlight the `hello()` function:
+For example, here we are specifying `highlight: [5,6,7]` to highlight the `hello()` function:
 
 ```js
 ---
diff --git a/products/docs-engine/src/content/reference/pages.md b/products/docs-engine/src/content/reference/pages.md
index 96d68ff7c5b..95debde6454 100644
--- a/products/docs-engine/src/content/reference/pages.md
+++ b/products/docs-engine/src/content/reference/pages.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: configuration
 ---
 
 # Pages
diff --git a/products/events/docs-config.js b/products/events/docs-config.js
index 1c8b7168e0c..7d620b72789 100644
--- a/products/events/docs-config.js
+++ b/products/events/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Join us for special Cloudflare events.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/events",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/firewall/docs-config.js b/products/firewall/docs-config.js
index 5cde16842ad..0bff34e3397 100644
--- a/products/firewall/docs-config.js
+++ b/products/firewall/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Create rules that examine incoming HTTP traffic against a set of powerful filters to block, challenge, log, or allow matching requests.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/firewall",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/firewall/src/content/cf-dashboard/create-mtls-rule.md b/products/firewall/src/content/cf-dashboard/create-mtls-rule.md
index 8bb0e5f227b..e0fc1a9aca3 100644
--- a/products/firewall/src/content/cf-dashboard/create-mtls-rule.md
+++ b/products/firewall/src/content/cf-dashboard/create-mtls-rule.md
@@ -17,7 +17,7 @@ Before you can create a mTLS rule, you must do the following:
 
 You can only use mTLS with a certificate authority (CA) that is fully managed by Cloudflare. Cloudflare generates a unique CA for each zone.
 
-If you need to use a different CA, contact a Cloudflare Customer Success Manager.
+If you need to use certificates issued by another CA, use [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/identity/devices/mutual-tls-authentication) to upload your own CA.
 
 </Aside>
 
diff --git a/products/firewall/src/content/cf-dashboard/rule-preview.md b/products/firewall/src/content/cf-dashboard/rule-preview.md
index 192d3fc4005..cfcfb8c743a 100644
--- a/products/firewall/src/content/cf-dashboard/rule-preview.md
+++ b/products/firewall/src/content/cf-dashboard/rule-preview.md
@@ -42,6 +42,8 @@ In this screenshot, a rule that matches all User-Agents that contain the string
 
 **Rule Preview does not take into account other Cloudflare firewall rules** that you have already configured. In effect, Rule Preview tests a single firewall rule in isolation. Firewall Events or any other rules with a higher priority that may have blocked or challenged a request are ignored.
 
+**You cannot test firewall rules that reference [Rules Lists](/cf-dashboard/rules-lists)**.
+
 **Cloudflare does not store the entirety of requests, so only a limited number of fields are available to Rule Preview**. The table below lists the fields that Rule Preview supports (green cells), broken down by operator. Fields and operators that are not supported are not included in this table.
 
 </ContentColumn>
@@ -150,7 +152,7 @@ In this screenshot, a rule that matches all User-Agents that contain the string
           <strong
             >Request method
             <p />
-            <code class="InlineCode">Http.request. method</code></strong
+            <code class="InlineCode">http.request.method</code></strong
           >
         </td>
         <td>&#x2705;</td>
diff --git a/products/firewall/src/content/cf-firewall-language/fields.md b/products/firewall/src/content/cf-firewall-language/fields.md
index 69c25ec76fa..a70e1dda117 100644
--- a/products/firewall/src/content/cf-firewall-language/fields.md
+++ b/products/firewall/src/content/cf-firewall-language/fields.md
@@ -25,6 +25,12 @@ Most standard fields use the same naming conventions as [Wireshark display field
 
 - The Cloudflare Firewall Rules language does not support the `slice` operator.
 
+<Aside type='note'>
+
+Access to `ip.geoip.is_in_european_union`, `ip.geoip.subdivision_1_iso_code`, and `ip.geoip.subdivision_2_iso_code` fields requires a Cloudflare Business or Enterprise plan.
+
+</Aside>
+
 The Cloudflare Firewall Rules language supports these standard fields:
 
 <table>
@@ -64,7 +70,7 @@ The Cloudflare Firewall Rules language supports these standard fields:
          </p>
       </td>
    </tr>
-   <tr>
+   <tr id="field-http-request-full-uri">
       <td valign="top"><code>http.request.full_uri</code><br /><Type>String</Type></td>
       <td>
          <p>Represents the full URI as received by the web server (does not include <code class="InlineCode">#fragment</code>, which is not sent to web servers).
@@ -84,6 +90,22 @@ The Cloudflare Firewall Rules language supports these standard fields:
          </p>
       </td>
    </tr>
+   <tr>
+      <td valign="top"><code>http.request.cookies</code><br /><Type>Map&lt;String&gt;&lt;Array&gt;</Type></td>
+      <td>
+         <p>Represents the <code class="InlineCode">Cookie</code> HTTP header associated with a request as a Map (associative array).
+         </p>
+         <p>Cookie values are not pre-processed and retain the case used in the request.</p>
+         <p><em>Decoding:</em> Cookie names are URL decoded. If two cookies have the same name after decoding, their value arrays are merged.
+         </p>
+         <p>Example:
+         <br /><code class="InlineCode">any(http.request.cookies["app"][*] == "test")</code>
+         </p>
+         <p>Example value:
+         <br /><code class="InlineCode">{'{"app": ["test"]}'}</code>
+         </p>
+      </td>
+   </tr>
    <tr>
       <td valign="top"><code>http.request.timestamp.sec</code><br /><Type>Integer</Type></td>
       <td>
@@ -92,21 +114,21 @@ The Cloudflare Firewall Rules language supports these standard fields:
          <p>Example value:
          <br /><code class="InlineCode">1484063137</code>
          </p>
-         <p>When validating HMAC tokens in an expression, pass this field as the <em>currentTimestamp</em> argument to the <code class="InlineCode">is_timed_hmac_valid_v()</code> <a href="/cf-firewall-language/functions/#hmac-validation">validation function</a>.
+         <p>When validating HMAC tokens in an expression, pass this field as the <em>currentTimestamp</em> argument to the <code class="InlineCode">is_timed_hmac_valid_v0()</code> <a href="/cf-firewall-language/functions/#hmac-validation">validation function</a>.
          </p>
       </td>
    </tr>
-   <tr>
+   <tr id="field-http-request-uri">
       <td valign="top"><code>http.request.uri</code><br /><Type>String</Type></td>
       <td>
-         <p>Represents the absolute URI of the request.
+         <p>Represents the URI path and query string of the request.
          </p>
          <p>Example value:
          <br /><code class="InlineCode">/articles/index?section=539061&expand=comments</code>
          </p>
       </td>
    </tr>
-   <tr>
+   <tr id="field-http-request-uri-path">
       <td valign="top"><code>http.request.uri.path</code><br /><Type>String</Type></td>
       <td>
          <p>Represents the URI path of the request.
@@ -116,7 +138,7 @@ The Cloudflare Firewall Rules language supports these standard fields:
          </p>
       </td>
    </tr>
-   <tr>
+   <tr id="field-http-request-uri-query">
       <td valign="top"><code class>http.request.uri.query</code><br /><Type>String</Type></td>
       <td>
          <p>Represents the entire query string, without the <code class="InlineCode">?</code> delimiter.
@@ -233,6 +255,42 @@ The Cloudflare Firewall Rules language supports these standard fields:
          </p>
       </td>
   </tr>
+  <tr id="field-raw-http-request-full-uri">
+    <td valign="top"><code>raw.http.request.full_uri</code><br /><Type>String</Type></td>
+    <td>
+      <p>Similar to the <a href="#field-http-request-full-uri"><code>http.request.full_uri</code></a> non-raw field. Represents the full URI as received by the web server without the URI fragment (if any) and without any transformation.
+      </p>
+      <p>Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.
+      </p>
+  </td>
+  </tr>
+  <tr id="field-raw-http-request-uri">
+    <td valign="top"><code>raw.http.request.uri</code><br /><Type>String</Type></td>
+    <td>
+      <p>Similar to the <a href="#field-http-request-uri"><code>http.request.uri</code></a> non-raw field. Represents the URI path and query string of the request without any transformation.
+      </p>
+      <p>Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.
+      </p>
+    </td>
+  </tr>
+  <tr id="field-raw-http-request-uri-path">
+    <td valign="top"><code>raw.http.request.uri.path</code><br /><Type>String</Type></td>
+    <td>
+      <p>Similar to the <a href="#field-http-request-uri-path"><code>http.request.uri.path</code></a> non-raw field. Represents the URI path of the request without any transformation.
+      </p>
+      <p>Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.
+      </p>
+    </td>
+  </tr>
+  <tr id="field-raw-http-request-uri-query">
+    <td valign="top"><code>raw.http.request.uri.query</code><br /><Type>String</Type></td>
+    <td>
+      <p>Similar to the <a href="#field-http-request-uri-query"><code>http.request.uri.query</code></a> non-raw field. Represents the entire query string without the <code class="InlineCode">?</code> delimiter and without any transformation.
+      </p>
+      <p>Note: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.
+      </p>
+    </td>
+  </tr>
   <tr>
       <td valign="top"><code>ssl</code><br /><Type>Boolean</Type></td>
       <td>
@@ -247,9 +305,9 @@ The Cloudflare Firewall Rules language supports these standard fields:
 
 Dynamic fields represent computed or derived values, typically related to threat intelligence about an HTTP request.
 
-<Aside type='warning' header='Important'>
+<Aside type='note'>
 
-Access to `cf.bot_management.verified_bot` and `cf.bot_management.score` fields require a Cloudflare Enterprise plan with [Bot Management](https://developers.cloudflare.com/bots/get-started/bm-subscription) enabled.
+Access to `cf.bot_management.verified_bot` and `cf.bot_management.score` fields requires a Cloudflare Enterprise plan with [Bot Management](https://developers.cloudflare.com/bots/get-started/bm-subscription) enabled.
 
 </Aside>
 
@@ -287,6 +345,15 @@ The Cloudflare Firewall Rules language supports these dynamic fields:
           <p>When <code class="InlineCode">true</code>, this field indicates the request originated from a known good bot or crawler.</p>
         </td>
     </tr>
+    <tr>
+        <td><code>cf.edge.server_ip</code><br /><Type>IP Address</Type></td>
+        <td>
+          <p>Represents the edge IP address to which the HTTP request has resolved to.
+          </p>
+          <p>This field is only meaningful for <a href="https://developers.cloudflare.com/byoip/">BYOIP customers</a>.
+          </p>
+        </td>
+    </tr>
     <tr>
         <td><code>cf.edge.server_port</code><br /><Type>Number</Type></td>
         <td>
@@ -399,6 +466,16 @@ The Cloudflare Firewall Rules language supports these dynamic fields:
          <code class="InlineCode">192.0.2.2</code>
         </td>
     </tr>
+    <tr>
+        <td><p><code>ip.geoip.country</code><br /><Type>String</Type></p>
+        </td>
+        <td>
+         Represents the 2-letter country code associated with the client IP address in <a href="https://www.iso.org/obp/ui/#search/code/">ISO 3166-1 Alpha 2</a> format.<br />
+         Example value:
+         <code class="InlineCode">GB</code>
+         <p>For more information on the ISO 3166-1 Alpha 2 format, see <a href="https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2">ISO 3166-1 Alpha 2</a> on Wikipedia.</p>
+        </td>
+    </tr>
     <tr>
         <td><p><code>ip.hdr_len</code><br /><Type>Number</Type></p>
         </td>
@@ -559,7 +636,7 @@ The Cloudflare Firewall Rules language supports these dynamic fields:
 
 ## URI argument and value fields
 
-The Cloudflare Firewall Rules language includes URI argument and value fields associated with HTTP requests. Many of these fields return arrays containing the respective values. Those that do require the `[*]` index operator, which returns an array of values for each field.
+The Cloudflare Firewall Rules language includes URI argument and value fields associated with HTTP requests. Many of these fields return [arrays](/cf-firewall-language/values#arrays) containing the respective values.
 
 The Cloudflare Firewall Rules language supports these URI argument and value fields:
 
@@ -571,7 +648,7 @@ The Cloudflare Firewall Rules language supports these URI argument and value fie
     </tr>
   </thead>
   <tbody>
-    <tr>
+    <tr id="field-http-request-uri-args">
       <td valign="top"><code>http.request.uri.args</code><br /><Type>Map&lt;String&gt;&lt;Array&gt;</Type></td>
        <td>
         <p>Represents the HTTP URI arguments associated with a request as a Map (associative array).
@@ -590,7 +667,7 @@ The Cloudflare Firewall Rules language supports these URI argument and value fie
         </p>
       </td>
     </tr>
-    <tr>
+    <tr id="field-http-request-uri-args-names">
       <td valign="top"><code>http.request.uri.args.names</code><br /><Type>Array&lt;String></Type></td>
       <td>
         <p>Represents the names of the arguments in the HTTP URI query string. Names are not pre-processed and retain the case used in the request.
@@ -608,7 +685,7 @@ The Cloudflare Firewall Rules language supports these URI argument and value fie
         </p>
       </td>
     </tr>
-    <tr>
+    <tr id="field-http-request-uri-args-values">
       <td valign="top"><code>http.request.uri.args.values</code><br /><Type>Array&lt;String></Type></td>
       <td>
         <p>Represents the values of arguments in the HTTP URI query string. Values are not pre-processed and retain the case used in the request. They are in the same order as in the request.
@@ -626,12 +703,33 @@ The Cloudflare Firewall Rules language supports these URI argument and value fie
         </p>
       </td>
     </tr>
+    <tr id="field-raw-http-request-uri-args">
+      <td valign="top"><code>raw.http.request.uri.args</code><br /><Type>Map&lt;String&gt;&lt;Array&gt;</Type></td>
+       <td>
+        <p>Contains the same field values as <a href="#field-http-request-uri-args"><code>http.request.uri.args</code></a>.
+        </p>
+      </td>
+    </tr>
+    <tr id="field-raw-http-request-uri-args-names">
+      <td valign="top"><code>raw.http.request.uri.args.names</code><br /><Type>Array&lt;String></Type></td>
+      <td>
+        <p>Contains the same field values as <a href="#field-http-request-uri-args-names"><code>http.request.uri.args.names</code></a>.
+        </p>
+      </td>
+    </tr>
+    <tr id="field-raw-http-request-uri-args-values">
+      <td valign="top"><code>raw.http.request.uri.args.values</code><br /><Type>Array&lt;String></Type></td>
+      <td>
+        <p>Contains the same field values as <a href="#field-http-request-uri-args-names"><code>http.request.uri.args.values</code></a>.
+        </p>
+      </td>
+    </tr>
   </tbody>
 </table>
 
 ## HTTP header fields
 
-The Firewall Rules language includes fields that represent properties of HTTP request headers. Many of these return arrays containing the respective values. Those that do require the `[*]` index operator, which returns an array of values for each field.
+The Firewall Rules language includes fields that represent properties of HTTP request headers. Many of these return [arrays](/cf-firewall-language/values#arrays) containing the respective values.
 
 The Cloudflare Firewall Rules language supports these HTTP header fields:
 
@@ -640,7 +738,7 @@ The Cloudflare Firewall Rules language supports these HTTP header fields:
       <td><strong>Field Name</strong></td>
       <td style="width: 50%;"><strong>Description</strong></td>
    </tr>
-   <tr>
+   <tr id="field-http-request-headers">
       <td valign="top"><code>http.request.headers</code><br /><Type>Map&lt;String&gt;&lt;Array&gt;</Type></td>
       <td>
          <p>Represents HTTP request headers as a Map (or associative array).
@@ -725,13 +823,21 @@ The Cloudflare Firewall Rules language supports these HTTP header fields:
 
 ## HTTP body fields
 
-<Aside type='warning' header='Important'>
+<Aside type='note'>
 
 Access to HTTP body is an add-on product of the Cloudflare Enterprise plan.
 
 </Aside>
 
-The Firewall Rules language includes fields that represent properties of an HTTP request body. Many of these return arrays containing the respective values. Those that do require the `[*]` index operator, which returns an array of values for each field.
+The Firewall Rules language includes fields that represent properties of an HTTP request body. Many of these return [arrays](/cf-firewall-language/values#arrays) containing the respective values.
+
+<Aside type="warning">
+
+The value of `http.request.body.*` fields has a maximum size of 128 KB, which means that you cannot define expressions that rely on request body data beyond the first 128 KB. If the request body is larger, the body fields will contain a truncated value and the `http.request.body.truncated` field will be set to `true`.
+
+The maximum body size applies only to the values of HTTP body fields — the origin server will still receive the complete request body.
+
+</Aside>
 
 The Cloudflare Firewall Rules language supports these HTTP body fields:
 
@@ -833,3 +939,7 @@ The Cloudflare Firewall Rules language supports these HTTP body fields:
     </tr>
   </tbody>
 </table>
+
+---
+
+_GeoIP is the registered trademark of MaxMind, Inc._
diff --git a/products/firewall/src/content/cf-firewall-language/functions.md b/products/firewall/src/content/cf-firewall-language/functions.md
index 478806550a2..b17bb6c95d9 100644
--- a/products/firewall/src/content/cf-firewall-language/functions.md
+++ b/products/firewall/src/content/cf-firewall-language/functions.md
@@ -22,7 +22,7 @@ In the expression below, the`lower()` function transforms `http.host` values to
 lower(http.host) == "www.cloudflare.com"
 ```
 
-Transformation functions that take arrays as an argument type require the `[*]` index operator, which returns an array of values for each field.
+Transformation functions that do not take arrays as an argument type require the `[*]` special index notation. Refer to [Arrays](/cf-firewall-language/values#arrays) for more information.
 
 The Cloudflare Firewall Rules language supports these transformation functions:
 
@@ -40,7 +40,7 @@ The Cloudflare Firewall Rules language supports these transformation functions:
 
 - <code>all(<Type>Array</Type>{'<'}<ParamType>Boolean</ParamType>{'>'})</code> <Type>Boolean</Type>
 
-  - Returns <code class="InlineCode">true</code> when the comparison operator in the argument returns `true` for <em>all</em> of the values in the argument array. Returns <code class="InlineCode">false</code> otherwise.
+  - Returns <code class="InlineCode">true</code> when the comparison operator in the argument returns `true` for <em>all</em> values in the argument array. Returns <code class="InlineCode">false</code> otherwise.
 
   - <em>Example:</em><br />
 
@@ -62,7 +62,7 @@ The Cloudflare Firewall Rules language supports these transformation functions:
     `ends_with("/welcome.html", ".html") == true`
 
     <Aside type='warning'>
-    
+
     **Warning:** You can only use the `ends_with()` function in [rulesets](/cf-rulesets) and [Transform Rules](https://developers.cloudflare.com/rules/transform).
 
     </Aside>
@@ -108,7 +108,7 @@ The Cloudflare Firewall Rules language supports these transformation functions:
     `regex_replace("/foo/a/path", "^/foo/([^/]*)/(.*)$", "/bar/${2}/${1}") == "/bar/path/a/"`
 
     <Aside type='warning'>
-    
+
     **Warning:** You can only use the `regex_replace()` function in [rewrite expressions of Transform Rules](https://developers.cloudflare.com/rules/transform). Additionally, the first argument must be a field under `http.request.headers` or `http.request.uri`.
 
     </Aside>
@@ -129,7 +129,7 @@ The Cloudflare Firewall Rules language supports these transformation functions:
     `starts_with("/blog/first-post", "/blog") == true`
 
     <Aside type='warning'>
-    
+
     **Warning:** You can only use the `starts_with()` function in [rulesets](/cf-rulesets) and [Transform Rules](https://developers.cloudflare.com/rules/transform).
 
     </Aside>
@@ -165,7 +165,7 @@ The Cloudflare Firewall Rules language supports these transformation functions:
 
     - <code class="InlineCode">%20</code> and <code class="InlineCode">+</code> decode to space characters <code class="InlineCode"> </code>
 
-    - <code class="InlineCode">%E4%BD</code> decodes to  <code class="InlineCode">ä½ </code>
+    - <code class="InlineCode">%E4%BD</code> decodes to <code class="InlineCode">ä½ </code>
 
   - <em>Example:</em><br />
 
@@ -177,9 +177,9 @@ The Cloudflare Firewall Rules language supports these transformation functions:
 
 - <code>bit_slice(<Type>String</Type>, <Type>Number</Type>, <Type>Number</Type>)</code> <Type>Number</Type>
 
-  - Select a slice of contiguous bits from a string field.  This is primarily intended for use with <code class="InlineCode">ip</code> and <code class="InlineCode">tcp</code>.
+  - Select a slice of contiguous bits from a string field. This is primarily intended for use with <code class="InlineCode">ip</code> and <code class="InlineCode">tcp</code>.
   - The slice can be no longer than 31 bits, but multiple calls can be joined together via a logical expression.
-  - Use of structure fields is preferred over this mechanism. 
+  - Use of structure fields is preferred over this mechanism.
 
 ## HMAC validation
 
@@ -195,12 +195,12 @@ You can validate hash-based message authentication code (HMAC) tokens in a Firew
 
 ```java
 is_timed_hmac_valid_v0(
-   <String literal as Key>,
-   <String field as MessageMAC>,
-   <Integer literal as ttl>,
-   <Integer as currentTimeStamp>,
-   <Optional Integer literal as lengthOfSeperator, default: 0>,
-   <Optional String literal as flags>
+  <String literal as Key>,
+  <String field as MessageMAC>,
+  <Integer literal as ttl>,
+  <Integer as currentTimeStamp>,
+  <Optional Integer literal as lengthOfSeparator, default: 0>,
+  <Optional String literal as flags>
 ) -> <Bool as result>
 ```
 
@@ -230,9 +230,9 @@ The `is_timed_hmac_valid_v0()` function has these parameter definitions:
 
 - _flags_ <Type>String literal</Type> <PropMeta>optional</PropMeta>
 
-  -  When you set this optional argument to `` `s` ``, the function expects the value of the base64-encoded _mac_ in the _MessageMAC_ argument to use the URL-safe character set with no padding.
+  - When you set this optional argument to `'s'`, the function expects the value of the base64-encoded _mac_ in the _MessageMAC_ argument to use the URL-safe character set with no padding.
 
-  -  When you do **not** set the value of _flags_ to `'s'`, you must URL encode the base64 value for _mac_ in the _MessageMAC_ argument.
+  - When you do **not** set the value of _flags_ to `'s'`, you must URL encode the base64 value for _mac_ in the _MessageMAC_ argument.
 
 </Definitions>
 
@@ -285,26 +285,26 @@ and is composed of these parentheses-delimited expressions:
     </tr>
     <tr>
       <td valign="top"><code>(.{'{43,}'})</code></td>
-      <td><p>A base64-encoded version of the <em>MAC</em>. When you do not set the value of the <em>urlSafe</em> argument in the HMAC validation function to <code class="InlineCode">s</code>, you must URL encode the base64 value for <em>mac</em>.</p>
-      <p>When the base64 MAC encoding is URL-safe, the value for <em>mac</em>contains 43 bytes. Otherwise, the value will be 44 bytes or more, because of URL encoding.</p></td>
+      <td><p>A base64-encoded version of the <em>MAC</em>. When you do not set the value of the <em>urlSafe</em> argument in the HMAC validation function to <code class="InlineCode">'s'</code>, you must URL encode the base64 value for <em>mac</em>.</p>
+      <p>When the base64 MAC encoding is URL-safe, the value for <em>mac</em> contains 43 bytes. Otherwise, the value will be 44 bytes or more, because of URL encoding.</p></td>
       <td valign="top"><code class="InlineCode">IaLGSmELTvlhfd0ItdN6PhhHTFhzx<br />73EX8uy%2FcSDiIU%3D</code></td>
     </tr>
   </tbody>
 </table>
 
-For details on generating a MessageMAC, see [_Implement token creation_](https://support.cloudflare.com/hc/en-us/articles/115001376488-Configuring-Token-Authentication#6P9Gz7kmyxQrpL6r6iPKQR)
+For details on generating a MessageMAC, see [_Implement token creation_](https://support.cloudflare.com/hc/articles/115001376488#6P9Gz7kmyxQrpL6r6iPKQR).
 
 ## HMAC validation examples
 
 <Aside type='warning' header='Important'>
 
-When you do not use the optional _flags_ argument for `_is_timed_hmac_valid()`, you must URL encode the base64 value for _mac_ in the _MessageMAC_ argument.
+When you do not use the optional _flags_ argument for `is_timed_hmac_valid_v0()`, you must URL encode the base64 value for _mac_ in the _MessageMAC_ argument.
 
 For more information, see [HMAC Validation: Overview](#overview).
 
 </Aside>
 
-#### Simple case
+### Simple case
 
 Consider the case where the MessageMAC is contained entirely within a single field, as in this example URI path:
 
@@ -312,26 +312,26 @@ Consider the case where the MessageMAC is contained entirely within a single fie
 /download/cat.jpg?verify=1484063787-IaLGSmELTvlhfd0ItdN6PhhHTFhzx73EX8uy%2FcSDiIU%3D
 ```
 
-Note how the URI maps to the elements of the MessageMac:
+Note how the URI maps to the elements of the MessageMAC:
 
 - _message_: `/download/cat.jpg`
 - _separator_: `?verify=`
 - _timestamp_: `1484063787`
 - _mac_: `IaLGSmELTvlhfd0ItdN6PhhHTFhzx73EX8uy%2FcSDiIU%3D`
 
-When the MessageMac is contained entirely within a single field such as `http.request.uri`, using the validation function is straightforward. Simply pass the name of the field to the _MessageMAC_ argument:
+When the MessageMAC is contained entirely within a single field such as `http.request.uri`, using the validation function is straightforward. Pass the name of the field to the _MessageMAC_ argument:
 
 ```java
 is_timed_hmac_valid_v0(
-    "mysecretkey",
-    http.request.uri,
-    100000,
-    http.request.timestamp.sec,
-    8
+  "mysecretkey",
+  http.request.uri,
+  100000,
+  http.request.timestamp.sec,
+  8
 )
 ```
 
-#### Concatenated MessageMAC argument
+### Concatenated MessageMAC argument
 
 To compose a MessageMAC from more than one field, use the `concat()` function.
 
@@ -339,15 +339,15 @@ This example constructs the MessageMAC by concatenating the request URI and two
 
 ```java
 is_timed_hmac_valid_v0(
-    "mysecretkey",
-    concat(
-        http.request.uri,
-        http.request.headers["timestamp"][0],
-        "-",
-        http.request.headers["mac"][0]),
-    100000,
-    http.request.timestamp.sec,
-    0
+  "mysecretkey",
+  concat(
+    http.request.uri,
+    http.request.headers["timestamp"][0],
+    "-",
+    http.request.headers["mac"][0]),
+  100000,
+  http.request.timestamp.sec,
+  0
 )
 ```
 
diff --git a/products/firewall/src/content/cf-firewall-language/values.md b/products/firewall/src/content/cf-firewall-language/values.md
index 22cc11fe6df..280862894b0 100644
--- a/products/firewall/src/content/cf-firewall-language/values.md
+++ b/products/firewall/src/content/cf-firewall-language/values.md
@@ -29,7 +29,7 @@ Note in this example that the first and last `"` characters in `"token-type=\"JW
 
 Since the evaluation of expressions using string values is case-sensitive, consider writing more than one simple expression to capture variants.
 
-Cloudflare Business and Enterprise customer plans have access to the `matches` [comparison operator](https://developers.cloudflare.com/firewall/cf-firewall-language/operators/#comparison-operators) which supports regular expressions, so that you can capture multiple variants of a value with a single expression.
+Cloudflare Business and Enterprise customer plans have access to the `matches` [comparison operator](/cf-firewall-language/operators/#comparison-operators) which supports regular expressions, so that you can capture multiple variants of a value with a single expression.
 
 ## Boolean values
 
@@ -47,6 +47,48 @@ To match requests where `ssl` is `false`, use the boolean `not` operator :
 not ssl
 ```
 
+## Arrays
+
+The Cloudflare Firewall Rules language includes [fields](/cf-firewall-language/fields) of `Array` type and [functions](/cf-firewall-language/functions) with `Array` arguments and return values.
+
+You can access individual array elements using an index (a non-negative value) between square brackets (`[]`). Array indexes start at `0` (zero).
+
+Use the special notation `[*]` when specifying an expression that will be evaluated for each array element (like the [`map` high-order function](https://wikipedia.org/wiki/Map_(higher-order_function))). This special index notation will unpack the array, call the enclosing function for all its elements individually, and return a new array containing all the individual return values.
+
+### Examples
+
+Consider the `http.request.headers.names` field with type `Array<String>` in the following examples:
+
+* Obtain the first element in the array:<br/>
+  `http.request.headers.names[0]`
+
+* Check if the first array element is equal to `Content-Type` (case sensitive):<br/>
+  `http.request.headers.names[0] == "Content-Type"`
+
+* Check if any array element is equal to `Content-Type` (case sensitive):<br/>
+  `any(http.request.headers.names[*] == "Content-Type")`
+
+* Check if any array element is equal to `Content-Type`, ignoring the case:<br/>
+  `any(lower(http.request.headers.names[*])[*] == "content-type")`
+
+In the last example, the `lower()` function includes the `[*]` notation so that the function is evaluated for each array element. This function, used along `[*]`, returns a new array where each element of the input array is converted to lowercase. Then, the string comparison uses `[*]` to transform the array resulting from applying `lower()` to each header name into an array of boolean values. Finally, `any()` evaluates to true if at least one of these array elements is true.
+
+### Final notes
+
+It is not possible to define your own arrays. You can only use arrays returned by fields, either directly or modified by functions.
+
+Accessing an out-of-bounds array index produces a "missing value". A missing value has the following behavior:
+
+* Any comparison `<expr> <op> <literal>` where `<expr>` evaluates to a missing value will evaluate to false.
+* Function calls like `function(<expr>)`, where `<expr>` evaluates to a missing value, will return a missing value in most cases, but the exact behavior can vary per function.
+
+You can only use `[*]` multiple times in the same expression if applied to the same array. Also, you can only use `[*]` in the first argument of a function call.
+
+The Firewall Rules language [operators](/cf-firewall-language/operators) do not directly support arrays or the `[*]` operator — however, they support indexed array elements like `array_value[0]`. For example, you cannot use `[*]` with the `==` operator outside the context of an enclosing function call:
+
+* `http.request.headers.names[*] == "Content-Type"` — **Invalid** expression
+* `any(http.request.headers.names[*] == "Content-Type")` — **Valid** expression
+
 ## Rules Lists
 
 [Rules Lists](/cf-firewall-rules/rules-lists) allow you to create a group of IP addresses and refer to them collectively, by name, in your firewall rule expressions.
diff --git a/products/firewall/src/content/cf-firewall-rules/api-shield.md b/products/firewall/src/content/cf-firewall-rules/api-shield.md
index 8bcf4694908..7d429eea3b8 100644
--- a/products/firewall/src/content/cf-firewall-rules/api-shield.md
+++ b/products/firewall/src/content/cf-firewall-rules/api-shield.md
@@ -48,7 +48,7 @@ To protect your application with mTLS authentication, use this workflow:
 
 API Shield's Mutual TLS requires Cloudflare-issued certificates. You can use mTLS with any fully managed certificate authority (CA) where Cloudflare issues the client certificates.
 
-If you need to use certificates issued by another (CA), please reach out to a Cloudflare Customer Success Manager.
+If you need to use certificates issued by another CA, use <a href="https://developers.cloudflare.com/cloudflare-one/identity/devices/mutual-tls-authentication?">Cloudflare Access</a> to upload your own CA.
 
 When using Yubikeys, the browser may prompt for unlocking the key due to a problem in Yubikey's PKCS#11 library.
 
diff --git a/products/firewall/src/content/cf-firewall-rules/fields-and-expressions.md b/products/firewall/src/content/cf-firewall-rules/fields-and-expressions.md
index 2a1b5818384..ea75b3cdcc7 100644
--- a/products/firewall/src/content/cf-firewall-rules/fields-and-expressions.md
+++ b/products/firewall/src/content/cf-firewall-rules/fields-and-expressions.md
@@ -47,7 +47,7 @@ This Expression Builder screenshot shows an expression for matching requests tha
 Notice how the **Expression Preview** displays the expression in text:
 
 ```sql
-ip.geoip.country ne "GB"
+(ip.geoip.country ne "GB")
 ```
 
 In this example, `ip.geoip.country` represents the country associated with the requesting client’s IP address, and the value `"GB"` represents the country code to match. The `ne` notation between them represents the _not equal_ comparison operator. Together, the expression specifies a match for any request with a country field value other than `GB`.
@@ -80,7 +80,7 @@ To match only external requests for content, use the `and` operator, as in this
 http.referer ne ".example.com" and http.request.uri.path eq "/content/"
 ```
 
-Compound expressions only matches requests that satisfy each of the simple expressions within. That is because the logical `and` operator requires that both operands be true for the compound expression to return `true`.
+Compound expressions only match requests that satisfy each of the simple expressions within. That is because the logical `and` operator requires that both operands be true for the compound expression to return `true`.
 
 In general, compound expressions use this pattern:
 
diff --git a/products/firewall/src/content/cf-firewall-rules/index.md b/products/firewall/src/content/cf-firewall-rules/index.md
index 5647801d61f..b990d81753c 100644
--- a/products/firewall/src/content/cf-firewall-rules/index.md
+++ b/products/firewall/src/content/cf-firewall-rules/index.md
@@ -28,19 +28,44 @@ You can also manage Firewall Rules through Terraform. For more, see [_Getting St
 
 The **Rules List** gives you a snapshot of recent activity and allows you to manage firewall rules in a single convenient location (see image below).
 
-![Firewall Rules tab](../images/firewall-rules-introduction-1.png)
+![Firewall Rules tab](../images/cf-firewall-rules-panel.png)
+
+#### Challenge Solve Rate (CSR)
+
+The **Rules List** displays each rule's **CSR** (Challenge Solve Rate), which is the percentage of issued challenges that were solved. This metric applies to rules configured with _Challenge (Captcha)_ or _JS Challenge_ actions, and it is calculated as follows:
+
+<p><var>CSR</var> = <var>number of challenges solved</var> / <var>number of challenges issued</var></p>
+
+Hover over the CSR to reveal the number of issued and solved CAPTCHA challenges:
+
+![Revealing the number of issued vs. solved CAPTCHA challenges](../images/firewall-rules-csr-hover.png)
+
+A low CSR means that Cloudflare is issuing a low number of CAPTCHA challenges to actual humans, since these are the solved challenges.
+
+You should aim for a low Challenge Solve Rate. Review the CSR of your CAPTCHA rules periodically and adjust them if necessary:
+
+* If the rate is higher than expected, for example regarding a Bot Management rule, consider relaxing the rule criteria so that you issue fewer challenges to human visitors.
+* If the rate is 0%, no CAPTCHA challenges are being solved. This means that you have no human visitors whose requests match the rule filter. Consider changing the rule action to _Block_.
+
+<Aside type="warning" header="Important">
+
+Currently, Cloudflare does not calculate the CSR of Managed Challenges.
+
+For customers on a Free plan, any rules configured with the _Challenge (Captcha)_ action now use Managed Challenges. For more information, see [Understanding Cloudflare Captchas and Challenge Passage](https://support.cloudflare.com/hc/articles/200170136#managed-challenge).
+
+</Aside>
 
 ### Expression Builder
 
 Both the **Create Firewall** and **Edit Firewall** panels include the visual **Expression Builder** (outlined below, in orange), which is an excellent tool to start with.
 
-![Expression Builder](../images/firewall-rules-introduction-2.png)
+![Expression Builder](../images/firewall-rules-intro-exp-builder.png)
 
 ### Expression Editor
 
 Advanced users will appreciate the **Expression Editor** (shown below), which trades the visual simplicity of the builder for the raw power of the [Cloudflare Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language). The editor also supports advanced features, such as grouping symbols, for constructing highly sophisticated, targeted rules.
 
-![Expression Editor](../images/firewall-rules-introduction-3.png)
+![Expression Editor](../images/firewall-rules-intro-exp-editor.png)
 
 ### Firewall Rules APIs
 
diff --git a/products/firewall/src/content/cf-rulesets/add-rule-phase-rulesets.md b/products/firewall/src/content/cf-rulesets/add-rule-phase-rulesets.md
new file mode 100644
index 00000000000..235a1342a12
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/add-rule-phase-rulesets.md
@@ -0,0 +1,174 @@
+---
+pcx-content-type: how-to
+type: overview
+order: 720
+---
+
+# Add rules to phase entry point rulesets
+
+A phase entry point ruleset contains an ordered list of rules that run in that phase. A rule in an entry point ruleset can execute a different ruleset. You can have entry point rulesets for each phase at the account level and at the zone level.
+
+To add one or more rules to a phase entry point ruleset, use the [Update ruleset](/cf-rulesets/rulesets-api/update) method of the [Rulesets API](/cf-rulesets/rulesets-api). When you add a rule to an entry point ruleset, the entry point ruleset is created automatically if it does not exist. This API method requires that you include in the request all rules you want to keep in the ruleset, or else they will be removed.
+
+If you are adding a **single** rule to a ruleset, consider using the [Add rule to ruleset](/cf-rulesets/rulesets-api/add-rule) API method instead. In this case, the request only includes the definition of the new rule.
+
+<Aside type="note" header="Creating an entry point ruleset">
+
+Instead of relying on the automatic creation of an entry point ruleset, you can also create this ruleset explicitly using the [Create ruleset](/cf-rulesets/rulesets-api/create) method.
+
+</Aside>
+
+---
+
+## Examples
+
+<details>
+<summary>Example: Set the rules of a phase entry point ruleset at the zone level</summary>
+<div>
+
+The following example sets the rules of a phase entry point ruleset at the zone level for the `http_request_firewall_managed` phase using the [Update ruleset](/cf-rulesets/rulesets-api/update) API method.
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/phases/http_request_firewall_managed/entrypoint" \
+-d '{
+  "rules": [
+    {
+      "action": "execute",
+      "action_parameters": {
+        "id": "{managed-ruleset-id-1}"
+      },
+      "expression": "true"
+    },
+    {
+      "action": "execute",
+      "action_parameters": {
+        "id": "{managed-ruleset-id-2}"
+      },
+      "expression": "true"
+    }
+  ]
+}'
+```
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Default",
+    "description": "",
+    "kind": "zone",
+    "version": "1",
+    "rules": [
+      {
+        "id": "{rule-id-1}",
+        "version": "1",
+        "action": "execute",
+        "expression": "true",
+        "action_parameters": {
+          "id": "{managed-ruleset-id-1}"
+        },
+        "last_updated": "2021-06-17T15:42:37.917815Z"
+      },
+      {
+        "id": "{rule-id-2}",
+        "version": "1",
+        "action": "execute",
+        "expression": "true",
+        "action_parameters": {
+          "id": "{managed-ruleset-id-2}"
+        },
+        "last_updated": "2021-06-17T15:42:37.917815Z"
+      }
+    ],
+    "last_updated": "2021-06-17T15:42:37.917815Z",
+    "phase": "http_request_firewall_managed"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example: Add a single rule to a phase entry point ruleset at the zone level</summary>
+<div>
+
+The following example adds a single rule to a phase entry point ruleset (with ID `{ruleset-id}`) at the zone level using the [Add rule to ruleset](/cf-rulesets/rulesets-api/add-rule) API method.
+
+```json
+---
+header: Request
+---
+curl -X POST \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zone/{zone-id}/rulesets/{ruleset-id}/rules" \
+-d '{
+  "action": "execute",
+  "action_parameters": {
+    "id": "{managed-ruleset-id}"
+  },
+  "expression": "true"
+}'
+```
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level phase entry point ruleset",
+    "description": "",
+    "kind": "root",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{existing-rule-id}",
+        "version": "1",
+        "action": "execute",
+        "expression": "true",
+        "action_parameters": {
+          "id": "{another-managed-ruleset-id}"
+        },
+        "last_updated": "2021-03-17T15:42:37.917815Z"
+      },
+      {
+        "id": "{new-rule-id}",
+        "version": "1",
+        "action": "execute",
+        "expression": "true",
+        "action_parameters": {
+          "id": "{managed-ruleset-id}"
+        },
+        "last_updated": "2021-06-30T15:42:37.917815Z"
+      }
+    ],
+    "last_updated": "2021-06-30T15:42:37.917815Z",
+    "phase": "http_request_firewall_managed"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
+
+## Next steps
+
+To deploy a ruleset in a phase, add a rule that executes that ruleset to the entry point ruleset. For more information, see [Deploy rulesets](/cf-rulesets/deploy-rulesets).
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-joomla-only.md b/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-joomla-only.md
index 6fb8920da32..f6ca4e4634c 100644
--- a/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-joomla-only.md
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-joomla-only.md
@@ -7,23 +7,17 @@ order: 772
 
 # Use category overrides to enable Joomla rules
 
-<Aside type='warning' header='Important'>
+Use the [Rulesets API](/cf-rulesets/rulesets-api) to configure the execution of a Managed Ruleset and override its behavior. By default, enabled rules perform the actions defined by the Managed Ruleset issuer. This example uses overrides to ensure that only rules with a specific tag are enabled.
 
-This feature is part of an early access experience for selected customers.
+Follow the steps below to configure the execution of a Managed Ruleset with two overrides for enabling only the rules tagged with `joomla`.
 
-</Aside>
-
-Use the [Rulesets API](/cf-rulesets/rulesets-api) to deploy Managed Rulesets and override their behavior. This ensures that **only rules with a specific tag are enabled**. By default, enabled rules run with actions set by the ruleset issuer in the Managed Ruleset.
-
-Follow the steps below to deploy Managed Rulesets that enable rules tagged with `joomla`.
-
-1. [Add a rule](/cf-rulesets/deploy-rulesets) to the ruleset of a phase that deploys a Managed Ruleset.
+1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase entry point ruleset that executes a Managed Ruleset.
 1. [Configure a ruleset override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that disables all rules in the Managed Ruleset.
 1. Configure a tag override that enables only the rules with a given tag.
 
 Tag overrides take precedence over ruleset overrides. Only the rules with the specified tag are enabled, and all other rules are disabled.
 
-The example below uses the [Update ruleset](/cf-rulesets/rulesets-api/update/) endpoint to deploy the Cloudflare Managed Ruleset to a phase with only Joomla rules enabled. Note that the `name`, `kind`, and `phase` fields are omitted from the request because they are immutable.
+The example below uses the [Update ruleset](/cf-rulesets/rulesets-api/update) endpoint to deploy the Cloudflare Managed Ruleset to a phase with only Joomla rules enabled. The `name`, `kind`, and `phase` fields are omitted from the request because they are immutable.
 
 <details>
 <summary>Example: Enable only Joomla rules using category overrides at the zone level</summary>
@@ -105,7 +99,7 @@ curl -X PUT \
 
 You can add more than one category override to a rule.
 
-The example below uses a `PUT` request to add two overrides to the deployment of a Managed Ruleset (`{managed-ruleset-id}`) in the `http_request_firewall_managed` phase. Note that the `name`, `kind`, and `phase` fields are omitted from the request because they are immutable.
+The example below uses a `PUT` request to add two overrides to the rule that executes a Managed Ruleset (`{managed-ruleset-id}`) in the `http_request_firewall_managed` phase. Note that the `name`, `kind`, and `phase` fields are omitted from the request because they are immutable.
 
 <details>
 <summary>Example: Add more than one category override at the zone level</summary>
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block.md b/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block.md
index 7c6d3fc1f1a..ea08595e661 100644
--- a/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block.md
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block.md
@@ -7,18 +7,12 @@ order: 771
 
 # Use tag overrides to set WordPress rules to Block
 
-<Aside type='warning' header='Important'>
+Follow the steps below to create a rule that executes a Managed Ruleset and defines an override for rules with a specific tag.
 
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-Follow the steps below to deploy a Managed Ruleset and override rules for a specific tag.
-
-1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase to deploy a Managed Ruleset.
+1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase entry point ruleset that executes a Managed Ruleset.
 1. [Configure a tag override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that sets a specified action for all rules with a given tag.
 
-The example below uses the [Update ruleset](/cf-rulesets/rulesets-api/update/) operation to execute the steps in a single `PUT` request.
+The example below uses the [Update ruleset](/cf-rulesets/rulesets-api/update) operation to perform the two steps in a single `PUT` request.
 
 * Add a rule to the ruleset of the `http_request_firewall_managed` phase that applies the **Cloudflare Managed Ruleset**.
 * Override rules with the `wordpress` tag to set the action to `block`. All other rules use the default action provided by the ruleset issuer.
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/enable-selected-rules.md b/products/firewall/src/content/cf-rulesets/common-use-cases/enable-selected-rules.md
index 8c7f3aa6502..4e6c96b8456 100644
--- a/products/firewall/src/content/cf-rulesets/common-use-cases/enable-selected-rules.md
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/enable-selected-rules.md
@@ -7,27 +7,21 @@ order: 773
 
 # Use rulesets and rule overrides to only enable selected rules
 
-<Aside type='warning' header='Important'>
+Use a ruleset override and a rule override in a phase entry point ruleset to execute only selected rules in a Managed Ruleset.
 
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-Use a ruleset override and a rule override in the ruleset of a phase to deploy selected rules in a Managed Ruleset.
-
-1. [Add a rule](/cf-rulesets/deploy-rulesets) to the ruleset of a phase to deploy a Managed Ruleset.
-1. [Configure a ruleset override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that disables all rules in the ruleset.
-1. [Configure a rule override](/cf-rulesets/managed-rulesets/override-managed-ruleset) to set an action for the rules you want to deploy.
+1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase entry point ruleset that executes a Managed Ruleset.
+1. [Configure a ruleset override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that disables all rules in the Managed Ruleset.
+1. [Configure a rule override](/cf-rulesets/managed-rulesets/override-managed-ruleset) to set an action for the rules you want to execute.
 
 <details>
-<summary>Example: Deploy ruleset and rule overrides at the zone level</summary>
+<summary>Example: Configure ruleset and rule overrides at the zone level</summary>
 <div>
 
-The following `PUT` request uses the [Update ruleset](/cf-rulesets/rulesets-api/update/) operation at the zone level to deploy only two rules from a Managed Ruleset to the `http_request_firewall_managed` phase.
+The following `PUT` request uses the [Update ruleset](/cf-rulesets/rulesets-api/update) operation at the zone level to execute only two rules from a Managed Ruleset in the `http_request_firewall_managed` phase.
 
 In this example:
 
-* `"id": "{managed-ruleset-id}"` adds a rule to the phase to apply a Managed Ruleset to requests for the specified zone (`{zone-id}`).
+* `"id": "{managed-ruleset-id}"` adds a rule to the phase entry point ruleset to execute a Managed Ruleset for requests in the specified zone (`{zone-id}`).
 * `"enabled": false` defines an override at the ruleset level to disable all rules in the Managed Ruleset.
 * `"rules": [{"id": "{rule-id-1}", "action": "block", "enabled": true}, {"id": "{rule-id-2}", "action": "log", "enabled": true}]` defines a list of overrides at the rule level to enable two individual rules.
 
@@ -68,14 +62,14 @@ curl -X PUT \
 </details>
 
 <details>
-<summary>Example: Deploy ruleset and rule overrides at the account level</summary>
+<summary>Example: Configure ruleset and rule overrides at the account level</summary>
 <div>
 
-The following `PUT` request uses the [Update ruleset](/cf-rulesets/rulesets-api/update/) operation at the account level to deploy only two rules from a Managed Ruleset to the `http_request_firewall_managed` phase.
+The following `PUT` request uses the [Update ruleset](/cf-rulesets/rulesets-api/update) operation at the account level to execute only two rules from a Managed Ruleset in the `http_request_firewall_managed` phase.
 
 In this example:
 
-* `"id": "{managed-ruleset-id}"` adds a rule to the phase to apply a Managed Ruleset to requests for `example.com`.
+* `"id": "{managed-ruleset-id}"` adds a rule to the phase entry point ruleset to execute a Managed Ruleset for requests addressed to `example.com`.
 * `"enabled": false` defines an override at the ruleset level to disable all rules in the Managed Ruleset.
 * `"rules": [{"id": "{rule-id-1}", "action": "block", "enabled": true}, {"id": "{rule-id-2}", "action": "log", "enabled": true}]` defines a list of overrides at the rule level to enable two individual rules.
 
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/index.md b/products/firewall/src/content/cf-rulesets/common-use-cases/index.md
index 88f71ccd925..ef20422f4d6 100644
--- a/products/firewall/src/content/cf-rulesets/common-use-cases/index.md
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/index.md
@@ -7,19 +7,13 @@ order: 770
 
 # Workflow examples
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 You cannot edit Managed Rulesets, but you can add overrides to Managed Rulesets deployed to a phase. Overrides take precedence over the default behavior of the Managed Ruleset.
 
-For more information on overriding Managed Rulesets, see [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset/).
+For more information on overriding Managed Rulesets, refer to [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset).
 
 The examples in the topics below use overrides to customize the behavior of Managed Rulesets.
 
-* [Use a tag override to set WordPress rules to Block](/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block/)
-* [Use ruleset and tag overrides to enable only Joomla rules](/cf-rulesets/common-use-cases/deploy-cmr-joomla-only/)
-* [Use ruleset and rule overrides to enable only selected rules](/cf-rulesets/common-use-cases/enable-selected-rules/)
-* [Deploy a Managed Ruleset with ruleset, tag, and rule overrides](/cf-rulesets/common-use-cases/override-ruleset-tag-rule/)
+* [Use a tag override to set WordPress rules to Block](/cf-rulesets/common-use-cases/deploy-cmr-wordpress-block)
+* [Use ruleset and tag overrides to enable only Joomla rules](/cf-rulesets/common-use-cases/deploy-cmr-joomla-only)
+* [Use ruleset and rule overrides to enable only selected rules](/cf-rulesets/common-use-cases/enable-selected-rules)
+* [Deploy a Managed Ruleset with ruleset, tag, and rule overrides](/cf-rulesets/common-use-cases/override-ruleset-tag-rule)
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/override-ddos-rule-sensitivity.md b/products/firewall/src/content/cf-rulesets/common-use-cases/override-ddos-rule-sensitivity.md
new file mode 100644
index 00000000000..b59ea7f023c
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/override-ddos-rule-sensitivity.md
@@ -0,0 +1,50 @@
+---
+pcx-content-type: configuration
+alwaysopen: true
+order: 775
+---
+
+# Adjust the sensitivity of a specific HTTP DDoS rule to Low
+
+Follow the steps below to override the sensitivity of a specific rule of the Cloudflare HTTP DDoS Managed Ruleset.
+
+1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase to deploy the Cloudflare HTTP DDoS Managed Ruleset. You only need to deploy this specific ruleset when you wish to define one or more overrides, since it is enabled by default.
+1. [Configure a rule override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that sets the `sensitivity_level` of a specific rule.
+
+The example below uses the [Update ruleset](/cf-rulesets/rulesets-api/update) operation to execute the steps in a single `PUT` request.
+
+* Add a rule to the ruleset of the `ddos_l7` phase that applies the Cloudflare HTTP DDoS Managed Ruleset (with ID `{http-ddos-ruleset-id}`).
+* Create an override for the rule with ID `{rule-id}` and set the rule sensitivity to `low`. All other rules use the default sensitivity defined by Cloudflare.
+
+<details>
+<summary>Example: Use an override to set the sensitivity of an HTTP DDoS rule at the zone level</summary>
+<div>
+
+```json
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/phases/ddos_l7/entrypoint" \
+-d '{
+  "rules": [
+    {
+      "action": "execute",
+      "expression": "true",
+      "action_parameters": {
+        "id": "{http-ddos-ruleset-id}",
+        "overrides": {
+          "rules": [
+            {
+              "id": "{rule-id}",
+              "sensitivity_level": "low"
+            }
+          ]
+        }
+      }
+    }
+  ]
+}'
+```
+
+</div>
+</details>
diff --git a/products/firewall/src/content/cf-rulesets/common-use-cases/override-ruleset-tag-rule.md b/products/firewall/src/content/cf-rulesets/common-use-cases/override-ruleset-tag-rule.md
index f0534982b51..573b6488b8a 100644
--- a/products/firewall/src/content/cf-rulesets/common-use-cases/override-ruleset-tag-rule.md
+++ b/products/firewall/src/content/cf-rulesets/common-use-cases/override-ruleset-tag-rule.md
@@ -1,5 +1,4 @@
 ---
-title: Deploy a Managed Ruleset with ruleset, tag, and rule overrides
 pcx-content-type: configuration
 alwaysopen: true
 order: 774
@@ -7,32 +6,26 @@ order: 774
 
 # Deploy a Managed Ruleset with ruleset, tag, and rule overrides
 
-<Aside type='warning' header='Important'>
+Customize the execution of Managed Rulesets with a combination of ruleset overrides, tag overrides, and rule overrides in your phase entry point ruleset.
 
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-Customize the deployment of Managed Rulesets with a combination of ruleset overrides, tag overrides, and rule overrides in your root ruleset.
-
-1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase to deploy a Managed Ruleset.
+1. [Add a rule](/cf-rulesets/deploy-rulesets) to a phase entry point ruleset to execute a Managed Ruleset.
 1. [Configure a ruleset override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that disables all rules in the Managed Ruleset.
 1. [Configure a tag override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that sets an action for rules with a given tag.
-1. [Configure a rule override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that sets an action for the rules you want to deploy.
+1. [Configure a rule override](/cf-rulesets/managed-rulesets/override-managed-ruleset) that sets an action for the rules you want to execute.
 
-The request below uses the [Update ruleset](/cf-rulesets/rulesets-api/update/) operation to execute the following in a single `PUT` request:
+The request below uses the [Update ruleset](/cf-rulesets/rulesets-api/update) operation to execute the following in a single `PUT` request:
 
-* Add a rule to the ruleset of the `http_request_firewall_managed` phase that deploys a Managed Ruleset.
+* Add a rule to the `http_request_firewall_managed` phase entry point ruleset that executes a Managed Ruleset.
 * Use category overrides to enable rules with `wordpress` and `drupal` tags and set their actions to `log`.
 * Add a rule override that enables a single rule.
 
 <details>
-<summary>Example: Deploy a Managed Ruleset with overrides at the zone level</summary>
+<summary>Example: Execute a Managed Ruleset at the zone level with overrides</summary>
 <div>
 
 In this example:
 
-* `"id": "{managed-ruleset-id}"` adds a rule to the `http_request_firewall_managed` phase ruleset that applies a Managed Ruleset to requests for a given zone (`{zone-id}`).
+* `"id": "{managed-ruleset-id}"` adds a rule to the `http_request_firewall_managed` phase entry point ruleset to execute a Managed Ruleset for requests addressed to a zone (`{zone-id}`).
 * `"enabled": false` defines an override at the ruleset level to disable all rules in the Managed Ruleset.
 * `"categories": [{"category": "wordpress", "action": "log", "enabled": true}, {"category": "drupal", "action": "log", "enabled": true}]` defines an override at the tag level to enable rules tagged with `wordpress` or `drupal` and sets their action to `log`.
 * `"rules": [{"id": "{rule-id}", "action": "block", "enabled": true}]` defines an override at the rule level that enables one individual rule and sets the action to `block`.
@@ -79,12 +72,12 @@ curl -X PUT \
 </details>
 
 <details>
-<summary>Example: Deploy a Managed Ruleset with overrides at the account level</summary>
+<summary>Example: Execute a Managed Ruleset at the account level with overrides</summary>
 <div>
 
 In this example:
 
-* `"id": "{managed-ruleset-id}"` adds a rule to the `http_request_firewall_managed` phase ruleset that applies a Managed Ruleset to requests for `example.com`.
+* `"id": "{managed-ruleset-id}"` adds a rule to the `http_request_firewall_managed` phase entry point ruleset that executes a Managed Ruleset for requests addressed to `example.com`.
 * `"enabled": false` defines an override at the ruleset level to disable all rules in the Managed Ruleset.
 * `"categories": [{"category": "wordpress", "action": "log", "enabled": true}, {"category": "drupal", "action": "log", "enabled": true}]` defines an override at the tag level to enable rules tagged with `wordpress` or `drupal` and sets their action to `log`.
 * `"rules": [{"id": "{rule-id}", "action": "block", "enabled": true}]` defines an override at the rule level that enables one individual rule and sets the action to `block`.
diff --git a/products/firewall/src/content/cf-rulesets/create-phase-rulesets.md b/products/firewall/src/content/cf-rulesets/create-phase-rulesets.md
deleted file mode 100644
index 01edb9e6f23..00000000000
--- a/products/firewall/src/content/cf-rulesets/create-phase-rulesets.md
+++ /dev/null
@@ -1,174 +0,0 @@
----
-title: Create phase rulesets
-pcx-content-type: how-to
-type: overview
-order: 720
----
-
-# Create phase rulesets
-
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-A phase behaves like a ruleset. You must create the ruleset for a phase to be able to add rules and deploy rulesets to it.
-
-Use the [Rulesets API](/cf-rulesets/rulesets-api) to create a phase ruleset. You can create a phase ruleset at the account level or at the zone level.
-
-You can specify the rules of the ruleset when creating the ruleset — that is, in the same API request. Alternatively, you can define the set of rules later, in a separate request, using the [Update ruleset](/cf-rulesets/rulesets-api/update) operation.
-
-In the `data` field, include the following parameters.
-
-* `name` - The name for your ruleset. You cannot change the name after creating the phase ruleset.
-* `kind` - Indicates the ruleset kind. The kind must be `root` for phase rulesets at the account level and `zone` for phase rulesets at the zone level. You cannot edit the `kind` value later.
-* `phase` - Indicates the phase where you want to create the ruleset.
-* `description` - Optional. You can update this field when editing your phase ruleset.
-
-## Examples
-
-<details>
-<summary>Example: Create phase ruleset at the zone level</summary>
-<div>
-
-The following example creates a phase ruleset at the zone level for the `http_request_firewall_managed` phase. It also defines a single rule in the ruleset that runs a Managed Ruleset for incoming requests.
-
-Note the `kind`, `phase`, and `expression` field values:
-
-* `kind` is set to `zone` because this is a zone-level phase ruleset.
-* `phase` is set to `http_request_firewall_managed` which is the name of the desired phase.
-* `expression` is set to `true` because the endpoint already sets the context for a specific zone (`{zone-id}`).
-
-```json
----
-header: Request
----
-curl -X POST \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets" \
--d '{
-  "name": "Zone-level phase ruleset",
-  "kind": "zone",
-  "description": "This ruleset deploys a Managed Ruleset.",
-  "rules": [
-    {
-      "action": "execute",
-      "action_parameters": {
-        "id": "{managed-ruleset-id}"
-      },
-      "expression": "true"
-    }
-  ],
-  "phase": "http_request_firewall_managed"
-}'
-```
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
-    "kind": "zone",
-    "version": "1",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "execute",
-        "expression": "true",
-        "action_parameters": {
-          "id": "{managed-ruleset-id}"
-        },
-        "last_updated": "2021-03-17T15:42:37.917815Z"
-      }
-    ],
-    "last_updated": "2021-03-17T15:42:37.917815Z",
-    "phase": "http_request_firewall_managed"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
-<details>
-<summary>Example: Create phase ruleset at the account level</summary>
-<div>
-
-The following example creates a phase ruleset at the account level for the `http_request_firewall_managed` phase. It also defines a single rule in the ruleset that runs a Managed Ruleset for incoming requests addressed at `example.com` or `anotherexample.com`.
-
-Note the `kind` and `phase` field values:
-
-* `kind` is set to `root` because this is an account-level phase ruleset.
-* `phase` is set to `http_request_firewall_managed` which is the name of the desired phase.
-
-```json
----
-header: Request
----
-curl -X POST \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets" \
--d '{
-  "name": "Account-level phase ruleset",
-  "kind": "root",
-  "description": "This ruleset deploys a Managed Ruleset for example.com and anotherexample.com.",
-  "rules": [
-    {
-      "action": "execute",
-      "action_parameters": {
-        "id": "{managed-ruleset-id}"
-      },
-      "expression": "cf.zone.name in {\"example.com\" \"anotherexample.com\"}"
-    }
-  ],
-  "phase": "http_request_firewall_managed"
-}'
-```
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Account-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset for example.com and anotherexample.com.",
-    "kind": "root",
-    "version": "1",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "execute",
-        "expression": "cf.zone.name in {\"example.com\" \"anotherexample.com\"}",
-        "action_parameters": {
-          "id": "{managed-ruleset-id}"
-        },
-        "last_updated": "2021-03-17T15:42:37.917815Z"
-      }
-    ],
-    "last_updated": "2021-03-17T15:42:37.917815Z",
-    "phase": "http_request_firewall_managed"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
-To add a rule that deploys a ruleset, refer to [Deploy rulesets](/cf-rulesets/deploy-rulesets).
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-api.md b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-api.md
new file mode 100644
index 00000000000..337f8a07de2
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-api.md
@@ -0,0 +1,85 @@
+---
+pcx-content-type: how-to
+order: 2
+type: overview
+---
+
+# Create Custom Firewall rules via API
+
+Use the [Rulesets API](/cf-rulesets/rulesets-api) to create a Custom Firewall rule via API.
+
+You must deploy Custom Firewall rules to the `http_request_firewall_custom` phase entry point ruleset.
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan.
+
+</Aside>
+
+## Create a Custom Firewall rule
+
+To create a Custom Firewall rule, add a rule to the `http_request_firewall_custom` phase entry point ruleset.
+
+1. Invoke the [View ruleset](/cf-rulesets/rulesets-api/view#view-a-specific-ruleset) method to obtain the list of rules already present in the `http_request_firewall_custom` phase entry point ruleset. If the entry point ruleset does not exist, proceed to step 2, since adding a rule to the entry point ruleset will create the ruleset if it does not exist.
+
+1. Invoke the [Update ruleset](/cf-rulesets/rulesets-api/update) method to update the list of rules in the phase entry point ruleset with a new rule. You must include the rule ID of all the rules you wish to keep in the ruleset (all other fields are optional).
+
+<details>
+<summary>Example: Add new Custom Firewall rule using the Update ruleset API method</summary>
+<div>
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/phases/http_request_firewall_custom/entrypoint" \
+-d '{
+  "rules": [
+    {
+      "description": "My custom rule",
+      "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0",
+      "action": "challenge"
+    }
+  ]
+}'
+```
+
+The response includes the complete ruleset definition.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Default",
+    "description": "",
+    "kind": "zone",
+    "version": "5",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0",
+        "action": "challenge",
+        "description": "My custom rule",
+        "last_updated": "2021-05-31T18:33:41.347Z",
+        "ref": "{rule-ref-1}",
+        "enabled": true
+      }
+    ],
+    "last_updated": "2021-05-31T18:33:41.347Z",
+    "phase": "http_request_firewall_custom"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-dashboard.md b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-dashboard.md
new file mode 100644
index 00000000000..27b6e165433
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/create-dashboard.md
@@ -0,0 +1,37 @@
+---
+pcx-content-type: how-to
+order: 1
+type: overview
+---
+
+# Create Custom Firewall rules in the dashboard
+
+Create Custom Firewall rules under the **Custom Rules** tab in the **Firewall** app.
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan.
+
+</Aside>
+
+## Create a Custom Firewall rule
+
+To create a new Custom Firewall rule:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the **Websites** tab and choose the site for which you want to create a rule.
+
+1. Navigate to **Firewall** > **Custom Rules**.
+
+1. Click **Create Custom rule** > **Firewall rule**.
+
+1. In the page that displays, enter a descriptive name for the rule in **Rule name**.
+
+    ![Create Custom Firewall rule page](../../../images/custom-rules/firewall-custom-rule-create.png)
+
+1. Under **If incoming requests match...**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**.
+
+1. Select the rule action from the **Choose action** drop-down list. For example, selecting _Block_ tells Cloudflare to refuse requests that match the conditions you specified.
+
+1. To save and deploy your rule, click **Save and Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/index.md b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/index.md
new file mode 100644
index 00000000000..bdd88c908cd
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/custom-firewall/index.md
@@ -0,0 +1,27 @@
+---
+pcx-content-type: concept
+order: 2
+---
+
+# Custom Firewall rules
+
+Custom Firewall rules allow you to control incoming traffic by filtering requests. You can perform actions like _Block_ or _JS Challenge_ on incoming requests according to rules you define.
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan. Contact your Cloudflare Customer Success Manager if you want to get access.
+
+</Aside>
+
+Like other rules evaluated by Cloudflare's [Ruleset Engine](/cf-rulesets), Custom Firewall rules have an **expression** and an **action**:
+
+* The **expression** specifies the criteria you are matching traffic on — the same as in [Firewall Rules](/cf-firewall-rules).
+* The **action** specifies what to perform when there is a match for the rule.
+
+---
+
+## Getting started
+
+To create Custom Firewall rules using the Cloudflare dashboard, see [Create Custom Firewall rules in the dashboard](/cf-rulesets/custom-rules/custom-firewall/create-dashboard).
+
+You can also create Custom Firewall rules using the [Rulesets API](/cf-rulesets/rulesets-api). See [Create Custom Firewall rules via API](/cf-rulesets/custom-rules/custom-firewall/create-api) for more information.
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/index.md b/products/firewall/src/content/cf-rulesets/custom-rules/index.md
index 90475ba1eeb..83e5efceb7a 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rules/index.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/index.md
@@ -13,16 +13,22 @@ This feature is only available for selected customers on an Enterprise plan. Con
 
 Custom Rules allow you to protect your website and your APIs from malicious or excessive incoming traffic.
 
-You can use Custom Rules in the **Firewall** app to define the following rule types:
+Use Custom Rules in the **Firewall** app to define the following rule types:
 
-* [**Rate Limiting Rules**](/cf-rulesets/custom-rules/rate-limiting) — Check for excessive incoming traffic and apply mitigation actions.
+* [**Rate Limiting rules**](/cf-rulesets/custom-rules/rate-limiting) — Check for excessive incoming traffic and apply mitigation actions.
 
-* **Custom Firewall rules** — Control incoming traffic by filtering requests. You can block or challenge incoming requests according to rules you define.
+* [**Custom Firewall rules**](/cf-rulesets/custom-rules/custom-firewall) — Control incoming traffic by filtering requests. Perform actions like _Block_ or _JS Challenge_ on incoming requests according to rules you define.
 
-<Aside type='warning' header='Important'>
+Custom Rules are built upon the [Ruleset Engine](/cf-rulesets) which you can use to define rules and actions in several Cloudflare products.
+
+---
 
-Currently, you can only create and manage Custom Firewall rules using the API. They are not displayed in the **Custom Rules** tab.
+## Rule execution order
 
-</Aside>
+Cloudflare evaluates different types of rules when processing incoming requests. The rule execution order is the following:
 
-Custom Rules are built upon the ruleset engine which you can use to define rules and actions in several Cloudflare products. Custom Rules are deployed to the `http_request_firewall_custom` phase ruleset.
\ No newline at end of file
+* [Firewall Rules](/cf-firewall-rules), available in the **Firewall Rules** tab
+* [Custom Firewall rules](/cf-rulesets/custom-rules/custom-firewall), available in the **Custom Rules** tab
+* [Rate Limiting rules](/cf-rulesets/custom-rules/rate-limiting), available in the **Custom Rules** tab
+* [Managed Rulesets](https://developers.cloudflare.com/waf/managed-rulesets), available in the **Managed Rules** tab
+* [Legacy Rate Limiting Rules](https://support.cloudflare.com/hc/articles/115001635128), available in the **Tools** tab
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/manage-dashboard.md b/products/firewall/src/content/cf-rulesets/custom-rules/manage-dashboard.md
new file mode 100644
index 00000000000..5cc9ca9d115
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/manage-dashboard.md
@@ -0,0 +1,44 @@
+---
+order: 5
+pcx-content-type: how-to
+---
+
+# Manage Custom Rules in the dashboard
+
+You can manage Custom Rules under the **Custom Rules** tab in the **Firewall** app.
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan.
+
+</Aside>
+
+The Custom Rules interface allows you to:
+
+* [Create Custom Firewall rules](/cf-rulesets/custom-rules/custom-firewall/create-dashboard)
+* [Create Rate Limiting rules](/cf-rulesets/custom-rules/rate-limiting/create-dashboard)
+* Browse and filter rules
+* Edit and delete rules
+* Enable or disable rules
+
+![Custom Rules tab](../../images/custom-rules/custom-rules-tab.png)
+
+## Manage Custom Rules
+
+Edit, delete, or enable/disable rules in the Custom Rules card.
+
+### Enable or disable a rule
+
+To enable/disable a rule, click the toggle button on the right of the rule you want to change.
+
+### Edit a rule
+
+To edit a rule:
+
+1. Click **Edit** on the right of the rule you want to change.
+1. Update the rule parameters.
+1. Click **Save**.
+
+### Delete a rule
+
+To delete a rule, click **Delete** on the right of the rule you want to delete and confirm the operation.
\ No newline at end of file
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-api.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-api.md
new file mode 100644
index 00000000000..4b77603f5d2
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-api.md
@@ -0,0 +1,98 @@
+---
+pcx-content-type: how-to
+order: 15
+type: overview
+---
+
+# Create Rate Limiting rules via API
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan.
+
+</Aside>
+
+Use the [Rulesets API](/cf-rulesets/rulesets-api) to create a Rate Limiting rule via API. 
+
+A Rate Limiting rule is similar to a regular rule handled by the ruleset engine, but contains an additional `ratelimit` field with the rate limiting configuration. See [Rate limiting parameters](/cf-rulesets/custom-rules/rate-limiting/parameters) for more information on this field and its parameters.
+
+You must deploy Rate Limiting rules to the `http_ratelimit` phase.
+
+## Create a Rate Limiting rule
+
+To create a Rate Limiting rule, add a rule with a `ratelimit` field to the `http_ratelimit` phase entry point ruleset by issuing a `PUT` request (see example below).
+
+Add any existing rules in the ruleset to the request by including their rule ID in the `rules` field of the request body. Rate limiting rules must appear at the end of the rules list.
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+  -H "X-Auth-Email: user@cloudflare.com" \
+  -H "X-Auth-Key: REDACTED" \
+  "https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/phases/http_ratelimit/entrypoint" \
+-d '{
+  "rules": [
+    {
+      "description": "My rate limiting rule",
+      "expression": "(http.request.uri.path matches \"^/api/\")",
+      "action": "block",
+      "ratelimit": {
+        "characteristics": [
+          "cf.colo.id",
+          "ip.src",
+          "http.request.headers[\"x-api-key\"]"
+        ],
+        "period": 60,
+        "requests_per_period": 100,
+        "mitigation_timeout": 600,
+        "mitigation_expression": ""
+      }
+    }
+  ]
+}'
+```
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Default",
+    "description": "",
+    "kind": "zone",
+    "version": "5",
+    "rules": [
+      {
+        "id": "{rate-limiting-rule-id}",
+        "version": "1",
+        "action": "block",
+        "ratelimit": {
+          "characteristics": [
+            "cf.colo.id",
+            "http.request.headers[\"x-api-key\"]",
+            "ip.src"
+          ],
+          "period": 60,
+          "requests_per_period": 100,
+          "mitigation_timeout": 600,
+          "mitigation_expression": ""
+        },
+        "expression": "(http.request.uri.path matches \"^/api/\")",
+        "description": "My rate limiting rule",
+        "last_updated": "2021-03-31T18:33:41.347Z",
+        "ref": "{rule-ref-1}",
+        "enabled": true
+      }
+    ],
+    "last_updated": "2021-03-31T18:33:41.347Z",
+    "phase": "http_ratelimit"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-dashboard.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-dashboard.md
new file mode 100644
index 00000000000..07e8396c0a3
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/create-dashboard.md
@@ -0,0 +1,43 @@
+---
+pcx-content-type: how-to
+order: 13
+type: overview
+---
+
+# Create Rate Limiting rules in the dashboard
+
+<Aside type='warning' header='Important'>
+
+This feature is only available for selected customers on an Enterprise plan.
+
+</Aside>
+
+Create Rate Limiting rules under the **Custom Rules** tab in the **Firewall** app.
+
+## Create a Rate Limiting rule
+
+To create a new Rate Limiting rule:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the **Websites** tab and choose the site for which you want to create a rule.
+
+1. Navigate to **Firewall** > **Custom Rules**.
+
+1. Click **Create Custom rule** > **Rate limiting rule**.
+
+1. In the page that displays, enter a descriptive name for the rule in **Rule name**.
+
+    ![Create Rate Limiting rule page](../../../images/custom-rules/rate-limiting-create.png)
+
+1. Under **If incoming requests match...**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**.
+
+1. Under **With the same...**, add one or more characteristics that will define the request counters for rate limiting purposes. Each value combination will have its own counter to determine the request rate. Check [Determining the request rate](/cf-rulesets/custom-rules/rate-limiting/request-rate) for more information.
+
+1. Under **And rate exceeds...**, define the rate limit and the time period to consider when determining the request rate.
+
+1. Select the rule action from the **Choose action** drop-down list. For example, selecting _Block_ tells Cloudflare to refuse requests in the conditions you specified when the request limit is reached.
+
+1. Under **For...**, select the mitigation timeout. This is the time period during which Cloudflare applies the select action once the request rate is reached.
+
+1. To save and deploy your rule, click **Save and Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/index.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/index.md
index 65be79ef43a..771d996fd4e 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/index.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/index.md
@@ -3,7 +3,7 @@ pcx-content-type: concept
 order: 1
 ---
 
-# Rate Limiting Rules
+# Rate Limiting rules
 
 <Aside type='warning' header='Important'>
 
@@ -11,36 +11,29 @@ This feature is only available for selected customers on an Enterprise plan. Con
 
 </Aside>
 
-Rate Limiting Rules allow you to define rate limits for incoming requests matching an expression, as well as actions to take when those rate limits are reached.
+Rate Limiting rules allow you to define rate limits for incoming requests matching an expression, as well as actions to take when those rate limits are reached.
 
-## Rule parameters 
+## Rule parameters
 
-Like other rules evaluated by Cloudflare's ruleset engine, Rate Limiting Rules have an associated **expression** and an **action**. 
+Like other rules evaluated by Cloudflare's ruleset engine, Rate Limiting rules have an associated **expression** and an **action**.
 
-The **expression** specifies the criteria you are matching traffic on — the same as in [Firewall Rules](/cf-firewall-rules). The **action** specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of Rate Limiting Rules, the action occurs when the request rate reaches the specified limit.
+The **expression** specifies the criteria you are matching traffic on — the same as in [Firewall Rules](/cf-firewall-rules). The **action** specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of Rate Limiting rules, the action occurs when the request rate reaches the specified limit.
 
-Besides these two parameters, Rate Limiting Rules require the following additional parameters:
+Besides these two parameters, Rate Limiting rules require the following additional parameters:
 
-* **Characteristics** - The set of parameters that define how Cloudflare tracks the request rate for this rule.
-* **Period** - The period of time to consider (in seconds) when evaluating the request rate.
-* **Requests per period** - The number of requests over the period of time that will trigger the Rate Limiting Rule.
-* **Mitigation timeout** - Once the request rate is reached, the Rate Limiting Rule blocks further requests for the period of time defined in this field.
+* **Characteristics** — The set of parameters that define how Cloudflare tracks the request rate for this rule.
+* **Period** — The period of time to consider (in seconds) when evaluating the request rate.
+* **Requests per period** — The number of requests over the period of time that will trigger the Rate Limiting rule.
+* **Mitigation timeout** — Once the request rate is reached, the Rate Limiting rule blocks further requests for the period of time defined in this field.
 
 Check [Rate limiting parameters](/cf-rulesets/custom-rules/rate-limiting/parameters) for more details on these parameters.
 
 See [Determining the request rate](/cf-rulesets/custom-rules/rate-limiting/request-rate) to learn how Cloudflare uses the parameters above when determining the rate of incoming requests.
 
-## Rule execution order
-
-Cloudflare evaluates different types of rules when processing incoming requests. The rule execution order is the following:
-
-* [Firewall Rules](/cf-firewall-rules), available in the **Firewall Rules** tab
-* Rate Limiting Rules (described in this section), available in the **Custom Rules** tab
-* Managed Rulesets, available in the **Managed Rules** tab
-* Legacy Rate Limiting Rules, available in the **Tools** tab
+---
 
 ## Getting started
 
-To configure Rate Limiting Rules using the Cloudflare dashboard, use the **Custom Rules** tab in the **Firewall** app. For more information, see [Manage Rate Limiting Rules in the dashboard](/cf-rulesets/custom-rules/rate-limiting/manage-dashboard).
+To configure Rate Limiting rules using the Cloudflare dashboard, use the **Custom Rules** tab in the **Firewall** app. For more information, see [Create Rate Limiting rules in the dashboard](/cf-rulesets/custom-rules/rate-limiting/create-dashboard).
 
-You can also configure Rate Limiting Rules using the [Rulesets API](/cf-rulesets/rulesets-api). See [Manage Rate Limiting Rules via API](/cf-rulesets/custom-rules/rate-limiting/manage-api) for more information.
\ No newline at end of file
+You can also configure Rate Limiting rules using the [Rulesets API](/cf-rulesets/rulesets-api). See [Create Rate Limiting rules via API](/cf-rulesets/custom-rules/rate-limiting/create-api) for more information.
\ No newline at end of file
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-api.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-api.md
deleted file mode 100644
index 99b1a4d14c6..00000000000
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-api.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-pcx-content-type: how-to
-order: 15
-type: overview
----
-
-# Manage Rate Limiting Rules via API
-
-<Aside type='warning' header='Important'>
-
-This feature is only available for selected customers on an Enterprise plan.
-
-</Aside>
-
-Use the [Rulesets API](/cf-rulesets/rulesets-api) to create a Rate Limiting Rule via API. A Rate Limiting Rule is similar to a regular rule handled by the ruleset engine, but contains an additional `ratelimit` field with the rate limiting configuration. See [Rate limiting parameters](/cf-rulesets/custom-rules/rate-limiting/parameters) for more information on this field and its parameters.
-
-You must deploy Rate Limiting Rules to the `http_request_firewall_custom` phase ruleset.
-
-## Create a Rate Limiting Rule
-
-To create a Rate Limiting Rule, add a rule with a `ratelimit` field to the `http_request_firewall_custom` phase ruleset by issuing a `PUT` request (see example below).
-
-Add any existing rules in the ruleset to the request by including their rule ID in the `rules` field of the request body. Rate limiting rules must appear at the end of the rules list.
-
-```json
----
-header: Request
----
-curl -X PUT \
-  -H "X-Auth-Email: user@cloudflare.com" \
-  -H "X-Auth-Key: REDACTED" \
-  "https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/phases/http_request_firewall_custom/entrypoint" \
--d '{
-  "rules": [
-    {
-      "description": "My rate limiting rule",
-      "expression": "(http.request.uri.path matches \"^/api/\")",
-      "action": "block",
-      "ratelimit": {
-        "characteristics": [
-          "cf.colo.id",
-          "ip.src",
-          "http.request.headers[\"x-api-key\"]"
-        ],
-        "period": 60,
-        "requests_per_period": 100,
-        "mitigation_timeout": 600,
-        "mitigation_expression": ""
-      }
-    }
-  ]
-}'
-```
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Default",
-    "description": "",
-    "kind": "zone",
-    "version": "5",
-    "rules": [
-      {
-        "id": "{rate-limiting-rule-id}",
-        "version": "1",
-        "action": "block",
-        "ratelimit": {
-          "characteristics": [
-            "cf.colo.id",
-            "http.request.headers[\"x-api-key\"]",
-            "ip.src"
-          ],
-          "period": 60,
-          "requests_per_period": 100,
-          "mitigation_timeout": 600,
-          "mitigation_expression": ""
-        },
-        "expression": "(http.request.uri.path matches \"^/api/\")",
-        "description": "My rate limiting rule",
-        "last_updated": "2021-03-31T18:33:41.347Z",
-        "ref": "{rule-ref-1}",
-        "enabled": true
-      }
-    ],
-    "last_updated": "2021-03-31T18:33:41.347Z",
-    "phase": "http_request_firewall_custom"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-dashboard.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-dashboard.md
deleted file mode 100644
index 6fbdb3fcf4d..00000000000
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/manage-dashboard.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-pcx-content-type: how-to
-order: 13
----
-
-# Manage Rate Limiting Rules in the dashboard
-
-<Aside type='warning' header='Important'>
-
-This feature is only available for selected customers on an Enterprise plan.
-
-</Aside>
-
-You can manage Rate Limiting Rules under the **Custom Rules** tab in the **Firewall** app.
-
-The Custom Rules interface allows you to:
-
-* Browse and filter rules
-* Create Rate Limiting Rules
-* Edit and delete rules
-* Enable or disable rules
-
-![Custom Rules tab](../../../images/custom-rules/custom-rules-tab.png)
-
-## Create a Rate Limiting Rule
-
-To create a new Rate Limiting Rule:
-
-1. Log in to the Cloudflare dashboard.
-
-1. Select the **Websites** tab and choose the site for which you want to create a rule.
-
-1. Click the **Firewall** tile in the app bar, and then click the **Custom Rules** tab.
-
-1. Click **Create Rate Limiting rule**.
-
-1. In the **Create Firewall Rule** page that displays, enter a descriptive name for the rule in **Rule name**.
-
-    ![Create Rate Limiting Rule page](../../../images/custom-rules/rate-limiting-create.png)
-
-1. Under **If incoming requests match...**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**.
-
-1. Under **With the same...**, add one or more characteristics that will define the request counters for rate limiting purposes. Each value combination will have its own counter to determine the request rate. Check [Determining the request rate](/cf-rulesets/custom-rules/rate-limiting/request-rate) for more information.
-
-1. Under **And rate exceeds...**, define the rate limit and the time period to consider when determining the request rate.
-
-1. Select the rule action from the **Choose action** drop-down list. For example, selecting _Block_ tells Cloudflare to refuse requests in the conditions you specified when the request limit is reached.
-
-1. Under **For...**, select the mitigation timeout. This is the time period during which Cloudflare applies the select action once the request rate is reached.
-
-1. To save and deploy your rule, click **Save and Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
-
-## Manage Custom Rules
-
-You can edit, delete, or enable/disable rules in the Custom Rules card.
-
-![Custom Rules card](../../../images/custom-rules/custom-rules-card.png)
-
-### Enable or disable a rule
-
-To enable/disable a rule, click the _On_/_Off_ toggle button on the right of the rule you want to change.
-
-### Edit a rule
-
-To edit a rule:
-
-1. Click **Edit** on the right of the rule you want to change. 
-1. Update the rule parameters.
-1. Click **Save**.
-
-### Delete a rule
-
-To delete a rule, click **Delete** on the right of the rule you want to delete and confirm the operation.
\ No newline at end of file
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/parameters.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/parameters.md
index 4594e1bcc36..95f8e37d453 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/parameters.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/parameters.md
@@ -11,7 +11,7 @@ This feature is only available for selected customers on an Enterprise plan.
 
 </Aside>
 
-The available Rate Limiting Rule parameters are the following:
+The available Rate Limiting rule parameters are the following:
 
 <Definitions>
 
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/request-rate.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/request-rate.md
index 7c36d358ed1..f08009234cc 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/request-rate.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/request-rate.md
@@ -12,24 +12,24 @@ This feature is only available for selected customers on an Enterprise plan.
 
 </Aside>
 
-Cloudflare keeps separate request counters for Rate Limiting Rules for each value combination of the rule characteristics.
+Cloudflare keeps separate request counters for Rate Limiting rules for each value combination of the rule characteristics.
 
 For example, consider a rule configured with the following characteristics:
 
 * IP address
 * HTTP header `x-api-key`
 
-In this case, two incoming requests with the **same** value for the HTTP header `X-API-Key` with **different** IP addresses are counted separately, since the value combination is different. Additionally, counters are not shared across data centers. 
+In this case, two incoming requests with the **same** value for the HTTP header `X-API-Key` with **different** IP addresses are counted separately, since the value combination is different. Additionally, counters are not shared across data centers.
 
 <Aside type='warning' header='Important'>
 
-The Cloudflare **data center ID** is a mandatory characteristic of every Rate Limiting Rule. This characteristic does not appear in the rule configuration in the dashboard, but you must include it when [creating Rate Limiting Rules via API](/cf-rulesets/custom-rules/rate-limiting/manage-api).
+The Cloudflare **data center ID** is a mandatory characteristic of every Rate Limiting rule. This characteristic does not appear in the rule configuration in the dashboard, but you must include it when [creating Rate Limiting rules via API](/cf-rulesets/custom-rules/rate-limiting/create-api).
 
 </Aside>
 
 ## Example
 
-Consider the following configuration for a Rate Limiting Rule:
+Consider the following configuration for a Rate Limiting rule:
 
 <Example>
 
@@ -38,9 +38,10 @@ Expression:<br/>
 
 Action: _Block_
 
-Characteristics: 
+Characteristics:
+
 * _Data center ID_ (included by default when creating the rule in the dashboard)
-* _IP Address_ 
+* _IP Address_
 * _HTTP Header_ > `x-api-key`
 
 Period: _10 seconds_
@@ -51,14 +52,14 @@ Mitigation timeout: _10 minutes_
 
 </Example>
 
-The following diagram shows how Cloudflare handles four incoming requests in the context of the above Rate Limiting Rule.
+The following diagram shows how Cloudflare handles four incoming requests in the context of the above Rate Limiting rule.
 
-![Rate Limiting Rule example diagram](../../../images/custom-rules/rate-limiting-example.png)
+![Rate Limiting rule example diagram](../../../images/custom-rules/rate-limiting-example.png)
 
-Since request 1 matches the rule expression, the Rate Limiting Rule is evaluated. Cloudflare defines a request counter for the values of the characteristics in the context of the Rate Limiting Rule and sets the counter to `1`. Since the counter value is within the established limits in **Requests per period**, the request is allowed.
+Since request 1 matches the rule expression, the Rate Limiting rule is evaluated. Cloudflare defines a request counter for the values of the characteristics in the context of the Rate Limiting rule and sets the counter to `1`. Since the counter value is within the established limits in **Requests per period**, the request is allowed.
 
-Request 2 matches the rule expression and therefore Cloudflare evaluates the Rate Limiting Rule. The values of the characteristics do not match any existing counter (the value of the `X-API-Key` header is different). Therefore, Cloudflare defines a separate counter in the context of this rule and sets it to `1`. The counter value is within the request limit established in **Requests per period**, and so this request is allowed.
+Request 2 matches the rule expression and therefore Cloudflare evaluates the Rate Limiting rule. The values of the characteristics do not match any existing counter (the value of the `X-API-Key` header is different). Therefore, Cloudflare defines a separate counter in the context of this rule and sets it to `1`. The counter value is within the request limit established in **Requests per period**, and so this request is allowed.
 
 Request 3 matches the rule expression and the same values for rule characteristics. Therefore, Cloudflare increases the value of the existing counter, setting it to `2`. The counter value is now above the limit defined in **Requests per period**, and so request 2 gets blocked.
 
-Request 4 does not match the rule expression, since the value for the `Content-Type` header does not match the value in the expression. Therefore, Cloudflare does not create a new rule counter for this request. Request 4 is not evaluated in the context of this Rate Limiting Rule and is passed on to subsequent rules in the request evaluation workflow.
+Request 4 does not match the rule expression, since the value for the `Content-Type` header does not match the value in the expression. Therefore, Cloudflare does not create a new rule counter for this request. Request 4 is not evaluated in the context of this Rate Limiting rule and is passed on to subsequent rules in the request evaluation workflow.
diff --git a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/use-cases.md b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/use-cases.md
index 726e388de53..c28703e5536 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/use-cases.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rules/rate-limiting/use-cases.md
@@ -12,7 +12,7 @@ This feature is only available for selected customers on an Enterprise plan.
 
 </Aside>
 
-The examples below include sample Rate Limiting Rule configurations that address common rate limiting use cases.
+The examples below include sample Rate Limiting rule configurations that address common rate limiting use cases.
 
 ## Example 1
 
@@ -24,6 +24,7 @@ Expression:<br />
 `(http.request.uri.path eq "/login" and ip.geoip.country eq "US" and ip.src ne 192.0.0.1)`
 
 Rule characteristics:
+
 * _Data center ID_ (included by default when creating the rule in the dashboard)
 * _IP Address_
 
@@ -39,6 +40,7 @@ Expression:<br />
 `(http.request.uri.path contains "/product*" and http.request.method eq "POST")`
 
 Rule characteristics:
+
 * _Data center ID_ (included by default when creating the rule in the dashboard)
 * _IP Address_
 * _HTTP Header_ > `x-api-key`
@@ -55,6 +57,7 @@ Expression:<br />
 `(http.request.uri.path eq "/store" or http.request.uri.path eq "/prices") and (http.host eq "mystore1.com" or http.host eq "mystore2.com") and not cf.client.bot`
 
 Rule characteristics:
+
 * _Data center ID_ (included by default when creating the rule in the dashboard)
 * _IP Address_
 * _HTTP Header_ > `user-agent`
diff --git a/products/firewall/src/content/cf-rulesets/custom-rulesets/add-rules-ruleset.md b/products/firewall/src/content/cf-rulesets/custom-rulesets/add-rules-ruleset.md
index 2b15f34caa3..28383beb8f3 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rulesets/add-rules-ruleset.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rulesets/add-rules-ruleset.md
@@ -7,23 +7,20 @@ order: 762
 
 # Add rules to a custom ruleset
 
-<Aside type='warning' header='Important'>
+To add rules to an existing custom ruleset, use the [Update ruleset](/cf-rulesets/rulesets-api/update) API method and pass the rules in an array. Each rule contains an expression and action.
 
-This feature is part of an early access experience for selected customers.
+<Aside type='note' header='Choosing the appropriate API method'>
 
-</Aside>
-
-To add rules to an existing custom ruleset, execute a `PUT` request to the custom ruleset and pass the rules in an array. Each rule contains an expression and action.
-
-<Aside type='info' header='Info'>
+When you add rules to a ruleset using the [Update ruleset](/cf-rulesets/rulesets-api/update) method, you replace all the rules in the ruleset with the rules in the request. Use this API method when adding or updating several rules at once. This method updates the ruleset version number only once.
 
-When you modify a ruleset using a `PUT` request, you replace the entire content of the ruleset with the request's payload. You must include in the request all existing rules you want to keep in addition to any new rules. 
+You can use other API methods depending on the type of operation:
 
-If you are updating several rules at once, use the `PUT` request described in this section. It allows you to make changes to several rules in bulk, while changing the version number of the updated rules and of the ruleset only once. However, if you are updating a single rule, consider using the [Update rule](/cf-rulesets/rulesets-api/update-rule) method instead.
+* Add a single rule to an existing custom ruleset — use the [Add rule to ruleset](/cf-rulesets/rulesets-api/add-rule) method.
+* Update a single rule in a custom ruleset — use the [Update rule](/cf-rulesets/rulesets-api/update-rule) method.
 
 </Aside>
 
-The following request adds two rules to a custom ruleset.
+The following request adds two rules to a custom ruleset. These will be the only two rules in the ruleset.
 
 ```json
 ---
@@ -94,7 +91,7 @@ header: Response
 
 ## Update rules in a custom ruleset
 
-To update one or more rules in a custom ruleset, execute a `PUT` request to the custom ruleset. Include the ID of the rules you want to modify in the rules array and add the fields you want to update. The request replaces the entire ruleset with a new version. Therefore, you must include the ID of all the rules you want to keep.
+To update one or more rules in a custom ruleset, use the [Update ruleset](/cf-rulesets/rulesets-api/update) API method. Include the ID of the rules you want to modify in the rules array and add the fields you want to update. The request replaces the entire ruleset with a new version. Therefore, you must include the ID of all the rules you want to keep.
 
 The following request edits one rule in a custom ruleset and updates the execution order of the rules.
 
@@ -164,4 +161,4 @@ header: Response
 }
 ```
 
-The `PUT` request completely replaces the existing contents of the ruleset. If you omit an existing rule from the `rules` array, it will not appear in the new version of the ruleset.
+The request above completely replaces the list of rules in the ruleset. If you omit an existing rule from the `rules` array, it will not appear in the new version of the ruleset.
diff --git a/products/firewall/src/content/cf-rulesets/custom-rulesets/create-custom-ruleset.md b/products/firewall/src/content/cf-rulesets/custom-rulesets/create-custom-ruleset.md
index d8a25a43ef4..0421f0130e4 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rulesets/create-custom-ruleset.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rulesets/create-custom-ruleset.md
@@ -7,12 +7,6 @@ order: 761
 
 # Create a custom ruleset
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 The following `POST` request creates a new custom ruleset. Set the `kind` field to `custom` and specify the name of the phase where you want to create the custom ruleset in the `phase` field.
 
 ```json
@@ -53,4 +47,4 @@ header: Response
 }
 ```
 
-After creating a custom ruleset, you can [add rules to a custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset).
\ No newline at end of file
+You can include a list of rules in the custom ruleset creation request. However, if you have not added any rules, see how to [add rules to a custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset).
\ No newline at end of file
diff --git a/products/firewall/src/content/cf-rulesets/custom-rulesets/deploy-custom-ruleset.md b/products/firewall/src/content/cf-rulesets/custom-rulesets/deploy-custom-ruleset.md
index 6002de41435..96f0cda00a4 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rulesets/deploy-custom-ruleset.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rulesets/deploy-custom-ruleset.md
@@ -1,5 +1,4 @@
 ---
-title: Deploy a custom ruleset
 pcx-content-type: how-to
 alwaysopen: true
 order: 763
@@ -7,19 +6,13 @@ order: 763
 
 # Deploy a custom ruleset
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 Before you begin:
 
 1. Obtain the name of the phase where you want to deploy the custom ruleset.
 1. [Create a custom ruleset](/cf-rulesets/custom-rulesets/create-custom-ruleset) and keep the ID of the new custom ruleset.
-1. [Fetch the rules already present in the phase ruleset](/cf-rulesets/view-rulesets#view-the-rules-included-in-a-ruleset). You must include all existing rules you want to keep when you execute the request to deploy the custom ruleset.
+1. [Fetch the rules already present in the phase entry point ruleset](/cf-rulesets/view-rulesets#view-the-rules-included-in-a-ruleset). You must include in the `PUT` request all existing rules you want to keep.
 
-Execute a `PUT` request to deploy the custom ruleset. The request creates rules in the `http_request_firewall_custom` phase that executes the rules in the custom ruleset when the zone name matches `example.com`.
+Issue a `PUT` request that adds a rule to execute the custom ruleset when the zone name matches `example.com`.
 
 ```json
 ---
@@ -33,7 +26,7 @@ curl -X PUT \
   "rules": [
     {
       "action":"execute",
-      "description":"Add custom ruleset",
+      "description":"Execute custom ruleset",
       "expression": "cf.zone.name == \"example.com\"",
       "action_parameters": {
         "id":"{custom-ruleset-id}"
@@ -58,8 +51,8 @@ header: Response
 {
   "result": {
     "id": "{account-phase-ruleset-id}",
-    "name": "http_request_firewall_custom phase Ruleset for my account",
-    "description":"Add custom ruleset",
+    "name": "http_request_firewall_custom phase entry point ruleset for my account",
+    "description": "Execute several rulesets",
     "kind": "root",
     "version": "3",
     "rules": [
@@ -67,6 +60,7 @@ header: Response
         "id": "{phase-rule-id}",
         "version": "1",
         "action": "execute",
+        "description":"Execute custom ruleset",
         "action_parameters": {
           "id": "{custom-ruleset-id}",
           "version": "latest"
@@ -81,7 +75,7 @@ header: Response
         "version": "1",
         "action": "execute",
         "action_parameters": {
-          "id": "{id-of-ruleset-that-existing-rule-id-1-deploys}",
+          "id": "{id-of-ruleset-executed-by-existing-rule-id}",
           "version": "latest"
         },
         "expression": "cf.zone.name eq  \"example.com\"",
@@ -94,7 +88,7 @@ header: Response
         "version": "1",
         "action": "execute",
         "action_parameters": {
-          "id": "{id-of-ruleset-that-existing-rule-id-2-deploys}",
+          "id": "{id-of-ruleset-executed-by-existing-rule-id-2}",
           "version": "latest"
         },
         "expression": "cf.zone.name eq  \"example.com\"",
diff --git a/products/firewall/src/content/cf-rulesets/custom-rulesets/index.md b/products/firewall/src/content/cf-rulesets/custom-rulesets/index.md
index e64566cf8b3..a9a937c00f0 100644
--- a/products/firewall/src/content/cf-rulesets/custom-rulesets/index.md
+++ b/products/firewall/src/content/cf-rulesets/custom-rulesets/index.md
@@ -9,16 +9,20 @@ order: 760
 
 <Aside type='warning' header='Important'>
 
-This feature is part of an early access experience for selected customers.
-
-Also, custom rulesets are currently only supported by the Cloudflare WAF.
+Custom rulesets are currently only supported by the Cloudflare WAF.
 
 </Aside>
 
-Use the following workflow to deploy a custom ruleset at the account level.
+Use the following workflow to deploy a custom ruleset at the account level:
+
+1. [Create a custom ruleset](/cf-rulesets/custom-rulesets/create-custom-ruleset).
+1. [Add rules to your custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset).
+1. [Add a rule to an account-level phase entry point ruleset that executes the custom ruleset](/cf-rulesets/custom-rulesets/deploy-custom-ruleset).
+
+<Aside type="warning">
 
-1. [Create a custom ruleset](/cf-rulesets/custom-rulesets/create-custom-ruleset/).
-1. [Add rules to your custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset/).
-1. [Add a rule to an account-level phase to deploy the custom ruleset](/cf-rulesets/custom-rulesets/deploy-custom-ruleset/).
+You must create a rule with `execute` action in an entry point ruleset to execute the custom ruleset (step 3 in the previous procedure). If you skip this step, the rules of the custom ruleset will not run.
+
+</Aside>
 
-To modify custom ruleset behavior, Cloudflare recommends [creating a new custom ruleset](/cf-rulesets/custom-rulesets/create-custom-ruleset/) or [editing the custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset/) instead of using overrides.
+To modify custom ruleset behavior, Cloudflare recommends [creating a new custom ruleset](/cf-rulesets/custom-rulesets/create-custom-ruleset) or [editing the custom ruleset](/cf-rulesets/custom-rulesets/add-rules-ruleset) instead of using overrides.
diff --git a/products/firewall/src/content/cf-rulesets/deploy-rulesets.md b/products/firewall/src/content/cf-rulesets/deploy-rulesets.md
index 12ea6a49952..ac34c2983b4 100644
--- a/products/firewall/src/content/cf-rulesets/deploy-rulesets.md
+++ b/products/firewall/src/content/cf-rulesets/deploy-rulesets.md
@@ -1,5 +1,4 @@
 ---
-title: Deploy rulesets
 pcx-content-type: how-to
 type: overview
 order: 740
@@ -7,33 +6,23 @@ order: 740
 
 # Deploy rulesets
 
-<Aside type='warning' header='Important'>
+Use the [Rulesets API](/cf-rulesets/rulesets-api) to deploy a ruleset. To deploy a ruleset, add a rule with `"action": "execute"` to a phase entry point ruleset, specifying the ruleset ID to execute as an action parameter. Use a separate rule for each ruleset you want to deploy.
 
-This feature is part of an early access experience for selected customers.
+A rule that executes a ruleset consists of:
 
-</Aside>
-
-Use the [Rulesets API](/cf-rulesets/rulesets-api) to deploy or execute a ruleset. Add a rule with `"action": "execute"` to a phase, specifying the Ruleset ID as an action parameter. This rule executes the ruleset. Use a separate rule for each ruleset you want to deploy.
-
-A rule that deploys a ruleset consists of:
-
-* The **ID of the ruleset** you want to deploy.
+* The **ID of the ruleset** you want to execute.
 * An **expression**.
-* An **action**. To deploy a ruleset, set the action to execute. The rules in the ruleset are executed when a request satisfies the expression.
-
-<Aside type='warning' header='Important'>
+* An **action**. Set the action to `execute`. The rules in the ruleset execute when a request satisfies the expression.
 
-When deploying a ruleset to a phase at the **account** level, use the expression to define the hosts the ruleset applies to. The only field you can use in a rule expression to deploy a ruleset in a phase at the account level is `cf.zone.name`. The following operators are valid: `equals`, `not equals`, `contains`, `does not contain`, `is in`, `is not in`.
+<Aside type='note'>
 
-When deploying a ruleset to a phase at the **zone** level, you must set the expression to `true`. 
+To apply a rule to every request in a phase at the **zone** level, set the rule expression to `true`.
 
 </Aside>
 
 ## Example
 
-The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone-id}`).
-
-When deploying to a zone-level phase, you must set `expression` to `true`, since the zone scope is already defined in the endpoint.
+The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone-id}`) by adding a rule that executes the Managed Ruleset.
 
 ```json
 ---
@@ -93,8 +82,8 @@ header: Response
 }
 ```
 
-Check [Work with Managed Rulesets](/cf-rulesets/managed-rulesets) and [Work with custom rulesets](/cf-rulesets/custom-rulesets) for more information on working with Managed Rulesets and custom rulesets.
+See [Work with Managed Rulesets](/cf-rulesets/managed-rulesets) and [Work with custom rulesets](/cf-rulesets/custom-rulesets) for more information.
 
-For more information on the available API endpoints for editing and deploying rulesets, check [Update and deploy rulesets](/cf-rulesets/rulesets-api/update).
+For more information on the available API endpoints for editing and deploying rulesets, refer to [Update and deploy rulesets](/cf-rulesets/rulesets-api/update).
 
 For examples of deploying rulesets, see [Workflow examples](/cf-rulesets/common-use-cases).
diff --git a/products/firewall/src/content/cf-rulesets/index.md b/products/firewall/src/content/cf-rulesets/index.md
index c8517a07845..1a4a80bab0d 100644
--- a/products/firewall/src/content/cf-rulesets/index.md
+++ b/products/firewall/src/content/cf-rulesets/index.md
@@ -5,29 +5,21 @@ order: 700
 
 # Ruleset Engine (Beta)
 
-<Aside type="warning" header="Important">
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 The Cloudflare Ruleset Engine allows you to create and deploy rules and rulesets. The engine syntax, inspired by the Wireshark Display Filter language, is the same syntax used in custom Firewall Rules. Cloudflare uses the Ruleset Engine in different products, allowing you to configure several products using the same basic syntax.
 
 There are several elements involved in the configuration and use of the Ruleset Engine. These elements are:
 
 * **Phase** — Defines a stage in the life of a request where you can execute rulesets.
-* **Ruleset** — Defines a versioned set of rules. You can execute rulesets in a phase.
-* **Rule** — Defines a filter and an action to perform on incoming requests that match the filter expression. A rule with an “execute” action deploys a ruleset.
+* **Ruleset** — Defines a versioned set of rules. You deploy rulesets to a phase, where they execute.
+* **Rule** — Defines a filter and an action to perform on incoming requests that match the filter expression. A rule with an `execute` action executes a ruleset.
 
 ## Phases
 
-A phase defines a stage or entry point in the life of a request where you can execute rulesets. Phases are defined by Cloudflare and you cannot modify them.
+A phase defines a stage in the life of a request where you can execute rulesets. Phases are defined by Cloudflare and cannot be modified.
 
-At a conceptual level, a phase is also a ruleset. You deploy rulesets to a phase by adding rules to the phase ruleset.
+Phases exist at two levels: at the **account** level and at the **zone** level. For the same phase, rules defined at the account level are evaluated **before** the rules defined at the zone level.
 
-Phases exist at two levels: at the **account** level and at the **zone** level. For the same phase, rules defined at the account level run **before** the rules defined at the zone level.
-
-<Aside type="warning" header="Important">
+<Aside type="note">
 
 Currently, phases at the account level are only available in Enterprise plans.
 
@@ -37,21 +29,26 @@ The following diagram outlines the request handling process where requests go th
 
 ![Requests going through the available phases](../images/rulesets-phases.png)
 
+Phases have an **entry point** ruleset at the account and zone levels. An entry point ruleset contains a list of ordered rules that run in the phase. You can define rules in an entry point ruleset that execute a different ruleset.
+
 Cloudflare products are specific to one or more phases, and they add support for different features. Check the documentation for each Cloudflare product for details on the applicable phases.
 
 ## Rulesets
 
-A ruleset is a versioned set of rules. Cloudflare creates a new version of the ruleset each time you modify it. You execute rulesets by deploying them to a phase.
+A ruleset is an ordered set of rules that you can apply to traffic at the edge. Rulesets belong to a phase and can only execute in the same phase. To deploy a ruleset to a phase, add a rule that executes the ruleset to the phase entry point.
+
+Rulesets are versioned. Each ruleset modification creates a new version of the ruleset. You can have several versions of a ruleset in use at the same time. When you deploy a ruleset — that is, when you create a rule that executes the ruleset — the most recent version of the ruleset is selected by default.
 
 There are several types of rulesets. Cloudflare provides **Managed Rulesets** that you can deploy. Additionally, you can create and manage your own **custom rulesets**. Specific Cloudflare products may provide other types of rulesets.
 
 <Aside type="note" header="Note">
 
-Since phases behave just like rulesets, they also have a type. In the Rulesets API, you can check the ruleset type in the `kind` field. Account-level phases have a `root` ruleset type, while zone-level phases have a `zone` ruleset type.
+The `kind` field of phase entry point rulesets has one of the following values:
 
-</Aside>
+* `root` for phase entry point rulesets at the account level
+* `zone` for phase entry point rulesets at the zone level
 
-Cloudflare creates a new version of the ruleset every time there is a change to that ruleset. You can have several versions of a ruleset in use at the same time. When you deploy a ruleset, the most recent version of the ruleset is selected by default.
+</Aside>
 
 ### Managed Rulesets
 
@@ -71,7 +68,7 @@ Currently, custom rulesets are only supported by the Cloudflare WAF.
 
 </Aside>
 
-You can create custom rulesets at the account level where you can define your own set of rules. After creating a custom ruleset, you can deploy it to a phase.
+Use custom rulesets to define your own sets of rules. After creating a custom ruleset, deploy it to a phase by creating a rule that executes the ruleset.
 
 For more information on creating and deploying custom rulesets, check [Work with custom rulesets](/cf-rulesets/custom-rulesets).
 
@@ -79,7 +76,7 @@ For more information on creating and deploying custom rulesets, check [Work with
 
 A **rule** defines a filter and an action to perform on the incoming requests that match the filter. The rule filter **expression** defines the scope of the rule and the rule **action** defines what happens when there’s a match for the expression. Rule filter expressions use the same syntax as Firewall Rules.
 
-For example, consider the following ruleset with four rules (R1, R2, R3, and R4). For a given incoming request, the expression of the first two rules matches the request properties. Therefore, the action for these rules runs (_Execute_ and _Log_). The action of the first rule executes a Managed Ruleset, which means that every rule in the Managed Ruleset is evaluated. The action of the second rule logs an event associated with the current phase. There is no match for the expressions of rules 3 and 4, so their actions do not run. Since no rule blocks the request, it proceeds to the next phase.
+For example, consider the following ruleset with four rules (R1, R2, R3, and R4). For a given incoming request, the expression of the first two rules matches the request properties. Therefore, the action for these rules runs (_Execute_ and _Log_, respectively). The action of the first rule executes a Managed Ruleset, which means that every rule in the Managed Ruleset is evaluated. The action of the second rule logs an event associated with the current phase. There is no match for the expressions of rules 3 and 4, so their actions do not run. Since no rule blocks the request, it proceeds to the next phase.
 
 ![Rules execution example](../images/rulesets-rules-example.png)
 
diff --git a/products/firewall/src/content/cf-rulesets/managed-rulesets/deploy-managed-ruleset.md b/products/firewall/src/content/cf-rulesets/managed-rulesets/deploy-managed-ruleset.md
index 7dc168a8c30..b7722cfd208 100644
--- a/products/firewall/src/content/cf-rulesets/managed-rulesets/deploy-managed-ruleset.md
+++ b/products/firewall/src/content/cf-rulesets/managed-rulesets/deploy-managed-ruleset.md
@@ -1,5 +1,4 @@
 ---
-title: Deploy a Managed Ruleset
 pcx-content-type: how-to
 alwaysopen: true
 order: 751
@@ -7,26 +6,20 @@ order: 751
 
 # Deploy a Managed Ruleset
 
-<Aside type='note' header='Note'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-To deploy a Managed Ruleset to a phase at the account level or at the zone level, use the [Rulesets API](/cf-rulesets/rulesets-api).
+To deploy a Managed Ruleset to a phase, use the [Rulesets API](/cf-rulesets/rulesets-api).
 
 ## Deploy a Managed Ruleset to a phase at the account level
 
-Use the following workflow to deploy a managed ruleset to a phase at the account level.
+Use the following workflow to deploy a Managed Ruleset to a phase at the account level.
 
 1. Get your account ID.
 1. Get the ID of the Managed Ruleset you wish to deploy. See [List existing rulesets](/cf-rulesets/rulesets-api/view#list-existing-rulesets).
 1. Identify the phase where you want to deploy the Managed Ruleset. Ensure that the Managed Ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, check the specific documentation for that product.
-1. Add a rule to the account-level phase to deploy the Managed Ruleset.
+1. Add a rule to the account-level phase entry point ruleset that executes the Managed Ruleset.
 
 ### Example
 
-The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of your account (`{account-id}`). The rules in the Managed Ruleset are executed when the zone name matches one of `example.com` or `anotherexample.com`.
+The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of your account (`{account-id}`) by creating a rule that executes the Managed Ruleset. The rules in the Managed Ruleset are executed when the zone name matches one of `example.com` or `anotherexample.com`.
 
 ```json
 ---
@@ -44,7 +37,7 @@ curl -X PUT \
         "id": "{cloudflare-managed-ruleset-id}"
       },
       "expression": "cf.zone.name in {\"example.com\" \"anotherexample.com\"}",
-      "description": "Execute Cloudflare Managed Ruleset on my account-level phase ruleset"
+      "description": "Execute Cloudflare Managed Ruleset on my account-level phase entry point"
     }
   ]
 }'
@@ -57,7 +50,7 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "http_request_firewall_managed Account-level Ruleset",
+    "name": "Account-level phase entry point",
     "description": "",
     "kind": "root",
     "version": "5",
@@ -71,7 +64,7 @@ header: Response
           "version": "latest"
         },
         "expression": "cf.zone.name in {\"example.com\" \"anotherexample.com\"}",
-        "description": "Execute Cloudflare Managed Ruleset on my account-level phase ruleset",
+        "description": "Execute Cloudflare Managed Ruleset on my account-level phase entry point",
         "last_updated": "2021-03-18T18:30:08.122758Z",
         "ref": "{rule-ref}",
         "enabled": true
@@ -88,22 +81,16 @@ header: Response
 
 ## Deploy a Managed Ruleset to a phase at the zone level
 
-Use the following workflow to deploy a managed ruleset to a phase at the zone level.
+Use the following workflow to deploy a Managed Ruleset to a phase at the zone level.
 
 1. Get your zone ID.
 1. Get the ID of the Managed Ruleset you wish to deploy. See [List existing rulesets](/cf-rulesets/rulesets-api/view#list-existing-rulesets).
 1. Identify the phase where you want to deploy the Managed Ruleset. Ensure that the Managed Ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, check the specific documentation for that product.
-1. Add a rule to the zone-level phase to deploy the Managed Ruleset.
-
-<Aside type='warning' header='Important'>
-
-When deploying to a zone-level phase, you must set the rule `expression` to `true`, since the zone scope is already defined in the endpoint.
-
-</Aside>
+1. Add a rule to the zone-level phase entry point ruleset that executes the Managed Ruleset.
 
 ### Example
 
-The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone-id}`).
+The following example deploys a Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone-id}`) by creating a rule that executes the Managed Ruleset.
 
 ```json
 ---
@@ -121,7 +108,7 @@ curl -X PUT \
         "id": "{cloudflare-managed-ruleset-id}"
       },
       "expression": "true",
-      "description": "Execute Cloudflare Managed Ruleset on my zone ruleset"
+      "description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point"
     }
   ]
 }'
@@ -134,7 +121,7 @@ header: Response
 {
   "result": {
     "id": "{zone-level-phase-ruleset-id}",
-    "name": "Zone-level Ruleset 1",
+    "name": "Zone-level phase entry point",
     "description": "",
     "kind": "zone",
     "version": "3",
@@ -148,7 +135,7 @@ header: Response
           "version": "latest"
         },
         "expression": "true",
-        "description": "Execute Cloudflare Managed Ruleset on my zone ruleset",
+        "description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point",
         "last_updated": "2021-03-18T18:08:14.003361Z",
         "ref": "{ruleset-ref-1}",
         "enabled": true
@@ -163,4 +150,4 @@ header: Response
 }
 ```
 
-In these examples, the Managed Ruleset executes the behavior configured by Cloudflare. To customize the behavior of  Managed Rulesets, see [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset).
+In these examples, the Managed Ruleset executes the behavior configured by Cloudflare. To customize the behavior of Managed Rulesets, see [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset).
diff --git a/products/firewall/src/content/cf-rulesets/managed-rulesets/index.md b/products/firewall/src/content/cf-rulesets/managed-rulesets/index.md
index 3953afedd56..553134ed8d8 100644
--- a/products/firewall/src/content/cf-rulesets/managed-rulesets/index.md
+++ b/products/firewall/src/content/cf-rulesets/managed-rulesets/index.md
@@ -8,15 +8,9 @@ order: 750
 
 # Work with Managed Rulesets
 
-<Aside type='warning' header='Important'>
+Managed Rulesets are preconfigured rulesets provided by Cloudflare that you can deploy. Only Cloudflare can modify these rulesets.
 
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-Managed Rulesets are preconfigured rulesets provided by Cloudflare that you can deploy to a phase. Only Cloudflare can modify these rulesets.
-
-The rules in a Managed Ruleset have a default action and status. However, you can define **overrides** that change these defaults.
+The rules in a Managed Ruleset have a default configuration. However, you can define overrides that change this default configuration.
 
 <Aside type='note' header='Note'>
 
@@ -28,8 +22,8 @@ There are several Cloudflare products that provide you with Managed Rulesets. Ch
 
 ## Get started
 
-To view available Managed Rulesets, see [View rulesets](/cf-rulesets/view-rulesets/).
+To view available Managed Rulesets, see [View rulesets](/cf-rulesets/view-rulesets).
 
-To deploy a Managed Ruleset to a phase, see [Deploy a Managed Ruleset](/cf-rulesets/managed-rulesets/deploy-managed-ruleset/).
+To deploy a Managed Ruleset to a phase, see [Deploy a Managed Ruleset](/cf-rulesets/managed-rulesets/deploy-managed-ruleset).
 
-You cannot edit a Managed Ruleset, but you can customize Managed Ruleset behavior by using overrides when deploying it to a phase. See [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset).
\ No newline at end of file
+You cannot edit the rules in a Managed Ruleset, but you can customize the Managed Ruleset behavior by using overrides. Refer to [Override a Managed Ruleset](/cf-rulesets/managed-rulesets/override-managed-ruleset) for more information.
diff --git a/products/firewall/src/content/cf-rulesets/managed-rulesets/override-managed-ruleset.md b/products/firewall/src/content/cf-rulesets/managed-rulesets/override-managed-ruleset.md
index 616be7937eb..12f72268e7f 100644
--- a/products/firewall/src/content/cf-rulesets/managed-rulesets/override-managed-ruleset.md
+++ b/products/firewall/src/content/cf-rulesets/managed-rulesets/override-managed-ruleset.md
@@ -7,25 +7,22 @@ order: 752
 
 # Override a Managed Ruleset
 
-<Aside type='warning' header='Important'>
+You cannot add or remove rules from a Managed Ruleset, but you can customize its behavior by overriding it at deployment. When you override a ruleset you specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
 
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-You cannot edit a Managed Ruleset, but you can customize its behavior by overriding it at deployment. When you override a ruleset, specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
-
-For example, if you want to test a ruleset before enforcing it, you may want to execute a Managed Ruleset with all rules set to `log` instead of their default actions. To accomplish this, override the configured behavior of the Managed Ruleset at the ruleset level so each rule uses the _Log_ action.
+For example, if you want to test a ruleset before enforcing it, you may want to execute a Managed Ruleset with all rules set to `log` instead of their default actions. To accomplish this, override the configured behavior of the Managed Ruleset at the ruleset level, so that each rule uses the _Log_ action.
 
 ## Working with overrides
 
-You can override a ruleset at three levels.
+You can override a ruleset at three levels:
+
+* **Ruleset overrides** apply to all rules in the executed ruleset.
+* **Tag overrides** apply to all rules with a specific tag. For example, use a tag override to customize the Cloudflare Managed Ruleset so all rules with the `wordpress` tag are set to _Block_. If multiple tags have overrides and if a given rule has more than one of these tags, the tag overrides order determines the behavior. For rules tagged with multiple overridden tags, the last tag's overrides apply.
+* **Rule overrides** apply to specific rules in a Managed Ruleset, referenced by their Rule ID.
 
-* **Ruleset overrides** are for all rules in the specified rulesets.
-* **Tag overrides** are for all rules with a specific tag. For example, use a tag override to customize the Cloudflare Managed Ruleset so all rules with the `wordpress` tag are set to _Block_. If multiple tags have overrides and if a given rule has more than one of these tags, the tag overrides order determines the behavior. For rules tagged with multiple overridden tags, the last tag's overrides apply.
-* **Rule overrides** are for specific rules in a Managed Ruleset, referenced by their Rule ID.
+To apply an override for a Managed Ruleset:
 
-To apply an override for a Managed Ruleset, execute the [Update ruleset](/cf-rulesets/rulesets-api/update/) operation on your root ruleset and specify the `overrides` in the `action_parameters` of the rule that executes your Managed Ruleset.
+* Call the [Update ruleset](/cf-rulesets/rulesets-api/update) method on your account-level phase entry point.
+* Specify the `overrides` in the `action_parameters` of the rule that executes your Managed Ruleset.
 
 ```json
 "action_parameters": {
@@ -61,12 +58,18 @@ You can override the following rule properties:
 * `"action"` (`"block"`, `"challenge"`, `"log"`)
 * `"enabled"` (`true`, `false`)
 
+<Aside type="note" header="Note">
+
+Some Managed Rulesets may have additional override requirements, or they may allow you to override other rule properties. Check each Cloudflare product’s documentation for details.
+
+</Aside>
+
 ## Examples
 
-The following request deploys a Managed Ruleset to the `http_request_firewall_managed` phase and defines a ruleset override to deploy the `log` action for all rules in that ruleset.
+The following request adds a rule that executes a Managed Ruleset in the `http_request_firewall_managed` phase and defines a ruleset override to execute the `log` action for all rules in that ruleset.
 
 <details>
-<summary>Example: Deploy a Managed Ruleset to a phase at the zone level</summary>
+<summary>Example: Execute a Managed Ruleset with overrides in a phase at the zone level</summary>
 <div>
 
 ```json
@@ -96,7 +99,7 @@ curl -X PUT \
 </details>
 
 <details>
-<summary>Example: Deploy a Managed Ruleset to a phase at the account level</summary>
+<summary>Example: Execute a Managed Ruleset with overrides in a phase at the account level</summary>
 <div>
 
 ```json
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/add-rule.md b/products/firewall/src/content/cf-rulesets/rulesets-api/add-rule.md
new file mode 100644
index 00000000000..198a16866bd
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/add-rule.md
@@ -0,0 +1,91 @@
+---
+pcx-content-type: reference
+alwaysopen: true
+order: 786
+---
+
+# Add rule to ruleset
+
+Adds a single rule to an existing ruleset. Use this endpoint to add a rule without having to include all the existing ruleset rules in the request.
+
+Use one of the following API endpoints to add a rule to a ruleset:
+
+```bash
+---
+header: Account-level endpoint
+---
+POST /accounts/{account-id}/rulesets/{ruleset-id}/rules
+```
+
+```bash
+---
+header: Zone-level endpoint
+---
+POST /zones/{zone-id}/rulesets/{ruleset-id}/rules
+```
+
+Invoking this method creates a new version of the ruleset.
+
+Include the rule definition in the request body. The rule will be added to the end of the existing list of rules in the ruleset.
+
+## Example
+
+The following example adds a rule to ruleset `{ruleset-id}` of zone `{zone-id}`. The ruleset ID was previously obtained using the [List rulesets](/cf-rulesets/rulesets-api/view#list-existing-rulesets) method, and corresponds to the entry point ruleset for the `http_request_firewall_custom` phase.
+
+```json
+---
+header: Request
+---
+curl -X POST \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}/rules" \
+-d '{
+  "action": "js_challenge",
+  "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0",
+  "description": "challenge GB and FR or based on IP Reputation"
+}'
+```
+
+The response includes the complete ruleset after adding the rule.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone Ruleset 1",
+    "description": "My phase entry point ruleset at the zone level",
+    "kind": "zone",
+    "version": "11",
+    "rules": [
+      {
+        "id": "{rule-id-1}",
+        "version": "1",
+        "action": "challenge",
+        "expression": "not http.request.uri.path matches \"^/api/.*$\"",
+        "last_updated": "2020-11-23T11:36:24.192361Z",
+        "ref": "{rule-ref-1}",
+        "enabled": true
+      },
+      {
+        "id": "{new-rule-id}",
+        "version": "1",
+        "action": "js_challenge",
+        "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0",
+        "description": "challenge GB and FR or based on IP Reputation",
+        "last_updated": "2021-06-22T12:35:58.144683Z",
+        "ref": "{new-rule-ref}",
+        "enabled": true
+      }
+    ],
+    "last_updated": "2021-06-22T12:35:58.144683Z",
+    "phase": "http_request_firewall_custom"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/create.md b/products/firewall/src/content/cf-rulesets/rulesets-api/create.md
index 124431090b0..2bd3b243153 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/create.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/create.md
@@ -7,13 +7,7 @@ order: 784
 
 # Create ruleset
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-Creates a ruleset of a given kind in the specified phase.
+Creates a ruleset of a given kind in the specified phase. Allows you to create phase entry point rulesets.
 
 Use one of the following endpoints when creating a ruleset:
 
@@ -61,9 +55,9 @@ The following parameters are required:
       <td>String</td>
       <td><p>Allowed values:
           <ul>
-            <li><em>root</em> - creates a phase ruleset at the account level</li>
-            <li><em>zone</em> - creates a phase ruleset at the zone level</li>
             <li><em>custom</em> - creates a custom ruleset</li>
+            <li><em>root</em> - creates a phase entry point ruleset at the account level</li>
+            <li><em>zone</em> - creates a phase entry point ruleset at the zone level</li>
           </ul>
         </p></td>
     </tr>
@@ -71,16 +65,16 @@ The following parameters are required:
       <td><code>phase</code></td>
       <td>The name of the phase where the ruleset will be created.</td>
       <td>String</td>
-      <td>Check the specific Cloudflare product documentation for more information on the phases where you can create custom rulesets.</td>
+      <td>Check the specific Cloudflare product documentation for more information on the phases where you can create rulesets for that product.</td>
     </tr>
   </tbody>
 </table>
 
-Use the `rules` parameter to supply a list of rules that define the ruleset. For an object definition, see [Rulesets API: JSON Object](/cf-rulesets/rulesets-api/json-object).
+Use the `rules` parameter to supply a list of rules for the ruleset. For an object definition, refer to [Rulesets API: JSON Object](/cf-rulesets/rulesets-api/json-object).
 
-## Example - Create a zone-level phase ruleset
+## Example - Create a custom ruleset
 
-This example creates a zone-level phase ruleset at the `http_request_firewall_managed` phase with a single rule that deploys a Managed Ruleset.
+This example creates a custom ruleset in the `http_request_firewall_custom` phase containing a single rule.
 
 ```json
 ---
@@ -89,21 +83,18 @@ header: Request
 curl -X POST \
 -H "X-Auth-Email: user@cloudflare.com" \
 -H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets" \
+"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets" \
 -d '{
-  "name": "Zone-level phase ruleset",
-  "kind": "zone",
-  "description": "This ruleset deploys a Managed Ruleset.",
+  "name": "Example custom ruleset",
+  "kind": "custom",
+  "description": "Example ruleset description",
   "rules": [
     {
-      "action": "execute",
-      "expression": "true",
-      "action_parameters": {
-        "id": "{managed-ruleset-id}"
-      }
+      "action": "log",
+      "expression": "cf.zone.name eq \"example.com\""
     }
   ],
-  "phase": "http_request_firewall_managed"
+  "phase": "http_request_firewall_custom"
 }'
 ```
 
@@ -114,24 +105,21 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
-    "kind": "zone",
+    "name": "Example custom ruleset",
+    "description": "Example ruleset description",
+    "kind": "custom",
     "version": "1",
     "rules": [
       {
         "id": "{rule-id}",
         "version": "1",
-        "action": "execute",
-        "expression": "true",
-        "action_parameters": {
-          "id": "{managed-ruleset-id}"
-        },
+        "action": "log",
+        "expression": "cf.zone.name eq \"example.com\"",
         "last_updated": "2021-03-17T15:42:37.917815Z"
       }
     ],
     "last_updated": "2021-03-17T15:42:37.917815Z",
-    "phase": "http_request_firewall_managed"
+    "phase": "http_request_firewall_custom"
   },
   "success": true,
   "errors": [],
@@ -139,9 +127,9 @@ header: Response
 }
 ```
 
-## Example - Create a custom ruleset
+## Example - Create a zone-level phase entry point ruleset
 
-This example creates a custom ruleset in the `http_request_firewall_custom` phase with a single rule.
+This example creates a zone-level phase entry point ruleset at the `http_request_firewall_managed` phase with a single rule that executes a Managed Ruleset.
 
 ```json
 ---
@@ -150,18 +138,21 @@ header: Request
 curl -X POST \
 -H "X-Auth-Email: user@cloudflare.com" \
 -H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets" \
 -d '{
-  "name": "Example custom ruleset",
-  "kind": "custom",
-  "description": "Example ruleset description",
+  "name": "Zone-level phase entry point",
+  "kind": "zone",
+  "description": "This ruleset executes a Managed Ruleset.",
   "rules": [
     {
-      "action": "log",
-      "expression": "cf.zone.name eq \"example.com\""
+      "action": "execute",
+      "expression": "true",
+      "action_parameters": {
+        "id": "{managed-ruleset-id}"
+      }
     }
   ],
-  "phase": "http_request_firewall_custom"
+  "phase": "http_request_firewall_managed"
 }'
 ```
 
@@ -172,24 +163,27 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Example custom ruleset",
-    "description": "Example ruleset description",
-    "kind": "custom",
+    "name": "Zone-level phase entry point",
+    "description": "This ruleset executes a Managed Ruleset.",
+    "kind": "zone",
     "version": "1",
     "rules": [
       {
         "id": "{rule-id}",
         "version": "1",
-        "action": "log",
-        "expression": "cf.zone.name eq \"example.com\"",
+        "action": "execute",
+        "expression": "true",
+        "action_parameters": {
+          "id": "{managed-ruleset-id}"
+        },
         "last_updated": "2021-03-17T15:42:37.917815Z"
       }
     ],
     "last_updated": "2021-03-17T15:42:37.917815Z",
-    "phase": "http_request_firewall_custom"
+    "phase": "http_request_firewall_managed"
   },
   "success": true,
   "errors": [],
   "messages": []
 }
-```
\ No newline at end of file
+```
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/delete-rule.md b/products/firewall/src/content/cf-rulesets/rulesets-api/delete-rule.md
new file mode 100644
index 00000000000..116c2307d6c
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/delete-rule.md
@@ -0,0 +1,74 @@
+---
+pcx-content-type: reference
+order: 787
+---
+
+# Delete a rule in a ruleset
+
+Deletes a single rule in a ruleset.
+
+Use one of the following API endpoints:
+
+```bash
+---
+header: Account-level endpoint
+---
+DELETE /accounts/{account-id}/rulesets/{ruleset-id}/rules/{rule-id}
+```
+
+```bash
+---
+header: Zone-level endpoint
+---
+DELETE /zones/{zone-id}/rulesets/{ruleset-id}/rules/{rule-id}
+```
+
+If the delete operation succeeds, the API method call returns a `200 OK` HTTP status code with the complete ruleset in the response body.
+
+## Example
+
+The following example deletes rule `{rule-id-1}` belonging to ruleset `{ruleset-id}`.
+
+```json
+---
+header: Request
+---
+curl -X DELETE \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/{ruleset-id}/rules/{rule-id-1}"
+```
+
+The response includes the complete ruleset after deleting the rule.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Custom Ruleset 1",
+    "description": "My first custom ruleset",
+    "kind": "custom",
+    "version": "12",
+    "rules": [
+      {
+        "id": "{rule-id-2}",
+        "version": "2",
+        "action": "js_challenge",
+        "expression": "(ip.geoip.country eq \"GB\" or ip.geoip.country eq \"FR\") or cf.threat_score > 0",
+        "description": "challenge GB and FR or based on IP Reputation",
+        "last_updated": "2021-07-22T12:54:58.144683Z",
+        "ref": "{rule-ref-2}",
+        "enabled": true
+      }
+    ],
+    "last_updated": "2021-07-22T12:54:58.144683Z",
+    "phase": "http_request_firewall_custom"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/delete.md b/products/firewall/src/content/cf-rulesets/rulesets-api/delete.md
new file mode 100644
index 00000000000..950b3cd2757
--- /dev/null
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/delete.md
@@ -0,0 +1,91 @@
+---
+pcx-content-type: reference
+order: 788
+---
+
+# Delete rulesets
+
+You can use the API to delete all the versions of a ruleset or delete a specific version of a ruleset.
+
+* [Delete ruleset (all versions)](#delete-ruleset)
+* [Delete ruleset version](#delete-ruleset-version)
+
+## Delete ruleset
+
+To delete all the versions of an existing ruleset at the account or zone level, use one of the following API endpoints:
+
+```bash
+---
+header: Account-level endpoint
+---
+DELETE /accounts/{account-id}/rulesets/{ruleset-id}
+```
+
+```bash
+---
+header: Zone-level endpoint
+---
+DELETE /zones/{zone-id}/rulesets/{ruleset-id}
+```
+
+If the delete operation succeeds, the API method call returns a `204 No Content` HTTP status code.
+
+<Aside type='warning' header='Important'>
+
+You cannot delete a ruleset that is still referenced in other rules. For example, you cannot delete a custom ruleset that is being deployed in a rule with `execute` action.
+
+To delete the ruleset, update or delete any rules that reference the ruleset and try again.
+
+</Aside>
+
+### Example
+
+The following example request deletes an existing ruleset.
+
+```json
+curl -X DELETE \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/{ruleset-id}"
+```
+
+## Delete ruleset version
+
+To delete a specific version of a ruleset, use one of the following API endpoints:
+
+```bash
+---
+header: Account-level endpoint
+---
+DELETE /accounts/{account-id}/rulesets/{ruleset-id}/versions/{version-number}
+```
+
+```bash
+---
+header: Zone-level endpoint
+---
+DELETE /zones/{zone-id}/rulesets/{ruleset-id}/versions/{version-number}
+```
+
+If the delete operation succeeds, the method call returns a `204 No Content` HTTP status code.
+
+Later updates to the ruleset will not reuse the version number of a deleted ruleset version.
+
+<Aside type='warning' header='Important'>
+
+You cannot delete a ruleset version if it is the latest ruleset version and there is a rule with `execute` action deploying that ruleset.
+
+To delete the ruleset version, update or delete any rules that reference the ruleset and try again.
+
+</Aside>
+
+### Example
+
+The following example request deletes a version of an existing ruleset.
+
+```json
+curl -X DELETE \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/{ruleset-id}/versions/{version-number}"
+```
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/endpoints.md b/products/firewall/src/content/cf-rulesets/rulesets-api/endpoints.md
index c820a660c25..51128dd3d2e 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/endpoints.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/endpoints.md
@@ -7,13 +7,7 @@ order: 782
 
 # Endpoints
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-For some operations, you can use specific endpoints provided by the Rulesets API for managing the rulesets of phases. These endpoints include the phase name in the endpoint instead of the ruleset ID.
+For some operations, you can use specific endpoints provided by the Rulesets API for managing phase entry point rulesets. These endpoints include the phase name in the endpoint instead of the ruleset ID.
 
 For example, instead of using the following endpoint:
 
@@ -24,7 +18,7 @@ PUT /zones/{zone-id}/rulesets/{ruleset-id}
 You can use the following endpoint:
 
 ```bash
-PUT /zones/{zone-id}/rulesets/phases/http_request_firewall_managed/entrypoint
+PUT /zones/{zone-id}/rulesets/phases/{phase-name}/entrypoint
 ```
 
 To invoke a Cloudflare Rulesets API operation, append the endpoint to the Cloudflare API base URL:
@@ -39,7 +33,7 @@ For help with endpoints and pagination, see [Getting Started: Endpoints](https:/
 
 <Aside>
 
-The Rulesets endpoints require a value for `{account_id}` or for `{zone-id}`.
+The Rulesets API endpoints require a value for `{account_id}` or `{zone-id}`.
 
 To retrieve a list of accounts you have access to, use the [List Accounts](https://api.cloudflare.com/#accounts-list-accounts) operation. Note the IDs of the accounts you want to manage.
 
@@ -113,7 +107,7 @@ The Cloudflare Rulesets API supports the operations outlined below. Visit the as
       <td><a href="/cf-rulesets/rulesets-api/create">Create ruleset</a></td>
       <td><code>POST</code></td>
       <td>
-        <p>Creates a new ruleset.</p>
+        <p>Creates a new ruleset or a new phase entry point.</p>
       </td>
     </tr>
   </tbody>
@@ -134,7 +128,14 @@ The Cloudflare Rulesets API supports the operations outlined below. Visit the as
       <td><a href="/cf-rulesets/rulesets-api/update">Update or deploy a ruleset</a></td>
       <td><code>PUT</code></td>
       <td>
-        <p>Updates the basic properties of a ruleset and the list of rules in the ruleset.<br/>Allows you to deploy Managed Rulesets.</p>
+        <p>Updates the basic properties of a ruleset and the list of rules in the ruleset.<br/>Allows you to configure the execution of Managed Rulesets.</p>
+      </td>
+    </tr>
+    <tr>
+      <td><a href="/cf-rulesets/rulesets-api/add-rule">Add rule to ruleset</a></td>
+      <td><code>POST</code></td>
+      <td>
+        <p>Adds a single rule to an existing ruleset.<br/>Allows you to add a single rule without having to include all the existing ruleset rules in the request.</p>
       </td>
     </tr>
     <tr>
@@ -144,5 +145,40 @@ The Cloudflare Rulesets API supports the operations outlined below. Visit the as
         <p>Updates the definition of a single rule within a ruleset.<br/>Allows you to change the order of a rule in a ruleset.</p>
       </td>
     </tr>
+    <tr>
+      <td><a href="/cf-rulesets/rulesets-api/delete-rule">Delete a rule in a ruleset</a></td>
+      <td><code>DELETE</code></td>
+      <td>
+        <p>Deletes a single rule in a ruleset.</p>
+      </td>
+    </tr>
   </tbody>
 </table>
+
+## Delete rulesets
+
+<table>
+  <thead>
+    <tr>
+      <th>Operation</th>
+      <th>Verb</th>
+      <th>Notes</th>
+    </tr>
+  </thead>
+  <tbody style="vertical-align:top">
+    <tr>
+      <td><a href="/cf-rulesets/rulesets-api/delete#delete-ruleset">Delete ruleset</a></td>
+      <td><code>DELETE</code></td>
+      <td>
+        <p>Deletes all the versions of a ruleset.</p>
+      </td>
+    </tr>
+    <tr>
+      <td><a href="/cf-rulesets/rulesets-api/delete#delete-ruleset-version">Delete ruleset version</a></td>
+      <td><code>DELETE</code></td>
+      <td>
+        <p>Deletes a specific version of a ruleset.</p>
+      </td>
+    </tr>
+  </tbody>
+</table>
\ No newline at end of file
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/index.md b/products/firewall/src/content/cf-rulesets/rulesets-api/index.md
index 10a2d3ece41..207992d2394 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/index.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/index.md
@@ -7,14 +7,8 @@ order: 780
 
 # Rulesets API
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
-The Rulesets API provides an interface for managing and deploying rulesets.
+The Rulesets API provides an interface for managing and configuring the execution of rulesets.
 
 ## Get started
 
-To get started, review the Rulesets [JSON object](/cf-rulesets/rulesets-api/json-object/) and [Endpoints](/cf-rulesets/rulesets-api/endpoints/).
+To get started, review the Rulesets [JSON object](/cf-rulesets/rulesets-api/json-object) and the available [Endpoints](/cf-rulesets/rulesets-api/endpoints).
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/json-object.md b/products/firewall/src/content/cf-rulesets/rulesets-api/json-object.md
index 6f19daac5a4..b42ccc30ee6 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/json-object.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/json-object.md
@@ -7,12 +7,6 @@ order: 781
 
 # JSON object
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 ## Ruleset object
 
 A fully populated ruleset object has the following JSON structure.
@@ -158,7 +152,7 @@ The JSON object properties for a rule are defined as follows:
       <td><code>action</code></td>
       <td>Defines what happens when there’s a match for the rule expression.</td>
       <td>String</td>
-      <td>The available actions depend on the phase where the rule's ruleset is deployed.</td>
+      <td>The available actions depend on the phase where the rule's ruleset is executed.</td>
     </tr>
     <tr>
       <td><code>categories</code></td>
@@ -170,7 +164,7 @@ The JSON object properties for a rule are defined as follows:
       <td><code>expression</code></td>
       <td>Criteria defining when there is a match for the current rule.</td>
       <td>String</td>
-      <td>The fields and functions you can use in a rule expression depend on the phase where the rule's ruleset is deployed.</td>
+      <td>The fields and functions you can use in a rule expression depend on the phase where the rule's ruleset is executed.</td>
     </tr>
     <tr>
       <td><code>last_updated</code></td>
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/update-rule.md b/products/firewall/src/content/cf-rulesets/rulesets-api/update-rule.md
index 8897c011996..e1b2bc87443 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/update-rule.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/update-rule.md
@@ -7,12 +7,6 @@ order: 786
 
 # Update a rule in a ruleset
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 Applies one or more changes to an existing rule in a ruleset.
 
 Use one of the following API endpoints to update a single rule in a ruleset:
@@ -35,7 +29,7 @@ You can update the definition of the rule, changing its fields, or change the or
 
 ## Update the definition of a rule
 
-To update the definition of a rule, include the new rule definition in the request body. You must include all the rule fields that you want to include in the new rule definition, even if you are not changing their values.
+To update the definition of a rule, include the new rule definition in the request body. You must include all the rule fields that you want to be part of the new rule definition, even if you are not changing their values.
 
 ```json
 ---
@@ -99,11 +93,11 @@ header: Response
 
 To reorder a rule in a list of ruleset rules, include a `position` field in the request, containing one of the following arguments:
 
-* `"before": "{rule-id}"` - Places the rule before rule `{rule-id}`. Use this argument with an empty rule ID value (`""`) to set the rule as the first rule in the ruleset.
+* `"before": "{rule-id}"` — Places the rule before rule `{rule-id}`. Use this argument with an empty rule ID value (`""`) to set the rule as the first rule in the ruleset.
 
-* `"after": "{rule-id}"` - Places the rule after rule `{rule-id}`. Use this argument with an empty rule ID value (`""`) to set the rule as the last rule in the ruleset.
+* `"after": "{rule-id}"` — Places the rule after rule `{rule-id}`. Use this argument with an empty rule ID value (`""`) to set the rule as the last rule in the ruleset.
 
-* `"index": {position-number}` - Places the rule in the exact position specified by the integer number `{position-number}`. Position numbers start with `1`. Existing rules in the ruleset from the specified position number onward are shifted one position (no rule is overwritten). For example, when you place a rule in position <var>n</var> using `index`, existing rules with index <var>n</var>, <var>n</var>+1, <var>n</var>+2, and so on, are shifted one position — their new position will be <var>n</var>+1, <var>n</var>+2, <var>n</var>+3, and so forth. If the index is out of range, the method returns 400 HTTP Status Code.
+* `"index": {position-number}` — Places the rule in the exact position specified by the integer number `{position-number}`. Position numbers start with `1`. Existing rules in the ruleset from the specified position number onward are shifted one position (no rule is overwritten). For example, when you place a rule in position <var>n</var> using `index`, existing rules with index <var>n</var>, <var>n</var>+1, <var>n</var>+2, and so on, are shifted one position — their new position will be <var>n</var>+1, <var>n</var>+2, <var>n</var>+3, and so forth. If the index is out of range, the method returns 400 HTTP Status Code.
 
 <Aside type='warning' header='Important'>
 
@@ -111,7 +105,7 @@ You can only use one of the arguments `before`, `after`, and `index` at a time.
 
 </Aside>
 
-You can reorder a rule without changing its definition by including only the `position` field in the `PATCH` request body. You can also update a rule definition and reorder it in the same `PATCH` request by including both the `rule` field and the `position` field.
+Reorder a rule without changing its definition by including only the `position` field in the `PATCH` request body. You can also update a rule definition and reorder it in the same `PATCH` request by including both the `rule` field and the `position` field.
 
 The following examples build upon the following (abbreviated) ruleset:
 
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/update.md b/products/firewall/src/content/cf-rulesets/rulesets-api/update.md
index 0c04a7dccd7..b7221821c2d 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/update.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/update.md
@@ -1,5 +1,4 @@
 ---
-title: Update and deploy rulesets
 pcx-content-type: reference
 alwaysopen: true
 order: 785
@@ -7,31 +6,25 @@ order: 785
 
 # Update and deploy rulesets
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 You can use the API to update **basic properties** of a ruleset (currently only the description) and the **list of rules** in the ruleset.
 
-To configure a ruleset at the account or zone level, use one of the following API endpoints:
+To update a ruleset at the account or zone level, use one of the following API endpoints:
 
 ```bash
 ---
 header: Account-level endpoint
 ---
-PUT /accounts/{account-id}/rulesets/{root-ruleset-id}
+PUT /accounts/{account-id}/rulesets/{ruleset-id}
 ```
 
 ```bash
 ---
 header: Zone-level endpoint
 ---
-PUT /zones/{zone-id}/rulesets/{root-ruleset-id}
+PUT /zones/{zone-id}/rulesets/{ruleset-id}
 ```
 
-Alternatively, you can use one of the following endpoints when updating the ruleset of a phase:
+Alternatively, you can use one of the following endpoints when updating a phase entry point ruleset:
 
 ```bash
 ---
@@ -55,7 +48,7 @@ You cannot update the name of the ruleset or its type. Do not include these fiel
 
 ## Example - Set the rules of a ruleset
 
-Use this API method to set the rules of a ruleset. You must include all the rules you want to associate with the ruleset in every `PUT` request.
+Use this API method to set the rules of a ruleset. You must include all the rules you want to associate with the ruleset in every request.
 
 ```json
 ---
@@ -85,8 +78,8 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
+    "name": "Zone-level phase entry point",
+    "description": "This ruleset executes a Managed Ruleset.",
     "kind": "zone",
     "version": "4",
     "rules": [
@@ -112,9 +105,9 @@ header: Response
 
 ## Example - Deploy a ruleset
 
-To deploy a ruleset, create a rule with the `action` field set to `execute` and add the ruleset ID to the `action_parameters` field in the `id` parameter. You deploy rulesets to a phase.
+To deploy a ruleset, create a rule with `"action": "execute"` that executes the ruleset, and add the ruleset ID to the `action_parameters` field in the `id` parameter.
 
-This example deploys a Managed Ruleset to the zone-level `http_request_firewall_managed` phase of a zone (`{zone-id}`).
+The following example deploys a Managed Ruleset to the zone-level `http_request_firewall_managed` phase of a zone (`{zone-id}`).
 
 ```json
 ---
@@ -132,7 +125,7 @@ curl -X PUT \
         "id": "{managed-ruleset-id}"
       },
       "expression": "true",
-      "description": "Execute Cloudflare Managed Ruleset on my phase ruleset"
+      "description": "Execute Cloudflare Managed Ruleset on my phase entry point"
     }
   ]
 }'
@@ -145,7 +138,7 @@ header: Response
 {
   "result": {
     "id": "{phase-ruleset-id}",
-    "name": "Zone-level phase ruleset",
+    "name": "Zone-level phase entry point",
     "description": "",
     "kind": "zone",
     "version": "4",
@@ -159,7 +152,7 @@ header: Response
           "version": "latest"
         },
         "expression": "true",
-        "description": "Execute Cloudflare Managed Ruleset on my phase ruleset",
+        "description": "Execute Cloudflare Managed Ruleset on my phase entry point",
         "last_updated": "2021-03-21T11:02:08.769537Z",
         "ref": "{rule-ref-1}",
         "enabled": true
@@ -174,22 +167,15 @@ header: Response
 }
 ```
 
-<Aside type='warning' header='Important'>
-
-You must set the `expression` field to `true` when deploying a ruleset to a zone-level phase.
-
-</Aside>
-
 For more information on deploying rulesets, check [Deploy rulesets](/cf-rulesets/deploy-rulesets).
 
-
 ## Example - Update ruleset description
 
-You can use this API method to update the description of an existing ruleset.
+You can use this API method to update the description of an existing ruleset or phase entry point.
 
 <Aside type='warning' header='Important'>
 
-You cannot update the description or the rules in a Managed Ruleset. You can only define overrides to customize the ruleset behavior.
+You cannot update the description or the rules in a Managed Ruleset. You can only [define overrides](/cf-rulesets/managed-rulesets/override-managed-ruleset) to customize the ruleset behavior.
 
 </Aside>
 
@@ -202,7 +188,7 @@ curl -X PUT \
 -H "X-Auth-Key: REDACTED" \
 "https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
 -d '{ 
-  "description": "My updated zone ruleset"
+  "description": "My updated phase entry point"
 }'
 ```
 
@@ -213,8 +199,8 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone Ruleset",
-    "description": "My updated zone ruleset",
+    "name": "Zone entry point",
+    "description": "My updated phase entry point",
     "kind": "zone",
     "version": "4",
     "rules": [
diff --git a/products/firewall/src/content/cf-rulesets/rulesets-api/view.md b/products/firewall/src/content/cf-rulesets/rulesets-api/view.md
index 44d2891f564..ea60803051d 100644
--- a/products/firewall/src/content/cf-rulesets/rulesets-api/view.md
+++ b/products/firewall/src/content/cf-rulesets/rulesets-api/view.md
@@ -7,12 +7,6 @@ order: 783
 
 # List and view rulesets
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 * [List existing rulesets](#list-existing-rulesets)
 * [View a specific ruleset](#view-a-specific-ruleset)
 * [List all versions of a ruleset](#list-all-versions-of-a-ruleset)
@@ -39,11 +33,11 @@ GET /zones/{zone-id}/rulesets
 
 The result includes rulesets across all phases at a given level (account or zone). The `phase` field in each result element indicates the phase where that ruleset is defined.
 
-Also, the list of rulesets at the zone level includes the account-level rulesets you may want to deploy at the specified zone.
+Also, the list of rulesets at the zone level includes the account-level rulesets you may want to deploy to the specified zone.
 
 <Aside type='warning' header='Important'>
 
-Not all zone-level phases support all types of rulesets, even if they are presented in the list returned by this API method. Check the documentation for each Cloudflare product for more information on what ruleset types are allowed in that product’s supported phases.
+Not all zone-level phases support all types of rulesets, even if they are presented in the list returned by this API method. Check the documentation for each Cloudflare product for more information on which ruleset types are allowed in that product’s supported phases.
 
 </Aside>
 
@@ -69,7 +63,7 @@ header: Response
   "result": [
     {
       "id": "{phase-ruleset-id}",
-      "name": "Zone-level phase ruleset",
+      "name": "Zone-level phase entry point",
       "description": "",
       "kind": "zone",
       "version": "5",
@@ -103,11 +97,11 @@ GET /zones/{zone-id}/rulesets/{ruleset-id}
 
 <Aside type='warning' header='Important'>
 
-Note: You can only use the zone-level endpoint for zone-level rulesets, that is, phases where `kind` is set to `zone`.
+Note: You can only use the zone-level endpoint for zone-level phase entry points, that is, entry points where `kind` is set to `zone`.
 
 </Aside>
 
-You can also use the following specific endpoints for viewing the ruleset of a phase:
+You can also use the following specific endpoints for viewing the ruleset of a phase entry point:
 
 ```bash
 ---
@@ -128,7 +122,7 @@ Returns the ruleset with the specified Ruleset ID.
 The API returns a 404 HTTP Status Code under these conditions:
 
 * When a ruleset cannot be found.
-* When the specified ruleset is not a Managed Ruleset the calling account is entitled to deploy.
+* When the specified ruleset is not a Managed Ruleset the calling account is entitled to execute.
 
 ### Example
 
@@ -149,8 +143,8 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
+    "name": "Zone-level phase entry point",
+    "description": "Executes a Managed Ruleset.",
     "kind": "zone",
     "version": "3",
     "rules": [
@@ -196,7 +190,7 @@ GET /zones/{zone-id}/rulesets/{ruleset-id}/versions
 
 The result contains the ruleset properties of each version, but it does not include the list of rules. Check [View a specific version of a ruleset](#view-a-specific-version-of-a-ruleset) to get this information.
 
-You can also use the following specific endpoints for the ruleset of a phase:
+You can also use the following specific endpoints to obtain all the versions of a phase entry point:
 
 ```bash
 ---
@@ -212,7 +206,7 @@ header: Zone-level phase endpoint
 GET /zones/{zone-id}/rulesets/phases/{phase-name}/entrypoint/versions
 ```
 
-When the specified phase ruleset does not exist, this API method returns an empty array in the `result` field.
+When the specified phase entry point ruleset does not exist, this API method returns an empty array in the `result` field.
 
 ### Example
 
@@ -277,7 +271,7 @@ header: Zone-level endpoint
 GET /zones/{zone-id}/rulesets/{ruleset-id}/versions/{version-number}
 ```
 
-You can also use the following specific endpoints for the ruleset of a phase:
+You can also use the following endpoints for viewing a specific version of a phase entry point:
 
 ```bash
 ---
@@ -293,7 +287,7 @@ header: Zone-level phase endpoint
 GET /zones/{zone-id}/rulesets/phases/{phase-name}/entrypoint/versions/{version-number}
 ```
 
-When the specified phase ruleset does not exist, this API method returns a 404 HTTP Status Code.
+When the specified phase entry point ruleset does not exist, this API method returns a 404 HTTP Status Code.
 
 ### Example
 
@@ -314,8 +308,8 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
+    "name": "Zone-level phase entry point",
+    "description": "Executes a Managed Ruleset.",
     "kind": "zone",
     "version": "3",
     "rules": [
@@ -341,7 +335,7 @@ header: Response
 
 <Aside type='note' header='Note'>
 
-When you view a specific version of a Managed Ruleset, each rule listed in the result has one or more associated categories/tags and it does not contain an expression.
+When you view a specific version of a Managed Ruleset, each rule listed in the result can have one or more associated categories/tags, and it will not contain an expression.
 
 </Aside>
 
@@ -350,7 +344,7 @@ When you view a specific version of a Managed Ruleset, each rule listed in the r
 Returns a list of all the rules in a Managed Ruleset with a specific tag.
 
 ```bash
-GET /accounts/{account-id}/rulesets/{managed-ruleset-id}/{version-number}/by_category/{category-name}
+GET /accounts/{account-id}/rulesets/{managed-ruleset-id}/{version-number}/by_tag/{tag-name}
 ```
 
 ### Example
@@ -362,7 +356,7 @@ header: Request
 curl -X GET \
   -H "X-Auth-Email: user@cloudflare.com" \
   -H "X-Auth-Key: REDACTED" \
-  "https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/{ruleset-id}/versions/2/by_category/wordpress"
+  "https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/{ruleset-id}/versions/2/by_tag/wordpress"
 ```
 
 ```json
diff --git a/products/firewall/src/content/cf-rulesets/view-rulesets.md b/products/firewall/src/content/cf-rulesets/view-rulesets.md
index 4f759fca91c..255ffc956e6 100644
--- a/products/firewall/src/content/cf-rulesets/view-rulesets.md
+++ b/products/firewall/src/content/cf-rulesets/view-rulesets.md
@@ -6,12 +6,6 @@ type: overview
 
 # View rulesets
 
-<Aside type='warning' header='Important'>
-
-This feature is part of an early access experience for selected customers.
-
-</Aside>
-
 ## View available rulesets
 
 You can list the available rulesets for a zone, account, or phase.
@@ -33,7 +27,7 @@ curl -X GET \
 The response displays the following rulesets:
 
 * Managed Rulesets you can deploy, indicated by `"kind": "managed"`
-* Rulesets for zone-level phases, if configured, indicated by `"kind": "zone"`
+* Zone-level phase entry points, if configured, indicated by `"kind": "zone"`
 * Custom rulesets, if configured, indicated by `"kind": "custom"`
 
 ```json
@@ -95,8 +89,8 @@ curl -X GET \
 
 The response displays the following rulesets:
 
-* Managed Rulesets that you can deploy, indicated by `"kind": "managed"`
-* Rulesets for account-level phases, if configured, indicated by `"kind": "root"`
+* Managed Rulesets you can deploy, indicated by `"kind": "managed"`
+* Account-level phase entry points, if configured, indicated by `"kind": "root"`
 * Custom rulesets, if configured, indicated by `"kind": "custom"`
 
 ```json
@@ -153,13 +147,13 @@ header: Response
 
 ## View the rules included in a ruleset
 
-You can view all versions in phase rulesets (both account-level and zone-level) and custom rulesets, but you can only view the most recent version of Managed Rulesets.
+You can view all versions of phase entry points (at the account and zone levels) and custom rulesets, but you can only view the most recent version of Managed Rulesets.
 
 <details>
-<summary>Example: View rules in a phase ruleset at the zone level</summary>
+<summary>Example: View rules in a phase entry point ruleset at the zone level</summary>
 <div>
 
-The following example lists the rules in version `2` of the `http_request_firewall_managed` phase ruleset at the zone level.
+The following example lists the rules in version `2` of the `http_request_firewall_managed` phase entry point ruleset at the zone level.
 
 ```bash
 ---
@@ -178,8 +172,8 @@ header: Response
 {
   "result": {
     "id": "{ruleset-id}",
-    "name": "Zone-level phase ruleset",
-    "description": "This ruleset deploys a Managed Ruleset.",
+    "name": "Zone-level phase entry point ruleset",
+    "description": "This ruleset executes a Managed Ruleset.",
     "kind": "zone",
     "version": "2",
     "rules": [
diff --git a/products/firewall/src/content/images/cf-firewall-rules-panel.png b/products/firewall/src/content/images/cf-firewall-rules-panel.png
index 0a0d6f5c12f..bd635934495 100644
Binary files a/products/firewall/src/content/images/cf-firewall-rules-panel.png and b/products/firewall/src/content/images/cf-firewall-rules-panel.png differ
diff --git a/products/firewall/src/content/images/custom-rules/custom-rules-card.png b/products/firewall/src/content/images/custom-rules/custom-rules-card.png
deleted file mode 100644
index 9b90b91c489..00000000000
Binary files a/products/firewall/src/content/images/custom-rules/custom-rules-card.png and /dev/null differ
diff --git a/products/firewall/src/content/images/custom-rules/custom-rules-tab.png b/products/firewall/src/content/images/custom-rules/custom-rules-tab.png
index 5a2a88bac1c..edde35b2ea8 100644
Binary files a/products/firewall/src/content/images/custom-rules/custom-rules-tab.png and b/products/firewall/src/content/images/custom-rules/custom-rules-tab.png differ
diff --git a/products/firewall/src/content/images/custom-rules/firewall-custom-rule-create.png b/products/firewall/src/content/images/custom-rules/firewall-custom-rule-create.png
new file mode 100644
index 00000000000..b0377121126
Binary files /dev/null and b/products/firewall/src/content/images/custom-rules/firewall-custom-rule-create.png differ
diff --git a/products/firewall/src/content/images/custom-rules/rate-limiting-example.png b/products/firewall/src/content/images/custom-rules/rate-limiting-example.png
index fcb898659f8..a14c726cf8c 100644
Binary files a/products/firewall/src/content/images/custom-rules/rate-limiting-example.png and b/products/firewall/src/content/images/custom-rules/rate-limiting-example.png differ
diff --git a/products/firewall/src/content/images/firewall-rules-csr-hover.png b/products/firewall/src/content/images/firewall-rules-csr-hover.png
new file mode 100644
index 00000000000..da8e7490799
Binary files /dev/null and b/products/firewall/src/content/images/firewall-rules-csr-hover.png differ
diff --git a/products/firewall/src/content/images/firewall-rules-expressions-explained-1.png b/products/firewall/src/content/images/firewall-rules-expressions-explained-1.png
index 87b2e8f2f58..7264f37ade9 100644
Binary files a/products/firewall/src/content/images/firewall-rules-expressions-explained-1.png and b/products/firewall/src/content/images/firewall-rules-expressions-explained-1.png differ
diff --git a/products/firewall/src/content/images/firewall-rules-introduction-2.png b/products/firewall/src/content/images/firewall-rules-intro-exp-builder.png
similarity index 100%
rename from products/firewall/src/content/images/firewall-rules-introduction-2.png
rename to products/firewall/src/content/images/firewall-rules-intro-exp-builder.png
diff --git a/products/firewall/src/content/images/firewall-rules-introduction-3.png b/products/firewall/src/content/images/firewall-rules-intro-exp-editor.png
similarity index 100%
rename from products/firewall/src/content/images/firewall-rules-introduction-3.png
rename to products/firewall/src/content/images/firewall-rules-intro-exp-editor.png
diff --git a/products/firewall/src/content/images/firewall-rules-introduction-1.png b/products/firewall/src/content/images/firewall-rules-introduction-1.png
deleted file mode 100644
index 58006cb7f19..00000000000
Binary files a/products/firewall/src/content/images/firewall-rules-introduction-1.png and /dev/null differ
diff --git a/products/firewall/src/content/known-issues-and-faq/index.md b/products/firewall/src/content/known-issues-and-faq/index.md
index 03fad074f1f..ae6f14737f7 100644
--- a/products/firewall/src/content/known-issues-and-faq/index.md
+++ b/products/firewall/src/content/known-issues-and-faq/index.md
@@ -392,7 +392,7 @@ Your application can use these status codes to handle unexpected challenges.
 
 No. The `challengeFailed` and `jschallengeFailed` Firewall actions account for observed requests that, under special circumstances, did not pass a challenge. However, some failed challenges cannot be traced back to a Firewall rule. Additionally, the Firewall may not have a record of every request with a failed challenge.
 
-Therefore, consider these actions with caution. A reliable indicator is the CSR (Challenge Solve Rate) displayed in **Firewall Rules**, which is calculated as follows: `number of challenges solved / number of challenges issued`.
+Therefore, consider these actions with caution. A reliable indicator is the [CSR (Challenge Solve Rate)](/cf-firewall-rules#challenge-solve-rate-csr) displayed in **Firewall Rules**, which is calculated as follows: `number of challenges solved / number of challenges issued`.
 
 ## Why would I not see any failed challenges? Why is 'ChallengeIssued' not equal to 'ChallengeSolved' plus 'ChallengeFailed'?
 
diff --git a/products/fundamentals/docs-config.js b/products/fundamentals/docs-config.js
index 1ebe56e6016..04e3c529f00 100644
--- a/products/fundamentals/docs-config.js
+++ b/products/fundamentals/docs-config.js
@@ -20,10 +20,10 @@ module.exports = {
     algoliaOptions: { 'facetFilters': '["project:fundamentals"]'}
   },
   siteMetadata: {
-    title: "The Life of a Cloudflare Request docs",
-    description: "Undersea cables, peering agreements and TLS handshakes. Follow the life of a request across the internet and see how it all works.",
+    title: "Cloudflare Fundamentals",
+    description: "Cloudflare Fundamentals provides information about features that span Cloudflare products.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/fundamentals",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/fundamentals/src/content/_partials/_ddos.md b/products/fundamentals/src/content/_partials/_ddos.md
new file mode 100644
index 00000000000..0c880ba96f3
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_ddos.md
@@ -0,0 +1 @@
+No action needed. Refer to [Understanding Cloudflare DDoS alerts](https://support.cloudflare.com/hc/articles/360053216191) for more information.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_errors.md b/products/fundamentals/src/content/_partials/_errors.md
new file mode 100644
index 00000000000..6b0268c0a77
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_errors.md
@@ -0,0 +1 @@
+Refer to [Troubleshooting Cloudflare 5XX errors](https://support.cloudflare.com/hc/articles/115003011431) to learn how to troubleshoot these errors.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-caching.md b/products/fundamentals/src/content/_partials/_origin-caching.md
new file mode 100644
index 00000000000..ae8e1ab366f
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-caching.md
@@ -0,0 +1 @@
+The [cache](https://developers.cloudflare.com/cache/) stores data from your application (webpages, etc.) at Cloudflare data centers around the world, which reduces the number of requests sent to your origin server.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-ddos.md b/products/fundamentals/src/content/_partials/_origin-ddos.md
new file mode 100644
index 00000000000..45c69ac154c
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-ddos.md
@@ -0,0 +1 @@
+So long as your traffic is [proxied by Cloudflare](https://support.cloudflare.com/hc/articles/205177068), Cloudflare automatically protects your application from [DDoS attacks](https://support.cloudflare.com/hc/articles/200172676).
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-firewall-options.md b/products/fundamentals/src/content/_partials/_origin-firewall-options.md
new file mode 100644
index 00000000000..a169a5662d4
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-firewall-options.md
@@ -0,0 +1,6 @@
+Additionally, adjust various settings in your **Firewall** to restrict potentially malicious traffic:
+- Get automatic protection from common threats with our [Web Application Firewall](https://developers.cloudflare.com/waf/)
+- Set up customized [firewall rules](https://developers.cloudflare.com/firewall/cf-firewall-rules)
+- Enable [bot protection](https://developers.cloudflare.com/bots/get-started)
+- Block, challenge, or allow specific addresses with [IP access rules](https://support.cloudflare.com/hc/articles/217074967)
+- Create [rate limiting rules](https://support.cloudflare.com/hc/articles/115001635128) (usage-based billing) as a final defense against malicious traffic 
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-health-check.md b/products/fundamentals/src/content/_partials/_origin-health-check.md
new file mode 100644
index 00000000000..272c7fc555e
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-health-check.md
@@ -0,0 +1 @@
+For more active monitoring, set up [standalone health checks](https://support.cloudflare.com/hc/articles/4404867308429) for your origin. 
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-health-overview.md b/products/fundamentals/src/content/_partials/_origin-health-overview.md
new file mode 100644
index 00000000000..dcd981bfd7d
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-health-overview.md
@@ -0,0 +1,12 @@
+Your [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server) is a physical or virtual machine that is not owned by Cloudflare and hosts your application content (data, webpages, etc.).
+
+Receiving too many requests can be bad for your origin. These requests might increase latency for visitors, incur higher costs — particularly for cloud-based machines — and could knock your application offline.
+
+Select a plan to see how Cloudflare can help you protect your origin:
+
+<ButtonGroup>
+  <Button type="primary" href="/get-started/origin-health/free">Free</Button>
+  <Button type="primary" href="/get-started/origin-health/pro">Pro</Button>
+  <Button type="primary" href="/get-started/origin-health/business">Business</Button>
+  <Button type="primary" href="/get-started/origin-health/enterprise">Enterprise</Button>
+</ButtonGroup>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-lb-alert.md b/products/fundamentals/src/content/_partials/_origin-lb-alert.md
new file mode 100644
index 00000000000..61f3a767627
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-lb-alert.md
@@ -0,0 +1,6 @@
+<Aside type='note'>
+
+If you have multiple servers and want to proactively prevent origin problems, <a href="https://developers.cloudflare.com/load-balancing/about">set up load balancing</a> as an add-on service.
+
+</Aside>
+
diff --git a/products/fundamentals/src/content/_partials/_origin-load-balancing.md b/products/fundamentals/src/content/_partials/_origin-load-balancing.md
new file mode 100644
index 00000000000..7e4f2ed260a
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-load-balancing.md
@@ -0,0 +1 @@
+[Set up load balancing](https://developers.cloudflare.com/load-balancing/about) (add-on service) to spread traffic across multiple servers, reducing server strain and improving the experience for end users.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-passive-alert.md b/products/fundamentals/src/content/_partials/_origin-passive-alert.md
new file mode 100644
index 00000000000..b933bdf6761
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-passive-alert.md
@@ -0,0 +1 @@
+To receive an email when Cloudflare is unable to reach your origin, [create a notification](/notifications/configure-create/create-notifications) for **Passive Origin Monitoring**.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-secure-connections.md b/products/fundamentals/src/content/_partials/_origin-secure-connections.md
new file mode 100644
index 00000000000..989101f4f67
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-secure-connections.md
@@ -0,0 +1,7 @@
+When you secure origin connections, it prevents attackers from discovering and overloading your origin server with requests.
+
+- **DNS**: [Set up proxied (orange-clouded) DNS records](https://support.cloudflare.com/hc/articles/200169626) and [change your domain nameservers](https://support.cloudflare.com/hc/articles/205195708), which will also require that you [allow Cloudflare IP addresses](https://support.cloudflare.com/hc/articles/201897700) at your origin.
+- **SSL**: 
+    - To encrypt traffic between Cloudflare and your server, [choose Full (strict)](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes#strict) SSL/TLS mode (requires server configuration)
+    - To ensure requests originate from the Cloudflare network, [set up authenticated origin pulls](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull).
+- **Cloudflare Tunnel**: To encrypt all traffic and prevent any inbound connections to your origin, [set up a Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps).
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_origin-waiting-room.md b/products/fundamentals/src/content/_partials/_origin-waiting-room.md
new file mode 100644
index 00000000000..26eb70244bc
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_origin-waiting-room.md
@@ -0,0 +1 @@
+To protect specific endpoints from being overwhelmed by traffic spikes, [set up a waiting room](https://developers.cloudflare.com/waiting-room/about).
\ No newline at end of file
diff --git a/products/fundamentals/src/content/_partials/_troubleshoot-ssl.md b/products/fundamentals/src/content/_partials/_troubleshoot-ssl.md
new file mode 100644
index 00000000000..cc4ab8395df
--- /dev/null
+++ b/products/fundamentals/src/content/_partials/_troubleshoot-ssl.md
@@ -0,0 +1 @@
+You only need to take action if notified that you have a certificate that failed. You can find the reasons why a certificate is not being issued in [Troubleshooting SSL errors](https://support.cloudflare.com/hc/articles/200170566#h_c1a6e78e-150d-4db6-89ab-eec7cb1ab03f).
\ No newline at end of file
diff --git a/products/fundamentals/src/content/customizations/building-custom-dashboards/index.md b/products/fundamentals/src/content/customizations/building-custom-dashboards/index.md
index 8690599d0e7..8fcb50130ea 100644
--- a/products/fundamentals/src/content/customizations/building-custom-dashboards/index.md
+++ b/products/fundamentals/src/content/customizations/building-custom-dashboards/index.md
@@ -1,6 +1,6 @@
 ---
-title: Building custom views
 order: 10
+pcx-content-type: how-to
 ---
 
 # Building custom views
diff --git a/products/fundamentals/src/content/customizations/index.md b/products/fundamentals/src/content/customizations/index.md
index b0cceab49e0..3e316211ca7 100644
--- a/products/fundamentals/src/content/customizations/index.md
+++ b/products/fundamentals/src/content/customizations/index.md
@@ -1,6 +1,6 @@
 ---
-title: Customizations
-order: 1
+order: 2
+pcx-content-type: navigation
 ---
 
 # Customizations
diff --git a/products/fundamentals/src/content/data-products/accessing-cf-data/index.md b/products/fundamentals/src/content/data-products/accessing-cf-data/index.md
index 9e640c40af2..8895d63593c 100644
--- a/products/fundamentals/src/content/data-products/accessing-cf-data/index.md
+++ b/products/fundamentals/src/content/data-products/accessing-cf-data/index.md
@@ -1,6 +1,6 @@
 ---
-title: Accessing the data Cloudflare collects
 order: 12
+pcx-content-type: reference
 ---
 
 # Accessing the data Cloudflare collects
@@ -13,7 +13,7 @@ Access the following analytics from the Cloudflare Dashboard:
 
 * Zone Analytics - Analytics gathered by each Cloudflare product, which are available within the **Analytics** application and within individual product applications
   * **Analytics** application - Aggregated traffic, security, and performance metrics for each orange-clouded domain. Data available on the **Analytics** application includes:
-    * Traffic - Visits, Page views, Requests, and Data transfer
+    * Traffic - Requests, Data transfer, Page views, Visits, and [API requests](https://developers.cloudflare.com/api-security/products/api-discovery#api-requests)
     * Security - Total Threats, Top Crawlers/Bots, Rate Limiting, Total Threats Stopped
     * Performance - Origin Performance, Bandwidth Saved
     * DNS - DNS Queries by Response Code, Record Type, and Cloudflare Data Center
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/datadog/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/datadog/index.md
new file mode 100644
index 00000000000..183fdb6c9bc
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/datadog/index.md
@@ -0,0 +1,60 @@
+---
+order: 97
+pcx-content-type: interim
+---
+
+# Datadog
+
+This tutorial explains how to analyze Cloudflare metrics using the [Cloudflare Integration tile for Datadog](https://docs.datadoghq.com/integrations/cloudflare/).
+
+## Overview
+
+Before viewing the Cloudflare dashboard in Datadog, note that this integration:
+
+- Is available to all Cloudflare customer plans (Free, Pro, Business and Enterprise)
+- Is based on the [Cloudflare Analytics API](https://api.cloudflare.com/#zone-analytics-dashboard)
+- Provides Cloudflare web traffic and DNS metrics only
+- Does not feature data coming from request logs stored in Cloudflare Logs
+
+## Task 1 - Install the Cloudflare App
+
+To install the Cloudflare App for Datadog:
+
+1. Log in to **Datadog**.
+
+2. Click the **Integrations** tab.
+
+3. In the **search box**, start typing _Cloudflare_. The app tile should appear below the search box.
+   ![Datadog Integrations search for Cloudflare App](../../../static/images/datadog/screenshots/datadog-integrations.png)
+
+4. Click the **Cloudflare** tile to begin the installation.
+
+5. Next, click **Configuration** and then complete the following:
+
+   - **Account name**: (Optional) This can be any value. It has not impact on the site data pulled from Cloudflare.
+
+   - **Email**: This value helps keep your account safe. We recommend creating a dedicated Cloudflare user for analytics with the [_Analytics_ role](https://support.cloudflare.com/hc/articles/205065067#12345682) (read-only). Note that the _Analytics_ role is available to Enterprise customers only.
+
+   - **API Key**: Enter your Cloudflare Global API key.
+
+6. Click **Install Integration**.
+   ![Datadog configure and install integration](../../../static/images/datadog/screenshots/cloudflare-tile-datadog-fill-details.png)
+
+The Cloudflare App for Datadog should be installed now and you can view the dashboard.
+
+## Task 2 - View the dashboard
+
+By default, the dashboard displays metrics for all sites in your Cloudflare account. Use the dashboard filters see metrics for a specific domain.
+
+The dashboard displays the following metrics:
+
+- **Threats** (threats by type, threats by country)
+- **Requests** (total requests, cached requests, uncached requests, top countries by request, requests by IP class, top content types)
+- **Bandwidth** (total bandwidth, encrypted and unencrypted traffic cached bandwidth, uncached bandwidth)
+- **Caching** (Cache hit rate, request caching rate over time)
+- **HTTP response status errors**
+- **Page views**
+- **Search Engine Bot Traffic**
+- **DNS** (DNS queries, response time, top hostnames, queries by type, stale vs. uncached queries)
+
+![Cloudflare dashboard datadog](../../../static/images/datadog/dashboards/cloudflare-dashboard-datadog.png)
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/elastic/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/elastic/index.md
new file mode 100644
index 00000000000..15a17582af5
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/elastic/index.md
@@ -0,0 +1,274 @@
+---
+order: 99
+pcx-content-type: interim
+---
+
+# Elastic
+
+This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using Elastic and Kibana.
+
+## Overview
+
+If you have not used Cloudflare Logs before, refer to the [Logs documentation](https://developers.cloudflare.com/logs) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
+
+### Prerequisites
+
+Before sending your Cloudflare log data to Elastic, make sure that you:
+
+- Have an existing Elastic instance (versions 6.x and 7.x supported)
+- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
+- Configure [Logpush](https://developers.cloudflare.com/logs/about) or [Logpull](https://developers.cloudflare.com/logs/logpull)
+
+<Aside type="note" header="Note">
+
+Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Elastic.
+</Aside>
+
+## Task 1 - Preparation
+
+Before getting Cloudflare logs into Elastic:
+
+1. Install an AWS Lambda function, available in the file _cloudflare-elastic-lambda.zip_ from GitHub at this location: [https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.3-7.x](https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.3-7.x).
+
+2. Upload the _cloudflare-elastic-lambda.zip_ file to an S3 bucket.
+
+   ![Amazon S3 bucket](../../../static/images/elastic/screenshots/cloudflare-elastic-lambda-zip-s3-bucket.png)
+
+## Task 2 - Create Elasticsearch deployment on Elastic Cloud
+
+1. Create an account on [Elastic Cloud](https://cloud.elastic.co) and log in.
+
+2. Once logged in, create a new deployment where the Cloudflare logs will reside.
+   ![Create your first deployment](../../../static/images/elastic/screenshots/create-your-first-deployment.png)
+
+3. Configure your new deployment with the following parameters:
+
+   - **Name**: _cloudflare-elastic-logs_
+
+   - **Cloud provider**: _Amazon Web Services_ or _Google Cloud Platform_
+
+   - **Region**: Geographical region in which to host the deployment
+
+   - **Version**: Choose version _6.x_ or _7.x_
+
+   - **Template**: Choose _Hot-Warm Architecture_ (recommended) or _I/O Optimize_
+     ![Create Elastic deployment part 1](../../../static/images/elastic/screenshots/create-elastic-deployment-hot-warm-architecture.png)
+
+4. Click **Customize Deployment**. On this page, you can set your Elasticsearch cluster memory and storage.
+
+   - **I/O Optimized Template Configuration**
+     For this options, we recommend configuring your cluster to have 2 availability zones and 8 GB of RAM.
+
+   - **Hot-Warm Template Configuration**
+     For this option, we recommend configuring your cluster as:
+
+     - _Hot Zone_: 2 availability zones, 8 GB RAM
+
+     - _Warm Zone_: 2 availability zones, 8 GB RAM
+
+     ![Create Elastic deployment part 2](../../../static/images/elastic/screenshots/configure-hot-and-warm-elastic-8gb-ram.png)
+     In a hot-warm template, the system will automatically manage the data lifecycle for you by migrating old data to less expensive storage. To configure this, click **Configure index management**.
+
+5. Add an index pattern for `cloudflare-*` and set it to migrate data off the hot zone after 7 days.
+   ![Create Elastic deployment part 3](../../../static/images/elastic/screenshots/index-curation-add-cloudflare.png)
+
+6. You are now ready to create your Elastic deployment. Click **Create deployment**. The page will refresh with details of your new cluster. It is important to save the randomly generated password (see screenshot). All Elastic deployments are secure by default and are bootstrapped with a randomly generated password for the **Elastic** user. You will use this password to log in to view your Cloudflare logs.
+
+![Elastic generated user details](../../../static/images/elastic/screenshots/generated-user-details-elastic-deployment.png)
+
+## Task 3 - Configure the deployment
+
+Next, to configure your deployment:
+
+1.  From [https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.1](https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.1) download the following files:
+
+    - _cloudflare-index-template.json_
+
+    - _cloudflare-ingest-pipeline-daily.json_
+
+    - _cloudflare-ingest-pipeline-weekly.json_
+
+    - _install-artifacts.sh_
+
+    - _dashboards.json_
+
+2.  Using the Elasticsearch endpoint for your new deployment (found on the main page), run the following command from a terminal, using the random password from above.
+
+        ./install-artifacts.sh -u elastic -p <RANDOM PASSWORD> -e https://_<YOUR DEPLOYMENT ENDPOINT>_:9243
+
+3.  To install the Cloudflare dashboards, log in to the Kibana user interface using the **elastic** username and the randomly generated password.
+
+4.  Navigate to **Management** > **Kibana** > **Saved Objects**.
+
+5.  Upload _dashboards.json_ by clicking the **Import** link.
+
+![Elastic Kibana saved objects import](../../../static/images/elastic/screenshots/kibana-saved-objects-import-dashboards.png)
+
+## Task 4 - Create the Lambda function in AWS
+
+To create the Lambda function:
+
+1. Install the function: create the Lambda, which will read Cloudflare logs from S3 and import them into your Elastic cluster.
+
+2. Log in to your AWS console and navigate to the Lambda section. Create a new function, using the Java 8 runtime and give it a name such as _cloudflare-elastic-logs_.
+
+3. Configure the handler as `com.cloudflare.elastic.ElasticLambdaForwarder::handleRequest` and upload the function that we had previously saved to our S3 bucket.
+   ![Elastic function code lambda](../../../static/images/elastic/screenshots/function-code-lambda.png)
+
+4. Configure the function. The Lambda function requires the following environment variables:
+
+   - **elastic_hostname**: Copy the Elasticsearch endpoint URL from your deployment. Remove the port number and https:// prefix; for example: `2202aa790db546268248a5bd1e35aea6.us-west1.gcp.cloud.es.io`.
+
+   - **elastic_username**: Enter _elastic_.
+
+   - **elastic_password**: Use the randomly generated password that was created for you.
+     ![Elastic Lambda environment variables](../../../static/images/elastic/screenshots/environment-variables-lambda-cloudflare.png)
+
+5. To connect your Cloudflare S3 log bucket. the last step is to tell the Lambda function to listen for events on the S3 bucket where your Cloudflare logs reside. Choose the S3 trigger type and configure it with the name of the S3 bucket. For **Event type**, select _All object create events_.
+
+6. Ensure your execution role is configured. In order for the function to be able to read logs from the S3 bucket, you may have to configure the execution role.
+   ![Elastic Lambda execution role](../../../static/images/elastic/screenshots/execution-role-aws.png)
+
+7. View the execution role and add an inline policy that enables the function to read from the bucket.
+   ![Elastic AWS S3 bucket actions](../../../static/images/elastic/screenshots/s3-bucket-actions.png)
+
+8. Give the policy a name and save it.
+
+9. Save the Lambda and start logging.
+
+10. Finally, save the Lambda configuration. Once it is saved, the Cloudflare logs will start showing up in Kibana on your Elastic Cloud deployment.
+
+## Task 5 - View the Dashboards in Kibana
+
+Once Successfully imported, you can find all Cloudflare dashboards under **Kibana** > **Dashboard**.
+
+### About the dashboards
+
+There are nine dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more. Filtering can further help you with debugging and tracing.
+
+#### Snapshot
+
+This is a quick overview of the most important metrics from your Cloudflare Logs, including the total number of requests, top visitors by geography, IP, user agent, traffic type, the total number of threats, and bandwidth usage.
+![Cloudflare dashboard - snapshot](../../../static/images/elastic/dashboards/elastic-snapshot.png)
+
+#### Security
+
+_Cloudflare - Security (Overview)_ - Get insights on threats to your websites and applications, including the number of threats stopped, threats over time, top threat countries, and more.
+![Cloudflare dashboard - security overview](../../../static/images/elastic/dashboards/elastic-security.png)
+
+_Cloudflare - Security (WAF)_ - Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
+![Cloudflare dashboard - security WAF](../../../static/images/elastic/dashboards/elastic-security-waf.png)
+
+_Cloudflare - Security (Rate Limiting)_ - Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
+![Cloudflare dashboard - security rate limiting](../../../static/images/elastic/dashboards/elastic-security-rate-limiting.png)
+
+_Cloudflare - Security (Bot Management)_ - Reliably detects and mitigates bad bots to prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities.
+![Cloudflare dashboard - bot management](../../../static/images/elastic/dashboards/elastic-bot-management.png)
+
+#### Performance
+
+_Cloudflare - Performance (Requests, Bandwidth, Cache)_ - Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
+![Cloudflare dashboard - performance (requests, bandwidth, cache)](../../../static/images/elastic/dashboards/elastic-performance.png)
+
+_Cloudflare - Performance (Hostname, Content Type, Request Methods, Connection Type)_ - Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
+![Cloudflare dashboard - performance (hostname, content type, request methods, connection type)](../../../static/images/elastic/dashboards/elastic-origin-requests-by-hostname-type.png)
+
+_Cloudflare - Performance (Static vs. Dynamic Content)_ - Get insights into the performance of your static and dynamic content, including slowest URLs.
+![Cloudflare dashboard - performance (static vs. dynamic content)](../../../static/images/elastic/dashboards/elastic-performance-static-vs-dynamic-content.png)
+
+#### Reliability
+
+Get insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+![Cloudflare dashboard - reliability](../../../static/images/elastic/dashboards/elastic-reliability.png)
+
+### Filters
+
+All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. Filters are applied across the entire dashboard.
+
+![Cloudflare dashboard filters](../../../static/images/elastic/screenshots/cloudflare-dashboards-filters-elastic-kibana.png)
+
+<Aside type="note" header="Note">
+
+You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
+</Aside>
+
+The default time interval is set to 24 hours. Note that for correct calculations filter will need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
+
+#### Available Filters
+
+- Date (EdgeStartTimestamp)
+
+- Device Type
+
+- Country
+
+- Hostname
+
+- Client IP
+
+- User Agent
+
+- Request URI
+
+- Edge Response Status
+
+- Origin Response Status
+
+- Origin IP
+
+- RayID
+
+- Worker Subrequest
+
+- Client Request Method
+
+## Debugging tips
+
+### Debug the AWS Lambda function
+
+#### Review the Lambda function logs in AWS
+
+If you detect issues with your AWS Lambda function in Elastic, you can review the AWS CloudWatch logs that are generated automatically for tht specific Lambda function.
+
+To begin, in AWS:
+
+1. Go to **Lambda** > **Functions** > _\<your Lambda function\>_.
+2. Click the **Monitoring** tab.
+3. Click **View logs in CloudWatch**.
+
+![AWS Lambda function monitoring](../../../static/images/elastic/screenshots/aws-lambda-monitoring.png)
+
+A list of log streams generated by the Lambda function (see image below) appears. Each stream contains log messages. However, some log streams will either be empty or not contain any useful information. You might need to review several of them.
+
+![AWS Lambda log streams](../../../static/images/elastic/screenshots/aws-lambda-log-streams.png)
+
+When you click to review a stream, you want to look for messages starting with the the text _Connected to cluster:_ and ending with _status: [GREEN]_ as shown in the image below.
+
+![AWS Lambda log stream messages](../../../static/images/elastic/screenshots/aws-lambda-log-streams-messages.png)
+
+If you see _status: [RED]_, then your cluster isn’t healthy and it’s likely that your Cloudflare logs won’t appear. If this is the case, review how to debug in Kibana (see below).
+
+It is important to verify the return status of the call to Elasticsearch. Lines starting with _Flushing [N] logs to elasticsearch_ and followed by a response line indicate that everything is working as expected.
+
+<Aside type="note" header="Note">
+
+You might see a _WARNING_ message containing text that says _‘y’ year should be replaced…_. You can ignore this message.
+</Aside>
+
+If you run into any other issues, take note of the exact return message and contact your Cloudflare support team.
+
+#### Review the AWS Lambda function health status from the Kibana console in Elastic Cloud
+
+To analyze the health status of the Lambda function from Kibana:
+
+1. From Elastic Cloud, launch the Kibana console.
+   ![Elastic Cloud console](../../../static/images/elastic/screenshots/elastic-cloud-console.png)
+2. Find the **Dev Tools** app on the left navigation bar.
+3. Under the **Console** tab, type the following into the left pane: _GET \_cat/indices?v&s=index_.
+4. In the right pane, you should see a table of indices with the column headings: **health status index**, **uuid**, **pri**, **rep**, **docs.count**, **docs.deleted**, **store.size**, and **pri.store.size**.
+
+![Elastic Kibana Dev Tools console 1](../../../static/images/elastic/screenshots/elastic-kibana-dev-tools-console-1.png)
+
+The first column should read _green_. If it does not, or if there are no _cloudflare-&lt;DATE>_ indices, then there is a problem loading the logs from the AWS Lambda function.
+
+![Elastic Kibana Dev Tools console 2](../../../static/images/elastic/screenshots/elastic-kibana-dev-tools-console-2.png)
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/google-cloud/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/google-cloud/index.md
new file mode 100644
index 00000000000..b76baa52725
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/google-cloud/index.md
@@ -0,0 +1,360 @@
+---
+title: Google Cloud
+order: 100
+---
+
+# Google Cloud
+
+## Overview
+
+This tutorial covers how to configure certain Google Cloud Platform (GCP) components so that you can analyze your Cloudflare Logs data.
+
+Before proceeding, you need to enable [Cloudflare Logpush in Google Cloud Storage](https://developers.cloudflare.com/logs/get-started/enable-destinations/google-cloud-storage) to ensure your log data is available for analyzing.
+
+The components we'll use in this tutorial include:
+
+- **Google Cloud Function** to import logs from Google Cloud Storage to Google BigQuery
+- **Google BigQuery** to make log data available to the reporting engine, and
+- **Google Data Studio** to run interactive reports
+
+The following diagram depicts how data flows from Cloudflare Logs through the different components of the Google Cloud Platform discussed in this tutorial.
+
+![Cloudflare Logpush to Google Cloud Platform](../../../static/images/google/cf-logpush-to-google-cloud-platform.png)
+
+<Aside type="info" header="Info">
+
+Google Cloud is offering a credit towards a new Google Cloud account to help you get started. To learn more, visit [Google Cloud Platform Partner Credit](https://cloud.google.com/partners/partnercredit/?PCN=a0n60000003kp9MAAQ).
+</Aside>
+
+## Task 1 - Use Google Cloud Function to import log data into Google BigQuery
+
+After you configured Cloudflare Logpush to send your logs to a Google Cloud Storage bucket, your log data updates every five minutes by default.
+
+Google BigQuery makes data available for both querying using Structured Query Language (SQL) and for configuring as a data source for the Google Data Studio reporting engine. BigQuery is a highly scalable cloud database where SQL queries run quite fast.
+
+Importing data from Google Cloud Storage into Google BigQuery requires creating a function using Google Cloud Function and running it in the Google Cloud Shell. This function triggers every time new Cloudflare log data is uploaded to your Google Cloud Storage bucket.
+
+### Clone and deploy a Google Cloud Function
+
+To a create a cloud function to import data from Google Cloud Storage into Google BigQuery, you will need the following GitHub repository from Cloudflare: https://github.com/cloudflare/GCS-To-Big-Query.
+
+To clone and deploy the cloud function:
+
+1. Run the Google Cloud Platform shell by opening the **Google Cloud Platform** console and clicking the **Google Shell** icon (_Activate Cloud Shell_).
+
+2. Run the following command to download the _master_ zipped archive, uncompress the files to new a directory, and change the command line prompt to the new directory: `curl -LO "https://github.com/cloudflare/cloudflare-gcp/archive/master.zip" && unzip master.zip && cd cloudflare-gcp-master/logpush-to-bigquery`
+
+3. Next, edit the `deploy.sh` file and make sure that:
+
+- **BUCKET_NAME** is set to the bucket you created when you configured Cloudflare Logpush with Google Cloud Platform.
+
+- **DATASET** and **TABLE** are unique names.
+
+  The contents of `deploy.sh` should look similar to this:
+
+  ```bash
+  .
+  .
+  .
+  BUCKET_NAME="my_cloudflarelogs_gcp_storage_bucket"
+  DATASET="my_cloudflare_logs"
+  TABLE="cloudflare_logs"
+  .
+  .
+  .
+  ```
+
+4. Then in the **Google Shell**, run the following command to deploy your instance of the cloud function:
+
+    ```bash
+    sh ./deploy.sh
+    ```
+
+Once you've deployed your new cloud function, verify that it appears in the **Cloud Functions** interface by navigating to **Google Cloud Platform** > **Compute** > **Cloud Functions**.
+
+Also, verify that the data now appears in your table in **BigQuery** by navigating to the appropriate project in **Google Cloud Platform** > **Big Data** > **BigQuery**.
+
+If everything is configured correctly, you can now query any request or visualize data with Google Data Studio or any other analytics tool that supports BigQuery as an input source.
+
+### Add fields in Google Cloud Function
+
+To add fields in Cloud Function, edit the `schema.json` file.
+
+1. Open Google Cloud Function.
+
+2. Select the function you want to update.
+
+3. Click **EDIT** on the Function details page.
+
+4. Select `schema.json` from the list of files.
+
+5. In the file editor, enter the `name`, `type`, and `mode` of any fields you would like to add. Follow the format shown in the file.
+
+6. Click **Deploy**.
+
+To debug in Cloud Function, click **VIEW LOGS** on the Function details page. This will take you to the Logs Viewer, where any errors will appear.
+
+### Add fields in BigQuery
+
+To add fields in BigQuery, edit the schema.
+
+1. Open BigQuery.
+
+2. In the menu, expand **your-project-name**.
+
+3. Expand **cloudflare_data** and click **cf_analytics_logs**.
+
+4. Select the **Schema** tab.
+
+5. Scroll to the bottom of the page, and click **Edit schema**.
+
+6. On the pop-up page, click **Add field**. Enter the field **Name** and select the field **Type** and **Mode** from the dropdowns.
+
+7. Click **Save**.
+
+## Task 2 - Analyze log data with Google Data Studio
+
+To analyze and visualize logs, you can use **Google Data Studio** or any other 3rd party services that supports Google BigQuery as an input source.
+
+With Google Data Studio, you can generate graphs and charts from a Google BigQuery table. You can also refresh the data in your reports and get real-time analytics.
+
+### About the Cloudflare Logs Insights Template
+
+Cloudflare has published a [Logs Insights Template](https://datastudio.google.com/u/0/reporting/1ez3m7Yf8AZLfM6aYRjfgF0pPpRvOwhTh/page/mAzI/preview) in the **Google Data Studio Report Gallery**.
+
+![Cloudflare Logs Insights Template on Google Data Studio Gallery](../../../static/images/cf-logs-insights-template.png)
+
+The Cloudflare Insights Template features several dashboards, or report pages, to help you analyze your Cloudflare Logs data. You can also use filters within the dashboards to narrow down the analysis by date and time, device type, country, user agent, client IP, hostname, and more. These insights further help with debugging and tracing.
+
+The following dashboards are included in the Insights template:
+
+- **Snapshot**: Gives you an overview of the most important metrics from your Cloudflare logs, including total number of requests, top visitors by geography, IP, user agent, traffic type, total number of threats, and bandwidth usage.
+
+- **Security**: Provides insights on threat identification and mitigations by our **Web Application Firewall**, including **Firewall Rules**, **Rate Limiting**, and **IP Firewall**. Metrics include total threats stopped, threat traffic source, blocked IPs and user agents, top threat requests, Firewall events (SQL injections, XSS, etc.), and rate limiting. Use this data to fine tune the firewall to target obvious threats and avoid false positives.
+
+- **Performance**: Helps you identify and address issues like slow pages and caching misconfigurations. Metrics include total vs. cached bandwidth, cache ratio, top uncached requests, static vs. dynamic content, slowest URIs, and more.
+
+- **Reliability**: Provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+
+### Create a report based on the Insights Template
+
+To create a report for your log data based on the Cloudflare template:
+
+1. In Data Studio, open the Cloudflare [template](https://datastudio.google.com/u/0/reporting/1ez3m7Yf8AZLfM6aYRjfgF0pPpRvOwhTh/page/mAzI/preview) and click **Use Template**. A _Create new report_ dialog opens.
+
+2. Under the **New Data Source** dropdown, select **Create New Data Source**. A page opens where you can enter additional configuration details.
+
+3. Under **Google Connectors**, locate the **BigQuery** card and click **Select**.
+
+4. Next under **MY PROJECTS**, select your **Project**, **Dataset**, and **Table**.
+
+5. Click **Connect** in the upper right.
+
+6. In the list of Cloudflare Logs fields, locate _EdgeStartTimestamp_, click the three vertical dots and select **Duplicate**. This creates _Copy of EdgeStartTimestamp_ right below _EdgeStartTimestamp_.
+
+7. Update the **Type** for _Copy of EdgeStartTimestamp_ to set it to _Date & Time_ > _Date Hour (YYYYMMDDHH)_.
+
+8. Next, update the **Type** for each of the following fields as indicated below:
+
+<table style="border: solid 2px darkgrey; width: 100%;">
+    <thead style="background: #ffeadf;">
+        <tr>
+            <th>Cloudflare Log Field</th>
+            <th>Type</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>ZoneID</td>
+            <td>Text</td>
+        </tr>
+        <tr>
+            <td>EdgeColoID</td>
+            <td>Text</td>
+        </tr>
+        <tr>
+            <td>ClientSrcPort</td>
+            <td>Text</td>
+        </tr>
+        <tr>
+            <td>EdgeResponseStatus</td>
+            <td>Number</td>
+        </tr>
+        <tr>
+            <td>EdgeRateLimitID</td>
+            <td>Text&nbsp;</td>
+        </tr>
+        <tr>
+            <td>
+                <div>
+                    <div>Copy of EdgeStartTimestamp</div>
+                </div>
+            </td>
+            <td>Date &amp; Time &gt; Date Hour (YYYYMMDDHH)</td>
+        </tr>
+        <tr>
+            <td>OriginResponseStatus</td>
+            <td>Number</td>
+        </tr>
+        <tr>
+            <td>ClientASN</td>
+            <td>Text</td>
+        </tr>
+        <tr>
+            <td>ClientCountry</td>
+            <td>Geo &gt; Country</td>
+        </tr>
+        <tr>
+            <td>CacheResponseStatus</td>
+            <td>Text</td>
+        </tr>
+    </tbody>
+</table>
+
+9. Next, add a new field to identify and calculate threat. In the top right corner, click **+ ADD A FIELD**, then in the add field UI:
+   _ For **Field Name**, type *Threats*.
+   _ In the **Formula** text box, paste the following code:
+
+   ```bash
+   CASE
+   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ip" THEN "ip block"
+   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ctry" THEN "country block"
+   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "zl" THEN "routed by zone lockdown"
+    WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ua" THEN "blocked user agent"
+   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "rateLimit" THEN "rate-limiting rule"
+    WHEN EdgePathingSrc = "bic" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "browser integrity check"
+   WHEN EdgePathingSrc = "hot" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "blocked hotlink"
+   WHEN EdgePathingSrc = "macro" AND EdgePathingOp = "chl" AND EdgePathingStatus = "captchaFail" THEN "CAPTCHA challenge failed"
+   WHEN EdgePathingSrc = "macro" AND EdgePathingOp = "chl" AND EdgePathingStatus = "jschlFail" THEN "java script challenge failed"
+   WHEN EdgePathingSrc = "filterBasedFirewall" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "blocked by filter based firewall"
+   WHEN EdgePathingSrc = "filterBasedFirewall" AND EdgePathingOp = "chl" THEN "challenged by filter based firewall"
+   Else "Other"
+   END
+   ```
+   \* Click **Save** in the lower right corner.
+
+10. Finally, add another new field for grouping status error codes. In the top right corner, click **+ ADD A FIELD**, then in the add field UI:
+    _ For **Field Name**, type *EdgeResponseStatus_Class*.
+    _ In the **Formula** text box, paste the following code:
+
+    ```bash
+    CASE
+    WHEN EdgeResponseStatus > 199 AND EdgeResponseStatus < 300 THEN "2xx"
+    WHEN EdgeResponseStatus > 299 AND EdgeResponseStatus < 400 THEN "3xx"
+    WHEN EdgeResponseStatus > 399 AND EdgeResponseStatus < 500 THEN "4xx"
+    WHEN EdgeResponseStatus > 499 AND EdgeResponseStatus < 600 THEN "5xx"
+    WHEN EdgeResponseStatus = 0 THEN "0 - Served from CF Edge"
+    Else "Other"
+    END
+    ```
+
+- Click **Save** in the lower right corner.
+
+11. To finish, click **Add to Report** in the upper right.
+
+### Refreshing fields and filters manually
+
+After you've added your report, you will notice that not all report components render successfully. To fix this, you need to resolve any errors related to invalid dimensions, metrics, or filters that appear in the affected report components.
+
+#### Update Data Studio with new fields
+
+To update Data Studio with fields added to BigQuery, refresh fields for the data source.
+
+1. In Data Studio, open the Cloudflare dashboard in **Edit** mode.
+
+2. Expand the **Resource** menu and select **Manage added data sources**.
+
+3. Click the **EDIT** action for the data source that you want to update.
+
+4. Click **REFRESH FIELDS** below the table. A window with **Field changes found** in BigQuery will pop up.
+
+5. To add the new fields, click **APPLY**.
+
+You can also create custom fields directly in Data Studio.
+
+1. In Data Studio, open the Cloudflare dashboard in **Edit** mode.
+
+2. Expand the **Resource** menu and select **Manage added data sources**.
+
+3. Click the **EDIT** action for the data source that you want to add a custom field to.
+
+4. Click **ADD A FIELD** above the table.
+
+5. Enter a formula in the **Formula** editor.
+
+6. Click **SAVE**.
+
+#### Fix invalid metric or dimension errors
+
+The following table summarizes which specific components require to be fixed:
+
+<table style="border: solid 2px darkgrey; width: 100%;">
+<thead style="background: #ffeadf;">
+<tr>
+<th>Report page</th>
+<th>Components</th>
+<th>Field to add</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td rowspan="3">2 Security Cloudflare&nbsp;</td>
+<td>
+<p><em>Threats </em>(scorecard)</p>
+</td>
+<td>&nbsp;Threats (Metric)</td>
+</tr>
+<tr>
+<td>
+<p><em>Threats - Record Count (table)</em></p>
+</td>
+<td>&nbsp;Threats (Dimension)</td>
+</tr>
+<tr>
+<td>&nbsp;<em>Threats Over Time&nbsp;</em>(area chart)</td>
+<td>&nbsp;Threats (Breadown Dimension)</td>
+</tr>
+<tr>
+<td>3 Reliability Cloudflare</td>
+<td><em>Status Codes Last 24 hours&nbsp;</em>(bar chart)</td>
+<td><em>Copy of EdgeStartTimeStamp&nbsp;</em>(Dimension)</td>
+</tr>
+<tr>
+<td>5&nbsp;Last 100s Requests Cloudflare</td>
+<td><em>Last 100 Requests</em> (table)</td>
+<td>&nbsp;<em>Copy of EdgeStartTimeStamp</em></td>
+</tr>
+</tbody>
+</table>
+
+For each of the report components listed above:
+
+1. Select the report component affected.
+
+2. On the menu to the right, under the **Data** tab, locate and click **Invalid Dimension** or **Invalid Metric** (as applicable). The **Field Picker** panel opens.
+
+3. Search or type for the field to add, then click to select it.
+
+4. To finish, click away from the panel to return to the main report.
+
+The component should now render correctly.
+
+#### Update data filters
+
+This fix applies to report page: **3 Reliability Cloudflare**, for the following scorecard components in the report:
+
+- **5xx Errors**
+- **4xx Errors**
+- **3xx Errors**
+
+To update the filter associated with each scorecard:
+
+1. Select the report component affected.
+
+2. On the menu to the right, under the **Data** tab, locate the **Filters** > **Scorecard Filter** section and click the **pencil** next to the filter name to edit it. The **Edit Filter** panel opens.
+
+3. In the filtering criteria section, click the dropdown and scroll or search for the field _EdgeResponseStatusClass_ and select it.
+
+4. To finish, click **Save** in the lower right corner.
+
+The component should now render correctly.
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/graylog/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/graylog/index.md
new file mode 100644
index 00000000000..6f158999003
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/graylog/index.md
@@ -0,0 +1,199 @@
+---
+order: 101
+pcx-content-type: interim
+---
+
+# Graylog
+
+This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using [Graylog](https://github.com/Graylog2/graylog-s3-lambda/blob/master/content-packs/cloudflare/cloudflare-logpush-content-pack.json).
+
+## Overview
+
+If you haven't used Cloudflare Logs before, visit our [Logs documentation](https://developers.cloudflare.com/logs) for
+more details. Contact your Cloudflare Customer Account Team to enable logs for
+your account.
+
+### Prerequisites
+
+Before sending your Cloudflare log data to Graylog, make sure that you:
+
+- Have an existing Graylog installation. Both single-node and cluster configurations are supported
+- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
+- Configure [Logpush](https://developers.cloudflare.com/logs/about)
+
+<Aside type="note" header="Note">
+
+Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. All timestamp formats are supported by Graylog.
+</Aside>
+
+## Task 1 - Preparation
+
+Before getting Cloudflare logs into Graylog:
+
+1. Configure Cloudflare [Logpush](https://developers.cloudflare.com/logs/about/) to push logs with all desired fields to an AWS S3 bucket of your choice.
+2. Download the latest [Graylog Integration for Cloudflare](https://github.com/Graylog2/graylog-s3-lambda/blob/master/content-packs/cloudflare/cloudflare-logpush-content-pack.json).
+3. Decompress the zip file.
+
+Once decompressed, the integration package includes:
+
+- _graylog-s3-lambda.jar_
+- _content-packs/cloudflare/cloudflare-logpush-content-pack.json_
+- _content-packs/cloudflare/threat-lookup.csv_
+
+## Task 2 - Create and configure the AWS Lambda Function
+
+1.  Navigate to the Lambda service page in the AWS web console.
+2.  Create a new Lambda function and specify a _function name_ of your choice and the _Java-8 runtime_.
+3.  Create or specify an execution role with the following permissions. You can also further restrict the resource permissions as desired for your specific set-up.
+
+```bash
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "Policy",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogGroup"
+        "s3:GetObject",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": [
+        "arn:aws:logs:your-region:your-account-number:*"
+        "arn:aws:s3:your-region::cloudflare-bucket-name/*"
+      ]
+    }
+  ]
+}
+```
+
+    **Note:** If your Graylog cluster is running in a VPC, you may need to add the _AWSLambdaVPCAccessExecutionRole_ managed role to allow the Lambda function to route traffic to the VPC.
+
+4.  Once you've created the Lambda function, upload the function code **_graylog-s3-lambda.jar_** downloaded in [Task 1](#task1).  Specify the following method for the Handler: _org.graylog.integrations.s3.GraylogS3Function::handleRequest_.
+
+5.  Specify at least the following required environment variables to configure the Lambda function for your Graylog cluster:
+
+    - **CONTENT_TYPE** (required) - _application/x.cloudflare.log_ value to indicate that the Lambda function will process Cloudflare logs.
+    - **COMPRESSION_TYPE** **_(required_** **)** - _gzip_ since Cloudflare logs are gzip compressed.
+    - **GRAYLOG_HOST** _(required)_ - hostname or IP address of the Graylog host or cluster load balancer.
+    - **GRAYLOG_PORT** _(optional - defaults to 12201)_ - The Graylog service port.
+    - **CONNECT_TIMEOUT** _(optional - defaults to 10000)_ - The number of milliseconds to wait for the connection to be established.
+    - **LOG_LEVEL** _(optional - defaults to INFO)_ - The level of detail to include in the CloudWatch logs generated from the Lambda function. Supported values are _OFF_, _ERROR_, _WARN_, _INFO_, _DEBUG_, _TRACE_, and _ALL_. Increase the logging level to help with troubleshooting. See [Defining Custom Log Levels in Code](https://logging.apache.org/log4j/2.0/manual/customloglevels.html) for more information.
+    - **CLOUDFLARE_LOGPUSH_MESSAGE_FIELDS** _(optional - defaults to all)_ - The fields to parse from the message. Specify as a comma-separated list of field names.
+    - **CLOUDFLARE_LOGPUSH_MESSAGE_SUMMARY_FIELDS** _(optional - defaults to ClientRequestHost, ClientRequestPath, OriginIP, ClientSrcPort, EdgeServerIP, EdgeResponseBytes)_ - The fields to include in the message summary that appears above the parsed fields at the top of each message in Graylog. Specify as a comma-separated list of field names.
+      ![Graylog environment variables](../../../static/images/graylog/screenshots/graylog-environment-variables.png)
+
+      **Note:** More configuration variables are available to fine-tune the function configuration in the Graylog Lambda S3 [README](https://github.com/Graylog2/graylog-s3-lambda/blob/master/README.md#step-2-specify-configuration) file.
+
+6.  Create an AWS S3 Trigger for the Lambda function so that the function can process each Cloudflare log field that is written. Specify the same S3 bucket from [Task 1](#task1) and choose the _All object create events_ option. Any other desired file filters can be applied here.
+    ![AWS S3 add trigger](../../../static/images/graylog/screenshots/aws-s3-add-trigger.png)
+
+7.  If your Graylog cluster is located within a VPC, you will need to [configure your Lambda function to access resources in a VPC](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html). You may also need to create a [VPC endpoint for the AWS S3 service](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html#create-vpc-endpoint). This allows the Lambda function to access S3 directly when running in a VPC.
+
+<Aside type="note" header="Note">
+
+By default, all log messages are sent over TCPt. TLS encryption between the
+Lambda function and Graylog is not currently supported. We recommend taking
+appropriate measures to secure the log messages in transit, such as placing
+the Lambda function within a secure VPC subnet where the Graylog node or
+cluster is running.
+</Aside>
+
+## Task 3 - Import the content pack in Graylog
+
+Importing the Cloudflare Logpush content pack into Graylog loads the
+necessary configuration to receive Cloudflare logs and installs the
+Cloudflare dashboards.
+
+The following components install with the content pack:
+
+- Cloudflare dashboards ([Task 4](#task4)).
+- A Cloudflare GELF (TCP) input that allows Graylog to receive Cloudflare logs.
+- A Cloudflare message [stream](https://docs.graylog.org/en/3.1/pages/streams.html).
+- [Pipeline](https://docs.graylog.org/en/3.1/pages/pipelines/pipelines.html) rules that help to process and parse Cloudflare log fields.
+
+To import the content pack:
+
+1.  Locate the _cloudflare-logpush-content-pack.json_ file that you downloaded and extracted in [Task 1](#task1).
+2.  In Graylog, go to **System** > **Content Packs** and click **Upload**in the top right. Once uploaded, the Cloudflare Logpush content pack will appear in the list of uploaded content packs.
+    ![Graylog content packs](../../../static/images/graylog/screenshots/graylog-content-packs.png)
+3.  Click **Install**.
+    ![Graylog content packs uploaded](../../../static/images/graylog/screenshots/graylog-content-packs-uploaded.png)
+4.  In the **Install** dialog, enter an optional install comment, and verify that the correct values are entered for all configuration parameters.
+
+    - A path is required for the MaxMind™️ database, available at [https://dev.maxmind.com/geoip/](https://dev.maxmind.com/geoip/).
+    - A path is also required for the _Threat Lookup_ CSV file, extracted in [Task 1](#task1).
+
+    ![Graylog content pack install](../../../static/images/graylog/screenshots/graylog-content-pack-install.png)
+
+5.  Once installed, your Graylog cluster will be ready to receive Cloudflare logs from the Lambda function.
+
+Refer to the Graylog Lambda S3 [README](https://github.com/Graylog2/graylog-s3-lambda/blob/master/README.md) for additional information and troubleshooting tips.
+
+## Task 4 - View the Cloudflare Dashboards
+
+You can view your dashboard in the [Graylog Cloudflare integration page](https://go.graylog.com/cloudflare). The dashboards include:
+
+### Cloudflare - Snapshot
+
+This is an at-a-glance overview of the most important metrics from your websites and applications on the Cloudflare network. You can use dashboard filters to further slice and dice the information for granular analysis of events and trends.
+
+Use this dashboard to:
+
+- Monitor the most important web traffic metrics of your websites and applications on the Cloudflare network
+- View which countries and IPs your traffic is coming from, and analyze the breakdown between mobile and desktop traffic, protocol, methods, and content types
+
+![Graylog dashboard Cloudflare Snapshot](../../../static/images/graylog/dashboards/snapshot-cloudflare-dashboard-graylog.png)
+
+### Cloudflare - Security
+
+This overview provides insights into threats to your websites and applications, including number of threats stopped,threats over time, top threat countries, and more.
+
+Use this dashboard to:
+
+- Monitor the most important security and threat metrics for your websites and applications
+- Fine-tune and configure your IP firewall
+
+![Graylog dashboard Cloudflare Security](../../../static/images/graylog/dashboards/security-cloudflare-dashboard-graylog.png)
+
+### Cloudflare - Performance
+
+This dashboard helps to identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
+
+Use this dashboard to:
+
+- Monitor caching behavior and identify misconfigurations
+- Improve configuration and caching ratio
+
+![Graylog dashboard Cloudflare Performance](../../../static/images/graylog/dashboards/performance-cloudflare-dashboard-graylog.png)
+
+### Cloudflare - Reliability
+
+This dashboard provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+
+Use this dashboard to:
+
+- Investigate errors on your websites and applications by viewing edge and origin response status codes
+- Further analyze errors based on status codes by countries, client IPs, hostnames, and other metrics
+
+![Graylog dashboard Cloudflare Reliability](../../../static/images/graylog/dashboards/reliability-cloudflare-dashboard-graylog.png)
+
+### Cloudflare - Bots
+
+Use this dashboard to detect and mitigate bad bots so that you can prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities.
+
+<Aside type="note" header="Note">
+
+To get bot requests identified correctly, use only one Cloudflare
+Firewall Rule, configured with the action _Challenge (Captcha)_. To lear more, consult the [Cloudflare Firewall Rules documentation](https://developers.cloudflare.com/firewall/cf-firewall-rules/).
+</Aside>
+
+Use this dashboard to:
+
+- Investigate bot activity on your website and prevent content scraping,
+  checkout fraud, spam registration, and other malicious activities
+- Use insight to tune Cloudflare to prevent bots from excessive usage and
+  abuse across websites, applications, and API endpoints
+
+![Graylog dashboard Cloudflare Bot Management](../../../static/images/graylog/dashboards/bot-management-cloudflare-dashboard-graylog.png)
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/index.md
new file mode 100644
index 00000000000..ee2a645b607
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/index.md
@@ -0,0 +1,10 @@
+---
+order: 100
+pcx-content-type: navigation
+---
+
+# Analytics Integrations
+
+You can analyze [Cloudflare Logs](https://developers.cloudflare.com/logs/) data with the following analytics platforms:
+
+<DirectoryListing path="/data-products/analytics-integrations"/>
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/looker/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/looker/index.md
new file mode 100644
index 00000000000..d1e7c6100e0
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/looker/index.md
@@ -0,0 +1,150 @@
+---
+order: 101
+pcx-content-type: interim
+---
+
+# Looker
+
+This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare Log Analytics for Looker](https://looker.com/platform/blocks/source/cloudflare-log-analytics).
+
+## Overview
+
+If you have not used Cloudflare Logs before, refer to the [Logs documentation](https://developers.cloudflare.com/logs) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
+
+This tutorial uses Cloudflare Logpush to send logs to [Google Cloud Storage Bucket and Cloud Function](/data-products/analytics-integrations/google-cloud/) and then import them into Google Big Query.
+
+### Prerequisites
+
+Before sending your Cloudflare log data to Looker, make sure that you:
+
+- Have an existing Looker account
+- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
+- Configure [Logpush](https://developers.cloudflare.com/logs/about) or [Logpull](https://developers.cloudflare.com/logs/logpull)
+- Load your data in a [database supported by Looker](https://looker.com/solutions/other-databases)
+
+<Aside type="note" header="Note">
+
+Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Looker.
+</Aside>
+
+## Task 1 - Connect your Database to Looker
+
+Looker connects to a database in order to query the data. In this tutorial, we use Google Big Query as an example. Learn [how to connect Google BigQuery to Looker](https://docs.looker.com/setup-and-management/database-config/google-bigquery#create_a_temporary_dataset_for_persistent_derived_tables).
+
+Once you load Cloudflare logs into your database, [connect the database to Looker](https://docs.looker.com/setup-and-management/connecting-to-db).
+
+## Task 2 - Create a new LookML project from the public Git repository
+
+To create your new LookML project:
+
+1. Log in to your Looker account.
+
+2. In the menu bar, click **Develop** and make sure **Development Mode** is set to _ON_.
+
+3. Next, also under **Develop**, click **Manage LookML Projects**.
+
+4. At the top right of the LookML Projects page, click **New LookML Project**.
+
+5. In the **New Project** dialog, enter a project name.
+
+6. For **Starting Point**, choose _Clone Public Git Repository**.**_
+
+7. Enter the _cloudflare_block_ URL for the public Git repository `git://github.com/llooker/cloudflare_block.git`.
+
+8. Click **Create Project**. Looker will pull all of the repository files into a new LookML project.
+
+9. Next, open the project.
+
+10. Click **Deploy from Remote** to pull all remote changes into your local version of the repository.
+    ![Looker manage LookML projects](../../../static/images/looker/screenshots/develop-look-ml-project.png)
+
+## Task 3 - Update the connection name
+
+To update the connection name in the LookML files:
+
+1. In your LookML **cloudflare_looker** model file, replace the **connection** name with yours, for example:
+   `connection: "bigquery_lpr"`.
+
+2. Check if any table names need to be updated to your database connection names as well. If you decide to rename the filenames for explore, model name, and view, make sure to update all mentions within the other files. Otherwise, you might encounter errors.
+
+## Task 4 - View the Dashboards
+
+In the main menu, click **Browse** and select **LookML Dashboards**. You should see all the Cloudflare dashboards that were pulled from GitHub.
+
+### About the Dashboards
+
+There are five dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more.
+
+#### Snapshot
+
+This is a quick overview of the most important metrics from your Cloudflare logs, including total number of requests, top visitors by country, client IP, user agent, traffic type, total number of threats, and bandwidth usage.
+
+![Looker Cloudflare Snapshot dashboard](../../../static/images/looker/dashboards/snapshot-cloudflare-dashboard-looker.png)
+
+#### Security
+
+This dashboard provides insights on threat identification and mitigation through our Web Application Firewall (WAF), Rate Limiting rules, and IP Firewall. Metrics include total threats stopped, threat traffic source, blocked IPs, and user agents, top threat requests, WAF events (SQL injections, XSS, etc.), and rate limiting. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
+
+![Looker Cloudflare Security dashboard](../../../static/images/looker/dashboards/security-cloudflare-dashboard-looker.png)
+
+#### Performance
+
+This dashboard helps you identify and address issues like slow pages and caching misconfigurations. Metrics include total vs. cached bandwidth, cache ratio, top uncached requests, static vs. dynamic content, slowest URIs, and more.
+
+![Looker Cloudflare Performance dashboard](../../../static/images/looker/dashboards/performance-cloudflare-dashboard-looker.png)
+
+#### Reliability
+
+This dashboard provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+
+![Looker Cloudflare Reliability dashboard](../../../static/images/looker/dashboards/reliability-cloudflare-dashboard-looker.png)
+
+#### Bot Management
+
+This dashboard allows to reliably detect and mitigate bad bots to prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities. Use these insights to tune Cloudflare and prevent bots from excessive usage and abuse across websites, applications, and API endpoints.
+
+![Looker Cloudflare Reliability dashboard](../../../static/images/looker/dashboards/bot-management-cloudflare-dashboard-looker.png)
+
+### Filters
+
+All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. The filters apply across the entire dashboard.
+
+![Looker Cloudflare dashboard filters](../../../static/images/looker/screenshots/cloudflare-looker-dashboard-filters.png)
+
+The default time interval is set to 24 hours. Note that for correct calculations, by default, filters exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
+
+Available Filters:
+
+- Date (EdgeStartTimestamp)
+
+- Device type
+
+- Country
+
+- Client IP
+
+- Hostname
+
+- Request URI
+
+- Origin Response Status
+
+- Edge response status
+
+- Origin IP
+
+- User Agent
+
+- RayID
+
+- Worker Subrequest
+
+- Client Request Method
+
+With the following pre-set filter values in the Looker dashboards all workers subrequests and client request method PURGE are excluded from the calculations:
+
+- **WorkerSubrequet** set to value _False_
+
+- **ClientRequestMethod** doesn’t equal to _PURGE_
+
+You can always adjust your default filters values according to your needs.
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/splunk/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/splunk/index.md
new file mode 100644
index 00000000000..056db608697
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/splunk/index.md
@@ -0,0 +1,294 @@
+---
+order: 103
+pcx-content-type: interim
+---
+
+# Splunk
+
+This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/).
+
+
+### Prerequisites
+
+Before sending your Cloudflare log data to Splunk, ensure that you:
+
+- Have an existing Splunk Enterprise or Cloud account
+- Have a Cloudflare Enterprise account
+- Consult the [Splunk documentation](https://splunkbase.splunk.com/app/4501/) for the Cloudflare App
+
+## Task 1 - Install and Configure the Cloudflare App for Splunk
+
+To install the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/):
+
+1. Log in to your Splunk instance.
+2. Under **Apps** > **Find More Apps**, search for _Cloudflare App for Splunk._
+3. Click **Install**.
+
+![Splunk find Cloudflare app](../../../static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk.png)
+
+4. Restart and reopen your Splunk instance.   
+5. Edit the `cloudflare:json` source type in the Cloudflare App for Splunk. To edit the source type:
+   1. Click the **Settings** dropdown and select **Source types**. 
+   2. Uncheck **Show only popular** and search for *cloudflare*. 
+   3. Click **Edit** and change the Regex expression to `([\r\n]+)`. 
+   4. Save your edits.
+
+6. Create an index on Splunk to store the HTTP Event logs. To create an index:
+   1. Open the setup screen by clicking the **Settings** dropdown, then click **Indexes**.
+   2. Select **New Index**. Note that the **Indexes** page also gives you the status of all your existing indexes so that you can see whether you're about to use up your licensed amount of space.
+   3. Name the index **cloudflare**, which is the default index that the Cloudflare App will use. 
+
+7. Set up the HTTP Event Collector (HEC) on Splunk. To create an HEC:
+   1. Click the **Settings** dropdown and select **Data inputs**. 
+   2. Click **+Add new** and follow the wizard. When prompted, submit the following responses:
+      * Name: Cloudflare
+      * Source Type: Select > "cloudflare:json"
+      * App Context: Cloudflare App for Splunk (cloudflare)
+      * Index: cloudflare
+   3. At the end of the wizard you will see a **Token Value**. This token authorizes the Cloudflare Logpush job to send data to your Splunk instance. If you forget to copy it now, Splunk allows you to get the value at any time. 
+
+8. Verify whether Splunk is using a self-signed certificate. You'll need this information when creating the Logpush job. 
+9.  Determine the endpoint to use to send the data to. The endpoint should be:
+
+```bash
+"<protocol>://input-<host>:<port>/<endpoint>" or "<protocol>://http-inputs-<host>:<port>/<endpoint>"
+```
+
+Where:
+* `protocol`: HTTP or HTTPS
+* `input`: `input` or `http-inputs` based on whether you have a self-service or managed cloud plan
+* `host`: The hostname of your Splunk instance. The easiest way to determine the hostname is to look at the URL you went to when you logged in to Splunk.
+* `port`: 443 or 8088
+* `endpoint`: services/collector/raw
+
+For example: `https://prd-p-0qk3h.splunkcloud.com:8088/services/collector/raw`. Refer to the [Splunk Documentation](https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Data/UsetheHTTPEventCollector) for more details and examples. 
+
+**Post Installation Notes**
+
+You can change the **Index Name** after initial configuration by accessing the app **Set up** page by clicking on the **Apps** dropdown and navigating to **Manage Apps** > **Cloudflare App for Splunk** > **Set up**.
+
+![Splunk apps set up interface](../../../static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up.png)
+
+You also can find the Index Name manually by visiting **Settings** > **Advanced search** > **Search macros**.
+
+![Splunk search macros](../../../static/images/splunk/screenshots/splunk-settings-advanced-search-search-macros.png)
+
+The Cloudflare App for Splunk comes with a custom Cloudflare Data Model that has an acceleration time frame of 1 day but is not accelerated by default. If you enable [Data Model acceleration](https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Acceleratedatamodels), we recommend that the Data Model is only accelerated for 1 or 7 days to ensure there are no adverse effects within your Splunk environment.
+
+Enable or disable acceleration after the initial configuration by accessing the app Set up page by clicking the **Apps** dropdown, then **Manage Apps** > **Cloudflare Set Up**.
+
+![Splunk search macros](../../../static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up-enable-data-model-acceleration.png)
+
+You can also manually configure Data Models by going to **Settings** > **Data models**. Learn more about data model acceleration in the [Splunk documentation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels).
+
+## Task 2 - Make the API call to create the Logpush job
+
+Create the Logpush job by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/get-started/enable-destinations/splunk). The API call creates a Logpush job but does not enable it.
+
+Enable the Logpush job through the the Cloudflare dashboard or through the API by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/get-started/enable-destinations/splunk). To enable through the dashboard: 
+
+1. Navigate to the Cloudflare dashboard and select **Analytics** > **Logs**. 
+2. Click **Edit** and select the fields referenced in the Dashboard section below to fully populate all tables and graphs. 
+3. Enable the Logpush job by toggling on the switch next to the Edit link. Data takes a few minutes to populate. 
+
+To validate that you are receiving data, search `index=cloudflare` in Splunk.  
+
+## Task 3 - View the Dashboards
+
+You can analyze Cloudflare logs with the thirteen (13) dashboards listed below.
+
+You can use filters within these dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more to further help with debugging and tracing.
+
+### About the Dashboards
+
+The following dashboards outlined below are available as part of the Cloudflare App for Splunk.
+
+#### Cloudflare - Snapshot
+
+_Web Traffic Overview_ and _Web Traffic Types_: Get an overview of the most important metrics from your websites and applications on the Cloudflare network.
+![Splunk dashboard Cloudflare Snapshot](../../../static/images/splunk/dashboards/splunk-cloudflare-snapshot-dashboard.png)
+
+#### Cloudflare - Reliability
+
+_Summary_ and _Detailed_: Get insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+![Splunk dashboard Cloudflare Reliability Summary](../../../static/images/splunk/dashboards/splunk-cloudflare-reliability-summary-dashboard.png)
+
+![Splunk dashboard Cloudflare Reliability Detailed](../../../static/images/splunk/dashboards/splunk-cloudflare-reliability-detailed-dashboard.png)
+
+#### Cloudflare - Security
+
+_Overview_: Get insights on threats to your websites and applications, including number of threats stopped, threats over time, top threat countries, and more.
+![Splunk dashboard Cloudflare Security Overview](../../../static/images/splunk/dashboards/splunk-cloudflare-security-overview.png)
+
+_WAF_: Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
+![Splunk dashboard Cloudflare Security WAF](../../../static/images/splunk/dashboards/splunk-cloudflare-security-waf-dashboard.png)
+
+_Rate Limiting_: Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
+![Splunk dashboard Cloudflare Security Rate Limiting](../../../static/images/splunk/dashboards/splunk-cloudflare-security-rate-limiting-dashboard.png)
+
+_Bots Summary_ and _Bots Detailed_: Investigate bot activity on your website to prevent content scraping, checkout fraud, spam registration and other malicious activities.
+![Splunk dashboard Cloudflare Security Bots Summary](../../../static/images/splunk/dashboards/splunk-cloudflare-security-bot-summary-dashboard.png)
+
+![Splunk dashboard Cloudflare Security Bots Detailed](../../../static/images/splunk/dashboards/splunk-cloudflare-security-bots-detailed-dashboard.png)
+
+#### Cloudflare - Performance
+
+_Requests and Cache_ and _Bandwidth_: Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
+![Splunk dashboard Cloudflare Performance Requests and Cache](../../../static/images/splunk/dashboards/splunk-cloudflare-performance-requests-and-cache-dashboard.png)
+
+![Splunk dashboard Cloudflare Performance Bandwidth](../../../static/images/splunk/dashboards/splunk-cloudflare-performance-bandwidth-dashboard.png)
+
+_Hostname, Content Type, Request Methods, Connection Type_: Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
+
+![Splunk dashboard Cloudflare Performance Hostname, Content Type, Request Methods, Connection Type](../../../static/images/splunk/dashboards/splunk-cloudflare-performance-hostname-dashboard.png)
+
+_Static vs. Dynamic Content_: Get insights into the performance of your static and dynamic content, including slowest URLs.
+![Splunk dashboard Cloudflare Performance Static vs. Dynamic Content](../../../static/images/splunk/dashboards/splunk-cloudflare-performance-static-vs-dynamic-dashboard.png)
+
+### Filters
+
+All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. Filters are applied across the entire dashboard.
+
+![Splunk Cloudflare filters](../../../static/images/splunk/screenshots/splunk-filters.png)
+
+You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
+
+The default time interval is set to 24 hours. Note that for correct calculations filter will need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
+
+Available Filters:
+
+- Time Range (EdgeStartTimestamp)
+
+- Client Country
+
+- Client Device type
+
+- Client IP
+
+- Client Request Host
+
+- Client Request URI
+
+- Client Request User Agent
+
+- Edge response status
+
+- Origin IP
+
+- Origin Response Status
+
+- RayID
+
+- Worker Subrequest
+
+- Client Request Method
+
+## Debugging tips
+
+### Incomplete dashboards
+
+The Splunk Cloudflare App relies on data from the Cloudflare Enterprise Logs fields outlined below. Depending on which fields you have enabled, certain dashboards might not populate fully.
+
+If that is the case, verify and test the Cloudflare App filters below each dashboard (these filters are the same across all dashboards). You can delete any filters that you don’t need, even if such filters include data fields already contained in your logs.
+
+Also, you could compare the list of fields you are getting in Cloudflare Logs with the fields listed in **Splunk** > **Settings** > **Data Model** > **Cloudflare**.
+
+The available fields are:
+
+- CacheCacheStatus
+
+- CacheResponseBytes
+
+- CacheResponseStatus
+
+- ClientASN
+
+- ClientCountry
+
+- ClientDeviceType
+
+- ClientIP
+
+- ClientIPClass
+
+- ClientRequestBytes
+
+- ClientRequestHost
+
+- ClientRequestMethod
+
+- ClientRequestPath
+
+- ClientRequestProtocol
+
+- ClientRequestReferer
+
+- ClientRequestURI
+
+- ClientRequestUserAgent
+
+- ClientSSLCipher
+
+- ClientSSLProtocol
+
+- ClientSrcPort
+
+- EdgeColoCode
+
+- EdgeColoID
+
+- EdgeEndTimestamp
+
+- EdgePathingOp
+
+- EdgePathingSrc
+
+- EdgePathingStatus
+
+- EdgeRateLimitAction
+
+- EdgeRateLimitID
+
+- EdgeRequestHost
+
+- EdgeResponseBytes
+
+- EdgeResponseContentType
+
+- EdgeResponseStatus
+
+- EdgeServerIP
+
+- EdgeStartTimestamp
+
+- FirewallMatchesActions
+
+- FirewallMatchesSources
+
+- FirewallMatchesRuleIDs
+
+- OriginIP
+
+- OriginResponseStatus
+
+- OriginResponseTime
+
+- OriginSSLProtocol
+
+- RayID
+
+- WAFAction
+
+- WAFFlags
+
+- WAFMatchedVar
+
+- WAFProfile
+
+- WAFRuleID
+
+- WAFRuleMessage
+
+- WorkerSubrequest
+
+- ZoneID
diff --git a/products/fundamentals/src/content/data-products/analytics-integrations/sumo-logic/index.md b/products/fundamentals/src/content/data-products/analytics-integrations/sumo-logic/index.md
new file mode 100644
index 00000000000..800a8dab3d4
--- /dev/null
+++ b/products/fundamentals/src/content/data-products/analytics-integrations/sumo-logic/index.md
@@ -0,0 +1,277 @@
+---
+order: 105
+pcx-content-type: interim
+---
+
+# Sumo Logic
+
+This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare App for Sumo Logic](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare).
+
+## Overview
+
+If you have not used Cloudflare Logs before, refer to the [Logs documentation](https://developers.cloudflare.com/logs) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
+
+This tutorial describes how to use Cloudflare Logpush to send logs to AWS S3 and the [AWS S3 source collector](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Amazon-Web-Services/AWS-S3-Source) to get logs into Sumo Logic. To learn how to use Logpush to send logs to AWS S3, refer to the [Logpush documentation](https://developers.cloudflare.com/logs/get-started/enable-destinations/aws-s3). Alternatively, you can use [Logpull](https://developers.cloudflare.com/logs/logpull) to get logs to your Sumo Logic instance directly and skip Task 1.
+
+### Prerequisites
+
+Before sending your Cloudflare log data to Sumo Logic, make sure that you:
+
+- Have an existing Sumo Logic account
+- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
+- Configure [Logpush](https://developers.cloudflare.com/logs/about) or [Logpull](https://developers.cloudflare.com/logs/logpull)
+- Consult the [Sumo Logic documentation](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare) for the Cloudflare App
+
+<Aside type="note" header="Note">
+
+Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Sumo Logic.
+</Aside>
+
+## Task 1 - Send Cloudflare Logs data to Sumo Logic
+
+You can use either **Cloudflare Logpush** or **AWS S3** to send your Cloudflare Logs data to Sumo Logic.
+
+### 1.1 - Send logs data via Cloudflare Logpush
+
+To enable Cloudflare Logpush in Sumo Logic:
+
+1. Configure a [Hosted Collector](https://help.sumologic.com/03Send-Data/Hosted-Collectors/Configure-a-Hosted-Collector).
+
+2. Configure an [HTTP Logs and Metrics Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source).
+
+3. Provide the _HTTP Source Address (URL)_ required by the Cloudflare Logpush API or Cloudflare dashboard UI.
+
+4. Enable [Cloudflare Logpush to Sumo Logic](https://developers.cloudflare.com/logs/get-started/enable-destinations/sumo-logic).
+
+### 1.2 Send log data via AWS S3
+
+To connect AWS S3 to Sumo Logic:
+
+1. [Configure your AWS S3 Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Amazon-Web-Services/AWS-S3-Source).
+
+2. Begin collecting Cloudflare logs data.
+
+## Task 2 - Filter Workers requests
+
+If you have [Cloudflare Workers](https://www.cloudflare.com/products/cloudflare-workers/) enabled and want to filter them out from the logs, do the following:
+
+Under **Processing Rules for Logs** create a **Filter** (processing rule regex on our Cloudflare collector) to exclude any log data where **WorkerSubrequest** is _true_, as illustrated below:
+
+![Sumo Logic Processing Rules for Logs](../../../static/images/sumo-logic/screenshots/exclude_Workers-sumo_logic.png)
+
+## Task 3 - Install the Cloudflare App
+
+To install the [Cloudflare App for Sumo Logic](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare):
+
+1. In the Sumo Logic UI, click **App Catalog** and search for _Cloudflare_.
+   ![Sumo Logic Cloudflare in App Catalog](../../../static/images/sumo-logic/screenshots/cloudflare-app-sumo-logic-app-catalog.png)
+
+2. Click **Add to Library** and specify the **Source** category _Cloudflare_, which was completed in Step 1.
+
+You should now be able to see the Cloudflare dashboards populated with your Cloudflare log data.
+
+## Task 4 - View the Dashboards
+
+There are nine dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more, to further help with debugging and tracing.
+
+### About the Dashboards
+
+#### Cloudflare - Snapshot
+
+Get a quick overview of the most important metrics from your websites and applications on the Cloudflare network.
+![Sumo Logic dashboard Cloudflare Snapshot](../../../static/images/sumo-logic/dashboards/cloudflare-snapshot-dashboard-sumo-logic.png)
+
+#### Cloudflare - Reliability
+
+Get insights on the availability of your websites and Applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
+![Sumo Logic dashboard Cloudflare Reliability](../../../static/images/sumo-logic/dashboards/cloudflare-reliability-dashboard-sumo-logic.png)
+
+#### Cloudflare - Security (Overview)
+
+Get insights on threats to your websites and applications, including number of threats stopped, threats over time, top threat countries, and more.
+![Sumo Logic dashboard Cloudflare Security Overview](../../../static/images/sumo-logic/dashboards/cloudflare-security-overview-dashboard-sumo-logic.png)
+
+#### Cloudflare - Security (WAF)
+
+Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
+![Sumo Logic dashboard Cloudflare Security WAF](../../../static/images/sumo-logic/dashboards/cloudflare-security-waf-dashboard-sumo-logic.png)
+
+#### Cloudflare - Security (Rate Limiting)
+
+Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
+![Sumo Logic dashboard Cloudflare Security Rate Limiting](../../../static/images/sumo-logic/dashboards/cloudflare-security-rate-limiting-dashboard-sumo-logic.png)
+
+#### Cloudflare - Security (Bot Management)
+
+Investigate bot activity on your website to prevent content scraping, checkout fraud, spam registration and other malicious activities.
+![Sumo Logic dashboard Cloudflare Security Bot Management](../../../static/images/sumo-logic/dashboards/cloudflare-security-bot-management-dashboard-sumo-logic.png)
+
+#### Cloudflare - Performance (Requests, Bandwidth, Cache)
+
+Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
+![Sumo Logic dashboard Cloudflare Performance Requests, Bandwidth, Cache](../../../static/images/sumo-logic/dashboards/cloudflare-performance-requests-bandwidth-cache-dashboard-sumo-logic.png)
+
+#### Cloudflare - Performance (Hostname, Content Type, Request Methods, Connection Type)
+
+Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
+![Sumo Logic dashboard Cloudflare Performance Hostname, Content Type, Request Methods, Connection Type](../../../static/images/sumo-logic/dashboards/cloudflare-performance-hostname-content-type-request-methods-connection-type-dashboard-sumo-logic.png)
+
+#### Cloudflare - Performance (Static vs. Dynamic Content)
+
+Get insights into the performance of your static and dynamic content, including slowest URLs.
+![Sumo Logic dashboard Cloudflare - Performance Static vs. Dynamic Content](../../../static/images/sumo-logic/dashboards/cloudflare-performance-static-vs-dynamic-content-dashboard-sumo-logic.png)
+
+### Filters
+
+All dashboards have a set of filters that you can apply to the entire dashboard, as shown below.
+
+Click the **funnel icon** in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.
+
+![Sumo Logic dashboard filtering](../../../static/images/sumo-logic/screenshots/filter-sumo-logic.png)
+
+<Aside type="note" header="Note">
+
+You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
+</Aside>
+
+Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.
+
+The default time interval is set to 24 hours. Note that for correct filter calculations, you need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
+
+#### Available Filters
+
+- Date (EdgeStartTimestamp)
+
+- client_country
+
+- client_device_type
+
+- client_ip
+
+- client_request_host
+
+- client_request_method
+
+- client_request_uri
+
+- client_request_user_agent
+
+- edge_response_status
+
+- origin_ip
+
+- origin_response_status
+
+- ray_id
+
+- worker_subrequest
+
+## Debugging tips
+
+### Incomplete dashboards
+
+The Sumo Logic Cloudflare App relies on data from the Cloudflare Enterprise Logs fields outlined below. Depending on which fields you have enabled, certain dashboards might not populate fully.
+
+If that is the case, verify and test the Cloudflare App filters below each dashboard (these filters are the same across all dashboards). You can delete any filters that you don’t need, even if such filters include data fields already contained in your logs.
+
+The available fields are:
+
+- CacheCacheStatus
+
+- CacheResponseBytes
+
+- CacheResponseStatus
+
+- ClientASN
+
+- ClientCountry
+
+- ClientDeviceType
+
+- ClientIP
+
+- ClientIPClass
+
+- ClientRequestBytes
+
+- ClientRequestHost
+
+- ClientRequestMethod
+
+- ClientRequestPath
+
+- ClientRequestProtocol
+
+- ClientRequestReferer
+
+- ClientRequestURI
+
+- ClientRequestUserAgent
+
+- ClientSSLCipher
+
+- ClientSSLProtocol
+
+- ClientSrcPort
+
+- EdgeColoCode
+
+- EdgeColoID
+
+- EdgeEndTimestamp
+
+- EdgePathingOp
+
+- EdgePathingSrc
+
+- EdgePathi
+
+- ngStatus
+
+- EdgeRateLimitAction
+
+- EdgeRateLimitID
+
+- EdgeRequestHost
+
+- EdgeResponseBytes
+
+- EdgeResponseContentType
+
+- EdgeResponseStatus
+
+- EdgeServerIP
+
+- EdgeStartTimestamp
+
+- FirewallMatchesActions
+
+- FirewallMatchesSources
+
+- FirewallMatchesRuleIDs
+
+- OriginIP
+
+- OriginResponseStatus
+
+- OriginResponseTime
+
+- OriginSSLProtocol
+
+- RayID
+
+- WAFAction
+
+- WAFFlags
+
+- WAFMatchedVar
+
+- WAFProfile
+
+- WAFRuleID
+
+- WAFRuleMessage
+
+- WorkerSubrequest
+
+- ZoneID
diff --git a/products/fundamentals/src/content/data-products/index.md b/products/fundamentals/src/content/data-products/index.md
index 88e87989d7a..44f1a1fcc38 100644
--- a/products/fundamentals/src/content/data-products/index.md
+++ b/products/fundamentals/src/content/data-products/index.md
@@ -1,6 +1,6 @@
 ---
-title: Cloudflare's Data Products
-order: 1
+order: 2
+pcx-content-type: reference
 ---
 
 # Cloudflare's Data Products
diff --git a/products/fundamentals/src/content/get-started/cdn.md b/products/fundamentals/src/content/get-started/cdn.md
new file mode 100644
index 00000000000..1eaaf26b6ad
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/cdn.md
@@ -0,0 +1,28 @@
+---
+order:
+pcx-content-type: concept
+---
+
+# Cloudflare's CDN
+
+Cloudflare’s Content Delivery Network (CDN) is a geographically distributed group of servers that ensure fast delivery of Internet content, including HTML pages, JavaScript files, stylesheets, and images. Caching static resources at Cloudflare reduces your server load and bandwidth, with no extra charges for bandwidth spikes.
+
+<Aside type="note" header="Note:">
+
+Cloudflare does not require an extra CDN subdomain or hostname, and you do not need to change your URLs.
+
+</Aside>
+
+There are many reasons to use [Cloudflare’s CDN](https://www.cloudflare.com/features-cdn) for your site:
+
+- **User Experience**: Without Cloudflare’s CDN, visitors geographically distant from your origin web server experience slow page loads. [Cloudflare’s Anycast network](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) brings content geographically closer to your visitors to reduce page load and latency.
+
+- **Traffic surges**: Due to a major news release or online event, sudden [influxes of traffic](https://support.cloudflare.com/hc/en-us/articles/200172906-What-should-I-do-if-I-m-expecting-a-surge-or-spike-in-traffic-) to your site can overload your origin web server. Cloudflare’s CDN serves your cached content to remove load from your origin web server.
+
+- **DDoS Protection**: [Distributed Denial of Service (DDoS)](https://www.cloudflare.com/ddos/) attacks disrupt websites by flooding their infrastructure with traffic. Cloudflare’s CDN has a network capacity 15 times bigger than the largest DDoS attack ever recorded and handles modern DDoS to ensure your website stays online.
+
+## Cache 
+
+Cloudflare makes customer websites faster by storing a copy of the website’s content on the servers of our globally distributed data centers.
+
+For more information about caching, refer to the [Cache documentation](https://developers.cloudflare.com/cache/).
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/index.md b/products/fundamentals/src/content/get-started/index.md
new file mode 100644
index 00000000000..9e3dbcf1da9
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/index.md
@@ -0,0 +1,10 @@
+---
+order: 1
+pcx-content-type: navigation
+---
+
+# Get started
+
+As you get started with Cloudflare, explore the following guides to get the most out of our products.
+
+<DirectoryListing path="/get-started"/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/origin-health/business.md b/products/fundamentals/src/content/get-started/origin-health/business.md
new file mode 100644
index 00000000000..c841dbb2626
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/origin-health/business.md
@@ -0,0 +1,51 @@
+---
+order: 1
+pcx-content-type: how-to
+hidden: true
+---
+
+import OriginHealthOverview from "../../_partials/_origin-health-overview"
+import SecureOriginConnections from "../../_partials/_origin-secure-connections"
+import OriginPassiveAlert from "../../_partials/_origin-passive-alert"
+import OriginHealthCheck from "../../_partials/_origin-health-check"
+import OriginLBAlert from "../../_partials/_origin-lb-alert"
+import DDoS from "../../_partials/_origin-ddos"
+import FirewallOptions from "../../_partials/_origin-firewall-options"
+import Caching from "../../_partials/_origin-caching"
+import LoadBalancing from "../../_partials/_origin-load-balancing"
+import WaitingRoom from "../../_partials/_origin-waiting-room"
+
+
+# Protect your origin server — Business
+
+<OriginHealthOverview/>
+
+## Secure origin connections
+
+<SecureOriginConnections/>
+
+## Monitor origin health
+
+<OriginPassiveAlert/>
+
+<OriginHealthCheck/>
+
+<OriginLBAlert/>
+
+## Reduce origin traffic
+
+### Block traffic
+
+<DDoS/>
+
+<FirewallOptions/>
+
+### Increase caching
+
+<Caching/>
+
+### Distribute traffic
+
+<LoadBalancing/>
+
+<WaitingRoom/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/origin-health/enterprise.md b/products/fundamentals/src/content/get-started/origin-health/enterprise.md
new file mode 100644
index 00000000000..c7a62bd8e59
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/origin-health/enterprise.md
@@ -0,0 +1,55 @@
+---
+order: 1
+pcx-content-type: how-to
+hidden: true
+---
+
+import OriginHealthOverview from "../../_partials/_origin-health-overview"
+import OriginHealthCheck from "../../_partials/_origin-health-check"
+import OriginLBAlert from "../../_partials/_origin-lb-alert"
+import DDoS from "../../_partials/_origin-ddos"
+import FirewallOptions from "../../_partials/_origin-firewall-options"
+import Caching from "../../_partials/_origin-caching"
+import LoadBalancing from "../../_partials/_origin-load-balancing"
+import WaitingRoom from "../../_partials/_origin-waiting-room"
+
+
+# Protect your origin server — Enterprise
+
+<OriginHealthOverview/>
+
+## Secure origin connections
+
+When you secure origin connections, it prevents attackers from discovering and overloading your origin server with requests.
+
+- **DNS**: Set up [proxied (orange-clouded) DNS records](https://support.cloudflare.com/hc/articles/200169626) and [change your domain nameservers](https://support.cloudflare.com/hc/articles/205195708), which will also require that you [allow Cloudflare IP addresses](https://support.cloudflare.com/hc/articles/201897700) at your origin.
+- **SSL**: 
+    - To encrypt all traffic between Cloudflare and your server, [choose Strict (SSL-Only Origin Pull)](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes#strict-ssl-only-origin-pull) SSL/TLS mode (requires server configuration)
+    - To validate requests are coming from the Cloudflare network, [set up authenticated origin pulls](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull).
+- **Cloudflare Tunnel**: To encrypt all traffic and prevent any inbound connections to your origin, [set up a Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps).
+
+## Monitor origin health
+
+For passive monitoring, [create notifications](/notifications/configure-create/create-notifications) for **Origin Error Rate Alerts** to receive alerts when your origin returns 5xx codes above a configurable threshold and **Passive Origin Monitoring** to see when Cloudflare is unable to reach your origin for a few minutes.
+
+<OriginHealthCheck/>
+
+<OriginLBAlert/>
+
+## Reduce origin traffic
+
+### Block traffic
+
+<DDoS/>
+
+<FirewallOptions/>
+
+### Increase caching
+
+<Caching/>
+
+### Distribute traffic
+
+<LoadBalancing/>
+
+<WaitingRoom/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/origin-health/free.md b/products/fundamentals/src/content/get-started/origin-health/free.md
new file mode 100644
index 00000000000..0016cd4e1ad
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/origin-health/free.md
@@ -0,0 +1,47 @@
+---
+order: 1
+pcx-content-type: how-to
+hidden: true
+---
+
+import OriginHealthOverview from "../../_partials/_origin-health-overview"
+import SecureOriginConnections from "../../_partials/_origin-secure-connections"
+import OriginPassiveAlert from "../../_partials/_origin-passive-alert"
+import OriginLBAlert from "../../_partials/_origin-lb-alert"
+import DDoS from "../../_partials/_origin-ddos"
+import Caching from "../../_partials/_origin-caching"
+import LoadBalancing from "../../_partials/_origin-load-balancing"
+
+# Protect your origin server — Free
+
+<OriginHealthOverview/>
+
+## Secure origin connections
+
+<SecureOriginConnections/>
+
+## Monitor origin health
+
+<OriginPassiveAlert/>
+
+<OriginLBAlert/>
+
+## Reduce origin traffic
+
+### Block traffic
+
+<DDoS/>
+
+Additionally, adjust various settings in your **Firewall** to restrict potentially malicious traffic:
+- Set up customized [firewall rules](https://developers.cloudflare.com/firewall/cf-firewall-rules)
+- Enable [bot protection](https://developers.cloudflare.com/bots/get-started)
+- Block, challenge, or allow specific addresses with [IP access rules](https://support.cloudflare.com/hc/articles/217074967)
+- Create [rate limiting](https://support.cloudflare.com/hc/articles/115001635128) rules as a final defense against malicious traffic (usage-based billing)
+
+### Increase caching
+
+<Caching/>
+
+### Distribute traffic
+
+<LoadBalancing/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/origin-health/index.md b/products/fundamentals/src/content/get-started/origin-health/index.md
new file mode 100644
index 00000000000..30d5fe6f7dc
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/origin-health/index.md
@@ -0,0 +1,10 @@
+---
+order: 1
+pcx-content-type: concept
+---
+
+import OriginHealthOverview from "../../_partials/_origin-health-overview"
+
+# Protect your origin server
+
+<OriginHealthOverview/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/get-started/origin-health/pro.md b/products/fundamentals/src/content/get-started/origin-health/pro.md
new file mode 100644
index 00000000000..86e487be374
--- /dev/null
+++ b/products/fundamentals/src/content/get-started/origin-health/pro.md
@@ -0,0 +1,47 @@
+---
+order: 1
+pcx-content-type: how-to
+hidden: true
+---
+
+import OriginHealthOverview from "../../_partials/_origin-health-overview"
+import SecureOriginConnections from "../../_partials/_origin-secure-connections"
+import OriginPassiveAlert from "../../_partials/_origin-passive-alert"
+import OriginHealthCheck from "../../_partials/_origin-health-check"
+import OriginLBAlert from "../../_partials/_origin-lb-alert"
+import DDoS from "../../_partials/_origin-ddos"
+import FirewallOptions from "../../_partials/_origin-firewall-options"
+import Caching from "../../_partials/_origin-caching"
+import LoadBalancing from "../../_partials/_origin-load-balancing"
+
+# Protect your origin server — Pro
+
+<OriginHealthOverview/>
+
+## Secure origin connections
+
+<SecureOriginConnections/>
+
+## Monitor origin health
+
+<OriginPassiveAlert/>
+
+<OriginHealthCheck/>
+
+<OriginLBAlert/>
+
+## Reduce origin traffic
+
+### Block traffic
+
+<DDoS/>
+
+<FirewallOptions/>
+
+### Increase caching
+
+<Caching/>
+
+### Distribute traffic
+
+<LoadBalancing/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/glossary/index.md b/products/fundamentals/src/content/glossary/index.md
new file mode 100644
index 00000000000..0365bbf261b
--- /dev/null
+++ b/products/fundamentals/src/content/glossary/index.md
@@ -0,0 +1,337 @@
+---
+title: Glossary
+order: 1
+---
+
+# Glossary
+
+See definitions for Cloudflare terms.
+
+## account
+Accounts group one or more members together with specific roles or permissions. Accounts can be associated with any number of domains.
+
+## allowlist
+An allowlist list of items (usually websites, IP addresses, email addresses, etc.) that are permitted to access a system.
+
+**Related terms:** blocklist
+
+## API key
+An API key is unique to each Cloudflare user and used to confirm identity when using the [Cloudflare API](https://api.cloudflare.com/#getting-started-endpoints).
+
+**Related terms:** API token
+
+## API token
+API tokens authorize access to specific Cloudflare dashboard pages, accounts, and zones. API tokens are associated to the user that created them.
+
+**Related terms:** API key
+
+## application
+In Cloudflare for Teams, an application is the resource being protected by Cloudflare for Teams. An application can be a subdomain, a path, or a SaaS application.
+
+## backup codes
+Backup codes allow restoration of Cloudflare account access outside the normal [two-factor authentication process](https://support.cloudflare.com/hc/articles/200167906). A backup code becomes invalid after use.
+
+**Related terms:** two-factor authentication
+
+## blocklist
+A blocklist is a list of items (usually websites, IP addresses, email addresses, etc.) that are prevented from accessing a system.
+
+**Related terms:** allowlist
+
+## cached bandwidth (cached egress bandwidth)
+The amount of bandwidth served from Cloudflare without hitting the origin server. Cached bandwidth is the sum of all **EdgeResponseBytes** where **CacheCacheStatus** equals _hit_, _stale_, _updating_, _ignored_, or _revalidated_.
+
+## cached requests
+The number of requests served from Cloudflare without having to hit the origin server. Cached requests are the sum of all requests where **CacheCacheStatus** equals _hit_, _stale_, _updating_, _ignored_. This doesn’t include _revalidated_ since the request had to be sent to the origin server.
+
+**Relevant terms:** requests, uncached requests
+
+## certificate
+SSL certificates enable encryption over HTTPS for traffic between a client and a website. SSL certificates contain the website's public key and the website's identity along with related information. Devices attempting to communicate with the origin web server reference the SSL certificate to obtain the public key and verify the server's identity. Cloudflare provides a [Universal SSL certificate](https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl) for each active Cloudflare domain.
+
+**Related terms:** SSL certificate, CAA record, Certificate Authority, EV certificate, intermediate certificate, primary certificate, root certificate  
+**Relevant links:** [Cloudflare SSL documentation](https://developers.cloudflare.com/ssl/)
+
+## Certificate Authority (CA)
+A CA is a trusted third party that provides SSL certificates for encrypting network traffic.
+
+## Certification Authority Authorization (CAA) record
+A CAA record declares which CAs are allowed to issue an SSL certificate for a domain.
+
+**Related terms:** Certificate Authority  
+**Relevant links:** [CAA FAQ](https://support.cloudflare.com/hc/articles/115000310832)
+
+## certificate packs
+Certificate packs allow Cloudflare to fallback to a different SSL certificate for browsers that do not support the latest standards. Certificate packs allow Custom SSL certificates to contain different signature algorithms for the same hostnames listed within the SSL certificate without taking up additional Custom SSL certificate quota for your Cloudflare account.
+ 
+**Relevant links:** [Managing Custom SSL certificates](https://support.cloudflare.com/hc/articles/200170466)
+
+## certificate pinning
+Certificate pinning is a security mechanism used to prevent on-path attacks on the Internet by hardcoding information about the certificate that the application expects to receive. If the wrong certificate is received, even if it is trusted by the system, the application will refuse to connect.
+
+## cipher suite
+A set of encryption algorithms for establishing a secure communications connection. There are several cipher suites in wide use, and a client and server agree on the cipher suite to use when establishing the TLS connection. Support of multiple cipher suites allows compatibility across various clients.
+
+**Relevant links:** [cipher suites documentation](https://developers.cloudflare.com/ssl/ssl-tls/cipher-suites)
+
+## cloud
+A network of remote servers used to store and maintain data.
+
+## cloudflared
+`cloudflared` is the software that powers Cloudflare Tunnel. `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
+
+**Relevant links:** [Connect applications with Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps)
+
+## content delivery network (CDN)
+A geographically distributed group of servers which work together to provide fast delivery of Internet content.
+
+## credit
+An amount applied to a specific Cloudflare account as credit for recurring subscriptions or plan payments. The Cloudflare billing system automatically applies credits in the next billing cycle.
+
+## daemon
+A program that performs tasks without active management or maintenance.
+
+## data center
+A physical location where servers run and other IT operations are hosted.
+
+## denial-of-service (DoS) attack
+A DoS attack is a type of cyber attack in which an attacker aims to render a computer or other device unavailable to its intended users by interrupting the device's normal functioning.
+
+**Related terms:** DDoS attack
+
+## distributed denial-of-service (DDoS) attack
+A DDoS attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.
+
+**Related terms:** DoS attack  
+**Relevant links:** [What is a DDoS attack?](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/)
+
+## domain
+The domain name of your application on Cloudflare.
+
+**Related terms:** website, zone
+
+## Domain Name System (DNS)
+The Domain Name System (DNS) is the phonebook of the Internet. DNS translates domain names to IP addresses.
+
+**Relevant links:** [Learn about DNS](https://www.cloudflare.com/learning/dns/what-is-dns/)
+
+## DNS filtering
+DNS filtering is the process of using the Domain Name System to block malicious websites and filter out harmful or inappropriate content. This ensures that company data remains secure and allows companies to have control over what their employees can access on company-managed networks. DNS filtering is often part of a larger access control strategy.
+
+**Relevant links:** [What is DNS filtering?](https://www.cloudflare.com/learning/access-management/what-is-dns-filtering/)
+
+## DNS record
+DNS records are instructions that live in authoritative DNS servers and provide information about a domain including what IP address is associated with that domain and how to handle requests for that domain.
+
+**Related terms:** DNS  
+**Relevant links:** [Learning Center guide on DNS records](https://www.cloudflare.com/learning/dns/dns-records/)
+
+## DNS server
+Each device connected to the Internet has a unique IP address which other machines use to find the device. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).
+
+**Related terms:** DNS
+
+## DNS zone
+A portion of the DNS namespace that is managed by a specific organization or administrator.
+
+**Related terms:** DNS
+
+## dynamic content
+Dynamic content is website content that has to be fetched from the origin server.
+
+**Related terms:** static content
+
+## edge response status code
+HTTP response code sent from Cloudflare to the client (end user). The Cloudflare dashboard **Analytics** app uses the edge response status code.
+
+## encryption algorithm
+An encryption algorithm is a set of mathematical operations performed on data to ensure the data is only understood by the intended recipient.
+
+## Extended Validation (EV) certificate
+EV certificates provide maximum trust to visitors, but require the most validation effort by the CA. EV certificates show the name of the company or organization in the address bar of the visitor’s browser. An EV certificate requires additional documentation by the company or organization in order for the CA to approve the certificate.
+
+## feature
+A feature is a setting in the Cloudflare dashboard that corresponds to functionality within a Cloudflare product or API.
+
+## firewall
+A firewall is a security system that monitors and controls network traffic based on a set of security rules.
+
+## hostname
+A hostname is the name given to a server or node on a network. In most cases, the hostname is the public DNS name of a server.
+
+## HTTP request
+An HTTP request is the way Internet communications platforms such as web browsers ask for the information they need to load a website.
+
+**Related terms:** HTTP 
+**Relevant links:** [What is HTTP?](https://www.cloudflare.com/learning/ddos/glossary/hypertext-transfer-protocol-http/)
+
+## identity provider (IdP or IDP)
+An identity provider (IdP or IDP) stores and manages users' digital identities. Think of an IdP as being like a guest list, but for digital and cloud-hosted applications instead of an event. An IdP may check user identities via username-password combinations and other factors, or it may simply provide a list of user identities that another service provider (like an SSO) checks.
+
+## intermediate certification
+For security purposes, CAs issue intermediate certificates for signing website certificates. Intermediate certificates provide a means for the CA to revoke a single intermediate certificate, thus affecting only a small subset of website certificates.
+
+## IP address
+IP stands for Internet Protocol, which is the set of rules that makes it possible for devices to communicate over the Internet. With billions of people accessing the Internet every day, unique identifiers are necessary to keep track of who is doing what. The Internet Protocol solves this by assigning IP numbers to every device accessing the Internet. Every assigned number is an IP address.
+
+**Relevant links:** [What is my IP address?](https://www.cloudflare.com/learning/dns/glossary/what-is-my-ip-address/)
+
+## Internet
+The Internet is a global system of computer networks that provides a wide range of information and communication facilities.
+
+## location
+Locations in Cloudflare for Teams are physical entities like offices, homes, retail stores, movie theatres or a data center.
+
+**Relevant links:** [Locations](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/locations)
+
+## member or user
+A member or user is an email account in Cloudflare that you can grant access to your organization account. Members belonging to multiple accounts can select which account to manage via the Cloudflare dashboard.
+
+**Related terms:** account
+
+## mTLS (mutual TLS)
+mTLS is a common security practice that uses client TLS certificates to provide an additional layer of protection, allowing to cryptographically verify the client information.
+
+**Related terms:** TLS 
+**Relevant links:** [Enable mTLS](https://developers.cloudflare.com/ssl/client-certificates/enable-mtls)
+
+## nameserver
+A nameserver is a dedicated server that translates human readable host names into IP addresses. Nameservers like root servers, TLD servers, and authoritative nameservers are fundamental components of the Domain Name System (DNS).
+
+**Related terms:** DNS
+
+## OAuth
+OAuth is a technical standard for authorizing users. It is a protocol for passing authorization from one service to another without sharing the actual user credentials, such as a username and password. With OAuth, a user can sign in on one platform and then be authorized to perform actions and view data on another platform.
+
+## Organization Validated (OV) certificate
+OV certificates are used by corporations or governments to portray an extra layer of confidence for their visitors. Rather than just validating domain ownership, the CA also validates the company’s registration using qualified independent information sources. The organization’s name is listed in the certificate.
+
+## origin bandwidth (origin egress bandwidth)
+The amount of data transferred from the origin server to Cloudflare within a certain period of time. Origin bandwidth is the sum of all **EdgeResponseBytes** where **OriginResponseStatus** doesn’t equal _0_.
+
+## Origin Certificate
+A Cloudflare Origin Certificate is a free TLS certificate issued by Cloudflare that can be installed on your origin server to facilitate end-to-end encryption for your visitors using HTTPS.
+
+**Related terms:** TLS 
+**Relevant links:** [Cloudflare Origin Certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca)
+
+## origin request
+An origin request is a request served from the origin server.
+
+**Relevant terms:** request
+
+## origin response status code
+An origin response status code is an HTTP response code sent from the origin server to Cloudflare.
+
+## plan
+Plans distinguish the breadth of Cloudflare features accessible to a specific domain.  Plan options include [Free, Pro, Business, or Enterprise](https://www.cloudflare.com/plans/).
+
+## primary certificate / secondary certificate
+Primary and secondary indicates the order in which Custom SSL certificates were uploaded to Cloudflare. The primary certificate is the first certificate added to a pack. The primary certificate defines the hostnames covered by the certificate.
+
+## protocol
+A protocol is a set of rules governing the exchange or transmission of data between devices.
+
+## public key / private key
+SSL public and private keys are essentially long strings of characters used for encrypting and decrypting data. Data encrypted with the public key can only be decrypted with the private key, and vice versa. Private keys are kept secret and unshared.
+
+**Related terms:** certificate
+
+## roles
+Authorize which Cloudflare products and features a member is allowed to access in a Cloudflare account. Learn more about [roles](https://support.cloudflare.com/hc/articles/205065067#12345682).
+
+## root certificate
+A root certificate is generated by a CA and is used to sign certificates. Every browser includes a root store of trusted root certificates. Any certificate signed with the private key of a root certificate is automatically trusted by a browser.
+
+## saved bandwidth (saved egress bandwidth)
+The percentage of bandwidth saved by caching on the Cloudflare network.
+
+## seat
+A unique user who authenticates to connect to an application protected by Cloudflare Access, or to use a Gateway service.
+
+## Secure Sockets Layer (SSL)
+SSL was a widely used cryptographic protocol for providing data security for Internet communications. SSL was superseded by TLS; however, most people still refer to Internet cryptographic protocols as SSL.
+
+## Server Name Indication (SNI)
+SNI allows a server to host multiple TLS Certificates for multiple websites using a single IP address. SNI adds the website hostname in the TLS handshake to inform the server which website to present when using shared IPs. Cloudflare uses SNI for Dedicated SSL certificates and all Universal SSL certificates.
+
+## Service Level Agreement (SLA)
+An SLA is a contractual obligation for Cloudflare to maintain a specific level of service. Read the [Service Level Agreement (SLA) for the Cloudflare Business plan](https://www.cloudflare.com/business-sla/). Enterprise customers refer to the Enterprise SLA provided by their Subscription Agreement.
+
+## service token
+Service tokens consist of an ID and Secret generated by Cloudflare Access that can be used by an automated system or application to reach an application protected by Cloudflare Access. Service tokens allow systems to authenticate without identity provider credentials in an automated way.
+
+## static content
+Static content is website content that can be delivered to an end user directly from cache, without hitting the origin server.
+
+**Related terms:** dynamic content
+
+## Subject Alternative Name (SAN)
+The SAN field of an SSL certificate specifies additional host names (sites, IP addresses, common names, subdomains, root domains, etc.) protected by a single SSL Certificate.
+
+## subscription, add-on, or plan extension
+Subscriptions are a monthly fee in addition to standard plan costs that are visible within the Cloudflare Overview app. Subscriptions refer to:
+
+- Plan Extensions (Enterprise), or
+- Active Subscriptions (Free, Pro, and Business)
+
+Some examples include products and services such as Cloudflare Dedicated SSL Certificates, Argo, Access, Load Balancing, Stream, and more.
+
+## team domain
+Your team domain is a unique subdomain assigned to your Cloudflare account; for example, `<your-team-name>.cloudflareaccess.com`. Setting up a team domain is an essential step in your Teams configuration. This is where your users will find the apps you've secured behind Teams — displayed in the App Launcher — and will be able to make login requests to them.
+
+**Relevant links:** [App Launcher](https://developers.cloudflare.com/cloudflare-one/applications/app-launcher)
+
+## team name
+The customizable portion of your [team domain](#team-domain). You can change this name at any time in the Teams dashboard, under the **Authentication** tab.
+
+| team domain | team name |
+|-------------|-----------|
+| `<your-team-name>.cloudflareaccess.com` | `your-team-name` |
+
+## Terraform
+[Terraform](https://www.terraform.io/) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building Cloudflare resources.
+
+## threat
+Any event that can potentially cause serious damage and lead to site attacks. In addition to threat analytics, you can monitor search engine crawlers visiting your websites. Cloudflare uses the IP reputation of a visitor to decide whether to present a challenge. A Cloudflare internal algorithm calculates an IP's reputation and assigns a threat score that ranges from 0 to 100.
+
+The security levels and the challenge display criteria are:
+
+- _High_ - for scores greater than 0
+- _Medium_ - for scores greater than 14
+- _Low_ - for scores greater than 24
+- _Essentially off_ - for scores greater than 49
+
+**Relevant links:** [Cloudflare Logs documentation](https://developers.cloudflare.com/logs/)
+
+## total bandwidth (total egress bandwidth, edge bandwidth)
+The amount of data transferred from Cloudflare to end users within a certain period of time. Total bandwidth equals the sum of all **EdgeResponseBytes** for a certain period of time.
+
+## Transport Layer Security (TLS)
+TLS is a security protocol that replaces SSL for data privacy and Internet communication security. TLS encrypts communications between web applications and servers such as between a visitor’s browser loading a website.
+
+## Tunnel certificate
+
+The Cloudflare Tunnel software, `cloudflared`, generates a certificate when you login with your Cloudflare account. The certificate consists of a [service token](#service-token) and [origin certificate](#origin-certificate).
+
+## two-factor authentication (2FA)
+Two-factor authentication adds an additional layer of login security to Cloudflare accounts. It requires users to provide both something known, such as a Cloudflare password, and something physically present, such as an authentication code from a mobile device.
+
+## uncached bandwidth (uncached egress bandwidth)
+The amount of bandwidth that is not cached, and therefore is served from the origin. Uncached bandwidth is the sum of all **EdgeResponseBytes** where **CacheCacheStatus** doesn’t equal _hit_, _stale_, _updating_, _ignored_, or _revalidated_.
+
+## uncached requests
+Uncached requests are requests that are not cached, and therefore are served from the origin server. Uncached requests are the sum of all requests where **CacheCacheStatus** doesn’t equal to _hit_, _stale_, _updating_, or _ignored_.
+
+**Related terms:** requests, cached requests
+
+## usage-based billing
+Within subscriptions, certain products are charged based on usage. This is referred to as usage-based billing. The bill can vary month by month based on usage. This is in contrast to monthly flat fees such as for [plans](https://www.cloudflare.com/plans/), additional [Page Rules](https://support.cloudflare.com/hc/articles/218411427), and [Dedicated SSL Certificates](https://support.cloudflare.com/hc/articles/228009108). 
+
+## web application firewall (WAF)
+A WAF is a security system that helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
+
+**Relevant links:** [Cloudflare WAF](https://developers.cloudflare.com/waf/)
+
+## Zero Trust Security
+An IT security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter. No single specific technology is associated with zero trust architecture; it is a holistic approach to network security that incorporates several different principles and technologies.
diff --git a/products/fundamentals/src/content/index.md b/products/fundamentals/src/content/index.md
index 627ca42bb7f..23518ec5ccb 100644
--- a/products/fundamentals/src/content/index.md
+++ b/products/fundamentals/src/content/index.md
@@ -1,6 +1,7 @@
 ---
 title: Overview 
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Cloudflare Fundamentals
diff --git a/products/fundamentals/src/content/internet/index.md b/products/fundamentals/src/content/internet/index.md
index 2122f662676..c63d00fe39d 100644
--- a/products/fundamentals/src/content/internet/index.md
+++ b/products/fundamentals/src/content/internet/index.md
@@ -1,6 +1,6 @@
 ---
-title: The Internet
 order: 2
+pcx-content-type: concept
 ---
 
 # The Internet
diff --git a/products/fundamentals/src/content/internet/local-network/index.md b/products/fundamentals/src/content/internet/local-network/index.md
index 8ab7b2997af..ce25743f9a5 100644
--- a/products/fundamentals/src/content/internet/local-network/index.md
+++ b/products/fundamentals/src/content/internet/local-network/index.md
@@ -1,5 +1,6 @@
 ---
 order: 30
+pcx-content-type: concept
 ---
 
 # Local networks
diff --git a/products/fundamentals/src/content/internet/local-to-global/index.md b/products/fundamentals/src/content/internet/local-to-global/index.md
index 63c01e9b107..b106d1774a8 100644
--- a/products/fundamentals/src/content/internet/local-to-global/index.md
+++ b/products/fundamentals/src/content/internet/local-to-global/index.md
@@ -1,5 +1,6 @@
 ---
 order: 40
+pcx-content-type: concept
 ---
 
 # Bridging from local to global
diff --git a/products/fundamentals/src/content/internet/peering/index.md b/products/fundamentals/src/content/internet/peering/index.md
index 9c290d3bab9..3e27afed76d 100644
--- a/products/fundamentals/src/content/internet/peering/index.md
+++ b/products/fundamentals/src/content/internet/peering/index.md
@@ -1,5 +1,6 @@
 ---
 order: 60
+pcx-content-type: concept
 ---
 
 # Networks on top of cables
diff --git a/products/fundamentals/src/content/internet/protocols/dns.md b/products/fundamentals/src/content/internet/protocols/dns.md
index debc3a4674a..7cc7ef3f29c 100644
--- a/products/fundamentals/src/content/internet/protocols/dns.md
+++ b/products/fundamentals/src/content/internet/protocols/dns.md
@@ -1,5 +1,6 @@
 ---
 order: 71
+pcx-content-type: concept
 ---
 
 # DNS
diff --git a/products/fundamentals/src/content/internet/protocols/index.md b/products/fundamentals/src/content/internet/protocols/index.md
index d2331bb119e..b8f3fdfa49e 100644
--- a/products/fundamentals/src/content/internet/protocols/index.md
+++ b/products/fundamentals/src/content/internet/protocols/index.md
@@ -1,5 +1,6 @@
 ---
 order: 70
+pcx-content-type: reference
 ---
 
 # Protocols
diff --git a/products/fundamentals/src/content/internet/protocols/tcp.md b/products/fundamentals/src/content/internet/protocols/tcp.md
index df344481cd8..3a0185417a3 100644
--- a/products/fundamentals/src/content/internet/protocols/tcp.md
+++ b/products/fundamentals/src/content/internet/protocols/tcp.md
@@ -1,5 +1,6 @@
 ---
 order: 72
+pcx-content-type: concept
 ---
 
 # TCP
diff --git a/products/fundamentals/src/content/internet/protocols/tls.md b/products/fundamentals/src/content/internet/protocols/tls.md
index a1fe51a1f83..ec720fc4734 100644
--- a/products/fundamentals/src/content/internet/protocols/tls.md
+++ b/products/fundamentals/src/content/internet/protocols/tls.md
@@ -1,5 +1,6 @@
 ---
 order: 73
+pcx-content-type: concept
 ---
 
 # TLS
diff --git a/products/fundamentals/src/content/internet/undersea-cables/index.md b/products/fundamentals/src/content/internet/undersea-cables/index.md
index cd0b7aee687..7578d15063f 100644
--- a/products/fundamentals/src/content/internet/undersea-cables/index.md
+++ b/products/fundamentals/src/content/internet/undersea-cables/index.md
@@ -1,5 +1,6 @@
 ---
 order: 50
+pcx-content-type: concept
 ---
 
 # Undersea cables
diff --git a/products/fundamentals/src/content/internet/wifi/index.md b/products/fundamentals/src/content/internet/wifi/index.md
index a78f414b050..fc78554e895 100644
--- a/products/fundamentals/src/content/internet/wifi/index.md
+++ b/products/fundamentals/src/content/internet/wifi/index.md
@@ -1,5 +1,6 @@
 ---
 order: 20
+pcx-content-type: concept
 ---
 
 # Wi-Fi
diff --git a/products/fundamentals/src/content/notifications/configure-create/create-notifications.md b/products/fundamentals/src/content/notifications/configure-create/create-notifications.md
new file mode 100644
index 00000000000..e28183df59f
--- /dev/null
+++ b/products/fundamentals/src/content/notifications/configure-create/create-notifications.md
@@ -0,0 +1,56 @@
+---
+order: 0
+pcx-content: how-to
+---
+
+# Create a Notification
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account / domain.
+1. Go to **Notifications**.
+1. Click **Add**.
+1. Click **Select** on the Notification you want to enable. The list of Notifications available depends on the [type of account you have](/notifications/notification-available).
+1. Give the Notification a name to identify it. 
+1. Add a way to be notified, like an email address. Professional and Business plans will have access to other options such as configuring PagerDuty or accessing webhooks.
+1. Click **Create**.
+
+This will take you back to your list of Notifications, where the new Notification will appear as **Enabled**.
+
+## PagerDuty
+
+Professional plans or higher can configure PagerDuty to receive notifications about their Cloudflare account. If you do not have a PagerDuty account, see [how to create an account](https://support.pagerduty.com/docs/quick-start-guide) in PagerDuty's documentation.
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account / domain.
+1. Go to **Notifications**.
+1. Click **Destinations** on the left side of your dashboard.
+1. In the **Connected notification services** card, click **Connect**.
+1. Log in to your PagerDuty account to connect it to your Cloudflare account.
+1. Select the services you want to use and click **Connect**.
+1. The browser will navigate back to your Cloudflare dashboard. Click **Continue**.
+
+Your new connected PagerDuty will appear in the **Connected notification services** card.
+
+## Webhooks to external services
+
+There are a variety of services you can connect to Cloudflare using webhooks to receive Notifications from your Cloudflare account. Here are some of the most popular services you can connect to your Cloudflare account:
+
+* [Jira](https://developer.atlassian.com/server/jira/platform/webhooks/) 
+* [Slack](https://api.slack.com/messaging/webhooks)
+* [Google Chat](https://developers.google.com/chat/how-tos/webhooks)
+* [DataDog](https://docs.datadoghq.com/developers/guide/calling-on-datadog-s-api-with-the-webhooks-integration/)
+* [OpsGenie](https://docs.opsgenie.com/docs/integration-api)
+
+After configuring the external service you want to connect to, set up webhooks in your Cloudflare dashboard:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account / domain.
+1. Go to **Notifications**. 
+1. Click **Destinations** on the left side of your dashboard.
+1. In the **Webhooks** card, click **Create**.
+1. Give your webhook a name so you can identify it later.
+1. In the **URL** field, enter the URL of the third-party service you set up above and want to connect to your Cloudflare account.
+1. If needed, insert the **Secret**. Secrets are how webhooks are encrypted and vary according to the service you are connecting to Cloudflare.
+
+  ![Webhooks secret](../../static/images/notifications/webhooks.png)
+
+1. Click **Save and Test** to finish setting up your webhook.
+
+The new webhook will appear in the **Webhooks** card.
\ No newline at end of file
diff --git a/products/fundamentals/src/content/notifications/configure-create/edit-notification.md b/products/fundamentals/src/content/notifications/configure-create/edit-notification.md
new file mode 100644
index 00000000000..9ee596edb05
--- /dev/null
+++ b/products/fundamentals/src/content/notifications/configure-create/edit-notification.md
@@ -0,0 +1,47 @@
+---
+order: 1
+title: Edit Notifications and webhooks
+pcx-content: how-to
+---
+
+# Edit a Notification
+
+1. Sign in to your [Cloudflare dashboard](https://dash.cloudflare.com/login).
+1. Click **Notifications** on the upper right corner.
+1. Click **Edit** on the Notification you want to modify.
+1. Make changes as needed and click **Save**.
+
+This will take you back to your list of Notifications.
+
+<Aside type="note" header="Note">
+
+You can also disable and/or delete Notifications. To disable a notification, click the **Enabled** toggle. To delete it, click **Delete**.
+
+</Aside>
+
+## Edit a PagerDuty connected service
+
+You can only disconnect PagerDuty services.
+
+1. Sign in to your [Cloudflare dashboard](https://dash.cloudflare.com/login).
+1. Go to **Notifications**.
+1. Click **Destinations** on the left side of your dashboard.
+1. In the **Connected notification services** card, click **View** on the PagerDuty service you want to disconnect.
+1. Click **Disconnect**.
+1. Select **Confirm**.
+
+## Edit webhooks
+
+You can only edit the name of webhooks and/or delete them.
+
+1. Sign in to your [Cloudflare dashboard](https://dash.cloudflare.com/login).
+1. Go to **Notifications**.
+1. Click **Destinations** on the left side of your dashboard.
+1. In the **Webhooks** card, click **Edit** on the webhook you want to edit.
+1. Change the webhook name as you see fit and click **Save**.
+
+<Aside type="note" header="Note">
+
+You can also delete a webhook after clicking **Edit**. However, it is faster to click **Delete** in the list of webhooks displayed in the **Destinations** card.
+
+</Aside>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/notifications/configure-create/index.md b/products/fundamentals/src/content/notifications/configure-create/index.md
new file mode 100644
index 00000000000..2740d2fa4ce
--- /dev/null
+++ b/products/fundamentals/src/content/notifications/configure-create/index.md
@@ -0,0 +1,10 @@
+---
+order: 6
+pcx-content: navigation
+---
+
+# Configuring and creating notifications
+
+Select one of the following tasks to get started:
+
+<DirectoryListing path="/notifications/configure-create"/>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/notifications/index.md b/products/fundamentals/src/content/notifications/index.md
new file mode 100644
index 00000000000..15bee07d6b1
--- /dev/null
+++ b/products/fundamentals/src/content/notifications/index.md
@@ -0,0 +1,32 @@
+---
+order: 4
+type: overview
+pcx-content: landing-page
+---
+
+<ContentColumn>
+
+# Cloudflare Notifications
+
+Cloudflare Notifications help you stay up to date with your Cloudflare account. Manage your Notifications to define what you want to be warned about and how, be it a denial-of-service attack or an issue with your server. 
+
+The available Notification features vary according to your plan:
+* Free plans can set up email-based Notifications. 
+* Professional and higher plans can also access PagerDuty. 
+* Business and higher plans can also use webhooks.
+
+## Where to find the Notifications section
+
+Notifications are available in your [Cloudflare dashboard](https://dash.cloudflare.com/login). After logging in to your account, click **Notifications** on the top right of the menu in your account home page. Here you can create notifications for different scenarios, edit notifications previously set up, and enable or disable notifications.
+
+![Where to find the Notifications section](../static/images/notifications/where-to-find.png)
+
+Other features vary according to your plan: 
+* Professional and higher plans can also connect a **PagerDuty** instance to send notifications to.
+* Business and higher plans also have access to **Webhooks**, to connect their Cloudflare account to external services such as Google Chat and Slack. 
+
+## What to do when receiving Notifications
+
+Go to our [Types of Notifications](notification-available/) section to know more about what each Notification does and what do to when receiving one.
+
+</ContentColumn>
diff --git a/products/fundamentals/src/content/notifications/notification-available.md b/products/fundamentals/src/content/notifications/notification-available.md
new file mode 100644
index 00000000000..31bc661e2b4
--- /dev/null
+++ b/products/fundamentals/src/content/notifications/notification-available.md
@@ -0,0 +1,331 @@
+---
+order: 5
+title: Types of Notifications
+pcx-content: concept
+---
+
+import SSLTroubleshoot from "../_partials/_troubleshoot-ssl"
+import DDOS from "../_partials/_ddos"
+import Errors5xx from "../_partials/_errors"
+
+# What kinds of Notifications are available?
+
+Available Notifications depend on your Cloudflare plan. We offer a variety of Notifications for our products and services, such as Billing, Denial-of-Service protection, Magic Transit, and SSL/TLS.
+Depending on your plan, you will also be able to configure webhooks. Webhooks allow you to connect your account with external services such as Slack and Google Chat. Another possibility is to use PagerDuty to receive Cloudflare Notifications.
+
+## What should you do when receiving Notifications?
+
+Each Notification carries different types of information about the status of your Cloudflare account, or the type of action you can take. 
+
+Click below to understand what each Notification does and what to do when receiving one.
+
+<details>
+<summary>Origin Error Rate Alert</summary>
+<div>
+
+**Who is it for?**
+
+Enterprise customers who want to receive a notification when Cloudflare is unable to access their origin server.
+
+**Included with**
+
+Enterprise plans.
+
+**What should you do if you receive one?**
+
+1. Use the link in the Notification you received to see which error codes Cloudflare is seeing from your origin.
+1. <Errors5xx/>
+
+</div>
+</details>
+
+<details>
+<summary>Dedicated SSL Alert</summary>
+<div>
+
+**Who is it for?**
+
+Customers with dedicated certificates who want to receive a notification on validation, issuance, renewal, and expiration of certificates.
+
+**Included with**
+
+Free plan.
+
+**What should you do if you receive one?**
+
+<SSLTroubleshoot/>
+
+</div>
+</details>
+
+<details>
+<summary>Universal SSL Alert</summary>
+<div>
+
+**Who is it for?**
+
+Customers with universal certificates who want to receive a notification on validation, issuance, and renewal of certificates.
+
+**Included with**
+
+Free plan.
+
+**What should you do if you receive one?**
+
+<SSLTroubleshoot/>
+
+</div>
+</details>
+
+<details>
+<summary>SSL for SaaS Custom Hostnames Alert</summary>
+<div>
+
+**Who is it for?**
+
+Customers with custom hostname certificates who want to receive a notification on validation, issuance, renewal, and expiration of certificates.
+
+**Included with**
+
+Purchase of Cloudflare for SaaS.
+
+**What should you do if you receive one?**
+
+<SSLTroubleshoot/>
+
+</div>
+</details>
+
+<details>
+<summary>HTTP DDoS Attack Alerter</summary>
+<div>
+
+**Who is it for?**
+
+WAF/CDN customers who want to receive a notification when Cloudflare has mitigated an attack.
+
+**Included with**
+
+Professional or higher plans.
+
+**What should you do if you receive one?**
+
+<DDOS/>
+
+</div>
+</details>
+
+<details>
+<summary>Layer 4 Attack Alerter</summary>
+<div>
+
+**Who is it for?**
+
+BYOIP customers and Spectrum customers with Network Analytics who want to receive a notification when Cloudflare has mitigated an attack.
+
+**Included with**
+
+Purchase of Magic Transit and/or BYOIP.
+
+**What should you do if you receive one?**
+
+<DDOS/>
+
+</div>
+</details>
+
+<details>
+<summary>Flow-based Monitoring: Volumetric Attack</summary>
+<div>
+
+**Who is it for?**
+
+Magic Transit On Demand customers who are using Flow Based Monitoring to detect attacks when Magic Transit is disabled.
+
+**Included with**
+
+Purchase of Magic Transit.
+
+**What should you do if you receive one?**
+
+You need to advertise your IP prefixes to enable Magic Transit. For more information, see [Dynamic advertisement](https://developers.cloudflare.com/byoip/dynamic-advertisement).
+
+</div>
+</details>
+
+<details>
+<summary>Passive Origin Monitoring</summary>
+<div>
+
+**Who is it for?**
+
+Any customer who wants to receive a notification when Cloudflare is unable to access their origin.
+
+**Included with**
+
+Free plans.
+
+**What should you do if you receive one?**
+
+<Errors5xx/>
+
+</div>
+</details>
+
+<details>
+<summary>Expiring Access Service Token Alert</summary>
+<div>
+
+**Who is it for?**
+
+Access customers who want to receive a notification when their service token is about to expire.
+
+**Included with**
+
+Purchase of Access.
+
+**What should you do if you receive one?**
+
+Refresh your service token in the [Teams dashboard](https://dash.teams.cloudflare.com/) under **Configuration** > **Service Auth**.
+
+
+</div>
+</details>
+
+<details>
+<summary>Usage Based Billing</summary>
+<div>
+
+**Who is it for?**
+
+Customers who want to receive a notification when usage of a product goes above a set level.
+
+**Included with**
+
+Professional plans or higher.
+
+**What should you do if you receive one?**
+
+Review your usage of the product and adjust the configuration and/or increase the alerting threshold.
+
+</div>
+</details>
+
+<details>
+<summary>Script Monitor New Scripts Alert</summary>
+<div>
+
+**Who is it for?**
+
+Page Shield customers who want to receive a notification when new JavaScript dependencies appear in their zone.
+
+**Included with**
+
+Business plans or higher.
+
+**What should you do if you receive one?**
+
+Investigate to confirm it is an expected change.
+
+</div>
+</details>
+
+<details>
+<summary>Script Monitor New Domain Alert</summary>
+<div>
+
+**Who is it for?**
+
+Page Shield customers who want to receive a notification when JavaScript dependencies from new host domains appear in their zone.
+
+**Included with**
+
+Business plans or higher.
+
+**What should you do if you receive one?**
+
+Investigate to confirm it is an expected change.
+
+
+</div>
+</details>
+
+<details>
+<summary>Route Leak Detection Alert</summary>
+<div>
+
+**Who is it for?**
+
+BYOIP customers who want to receive a notification when their prefixes are advertised in places they should not be.
+
+**Included with**
+
+Purchase of BYOIP.
+
+**What should you do if you receive one?**
+
+Confirm your traffic is healthy: reach out to your transit providers to ensure you are behaving as expected and ask them to follow up with any providers accepting the unauthorized routes.
+
+</div>
+</details>
+
+<details>
+<summary>Secondary DNS all Primaries Failing</summary>
+<div>
+
+**Who is it for?**
+
+Enterprise customers who have at least one secondary zone in their account and want to receive a notification if all of their primary nameservers are failing.
+
+**Included with**
+
+Purchase of Secondary DNS.
+
+**What should you do if you receive one?**
+
+1. Confirm that your primary nameservers are up and running.
+1. Confirm that the ACLs on your primary nameservers are configured correctly.
+1. Confirm that your primary nameservers are configured correctly in your Cloudflare account (correct IP, port, TSIG).
+
+</div>
+</details>
+
+<details>
+<summary>Secondary DNS Primaries Failing</summary>
+<div>
+
+**Who is it for?**
+
+Enterprise customers who have at least one secondary zone and want to receive a notification if at least one of their primary nameservers is failing.
+
+**Included with**
+
+Purchase of Secondary DNS.
+
+**What should you do if you receive one?**
+
+1. Confirm that the primary nameserver that is failing is up and running.
+1. Confirm that the ACL on the primary nameserver that is failing is configured correctly. 
+1. Confirm that the primary nameserver that is failing is configured correctly in your Cloudflare account (correct IP, port, TSIG).
+
+</div>
+</details>
+
+<details>
+<summary>Secondary DNS Successfully Updated</summary>
+<div>
+
+**Who is it for?**
+
+Enterprise customers who have at least one secondary zone in their account and want to receive a notification on successful zone transfers.
+
+**Included with**
+
+Purchase of Secondary DNS.
+
+**What should you do if you receive one?**
+
+No action needed. Everything is working correctly.
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/fundamentals/src/content/static/images/datadog/dashboards/cloudflare-dashboard-datadog.png b/products/fundamentals/src/content/static/images/datadog/dashboards/cloudflare-dashboard-datadog.png
new file mode 100644
index 00000000000..1264f799e4a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/datadog/dashboards/cloudflare-dashboard-datadog.png differ
diff --git a/products/fundamentals/src/content/static/images/datadog/screenshots/cloudflare-tile-datadog-fill-details.png b/products/fundamentals/src/content/static/images/datadog/screenshots/cloudflare-tile-datadog-fill-details.png
new file mode 100644
index 00000000000..b13f7e0c0fd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/datadog/screenshots/cloudflare-tile-datadog-fill-details.png differ
diff --git a/products/fundamentals/src/content/static/images/datadog/screenshots/datadog-integrations.png b/products/fundamentals/src/content/static/images/datadog/screenshots/datadog-integrations.png
new file mode 100644
index 00000000000..2dc3bf94cd7
Binary files /dev/null and b/products/fundamentals/src/content/static/images/datadog/screenshots/datadog-integrations.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-bot-management.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-bot-management.png
new file mode 100644
index 00000000000..51aa37f33b8
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-bot-management.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-origin-requests-by-hostname-type.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-origin-requests-by-hostname-type.png
new file mode 100644
index 00000000000..b658e1d4acc
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-origin-requests-by-hostname-type.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance-static-vs-dynamic-content.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance-static-vs-dynamic-content.png
new file mode 100644
index 00000000000..d82fb5eab15
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance-static-vs-dynamic-content.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance.png
new file mode 100644
index 00000000000..6c879ac67a1
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-performance.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-reliability.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-reliability.png
new file mode 100644
index 00000000000..92ea29e0506
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-reliability.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-rate-limiting.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-rate-limiting.png
new file mode 100644
index 00000000000..939558dbdbd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-rate-limiting.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-waf.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-waf.png
new file mode 100644
index 00000000000..b95deae052e
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security-waf.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security.png
new file mode 100644
index 00000000000..383badccaec
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-security.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-snapshot.png b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-snapshot.png
new file mode 100644
index 00000000000..62381bf1b94
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/dashboards/elastic-snapshot.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams-messages.png b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams-messages.png
new file mode 100755
index 00000000000..00c2a53cc8d
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams-messages.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams.png b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams.png
new file mode 100755
index 00000000000..90885b7f745
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-log-streams.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-monitoring.png b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-monitoring.png
new file mode 100755
index 00000000000..1c75a7011eb
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/aws-lambda-monitoring.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-dashboards-filters-elastic-kibana.png b/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-dashboards-filters-elastic-kibana.png
new file mode 100644
index 00000000000..4b190f2c844
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-dashboards-filters-elastic-kibana.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-elastic-lambda-zip-s3-bucket.png b/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-elastic-lambda-zip-s3-bucket.png
new file mode 100644
index 00000000000..17a53040ae6
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/cloudflare-elastic-lambda-zip-s3-bucket.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/configure-hot-and-warm-elastic-8gb-ram.png b/products/fundamentals/src/content/static/images/elastic/screenshots/configure-hot-and-warm-elastic-8gb-ram.png
new file mode 100644
index 00000000000..248a82c4fa6
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/configure-hot-and-warm-elastic-8gb-ram.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/configure-index-management-elastic.png b/products/fundamentals/src/content/static/images/elastic/screenshots/configure-index-management-elastic.png
new file mode 100644
index 00000000000..434fa8cf791
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/configure-index-management-elastic.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/create-elastic-deployment-hot-warm-architecture.png b/products/fundamentals/src/content/static/images/elastic/screenshots/create-elastic-deployment-hot-warm-architecture.png
new file mode 100644
index 00000000000..67b219aa292
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/create-elastic-deployment-hot-warm-architecture.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/create-your-first-deployment.png b/products/fundamentals/src/content/static/images/elastic/screenshots/create-your-first-deployment.png
new file mode 100644
index 00000000000..1ce93058be6
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/create-your-first-deployment.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-cloud-console.png b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-cloud-console.png
new file mode 100755
index 00000000000..d861893c8bd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-cloud-console.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-1.png b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-1.png
new file mode 100755
index 00000000000..9d27b8a4c0a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-1.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-2.png b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-2.png
new file mode 100755
index 00000000000..2931a9d8375
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-dev-tools-console-2.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-scripted-fields.png b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-scripted-fields.png
new file mode 100644
index 00000000000..d4bb5f0700f
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/elastic-kibana-scripted-fields.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/environment-variables-lambda-cloudflare.png b/products/fundamentals/src/content/static/images/elastic/screenshots/environment-variables-lambda-cloudflare.png
new file mode 100644
index 00000000000..ec3abf18b50
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/environment-variables-lambda-cloudflare.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/execution-role-aws.png b/products/fundamentals/src/content/static/images/elastic/screenshots/execution-role-aws.png
new file mode 100644
index 00000000000..d734f894381
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/execution-role-aws.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/function-code-lambda.png b/products/fundamentals/src/content/static/images/elastic/screenshots/function-code-lambda.png
new file mode 100644
index 00000000000..c085367ca31
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/function-code-lambda.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/generated-user-details-elastic-deployment.png b/products/fundamentals/src/content/static/images/elastic/screenshots/generated-user-details-elastic-deployment.png
new file mode 100644
index 00000000000..fd5ac8a5e26
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/generated-user-details-elastic-deployment.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/index-curation-add-cloudflare.png b/products/fundamentals/src/content/static/images/elastic/screenshots/index-curation-add-cloudflare.png
new file mode 100644
index 00000000000..1c32f37eed4
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/index-curation-add-cloudflare.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/kibana-saved-objects-import-dashboards.png b/products/fundamentals/src/content/static/images/elastic/screenshots/kibana-saved-objects-import-dashboards.png
new file mode 100644
index 00000000000..bd383d78669
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/kibana-saved-objects-import-dashboards.png differ
diff --git a/products/fundamentals/src/content/static/images/elastic/screenshots/s3-bucket-actions.png b/products/fundamentals/src/content/static/images/elastic/screenshots/s3-bucket-actions.png
new file mode 100644
index 00000000000..40e5d7dc7fc
Binary files /dev/null and b/products/fundamentals/src/content/static/images/elastic/screenshots/s3-bucket-actions.png differ
diff --git a/products/fundamentals/src/content/static/images/google/cf-logpush-to-google-cloud-platform.png b/products/fundamentals/src/content/static/images/google/cf-logpush-to-google-cloud-platform.png
new file mode 100644
index 00000000000..4bed640660c
Binary files /dev/null and b/products/fundamentals/src/content/static/images/google/cf-logpush-to-google-cloud-platform.png differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Graylog.png b/products/fundamentals/src/content/static/images/graylog/dashboards/bot-management-cloudflare-dashboard-graylog.png
similarity index 100%
rename from products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Graylog.png
rename to products/fundamentals/src/content/static/images/graylog/dashboards/bot-management-cloudflare-dashboard-graylog.png
diff --git a/products/fundamentals/src/content/static/images/graylog/dashboards/performance-cloudflare-dashboard-graylog.png b/products/fundamentals/src/content/static/images/graylog/dashboards/performance-cloudflare-dashboard-graylog.png
new file mode 100755
index 00000000000..4ad3c96cc7b
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/dashboards/performance-cloudflare-dashboard-graylog.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/dashboards/reliability-cloudflare-dashboard-graylog.png b/products/fundamentals/src/content/static/images/graylog/dashboards/reliability-cloudflare-dashboard-graylog.png
new file mode 100755
index 00000000000..81e64b191c2
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/dashboards/reliability-cloudflare-dashboard-graylog.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/dashboards/security-cloudflare-dashboard-graylog.png b/products/fundamentals/src/content/static/images/graylog/dashboards/security-cloudflare-dashboard-graylog.png
new file mode 100755
index 00000000000..3a1d6a25f11
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/dashboards/security-cloudflare-dashboard-graylog.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/dashboards/snapshot-cloudflare-dashboard-graylog.png b/products/fundamentals/src/content/static/images/graylog/dashboards/snapshot-cloudflare-dashboard-graylog.png
new file mode 100755
index 00000000000..54bcb1b5328
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/dashboards/snapshot-cloudflare-dashboard-graylog.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/screenshots/aws-s3-add-trigger.png b/products/fundamentals/src/content/static/images/graylog/screenshots/aws-s3-add-trigger.png
new file mode 100755
index 00000000000..badefbfaf81
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/screenshots/aws-s3-add-trigger.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-pack-install.png b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-pack-install.png
new file mode 100755
index 00000000000..c92055d2f0e
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-pack-install.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs-uploaded.png b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs-uploaded.png
new file mode 100755
index 00000000000..c5d3007b6ac
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs-uploaded.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs.png b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs.png
new file mode 100755
index 00000000000..4cb70188511
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-content-packs.png differ
diff --git a/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-environment-variables.png b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-environment-variables.png
new file mode 100755
index 00000000000..629d8d03093
Binary files /dev/null and b/products/fundamentals/src/content/static/images/graylog/screenshots/graylog-environment-variables.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/bot-management-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/bot-management-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..4a5f3a4ccf6
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/bot-management-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/origin-requests-per-hostname-ssl-connection-client-http-request-content-type-cloudflare-performnance-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/origin-requests-per-hostname-ssl-connection-client-http-request-content-type-cloudflare-performnance-dashboard-looker.png
new file mode 100644
index 00000000000..d299a884ace
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/origin-requests-per-hostname-ssl-connection-client-http-request-content-type-cloudflare-performnance-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/performance-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/performance-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..5870080aff0
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/performance-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/rate-limiting-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/rate-limiting-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..c4460046161
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/rate-limiting-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/reliability-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/reliability-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..f0df8334dce
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/reliability-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/security-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/security-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..85a5ac56adc
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/security-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/snapshot-cloudflare-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/snapshot-cloudflare-dashboard-looker.png
new file mode 100644
index 00000000000..7822f8dc869
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/snapshot-cloudflare-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/static-vs-dynami-and-slowest-urls-cloudflare-performance-looker-dashboard.png b/products/fundamentals/src/content/static/images/looker/dashboards/static-vs-dynami-and-slowest-urls-cloudflare-performance-looker-dashboard.png
new file mode 100644
index 00000000000..abe508e7e26
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/static-vs-dynami-and-slowest-urls-cloudflare-performance-looker-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/dashboards/waf-cloudflare-security-dashboard-looker.png b/products/fundamentals/src/content/static/images/looker/dashboards/waf-cloudflare-security-dashboard-looker.png
new file mode 100644
index 00000000000..f4266df0528
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/dashboards/waf-cloudflare-security-dashboard-looker.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/screenshots/cloudflare-looker-dashboard-filters.png b/products/fundamentals/src/content/static/images/looker/screenshots/cloudflare-looker-dashboard-filters.png
new file mode 100644
index 00000000000..9d96a95d21c
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/screenshots/cloudflare-looker-dashboard-filters.png differ
diff --git a/products/fundamentals/src/content/static/images/looker/screenshots/develop-look-ml-project.png b/products/fundamentals/src/content/static/images/looker/screenshots/develop-look-ml-project.png
new file mode 100644
index 00000000000..510094e99cd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/looker/screenshots/develop-look-ml-project.png differ
diff --git a/products/fundamentals/src/content/static/images/notifications/start.png b/products/fundamentals/src/content/static/images/notifications/start.png
new file mode 100644
index 00000000000..706f4fa1168
Binary files /dev/null and b/products/fundamentals/src/content/static/images/notifications/start.png differ
diff --git a/products/fundamentals/src/content/static/images/notifications/webhooks.png b/products/fundamentals/src/content/static/images/notifications/webhooks.png
new file mode 100644
index 00000000000..2a7e3920548
Binary files /dev/null and b/products/fundamentals/src/content/static/images/notifications/webhooks.png differ
diff --git a/products/fundamentals/src/content/static/images/notifications/where-to-find.png b/products/fundamentals/src/content/static/images/notifications/where-to-find.png
new file mode 100644
index 00000000000..2c20839e346
Binary files /dev/null and b/products/fundamentals/src/content/static/images/notifications/where-to-find.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-bandwidth-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-bandwidth-dashboard.png
new file mode 100644
index 00000000000..51c33054428
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-bandwidth-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-hostname-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-hostname-dashboard.png
new file mode 100644
index 00000000000..fa15dd64af3
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-hostname-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-requests-and-cache-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-requests-and-cache-dashboard.png
new file mode 100644
index 00000000000..95d215b4b8a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-requests-and-cache-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-static-vs-dynamic-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-static-vs-dynamic-dashboard.png
new file mode 100644
index 00000000000..60e89ba8226
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-performance-static-vs-dynamic-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-detailed-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-detailed-dashboard.png
new file mode 100644
index 00000000000..de468399308
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-detailed-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-summary-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-summary-dashboard.png
new file mode 100644
index 00000000000..f90233cd00b
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-reliability-summary-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bot-summary-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bot-summary-dashboard.png
new file mode 100644
index 00000000000..8f7868120d0
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bot-summary-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bots-detailed-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bots-detailed-dashboard.png
new file mode 100644
index 00000000000..f9d23656865
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-bots-detailed-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-overview.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-overview.png
new file mode 100644
index 00000000000..25ed71f6536
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-overview.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-rate-limiting-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-rate-limiting-dashboard.png
new file mode 100644
index 00000000000..d314e662d7a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-rate-limiting-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-waf-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-waf-dashboard.png
new file mode 100644
index 00000000000..ffc2cac257c
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-security-waf-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-dashboard.png
new file mode 100644
index 00000000000..6fe7ba54ddd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-web-traffic-types-dashboard.png b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-web-traffic-types-dashboard.png
new file mode 100644
index 00000000000..172ba47ec87
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/dashboards/splunk-cloudflare-snapshot-web-traffic-types-dashboard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-add-aws-info-to-configuration.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-add-aws-info-to-configuration.png
new file mode 100644
index 00000000000..9c298dfb629
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-add-aws-info-to-configuration.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-addon-for-aws.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-addon-for-aws.png
new file mode 100644
index 00000000000..133bb1f46e0
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-addon-for-aws.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up-enable-data-model-acceleration.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up-enable-data-model-acceleration.png
new file mode 100644
index 00000000000..cca7355740a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up-enable-data-model-acceleration.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up.png
new file mode 100644
index 00000000000..8bd3f013453
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-aws-s3-update-source-to-cloudflare-json.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-aws-s3-update-source-to-cloudflare-json.png
new file mode 100644
index 00000000000..bcc618c991c
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-aws-s3-update-source-to-cloudflare-json.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk-search-logs.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk-search-logs.png
new file mode 100644
index 00000000000..7d8eab2ed6a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk-search-logs.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk.png
new file mode 100644
index 00000000000..dac14c621a3
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-data-model-calculated-fields.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-data-model-calculated-fields.png
new file mode 100644
index 00000000000..7018d131039
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-cloudflare-data-model-calculated-fields.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-configure-cloudflare-index-app-wizard.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-configure-cloudflare-index-app-wizard.png
new file mode 100644
index 00000000000..6596893c8b5
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-configure-cloudflare-index-app-wizard.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-index-cloudflare.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-index-cloudflare.png
new file mode 100644
index 00000000000..196de9ae1d2
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-index-cloudflare.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-input-generic-s3.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-input-generic-s3.png
new file mode 100644
index 00000000000..53eda0c4126
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-create-new-input-generic-s3.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-input-aws-s3-source-type-cloudflare-json.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-input-aws-s3-source-type-cloudflare-json.png
new file mode 100644
index 00000000000..617225a3a75
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-input-aws-s3-source-type-cloudflare-json.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-models-cloudflare.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-models-cloudflare.png
new file mode 100644
index 00000000000..5cb015ff355
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-data-models-cloudflare.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-filters.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-filters.png
new file mode 100644
index 00000000000..3ea74f9574d
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-filters.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-generic-s3-fill-out-cloudflare-data.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-generic-s3-fill-out-cloudflare-data.png
new file mode 100644
index 00000000000..93ef804f224
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-generic-s3-fill-out-cloudflare-data.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-advanced-search-search-macros.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-advanced-search-search-macros.png
new file mode 100644
index 00000000000..e9d69ac839b
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-advanced-search-search-macros.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-indexes.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-indexes.png
new file mode 100644
index 00000000000..30af589d585
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-indexes.png differ
diff --git a/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-inputs-aws-s3.png b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-inputs-aws-s3.png
new file mode 100644
index 00000000000..3d0c44a7b8e
Binary files /dev/null and b/products/fundamentals/src/content/static/images/splunk/screenshots/splunk-settings-data-inputs-aws-s3.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-hostname-content-type-request-methods-connection-type-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-hostname-content-type-request-methods-connection-type-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..b2f840e9b15
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-hostname-content-type-request-methods-connection-type-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-requests-bandwidth-cache-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-requests-bandwidth-cache-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..e5bcd3aff36
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-requests-bandwidth-cache-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-static-vs-dynamic-content-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-static-vs-dynamic-content-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..e5c2ab9a389
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-performance-static-vs-dynamic-content-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-reliability-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-reliability-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..c92cd2447a4
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-reliability-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-bot-management-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-bot-management-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..0431bf6d39e
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-bot-management-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-overview-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-overview-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..229eaaa36de
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-overview-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-rate-limiting-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-rate-limiting-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..71030399872
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-rate-limiting-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-waf-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-waf-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..568b9ef82dd
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-security-waf-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-snapshot-dashboard-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-snapshot-dashboard-sumo-logic.png
new file mode 100644
index 00000000000..fab7fbb922d
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/dashboards/cloudflare-snapshot-dashboard-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/add-to-library-cloudflare-sumo-logic-app.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/add-to-library-cloudflare-sumo-logic-app.png
new file mode 100644
index 00000000000..8c7279295f7
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/add-to-library-cloudflare-sumo-logic-app.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/cloudflare-app-sumo-logic-app-catalog.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/cloudflare-app-sumo-logic-app-catalog.png
new file mode 100644
index 00000000000..53dc906809d
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/cloudflare-app-sumo-logic-app-catalog.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/exclude_Workers-sumo_logic.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/exclude_Workers-sumo_logic.png
new file mode 100644
index 00000000000..07a646a49f8
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/exclude_Workers-sumo_logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/filter-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/filter-sumo-logic.png
new file mode 100644
index 00000000000..7ccbc5df507
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/filter-sumo-logic.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-1st.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-1st.png
new file mode 100644
index 00000000000..47949dca20c
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-1st.png differ
diff --git a/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-logic.png b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-logic.png
new file mode 100644
index 00000000000..5c9fad8464a
Binary files /dev/null and b/products/fundamentals/src/content/static/images/sumo-logic/screenshots/timestamp-format-sumo-logic.png differ
diff --git a/products/fundamentals/wrangler.toml b/products/fundamentals/wrangler.toml
index 433a03f3622..a34610daabf 100644
--- a/products/fundamentals/wrangler.toml
+++ b/products/fundamentals/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/fundamentals*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "f94b44348e8440c397dda6696a9a864f" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/gateway/README.md b/products/gateway/README.md
deleted file mode 100644
index c89f69aa806..00000000000
--- a/products/gateway/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Cloudflare Gateway docs
-
-[View docs →](https://developers.cloudflare.com/gateway)
-
-[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
diff --git a/products/gateway/docs-config.js b/products/gateway/docs-config.js
deleted file mode 100644
index 4ee8db7eed0..00000000000
--- a/products/gateway/docs-config.js
+++ /dev/null
@@ -1,25 +0,0 @@
-module.exports = {
-  product: "Gateway",
-  pathPrefix: "/gateway",
-  productIconKey: "gateway",
-  contentRepo: "cloudflare/cloudflare-docs",
-  contentRepoFolder: "products/gateway",
-  externalLinks: [
-    {
-      title: "Cloudflare homepage",
-      url: "https://cloudflare.com"
-    }
-  ],
-  search: {
-    indexName: "developers-cloudflare",
-    apiKey: "b23088ab4d346409f9d3ece6606344c3",
-    algoliaOptions: { 'facetFilters': '["project:gateway"]'}
-  },
-  siteMetadata: {
-    title: "Cloudflare Gateway docs",
-    description: "Cloudflare Gateway protects enterprises, their devices, their networks and their data by securing every connection without compromising performance.",
-    author: "@cloudflare",
-    url: "https://developers.cloudflare.com/gateway",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
-  }
-}
diff --git a/products/gateway/src/content/about/how-gateway-works.md b/products/gateway/src/content/about/how-gateway-works.md
deleted file mode 100644
index 5d6d2b1a5e6..00000000000
--- a/products/gateway/src/content/about/how-gateway-works.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-order: 0
----
-
-# How Cloudflare Gateway Works
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-
-![How Gateway Works](../static/how-does-gw-work-background.png)
-
-## Secure DNS
-
-Cloudflare Gateway's secure DNS filtering service sits between a device and the Internet and filters traffic at the DNS layer.
-
-The primary difference between 1.1.1.1 and Gateway’s secure DNS filtering is that 1.1.1.1 does not block any DNS queries. When a browser performs a DNS query for a domain, the 1.1.1.1 public DNS resolver simply looks up the answer for the DNS query either in cache or by performing a full recursive query.
-
-Cloudflare Gateway's DNS resolver adds an additional step to introduce security into this flow. Instead of allowing all DNS queries, Gateway first checks the hostname being queried against the intelligence Cloudflare has about threats on the Internet. If that query matches a known threat or a blocked content category configured by an administrator, Gateway stops it before the site loads for the user - and potentially executes code or phishes that team member.
-
-For example, if you are using Cloudflare Gateway, and send a DNS query to `example.com`:
-1. Gateway checks if the DNS query is coming from your location.
-2. If it is coming from your location, Gateway checks if `example.com` matches any of the policies you have set up. The policy could consist of domains that you are blocking with a custom list imported to Cloudflare Gateway in addition to broader security or content categories that you enabled.
-3. If `example.com` matches a policy configuration, Cloudflare Gateway will block access to the domain.
-
-### DNS over HTTPS
-
-You can use **cloudflared** to setup your device and start sending DNS queries to Gateway in an encrypted fashion. It will also support other DNS over HTTPS clients, as long as you can change the hostname in your preferred DNS over HTTPS client. Here’s how DNS over HTTPS for Cloudflare Gateway works:
-
-![How Encrypted DNS Works](../static/encrypted-dns-gateway.png)
-
-The DNS over HTTPS client encrypts the DNS request and sends it to the closest Cloudflare’s data center. Upon receiving the encrypted DNS request, it will decrypt it and send it to Cloudflare Gateway. Cloudflare Gateway will log the request, apply the required security policies, and return the response to our edge. Our edge will encrypt the response and send it back to the DNS over HTTPS client.
-
-By encrypting your DNS queries you will make sure that ISPs cannot snoop on your DNS queries, and at the same time you will be able to filter DNS requests that are malicious.
-
-### DNS over TLS
-
-Gateway also supports DNS-over-TLS encryption. This enables you to apply security policies for clients that don’t support DNS-over-HTTPS. The DNS client on a device that talks to the DNS resolver initiates a TLS connection with the resolver. Then, it establishes a TCP connection with `cloudflare-dns.com:853`, and initiates a TLS handshake.
-In the TLS handshake, `cloudflare-dns.com` presents its TLS certificate. Once the TLS connection is established, the DNS client can send DNS over an encrypted connection, preventing eavesdropping and tampering.
-
-All DNS queries sent over the TLS connection must comply with specifications of sending DNS over TCP.
-
-## L7 Cloud Firewall
-
-Cloudflare Gateway includes a Layer 7 (L7) firewall that allows our customers to apply security and content policies to HTTP traffic. Users connect to Gateway with the Cloudflare for Teams client, which sends all internet-bound traffic from a user’s device to the Cloudflare Gateway. Administrators configure both DNS and HTTP policies--DNS policies are enforced at the Gateway DNS filtering service within the recursive resolver, and HTTP policies are enforced at the L7 firewall within the HTTP forward proxy.
-
-This provides administrators the ability to enforce policies across all applications at the DNS layer but also at a more granular level within HTTP sessions. It also gives our administrators greater control over where their data resides. By building policies, customers can specify whether to allow or block a request based on file type, on whether the request was to upload or download a file, or on whether the destination is an approved cloud storage provider for the organization.
-
-Enterprises protect their users’ internet traffic wherever they are by connecting to Cloudflare with the Cloudflare for Teams client. This client uses the same WARP application under the hood, and by enrolling a user and device in a Gateway organization, administrators can both protect users wherever they are and receive visibility into each user’s DNS and HTTP activity captured in Gateway logs.
-
-In addition to DNS filtering, Cloudflare Gateway now supports HTTP traffic filtering based on a variety of criteria including:
-
-| Criteria                          | Example
-| -------------                     |:-------------:
-| URL, path, and/or query string    | https://www.myurl.com/path?query
-| HTTP method                       | GET, POST, etc.
-| HTTP response code                | 500
-| File type and file name           | myfilename.zip
-| MIME type                         | application/zip
-| URL security or content category  | Malware, phishing, adult themes
-
-For more information on types, see the [references section.](/reference/)
diff --git a/products/gateway/src/content/about/index.md b/products/gateway/src/content/about/index.md
deleted file mode 100644
index 3252e42af5b..00000000000
--- a/products/gateway/src/content/about/index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-order: 1
-hidden: true
----
-
-# About
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
diff --git a/products/gateway/src/content/connecting-to-gateway/Installing the Cloudflare Certificate.md b/products/gateway/src/content/connecting-to-gateway/Installing the Cloudflare Certificate.md
deleted file mode 100644
index 865ba7c7b18..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/Installing the Cloudflare Certificate.md	
+++ /dev/null
@@ -1,162 +0,0 @@
----
-order: 0
-hidden: true
----
-
-# Install the Cloudflare Root Certificate
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Advanced security features including HTTPS traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all of your devices, these steps will need to be performed on each new device that is to be subject to HTTP Filtering.
-
-## Download the Cloudflare root certificate
-The Cloudflare certificate can be downloaded [from this location](../static/Cloudflare_CA.crt)
-
-### Verify the certificate fingerprint
-
-To verify your download, check that the certificates thumbprint matches:
-
-#### SHA1
-`BB:2D:B6:3D:6B:DE:DA:06:4E:CA:CB:40:F6:F2:61:40:B7:10:F0:6C`
-
-#### SHA256
-`F5:E1:56:C4:89:78:77:AD:79:3A:1E:83:FA:77:83:F1:9C:B0:C6:1B:58:2C:2F:50:11:B3:37:72:7C:62:3D:EF`
-
-## Add certificate to your system
-
-### MacOS
-
-#### Before starting
-Installing a certificate in Keychain in macOS requires consideration of which users to affect. macOS offers three options to install the certificate in Keychain with each having a different impact on which users are impacted by trusting the root certificate.
-
-| Key Chain   | Impact                  |
-|-------------|-------------------------|
-| Login       | The logged on user      |
-| Local Items | Cached iCloud passwords |
-| System      | All users on the system |
-
-Installing the certificate in Login will result in only the logged in user trusting the Cloudflare certificate. Installing in System affects all users who use that machine.
-
-1. Download the Cloudflare certificate [at this location](../static/Cloudflare_CA.crt)
-
-2. **Double-click** on the .crt file.
-
-3. The certificate is now listed in the **Keychain Access** application.
-
-![Keychain](../static/listed-in-keychain.png)
-
-4. **Double-click**  on the certificate and then click on **Trust**.
-
-![Keychain](../static/cert-click-on-trust.png)\
-
-5. Select **Always Trust** from the drop-down menu for **When using this certificate**.\
-
-![Always trust](../static/cert-select-always-trust.png)
-
-6. Close the menu.
-
-### iOS
-
-1. Download the Cloudflare certificate [at this location](../static/Cloudflare_CA.crt)
-
-The device will show a message: "This website is trying to open Settings to how you a configuration profile. Do you want to allow this?"
-
-![iOS download](../static/ios_cert_download.png)
-
-2. Tap **Allow**
-
-3. Navigate to Settings > General > Profile and find the "Cloudflare for Teams ECC Certificate Authority" profile.
-
-![iOS profile](../static/ios_cert_profile.png)
-
-4. Tap Install
-
-5. If the iOS device has a passcode set, the device will prompt you to enter it. Enter the passcode.
-
-6. A certificate warning will be displayed. Tap Install. If a second prompt is displayed, tap Install again.
-
-6. The Profile Installed screen is displayed. Tap Done.
-
-Before the certificate can be used as intended, it must be trusted by the device.
-
-7. On the device, go to Settings > General > About > Certificate Trust Settings.
-
-The installed Root Certificates will be displayed in a section entitled "Enable Full Trust for Root Certificates."
-
-![iOS cert trust](../static/ios_cert_trust1.png)
-
-There is a slide button next to each certificate.
-
-Tap the slide button next to the Cloudflare certificate you just installed. A confirmation dialogue will be displayed.
-
-![iOS cert confirm](../static/ios_cert_trust2.png)
-
-8. Tap Continue.
-
-### Windows
-
-#### Before starting
-Installing a certificate in Windows requires consideration of which users to affect. Windows offers two options to install the certificate with each having a different impact on which users are impacted by trusting the root certificate.
-
-| Store Location      | Impact                  |
-|---------------------|-------------------------|
-| Current User Store  | The logged on user      |
-| Local Machine Store | All users on the system |
-
-1. Download the Cloudflare certificate [at this location](../static/Cloudflare_CA.crt)
-
-2. Right-click on the certificate file, and choose Open. You may see a Security Warning window. If so, choose Open.
-
-3. The Certificate window will appear. Click Install Certificate
-
-![Windows install cert](../static/windows_install_cert.png)
-
-4. Choose a Store Location and click Next.
-
-5. On the next screen, click Browse. Choose the Trusted Root Certification Authorities store. Click OK.
-
-![Windows cert location](../static/windows_cert_location.png)
-
-6. Click Finish.
-
-![Windows cert install complete](../static/windows_cert_install_finished.png)
-
-### Android
-
-1. Download the Cloudflare certificate [at this location](../static/Cloudflare_CA.crt)
-
-2. Navigate to the Settings menu.
-
-3. Select Security.
-
-![Android settings](../static/android_security_settings.png)
-
-4. Click Advanced and then Click Encryption & Credentials
-
-![Android encrypt settings](../static/android_advanced_encrypt.png)\
-
-![Android cred settings](../static/android_advanced_encrypt2.png)\
-
-5. Click Install Certificate
-
-![Android install cert](../static/android_install_cert.png)
-
-6. Click CA certificate
-
-![Android ca cert](../static/android_ca_cert.png)
-
-7. Click "Install Anyway"
-
-![Android install anyway](../static/android_install_anyway.png)
-
-8. Verify it is you w/ Fingerprint or Pin
-
-9. Choose the certificate you want to install. I have our default filename in the pictures, I can take this again if you want to call it something else.
-
-![Android choose cert](../static/android_choose_certificate.png)
-
-10. You have completed the Android certificate installation.
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/Troubleshooting.md b/products/gateway/src/content/connecting-to-gateway/Troubleshooting.md
deleted file mode 100644
index dfc3c87d933..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/Troubleshooting.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-order: 10
----
-
-# Troubleshooting
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-### I receive an untrusted certificate warnings for every page and I am unable to browse the internet.
-
-Advanced security features including HTTPS traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all of your devices, these steps will need to be performed on each new device that is to be subject to HTTP Filtering.
-
-To install the Cloudflare root certificate, follow the steps [found here](/connecting-to-gateway/install-cloudflare-cert).
-
-### Even though I installed the Cloudflare certificate on my system, mobile applications warn of an invalid certificate.
-
-The mobile application may leverage certificate pinning. This is a security mechanism used to prevent man-in-the-middle (MITM) attacks on the internet by hardcoding information about the certificate that the application expects to receive. If the wrong certificate is received, even if it's trusted by the system, the application will refuse to connect.
-
-Cloudflare Gateway dynamically generates a certificate for all encrypted connections in order to inspect the content of HTTP traffic. This certificate will not match the expected certificate by applications that use certificate pinning.
-
-To allow these applications to function normally, administrators can configure bypass rules to exempt traffic to hosts associated with the application from being intercepted and inspected.
-
-### I browsed to a website and received a Cloudflare Gateway error page, not a block page.
-
-![HTTP error page](../static/http-error-page.png)
-
-Cloudflare Gateway is designed to protect users by default. In the event this page is received, providing as much information as possible to the local IT administrator will be helpful as we troubleshoot with them such as:
-
-* Operating System (Windows 10, macOS 10.x, iOS 14.x)
-* Web browser (Chrome, Firefox, Safari, Edge)
-* URL of the request
-* Screenshot or copy/paste of the content from the error page
-
-We present an HTTP error page in the following cases:
-
-#### An untrusted certificate is presented from the origin to Gateway.
-
-Gateway will consider a certificate is untrusted if any of these three conditions are true:
-
-* The server certificate issuer is unknown or is not trusted by the service.
-* The server certificate is revoked and fails a CRL check (OSCP checking coming soon)
-* There is at least one expired certificate in the certificate chain for the server certificate
-
-#### Common certificate errors
-
-For example in the event of a certificate common name mismatch.
-
-#### Insecure cipher suite
-
-When the connection from Cloudflare Gateway to an upstream server is insecure (e.g, uses an insecure cipher such as rc4, rc4-md5, 3des, etc.)
-
-We do support upstream connections that require a connection over TLS that is prior to TLS 1.3. We will support the ability for an administrator to configure whether to trust insecure connections in the very near future.
-
-#### I created a bypass rule or disabled TLS interception completely and inspection seems to still be occurring.
-
-Disabling TLS interception for a previously inspected hostname requires the HTTP connection to be restarted (i.e., closing the browser) for the bypass to take effect.
-
-### Does Cloudflare have a global policy to allow, block, or bypass anything in addition to what I've configured?
-
-Cloudflare provides organizations the tools to protect themselves from advanced threats in the simplest way possible. However, we won't configure any rules without the knowledge of our customers--we'd rather make it easy for you to do so. A customer's rules are always evaluated first (and exclusively) with one exception: We have a single global rule to ensure that the Cloudflare WARP client can connect to the Cloudflare edge even in the event that the Cloudflare root certificate was not installed:
-
-```
-Selector: hostname
-Operator: is
-Value: cloudflareclient.com
-Action: bypass
-```
-
-This allows the WARP client to connect to Cloudflare and determine if the Cloudflare certificate is not present and trusted on the local device; and if not, then the client will alert the user.
-
-### I'm using a common application and it seems unable to connect when I inspect HTTP traffic or presents an untrusted certificate error.
-
-The application may use certificate pinning. This is a process used by applications to verify that the TLS certificate presented from the origin server matches a known, specified list of certificates hardcoded in the application. This is a countermeasure to man-in-the-middle attacks where an attacker presents a trusted, but false, certificate on behalf of the origin in oder to decrypt the traffic. Unfortunately, this is exactly what TLS interception in a Secure Web Gateway does although for the purposes of securing a user's web traffic.
-
-In order to accommodate applications that take advantage of certificate pinning, a bypass for the hostnames associated with the application must be configured in the Gateway L7 firewall. In the future, Gateway will provide the ability for organizations to simply select the name or type of application in order to configure rules.
-
-Some common applications that make use of certificate pinning include:
-
-<TableWrap>
-
-| Application     | FQDN               | Bypass Rules                                                                           |
-|-----------------|--------------------|----------------------------------------------------------------------------------------|
-| Signal          | whispersystems.org | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*whispersystems\.org ***Action:*** bypass |
-| Signal          | signal.org         | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*signal\.org ***Action:*** bypass         |
-| Zoom            | zoom.us            | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*zoom\.us ***Action:*** bypass            |
-| Zoom            | zoomgov.com        | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*zoomgov\.com ***Action:*** bypass        |
-| Wells Fargo App | wellsfargo.com     | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*wellsfargo\.com ***Action:*** bypass     |
-| USAA Mobile App | usaa.com           | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*usaa\.com ***Action:*** bypass           |
-| Apple/iCloud    | apple.com          | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*apple\.com ***Action:*** bypass           |
-| Apple/iCloud    | icloud.com         | ***Selector:*** hostname ***Operator:*** matches regex ***Value:*** .*icloud\.com ***Action:*** bypass           |
-
-</TableWrap>
diff --git a/products/gateway/src/content/connecting-to-gateway/index.md b/products/gateway/src/content/connecting-to-gateway/index.md
deleted file mode 100644
index aa1b7496918..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-order: 4
----
-
-# Connect to Gateway
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can secure your internet-bound traffic by connecting to Gateway in two ways:
-
-1. [With the Cloudflare WARP client](/connecting-to-gateway/with-client). You can download the latest version for your operating system, and configure the client to send DNS queries to Gateway for policy enforcement. If your subscription supports HTTP traffic filtering, you can enroll users and devices in your Gateway organization through the client, and configure L7 firewall rules to enforce HTTP policies in the L7 cloud firewall.
-
-2. [Without the Cloudflare WARP client](/connecting-to-gateway/without-client). Cloudflare Gateway supports a variety of client configurations and operating systems, as well as DNS over HTTPS. You can configure your native operating system or browser to use Cloudflare Gateway as your upstream recursive resolver for DNS policy enforcement.
diff --git a/products/gateway/src/content/connecting-to-gateway/install-cloudflare-cert.md b/products/gateway/src/content/connecting-to-gateway/install-cloudflare-cert.md
deleted file mode 100644
index 306a957ac24..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/install-cloudflare-cert.md
+++ /dev/null
@@ -1,181 +0,0 @@
----
-order: 0
----
-
-# Install the Cloudflare root certificate
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Advanced security features including HTTPS traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all of your devices, these steps will need to be performed on each new device that is to be subject to HTTP Filtering.
-
-## Download the Cloudflare root certificate
-First, download the Cloudflare certificate [from this location](../static/Cloudflare_CA.crt).
-
-### Verify the certificate fingerprint
-
-To verify your download, check that the certificate's thumbprint matches:
-
-#### SHA1
-```txt
-BB:2D:B6:3D:6B:DE:DA:06:4E:CA:CB:40:F6:F2:61:40:B7:10:F0:6C
-```
-
-#### SHA256
-```txt
-F5:E1:56:C4:89:78:77:AD:79:3A:1E:83:FA:77:83:F1:9C:B0:C6:1B:58:2C:2F:50:11:B3:37:72:7C:62:3D:EF
-```
-
-## Add the certificate to your system
-
-### MacOS
-
-#### Before you start
-You will need to install the root certificate in the Keychain Access application. In the application, you can choose the keychain in which you want to install the certificate. macOS offers three options, each having a different impact on which users will be affected by trusting the root certificate.
-
-| Keychain   | Impact                  |
-|-------------|-------------------------|
-| login       | The logged in user      |
-| Local Items | Cached iCloud passwords |
-| System      | All users on the system |
-
-Installing the certificate in the Login keychain will result in only the logged in user trusting the Cloudflare certificate. Installing it in the System keychain affects all users who have access to that machine.
-
-To install the certificate in Keychain Access:
-
-1. Download the Cloudflare certificate [here](../static/Cloudflare_CA.crt).
-
-2. Double-click on the `.crt` file.
-
-  The certificate is now listed in the **Keychain Access** application, under the **login** keychain. If you want to install it in the **System** keychain instead, drag and drop the certificate from the login keychain onto the System keychain section on the left.
-
-![Keychain](../static/listed-in-keychain.png)
-
-3. Double-click on the certificate.
-
-4. Click **Trust**.
-
-![Keychain](../static/cert-click-on-trust.png)
-
-5. From the **When using this certificate** drop-down menu, select **Always Trust**.
-
-![Always trust](../static/cert-select-always-trust.png)
-
-6. Close the menu.
-
-The root certificate is now installed and ready to be used.
-
-### iOS
-
-1. Download the Cloudflare certificate [here](../static/Cloudflare_CA.crt).
-
- The device will show a message: *This website is trying to open Settings to how you a configuration profile. Do you want to allow this?*
-
-![iOS download](../static/ios_cert_download.jpg)
-
-2. Tap **Allow**.
-
-3. Navigate to **Settings** > **General** > **Profile** and find the **Cloudflare for Teams ECC Certificate Authority** profile.
-
-![iOS profile](../static/ios_cert_profile.jpg)
-
-4. Tap **Install**. If the iOS device is passcode-protected, you will be prompted to enter the passcode.
-
-5. Next, a certificate warning will appear. Tap **Install**.
-
- If a second prompt is displayed, tap **Install** again.
-
-6. Next, the **Profile Installed** screen will appear. Tap **Done**.
-
- The certificate is now installed. However, before it can be used, it must be trusted by the device.
-
-7. On the device, go to **Settings** > **General** > **About** > **Certificate Trust Settings**.
-
- The installed root certificates will be displayed in the *Enable full trust for root certificates* section.
-
- ![iOS cert trust](../static/ios_cert_trust1.jpg)
-
-8. Tap the slide button next to the Cloudflare certificate you just installed.
-
-9. A confirmation dialogue will appear. Tap **Continue**.
-
- ![iOS cert confirm](../static/ios_cert_trust2.jpg)
-
-The root certificate is now installed and ready to be used.
-
-### Windows
-
-#### Before you start
-Windows offers two options to install the certificate, each having a different impact on which users will be affected by trusting the root certificate.
-
-| Store Location      | Impact                  |
-|---------------------|-------------------------|
-| Current User Store  | The logged in user      |
-| Local Machine Store | All users on the system |
-
-1. Download the Cloudflare certificate [here](../static/Cloudflare_CA.crt).
-
-2. Right-click on the certificate file.
-3. Click **Open**.  
- If you see a Security Warning window, click **Open**.
-
-4. The **Certificate** window will appear. Click **Install Certificate**.
-
-![Windows install cert](../static/windows_install_cert.png)
-
-5. Now choose a Store Location.
-
-6. Click **Next**.
-
-7. On the next screen, click **Browse**.
-
-8. Choose the **Trusted Root Certification Authorities** store.
-
-9. Click **OK**.
-
-![Windows cert location](../static/windows_cert_location.png)
-
-10. Click **Finish**.
-
-![Windows cert install complete](../static/windows_cert_install_finished.png)
-
-The root certificate is now installed and ready to be used.
-
-### Android
-
-1. Download the Cloudflare certificate [here](../static/Cloudflare_CA.crt).
-
-2. Navigate to the **Settings** menu.
-
-3. Select **Security**.
-
-![Android settings](../static/android_security_settings.png)
-
-4. Tap **Advanced** > **Encryption & Credentials**.
-
-![Android encrypt settings](../static/android_advanced_encrypt.png)
-
-![Android cred settings](../static/android_advanced_encrypt2.png)
-
-5. Tap **Install a certificate**.
-
-![Android install cert](../static/android_install_cert.png)
-
-6. Tap **CA certificate**.
-
-![Android ca cert](../static/android_ca_cert.png)
-
-7. Tap **Install Anyway**.
-
-![Android install anyway](../static/android_install_anyway.png)
-
-8. Verify your identity through the fingerprint, or by inserting the pin code.
-
-9. Select the certificate you want to install.
-
-![Android choose cert](../static/android_choose_certificate.png)
-
-The root certificate is now installed and ready to be used.
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/with-client/DNS/index.md b/products/gateway/src/content/connecting-to-gateway/with-client/DNS/index.md
deleted file mode 100644
index a57c2e5ae07..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/with-client/DNS/index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-order: 1
----
-
-# Configure DNS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Organizations can enforce DNS content and security policies for roaming users by sending DNS queries from the WARP client over DoH in DNS-filtering only mode. This service allows organizations to apply DNS policies by selecting a DoH subdomain from aligned to an existing location and configuring WARP clients to use this DoH subdomain.
-
-The DNS filtering policy configured for that location will be applied to WARP client DNS traffic. When the client connection toggle is enabled, only DNS traffic is sent to Cloudflare Gateway for policy enforcement--all non-DNS traffic is sent directly to the internet.
-
-![DNS only filtering](../../../static/client-dns-filtering-only.png)
-
-When DNS filtering is enabled, all other traffic will be sent directly to the Internet. Entering a DoH subdomain for an organization triggers WARP into Teams mode
-
-Learn more about configuring the DoH subdomain within the WARP client for your operating system [here](https://developers.cloudflare.com/warp-client/teams).
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/with-client/HTTP/index.md b/products/gateway/src/content/connecting-to-gateway/with-client/HTTP/index.md
deleted file mode 100644
index 8b964172048..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/with-client/HTTP/index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-order: 3
----
-
-# Connect to the L7 Firewall
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Organizations can enforce both DNS and HTTP content and security policies for roaming users by enrolling users in a Gateway organization. Teams Gateway, Teams Standard, and Teams Enterprise customers will have the ability to login with Cloudflare for Teams through the WARP client.
-
-In L7 firewall model, all traffic leaving a user's device connects to Cloudflare through the WARP connection where Gateway can apply filters. DNS Queries are sent to the DoH address for that organization.
-
-![HTTP filtering](../../../static/client-http-filtering.png)
-
-Learn more about configuring the WARP client for your operating system [here](https://developers.cloudflare.com/warp-client/teams).
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/with-client/index.md b/products/gateway/src/content/connecting-to-gateway/with-client/index.md
deleted file mode 100644
index f5e9dce8b3b..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/with-client/index.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-order: 3
----
-
-# WARP Client
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Getting Started
-The Cloudflare WARP client supports manual installs, deployment scripts, or advanced enterprise management tools, such as Microsoft Intune or Jamf.
-
-To start using Cloudflare for Teams, ensure you perform the following steps prior to configuring the WARP client to connect to your Teams organization:
-
-### Configure a device enrollment policy to allow devices to enroll in your organization
-
-1. Visit your Teams dashboard and navigate to the **Devices** page to find the Device Settings button.
-
-![Go to teams dash](../../static/go-to-teams-dashboard-devices.png)
-
-2. Click the **Device Settings** button.
-
-![Go to device settings page](../../static/go-to-device-settings-page.png)
-
-3. Configure a rule to defines who should be allowed to enroll in your Gateway organization. In this example, only users with cloudflare.com email addresses who successfully authenticate during device enrollment through the WARP client will be able to enroll in the organization. This rule prevents outsider users from sending traffic through your account and will give your organization the ability to capture user profile logs and apply profile-specific rules.
-
-### Choose a location's DoH subdomain for DNS policy enforcement via the WARP client
-
-1. Your organization has a DoH subdomain for the entire account. You can create additional subdomains for specific locations or groups, if needed.
-
-[Obtain a location DoH subdomain (previously known as a unique id)](/getting-started/troubleshooting-policies/#find-a-location-doh-subdomain)
-
-### Obtain your Cloudflare for Teams auth domain
-
-1. Visit your Teams dashboard and navigate to the **Authentication** page under **Access** to find the Auth Domain configuration section.
-
-![Configure the auth domain](../../static/go-to-auth-domain-page.png)
-
-2. Configure a unique Auth Domain for your account. This domain will be used as your Gateway organization name in the WARP client during user and device enrollment. The Auth Domain represents your organization's Teams account and is used across both Access and Gateway.
-
-## Download the Cloudflare root certificate and install it on the device
-
-If your organization plans to inspect HTTP traffic, you must download the Cloudflare for Teams certificate on any device being enrolled.
-
-To install the Cloudflare root certificate, follow the steps [found here](/connecting-to-gateway/install-cloudflare-cert).
-
-### Install the WARP client and log in with Cloudflare for Teams
-
-1. Follow [these instructions](https://developers.cloudflare.com/warp-client/teams) to install and configure the Cloudflare WARP client.
-
-### Configure clients to protect DNS and HTTP traffic
-
-Cloudflare for Teams has three available modes that can be used with the client.
-
-|Mode|Description|DNS Filtering|HTTP Filtering|
-|---|---|---|---|
-|DNS only|DoH-based filtering|Yes|No|
-|DNS with WARP+|DoH-based filtering with encrypted WARP+ traffic|Yes|No|
-|HTTP filtering|DoH-based filtering, HTTP filtering, and encrypted WARP+ traffic|Yes|Yes|
-
-[Configure DNS in the client](/connecting-to-gateway/with-client/DNS)
-
-[Configure clients to send HTTP traffic to Gateway](/connecting-to-gateway/with-client/HTTP):
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/browser.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/browser.md
deleted file mode 100644
index 772b16d646d..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/browser.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-order: 0
-hidden: true
----
-
-# Browser Setup
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Firefox
-
-With Firefox, you can send DNS queries using the DNS over HTTPS protocol.
-
-### Find a location's DoH subdomain
-
-[Obtain a location DoH subdomain (previously known as a unique id)](/getting-started/troubleshooting-policies/#find-a-location-doh-subdomain)
-
-### Set up Gateway on Firefox
-
-1. Open **Preferences** and scroll to the bottom.
-
-2. Click on **Network Settings**.
-
-3. Click on **Settings**.
-
-4. Check **Enable DNS over HTTPS**.
-
-5. Choose **Custom** from the drop-down for **Use Provider**.
-
-6. Enter `https://YOUR_UNIQUE_SUBDOMAIN.cloudflare-gateway.com/dns-query` in the **Custom** field. In place of `YOUR_UNIQUE_SUBDOMAIN`, include your **unique ID**.
-
-7. Click **OK**.
-
-8. Enter **about:config** in the address bar.
-
-9. Click on **Accept the risk!** if you see a prompt from Firefox.
-
-10. Set network.trr.bootstrapAddress to `162.159.36.5`.
-
-11. Set network.trr.mode to **3**.
-
-You should now be able to send queries through the DNS over HTTPS protocol.
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-https.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-https.md
deleted file mode 100644
index a88d9109f4c..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-https.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-order: 1
----
-
-# DNS over HTTPS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Browser
-
-### Firefox
-
-<Aside>
-
-<b>Before you start</b>. <a href="/getting-started/troubleshooting-policies/#find-a-location-doh-subdomain"> Obtain a location DoH subdomain (previously known as a unique id)</a>
-
-</Aside>
-
-With Firefox, you can send DNS queries using the DNS over HTTPS protocol.
-
-1. Open **Preferences** and scroll to the bottom.
-
-2. Click on **Network Settings**.
-
-3. Click on **Settings**.
-
-4. Check **Enable DNS over HTTPS**.
-
-5. Choose **Custom** from the drop-down for **Use Provider**.
-
-6. Enter `https://YOUR_UNIQUE_SUBDOMAIN.cloudflare-gateway.com/dns-query` in the **Custom** field. In place of `YOUR_UNIQUE_SUBDOMAIN`, include your **unique ID**.
-
-7. Click **OK**.
-
-8. Enter **about:config** in the address bar.
-
-9. Click on **Accept the risk!** if you see a prompt from Firefox.
-
-10. Set network.trr.bootstrapAddress to `162.159.36.5`.
-
-11. Set network.trr.mode to **3**.
-
-You should now be able to send queries through the DNS over HTTPS protocol.
-
-### Google Chrome / Microsoft Edge / Brave
-
-1. Open **Settings**.
-2. In your address bar, type the following and hit **Enter**:
- `chrome://flags/#dns-over-https`. This will take you to Secure DNS lookups.
-4. Click on the **Secure DNS lookups** radio button to enable DoH.
-
-Read more about [enabling DNS over HTTPS](https://www.chromium.org/developers/dns-over-https) on Chrome.
-
-### Safari
-
-As of today, Safari does not support DNS over HTTPS.
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-tls.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-tls.md
deleted file mode 100644
index 69770d51b9a..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/dns-over-tls.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-order: 2
----
-
-# DNS over TLS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-By default, DNS is sent over a plaintext connection. DNS over TLS (DoT) is a standard for encrypting DNS queries to keep them secure and private. DoT uses the same security protocol, TLS, that HTTPS websites use to encrypt and authenticate communications.
-
-Cloudflare supports DoT on standard port `853` and is compliant with [RFC7858](https://tools.ietf.org/html/rfc7858).
-
-## Configuration
-
-### Obtain your DoT hostname
-
-Each Gateway location has a unique DoT hostname. Locations and corresponding DoT hostnames have policies associated with them.
-
-1. Visit your [Teams dashboard](https://dash.teams.cloudflare.com/).
-1. Navigate to the **Locations** page to visualize your location.
-
- ![Go to teams dash](../../../static/go-to-teams-dashboard.png)
-
-1. If you have more than one location set up, you will see a list of all your locations.
-
- ![Go to locations page](../../../static/go-to-locations-page.png)
-
-3. Expand the location card for the location whose DoT hostname you'd like to retrieve.
-
- ![Expand location card](../../../static/locations-doh-dot.png)
-
-4. Get the **DoT hostname** for the location.
- 
- In the example below, the DoT hostname is: `9y65g5srsm.cloudflare-gateway.com`.
-
- ![Get unique subdomain](../../../static/locations-dot-complete.png)
-
-5. Take note of the **DoT hostname**.
-
-### Configure your DoT client
-
-Depending on your operating system, you can choose from a variety of standalone DoT clients. Alternatively, stub resolvers (e.g. BIND) support DoT natively.
-
-To configure your DoT client, use the following IP address and hostname:
-
-```text
-Hostname: DoT hostname for a chosen location (above this is 9y65g5srsm.cloudflare-gateway.com)
-IP address: 162.159.36.5
-```
-
-## Supported TLS versions
-
-Cloudflare's DNS over TLS supports TLS 1.3 and TLS 1.2.
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/index.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/index.md
deleted file mode 100644
index a60d15acc51..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-order: 0
----
-
-# Configure DNS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare Gateway supports a variety of client configurations and operating systems. It also allows you to send private, encrypted queries over both DNS over HTTPS (DoH) and DNS over TLS (DoT).
-
-- [DNS over HTTPS](/connecting-to-gateway/without-client/DNS/dns-over-https)
-- [DNS over TLS](/connecting-to-gateway/without-client/DNS/dns-over-tls)
-- [Native Operating System Integration](/connecting-to-gateway/without-client/DNS/native-os)
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/linux.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/linux.md
deleted file mode 100644
index 7cebf1795ca..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/linux.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-order: 2
-hidden: true
----
-
-# Linux
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Ubuntu
-
-### IPv4
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **Edit**.
-4. Click **IPv4**.  
-Remove any IP addresses that may already be listed.
-6. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-7. Click **Apply**.
-
-### IPv6
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **IPv6**.
-4. Add the IPv6 address from that we listed based on your location configuration
-5. Click **Apply**.
-
-## Debian
-
-### IPv4
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Press the **i** key on your keyboard to edit the document
-3. Replace the nameserver lines with:
-    * **172.64.36.1**
-    * **172.64.36.2**
-4. Press the **ESC** key on your keyboard to save and exit vim.
-5. Type `:wq`.
-
-### IPv6
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Add the IPv6 address from that we listed based on your location configuration.
-3. Press the **ESC** key on your keyboard to save and exit vim.
-4. Type `:wq`.
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/mac.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/mac.md
deleted file mode 100644
index b811ca45f71..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/mac.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-order: 1
-hidden: true
----
-
-# Mac
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## IPv4
-1. Go to **System Preferences** > **Network**.
-2. Click **Advanced**.
-3. Select the **DNS** tab, and remove any IP addresses that may be already listed.
-4. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-5. Click **OK**.
-6. Click **Apply**.
-
-## IPv6
-
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to the **Locations** tab.
-2. Expand your location by clicking on it.
-3. Note the **IPv6 address**.
-4. On your computer, go to **System Preferences** > **Network**.
-5. Click **Advanced**.
-6. Select the **DNS** tab, and remove any IP addresses that may already be listed.
-7. Add the **IPv6 address** you got from your location card.
-8. Click **OK**.
-9. Click **Apply**.
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/native-os.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/native-os.md
deleted file mode 100644
index c182a55e934..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/native-os.md
+++ /dev/null
@@ -1,101 +0,0 @@
----
-order: 3
----
-
-# Native OS
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Linux
-
-### Ubuntu
-
-#### IPv4
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **Edit**.
-4. Click **IPv4**.  
-Remove any IP addresses that may already be listed.
-6. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-7. Click **Apply**.
-
-#### IPv6
-1. Click **System** > **Preferences** > **Network Connections**.
-2. Click on the **Wireless** tab, then choose the Wi-Fi network you are currently connected to.
-3. Click **IPv6**.
-4. Add the IPv6 address from that we listed based on your location configuration
-5. Click **Apply**.
-
-### Debian
-
-#### IPv4
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Press the **i** key on your keyboard to edit the document
-3. Replace the nameserver lines with:
-    * **172.64.36.1**
-    * **172.64.36.2**
-4. Press the **ESC** key on your keyboard to save and exit vim. 
-5. Type `:wq`.
-
-### IPv6
-1. In the command line, type: `sudo vim /etc/resolv.conf`
-2. Add the IPv6 address from that we listed based on your location configuration.
-3. Press the **ESC** key on your keyboard to save and exit vim. 
-4. Type `:wq`.
-
-## Mac
-
-### IPv4
-1. Go to **System Preferences** > **Network**.
-2. Click **Advanced**.
-3. Select the **DNS** tab, and remove any IP addresses that may be already listed.
-4. Add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-5. Click **OK**.
-6. Click **Apply**.
-
-### IPv6
-
-1. On the [Teams dashboard](https://dash.teams.cloudflare.com), navigate to the **Locations** tab.
-2. Expand your location by clicking on it.
-3. Note the **IPv6 address**.
-4. On your computer, go to **System Preferences** > **Network**.
-5. Click **Advanced**.
-6. Select the **DNS** tab, and remove any IP addresses that may already be listed.
-7. Add the **IPv6 address** you got from your location card.
-8. Click **OK**.
-9. Click **Apply**.
-
-## Windows
-
-### IPv4
-1. Click on **Start** menu, then click on Control Panel.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 4**.
-7. Click **Properties**.
-8. Remove any IP addresses that may be already listed and add the following IP addresses in their place:
-    * **172.64.36.1**
-    * **172.64.36.2**
-9. Click **OK**.
-
-### IPv6
-1. Click on **Start** > **Control Panel**.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 6**.
-7. Click **Properties**.
-8. Click **Use The Following DNS Server Addresses**.
-9. Add the IPv6 address that we listed based on your location configuration
-10. Click **OK**.
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/windows.md b/products/gateway/src/content/connecting-to-gateway/without-client/DNS/windows.md
deleted file mode 100644
index 84a265856fe..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/DNS/windows.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-order: 0
-hidden: true
----
-
-# Windows
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## IPv4
-1. Click on **Start** menu, then click on Control Panel.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 4**.
-7. Click **Properties**.
-8. Remove any IP addresses that may be already listed and add the following IP addresses in their place:
-    * **172.64.36.1**
-    * **172.64.36.2**
-9. Click **OK**.
-
-## IPv6
-1. Click on **Start** > **Control Panel**.
-2. Click on **Network and Internet**.
-3. Click on **Change Adapter Settings**.
-4. Right click on the Wi-Fi network you are connected to.
-5. Click **Properties**.
-6. Select **Internet Protocol Version 6**.
-7. Click **Properties**.
-8. Click **Use The Following DNS Server Addresses**.
-9. Add the IPv6 address that we listed based on your location configuration
-10. Click **OK**.
\ No newline at end of file
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/HTTP/index.md b/products/gateway/src/content/connecting-to-gateway/without-client/HTTP/index.md
deleted file mode 100644
index 1b17716f7dc..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/HTTP/index.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-order: 3
----
-
-# Connect to the L7 Firewall
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-In the future, Cloudflare Gateway will support the ability for organizations to connect to the L7 firewall directly, without the use of the Cloudflare for Teams client, through the deployment of a PAC file. Today, organizations must connect to Cloudflare Gateway with the Teams client and the user must be enrolled in a Gateway organization with a paid subscription in order to receive protections from HTTP traffic filtering.
diff --git a/products/gateway/src/content/connecting-to-gateway/without-client/index.md b/products/gateway/src/content/connecting-to-gateway/without-client/index.md
deleted file mode 100644
index 0817c915d7c..00000000000
--- a/products/gateway/src/content/connecting-to-gateway/without-client/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-order: 6
----
-
-# Without the WARP Client
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Users can configure their operating systems or browsers to use Cloudflare Gateway for DNS policy enforcement by configuring Gateway as their upstream DNS recursive resolver. In the future, Cloudflare Gateway will support direct connections to the L7 firewall as an HTTP proxy for HTTP traffic filtering.
-
-[Configure DNS Settings](/connecting-to-gateway/without-client/DNS/)
-
-[Configure HTTP Proxy](/connecting-to-gateway/without-client/HTTP/)
diff --git a/products/gateway/src/content/faq/free-program.md b/products/gateway/src/content/faq/free-program.md
deleted file mode 100644
index 2c1cec07d4b..00000000000
--- a/products/gateway/src/content/faq/free-program.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-hidden: true
-order: 1
----
-
-# Free Program
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-We know that organizations and individuals around the world depend on Cloudflare and our network.
-
-We recognize that this emergency has put a strain on the infrastructure of companies around the world as more employees work from home. Cloudflare has made our Cloudflare for Teams platform, which helps support secure and efficient remote work, free through September 1. This offer includes Cloudflare Access, Argo Tunnel, and Cloudflare Gateway.
-
-If you are already a Cloudflare for Teams customer, we have removed the caps on usage during this emergency so you can scale to whatever number of seats you need without additional cost through September 1, 2020. If you are not yet using Cloudflare for Teams, and if you or your employer are struggling with limits on the capacity of your existing VPN or Firewall, we stand ready to help and have removed the limits on the free trials of our Access and Gateway products through September 1, 2020. Cloudflare employees around the world have volunteered to run onboarding sessions so you can get setup quickly and can ensure your business’ continuity.
-
-### Program details
-The program includes the following features:
-* Up to 3 locations
-* Unlimited security and content filters
-* The ability to assign multiple policies to one location
-* The ability to update IPs for locations
-
-As September 2nd draws closer, users will be prompted to select a paid plan. Pricing for these plans can be found [here](https://www.cloudflare.com/teams-pricing/). Teams that exceed the limit of the Teams Free plan will not be immediately downgraded; however, they will not be able to expand protection to additional users or locations from their current deployment.
\ No newline at end of file
diff --git a/products/gateway/src/content/faq/index.md b/products/gateway/src/content/faq/index.md
deleted file mode 100644
index cee81c7bbc0..00000000000
--- a/products/gateway/src/content/faq/index.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-order: 12
----
-
-# Troubleshooting and FAQ
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## I have a dynamic IP address assigned to me by my ISP. How can I still use Gateway?
-There are two ways to connect to Cloudflare Gateway: with the Cloudflare WARP client and without the client.
-
-You can filter DNS traffic without using the client by registering the source IP of your network and configuring Gateway as your upstream DNS resolver; however, if your IP address changes then Gateway will not know which policy to apply to your queries. This can be solved by using the DoH subdomain associated with the location for which you've configured a policy. When queries reach Gateway over DoH, only the DoH subdomain is used to determine which organization and policy to apply to the query--the source IP of the query is not considered. There are a several of DoH clients available for a variety of operating systems, and we recommend using cloudflared to send queries to Gateway via DoH if not using the Cloudflare WARP client. Simply install cloudflared and configure the DoH subdomain for a chosen location as the upstream resolver in cloudflared.
-
-[Install and configure cloudflared](https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy)
-
-Connecting to Gateway with the Cloudflare WARP client creates a secure connection to the Cloudflare edge and also affords you the ability to send queries to Gateway over DoH. Using the Cloudflare WARP client allows you to apply security for your users wherever they are regardless of location or source IP address.
-
-[Learn more about the Cloudflare WARP client](https://developers.cloudflare.com/warpclient/)
-
-## How can I check if Gateway is blocking a domain?
-After you blocked a domain using a policy, you can use either `dig` or `nslookup` to see if it's working.
-
-Before you test if the domain is blocked, please make sure that you are connected to a network that is associated with the location where the policy is applied.
-
-If you are using a policy to block `example.com`, you can do the following to see if Gateway is blocking `example.com`:
-
-1. Open your terminal
-
-2. Type `dig example.com` (`nslookup example.com`) if you are using Windows) and press enter
-
-3. If the Block page is **disabled** for the policy, then you should see `REFUSED` in the answer section like below
-![Blocked when block page disabled](../static/blocked-disabled.png)
-If the Block page is **enabled** for the policy, then you should see `NOERROR` in the answer section and **162.159.36.12** and **162.159.46.12** as the answers when the domain is successfully blocked.
-![Blocked when block page enabled](../static/blocked-enabled.png)
-
-## If I add a policy, how long does it take to propagate or take effect?
-It takes about 60 seconds for the policy to be updated across all of our data centers around the world.
-
-If you are still seeing responses from the DNS queries for a domain that you blocked. The answers may be cached by your browser from anywhere between 5 minutes to a few hours.
-
-## Will I see the private IP addresses in the activity log?
-No. The IP addresses are NAT-ed behind a public IP address. Activity log will only show the public Source IP address.
-
-## What is the difference between Cloudflare Gateway and 1.1.1.1?
-The primary difference between 1.1.1.1 and Cloudflare Gateway is that 1.1.1.1 does not block any DNS query. When a browser requests for example.com, 1.1.1.1 simply looks up the answer either in cache or by performing a full recursive DNS query.
-
-Cloudflare Gateway's DNS resolver adds an additional step to introduce security into this flow. Instead of allowing all DNS queries, Gateway first checks the hostname being queried against the intelligence Cloudflare has about threats on the Internet. If that query matches a known threat, or is requesting a blocked domain configured by an administrator as part of a Gateway policy, Gateway stops it before the site could load for the user - and potentially execute code or phish that team member.
-
-For example, if you are using Cloudflare Gateway, and send a DNS query to example.com, Gateway checks if the DNS query matches with any of the policies you set up earlier to block domains. The policy could be a domain that you are manually blocking or it could be part of a broader security category that you enabled. If the domain matches one of those cases, Gateway will return REFUSED. The browser will think this website does not exist. As a result, it will not take the customer to the blocked website.
-
-## Can I use a wildcard operator to block domains?
-You don’t need to use a wildcard operator to block domains. For example, if you want to block all the subdomains for `example.com` then you only have to block `example.com`. It will not only block dns requests to `example.com` but also all subdomains for `example.com`. You can read more about it on our [policies page](/reference/policy).
-
-## Does Cloudflare Gateway support IPv6 networks?
-Yes. Each location has a unique IPv6 address. You can use that IPv6 address to send DNS queries to Cloudflare Gateway.
-
-## What happens when I have multiple policies assigned to the same location?
-If you have multiple policies and both policies are applied to a single location, Gateway will arbitrarily choose one of the policies and apply them to the location.
-
-## What happens when there is no policy assigned to a location?
-Assuming the location is configured correctly, Gateway will log the DNS queries and show them in the analytics dashboard. As there are no policies assigned to the location, Gateway will not block any DNS queries.
-
-## How can I test if SafeSearch is working?
-Visit the [SafeSearch page](/getting-started/configuring-policies/safesearch) to see how you can test if SafeSearch is working.
-
-## In what order does Gateway apply the rules inside a policy?
-Visit the [Policies page](/reference/policy) to see in what order Gateway applies its rules inside a policy.
diff --git a/products/gateway/src/content/getting-started/configuring-block-page.md b/products/gateway/src/content/getting-started/configuring-block-page.md
deleted file mode 100644
index 478354bf5ef..00000000000
--- a/products/gateway/src/content/getting-started/configuring-block-page.md
+++ /dev/null
@@ -1,87 +0,0 @@
----
-order: 5
----
-
-# Configure a block page
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-When trying to visit a blocked website, users will see a default browser error page like this one:  
-
-![No block page](../static/no-block-page.png)
-
-This is because Gateway responds to any blocked domain with 0.0.0.0, and does not return the blocked domain's IP address. As a result, the browser cannot take the user to that website.
-
-However, this may be confusing for some people, as they may think that their Internet is not working.
-
-To remove this confusion, you can configure Cloudflare Gateway's block page to explain to the end user why a website is being blocked.  
-
-To enable a block page using Gateway's policy engine, you will have to follow a three-step procedure:
-
-1. **Enable** the block page.
-2. **Download** the Cloudflare certificate.
-3. **Add** the certificate to your system.
-
-## 1. Enable block page
-
-1. Navigate to the **Policies** tab in the [Teams dashboard](https://dash.teams.cloudflare.com).
-2. Find the policy for which you would like to set up a block page.
-3. Click **Edit**.
-4. Scroll down to find the **Block page** card.
-5. Toggle the **Enable** switch.
-
-![Enable block page](../static/enable-block-page.png)
-
-6. Click **Save**.
-
-Enabling block page alone will not work for HTTPS connections. When your users try to visit a blocked website, they will now see the following error:
-
-![HTTPS browser error](../static/https-browser-error.png)
-
-To fix the browser error, you need to download and add a certificate to your system.
-
-## 2. Download certificate
-1. Navigate to the **Settings** tab on your [Teams dashboard](https://dash.teams.cloudflare.com).
-1. Click on **Account**.
-1. Scroll down to find the **Certificates** card.
-1. Click on **Download**.
-
-![Download certificate](../static/update-certificates-page.png)
-
-You will now need to add the certificate to your system to ensure your web browser will use this certificate to establish HTTPS connections.
-
-## 3. Add certificate to your system
-
-1. If you are on a Mac, **double-click** on the .pem file.
-2. The certificate is now listed in the **Keychain Access** application.
-
-![Keychain](../static/listed-in-keychain.png)
-
-3. Double-click on the certificate and then click on **Trust**.
-
-![Keychain](../static/cert-click-on-trust.png)
-
-4. Select **Always Trust** from the drop-down menu for **When using this certificate**.
-
-![Always trust](../static/cert-select-always-trust.png)
-
-5. Close the menu.
-
-If your system asks for admin permission, enter your password or use your fingerprint ID to confirm the changes.
-
-### Firefox
-If you are not using Firefox, you can skip this section.
-
-Follow the instructions below to finish configuring the block page:
-
-1. Enter **about:config** in the address bar.
-1. Click on **Accept the risk!** if you see a prompt from Firefox.
-1. Set `security.enterprise_roots.enabled` to `true`.
-
-## See the block page
-When you visit a blocked website you will now see the following block page:
-![Block page](../static/cert-block-page.png)
diff --git a/products/gateway/src/content/getting-started/configuring-dns-policy.md b/products/gateway/src/content/getting-started/configuring-dns-policy.md
deleted file mode 100644
index 0ab57e2451a..00000000000
--- a/products/gateway/src/content/getting-started/configuring-dns-policy.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-order: 2
-hidden: true
----
-
-# Configure a DNS policy
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Setup your first policy
-
-1. On the Teams dashboard, navigate to the **Policies** tab.
-2. Click on **Create a policy**.
-
-![Gateway first policy](../static/dash-first-policy.png)
-
-3. Add a **policy name**.
-
-![Gateway policy name](../static/add-policy-name.png)
-
-4. In the **Assign Locations** card, specify the location(s) for which you want to enable the policy. To enable it for all your locations, click **Select all** on the top right corner of the card.  
-
-5. Navigate to **Security Threats** to choose which security categories you want to block. Click on **Block all** if you want to select all categories.
-
-6. Navigate to **Content Categories** to choose which content categories you want to block.
-
-7. Navigate to **Custom** to allow, block, or override domains. The ability to override lists of URLs and IP addresses will be released in the future.
-
-  * Click on **Add a destination**.
-
-  * From the drop-down menu, choose a **Destination Type**.
-
-    ![Gateway add destination](../static/add-a-destination.png)
-
-  * Choose whether you want to allow, block, or override the destination.
-
-  * Click on **Add to policy**.
-
-8. Click on **Save** to add the policy to your dashboard.
-
-![Gateway added policy](../static/added-policy.png)
\ No newline at end of file
diff --git a/products/gateway/src/content/getting-started/configuring-dns-policy/blocking-categories.md b/products/gateway/src/content/getting-started/configuring-dns-policy/blocking-categories.md
deleted file mode 100644
index cbe438a397f..00000000000
--- a/products/gateway/src/content/getting-started/configuring-dns-policy/blocking-categories.md
+++ /dev/null
@@ -1,93 +0,0 @@
----
-order: 2
----
-
-# Blocking categories
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare Gateway’s DNS filtering capabilities allow you to block known and potential security threats on the public internet, as well as specific categories of content. To give you more granular control over how to secure your network, Gateway also provides you with categorized security threats and content categories.
-
-You can block security threats and content categories by creating Gateway policies. Once you have configured your policies, you will be able to inspect network activity and the associated categories in your Gateway logs. 
-
-To know more about security threats and content categories, read our [Categories learning page](/reference/categories).
-
-<Aside>
-
-If you wish to block a hostname or URL that belongs to a security threat category, you need to block that category. If the security threat category is not configured as blocked, requests to that hostname or URL will appear in your Gateway logs as allowed requests.
-
-</Aside>
-
-## Block security threat categories
-
-1. Navigate to the **Policies** tab in the [Teams dashboard](https://dash.teams.cloudflare.com/).
-2. [Create a new policy](/getting-started/configuring-dns-policy), or edit an existing one.
-3. Navigate to the **Security threats** tab.
-
-![Security threats page](../../static/security-threats.png)
-
-4. Select all the security threats categories you want your policy to block.
-5. Click **Save** to finalize your changes.
-
-## Block content categories
-
-1. Navigate to the **Policies** tab in the [Teams dashboard](https://dash.teams.cloudflare.com/).
-2. [Create a new policy](/getting-started/configuring-dns-policy), or edit an existing one.
-3. Navigate to the **Content categories** tab.
-
-![Content categories page](../../static/content-categories.png)
-
-4. Select all the content categories you want your policy to block.
-5. Click **Save** to finalize your changes.
-
-## Test a policy
-
-If you are blocking a security threat or content category, you can test that the policy is working by using the **test domain** associated with each category.
-
-Once you have configured your Gateway policy to block the category, the test domain will show a block page when you attempt to visit the domain in your browser, or will return `REFUSED` when you perform `dig` using the command-line interface.
-
-### Test domains
-
-#### One-word categories
-Test domains use the following format for categories with one-word names:
-
-```NAME_OF_CATEGORY.testcategory.com```
-
-| Category | Test domain |
-| -------- | ----------- |
-| *Malware* | `malware.testcategory.com` |
-| *Phishing* | `phishing.testcategory.com` |
-| *Cryptomining* | `cryptomining.testcategory.com` |
-
-#### Multi-word categories
-If the category has multiple words in the name (e.g. *Parked & For Sale Domains*) then the test domain uses the following format:
-
-* Remove any spaces between the words
-* Replace `&` with `and`
-* All letters are lowercase
-
-| Category | Test domain |
-| -------- | ----------- |
-| *Parked & For Sale Domains* | `parkedandforsaledomains.testcategory.com` |
-| *Private IP Address* | `privateipaddress.testcategory.com` |
-| *Command and Control & Botnet* | `commandandcontrolandbotnet.testcategory.com` |
-
-#### Common test domains
-
-| Category | Test domain |
-| -------- | ----------- |
-| *Anonymizer* | `anonymizer.testcategory.com` |
-| *Command and Control & Botnet* | `commandandcontrolandbotnet.testcategory.com` |
-| *Cryptomining* | `cryptomining.testcategory.com` |
-| *Malware* | `malware.testcategory.com` |
-| *New Domains* | `newdomains.testcategory.com` |
-| *Parked & For Sale Domains* | `parkedandforsaledomains.testcategory.com` |
-| *Phishing* | `phishing.testcategory.com` |
-| *Private IP Address* | `privateipaddress.testcategory.com` |
-| *Spam* | `spam.testcategory.com` |
-| *Spyware* | `spyware.testcategory.com` |
-| *Unreachable* | `unreachable.testcategory.com` |
diff --git a/products/gateway/src/content/getting-started/configuring-dns-policy/index.md b/products/gateway/src/content/getting-started/configuring-dns-policy/index.md
deleted file mode 100644
index 3847c8f941f..00000000000
--- a/products/gateway/src/content/getting-started/configuring-dns-policy/index.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-order: 2
----
-
-# Configure a DNS policy
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Setup your first policy
-
-1. On the Teams dashboard, navigate to the **Policies** tab.
-2. Click on **Create a policy**.
-
- ![Gateway first policy](../../static/dash-first-policy.png)
-
-3. Add a **policy name**.
-
- ![Gateway policy name](../../static/add-policy-name.png)
-
-4. In the **Assign Locations** card, specify the location(s) for which you want to enable the policy. To enable it for all your locations, click **Select all** on the top right corner of the card.  
-
-5. Navigate to **Security Threats** to choose which security categories you want to block. Click on **Block all** if you want to select all categories.
-
-6. Navigate to **Content Categories** to choose which content categories you want to block.
-
-7. Navigate to **Custom** to allow, block, or override domains. The ability to override lists of URLs and IP addresses will be released in the future.
-
-  * Click on **Add a destination**.
-
-  * From the drop-down menu, choose a **Destination Type**.
-
-    ![Gateway add destination](../../static/add-a-destination.png)
-
-  * Choose whether you want to allow, block, or override the destination.
-
-  * Click on **Add to policy**.
-
-8. Click on **Save** to add the policy to your dashboard.
-
- ![Gateway added policy](../../static/added-policy.png)
\ No newline at end of file
diff --git a/products/gateway/src/content/getting-started/configuring-http-policy.md b/products/gateway/src/content/getting-started/configuring-http-policy.md
deleted file mode 100644
index 0be028d1959..00000000000
--- a/products/gateway/src/content/getting-started/configuring-http-policy.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-order: 2
----
-
-# Configure an HTTP policy
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-This feature is not available on the Teams free plan. For more information, see the [Cloudflare for Teams pricing page](https://www.cloudflare.com/teams-pricing/).
-
-</Aside>
-
-## Before you start
-
-The Cloudflare Gateway L7 firewall will intercept and inspect all HTTP and HTTPS traffic over ports 80 and 443. The inspection of HTTPS traffic requires breaking the TLS connection between the user and the origin server. Cloudflare Gateway presents a certificate to the user and securely connects to the origin on their behalf; however, this requires the Cloudflare certificate to be installed and trusted on each user's device.
-
-## Setup your first HTTP policy
-
-1. On the Teams dashboard, navigate to the **Policies** tab.
-
-2. Select the **HTTP tab**.
-
-![Gateway first http policy](../static/http-first-rule.png)
-
-3. Select **Add a Rule**.
-
-![Gateway first http policy](../static/http-add-rule.png)
-
-4. Configure the **Selector**, **Operator**, and **Value(s)** to match against.
-5. Select an **Action** to perform if the expression matches HTTP traffic.
-6. Select **Create Rule**.
-
-The rule is inserted at the bottom of the list of rules when more than one rule is present. Rules are enabled by default and take effect as soon as the rule is created.
-
-Administrators are able to create up to 50 rules in their HTTP policy.
-
-Check out the [L7 firewall reference section](/reference/policy/#l7-firewall) for more information about configuring rules and supported filtering criteria.
-
-## Enable L7 filtering
-
-In the settings (Gateway → Policies → Settings) page, click the toggle to enable filtering once clients have been deployed and certificates installed. If you do not enable filtering, your rules will not apply.
-
-Do not enable filtering without first [configuring certificates](https://developers.cloudflare.com/gateway/policies/configure-block-page/#add-certificate-to-your-system) on the devices enrolled, otherwise you will prevent those devices from connecting to the Internet.
diff --git a/products/gateway/src/content/getting-started/configuring-locations.md b/products/gateway/src/content/getting-started/configuring-locations.md
deleted file mode 100644
index b183992bc19..00000000000
--- a/products/gateway/src/content/getting-started/configuring-locations.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-order: 4
----
-
-# Configure additional locations
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-1. On the Teams dashboard, navigate to the **Locations** tab.  
-You will see the location you set up during your Gateway onboarding listed there.
-
-![Gateway Begin Setup](../static/dash-additional-location.png)
-
-2. Click on **Add a location**.
-
-3. Add a **location name** and IP address.  
-
-![Gateway Begin Setup](../static/add-location-name.png)
-
-If the location you are sending requests from is only using IPv6 or sending all DNS requests using DNS over HTTPS, click **Delete** on the right side of the IP address field, as the field is not required.
-
-4. Click on **Add location**.
-
-5. Your location will now appear in the **Locations** tab, along with the others you have setup.
-
-![Gateway Begin Setup](../static/two-locations.png)
diff --git a/products/gateway/src/content/getting-started/index.md b/products/gateway/src/content/getting-started/index.md
deleted file mode 100644
index 7cf81ed019e..00000000000
--- a/products/gateway/src/content/getting-started/index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 3
----
-
-# Getting started
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-This section includes instructions to set up Cloudflare Gateway on your [Teams dashboard](https://dash.teams.cloudflare.com), as well as on your clients. It also includes a troubleshooting section for any issues you may face.
-
-For more in-depth information on locations and policies, please visit the [Reference](/reference) section.
diff --git a/products/gateway/src/content/getting-started/onboarding-gateway.md b/products/gateway/src/content/getting-started/onboarding-gateway.md
deleted file mode 100644
index 96a05169edb..00000000000
--- a/products/gateway/src/content/getting-started/onboarding-gateway.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-order: 0
----
-
-# Set up Gateway
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-To start using Gateway, set up your first **location** and your DNS resolvers.
-
-1. Navigate to the [Cloudflare for Teams](https://www.cloudflare.com/teams) website.
-
-2. Click **Get Started**.
-
-3. Sign up for Cloudflare for Teams and click  **Create Account**.
-  If you already have a Cloudflare Account, click *Already have an account? Log in*.
-
-  You'll be redirected to the [Cloudflare for Teams dashboard](https://dash.teams.cloudflare.com/).
-
-4. Click on **Gateway** > **Begin setup**.
-
-![Gateway Begin Setup](../static/begin-setup.png)
-
-5. Click **Next**.
-
-6. You can now input a name for your first location. You will be able to change this name at any time.
-
-![Gateway First Location](../static/setup-first-location.png)
-
-7. Click **Next**.
-
-8. Follow the instructions on how to setup your DNS resolvers.
-
-![Gateway Setup DNS](../static/setup-dns.png)
-
-9. Click **Finish setup**.
-
-  This will take you to the [Teams dashboard](https://dash.teams.cloudflare.com), where you can start customizing your location, or you can add your first [DNS](https://developers.cloudflare.com/gateway/getting-started/configuring-dns-policy) or [HTTP policy](https://developers.cloudflare.com/gateway/getting-started/configuring-http-policy).
diff --git a/products/gateway/src/content/getting-started/safesearch.md b/products/gateway/src/content/getting-started/safesearch.md
deleted file mode 100644
index d53cd028fd4..00000000000
--- a/products/gateway/src/content/getting-started/safesearch.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-order: 6
----
-
-# Enable SafeSearch
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-SafeSearch is a feature of search engines that can help you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children, you or at work.
-
-You can use Cloudflare Gateway to enable SafeSearch on search engines like Google, Bing, Yandex, YouTube and DuckDuckGo.
-
-To enable SafeSearch for Cloudflare Gateway, follow the steps below:
-
-1. Navigate to the **Policies** tab. If you don't have a policy, create one following [these instructions](/getting-started/configuring-dns-policy).
-
-2. Navigate to the **Overview** tab.
-
-3. Scroll down to see the **SafeSearch** card.
-
-4. Enable the switch inside the **SafeSearch** card.
-
-![SafeSearch Card](../static/safesearch-card.png)
-
-5. Hit **Save**.
-
-## Test SafeSearch
-You can test if SafeSearch is working by performing dig on the search engines. Instead of returning the regular IP address, you should see the CNAMEs returned like below:
-
-### Google
-Google will return `forcesafesearch.google.com`.
-
-![SafeSearch Google](../static/google-safesearch.png)
-
-### YouTube
-YouTube will return `restrict.youtube.com`.
-
-![SafeSearch Youtube](../static/youtube-safesearch.png)
-
-### Bing
-Bing will return `strict.bing.com`.
-
-![SafeSearch Bing](../static/bing-safesearch.png)
-
-### DuckDuckGo
-DuckDuckGo will return `safe.duckduckgo.com`.
-
-![SafeSearch DuckDuckGo](../static/duckduckgo-safesearch.png)
diff --git a/products/gateway/src/content/getting-started/troubleshooting-policies.md b/products/gateway/src/content/getting-started/troubleshooting-policies.md
deleted file mode 100644
index 0f8bea33d02..00000000000
--- a/products/gateway/src/content/getting-started/troubleshooting-policies.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-order: 6
----
-
-# Troubleshooting
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Locations
-
-### Find a location DoH Subdomain
-DoH subdomains (previously known as a unique id) are aligned to locations. Locations and corresponding DoH subdomains have policies associated with them.
-
-1. Visit your Teams dashboard to fetch the **DoH subdomain** from your location.
-Navigate to the **Locations** page to visualize your location.
-
-![Go to teams dash](../static/go-to-teams-dashboard.png)
-
-2. If you have more than one location set up, you will see a list of all your locations.
-
-![Go to locations page](../static/go-to-locations-page.png)
-
-3. Expand the location card for the location which you'd like to retrieve the corresponding DoH subdomain.
-
-![Expand location card](../static/locations-doh-dot.png)
-
-4. Get the subdomain of the DNS over HTTPS hostname (previously known as a unique ID). In the example below, the ID is: `9y65g5srsm`.
-
-5. Take note of the **DoH subdomain**.
-
-![Get unique subdomain](../static/locations-doh.png)
-
-### Your source IPv4 address is taken
-![Source IP taken](../static/source-ip-taken.png)
-If you are seeing this, you may be connected to a network where someone else in the same network signed up for Cloudflare Gateway before you did.
-
-If your network supports IPv6, you can still use Cloudflare Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client.
-
-## Analytics
-
-### You are not seeing analytics on the Overview page
-![Overview empty](../static/gateway-dash-overview-empty.png)
-
-You may not see analytics on the Overview page for the following reasons:
-
-##### 1. You are not sending DNS queries to Gateway
-Verify that the destination IP addresses you are sending DNS queries to are correct. You can check the destination IP addresses for your location by going to your locations page and then expanding the location:
-
-![Location With Destinations](../static/expanded-location-with-destinations.png)
-
-##### 2. You are using other DNS resolvers
-If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
-
-##### 3. The source IPv4 address for your location is incorrect
-If you are using IPv4, check the source IPv4 address that you entered for the location matches with the network's source IPv4 address.
-
-##### 4. Analytics is not available yet
-It takes some time to generate the analytics for Cloudflare Gateway. If you are not seeing anything even after 5 minutes, please file a support ticket.
-
-## Policies
-
-### You added a domain to the block list but you can still resolve it
-
-#### 1. Policy update is still in progress
-After you update your policy, Cloudflare updates the new setting across all of our data centers around the world. It takes about 60 seconds to update the policy when you make a change.
-
-#### 2. DNS records are cached
-If it takes longer than 60 seconds and you are still seeing that you can successfully resolve a domain then the DNS record is probably getting cached in your browser or in your operating system. DNS records for domains can be cached from anywhere between five minutes to a few hours. Here is how you can flush the DNS cache in your browser and/or your operating system:
-
-##### Mac OSX 10.9 and Later
-
-1. Launch the Terminal application
-2. Run the following command and hit enter:
-`sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`
-
-##### Mac OSX 10.8 and Earlier
-
-1. Launch Terminal (under Applications/Utilities)
-2. Run the following command and hit enter:
-`sudo killall -HUP mDNSResponder`
-
-##### Windows
-
-1. Right-click Command Prompt and select Run as Administrator.
-2. Run the following command and hit enter:
-`ipconfig /flushdns`
-
-##### Linux
-
-1. Open a terminal window.
-2. Run the following command and hit enter:
-`sudo service network-manager restart`
-
-##### Safari
-
-Use the instructions in the Mac section to flush the DNS cache for Safari.
-
-##### Google Chrome
-
-1. In a new tab, type the following into the address bar and hit enter: `chrome://net-internals/#dns`
-2. Click the button labeled "clear host cache"
-
-##### Firefox
-
-1. Type `about:config` in Firefox’s address bar and acknowledge the warning that appears
-2. Find an entry called `network.dnsCacheExpiration` and set its value to `0` (If there’s no such entry, create a new integer item with the name above and a value of 0)
-3. Now go back and change the value to `3600`
-
-#### 3. Your device using another DNS resolver
-If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. As a result, the domain you are trying to block is still accessible from your device. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
-
-#### 4. The policy is not assigned to a location
-If your policy is not assigned to a location and you send a DNS query from that location, Gateway will not apply that policy. Assign a policy to a location to make sure the desired policy is applied when you send a DNS query from that location.
\ No newline at end of file
diff --git a/products/gateway/src/content/glossary/index.md b/products/gateway/src/content/glossary/index.md
deleted file mode 100644
index d24f9ae8a17..00000000000
--- a/products/gateway/src/content/glossary/index.md
+++ /dev/null
@@ -1,260 +0,0 @@
----
-order: 200
----
-
-# Glossary
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## [Cloudflare for Teams](https://www.cloudflare.com/teams-home/)
-Cloudflare for Teams brings the power of Cloudflare’s global network to your internal teams and infrastructure. Teams empowers users with secure, fast and seamless access to any device on the Internet.
-
-## [Cloudflare Access](https://developers.cloudflare.com/access/)
-Cloudflare Access replaces corporate VPNs with Cloudflare’s network. Instead of placing internal tools on a private network, customers deploy them in any environment, including hybrid or multi-cloud models, and secure them consistently with Cloudflare’s network.
-
-## [Cloudflare Gateway](https://developers.cloudflare.com/gateway/)
-Cloudflare Gateway is a modern next generation firewall between your user, device or network and the public Internet. Once you setup Cloudflare Gateway, Gateway's DNS filtering service will inspect all Internet bound DNS queries, log them and apply corresponding policies.
-
-## [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/)
-A secure outbound connection which runs in your infrastructure to connect the applications and machines to Cloudflare.
-
-## [Cloudflare Workers](https://developers.cloudflare.com/workers/)
-Cloudflare Workers provides a serverless execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure.
-
----------------
-
-## Access App Launch
-The Access App Launch portal provides end users with a single dashboard from which they can open applications secured by Access.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Active zone
-A DNS zone is a portion of the DNS namespace that is managed by a specific organization or administrator. For a domain to be active on Cloudflare, its nameservers need to be changed to Cloudflare's.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Application (Access)
-
-The resource being protected by Cloudflare Access. An application can be a subdomain, a path, or a SaaS application.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Auth Domain
-The unique subdomain assigned to your Cloudflare account; for example, https://example.cloudflareaccess.com
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Authenticated Origin Pulls
-
-Authenticated Origin Pulls let origin web servers validate that a web request came from Cloudflare. Cloudflare uses TLS client certificate authentication, a feature supported by most web servers, to present a Cloudflare certificate when establishing a connection between Cloudflare and the origin web server.
-
-| Related products: | [Cloudflare SSL](https://developers.cloudflare.com/ssl/) |
-|---|---|
-
-## cloudflared
-
-`cloudflared` is the software that powers Argo Tunnel. `cloudflared` runs alongside origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## daemon
-A program that performs tasks without active management or maintenance.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## DoH
-*DNS over HTTPS*
-
-With DoH, DNS queries and responses are encrypted, and they are sent via the HTTP or HTTP/2 protocols. Like [DoT](#DoT), DoH ensures that attackers can't forge or alter DNS traffic. DoH traffic looks like other HTTPS traffic – e.g. normal user-driven interactions with websites and web apps – from a network administrator's perspective.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## DNS filtering
-
-DNS filtering is the process of using the Domain Name System to block malicious websites and filter out harmful or inappropriate content. This ensures that company data remains secure and allows companies to have control over what their employees can access on company-managed networks. DNS filtering is often part of a larger access control strategy.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## DNS server
-
-Each device connected to the Internet has a unique IP address which other machines use to find the device. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## DoT
-*DNS over TLS*
-
-DNS over TLS, or DoT, is a standard for encrypting DNS queries to keep them secure and private. DoT uses the same security protocol, TLS, that HTTPS websites use to encrypt and authenticate communications. (TLS is also known as "SSL.") DoT adds TLS encryption on top of the user datagram protocol (UDP), which is used for DNS queries. Additionally, it ensures that DNS requests and responses are not tampered with or forged via on-path attacks.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## hostname
-The name given to a server or node on a network. In most cases, the public DNS name of a server.
-
-## IdP
-*identity provider*
-
-An identity provider (IdP or IDP) stores and manages users' digital identities. Think of an IdP as being like a guest list, but for digital and cloud-hosted applications instead of an event. An IdP may check user identities via username-password combinations and other factors, or it may simply provide a list of user identities that another service provider (like an SSO) checks.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## JWT
-*JSON web token*
-
-An open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Location
-Locations are physical entities like offices, homes, retail stores, movie theatres or a data center.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## mTLS
-*mutual TLS*
-
-Mutual TLS is a common security practice that uses client TLS certificates to provide an additional layer of protection, allowing to cryptographically verify the client information.
-
-## Next-generation firewall
-A next-generation firewall (NGFW) is more powerful than a traditional firewall. NGFWs have the capabilities of traditional firewalls, but they also have a host of added features to address a greater variety of organizational needs. NGFWs can run either in the cloud or on-premises.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## OAuth
-OAuth is a technical standard for authorizing users. It is a protocol for passing authorization from one service to another without sharing the actual user credentials, such as a username and password. With OAuth, a user can sign in on one platform and then be authorized to perform actions and view data on another platform.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## OpenID Connect
-
-A simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. (From: [source](https://openid.net/connect/))
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Origin certificate
-
-Cloudflare Origin Certificates are free SSL certificates issued by Cloudflare for installation on your origin server to facilitate end-to-end encryption for your visitors using HTTPS.
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## Policy
-**Gateway**: a set of rules determining which domains, content categories, or domain categories are allowed through Gateway.
-**Access**: a set of rules determining which users are allowed to access an application through Access.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## RDP
-*Remote Desktop Protocol*
-
-A protocol, or technical standard, for using a desktop computer remotely. RDP was initially released by Microsoft and is available for most Windows operating systems, but it can be used with Mac operating systems too.
-
-## SafeSearch
-
-A feature of search engines that can help you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children, you or at work.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## SAML
-*Security Assertion Markup Language*
-
-A standardized way to tell external applications and services that a user is who they say they are. SAML makes single sign-on ([SSO](#SSO)) technology possible by providing a way to authenticate a user once and then communicate that authentication to multiple applications.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SASE
-*Secure Access Service Edge*
-
-A cloud-based security model which bundles software-defined networking with network security functions and delivers them from a single service provider. SASE packages software-defined wide area networking (SD-WAN) capabilities with other network security functions (like secure web gateways, Zero Trust network access, firewall-as-a-service, and cloud access security brokers) and is delivered from and managed on a single cloud platform.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## seat
-A unique user who authenticates to connect to an application protected by Cloudflare Access, or to use a Gateway service.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) | [Access](https://developers.cloudflare.com/access/) |
-|---|---|---|
-
-## service token
-Service tokens consist of an ID and Secret generated by Cloudflare Access that can be used by an automated system or application to reach an application protected by Cloudflare Access. Service tokens allow systems to authenticate without identity provider credentials in an automated way.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SIEM
-*Security Information and Event Management*
-
-Security Information and Event Management (SIEM) solutions provide an analysis layer for logs generated by other systems.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SMB
-*Server Message Block*
-
-A network file sharing protocol that allows applications on a computer to read and write to files and to request services from server programs in a computer network. (From: [source](https://docs.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview))
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SSH
-*Secure SHell protocol*
-
-Secure Shell (SSH) protocol allows users to connect to infrastructure to perform activities like remote command execution.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## SSO
-A technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Terraform
-[Terraform](https://www.terraform.io/) is a tool for building, changing, and versioning infrastructure, and provides components and documentation for building Cloudflare resources.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
-
-## Tunnel certificate
-The Argo Tunnel software, `cloudflared`, generates a certificate when you login with your Cloudflare account. The certificate consists of a [service token](#service-token) and [origin certificate](#origin-certificate).
-
-| Related products: | [Argo Tunnel](https://developers.cloudflare.com/argo-tunnel/) |
-|---|---|
-
-## WARP/WARP+
-WARP is a mobile app designed for everyone. It uses Cloudflare's global network to secure all of your phone’s Internet traffic WARP automatically adds encryption from your device to the edge of Cloudflare’s network.
-
-| Related products: | [Gateway](https://developers.cloudflare.com/gateway/) |
-|---|---|
-
-## Zero Trust Security
-An IT security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter. No single specific technology is associated with zero trust architecture; it is a holistic approach to network security that incorporates several different principles and technologies.
-
-| Related products: | [Access](https://developers.cloudflare.com/access/) |
-|---|---|
diff --git a/products/gateway/src/content/how-gateway-works.md b/products/gateway/src/content/how-gateway-works.md
deleted file mode 100644
index 98b7c39ae78..00000000000
--- a/products/gateway/src/content/how-gateway-works.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-order: 1
----
-
-
-# How Gateway works
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-![How Gateway Works](../content/static/how-does-gw-work-background.png)
-
-## Secure DNS
-
-Cloudflare Gateway's secure DNS filtering service sits between a device and the Internet and filters traffic at the DNS layer.
-
-The primary difference between 1.1.1.1 and Gateway’s secure DNS filtering is that 1.1.1.1 does not block any DNS queries. When a browser performs a DNS query for a domain, the 1.1.1.1 public DNS resolver simply looks up the answer for the DNS query either in cache or by performing a full recursive query.
-
-Cloudflare Gateway's DNS resolver adds an additional step to introduce security into this flow. Instead of allowing all DNS queries, Gateway first checks the hostname being queried against the intelligence Cloudflare has about threats on the Internet. If that query matches a known threat or a blocked content category configured by an administrator, Gateway stops it before the site loads for the user - and potentially executes code or phishes that team member.
-
-For example, if you are using Cloudflare Gateway, and send a DNS query to `example.com`:
-1. Gateway checks if the DNS query is coming from your location.
-2. If it is coming from your location, Gateway checks if `example.com` matches any of the policies you have set up. The policy could consist of domains that you are blocking with a custom list imported to Cloudflare Gateway in addition to broader security or content categories that you enabled.
-3. If `example.com` matches a policy configuration, Cloudflare Gateway will block access to the domain.
-
-### DNS over HTTPS
-
-Gateway currently supports DNS over HTTPS (DoH), and will also support DNS over TLS in the future. You can use **cloudflared** to setup your device and start sending DNS queries to Gateway in an encrypted fashion. It will also support other DNS over HTTPS clients, as long as you can change the hostname in your preferred DNS over HTTPS client. Here’s how DNS over HTTPS for Cloudflare Gateway works:
-
-![How Encrypted DNS Works](../content/static/encrypted-dns-gateway.png)
-
-The DNS over HTTPS client encrypts the DNS request and sends it to the closest Cloudflare’s data center. Upon receiving the encrypted DNS request, it will decrypt it and send it to Cloudflare Gateway. Cloudflare Gateway will log the request, apply the required security policies, and return the response to our edge. Our edge will encrypt the response and send it back to the DNS over HTTPS client.
-
-By encrypting your DNS queries you will make sure that ISPs cannot snoop on your DNS queries, and at the same time you will be able to filter DNS requests that are malicious.
-
-## L7 Cloud Firewall
-
-Cloudflare Gateway includes a Layer 7 (L7) firewall that allows our customers to apply security and content policies to HTTP traffic. Users connect to Gateway with the Cloudflare for Teams client, which sends all internet-bound traffic from a user’s device to the Cloudflare Gateway. Administrators configure both DNS and HTTP policies--DNS policies are enforced at the Gateway DNS filtering service within the recursive resolver, and HTTP policies are enforced at the L7 firewall within the HTTP forward proxy.
-
-This provides administrators the ability to enforce policies across all applications at the DNS layer but also at a more granular level within HTTP sessions. It also gives our administrators greater control over where their data resides. By building policies, customers can specify whether to allow or block a request based on file type, on whether the request was to upload or download a file, or on whether the destination is an approved cloud storage provider for the organization.
-
-Enterprises protect their users’ internet traffic wherever they are by connecting to Cloudflare with the Cloudflare for Teams client. This client uses the same WARP application under the hood, and by enrolling a user and device in a Gateway organization, administrators can both protect users wherever they are and receive visibility into each user’s DNS and HTTP activity captured in Gateway logs.
-
-In addition to DNS filtering, Cloudflare Gateway now supports HTTP traffic filtering based on a variety of criteria including:
-
-| Criteria                          | Example
-| -------------                     |:-------------:
-| URL, path, and/or query string    | https://www.myurl.com/path?query
-| HTTP method                       | GET, POST, etc.
-| HTTP response code                | 500
-| File type and file name           | myfilename.zip
-| MIME type                         | application/zip
-| URL security or content category  | Malware, phishing, adult themes
-
-For more information on types, see the [references section.](/reference/)
diff --git a/products/gateway/src/content/index.md b/products/gateway/src/content/index.md
deleted file mode 100644
index 16346b163b2..00000000000
--- a/products/gateway/src/content/index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-order: 0
----
-
-# Welcome
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare Gateway is a modern next generation firewall — a way to ensure that your team members are protected from malware and follow your organization's policies wherever they go online. Cloudflare Gateway, part of [Cloudflare for Teams](https://www.cloudflare.com/teams-home/), protects teams from security threats without sacrificing performance.
-
-Using Cloudflare Gateway, you can protect users wherever they are from security threats on the Internet. Once you setup Cloudflare Gateway, the Gateway DNS filtering service will inspect all Internet-bound DNS queries, log them and apply corresponding policies. Enterprises can protect their users’ internet traffic and prevent corporate data loss by connecting to Cloudflare with the Cloudflare for Teams client.
-
-**Anyone and everyone can use Cloudflare Gateway**. All you need is a Cloudflare Account to get started. If you need help creating a Cloudflare Account, head to our [Help Center article](https://support.cloudflare.com/hc/articles/360027989951).
-
-Start using Cloudflare Gateway today by visiting our [Teams dashboard](https://dash.teams.cloudflare.com).
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/configuring-a-location.md b/products/gateway/src/content/locations/configuring-a-location.md
deleted file mode 100644
index a81db491a1e..00000000000
--- a/products/gateway/src/content/locations/configuring-a-location.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-order: 1
----
-
-# Configure a Location
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-import gatewayCreateLocation from '../static/gateway-create-location.gif'
-
-The only requirement for a location is its name. All other fields are optional if the location you are sending requests from is only using IPv6 or sending all DNS requests using DNS over HTTPS.
-
-<img src={gatewayCreateLocation} alt="Configuring a location" />
-
-## IPv4
-Gateway uses the public source IPv4 address of your network to identify your location, apply policies and log the DNS requests. When you go through onboarding or in our location tab, the dashboard automatically identifies the public source IP address.
-
-If you are using Gateway's paid plans, you can manually enter the IP address and netmask of your location. You can find out what public IP address you are using by connecting to the network of the location and then googling “What’s my IP address”.
-
-On your router or if you are using a device or a daemon, forward DNS queries to the following IP addresses:
-
-* **172.64.36.1**
-* **172.64.36.2**
-
-See how you can start sending DNS queries by visiting the [setup instructions](/locations/setup-instructions/)
-
-## IPv6
-When you create a location, your location will receive a unique IPv6 address. Cloudflare Gateway will identify your location based on this unique IPv6 address.
-
-On your router/device/forwarder/daemon forward DNS queries to the corresponding IPv6 address for the location.
-
-See how you can start sending DNS queries by visiting the [setup instructions](/locations/setup-instructions/)
-
-## DNS over HTTPS
-Each location has a unique hostname for DNS over HTTPS.
-
-Cloudflare Gateway will identify your location based on the DNS over HTTPS hostname.
-
-![DNS over HTTPS hostname](../static/location-with-dns-over-https-hostname.png)
-
-See how you can start sending DNS queries over HTTPS using [Firefox.](/locations/setup-instructions/firefox).
diff --git a/products/gateway/src/content/locations/index.md b/products/gateway/src/content/locations/index.md
deleted file mode 100644
index 2698a113c6f..00000000000
--- a/products/gateway/src/content/locations/index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-order: 2
-hidden: true
----
-
-# Locations
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Locations are usually physical entities like offices, homes, retail stores, movie theatres or a data centers. The fastest way to start sending DNS queries from a location and protect it from security threats is by changing the DNS resolvers at the router to the dedicated IPv6 addresses for those locations.
-
-If you don’t have IPv6 network, you can set up a location by adding the source IP for the location and changing the DNS resolvers to
-
-* **172.64.36.1**
-* **172.64.36.2**
-
-If you want to send your DNS queries over an encrypted connection, you can use the hostname that we provide in the dashboard to send queries using DNS over HTTPS.
-
-* [Configuring a location](/locations/configuring-a-location)
-* [Setup instructions](/locations/setup-instructions)
diff --git a/products/gateway/src/content/locations/match-query-to-location.md b/products/gateway/src/content/locations/match-query-to-location.md
deleted file mode 100644
index 78e87643923..00000000000
--- a/products/gateway/src/content/locations/match-query-to-location.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-order: 3
----
-
-# Determining a location
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Gateway uses different ways to match a DNS query to [locations](/locations) depending on the type of request and network. This is how Gateway determines the location of a DNS query:
-
-![Determine location](../static/gateway-determine-location-dns.png)
-
-Here is a step by step flow of how Gateway determines the location for an incoming DNS query:
-
-## Step 1: DNS over HTTPS check and lookup based on hostname
-
-Check if the DNS query is using DNS over HTTPS. If yes, lookup location by the unique hostname. If not, go to step 2.
-
-## Step 2: IPv4 check and lookup based on source IPv4 address
-
-Check if the DNS query is sent over IPv4. If yes, lookup location by the source IPv4 address. If no, go to step 3.
-
-## Step 3: Lookup based on IPv6
-
-If the query is in this step, it means that the DNS query is using IPv6. Gateway will lookup the location associated with the DNS query based on the destination IPv6 address.
diff --git a/products/gateway/src/content/locations/setup-instructions/android/index.md b/products/gateway/src/content/locations/setup-instructions/android/index.md
deleted file mode 100644
index ab0ee76c45f..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/android/index.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-order: 3
----
-
-# Android Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-* [Setup Gateway on Android](/locations/setup-instructions/android/manual)
-* [Setup Gateway on Android using an MDM](/locations/setup-instructions/android/mdm)
diff --git a/products/gateway/src/content/locations/setup-instructions/android/manual.md b/products/gateway/src/content/locations/setup-instructions/android/manual.md
deleted file mode 100644
index 88467505309..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/android/manual.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-order: 1
----
-
-# Android Setup Instructions (Manual)
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Note that if you were using 1.1.1.1 for Families in the mobile app, you will at first need to disable 1.1.1.1 for Families. You can disable it by going to `Advanced -> Connection options -> DNS Settings -> 1.1.1.1 for Families -> And select 'None'`.
-</Aside>
-
-## Install the 1.1.1.1 mobile app
-Install the 1.1.1.1 mobile app by visiting the [play store](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone) on your Android device.
-
-If you already have the app on your phone, make sure you have the latest version of the app and then skip to the next step.
-
-## Click on the menu button
-After you open the 1.1.1.1 mobile app, visit settings.
-
-## Click on Advanced
-Click on 'Advanced' which is located under the 'Account' button.
-![Click on Advanced](../../../static/android-click-on-advanced.png)
-
-## Click on Connection options
-Click on 'Connection options' which is located at the bottom of the screen right above 'Diagnostics'.
-![Click on Connection options](../../../static/android-click-on-connection-options.png)
-
-## Click on DNS Settings
-Click on 'DNS Settings'. This will take you to the screen where you can configure Gateway for your 1.1.1.1 mobile app.
-![Click on DNS Settings](../../../static/android-click-on-dns-settings.png)
-
-## Enter unique id from Gateway
-When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone.
-
-1. Visit your teams dashboard to fetch the unique id from your location.
-![Go to teams dash](../../../static/go-to-teams-dashboard.png)
-
-2. Go to locations page to see the list of locations.
-![Go to locations page](../../../static/go-to-locations-page.png)
-
-3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card.
-![Expand location card](../../../static/expand-location-card.png)
-
-4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg.
-![Get unique subdomain](../../../static/unique-gateway-id.png)
-
-5. Click on 'Gateway Unique ID'.
-![Click on guid](../../../static/android-click-on-guid.png)
-
-6. Enter the subdomain inside the field.
-![Enter unique id](../../../static/android-enter-unique-id.png)
-
-If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/android/mdm.md b/products/gateway/src/content/locations/setup-instructions/android/mdm.md
deleted file mode 100644
index 4e32dbde4b4..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/android/mdm.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-order: 2
----
-
-# Android Setup Instructions (MDM)
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Note that if you were using 1.1.1.1 for Families in the mobile app, you will at first need to disable 1.1.1.1 for Families.
-
-You can disable it by going to `Advanced -> Connection options -> DNS Settings -> 1.1.1.1 for Families -> And select 'None'`.
-</Aside>
-
-You can deploy Gateway to your corporate Android devices in bulk. Use an MDM solution to deploy your Gateway configuration to all corporate devices. If you want to learn how to use Gateway on your personal Android device please use the setup instructions from [this page](../manual/) instead.
-
-## Unique Gateway Id
-When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone.
-
-1. Visit your teams dashboard to fetch the unique id from your location.
-![Go to teams dash](../../../static/go-to-teams-dashboard.png)
-
-2. Go to locations page to see the list of locations
-![Go to locations page](../../../static/go-to-locations-page.png)
-
-3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card.
-![Expand location card](../../../static/expand-location-card.png)
-
-4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg.
-![Get unique subdomain](../../../static/unique-gateway-id.png)
-
-## Modify configuration file
-
-Create a file named `app_restrictions.xml` in your app's `res/xml` directory with the contents below:
-
-```xml
-<?xml version="1.0" encoding="utf-8"?>
-<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
-
-    <restriction
-        android:key="gateway_unique_id"
-        android:title="@string/gateway_unique_id"
-        android:restrictionType="string"
-        android:description="@string/gateway_unique_id"
-        android:defaultValue="gateway_unique_id_value" />
-
-</restrictions>
-```
-
-Open the file in a text editor and search for the id and replace the value `gateway_unique_id_value` with the unique id from the previous section.
-
-You can read more about using mdm on Android [here](https://developer.android.com/work/managed-configurations).
-
-After you save the file, use your preferred MDM tool to deploy the configuration change to your fleet of corporate mobile devices.
-
-If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/firefox.md b/products/gateway/src/content/locations/setup-instructions/firefox.md
deleted file mode 100644
index ddbba96fbf4..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/firefox.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-order: 2
----
-
-# Firefox Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-With Firefox, you can send DNS queries using the DNS over HTTPS protocol.  
-
-* Open Preferences and scroll to the bottom.
-
-* Click on Settings inside **Network Settings**.
-
-* Check **Enable DNS over HTTPS**.
-
-* Using the dropdown for **Use Provider**, choose **Custom**.
-
-* In the Custom field enter `https://YOUR_UNIQUE_SUBDOMAIN.cloudflare-gateway.com/dns-query` and click **OK**.
-
-* Enter **about:config** in the address bar.
-
-* Click on **Accept the risk!** if you see a prompt from Firefox.
-
-* Set network.trr.bootstrapAddress to `162.159.36.5`
-
-* Set network.trr.mode to **3**
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/iOS/cfteams.mobileconfig b/products/gateway/src/content/locations/setup-instructions/iOS/cfteams.mobileconfig
deleted file mode 100644
index c5f6550c395..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/iOS/cfteams.mobileconfig
+++ /dev/null
@@ -1,69 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PayloadContent</key>
-	<array>
-		<dict>
-			<key>IPv4</key>
-			<dict>
-				<key>OverridePrimary</key>
-				<integer>0</integer>
-			</dict>
-			<key>PayloadDescription</key>
-			<string>Configures VPN settings</string>
-			<key>PayloadDisplayName</key>
-			<string>VPN</string>
-			<key>PayloadIdentifier</key>
-			<string>com.apple.vpn.managed.0C1AE427-5904-41EB-BC46-2CA460B7F683</string>
-			<key>PayloadType</key>
-			<string>com.apple.vpn.managed</string>
-			<key>PayloadUUID</key>
-			<string>0C1AE427-5904-41EB-BC46-2CA460B7F683</string>
-			<key>PayloadVersion</key>
-			<integer>1</integer>
-			<key>Proxies</key>
-			<dict>
-				<key>HTTPEnable</key>
-				<integer>0</integer>
-				<key>HTTPSEnable</key>
-				<integer>0</integer>
-			</dict>
-			<key>UserDefinedName</key>
-			<string>1.1.1.1</string>
-			<key>VPN</key>
-			<dict>
-				<key>AuthName</key>
-				<string>na</string>
-				<key>AuthenticationMethod</key>
-				<string>Password</string>
-				<key>RemoteAddress</key>
-				<string>1.1.1.1</string>
-			</dict>
-			<key>VPNSubType</key>
-			<string>com.cloudflare.1dot1dot1dot1</string>
-			<key>VPNType</key>
-			<string>VPN</string>
-			<key>VendorConfig</key>
-			<dict>
-				<key>admin_installed</key>
-				<true/>
-				<key>gateway_unique_id</key>
-				<string>bt2y71kv3e</string>
-			</dict>
-		</dict>
-	</array>
-	<key>PayloadDisplayName</key>
-	<string>1.1.1.1</string>
-	<key>PayloadIdentifier</key>
-	<string>C02V5189HTDD.20DD5FEA-78C3-4E2B-BE41-A96091A734B0</string>
-	<key>PayloadRemovalDisallowed</key>
-	<false/>
-	<key>PayloadType</key>
-	<string>Configuration</string>
-	<key>PayloadUUID</key>
-	<string>8D0811D8-0CCA-4162-AC6F-DA2808A942A2</string>
-	<key>PayloadVersion</key>
-	<integer>1</integer>
-</dict>
-</plist>
diff --git a/products/gateway/src/content/locations/setup-instructions/iOS/index.md b/products/gateway/src/content/locations/setup-instructions/iOS/index.md
deleted file mode 100644
index 56d3f6a3b71..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/iOS/index.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-order: 2
----
-
-# iOS Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-* [Setup Gateway on iOS](/locations/setup-instructions/ios/manual)
-* [Setup Gateway on iOS using an MDM](/locations/setup-instructions/ios/mdm)
diff --git a/products/gateway/src/content/locations/setup-instructions/iOS/manual.md b/products/gateway/src/content/locations/setup-instructions/iOS/manual.md
deleted file mode 100644
index 51c7ee405df..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/iOS/manual.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-order: 1
----
-
-# iOS Setup Instructions (Manual)
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Note that if you were using 1.1.1.1 for Families in the mobile app, you will at first need to disable 1.1.1.1 for Families. You can disable it by going to `Advanced -> Connection options -> DNS Settings -> 1.1.1.1 for Families -> And select 'None'`.
-</Aside>
-
-## Install the 1.1.1.1 mobile app
-Install the 1.1.1.1 mobile app by visiting the [app store](https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627) on your iOS device.
-
-If you already have the app on your phone, make sure you have the latest version of the app and then skip to the next step.
-
-![Install the 1.1.1.1 mobile app](../../../static/install-one-dot-app.png)
-
-## Click on the menu button
-After you open the 1.1.1.1 mobile app, click on the menu button on the top right corner.
-![Click on the menu button](../../../static/click-on-menu.PNG)
-
-## Click on Advanced
-Click on 'Advanced' which is located under the 'Account' button.
-![Click on Advanced](../../../static/click-on-advanced.PNG)
-
-## Click on Connection options
-Click on 'Connection options' which is located at the bottom of the screen right above 'Diagnostics'.
-![Click on Connection options](../../../static/click-on-connection-options.PNG)
-
-## Click on DNS Settings
-Click on 'DNS Settings'. This will take you to the screen where you can configure Gateway for your 1.1.1.1 mobile app.
-![Click on DNS Settings](../../../static/click-on-dns-settings.PNG)
-
-## Enter unique id from Gateway
-When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone.
-
-1. Visit your teams dashboard to fetch the unique id from your location.
-![Go to teams dash](../../../static/go-to-teams-dashboard.png)
-
-2. Go to locations page to see the list of locations.
-![Go to locations page](../../../static/go-to-locations-page.png)
-
-3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card.
-![Expand location card](../../../static/expand-location-card.png)
-
-4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg.
-![Get unique subdomain](../../../static/unique-gateway-id.png)
-
-5. Enter the subdomain inside the field **GATEWAY UNIQUE ID**
-![Enter unique id](../../../static/enter-unique-id.PNG)
-
-If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/iOS/mdm.md b/products/gateway/src/content/locations/setup-instructions/iOS/mdm.md
deleted file mode 100644
index e1dcb65f74c..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/iOS/mdm.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-order: 2
----
-
-# iOS Setup Instructions (MDM)
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-Note that if you were using 1.1.1.1 for Families in the mobile app, you will at first need to disable 1.1.1.1 for Families.
-
-You can disable it by going to `Advanced -> Connection options -> DNS Settings -> 1.1.1.1 for Families -> And select 'None'`.
-</Aside>
-
-You can deploy Gateway to your corporate iOS devices in bulk. Use an MDM solution to deploy your Gateway configuration to all corporate devices. If you want to learn how to use Gateway on your personal iOS device please use the setup instructions from [this page](/locations/setup-instructions/ios/manual/) instead.
-
-## Unique Gateway Id
-When you are on this screen on your phone, you will need to enter the unique subdomain of the location you created for your mobile phone.
-
-1. Visit your teams dashboard to fetch the unique id from your location.
-![Go to teams dash](../../../static/go-to-teams-dashboard.png)
-
-2. Go to locations page to see the list of locations
-![Go to locations page](../../../static/go-to-locations-page.png)
-
-3. Expand the location card for the location you want to associate your mobile device with. If you have only one location, expand that location card.
-![Expand location card](../../../static/expand-location-card.png)
-
-4. Get the subdomain of the DNS over HTTPS hostname. This is your unique id. In the example below, this id is: fix7p31bzg.
-![Get unique subdomain](../../../static/unique-gateway-id.png)
-
-## Modify configuration file
-
-Download the configuration file from <a href="./cfteams.mobileconfig" download>here</a>
-
-The contents of the file will look like below:
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PayloadContent</key>
-	<array>
-		<dict>
-			<key>IPv4</key>
-			<dict>
-				<key>OverridePrimary</key>
-				<integer>0</integer>
-			</dict>
-			<key>PayloadDescription</key>
-			<string>Configures VPN settings</string>
-			<key>PayloadDisplayName</key>
-			<string>VPN</string>
-			<key>PayloadIdentifier</key>
-			<string>com.apple.vpn.managed.0C1AE427-5904-41EB-BC46-2CA460B7F683</string>
-			<key>PayloadType</key>
-			<string>com.apple.vpn.managed</string>
-			<key>PayloadUUID</key>
-			<string>0C1AE427-5904-41EB-BC46-2CA460B7F683</string>
-			<key>PayloadVersion</key>
-			<integer>1</integer>
-			<key>Proxies</key>
-			<dict>
-				<key>HTTPEnable</key>
-				<integer>0</integer>
-				<key>HTTPSEnable</key>
-				<integer>0</integer>
-			</dict>
-			<key>UserDefinedName</key>
-			<string>1.1.1.1</string>
-			<key>VPN</key>
-			<dict>
-				<key>AuthName</key>
-				<string>na</string>
-				<key>AuthenticationMethod</key>
-				<string>Password</string>
-				<key>RemoteAddress</key>
-				<string>1.1.1.1</string>
-			</dict>
-			<key>VPNSubType</key>
-			<string>com.cloudflare.1dot1dot1dot1</string>
-			<key>VPNType</key>
-			<string>VPN</string>
-			<key>VendorConfig</key>
-			<dict>
-				<key>admin_installed</key>
-				<true/>
-				<key>gateway_unique_id</key>
-				<string>bt2y71kv3e</string>
-			</dict>
-		</dict>
-	</array>
-	<key>PayloadDisplayName</key>
-	<string>1.1.1.1</string>
-	<key>PayloadIdentifier</key>
-	<string>C02V5189HTDD.20DD5FEA-78C3-4E2B-BE41-A96091A734B0</string>
-	<key>PayloadRemovalDisallowed</key>
-	<false/>
-	<key>PayloadType</key>
-	<string>Configuration</string>
-	<key>PayloadUUID</key>
-	<string>8D0811D8-0CCA-4162-AC6F-DA2808A942A2</string>
-	<key>PayloadVersion</key>
-	<integer>1</integer>
-</dict>
-</plist>
-```
-
-Use a texteditor to replace the string `gateway_unique_id` with the 10 character unique subdomain from the DNS over HTTPS hostname for your location that you got from the previous section. Please make sure that you don't change any other parts of the file.
-
-After you save the file, use your preferred MDM tool to deploy the configuration change to your fleet of corporate mobile devices.
-
-If 1.1.1.1 DNS, WARP or WARP+ was already enabled, the 1.1.1.1 app should be using Gateway now.
diff --git a/products/gateway/src/content/locations/setup-instructions/index.md b/products/gateway/src/content/locations/setup-instructions/index.md
deleted file mode 100644
index 5eb82b25751..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/index.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-order: 1
----
-
-# Setup instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-[Router Setup Instructions](/locations/setup-instructions/router)
-See how you can send DNS queries to Gateway from a router.
-
-[Firefox Setup Instructions](/locations/setup-instructions/firefox)
-See how you can send encrypted DNS queries to Gateway using Firefox.
-
-[Mac Setup Instructions](/locations/setup-instructions/mac)
-See how you can send DNS queries to Gateway from a Mac.
-
-[Windows Setup Instructions](/locations/setup-instructions/windows)
-See how you can send DNS queries to Gateway from Windows.
-
-[Linux Setup Instructions](/locations/setup-instructions/linux)
-See how you can send DNS queries to Gateway from a Linux Distro.
-
-[iOS Setup Instructions](/locations/setup-instructions/ios)
-See how you can send DNS queries to Gateway from an iOS device.
diff --git a/products/gateway/src/content/locations/setup-instructions/linux.md b/products/gateway/src/content/locations/setup-instructions/linux.md
deleted file mode 100644
index 1b9aa47c97c..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/linux.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-order: 4
----
-
-# Linux
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Ubuntu
-
-### IPv4
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Click Edit then click IPv4.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-* Click Apply
-
-### IPv6
-* Click System > Preferences > Network Connections.
-* Click on the Wireless tab, then choose the Wi-Fi network you are currently connected to.
-* Then go to IPv6.
-* Add the IPv6 address from that we listed based on your location configuration
-* Click Apply.
-
-## Debian
-
-### IPv4
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Replace the nameserver lines with: (Since you are using vim press the i key on your keyboard to edit the document)
-    * **172.64.36.1**
-    * **172.64.36.2**
-* Save and exit vim by pressing the ESC key on your keyboard. Then after lifting the key type `:wq`
-
-### IPv6
-* In the command line, type: `sudo vim /etc/resolv.conf`
-* Add the IPv6 address from that we listed based on your location configuration
-* Save and exit vim by pressing the ESC key on your keyboard. Then after lifting the key type `:wq`
diff --git a/products/gateway/src/content/locations/setup-instructions/mac.md b/products/gateway/src/content/locations/setup-instructions/mac.md
deleted file mode 100644
index 83250877a96..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/mac.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-order: 2
----
-
-# Mac Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## IPv4
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-* Click OK.
-* Click Apply.
-
-## IPv6
-* Go to System Preferences. You can find it by pressing Command+Space on your Mac and typing System Preferences.
-* Click on the icon called Network.
-* Click Advanced.
-* Select the DNS tab. Remove any IP addresses that may be already listed and in their place add the IPv6 address we listed based on your location configuration
-* Click OK.
-* Click Apply.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/router.md b/products/gateway/src/content/locations/setup-instructions/router.md
deleted file mode 100644
index 7efefdcb4d5..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/router.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-order: 1
----
-
-# Router Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## IPv4
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 4.
-* Click Properties.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-* Click OK.
-
-## IPv6
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 6.
-* Click Properties.
-* Click Use The Following DNS Server Addresses.
-* Add the IPv6 address from that we listed based on your location configuration
-* Click OK.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/setup-instructions/windows.md b/products/gateway/src/content/locations/setup-instructions/windows.md
deleted file mode 100644
index c42120969d7..00000000000
--- a/products/gateway/src/content/locations/setup-instructions/windows.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-order: 3
----
-
-# Windows Setup Instructions
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## IPv4
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 4.
-* Click Properties.
-* Remove any IP addresses that may be already listed and in their place add the following IP addresses:
-    * **172.64.36.1**
-    * **172.64.36.2**
-* Click OK.
-
-## IPv6
-* Click on the Start menu, then click on Control Panel.
-* Click on Network and Internet.
-* Click on Change Adapter Settings.
-* Right click on the Wi-Fi network you are connected to.
-* Click Properties.
-* Select Internet Protocol Version 6.
-* Click Properties.
-* Click Use The Following DNS Server Addresses.
-* Add the IPv6 address from that we listed based on your location configuration
-* Click OK.
\ No newline at end of file
diff --git a/products/gateway/src/content/locations/troubleshooting-locations.md b/products/gateway/src/content/locations/troubleshooting-locations.md
deleted file mode 100644
index 05c9b7ed633..00000000000
--- a/products/gateway/src/content/locations/troubleshooting-locations.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-order: 3
----
-
-# Troubleshooting Locations
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-### Your source IPv4 address is taken
-![Source IP taken](../static/source-ip-taken.png)
-You may see this if you are connected to a network where someone else in the same network signed up for Cloudflare Gateway before you did.
-
-If your network supports IPv6, you can still use Cloudflare Gateway's DNS filtering by sending DNS queries over IPv6. You can also use the DNS over HTTPS hostname to send queries using a DNS over HTTPS client.
-
-If you think someone else is wrongfully using this IPv4 address, please [let us know](https://forms.gle/MUtjTheQh24MRY2aA)
-
-### You are not seeing analytics on the Overview page
-![Overview empty](../static/gateway-dash-overview-empty.png)
-
-You may not see analytics on the Overview page for the following reasons:
-
-##### 1. You are not sending DNS queries to Gateway
-Verify that the destination IP addresses you are sending DNS queries to are correct. You can check the destination IP addresses for your location by going to your locations page and then expanding the location:
-
-![Location With Destinations](../static/expanded-location-with-destinations.png)
-
-##### 2. You are using other DNS resolvers
-If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
-
-##### 3. The source IPv4 address for your location is incorrect
-If you are using IPv4, check the source IPv4 address that you entered for the location matches with the network's source IPv4 address.
-
-##### 4. Analytics is not available yet
-It takes some time to generate the analytics for Cloudflare Gateway. If you are not seeing anything even after 5 minutes, please file a support ticket.
diff --git a/products/gateway/src/content/policies/adding-a-domain-to-the-allow-list.md b/products/gateway/src/content/policies/adding-a-domain-to-the-allow-list.md
deleted file mode 100644
index 4f66a26e193..00000000000
--- a/products/gateway/src/content/policies/adding-a-domain-to-the-allow-list.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-order: 4
----
-
-# Adding a domain to the allow list
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## Why add a domain to the Allow list
-Sometimes you may want to allow a domain when that domain belongs to a category you are blocking.
-
-For example: if you are blocking the category `Sports` and want to allow the domain `arsenal.com` (which belongs to the category), add the domain to the list of allowed domains.
-
-## Steps
-You can allow a domain by:
-
-1. Going to ‘Policies’
-
-2. Clicking on ‘Allow/Block’
-
-3. Enter the domain you want to allow in the ‘Add a domain’ field
-
-4. From the Allow/Block dropdown, select 'Allow’
-
-5. Click on the ‘Add domain’ button
\ No newline at end of file
diff --git a/products/gateway/src/content/policies/blocking-a-domain.md b/products/gateway/src/content/policies/blocking-a-domain.md
deleted file mode 100644
index 63652752b80..00000000000
--- a/products/gateway/src/content/policies/blocking-a-domain.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-order: 2
----
-
-# Blocking a Domain
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Follow the steps below to block a domain:
-
-1. Go to ‘Policies’
-
-2. Click on ‘Allow/Block’
-
-3. Enter the domain name you want to block in the ‘Add a domain’ field
-
-4. From the Allow/Block dropdown, select ‘Block’
-
-5. Click on the ‘Add domain’ button
diff --git a/products/gateway/src/content/policies/blocking-all-subdomains.md b/products/gateway/src/content/policies/blocking-all-subdomains.md
deleted file mode 100644
index f89d70de444..00000000000
--- a/products/gateway/src/content/policies/blocking-all-subdomains.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 5
----
-
-# Blocking All Subdomains
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-When you manually block a domain, you automatically block all of its subdomains. For example, if you are blocking `example.com`, our policy engine will also block a.example.com, a.b.example.com.
-
-If you only want to block a subdomain `a.example.com`, then instead of adding `example.com` to the list, you will add `a.example.com`. Note that once you add `a.example.com` to the block list, Cloudflare Gateway will also block all subdomains of `a.example.com`.
\ No newline at end of file
diff --git a/products/gateway/src/content/policies/blocking-domains-by-category.md b/products/gateway/src/content/policies/blocking-domains-by-category.md
deleted file mode 100644
index 11f48b4d40e..00000000000
--- a/products/gateway/src/content/policies/blocking-domains-by-category.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-order: 3
----
-
-# Blocking Domains by Category
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can block domains by selecting a category or multiple categories. When the requested domain matches the category you are blocking, Gateway will block that domain.
-
-![Block security threats](../static/block-security-threats-by-category.png)
-
-You can block a category of domains by:
-
-1. Going to ‘Policies’
-
-2. Clicking on either 'Security threats’ or 'Content categories'
-
-3. Select a category e.g. 'Phishing' (you can also select multiple categories)
-
-4. Click on the 'Add policy' button to add the policy
\ No newline at end of file
diff --git a/products/gateway/src/content/policies/configure-block-page.md b/products/gateway/src/content/policies/configure-block-page.md
deleted file mode 100644
index d6f02dfee63..00000000000
--- a/products/gateway/src/content/policies/configure-block-page.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-order: 3
----
-
-# Configure a Block Page
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-- [Enable a block page](#enable-a-block-page)
-- [Download certificate](#download-certificate)
-- [Add certificate to your system](#add-certificate-to-your-system)
-- [Update preferences if you are using Firefox](#firefox)
-- [See block page](#see-block-page)
-
-When you try to visit a blocked website, by default you will see a browser error like the page you see below:
-![No block page](../static/no-block-page.png)
-
-You will see this page because Gateway is not returning the IP address for the blocked domain. As a result, your browser cannot take you to that website.
-
-However, this may be confusing for some people as they may think that their Internet is not working.
-
-You can remove this confusion by show Cloudflare Gateway's block page to explain to the end user why a website is blocked.
-
-Here's how you can configure a block page using Gateway's policy engine:
-
-## Enable block page
-![Enable block page](../static/enable-block-page.png)
-
-In the policy configuration page, enable the block by toggling the switch annotated above. Hit 'Save'.
-
-Enabling block page alone will not work for HTTPS connections. Your users will see the following error now when they try to visit a blocked website:
-![HTTPS browser error](../static/https-browser-error.png)
-
-## Download certificate
-To fix the browser error, go to the Account page to download a certificate given by Cloudflare.
-
-From the account page click on 'Download' to add the certificate:
-![Download certificate](../static/update-certificates-page.png)
-
-## Add certificate to your system
-You will need to add the certificate to your system to ensure your web browser will use this certificate to establish HTTPS connections.
-
-If you are on a Mac, double click on the .pem file. You will notice that the certificate is now listed in the 'Keychain Access' application like below:
-![Keychain](../static/listed-in-keychain.png)
-
-Double click on the certificate and then click on 'Trust'
-![Keychain](../static/cert-click-on-trust.png)
-
-From the drop down menu for **When using this certificate** select ***Always Trust*** like below:
-![Always trust](../static/cert-select-always-trust.png)
-
-Now close the menu and if your system asks for admin permission enter your password or use your fingerprint ID to confirm the changes.
-
-## Firefox
-If you are not using Firefox, you can skip to the next section.
-
-Follow the instructions below to finish configuring the block page:
-
-* Enter **about:config** in the address bar
-
-* Click on **Accept the risk!** if you see a prompt from Firefox.
-
-* Set `security.enterprise_roots.enabled` to `true`
-
-## See block page
-You are now all set, and when you visit a blocked website you will see the following block page:
-![Block page](../static/cert-block-page.png)
diff --git a/products/gateway/src/content/policies/index.md b/products/gateway/src/content/policies/index.md
deleted file mode 100644
index 39ac8769cf3..00000000000
--- a/products/gateway/src/content/policies/index.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-order: 3
-hidden: true
----
-
-# Policies
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-import gatewayCreatePolicy from '../static/gateway-create-policy.gif'
-
-Cloudflare Gateway's policy engine allows you to block domains by categories, manually block domains and override domains to allow them even if those domains are getting blocked by a category. You can assign a policy to one or multiple locations.
-
-<img src={gatewayCreatePolicy} alt="create gateway policy" />
-
-[Creating L7 policies](/policies/l7-firewall)
-Follow instructions to create HTTP filtering policies in Cloudflare Gateway.
-
-[Blocking a domain](/policies/blocking-a-domain)
-See how you can block a domain using the policy engine.
-
-[Blocking domains by category](/policies/blocking-domains-by-category)
-Shows how you can block a group of domains or multiple groups of domains using category based DNS filtering.
-
-[Configuring a block page](/policies/configure-block-page) See how you can show a block page when a website is blocked by Gateway.
-
-[Adding a domain to the allow list](/policies/adding-a-domain-to-the-allow-list)
-See how you can force resolve a domain even if the domain is getting blocked by another policy.
-
-[Blocking all subdomains](/policies/blocking-all-subdomains)
-Provides examples of how you can block subdomains
-
-[Troubleshooting Policies](/policies/troubleshooting-policies)
-Check out the most common issues you may face when you are setting up a policy.
diff --git a/products/gateway/src/content/policies/order-of-operations.md b/products/gateway/src/content/policies/order-of-operations.md
deleted file mode 100644
index b04b307572d..00000000000
--- a/products/gateway/src/content/policies/order-of-operations.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-order: 6
----
-
-# Order of Operations
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-When Gateway receives a DNS query and the query matches with a policy, the policy follows the order outlined below:
-
-| Step |          Check If           |                           If Matches                      |     Else    |
-|:----:|:---------------------------:|:---------------------------------------------------------:|:-----------:|
-|  1   |  Domain is in CSAM category | Block domain, return REFUSED                              |Go to step 2 |
-|  2   |    Domain in Allow list     | Allow domain, return NOERROR with IP address of the domain|Go to step 3 |
-|  3   |    Domain in Block list     | Block domain, return REFUSED                              |Go to step 4 |
-|  4   |    Domain in SafeSearch     | Override domain, return NOERROR with safe CNAME           |Go to step 5 |
-|  5   | Domain blocked by category  | Block domain, return REFUSED                              |Go to step 6 |
-|  6   |            N/A              | Allow domain, return NOERROR with IP address of the domain|     N/A     |
-In each step, Gateway checks if the domain matches with the rule stated in the `Check If` column. If it matches with the rule, Gateway triggers the action in the `If Matches` column. If it does not match the check moves to the next step outlined in the `Else` column.
\ No newline at end of file
diff --git a/products/gateway/src/content/policies/safesearch.md b/products/gateway/src/content/policies/safesearch.md
deleted file mode 100644
index 2a4d46d1af0..00000000000
--- a/products/gateway/src/content/policies/safesearch.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-order: 6
----
-
-# Enable SafeSearch
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-SafeSearch is a feature of search engines that can help you filter explicit or offensive content. When you enable SafeSearch, the search engine filters explicit or offensive content and returns search results that are safe for children, you or at work.
-
-You can use Cloudflare Gateway to enable SafeSearch on search engines like Google, Bing, Yandex, YouTube and DuckDuckGo.
-
-## Enable SafeSearch
-You can enable SafeSearch for Gateway by following the steps below:
-![SafeSearch Card](../static/safesearch-card.png)
-
-1. Visit 'Policies'. If you don't have a policy, create one.
-
-2. Visit 'Overview' tab in the policy.
-
-3. Scroll down to see the 'SafeSearch' card
-
-4. Enable the switch inside the 'SafeSearch' card
-
-5. Hit 'Save'
-
-## Test SafeSearch
-You can test if SafeSearch is working by performing dig on the search engines. Instead of returning the regular IP address, you should see the CNAMEs returned like below:
-
-### Google
-Google will return `forcesafesearch.google.com`.
-![SafeSearch Google](../static/google-safesearch.png)
-
-### YouTube
-YouTube will return `restrict.youtube.com`.
-![SafeSearch Youtube](../static/youtube-safesearch.png)
-
-### Bing
-Bing will return `strict.bing.com`.
-![SafeSearch Bing](../static/bing-safesearch.png)
-
-### DuckDuckGo
-DuckDuckGo will return `safe.duckduckgo.com`.
-![SafeSearch DuckDuckGo](../static/duckduckgo-safesearch.png)
diff --git a/products/gateway/src/content/policies/troubleshooting-policies.md b/products/gateway/src/content/policies/troubleshooting-policies.md
deleted file mode 100644
index 0edb11dacb8..00000000000
--- a/products/gateway/src/content/policies/troubleshooting-policies.md
+++ /dev/null
@@ -1,64 +0,0 @@
----
-order: 6
----
-
-# Troubleshooting Policies
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-### You added a domain to the block list but you can still resolve it
-
-##### 1. Policy update is still in progress
-After you update your policy, Cloudflare updates the new setting across all of our datacenters around the world. It takes about 60 seconds to update the policy when you make a change.
-
-##### 2. DNS records are cached
-If it takes longer than 60 seconds and you are still seeing that you can successfully resolve a domain then the DNS record is probably getting cached in your browser or in your operating system. DNS records for domains can be cached from anywhere between five minutes to a few hours. Here is how you can flush the DNS cache in your browser and/or your operating system:
-
-###### Mac OSX 10.9 and Later
-
-1. Launch the Terminal application
-2. Run the following command and hit enter:
-`sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`
-
-###### Mac OSX 10.8 and Earlier
-
-1. Launch Terminal (under Applications/Utilities)
-2. Run the following command and hit enter:
-`sudo killall -HUP mDNSResponder`
-
-###### Windows
-
-1. Right-click Command Prompt and select Run as Administrator.
-2. Run the following command and hit enter:
-`ipconfig /flushdns`
-
-###### Linux
-
-1. Open a terminal window.
-2. Run the following command and hit enter:
-`sudo service network-manager restart`
-
-###### Safari
-
-Use the instructions in the Mac section to flush the DNS cache for Safari.
-
-###### Google Chrome
-
-1. In a new tab, type the following into the address bar and hit enter: `chrome://net-internals/#dns`
-2. Click the button labeled "clear host cache"
-
-###### Firefox
-
-1. Type `about:config` in Firefox’s address bar and acknowledge the warning that appears
-2. Find an entry called `network.dnsCacheExpiration` and set its value to `0` (If there’s no such entry, create a new integer item with the name above and a value of 0)
-3. Now go back and change the value to `3600`
-
-##### 3. Your device using another DNS resolver
-If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. As a result, the domain you are trying to block is still accessible from your device. Please make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses.
-
-##### 4. The policy is not assigned to a location
-If your policy is not assigned to a location and you send a DNS query from that location, Gateway will not apply that policy. Assign a policy to a location to make sure the desired policy is applied when you send a DNS query from that location.
diff --git a/products/gateway/src/content/privacy/index.md b/products/gateway/src/content/privacy/index.md
deleted file mode 100644
index f461e376484..00000000000
--- a/products/gateway/src/content/privacy/index.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-order: 300
----
-
-# Privacy
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## How long are Gateway logs stored by Cloudflare?
-Cloudflare Gateway logs are stored for a varying period of time based on the service used:
-
-DNS logs corresponding to DNS filtering: up to six months
-
-HTTP logs corresponding to HTTP traffic filtering: up to 30 days
-
-Teams Free users will have the visibility into the last 24 hours of DNS activity logs. Teams Standard and Enterprise users have 30 days of visibility into both DNS and HTTP activity logs.
-
-## What fields are logged for HTTP sessions if using the L7 firewall?
-
-### Request ID
-The ID of the HTTP request
-
-### Timestamp
-The timestamp of the HTTP request
-  
-### Account ID
-The Cloudflare Account Tag
-
-### User ID
-UUID of user in User Registry--this is generated by the WARP client on the device that created the request
-
-### Device ID
-UUID of device in Device Registry (the ID of the device that made the request)--this is generated by the WARP client on the device that created the request
-
-### Rule ID
-UUID of matching Gateway rule
-
-### Action
-The Gateway action taken based on the first rule that matched. For example: Allowed, Blocked, Bypass, etc.
-
-### HTTP Host
-The hostname in the HTTP header for the HTTP request
-
-### HTTP Method
-The HTTP method used for the request (e.g., GET, POST, etc.)
-
-### HTTP Version
-The HTTP version of the origin that Gateway connected to on behalf of the user
-  
-### URL
-The full URL of the HTTP request
-  
-### Referer
-The Referer request header contains the address of the page making the request
-  
-### User Agent
-The user agent header sent in the request by the originating device
-
-### Uploaded Filenames
-List of file name strings if a file upload occurred
-
-### Downloaded Filenames
-List of file name strings if a file download occurred
-  
-### Blocked Filename
-The name of the blocked file
diff --git a/products/gateway/src/content/reference/categories.md b/products/gateway/src/content/reference/categories.md
deleted file mode 100644
index 25198c1232f..00000000000
--- a/products/gateway/src/content/reference/categories.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-order: 5
----
-
-# Categories
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-Cloudflare Gateway’s DNS filtering capabilities allow you to block known and potential security threats on the public internet, as well as specific categories of content. 
-To learn more about how to block one or more categories while setting up a Gateway policy, or to learn how to test if a policy you've set up is blocking the correct categories, check our [Blocking categories page](/getting-started/configuring-dns-policy/blocking-categories).
-
-## Security threat categories
-
-| Category | Definition |
-| -------- | ---------- |
-| Anonymizer | Sites that allow users to surf the Internet anonymously. |
-| Command and Control & Botnet | Sites that are queried by compromised devices to exfiltrate information or potentially infect other devices in a network. |
-| Cryptomining | Sites that mine cryptocurrency by taking over the user's computing resources. |
-| DGA Domains | Domains detected as generated by algorithms seen in malware. |
-| DNS Tunneling | Domains with detected DNS tunneling activity. | 
-| Malware | Sites hosting malicious content and other compromised websites. |
-| New Domains | Domains that have been registered very recently. |
-| Newly Seen Domains | Domains that have recently been resolved for the first time.|
-| Phishing |Domains that are known for stealing personal information. |
-| Private IP Address | Domains that resolve to private IP Addresses.
-| Spam | Sites that are known for targeting users with unwanted sweepstakes, surveys, and advertisements. |
-| Spyware | Sites that are known to distribute or contain code that displays unwanted advertisements or that gathers user information without the user’s knowledge.|
-| Unreachable | Domains that resolve to unreachable IP addresses.|
-
-## Content categories
-
-| Category | Definition |
-| -------- | ---------- |
-|Adult Themes	|	Sites that are hosting content related to pornography, nudity, sexuality, and other adult themes.|
-|Business & Economy	|	Sites that are related to business, economy, finance, education, science and technology.|
-|Deceptive Ads	|	Sites that spoof clicks, impressions, conversions for ads.|
-|Drugs	|	Sites related to the use and promotion of illegal drugs or illegal use of prescribed drugs.|
-|Education	|	Site hosting educational content that are not included in other categories like Science, Technology or Educational institutions.|
-|Entertainment	|	Sites that are hosting entertaining content that are not included in other categories like Comic books, Audio streaming, Video streaming etc.|
-|Gambling	|	Sites that are providing online gambling or are related to gambling.|
-|Government & Politics	|	Sites related to government and politics.|
-|Health	|	Sites containing information about health and fitness.|
-|Information Technology	|	Sites related to information technology.|
-|Internet Communication	|	Sites hosting applications that are used for communication like chat, mail etc.|
-|Job Search & Careers	|	Sites that facilitate searching for jobs and careers.|
-|Login Screens	|	Sites hosting login screens that are not included in other categories.|
-|Miscellaneous	|	Sites that are not included in the listed security and content categories.|
-|No Content	|	Sites that have no content.|
-|Questionable Content	|	Sites hosting content that are related to hacking, piracy, profanity and other questionable activities.|
-|Real Estate	|	Sites related to real estate.|
-|Religion	|	Sites hosting content about religion, alternative religion, religious teachings, religious groups and spirituality.|
-|Safe for Kids	|	Sites that are safe for kids to visit.|
-|Security threats	|	Sites that contain security threats like malware, phishing, cryptomininng and other security threats.|
-|Shopping & Auctions	|	Sites that are hosting content related to ecommerce, coupons, shopping, auctions and marketplaces.|
-|Social & Family	|	Sites related to society and lifestyle.|
-|Society & Lifestyle	|	Sites hosting information about lifestyle that are not included in other categories like fashion, food & drink etc.|
-|Sports	|	Sites related to sports & recreation.|
-|Technology	|	Sites hosting information about technology that are not included in the science category.|
-|Travel	|	Sites that contain information about listings, reservations, services for travel.|
-|Vehicles	|	Sites related vehicles, automobiles, including news, reviews, and other hobbyist information.|
-|Violence	|	Sites hosting and/or promoting violent content.|
-|Weather	|	Sites related to weather.|
\ No newline at end of file
diff --git a/products/gateway/src/content/reference/index.md b/products/gateway/src/content/reference/index.md
deleted file mode 100644
index 5a0d606ad1a..00000000000
--- a/products/gateway/src/content/reference/index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 4
----
-
-# Learning
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-This section expands on Gateway features and concepts. If you want to know more about what a policy is, or how locations work, you've come to the right place. You will find definitions, explanations, and all the information you need to learn how Gateway works.
-
-For step-by-step instructions on how to configure Gateway, visit the [Getting Started](/getting-started) section.
diff --git a/products/gateway/src/content/reference/location.md b/products/gateway/src/content/reference/location.md
deleted file mode 100644
index 013b36e67a8..00000000000
--- a/products/gateway/src/content/reference/location.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-order: 2
----
-
-# Locations
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-## What is a Location?
-
-Locations are physical entities like offices, homes, retail stores, movie theaters or data centers. The fastest way to start sending DNS queries from a location and protect it from security threats is by changing the DNS resolvers at the router to the dedicated IPv6 addresses for those locations.
-
-If you don’t have IPv6 network, you can set up a location by adding the source IP for the location and changing the DNS resolvers to
-
-* **172.64.36.1**
-* **172.64.36.2**
-
-If you want to send your DNS queries over an encrypted connection, you can use the hostname that we provide in the dashboard to send queries using DNS over HTTPS. Head to the [Getting started section](/getting-started/) to learn more on how to setup a location.
-
-## How does Gateway determine the location of a DNS query?
-
-Gateway uses different ways to match a DNS query to locations depending on the type of request and network. This is how Gateway determines the location of a DNS query:
-
-![Determine location](../static/gateway-determine-location-dns.png)
-
-Here is a step by step flow of how Gateway determines the location for an incoming DNS query:
-
-### Step 1: Encrypted queries check and lookup based on hostname
-Check if the DNS query is using DNS over HTTPS or DNS over TLS. If yes, lookup location by the unique hostname. If not, go to step 2.
-
-### Step 2: IPv4 check and lookup based on source IPv4 address
-Check if the DNS query is sent over IPv4. If yes, lookup location by the source IPv4 address. If no, go to step 3.
-
-### Step 3: Lookup based on IPv6
-If the query is in this step, it means that the DNS query is using IPv6. Gateway will lookup the location associated with the DNS query based on the destination IPv6 address.
-
-## IPv4
-Gateway uses the public source IPv4 address of your network to identify your location, apply policies and log the DNS requests. When you go through onboarding, or in our location tab, the dashboard automatically identifies the public source IP address.
-
-If you are using Cloudflare Gateway as part of a Teams Gateway Enterprise or Teams Enterprise subscription, you can manually enter the IP address and netmask of your location. The IP address for the location from which you are interfacing with the Teams dashboard will populate the IP address field. Use this as a quick reference for the location or type in the public IP address and CIDR notation for the new location.
-
-On your router or if you are using a device or a daemon, forward DNS queries to the following IP addresses:
-
-* **172.64.36.1**
-* **172.64.36.2**
-
-See how you can start sending DNS queries by visiting the [Getting started](/getting-started/) section.
-
-## IPv6
-When you create a location, your location will receive a unique IPv6 address. Cloudflare Gateway will identify your location based on this unique IPv6 address.
-
-On your router/device/forwarder/daemon forward DNS queries to the corresponding IPv6 address for the location.
-
-See how you can start sending DNS queries by visiting the [Getting started](/getting-started/) section.
diff --git a/products/gateway/src/content/reference/policy.md b/products/gateway/src/content/reference/policy.md
deleted file mode 100644
index f57dfa41ae6..00000000000
--- a/products/gateway/src/content/reference/policy.md
+++ /dev/null
@@ -1,186 +0,0 @@
----
-order: 2
----
-
-# Policies
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-<Aside>
-
-For instructions on how to set up policies in the Teams dash, visit our [Getting started section](/getting-started/).
-</Aside>
-
-Gateway policies allow you to grant or deny your users access to specific domains or domain categories. If the WARP client is configured to send DNS requests over DoH to Gateway, the DNS queries are evaluated against content and security policies configured for the organization. If the domain is allowed, the client receives the DNS resolution and initiates an HTTP connection.
-
-Cloudflare Gateway currently filters HTTP traffic over port 80 and 443. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule). If the HTTP connection does not violate any policies configured by an administrator, the traffic is allowed through to the origin server.
-
-### DNS policies
-
-When a user makes a DNS request to Gateway, Gateway matches the request against the content or security categories you have set up for your organization. If the domain does not belong to any blocked categories, or if it matches an override rule, the user's client receives the DNS resolution and initiates an HTTP connection. 
-
-DNS policies can be built by doing one or more of the following:
-
-1. Selecting security threat categories you want to block.
-1. Enabling SafeSearch.
-1. Enabling YouTube Restricted Mode.
-1. Selecting content categories you want to block.
-1. Adding custom domains you want to block, allow, or override.
-
-#### Security threat categories
-
-When creating a DNS policy, you can select as many security threat categories as you want to block with the policy. This allows you to block known and potential security threats on the public Internet.
-
-#### Content categories
-
-<Aside>
-
-Sites that are classified as belonging to the **Child Abuse** category are blocked by default.
-</Aside>
-
-When creating a DNS policy, you can select as many content categories as you want to block with the policy.
-
-#### Destinations
-
-Setting a **destination** for a policy allows you to have manual control on what action to take on requests for **specific domains**.
-When setting a domain as a destination, you have the option to allow, block or override that domain.
-* **Allow**. This action forces resolving this destination and all its sub-destinations, and takes precedence over any blocked destinations.
-* **Block**. This action will block a destination and all its sub-destinations.
-* **Override**. This action will forward all requests to a given destination to another destination you can set.
-
-##### Blocking a subdomain
-
-When you manually block a domain, you automatically block all of its subdomains. For example, if you are blocking `example.com`, our policy engine will also block `a.example.com`, `a.b.example.com`.
-
-If you only want to block a subdomain `a.example.com`, then instead of adding `example.com` to the list, you will add `a.example.com`. Note that once you add `a.example.com` to the block list, Cloudflare Gateway will also block all subdomains of `a.example.com`.
-
-##### Blocking a top-level domain
-
-Just like you can choose to block a domain and all subdomains, you can block an entire top-level domain (TLD) by specifying it in a custom list. For example, if you wish to block all domains and subdomains registered as a `.net`, you would input `net` in a custom list with the *Block* action selected. 
-
-<Aside>
-
-Blocking a popular TLD like `.com` will prevent users from connecting to significant portions of the internet.
-</Aside>
-
-#### Order of operations
-
-When a DNS query matches with a DNS policy, Gateway follows this order of operations:
-
-| Step |          Check If           |                           If Matches                      |     Else    |
-|:----:|:---------------------------:|:---------------------------------------------------------:|:-----------:|
-|  1   |  Domain is in Child Abuse category | Block domain, return REFUSED                              |Go to step 2 |
-|  2   |    Domain in Allow list     | Allow domain, return NOERROR with IP address of the domain|Go to step 3 |
-|  3   |    Domain in Block list     | Block domain, return REFUSED                              |Go to step 4 |
-|  4   |    Domain in SafeSearch     | Override domain, return NOERROR with safe CNAME           |Go to step 5 |
-|  5   | Domain blocked by category  | Block domain, return REFUSED                              |Go to step 6 |
-|  6   |            N/A              | Allow domain, return NOERROR with IP address of the domain|     N/A     |
-
-### HTTP policies
-
-<Aside>
-
-This feature is only available for Gateway and Teams paid plans. For more information, see the Cloudflare for Teams [pricing page](https://www.cloudflare.com/teams-pricing/).
-
-</Aside>
-
-You can decide to add a policy to filter HTTP traffic on the L7 firewall. Gateway will intercept all HTTP and HTTPS traffic and apply the rules you have configured in your policy to either block, allow, or override specific elements such as websites, IP addresses, and file types.
-
-You can build an HTTP policy by configuring the following elements:
-
-* **Actions**
-* **Expressions**
-* **Selectors**
-* **Operators**
-
-#### Actions
-
-Just like actions on destinations in DNS policies, actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.
-
-These are the action types you can choose from:
-
-* **Allow** 
-* **Block** 
-* **Bypass**
-
-*Bypass* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occuring on both encrypted and plaintext traffic. The bypass action is only available when matching against the host criteria.
-
-#### Selectors
-Gateway matches HTTP traffic against the following selectors, or criteria:
-* **Host**
-* **URL**
-* **URL Query**
-* **URL Path**
-* **URL Path and Query**
-* **HTTP Method**
-* **HTTP Response**
-* **Uploaded and Downloaded File Extension**
-* **Uploaded and Downloaded Mime Type**
-* **Content categories**
-
-List of file extensions Gateway can match against:
-
-<TableWrap>
-
-| Image | Executable | Audio | Documents | Data | Compressed | System | Video |
-|------|------|-------|------|--------|--------|--------|-----|
-| avif | apk | m4a | doc | avro | 7z | bak | avi |
-| bmp | bat | mid | docx | csv | arj | cab | flv |
-| gif | bin | mp3 | odp | dat | bz2 | cpl | h264 |
-| ico | cgi | mpa | ods | dmg | deb | cur | m4v |
-| jpeg | com | wav | odt | iso | gz | emu | mkv |
-| png | dll | wma | pdf | json | lz | ini | mov |
-| psd | exe | ppt | | log | lz4 | scr | mp4 |
-| svg | hta | pptx | | mdb | lzh | sys | mpeg |
-| tif | jar | rtf | | nzb | lzma | tmp | wmv |
-| webp | moo | txt | | orc | pak
-|  | pif | xls | | parquet | rar
-|  | pl | xlsx | | rc | rpm
-|  | prg | | | sav | sz
-|  | | | | wasm | xz | | 
-|  |      | | | sql lite | z
-|  |      | | | tar | zip
-|  |      | | | toml | zlib |
-|  |      | | | torrent | zst |
-|  |      | | | xml |  |
-|  |      | | | yaml | | 
-
-</TableWrap>
-
-#### Operators
-Operators are the way Gateway matches traffic to a selector. Matching happens as follows:
-
-| Operator              |          Meaning
-|:---------------------:|:---------------------------:|
-|  is                   |  exact match, equals        |
-|  is not               |  all except exact match     |
-|  in                   |  in any of defined entries  |
-|  not in               |  not in defined entries     |
-|  matches regex        | regex evaluates to true         |
-|  does not match regex |  all except when regex evals to true   |
-
-#### Expressions
-Expressions are sets of conditions with which you can combine [selectors](#selectors) and [operators](#operators). By configuring one or more expressions, you can define the scope of your HTTP policy. 
-
-#### Example scenarios
-
-| Action | Selector | Operator | 
-| ------ | ---- | -------- | 
-| Block  | Content categories | in: `Gaming` | 
-
-**Result**: this configuration blocks any traffic to domains categorized as `Gaming`. 
-
-#### FAQ
-
-* **How can I bypass the L7 firewall for a website?**
-
-Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
-Bypassing the L7 firewall results in no HTTP traffic inspection and logging is disabled for that HTTP session.
-
-* **In what order are rules evaluated?**
-
-The L7 firewall evaluates rules starting with the rule containing the lowest precedence (e.g., rule number one). Rules with a higher value precedence are evaluated after those with a lower value.
diff --git a/products/gateway/src/content/reporting/activity-log.md b/products/gateway/src/content/reporting/activity-log.md
deleted file mode 100644
index 9d7e6202fe2..00000000000
--- a/products/gateway/src/content/reporting/activity-log.md
+++ /dev/null
@@ -1,89 +0,0 @@
----
-order: 2
----
-
-# Activity Log
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-The Activity log allows you to see individual DNS queries made from your locations or, for paid subscribers, HTTP requests made from WARP clients. You can use the Activity log to investigate anomalies in your network. You can search by the DNS query or HTTP request and investigate each by clicking on a row.
-
-## DNS
-![Gateway activity log](../static/teams-dash-activity-log.png)
-
-When you click on the row, you can see information related to the identity that is making the DNS request and attributes relevant to the DNS queries.
-
-![Gateway activity log expanded](../static/teams-dash-activity-log-expanded.png)
-
-### Explanation of the fields
-
-#### Request
-The name of the domain that was queried.
-
-#### Request type
-The DNS query type. [This page](https://en.wikipedia.org/wiki/List_of_DNS_record_types) contains a list of all the DNS query types.
-
-#### Action
-What Action Gateway applied. For example: Allowed, Blocked etc.
-
-#### Source IP
-The public source IP of the DNS request.
-
-#### Time
-The timestamp of the DNS query.
-
-#### Location
-The location from where the DNS query was made.
-
-#### Protocol type
-The protocol that was used to make the DNS query.
-
-#### Port
-The port that was used to make the DNS request.
-
-#### Policies
-The name of the policy if it applies to the DNS request.
-
-#### Categories
-Category or categories associated with the DNS request.
-
-## HTTP
-
-### Explanation of the fields
-
-#### Host
-The hostname in the HTTP header for the HTTP request.
-
-#### Method
-The HTTP method used for the request (e.g., GET, POST, etc.)
-
-#### Decision
-The Gateway action taken based on the first rule that matched. For example: Allowed, Blocked, Bypass, etc.
-
-#### Time
-The timestamp of the HTTP request
-
-#### URL
-The full URL of the HTTP request
-
-#### Device
-The ID of the device that made the request. This is generated by the WARP client on the device that created the request.
-
-#### Referer
-The Referer request header contains the address of the page making the request.
-
-#### User Agent
-The user agent header sent in the request by the originating device.
-
-#### File Name
-File name string if a file transfer occurred or was attempted.
-
-#### HTTP Version
-The HTTP version of the origin that Gateway connected to on behalf of the user.
-
-#### Policy Details
-The policy corresponding to the decision Gateway made based on the traffic criteria of the request.
diff --git a/products/gateway/src/content/reporting/index.md b/products/gateway/src/content/reporting/index.md
deleted file mode 100644
index 213ca6f3c1f..00000000000
--- a/products/gateway/src/content/reporting/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-order: 10
----
-
-# Analytics
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can use Cloudflare Gateway's reporting tools to see usage analytics and dns query logs.
-
-Use the [Overview page](/reporting/overview-analytics) to see the number of allowed and blocked requests, top allowed and blocked requests and top categories across all of your locations.
-
-Use the [Activity log](/reporting/activity-log) to see individual DNS queries made from your locations.
diff --git a/products/gateway/src/content/reporting/overview-analytics.md b/products/gateway/src/content/reporting/overview-analytics.md
deleted file mode 100644
index 96e64119fa5..00000000000
--- a/products/gateway/src/content/reporting/overview-analytics.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-order: 1
----
-
-# Overview Page
-
-<Aside type='warning' header='⚠️ THIS PAGE IS OUTDATED'>
-
-We're no longer maintaining this page. **It will be deleted on Feb 8, 2021**. Please visit the new [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/teams-docs-changes) instead.
-
-</Aside>
-
-You can use the Overview page to see the top allowed and blocked requests across all of your locations. You can filter the data by selecting a specific location and/or a time.
-
-- [Filter analytics by time](#filter-analytics-by-time)
-- [Filter analytics by location](#filter-analytics-by-location)
-- [View top allowed and blocked domains](#view-top-allowed-and-blocked-domains)
-- [View top allowed and blocked categories](#view-top-allowed-and-blocked-categories)
-
-![Overview analytics](../static/gateway-dash-overview-page.png)
-
-### Filter analytics by time
-You can filter the overview page by time. You can view analytics for the last 24 hours using Gateway's Free tier.
-
-![Overview filter by time](../static/gateway-dash-filter-by-time.png)
-
-### Filter analytics by location
-You can filter by the location name.
-![Overview filter by location](../static/gateway-dash-filter-by-location.png)
-
-### View top allowed and blocked domains
-You can view most seen allowed and blocked requests across your locations.
-![Overview filter by time](../static/gateway-dash-top-allowed-and-blocked-requests.png)
-
-### View top allowed and blocked categories
-You can view the top allowed and blocked categories across your locations.
-![Overview filter by time](../static/gateway-dash-top-categories.png)
\ No newline at end of file
diff --git a/products/gateway/src/content/static/Cloudflare_CA.crt b/products/gateway/src/content/static/Cloudflare_CA.crt
deleted file mode 100644
index f02f49a951f..00000000000
Binary files a/products/gateway/src/content/static/Cloudflare_CA.crt and /dev/null differ
diff --git a/products/gateway/src/content/static/adblocker-blocking-advertisements.png b/products/gateway/src/content/static/adblocker-blocking-advertisements.png
deleted file mode 100644
index eacdc8264df..00000000000
Binary files a/products/gateway/src/content/static/adblocker-blocking-advertisements.png and /dev/null differ
diff --git a/products/gateway/src/content/static/add-a-destination.png b/products/gateway/src/content/static/add-a-destination.png
deleted file mode 100644
index 0b4aa835771..00000000000
Binary files a/products/gateway/src/content/static/add-a-destination.png and /dev/null differ
diff --git a/products/gateway/src/content/static/add-location-name.png b/products/gateway/src/content/static/add-location-name.png
deleted file mode 100644
index cd3ddd4bde0..00000000000
Binary files a/products/gateway/src/content/static/add-location-name.png and /dev/null differ
diff --git a/products/gateway/src/content/static/add-policy-name.png b/products/gateway/src/content/static/add-policy-name.png
deleted file mode 100644
index 355ce738156..00000000000
Binary files a/products/gateway/src/content/static/add-policy-name.png and /dev/null differ
diff --git a/products/gateway/src/content/static/added-policy.png b/products/gateway/src/content/static/added-policy.png
deleted file mode 100644
index 18dd9df9b10..00000000000
Binary files a/products/gateway/src/content/static/added-policy.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android-click-on-advanced.png b/products/gateway/src/content/static/android-click-on-advanced.png
deleted file mode 100644
index cf95fe83b8b..00000000000
Binary files a/products/gateway/src/content/static/android-click-on-advanced.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android-click-on-connection-options.png b/products/gateway/src/content/static/android-click-on-connection-options.png
deleted file mode 100644
index a11fff0cfde..00000000000
Binary files a/products/gateway/src/content/static/android-click-on-connection-options.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android-click-on-dns-settings.png b/products/gateway/src/content/static/android-click-on-dns-settings.png
deleted file mode 100644
index 15aaaa5df8a..00000000000
Binary files a/products/gateway/src/content/static/android-click-on-dns-settings.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android-click-on-guid.png b/products/gateway/src/content/static/android-click-on-guid.png
deleted file mode 100644
index 032422a3422..00000000000
Binary files a/products/gateway/src/content/static/android-click-on-guid.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android-enter-unique-id.png b/products/gateway/src/content/static/android-enter-unique-id.png
deleted file mode 100644
index eeef2b854f5..00000000000
Binary files a/products/gateway/src/content/static/android-enter-unique-id.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_advanced_encrypt.png b/products/gateway/src/content/static/android_advanced_encrypt.png
deleted file mode 100644
index 01e5c7f8a2e..00000000000
Binary files a/products/gateway/src/content/static/android_advanced_encrypt.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_advanced_encrypt2.png b/products/gateway/src/content/static/android_advanced_encrypt2.png
deleted file mode 100644
index 2a18df9ccc2..00000000000
Binary files a/products/gateway/src/content/static/android_advanced_encrypt2.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_ca_cert.png b/products/gateway/src/content/static/android_ca_cert.png
deleted file mode 100644
index 462841d799e..00000000000
Binary files a/products/gateway/src/content/static/android_ca_cert.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_choose_certificate.png b/products/gateway/src/content/static/android_choose_certificate.png
deleted file mode 100644
index 9bc088ae687..00000000000
Binary files a/products/gateway/src/content/static/android_choose_certificate.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_install_anyway.png b/products/gateway/src/content/static/android_install_anyway.png
deleted file mode 100644
index 18555f9ef26..00000000000
Binary files a/products/gateway/src/content/static/android_install_anyway.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_install_cert.png b/products/gateway/src/content/static/android_install_cert.png
deleted file mode 100644
index 2c3d7ee7ecb..00000000000
Binary files a/products/gateway/src/content/static/android_install_cert.png and /dev/null differ
diff --git a/products/gateway/src/content/static/android_security_settings.png b/products/gateway/src/content/static/android_security_settings.png
deleted file mode 100644
index 0e5e40df019..00000000000
Binary files a/products/gateway/src/content/static/android_security_settings.png and /dev/null differ
diff --git a/products/gateway/src/content/static/begin-setup.png b/products/gateway/src/content/static/begin-setup.png
deleted file mode 100644
index ffdce506de7..00000000000
Binary files a/products/gateway/src/content/static/begin-setup.png and /dev/null differ
diff --git a/products/gateway/src/content/static/bing-safesearch.png b/products/gateway/src/content/static/bing-safesearch.png
deleted file mode 100644
index 7362ef99bc1..00000000000
Binary files a/products/gateway/src/content/static/bing-safesearch.png and /dev/null differ
diff --git a/products/gateway/src/content/static/block-security-threats-by-category.png b/products/gateway/src/content/static/block-security-threats-by-category.png
deleted file mode 100644
index 426ef06995a..00000000000
Binary files a/products/gateway/src/content/static/block-security-threats-by-category.png and /dev/null differ
diff --git a/products/gateway/src/content/static/blocked-disabled.png b/products/gateway/src/content/static/blocked-disabled.png
deleted file mode 100644
index d4130a75bf6..00000000000
Binary files a/products/gateway/src/content/static/blocked-disabled.png and /dev/null differ
diff --git a/products/gateway/src/content/static/blocked-enabled.png b/products/gateway/src/content/static/blocked-enabled.png
deleted file mode 100644
index 776cf8a18eb..00000000000
Binary files a/products/gateway/src/content/static/blocked-enabled.png and /dev/null differ
diff --git a/products/gateway/src/content/static/cert-block-page.png b/products/gateway/src/content/static/cert-block-page.png
deleted file mode 100644
index 88aed3183ca..00000000000
Binary files a/products/gateway/src/content/static/cert-block-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/cert-click-on-trust.png b/products/gateway/src/content/static/cert-click-on-trust.png
deleted file mode 100644
index cc34a0b8806..00000000000
Binary files a/products/gateway/src/content/static/cert-click-on-trust.png and /dev/null differ
diff --git a/products/gateway/src/content/static/cert-select-always-trust.png b/products/gateway/src/content/static/cert-select-always-trust.png
deleted file mode 100644
index df8293aed2e..00000000000
Binary files a/products/gateway/src/content/static/cert-select-always-trust.png and /dev/null differ
diff --git a/products/gateway/src/content/static/click-on-advanced.PNG b/products/gateway/src/content/static/click-on-advanced.PNG
deleted file mode 100644
index 82785c75c32..00000000000
Binary files a/products/gateway/src/content/static/click-on-advanced.PNG and /dev/null differ
diff --git a/products/gateway/src/content/static/click-on-connection-options.PNG b/products/gateway/src/content/static/click-on-connection-options.PNG
deleted file mode 100644
index edaf48a45c1..00000000000
Binary files a/products/gateway/src/content/static/click-on-connection-options.PNG and /dev/null differ
diff --git a/products/gateway/src/content/static/click-on-dns-settings.PNG b/products/gateway/src/content/static/click-on-dns-settings.PNG
deleted file mode 100644
index 8eaf963d2db..00000000000
Binary files a/products/gateway/src/content/static/click-on-dns-settings.PNG and /dev/null differ
diff --git a/products/gateway/src/content/static/click-on-menu.PNG b/products/gateway/src/content/static/click-on-menu.PNG
deleted file mode 100644
index 1c5e780abc8..00000000000
Binary files a/products/gateway/src/content/static/click-on-menu.PNG and /dev/null differ
diff --git a/products/gateway/src/content/static/client-dns-filtering-only.png b/products/gateway/src/content/static/client-dns-filtering-only.png
deleted file mode 100644
index e9ab24e28a6..00000000000
Binary files a/products/gateway/src/content/static/client-dns-filtering-only.png and /dev/null differ
diff --git a/products/gateway/src/content/static/client-http-filtering.png b/products/gateway/src/content/static/client-http-filtering.png
deleted file mode 100644
index 21f4b64522b..00000000000
Binary files a/products/gateway/src/content/static/client-http-filtering.png and /dev/null differ
diff --git a/products/gateway/src/content/static/content-categories.png b/products/gateway/src/content/static/content-categories.png
deleted file mode 100644
index a1decfe7e0d..00000000000
Binary files a/products/gateway/src/content/static/content-categories.png and /dev/null differ
diff --git a/products/gateway/src/content/static/dash-additional-location.png b/products/gateway/src/content/static/dash-additional-location.png
deleted file mode 100644
index f0ddd7727e8..00000000000
Binary files a/products/gateway/src/content/static/dash-additional-location.png and /dev/null differ
diff --git a/products/gateway/src/content/static/dash-first-location.png b/products/gateway/src/content/static/dash-first-location.png
deleted file mode 100644
index 5e340f9d26e..00000000000
Binary files a/products/gateway/src/content/static/dash-first-location.png and /dev/null differ
diff --git a/products/gateway/src/content/static/dash-first-policy.png b/products/gateway/src/content/static/dash-first-policy.png
deleted file mode 100644
index 5230ab2bef2..00000000000
Binary files a/products/gateway/src/content/static/dash-first-policy.png and /dev/null differ
diff --git a/products/gateway/src/content/static/duckduckgo-safesearch.png b/products/gateway/src/content/static/duckduckgo-safesearch.png
deleted file mode 100644
index fe4a3d5f87e..00000000000
Binary files a/products/gateway/src/content/static/duckduckgo-safesearch.png and /dev/null differ
diff --git a/products/gateway/src/content/static/enable-block-page.png b/products/gateway/src/content/static/enable-block-page.png
deleted file mode 100644
index 097cd2e8e39..00000000000
Binary files a/products/gateway/src/content/static/enable-block-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/encrypted-dns-gateway.png b/products/gateway/src/content/static/encrypted-dns-gateway.png
deleted file mode 100644
index 604c6c67037..00000000000
Binary files a/products/gateway/src/content/static/encrypted-dns-gateway.png and /dev/null differ
diff --git a/products/gateway/src/content/static/enter-unique-id.PNG b/products/gateway/src/content/static/enter-unique-id.PNG
deleted file mode 100644
index f4430b0dc4c..00000000000
Binary files a/products/gateway/src/content/static/enter-unique-id.PNG and /dev/null differ
diff --git a/products/gateway/src/content/static/expand-location-card.png b/products/gateway/src/content/static/expand-location-card.png
deleted file mode 100644
index a3638692c8f..00000000000
Binary files a/products/gateway/src/content/static/expand-location-card.png and /dev/null differ
diff --git a/products/gateway/src/content/static/expanded-location-with-destinations.png b/products/gateway/src/content/static/expanded-location-with-destinations.png
deleted file mode 100644
index 6a82349f75f..00000000000
Binary files a/products/gateway/src/content/static/expanded-location-with-destinations.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-begin-setup.png b/products/gateway/src/content/static/gateway-begin-setup.png
deleted file mode 100644
index 599cdde7de6..00000000000
Binary files a/products/gateway/src/content/static/gateway-begin-setup.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-create-location.gif b/products/gateway/src/content/static/gateway-create-location.gif
deleted file mode 100644
index 03dd4b72e6d..00000000000
Binary files a/products/gateway/src/content/static/gateway-create-location.gif and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-create-policy.gif b/products/gateway/src/content/static/gateway-create-policy.gif
deleted file mode 100644
index fa2108b882c..00000000000
Binary files a/products/gateway/src/content/static/gateway-create-policy.gif and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-filter-by-location.png b/products/gateway/src/content/static/gateway-dash-filter-by-location.png
deleted file mode 100644
index 09c701c75e0..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-filter-by-location.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-filter-by-time.png b/products/gateway/src/content/static/gateway-dash-filter-by-time.png
deleted file mode 100644
index f803b110ad9..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-filter-by-time.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-overview-empty.png b/products/gateway/src/content/static/gateway-dash-overview-empty.png
deleted file mode 100644
index 0a78d75d44a..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-overview-empty.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-overview-page.png b/products/gateway/src/content/static/gateway-dash-overview-page.png
deleted file mode 100644
index 2da3843b788..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-overview-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-top-allowed-and-blocked-requests.png b/products/gateway/src/content/static/gateway-dash-top-allowed-and-blocked-requests.png
deleted file mode 100644
index d8b029f0305..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-top-allowed-and-blocked-requests.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-dash-top-categories.png b/products/gateway/src/content/static/gateway-dash-top-categories.png
deleted file mode 100644
index 6f2b1aa7450..00000000000
Binary files a/products/gateway/src/content/static/gateway-dash-top-categories.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-determine-location-dns.png b/products/gateway/src/content/static/gateway-determine-location-dns.png
deleted file mode 100644
index 3a15a1b9ee9..00000000000
Binary files a/products/gateway/src/content/static/gateway-determine-location-dns.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gateway-order-of-operations.png b/products/gateway/src/content/static/gateway-order-of-operations.png
deleted file mode 100644
index 6afa861ae4b..00000000000
Binary files a/products/gateway/src/content/static/gateway-order-of-operations.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gatewaylogo.png b/products/gateway/src/content/static/gatewaylogo.png
deleted file mode 100644
index d054abca90a..00000000000
Binary files a/products/gateway/src/content/static/gatewaylogo.png and /dev/null differ
diff --git a/products/gateway/src/content/static/gatewaylogo2.png b/products/gateway/src/content/static/gatewaylogo2.png
deleted file mode 100644
index 1b4303ed143..00000000000
Binary files a/products/gateway/src/content/static/gatewaylogo2.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-account.png b/products/gateway/src/content/static/go-to-account.png
deleted file mode 100644
index 703a8a41398..00000000000
Binary files a/products/gateway/src/content/static/go-to-account.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-auth-domain-page.png b/products/gateway/src/content/static/go-to-auth-domain-page.png
deleted file mode 100644
index 7547cd60951..00000000000
Binary files a/products/gateway/src/content/static/go-to-auth-domain-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-device-settings-page.png b/products/gateway/src/content/static/go-to-device-settings-page.png
deleted file mode 100644
index f6d866a0964..00000000000
Binary files a/products/gateway/src/content/static/go-to-device-settings-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-locations-page.png b/products/gateway/src/content/static/go-to-locations-page.png
deleted file mode 100644
index 80b3531d5ff..00000000000
Binary files a/products/gateway/src/content/static/go-to-locations-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-teams-dashboard-devices.png b/products/gateway/src/content/static/go-to-teams-dashboard-devices.png
deleted file mode 100644
index 1d195bd2e5b..00000000000
Binary files a/products/gateway/src/content/static/go-to-teams-dashboard-devices.png and /dev/null differ
diff --git a/products/gateway/src/content/static/go-to-teams-dashboard.png b/products/gateway/src/content/static/go-to-teams-dashboard.png
deleted file mode 100644
index dbd1692c5d1..00000000000
Binary files a/products/gateway/src/content/static/go-to-teams-dashboard.png and /dev/null differ
diff --git a/products/gateway/src/content/static/google-safesearch.png b/products/gateway/src/content/static/google-safesearch.png
deleted file mode 100644
index 75df24f6a8c..00000000000
Binary files a/products/gateway/src/content/static/google-safesearch.png and /dev/null differ
diff --git a/products/gateway/src/content/static/how-does-gateway-work-dns.png b/products/gateway/src/content/static/how-does-gateway-work-dns.png
deleted file mode 100644
index 3ea7a511935..00000000000
Binary files a/products/gateway/src/content/static/how-does-gateway-work-dns.png and /dev/null differ
diff --git a/products/gateway/src/content/static/how-does-gw-work-background.png b/products/gateway/src/content/static/how-does-gw-work-background.png
deleted file mode 100644
index 9ef6a522844..00000000000
Binary files a/products/gateway/src/content/static/how-does-gw-work-background.png and /dev/null differ
diff --git a/products/gateway/src/content/static/http-add-rule.png b/products/gateway/src/content/static/http-add-rule.png
deleted file mode 100644
index e320be9a8b2..00000000000
Binary files a/products/gateway/src/content/static/http-add-rule.png and /dev/null differ
diff --git a/products/gateway/src/content/static/http-error-page.png b/products/gateway/src/content/static/http-error-page.png
deleted file mode 100644
index 66e41a8b36f..00000000000
Binary files a/products/gateway/src/content/static/http-error-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/http-first-rule.png b/products/gateway/src/content/static/http-first-rule.png
deleted file mode 100644
index cba682bb009..00000000000
Binary files a/products/gateway/src/content/static/http-first-rule.png and /dev/null differ
diff --git a/products/gateway/src/content/static/https-browser-error.png b/products/gateway/src/content/static/https-browser-error.png
deleted file mode 100644
index e2fa0c4da21..00000000000
Binary files a/products/gateway/src/content/static/https-browser-error.png and /dev/null differ
diff --git a/products/gateway/src/content/static/install-one-dot-app.png b/products/gateway/src/content/static/install-one-dot-app.png
deleted file mode 100644
index f60f827e411..00000000000
Binary files a/products/gateway/src/content/static/install-one-dot-app.png and /dev/null differ
diff --git a/products/gateway/src/content/static/ios_cert_download.jpg b/products/gateway/src/content/static/ios_cert_download.jpg
deleted file mode 100644
index 27709e03ca5..00000000000
Binary files a/products/gateway/src/content/static/ios_cert_download.jpg and /dev/null differ
diff --git a/products/gateway/src/content/static/ios_cert_profile.jpg b/products/gateway/src/content/static/ios_cert_profile.jpg
deleted file mode 100644
index 4524552bebe..00000000000
Binary files a/products/gateway/src/content/static/ios_cert_profile.jpg and /dev/null differ
diff --git a/products/gateway/src/content/static/ios_cert_trust1.jpg b/products/gateway/src/content/static/ios_cert_trust1.jpg
deleted file mode 100644
index de09037af38..00000000000
Binary files a/products/gateway/src/content/static/ios_cert_trust1.jpg and /dev/null differ
diff --git a/products/gateway/src/content/static/ios_cert_trust2.jpg b/products/gateway/src/content/static/ios_cert_trust2.jpg
deleted file mode 100644
index 48fbc5d2969..00000000000
Binary files a/products/gateway/src/content/static/ios_cert_trust2.jpg and /dev/null differ
diff --git a/products/gateway/src/content/static/listed-in-keychain.png b/products/gateway/src/content/static/listed-in-keychain.png
deleted file mode 100644
index 16b2ad74825..00000000000
Binary files a/products/gateway/src/content/static/listed-in-keychain.png and /dev/null differ
diff --git a/products/gateway/src/content/static/location-with-dns-over-https-hostname.png b/products/gateway/src/content/static/location-with-dns-over-https-hostname.png
deleted file mode 100644
index f050d4ef818..00000000000
Binary files a/products/gateway/src/content/static/location-with-dns-over-https-hostname.png and /dev/null differ
diff --git a/products/gateway/src/content/static/locations-doh-dot.png b/products/gateway/src/content/static/locations-doh-dot.png
deleted file mode 100644
index 2f3aa1b5d87..00000000000
Binary files a/products/gateway/src/content/static/locations-doh-dot.png and /dev/null differ
diff --git a/products/gateway/src/content/static/locations-doh.png b/products/gateway/src/content/static/locations-doh.png
deleted file mode 100644
index 2c058ba940b..00000000000
Binary files a/products/gateway/src/content/static/locations-doh.png and /dev/null differ
diff --git a/products/gateway/src/content/static/locations-dot-complete.png b/products/gateway/src/content/static/locations-dot-complete.png
deleted file mode 100644
index 7eed99349bf..00000000000
Binary files a/products/gateway/src/content/static/locations-dot-complete.png and /dev/null differ
diff --git a/products/gateway/src/content/static/locations-dot.png b/products/gateway/src/content/static/locations-dot.png
deleted file mode 100644
index ed9860e797b..00000000000
Binary files a/products/gateway/src/content/static/locations-dot.png and /dev/null differ
diff --git a/products/gateway/src/content/static/no-block-page.png b/products/gateway/src/content/static/no-block-page.png
deleted file mode 100644
index 7f7439cec05..00000000000
Binary files a/products/gateway/src/content/static/no-block-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/safesearch-card.png b/products/gateway/src/content/static/safesearch-card.png
deleted file mode 100644
index a1cc17ad4dd..00000000000
Binary files a/products/gateway/src/content/static/safesearch-card.png and /dev/null differ
diff --git a/products/gateway/src/content/static/security-threats.png b/products/gateway/src/content/static/security-threats.png
deleted file mode 100644
index 942421b3f7a..00000000000
Binary files a/products/gateway/src/content/static/security-threats.png and /dev/null differ
diff --git a/products/gateway/src/content/static/select-http-tab.png b/products/gateway/src/content/static/select-http-tab.png
deleted file mode 100644
index 7efddee0bd0..00000000000
Binary files a/products/gateway/src/content/static/select-http-tab.png and /dev/null differ
diff --git a/products/gateway/src/content/static/setup-dns.png b/products/gateway/src/content/static/setup-dns.png
deleted file mode 100644
index bd9e93f50ad..00000000000
Binary files a/products/gateway/src/content/static/setup-dns.png and /dev/null differ
diff --git a/products/gateway/src/content/static/setup-first-location.png b/products/gateway/src/content/static/setup-first-location.png
deleted file mode 100644
index 0591b0a641f..00000000000
Binary files a/products/gateway/src/content/static/setup-first-location.png and /dev/null differ
diff --git a/products/gateway/src/content/static/source-ip-taken.png b/products/gateway/src/content/static/source-ip-taken.png
deleted file mode 100644
index eef2950a6ad..00000000000
Binary files a/products/gateway/src/content/static/source-ip-taken.png and /dev/null differ
diff --git a/products/gateway/src/content/static/teams-dash-activity-log-expanded.png b/products/gateway/src/content/static/teams-dash-activity-log-expanded.png
deleted file mode 100644
index 7ef8ff9e8f7..00000000000
Binary files a/products/gateway/src/content/static/teams-dash-activity-log-expanded.png and /dev/null differ
diff --git a/products/gateway/src/content/static/teams-dash-activity-log.png b/products/gateway/src/content/static/teams-dash-activity-log.png
deleted file mode 100644
index 5e76b27fdf5..00000000000
Binary files a/products/gateway/src/content/static/teams-dash-activity-log.png and /dev/null differ
diff --git a/products/gateway/src/content/static/two-locations.png b/products/gateway/src/content/static/two-locations.png
deleted file mode 100644
index 626a0ddce00..00000000000
Binary files a/products/gateway/src/content/static/two-locations.png and /dev/null differ
diff --git a/products/gateway/src/content/static/unique-gateway-id.png b/products/gateway/src/content/static/unique-gateway-id.png
deleted file mode 100644
index 30a8aa87827..00000000000
Binary files a/products/gateway/src/content/static/unique-gateway-id.png and /dev/null differ
diff --git a/products/gateway/src/content/static/update-certificates-page.png b/products/gateway/src/content/static/update-certificates-page.png
deleted file mode 100644
index ee23ca3a628..00000000000
Binary files a/products/gateway/src/content/static/update-certificates-page.png and /dev/null differ
diff --git a/products/gateway/src/content/static/windows_cert_install_finished.png b/products/gateway/src/content/static/windows_cert_install_finished.png
deleted file mode 100644
index d2a0bcaf684..00000000000
Binary files a/products/gateway/src/content/static/windows_cert_install_finished.png and /dev/null differ
diff --git a/products/gateway/src/content/static/windows_cert_location.png b/products/gateway/src/content/static/windows_cert_location.png
deleted file mode 100644
index f7ef0e5233c..00000000000
Binary files a/products/gateway/src/content/static/windows_cert_location.png and /dev/null differ
diff --git a/products/gateway/src/content/static/windows_install_cert.png b/products/gateway/src/content/static/windows_install_cert.png
deleted file mode 100644
index b39a6bacb18..00000000000
Binary files a/products/gateway/src/content/static/windows_install_cert.png and /dev/null differ
diff --git a/products/gateway/src/content/static/youtube-safesearch.png b/products/gateway/src/content/static/youtube-safesearch.png
deleted file mode 100644
index 088aafd3933..00000000000
Binary files a/products/gateway/src/content/static/youtube-safesearch.png and /dev/null differ
diff --git a/products/gateway/wrangler.toml b/products/gateway/wrangler.toml
deleted file mode 100644
index c1e029fa50a..00000000000
--- a/products/gateway/wrangler.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-name = "gateway"
-type = "webpack"
-account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
-workers_dev = true
-
-[env.production]
-workers_dev = false
-account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
-zone_id = "351cf9fc660523187714fa772ad5ca49"
-route = "https://developers.cloudflare.com/gateway*"
-kv_namespaces = [
-  { binding = "REDIRECTS", id = "8a91001065b6459483db0b898a58cd2e" }
-]
-
-[site]
-bucket = ".docs/public/"
-entry-point = ".docs/workers-site"
diff --git a/products/http3/docs-config.js b/products/http3/docs-config.js
index 7052e0e16bc..afdc6010d4a 100644
--- a/products/http3/docs-config.js
+++ b/products/http3/docs-config.js
@@ -28,6 +28,6 @@ module.exports = {
     description: "HTTP/3 is the newest version of the Hypertext Transfer Protocol",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/http3",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/http3/src/content/chrome.md b/products/http3/src/content/chrome.md
index 6d7df51fa84..2449d8b0c43 100644
--- a/products/http3/src/content/chrome.md
+++ b/products/http3/src/content/chrome.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Google Chrome
diff --git a/products/http3/src/content/curl-brew.md b/products/http3/src/content/curl-brew.md
index e9d3ca8bec9..6a866fea219 100644
--- a/products/http3/src/content/curl-brew.md
+++ b/products/http3/src/content/curl-brew.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Curl + Quiche
diff --git a/products/http3/src/content/edge.md b/products/http3/src/content/edge.md
index 7643a439095..7dd08cd8e06 100644
--- a/products/http3/src/content/edge.md
+++ b/products/http3/src/content/edge.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # Microsoft Edge
diff --git a/products/http3/src/content/firefox.md b/products/http3/src/content/firefox.md
index 8394db5d24c..afe066de48b 100644
--- a/products/http3/src/content/firefox.md
+++ b/products/http3/src/content/firefox.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # Mozilla Firefox
diff --git a/products/http3/src/content/index.md b/products/http3/src/content/index.md
index ec79cf2db54..5196d9aea7e 100644
--- a/products/http3/src/content/index.md
+++ b/products/http3/src/content/index.md
@@ -1,6 +1,7 @@
 ---
 title: Welcome
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Cloudflare HTTP/3 docs
diff --git a/products/http3/src/content/quiche-http3-client.md b/products/http3/src/content/quiche-http3-client.md
index 60f8f94f661..20c0bcfcf41 100644
--- a/products/http3/src/content/quiche-http3-client.md
+++ b/products/http3/src/content/quiche-http3-client.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: configuration
 ---
 
 # Quiche HTTP/3 client
diff --git a/products/http3/src/content/release.md b/products/http3/src/content/release.md
index c7d62829543..cec679330df 100644
--- a/products/http3/src/content/release.md
+++ b/products/http3/src/content/release.md
@@ -1,5 +1,6 @@
 ---
 order: 6
+pcx-content-type: interim
 ---
 
 # Release notes
diff --git a/products/http3/wrangler.toml b/products/http3/wrangler.toml
index 13306cf8f40..89fb2e0aeff 100644
--- a/products/http3/wrangler.toml
+++ b/products/http3/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/http3*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "dd91f8b73f5843b8b67d91df7ff3a613" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/image-resizing/README.md b/products/image-resizing/README.md
new file mode 100644
index 00000000000..134745def56
--- /dev/null
+++ b/products/image-resizing/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Image Resizing docs
+
+[View docs →](https://developers.cloudflare.com/image-resizing)
+
+[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
diff --git a/products/image-resizing/docs-config.js b/products/image-resizing/docs-config.js
new file mode 100644
index 00000000000..aa3b4820d62
--- /dev/null
+++ b/products/image-resizing/docs-config.js
@@ -0,0 +1,25 @@
+module.exports = {
+  product: "Image Resizing",
+  pathPrefix: "/image-resizing",
+  productIconKey: "images",
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/image-resizing",
+  externalLinks: [
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:image-resizing"]'}
+  },
+  siteMetadata: {
+    title: "Cloudflare Image Resizing docs",
+    description: "Run your image optimization logic at the edge.",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/image-resizing",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+  }
+}
diff --git a/products/image-resizing/package.json b/products/image-resizing/package.json
new file mode 100644
index 00000000000..ea02638c7ca
--- /dev/null
+++ b/products/image-resizing/package.json
@@ -0,0 +1,14 @@
+{
+  "private": true,
+  "dependencies": {
+    "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+  },
+  "scripts": {
+    "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+    "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+    "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+    "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+    "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+    "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+  }
+}
diff --git a/products/image-resizing/src/content/cloudflare-images-beta.md b/products/image-resizing/src/content/cloudflare-images-beta.md
new file mode 100644
index 00000000000..2964914d0d2
--- /dev/null
+++ b/products/image-resizing/src/content/cloudflare-images-beta.md
@@ -0,0 +1,106 @@
+---
+title: Images (beta)
+order: 8
+pcx-content-type: how-to
+---
+
+# Cloudflare Images API (beta)
+
+Cloudflare Images API provides an end-to-end solution to build your image pipeline.  It aims to answer the most common challenges associated with building and maintaining your image infrastructure:
+
+1. “Where do we store images?”
+2. “How do we secure, resize, and optimize the images for different use cases?”
+3. “How do we serve the images to our users reliably?”
+4. “How do we do all of these things at scale while having predictable and affordable pricing, especially during spikes?”
+
+To learn more about the vision behind Images, [read the Images blog post.](https://blog.cloudflare.com/announcing-cloudflare-images-beta/) 
+
+## Availability
+
+Cloudflare Images is currently in closed beta. To request an invite, [click here.](https://docs.google.com/forms/d/1x1caSSYQn10dRjxNLJlG-MdHgLnUa2mnR6iUpa2ahxI/edit) 
+
+## Limitations
+
+Currently, Cloudflare Images API requires use of your auth key and email. Support for Bearer Tokens will be added soon.
+
+## Uploading Images
+
+Once you have access to Images, you can upload pictures by call the /images endpoint:
+
+```bash
+curl https://api.cloudflare.com/client/v4/accounts/$account_tag/images/v1 \
+-H "X-Auth-Key: $auth_key" \
+-H "X-Auth-Email: $auth_email" \
+-F file=@./logo.png
+```
+
+If the upload is successful, you can expect a JSON response body similar to this:
+
+```json
+{
+   "result": {
+      "filename": "logo.png",
+      "id": "MTt4OTd0b0w5ajZxR0pLaXRldlBtaFhhO2FiZGVnaA==",
+      "variants": [
+         {
+            "name": "default",
+            "url": "https://imagedelivery.net/default/MTt4OTd0b0w5ajZxR0pLaXRldlBtaFhhO2FiZGVnaA=="
+         }
+      ]
+   },
+   "success": true,
+   "errors": [],
+   "messages": []
+}
+```
+
+## Displaying Images
+
+When you upload an image, you will see a `url` property that can be used to serve the image.
+  
+Currently, all images are auto-optimized based on device type. In future, we will be introducing custom variants so you can configure exactly how you'd like the image to be optimized.
+
+### Default Variant
+The `default` variant has the following preconfigured settings based on device type:
+   
+   * Desktop: format = auto, fit = scale-down, height = 1440, width: 2560, metadata = none, quality = 85
+   * Mobile: format = auto, fit = scale-down, height = 720, width: 1080, metadata = none, quality = 85
+   * Tablet: format =. auto, fit = scale-down, height = 1080, width: 1920, metadata = none, quality = 85
+
+If the device type cannot be inferred, the default variant will use the `Desktop` subvariant.
+
+## Deleting Images
+```bash
+curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$account_tag/images/v1/MTt4OTd0b0w5ajZxR0pLaXRldlBtaFhhO2FiZGVnaA== \
+-H "X-Auth-Key: $auth_key" \
+-H "X-Auth-Email: $auth_email"
+
+```
+
+If the upload is successful, you can expect a JSON response body similar to this:
+
+```json
+{
+  "result": {
+    "id": "MTt4OTd0b0w5ajZxR0pLaXRldlBtaFhhO2FiZGVnaA=="
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+## Roadmap
+
+We're just getting started with Cloudflare Images. Here are some of the features you can expect over the next quarter:
+
+<TableWrap>
+
+| Feature | Description |
+|------------------|-------------|
+| Token Uploads | Enable your users to upload images directly to Cloudflare |
+| Dashboard UI | Ability to upload and manage images using the Cloudflare Dashboard |
+| Custom Variants | Define custom variants and associate them with your images |
+| Signed URL Support | Require a signed URL for access to your images |
+
+</TableWrap>
diff --git a/products/images/src/content/controlling-origin-access.md b/products/image-resizing/src/content/controlling-origin-access.md
similarity index 99%
rename from products/images/src/content/controlling-origin-access.md
rename to products/image-resizing/src/content/controlling-origin-access.md
index 7444d5cbad4..8511736ab81 100644
--- a/products/images/src/content/controlling-origin-access.md
+++ b/products/image-resizing/src/content/controlling-origin-access.md
@@ -1,5 +1,6 @@
 ---
-order: 5
+order: 6
+pcx-content-type: interim
 ---
 
 # Controlling origin access
diff --git a/products/images/src/content/drawing-overlays.md b/products/image-resizing/src/content/drawing-overlays.md
similarity index 98%
rename from products/images/src/content/drawing-overlays.md
rename to products/image-resizing/src/content/drawing-overlays.md
index 023b2b1ebf7..ac99f629072 100644
--- a/products/images/src/content/drawing-overlays.md
+++ b/products/image-resizing/src/content/drawing-overlays.md
@@ -1,6 +1,7 @@
 ---
 title: Drawing overlays
-order: 4
+order: 5
+pcx-content-type: configuration
 ---
 
 # Drawing overlays & watermarks
diff --git a/products/image-resizing/src/content/enable-image-resizing.md b/products/image-resizing/src/content/enable-image-resizing.md
new file mode 100644
index 00000000000..3b01639c00f
--- /dev/null
+++ b/products/image-resizing/src/content/enable-image-resizing.md
@@ -0,0 +1,32 @@
+---
+order: 1
+title: Get started
+pcx-content-type: how-to
+---
+
+# Enable Image Resizing
+
+To use Image Resizing you first need to enable it via the Speed app of your Cloudflare dashboard:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/).
+1. Click the **account** for the domain you want to use with Image Resizing.
+1. Select the **domain** where you will be using Image Resizing.
+1. Click on the **Speed** app.
+
+  <div class="large-img">
+
+  ![Image Resizing options in Cloudflare's dashboard](static/image-resizing.png)
+
+  </div>
+
+1. Click the **Optimization** tab.
+1. Under **File Size Optimization**, enable **Image Resizing**
+1. If you do not want to resize images from any origin, uncheck **Resize images from any origin**.
+
+<Aside type="note" header="Note">
+
+Image Resizing defaults to resizing images from **any domain**. To prevent third parties from resizing any image at any origin, uncheck **Resize images from any origin**. When unchecked, Image Resizing will only resize images that are in the enabled zone. 
+
+This restriction does not apply to image resizing requests coming from Cloudflare Workers. If you are using Image Resizing in a Worker, you need to include the appropriate logic in your Worker code.
+
+</Aside>
\ No newline at end of file
diff --git a/products/image-resizing/src/content/index.md b/products/image-resizing/src/content/index.md
new file mode 100644
index 00000000000..7defce64658
--- /dev/null
+++ b/products/image-resizing/src/content/index.md
@@ -0,0 +1,26 @@
+---
+title: Overview
+order: 0
+pcx-content-type: landing-page
+---
+
+# Cloudflare Image Resizing documentation
+
+With Image Resizing, you can transform images on Cloudflare’s edge platform. You can resize, adjust quality, and convert images to WebP or AVIF format on demand. Cloudflare will automatically cache every derived image at the edge, so you only need to store one original image at your origin.
+
+- Quickly and easily adapt images to your site’s layout and your visitors’ screen sizes without maintaining a server-side image processing pipeline on your servers.
+
+- Image processing [integrates well with Workers](/resizing-with-workers), which enables advanced integrations such as custom URL schemes, content negotiation and responsive images based on Client Hints.
+
+## Availability
+
+Image Resizing is currently available for Business and Enterprise customers. To begin, ensure you have [enabled Image Resizing](/enable-image-resizing) in the Cloudflare dashboard.
+
+## Two ways to use
+
+You can use Cloudflare Image Resizing with either a pre-defined [URL format](/url-format) or with [Cloudflare Workers](/resizing-with-workers), for advanced use cases. 
+
+<ButtonGroup>
+  <Button type="primary" href="/url-format">Learn the URL format</Button>
+  <Button type="secondary" href="/resizing-with-workers">View the Workers docs</Button>
+</ButtonGroup>
diff --git a/products/image-resizing/src/content/integration-with-frameworks.md b/products/image-resizing/src/content/integration-with-frameworks.md
new file mode 100644
index 00000000000..4b55e97a3fc
--- /dev/null
+++ b/products/image-resizing/src/content/integration-with-frameworks.md
@@ -0,0 +1,40 @@
+---
+title: Integration with frameworks
+order: 9
+pcx-content-type: interim
+---
+
+# Integration with frameworks
+
+## Next.js
+
+Image Resizing can be used automatically with Next.js' [`next/image` component](https://nextjs.org/docs/api-reference/next/image). With a [custom loader](https://nextjs.org/docs/api-reference/next/image#loader) which applies Cloudflare Image Resizing, `next/image` will set an optimal width and quality for a given client.
+
+```javascript
+import Image from "next/image";
+
+const normalizeSrc = (src) => {
+  return src[0] === "/" ? src.slice(1) : src;
+};
+
+const cloudflareLoader = ({ src, width, quality }) => {
+  const params = [`width=${width}`];
+  if (quality) {
+    params.push(`quality=${quality}`);
+  }
+  const paramsString = params.join(",");
+  return `/cdn-cgi/image/${paramsString}/${normalizeSrc(src)}`;
+};
+
+const MyImage = (props) => {
+  return (
+    <Image
+      loader={cloudflareLoader}
+      src="/me.png"
+      alt="Picture of the author"
+      width={500}
+      height={500}
+    />
+  );
+};
+```
diff --git a/products/images/src/content/resizing-with-workers.md b/products/image-resizing/src/content/resizing-with-workers.md
similarity index 93%
rename from products/images/src/content/resizing-with-workers.md
rename to products/image-resizing/src/content/resizing-with-workers.md
index 6bdfbe1fec9..797e92530a5 100644
--- a/products/images/src/content/resizing-with-workers.md
+++ b/products/image-resizing/src/content/resizing-with-workers.md
@@ -1,6 +1,7 @@
 ---
 title: Resizing with Workers
-order: 3
+order: 4
+pcx-content-type: configuration
 ---
 
 # Resizing with Cloudflare Workers
@@ -223,14 +224,33 @@ async function handleRequest(request) {
   if (url.searchParams.has("quality")) options.cf.image.quality = url.searchParams.get("quality")
 
   // Get URL of the original (full size) image to resize.
-  // You could adjust the URL here, e.g. prefix it with a fixed address of your server,
+  // You could adjust the URL here, e.g., prefix it with a fixed address of your server,
   // so that user-visible URLs are shorter and cleaner.
   const imageURL = url.searchParams.get("image")
+  if (!imageURL) return new Response('Missing "image" value', { status: 400 })
+
+  try {
+    // TODO: Customize validation logic
+    const { hostname, pathname } = new URL(imageURL)
+
+    // Only accept JPEG, PNG, GIF, or WebP types
+    // @see https://developers.cloudflare.com/images/url-format#supported-formats-and-limitations
+    if (!/\.(jpe?g|png|gif|webp)$/i.test(pathname)) {
+      return new Response('Invalid image type', { status: 400 })
+    }
+
+    // Demo: Only accept "example.com" images
+    if (hostname !== 'example.com') {
+      return new Response('Must use "example.com" source images', { status: 403 })
+    }
+  } catch (err) {
+    return new Response('Invalid "image" value', { status: 400 })
+  }
 
   // Build a request that passes through request headers,
   // so that automatic format negotiation can work.
   const imageRequest = new Request(imageURL, {
-    headers: request.headers,
+    headers: request.headers
   })
 
   // Returning fetch() with resizing options will pass through response with the resized image.
diff --git a/products/images/src/content/responsive-images.md b/products/image-resizing/src/content/responsive-images.md
similarity index 99%
rename from products/images/src/content/responsive-images.md
rename to products/image-resizing/src/content/responsive-images.md
index 9a1913d5696..08be956f457 100644
--- a/products/images/src/content/responsive-images.md
+++ b/products/image-resizing/src/content/responsive-images.md
@@ -1,5 +1,6 @@
 ---
-order: 2
+order: 3
+pcx-content-type: configuration
 ---
 
 # Responsive images
diff --git a/products/image-resizing/src/content/static/image-resizing.png b/products/image-resizing/src/content/static/image-resizing.png
new file mode 100644
index 00000000000..3dca87ae7ff
Binary files /dev/null and b/products/image-resizing/src/content/static/image-resizing.png differ
diff --git a/products/image-resizing/src/content/troubleshooting.md b/products/image-resizing/src/content/troubleshooting.md
new file mode 100644
index 00000000000..3ccf1f07127
--- /dev/null
+++ b/products/image-resizing/src/content/troubleshooting.md
@@ -0,0 +1,55 @@
+---
+order: 7
+pcx-content-type: faq
+---
+
+# Troubleshooting
+
+## Requests without resizing enabled
+
+Does the response have a `Cf-Resized` header? If **not**, then resizing has not been attempted. Possible causes:
+
+  * There’s another Worker running on the same request. Resizing is "forgotten" as soon as one Worker calls another. Don’t use Workers scoped to the entire domain `/*`.
+  * Preview in the Editor in the Dashboard is does not simulate image resizing. You must deploy the Worker and test from another browser tab instead.
+
+## Error responses from resizing
+
+When resizing fails, the response body contains an error message explaining the reason, as well as the `Cf-Resized` header containing `err=code`:
+
+* 9401 — Missing or invalid required arguments in `{cf:image{…}}` options, e.g. `width` is not a number.
+* 9402 — Download of the original image failed, e.g. because the image was too large or the connection was interrupted.
+* 9403 — [Request loop](/resizing-with-workers#preventing-request-loops). The service was asked to resize an already-resized image, or the Worker has fetched its own URL.
+* 9406 & 9419 — Invalid image URL specified (e.g. contains spaces, unescaped Unicode, or non-HTTP/S URL).
+* 9407 — Origin domain name lookup error.
+* 9404 — Origin returned 404 HTTP status code. The image doesn’t exist on the origin server, or a wrong URL was given to resize.
+* 9408 — Origin returned 4xx HTTP status code. The origin server may be denying access to the image.
+* 9509 — Origin returned 5xx HTTP status code. This is most likely a problem with the origin server-side software, not image resizing.
+* 9412 — Origin returned a non-image, e.g. a HTML page. This usually happens when an invalid URL is specified, or server-side software has printed an error, or presented a login page.
+* 9413 — The image is too large (exceeds 10000 pixels width or height)
+* 9420 — Origin server redirected to an invalid URL.
+* 9421 — Origin redirected too many times.
+* 9504, 9505 & 9510 — Unable to contact origin. The origin server may be down or overloaded.
+* 9524 — `/cdn-cgi/image/` resizing service could not perform resizing, probably because the image URL was intercepted by a Worker.
+* 9511 — Image format not supported.
+* 9522 — Exceeded processing limit. This may happen briefly after purging an entire zone or when requesting files with huge dimensions. If the problem persists, please contact support.
+* 9424, 9516, 9517, 9518 & 9523 — Internal errors. Please contact support if you encounter these errors.
+
+## Limits
+
+Maximum image size is 100 megapixels (e.g. 10000&times;10000 pixels large). Maximum file size is 70MB.
+
+## Authorization and cookies are not supported
+
+Image requests to the origin will be anonymized (no cookies, no auth, no custom headers). This is because we have to have one public cache for resized images, and it would be unsafe to share images that are personalized for individual visitors.
+
+You can use unguessable URLs for images (e.g. with long random IDs) and/or handle cookie-based authentication in a Worker that manages image resizing.
+
+## Caching and purging
+
+Changes to image dimensions or other resizing options should always take effect immediately — no purging necessary.
+
+Image requests consists of two parts: running Worker code, and image processing. The Worker code is always executed and uncached. Results of image processing are cached for one hour or longer if origin server's `Cache-Control` header allows.
+
+Because responses from Workers themselves are not cached at the edge, purging of *Worker URLs* doesn’t do anything. Resized image variants are cached together under their source’s URL. When purging, use the (full-size) source image’s URL, rather than URLs of the Worker that requested resizing.
+
+If the origin server sends an `Etag` HTTP header, the resized images will have an `Etag` HTTP header that has a format `cf-<gibberish>:<etag of the original image>`. You can compare the second part with the `Etag` header of the source image URL to check if the resized image is up to date.
diff --git a/products/images/src/content/url-format.md b/products/image-resizing/src/content/url-format.md
similarity index 99%
rename from products/images/src/content/url-format.md
rename to products/image-resizing/src/content/url-format.md
index 42ddb8dc989..31fdf1a3d04 100644
--- a/products/images/src/content/url-format.md
+++ b/products/image-resizing/src/content/url-format.md
@@ -1,5 +1,6 @@
 ---
-order: 1
+order: 2
+pcx-content-type: configuration
 ---
 
 # URL format
diff --git a/products/image-resizing/wrangler.toml b/products/image-resizing/wrangler.toml
new file mode 100644
index 00000000000..f031d7bd2f7
--- /dev/null
+++ b/products/image-resizing/wrangler.toml
@@ -0,0 +1,15 @@
+name = "image-resizing"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/image-resizing*"
+kv_namespaces = [{ binding = "REDIRECTS", id = "0821ddd66f4742bdbbb56593b8b43fd8", preview_id = "0821ddd66f4742bdbbb56593b8b43fd8" }]
+
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
diff --git a/products/images/docs-config.js b/products/images/docs-config.js
index ebf123342ae..895887caa26 100644
--- a/products/images/docs-config.js
+++ b/products/images/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Run your image optimization logic at the edge.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/images",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/images/src/content/index.md b/products/images/src/content/index.md
index 316f9174417..b115f7e2853 100644
--- a/products/images/src/content/index.md
+++ b/products/images/src/content/index.md
@@ -1,30 +1,9 @@
 ---
-type: overview
-title: Welcome
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Cloudflare Image Resizing docs
 
-<ContentColumn>
-
-You can transform images on Cloudflare’s edge platform. You can resize, adjust quality, and convert images to WebP or AVIF format on demand. We’ll automatically cache every derived image at the edge, so you only need to store one original image at your origin.
-
-- Quickly and easily adapt images to your site’s layout and your visitors’ screen sizes without maintaining a server-side image processing pipeline on your servers.
-
-- Image processing [integrates well with Workers](/resizing-with-workers), which enables advanced integrations such as custom URL schemes, content negotiation and responsive images based on Client Hints.
-
-## Two ways to use
-
-You can use Cloudflare Image Resizing with either a pre-defined [URL format](/url-format) or with [Cloudflare Workers](/resizing-with-workers), for advanced use-cases.
-
-<ButtonGroup>
-  <Button type="primary" href="/url-format">Learn the URL format</Button>
-  <Button type="secondary" href="/resizing-with-workers">View the Workers docs</Button>
-</ButtonGroup>
-
-## Availability
-
-Image Resizing is available today for Business and Enterprise Customers. To enable it, login to the Cloudflare Dashboard and navigate to the Speed Tab. There you’ll find the section for Image Resizing which you can enable with one click.
-
-</ContentColumn>
+This content has moved to https://developers.cloudflare.com/image-resizing/
diff --git a/products/images/src/content/troubleshooting.md b/products/images/src/content/troubleshooting.md
deleted file mode 100644
index 2ae6207b5b8..00000000000
--- a/products/images/src/content/troubleshooting.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-order: 6
----
-
-# Troubleshooting
-
-## Requests without resizing enabled
-
-Does the response have a `Cf-Resized` header? If **not**, then resizing has not been attempted. Possible causes:
-
-  * There’s another Worker running on the same request. Resizing is "forgotten" as soon as one Worker calls another. Don’t use Workers scoped to the entire domain `/*`.
-  * Preview in the Editor in the Dashboard is does not simulate image resizing. You must deploy the Worker and test from another browser tab instead.
-
-## Error responses from resizing
-
-When resizing fails, the response body contains an error message explaining the reason, as well as the `Cf-Resized` header containing `err=code`:
-
-* 9401 — Missing or invalid required arguments in `{cf:image{…}}` options, e.g. `width` is not a number.
-* 9402 — Download of the original image failed, e.g. because the image was too large or the connection was interrupted.
-* 9403 — [Request loop](/resizing-with-workers#preventing-request-loops). The service was asked to resize an already-resized image, or the Worker has fetched its own URL.
-* 9406 & 9419 — Invalid image URL specified (e.g. contains spaces, unescaped Unicode, or non-HTTP/S URL).
-* 9407 — Origin domain name lookup error.
-* 9404 — Origin returned 404 HTTP status code. The image doesn’t exist on the origin server, or a wrong URL was given to resize.
-* 9408 — Origin returned 4xx HTTP status code. The origin server may be denying access to the image.
-* 9509 — Origin returned 5xx HTTP status code. This is most likely a problem with the origin server-side software, not image resizing.
-* 9412 — Origin returned a non-image, e.g. a HTML page. This usually happens when an invalid URL is specified, or server-side software has printed an error, or presented a login page.
-* 9413 — The image is too large (exceeds 10000 pixels width or height)
-* 9420 — Origin server redirected to an invalid URL.
-* 9421 — Origin redirected too many times.
-* 9504, 9505 & 9510 — Unable to contact origin. The origin server may be down or overloaded.
-* 9524 — `/cdn-cgi/image/` resizing service could not perform resizing, probably because the image URL was intercepted by a Worker.
-* 9511 — Image format not supported.
-* 9522 — Exceeded processing limit. This may happen briefly after purging an entire zone or when requesting files with huge dimensions. If the problem persists, please contact support.
-* 9424, 9516, 9517, 9518 & 9523 — Internal errors. Please contact support if you encounter these errors.
-
-## Limits
-
-Maximum image size is 100 megapixels (e.g. 10000&times;10000 pixels large). Maximum file size is 70MB.
-
-## Authorization and cookies are not supported
-
-Image requests to the origin will be anonymized (no cookies, no auth, no custom headers). This is because we have to have one public cache for resized images, and it would be unsafe to share images that are personalized for individual visitors.
-
-You can use unguessable URLs for images (e.g. with long random IDs) and/or handle cookie-based authentication in a Worker that manages image resizing.
-
-## Caching and purging
-
-Changes to image dimensions or other resizing options should always take effect immediately — no purging necessary.
-
-Image requests consists of two parts: running Worker code, and image processing. The Worker code is always executed and uncached. Results of image processing are cached for one hour or longer if origin server's `Cache-Control` header allows.
-
-Because responses from Workers themselves are not cached at the edge, purging of *Worker URLs* doesn’t do anything. Resized image variants are cached together under their source’s URL. When purging, use the (full-size) source image’s URL, rather than URLs of the Worker that requested resizing.
-
-If the origin server sends an `Etag` HTTP header, the resized images will have an `Etag` HTTP header that has a format `cf-<gibberish>:<etag of the original image>`. You can compare the second part with the `Etag` header of the source image URL to check if the resized image is up to date.
diff --git a/products/images/wrangler.toml b/products/images/wrangler.toml
index 29b9e89da5d..a5cb1d235c3 100644
--- a/products/images/wrangler.toml
+++ b/products/images/wrangler.toml
@@ -2,7 +2,6 @@ name = "images"
 type = "webpack"
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
 workers_dev = true
-kv_namespaces = [{ binding = "REDIRECTS", id = "fa21f9d866a14296b2d53f4ee161ab11", preview_id = "fa21f9d866a14296b2d53f4ee161ab11" }]
 
 [env.production]
 workers_dev = false
diff --git a/products/load-balancing/docs-config.js b/products/load-balancing/docs-config.js
index 465ad2d8e8a..ca869b7cde0 100644
--- a/products/load-balancing/docs-config.js
+++ b/products/load-balancing/docs-config.js
@@ -1,7 +1,7 @@
 module.exports = {
   product: "Load Balancing",
   pathPrefix: "/load-balancing",
-  productLogoPathD: "dummy content",
+  productLogoPathD: "M18 35.82l4.58 4.58a2 2 0 002.84 0L40.4 25.42a2 2 0 000-2.84L25.42 7.6a2 2 0 00-2.84 0L7.6 22.58a2 2 0 000 2.84l7.4 7.4V23.4c0-.77.63-1.4 1.4-1.4H28v-3.13a.4.4 0 01.66-.3l5.24 4.47a.6.6 0 010 .92l-5.24 4.48a.4.4 0 01-.66-.3V25H18v10.82zM5.47 20.45L20.45 5.47a5.02 5.02 0 017.1 0l14.98 14.98a5.02 5.02 0 010 7.1L27.55 42.53a5.02 5.02 0 01-7.1 0L5.47 27.55a5.02 5.02 0 010-7.1z",
   contentRepo: "cloudflare/cloudflare-docs",
   contentRepoFolder: "products/load-balancing",
   externalLinks: [
@@ -20,6 +20,6 @@ module.exports = {
     description: "Balance traffic loads, manage failovers, monitor server and pool health, and apply geographic control with Cloudflare Load Balancing",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/load-balancing",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/load-balancing/src/content/about/index.md b/products/load-balancing/src/content/about/index.md
new file mode 100644
index 00000000000..57b6f3eec2f
--- /dev/null
+++ b/products/load-balancing/src/content/about/index.md
@@ -0,0 +1,42 @@
+---
+order: 1
+pcx-content-type: concept
+---
+
+# About
+
+Cloudflare Load Balancing allows you to distribute traffic across your servers, which reduces server strain and latency and improves the experience for end users.
+
+## Benefits
+
+Cloudflare Load Balancing provides three main benefits:
+
+- **Load balancing and failover**: Distribute traffic evenly across your healthy servers, [automatically failing over](/understand-basics/load-balancers) when a server is unhealthy or unresponsive.
+- **Active health checks**: [Monitor your servers](/understand-basics/monitors) at configurable intervals and across multiple data centers to look for specific status codes, response text, and timeouts.
+- **Intelligent routing**: Choose whether to [distribute requests](/understand-basics/traffic-steering) based on server latency, a visitor's geographic region, or even a visitor's GPS coordinates.
+
+<Aside type='note' header="Note">
+
+If you are only interested in monitoring server health — and not in distributing traffic according to server health — check out our <a href="https://support.cloudflare.com/hc/articles/4404867308429">standalone Health Checks</a>.
+
+</Aside>
+
+## Availability
+
+Cloudflare Load Balancing is available as an add-on feature for any type of account. The exact number of load balancers, origin servers, and monitors depend on your plan type.
+
+## Load Balancing components
+
+Cloudflare Load Balancing has three major components:
+
+- The [**Load Balancer**](/understand-basics/load-balancers) is identified by a DNS hostname (`www.example.com`) for which you want to balance traffic. A load balancer defines which origin-server pools to use, the order in which they should be used, and how to geographically distribute traffic to different pools.
+- [**Pools**](/understand-basics/pools) represent a group of origin servers (or endpoints), each identified by its IP address or hostname. You can configure multiple pools, as well as failover priority (Pool A-> Pool B-> Pool C). If you're familiar with DNS terminology, think of a pool as a “record set,” except we only return addresses of origins that are considered healthy. You can attach health checks to individual pools to tailor monitoring to collections of servers.
+- [**Monitors**](/understand-basics/monitors) configure availability monitoring. When a monitor is attached to a pool, Cloudflare will run health checks on that pool’s origin servers from our data centers around the world. You can customize monitoring for specific URLs by using periodic HTTP/HTTPS requests, which allow you to set request intervals, timeouts, and status codes.
+
+You can reuse monitors and pools across many load balancers. For example, your `.co.uk` domain might use a different ordering of pools (favoring your London servers, for instance) than your `.com.au` domain.
+
+<Aside type='note' header="Tip">
+
+For more information about load balancing as a concept, refer to <a href="https://www.cloudflare.com/learning/performance/what-is-load-balancing/">What is load balancing?</a>
+
+</Aside>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/additional-options/cloudflare-tunnel.md b/products/load-balancing/src/content/additional-options/cloudflare-tunnel.md
new file mode 100644
index 00000000000..6506ca1fc78
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/cloudflare-tunnel.md
@@ -0,0 +1,11 @@
+---
+order: 1
+pcx-content-type: navigation
+title: Cloudflare Tunnel
+---
+
+# Route traffic through a Cloudflare Tunnel
+
+Cloudflare Tunnel (formerly Argo Tunnel) establishes a secure outbound connection which runs in your infrastructure to connect the applications and machines to Cloudflare.
+
+For more details, refer to [Route tunnel traffic using a load balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb).
diff --git a/products/load-balancing/src/content/additional-options/deploy-containerized-applications.md b/products/load-balancing/src/content/additional-options/deploy-containerized-applications.md
new file mode 100644
index 00000000000..67fa1233e28
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/deploy-containerized-applications.md
@@ -0,0 +1,47 @@
+---
+title: Containerized applications
+order: 8
+pcx-content-type: how-to
+---
+
+# Deploy containerized applications
+
+Cloudflare’s Load Balancer distributes global traffic intelligently across Google Kubernetes Engine (GKE) and Amazon Web Services EC2 (AWS). Cloudflare’s native Kubernetes support provides a multi-cloud deployment that is transparent to end users.
+
+![Application deployed across Google Kubernetes Engine and AWS](../static/images/best-practices-2.png)
+
+## Prerequisites
+
+Before you begin, be sure you have the following:
+
+- Access to Google Cloud Platform (GCP)
+- Access to AWS
+- Docker image
+- A domain on Cloudflare (on the Free, Pro, or Business plan) with a Load Balancing subscription, configurable in **Traffic** on the dashboard
+
+## Deploying a containerized web application on Google Kubernetes Engine
+
+You will be using [Google Cloud Shell](https://cloud.google.com/shell/) interface, which comes preinstalled with the gcloud console, docker, and kubectl command-line tools used below. If you use Cloud Shell, you do not need to install these command-line tools on your workstation.
+
+### Getting started
+
+Go to the [Kubernetes Engine](https://console.cloud.google.com/kubernetes?_ga=2.151836153.-1932148812.1510627946). Click the **Activate Google Cloud Shell** button at the top of the console window. A Cloud Shell session with a command prompt will open in a new frame at the bottom of the console.
+
+![Use the Cloud Shell in Google Kubernetes Engine](../static/images/best-practices-3.png)
+
+Set default configuration values by running the following commands:
+
+- `gcloud config set project PROJECT_ID`
+- `gcloud config set compute/zone us-west1-a`
+
+## Deploying a web application
+
+1. Create a container cluster to run the container image. A cluster consists of a pool of Compute Engine VM instances running Kubernetes.
+
+   - Run the following command to create a three-node cluster (our cluster name is _camilia-cluster_): `gcloud container clusters create camilia-cluster --num-nodes=3`
+
+   - It may take several minutes for the cluster to be created. Once the command is complete, run the following command to see the cluster’s three worker VM instances: `gcloud compute instances list`
+
+1. Deploy the application to the cluster. Use the kubectl command-line tool to deploy and manage applications on a Kubernetes Engine cluster.
+   You can create a simple nginx docker container, for example, using the following command (*camilia-nginx* is the name for the deployment):
+   `kubectl run camilia-nginx --image=nginx --port 80`
diff --git a/products/load-balancing/src/content/additional-options/index.md b/products/load-balancing/src/content/additional-options/index.md
new file mode 100644
index 00000000000..b64d386534b
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/index.md
@@ -0,0 +1,10 @@
+---
+order: 48
+pcx-content-type: navigation
+---
+
+# Additional options
+
+Beyond [creating a simple load balancer](/create-load-balancer-ui), you may want to further customize how your load balancer routes traffic or integrate your load balancer with other Cloudflare products.
+
+<DirectoryListing path="/additional-options"/>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-rules/actions.md b/products/load-balancing/src/content/additional-options/load-balancing-rules/actions.md
similarity index 100%
rename from products/load-balancing/src/content/understand-basics/load-balancing-rules/actions.md
rename to products/load-balancing/src/content/additional-options/load-balancing-rules/actions.md
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-rules/create-rules.md b/products/load-balancing/src/content/additional-options/load-balancing-rules/create-rules.md
similarity index 83%
rename from products/load-balancing/src/content/understand-basics/load-balancing-rules/create-rules.md
rename to products/load-balancing/src/content/additional-options/load-balancing-rules/create-rules.md
index 12a069e696b..c2584f967e4 100644
--- a/products/load-balancing/src/content/understand-basics/load-balancing-rules/create-rules.md
+++ b/products/load-balancing/src/content/additional-options/load-balancing-rules/create-rules.md
@@ -8,7 +8,7 @@ pcx-content-type: how-to
 
 ## Overview
 
-Create and manage [Load Balancing rules](/understand-basics/load-balancing-rules) in the **Custom Rules** page, which is part of the Create/Edit Load Balancer workflow in the **Traffic** app.
+Create and manage [Load Balancing rules](../load-balancing-rules) in the **Custom Rules** page, which is part of the Create/Edit Load Balancer workflow in the **Traffic** app.
 
 ---
 
@@ -28,8 +28,6 @@ Create and manage [Load Balancing rules](/understand-basics/load-balancing-rules
 
 1. Select **Traffic** > **Load Balancing**.
 
-  ![Load Balancing tab in the Traffic app](../../static/images/load-balancing-tab.png)
-
 1. Edit an existing load balancer or [create a new load balancer](/create-load-balancer-ui).
 
 1. From the Load Balancer workflow, select **Custom Rules**.
@@ -92,11 +90,11 @@ Create and manage [Load Balancing rules](/understand-basics/load-balancing-rules
 
 ---
 
-1. In the **Field** drop-down list, choose an HTTP property. For more details, see [Supported fields](/understand-basics/load-balancing-rules/reference).
+1. In the **Field** drop-down list, choose an HTTP property. For more details, see [Supported fields](../reference).
 
   ![Screenshot, Create Custom Rule dialog, choose Field](../../static/images/create-custom-rule-field.png)
 
-1. In the **Operator** drop-down list, choose an operator. For more details, see [Operators](/understand-basics/load-balancing-rules/reference#operators).
+1. In the **Operator** drop-down list, choose an operator. For more details, see [Operators](../reference#operators).
 
 1. Enter the value to match. When the field is an ordered list, **Value** is a drop-down list. Otherwise, **Value** is a text input.
 
@@ -124,8 +122,6 @@ To save a new load balancer rule, make sure to save both the rule **and** the ov
 
 1. After you create your rule, select **Save and Deploy** or **Save as Draft**.
 
-1. Select **Next** and review your changes:
-
-    ![Screenshot, Edit Load Balancer, Review](../../static/images/edit-load-balancer-review.png)
+1. Select **Next** and review your changes.
 
 1. Select **Save**.
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-rules/expressions.md b/products/load-balancing/src/content/additional-options/load-balancing-rules/expressions.md
similarity index 89%
rename from products/load-balancing/src/content/understand-basics/load-balancing-rules/expressions.md
rename to products/load-balancing/src/content/additional-options/load-balancing-rules/expressions.md
index 28b3ea9f84a..8ad03fcb854 100644
--- a/products/load-balancing/src/content/understand-basics/load-balancing-rules/expressions.md
+++ b/products/load-balancing/src/content/additional-options/load-balancing-rules/expressions.md
@@ -8,7 +8,7 @@ pcx-content-type: reference
 
 ## Overview
 
-[Load Balancing rules](/understand-basics/load-balancing-rules) uses two kinds of expressions:
+[Load Balancing rules](/additional-options/load-balancing-rules) uses two kinds of expressions:
 
 - [Simple expressions](#simple-expressions) compare a value from an HTTP request to a value defined in the expression. A simple expression is identified by the presence of a **comparison operator** (_equals_ or _less than_, for example).
 
@@ -40,7 +40,7 @@ In general, simple expressions use this pattern:
 <field> <operator> <value>
 ```
 
-For more, see [_Supported fields and operators_](/understand-basics/load-balancing-rules/reference).
+For more, see [_Supported fields and operators_](/additional-options/load-balancing-rules/reference).
 
 ---
 
@@ -63,7 +63,7 @@ In general, compound expressions use this pattern:
 
 A compound expression can be an operand of a logical operator. This allows multiple operators to construct a compound expression from many individual expressions.
 
-For more, see [_Supported fields and operators_](/understand-basics/load-balancing-rules/reference).
+For more, see [_Supported fields and operators_](/additional-options/load-balancing-rules/reference).
 
 ---
 
@@ -88,7 +88,7 @@ The **Expression Preview** displays the expression in text:
 and (http.request.uri.query contains "webserver")
 ```
 
-For a walkthrough, see [_Creating Load Balancing rules_](/understand-basics/load-balancing-rules/create-rules).
+For a walkthrough, see [_Creating Load Balancing rules_](/additional-options/load-balancing-rules/create-rules).
 
 ### Expression Editor
 
@@ -112,4 +112,4 @@ For example, you might create a list of known office IP addresses and use it in
 
 Cloudflare stores your lists at the account level and sends to the edge, so you can view, manage, and incorporate them into firewall rules for any of your zones.
 
-For more, see [_Rules Lists_](https://developers.cloudflare.com/firewall/cf-firewall-rules/rules-lists) in the Firewall Rules documentation.
+For more, see [Rules Lists](https://developers.cloudflare.com/firewall/cf-firewall-rules/rules-lists) in the Firewall Rules documentation.
diff --git a/products/load-balancing/src/content/additional-options/load-balancing-rules/index.md b/products/load-balancing/src/content/additional-options/load-balancing-rules/index.md
new file mode 100644
index 00000000000..b1048976f1b
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/load-balancing-rules/index.md
@@ -0,0 +1,25 @@
+---
+title: Custom load balancing rules
+order: 17
+pcx-content-type: concept
+---
+
+# Custom rules
+
+Use load balancing rules to customize the behavior of your [load balancer](/understand-basics/load-balancers). For example, create a rule that selects an [origin pool](/understand-basics/pools) based on the URI path of an HTTP request.
+
+## More details
+
+You can [create Load Balancing rules](create-rules) whenever you create or edit a load balancer in **Traffic** > **Load Balancing**.
+
+As with Cloudflare [Firewall rules](https://developers.cloudflare.com/firewall/cf-firewall-rules), each Load Balancing rule is a combination of two elements: an [expression](expressions) and an [action](actions). Expressions define the criteria for an HTTP request to trigger an action. The action tells Cloudflare how to handle the request.
+
+When building expressions for Load Balancing rules, refer to [Supported fields and operators](reference) for definitions and usage.
+
+## Availability
+
+By default, non-Enterprise customers have **one** Load Balancing rule **per domain**. For more rules, upgrade to [Enterprise](https://www.cloudflare.com/enterprise/).
+
+## Limitations
+
+At the moment, you cannot use load balancing rules with [Cloudflare Spectrum](https://developers.cloudflare.com/spectrum/load-balancer).
\ No newline at end of file
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-rules/reference.md b/products/load-balancing/src/content/additional-options/load-balancing-rules/reference.md
similarity index 100%
rename from products/load-balancing/src/content/understand-basics/load-balancing-rules/reference.md
rename to products/load-balancing/src/content/additional-options/load-balancing-rules/reference.md
diff --git a/products/load-balancing/src/content/additional-options/load-shedding.md b/products/load-balancing/src/content/additional-options/load-shedding.md
new file mode 100644
index 00000000000..4e32e680827
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/load-shedding.md
@@ -0,0 +1,134 @@
+---
+order: 14
+pcx-content-type: tutorial
+---
+
+# Load shedding
+
+Use load shedding to prevent an at-risk origin from [becoming unhealthy](/understand-basics/health-details) and starting the failover process. 
+
+Once you configure load shedding on a pool, that pool will begin diverting traffic to other pools according to your load shedding settings and the load balancer's [steering policy](/understand-basics/traffic-steering).
+
+## Step 1 — Identify at-risk origins
+
+Using your internal metrics, identify origins at risk of reaching their failure threshold.
+
+- If your origin is seeing increased traffic but is not yet at risk of failure, start with [Step 2](#step-2--shed-default-traffic).
+- If your origin is about to fail, start with [Step 4](#step-4--shed-additional-traffic-optional).
+
+## Step 2 — Shed default traffic from a pool
+
+Once you have identified an at-risk origin, shed a small amount of **Default** traffic from that origin's pool. This traffic is not affiliated with existing [Session affinity](/understand-basics/session-affinity) sessions.
+
+Configure load shedding via the [dashboard](#configure-via-dashboard) or the [API](#configure-via-api).
+
+### Configure via dashboard
+
+To enable load shedding for a specific pool via the dashboard:
+1. Go to **Traffic** > **Load Balancing**.
+1. Click **Manage Pools**.
+1. On a pool, click **Edit**.
+1. Click the **Configure Load Shedding** dropdown.
+1. For **Default traffic**, select a **Policy** and a **Shed %**:
+
+    <details>
+    <summary>Policy options</summary>
+    <div>
+    When shedding <strong>Default traffic</strong>, you have two <strong>Policy</strong> options:
+
+    - **Random**: Randomly sheds the percentage of requests specified in the *Shed %*. Distributes traffic more accurately, but may cause requests from the same IP to hit different origins.
+    - **IP hash**: Sheds the percentage of IP address hash space specified in the *Shed %*. Ensures requests from the same IP will hit the same origin, but may shed a significantly higher or lower percentage of requests.
+
+    For more guidance on choosing a policy, see [Shedding policies](#shedding-policies).
+    </div>
+    </details>
+
+    <details>
+    <summary>Shed %</summary>
+    <div>
+    When choosing a <strong>Shed %</strong>, start with a small percentage and increase gradually. Particularly if you choose the <a href="#shedding-policies">IP hash</a> shedding policy, you might shed more traffic than expected.
+    </div>
+    </details>
+
+### Configure via API
+
+To enable load shedding for a specific pool via the API, [update the values](https://api.cloudflare.com/#account-load-balancer-pools-update-pool) for the pool's `load_shedding` object.
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```json
+---
+header: Request
+---
+curl -X PATCH "https://api.cloudflare.com/client/v4/accounts/{account-id}/load_balancers/pools/{pool-id}" \
+     -H "X-Auth-Email: user@example.com" \
+     -H "X-Auth-Key: REDACTED" \
+     -H "Content-Type: application/json" \
+     --data-binary '{
+         "load_shedding": {
+             "default_percent": 20,
+             "default_policy": "random",
+             "session_percent": 0,
+             "session_policy": "hash"
+         }
+     }'
+```
+</div>
+</details>
+
+For more guidance on choosing a shedding policy, see [Shedding policies](#shedding-policies).
+
+## Step 3 — Monitor traffic
+
+Once you have started shedding default traffic, evaluate the effects by reviewing the [**Overview** metrics](/load-balancing-analytics#overview-metrics) in Load Balancing analytics. Based on these numbers and your internal metrics, you will know whether you need to divert additional traffic from the pool.
+
+If you see increased traffic to a pool, you may need to shed additional traffic. Pools shed a percentage of total traffic, so any increase in total traffic will also increase the traffic reaching your pool.
+
+## Step 4 — Shed additional traffic (optional)
+
+If you need to shed additional pool traffic:
+1. Follow the steps outlined in [Step 2](#step-2--shed-default-traffic-from-a-pool).
+    - In the dashboard, increase the **Shed %** for **Default traffic** and/or **Session affinity traffic**.
+    - For the API, increase the value for `default_percent` and/or `session_percent`.
+
+Since shedding **Session Affinity traffic** will disrupt [existing sessions](/understand-basics/session-affinity) and may degrade the customer experience, only enable this option if your pool is in imminent danger of becoming unhealthy or your pool has a high percentage of traffic related to existing sessions. For more guidance, see [Shedding policies](#shedding-policies).
+
+## Step 5 — Disable load shedding
+
+Once an origin is no longer at risk, remove load shedding from the pool.
+
+To remove load shedding in the dashboard, perform the same steps as [Configure load shedding via the dashboard](#configure-via-dashboard) but set the **Shed %** to `0` for both **Default traffic** and **Session affinity traffic**.
+
+To remove load shedding via the API, perform the same steps as [Configure load shedding via the API](#configure-via-api) but set the `load_shedding` object to `null`.
+
+## Additional notes
+
+### Shedding policies
+
+For **Default traffic**, you have two choices for shedding policy.
+
+A *Random* policy:
+
+- Randomly sheds the percentage of requests specified in the *Shed %*.
+- Distributes traffic more accurately because it sheds at the request level.
+- May cause requests from the same IP to hit different origins, potentially leading to cache misses, inconsistent latency, or session disruption for [DNS-only load balancers](/understand-basics/proxy-modes#dns-only-mode).
+
+An *IP hash* policy:
+
+- Sheds the percentage of IP address hash space specified in the *Shed %*.
+- Ensures requests from the same IP will hit the same origin, which will increase cache hits, provide consistent latency, and preserve sessions.
+- Can over- or under-shed requests, since hashing does not guarantee a perfectly even IP distribution and individual IPs may be responsible for different percentages of your requests.
+
+Choose a *Random* policy when you want a more accurate distribution of raw requests and an *IP hash* policy when you want to prevent a single IP from flapping between different origins.
+
+For **Session Affinity traffic**, you can only use an *IP hash* policy since these requests relate to existing sessions. Only increase the *Shed %* if you are comfortable disrupting [existing sessions](/understand-basics/session-affinity).
+
+### Fallback pools
+
+If all pools within a load balancer have *Load shedding* enabled, some traffic will go to the fallback pool. To prevent any traffic from reaching the fallback pool, ensure at least one pool within the load balancer **does not** have load shedding enabled.
+
+### Pools in multiple load balancers
+
+If you enable load shedding on an origin pool, it will shed the same percentage of traffic across all your load balancers. If you need an origin to shed different percentages of traffic for different load balancers, put that origin in multiple pools.
\ No newline at end of file
diff --git a/products/load-balancing/src/content/additional-options/pagerduty-integration.md b/products/load-balancing/src/content/additional-options/pagerduty-integration.md
new file mode 100644
index 00000000000..31946797d19
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/pagerduty-integration.md
@@ -0,0 +1,16 @@
+---
+order: 40
+pcx-content-type: how-to
+---
+
+# Integrate with PagerDuty
+
+To integrate Cloudflare Health Check notifications with PagerDuty, follow the steps outlined in PagerDuty’s [Email Integration Guide](https://www.pagerduty.com/docs/guides/email-integration-guide/). If you do not have a PagerDuty account, you will first need to set that up.
+
+PagerDuty will generate an email address that will create incidents based on emails sent to that address.
+
+If you already have email integration configured in PagerDuty, you can find the designated email address by going to **Configuration > Services > Email** (under **Integrations**).
+
+![Locate your existing email in Pagerdutry](../static/images/monitors-1.png)
+
+When creating the Notifier object, configure the email to go to the PagerDuty integration email. Consequently, whenever a pool or origin goes down, an Incident will be created to capture it.
\ No newline at end of file
diff --git a/products/load-balancing/src/content/additional-options/planned-maintenance.md b/products/load-balancing/src/content/additional-options/planned-maintenance.md
new file mode 100644
index 00000000000..ff656a85de8
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/planned-maintenance.md
@@ -0,0 +1,63 @@
+---
+order: 5
+pcx-content-type: how-to
+---
+
+# Planned maintenance
+
+When you change application settings or add new assets, you will likely want to make these changes on one origin server at a time. Going server by server reduces the risk of changes and ensures a more consistent user experience.
+
+To take servers out of rotation gradually (important for session-based load balancing), [enable origin drain](#gradual-rotation) on your load balancer. This option is only available for [proxied load balancers (orange-clouded)](/understand-basics/proxy-modes).
+
+To direct traffic away from your origin server immediately, [adjust settings on the pool or monitor](#immediate-rotation).
+
+<Aside type="note">
+
+If you want to divert traffic from an origin to prevent it from becoming unhealthy, use [Load Shedding](/additional-options/load-shedding) instead.
+
+</Aside>
+
+## Before you begin
+
+Before disabling any origin server, review the settings for any affected load balancers and pools. 
+
+If a pool falls below its **Health Threshold**, it will be considered **Unhealthy** and — depending on the load balancer setup and steering policy — a load balancer may begin routing traffic away from that pool.
+
+## Gradual rotation
+
+<Aside type="note">
+
+Origin drain is only available for [proxied load balancers (orange-clouded)](/understand-basics/proxy-modes).
+
+</Aside>
+
+With [session-based load balancing](/understand-basics/session-affinity), it is important to direct all requests from a particular end user to a specific origin server. Otherwise, information about the user session — such as items in their shopping cart — may be lost and lead to negative business outcomes.
+
+To remove a server from rotation while still preserving session continuity, set up **Origin drain** on a load balancer:
+
+1. On a new or existing load balancer, go to the **Hostname** step.
+1. Make sure you have enabled **Session Affinity**.
+1. For **Origin drain duration**, enter a time in seconds. If this value is less than the **Session TTL** value, you will affect existing sessions.
+    ![Session affinity configuration with origin drain](../static/images/session-affinity-3.png)
+1. Save your changes to the load balancer.
+1. Click **Manage Pools**.
+1. Disable an origin. Your load balancer will gradually drain sessions from that origin.
+1. On your load balancer, expand your pools to find the disabled origin. You will see the estimated **Drain Time** counting down.
+    ![Manage Load Balancer table with draining in progress](../static/images/session-affinity-4.png)
+1. When a drain is **Complete**, there are no longer any connections to that origin.
+    ![Manage Load Balancer table with draining complete](../static/images/session-affinity-5.png)
+1. Perform your required maintenance or upgrades.
+1. To bring your origin back online, re-enable the origin.
+
+## Immediate rotation
+
+To direct traffic away from an origin server immediately: 
+
+1. Do one of the following actions:
+    - On the origin's [monitor](/understand-basics/monitors), update the monitor settings so the origin will fail health checks, such as putting an incorrect value for the **Response Body** or **Response Code**.
+    - On the pool, disable the origin.
+    - On the pool, set the [origin weight](/understand-basics/weighted-load-balancing) to `0` (though traffic may still reach the origin if it is included in multiple pools).
+1. Monitor [Load Balancing Analytics](/load-balancing-analytics) to make sure no requests are reaching the pool.
+    - If you are using [DNS-only load balancing (gray-clouded)](/understand-basics/proxy-modes), changes may be delayed due to DNS resolver caching.
+1. Perform your required maintenance or upgrades.
+1. Undo the changes you made in **Step 1**.
diff --git a/products/load-balancing/src/content/additional-options/railgun.md b/products/load-balancing/src/content/additional-options/railgun.md
new file mode 100644
index 00000000000..ed901575b6d
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/railgun.md
@@ -0,0 +1,33 @@
+---
+order: 1
+pcx-content-type: how-to
+title: Railgun
+---
+
+# Use a load balancer with Railgun
+
+[**Railgun**](https://developers.cloudflare.com/railgun) is a web proxy system that allows dynamic content for a website — such as news sites or personalized content — to be cached while also allowing changes to the site to take effect almost instantly. Railgun is currently available to customers with a Business or Enterprise plan or via one of Cloudflare’s Optimised Partners.
+
+By adding a load balancer to Railgun, you speed up connections between Cloudflare data centers and DNS origin servers so that uncacheable requests have minimal latency.
+
+<Aside type="note">
+
+For additional guidance and diagrams, refer to [Best practices for Railgun with a Load Balancer](https://support.cloudflare.com/hc/articles/200168346).
+
+</Aside>
+
+## Set up Railgun in front of a load balancer
+
+We recommend that you put Railgun in front of your load balancer so the load balancer can handle HTTP connections normally. This option provides a much simpler setup because it is difficult to load balancing long-lived TLS connections between the sender and listener.
+
+Use the same load balancer settings as if Railgun were not in place. For example, enable HTTP keep-alive connections and set them to a 90-second timeout, since Railgun is working as an HTTP reverse proxy.
+
+## Set up Railgun behind a load balancer
+
+Though Railgun's optimal placing is in front of your load balancer, you can also put Railgun behind a load balancer.
+
+Observe the following guidelines to avoid interruptions with site traffic:
+
+1. Use the `railgun-nat.conf` configuration file to set the internal addresses of the hosts Railgun will be optimizing (`localhost:8080`, for example). This is important to avoid looping the request outbound to the internet and back to the load balancer only to be forwarded to the origin.
+1. Ensure no firewall rules are in place that will interfere with traffic between the listener and the origin server.
+1. Ensure port 2408 is open and passed through the load balancer so that it does not interfere with the TLS connection between the listener and sender.
diff --git a/products/load-balancing/src/content/additional-options/spectrum.md b/products/load-balancing/src/content/additional-options/spectrum.md
new file mode 100644
index 00000000000..5896d3036ca
--- /dev/null
+++ b/products/load-balancing/src/content/additional-options/spectrum.md
@@ -0,0 +1,11 @@
+---
+order: 1
+pcx-content-type: navigation
+title: Spectrum
+---
+
+# Add load balancing to Spectrum applications
+
+You can configure a load balancer to provide TCP healthchecks, failover, and traffic steering to bring resiliency to your Spectrum applications.
+
+For more details, refer to [Load balancing in Spectrum applications](https://developers.cloudflare.com/spectrum/load-balancer).
diff --git a/products/load-balancing/src/content/best-practices/index.md b/products/load-balancing/src/content/best-practices/index.md
deleted file mode 100644
index e164c1f1aa3..00000000000
--- a/products/load-balancing/src/content/best-practices/index.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: Best practices
-order: 40
-pcx-content-type: best-practices
----
-
-# Best practices for Cloudflare Load Balancing
-
-## Planned maintenance
-
-When making changes to your applications or adding assets, you may want to roll out those changes one origin at a time to ensure they work properly. However, as the load balancer continues to direct traffic among multiple origins, both versions of your app are served and the user has an inconsistent experience.
-
-To avoid an inconsistent user experience when rolling out application changes, you can temporarily configure load balancing not to direct traffic to each origin as you upgrade them.
-
-### Using the Load Balancing dashboard to temporarily ignore an origin server
-
-To temporarily ignore an origin server:
-
-1. Update the associated monitor so that your origin will fail health checks, which will route traffic away from that origin. This might include setting:
-    - The **Response Code** to an HTTP status code you know your server does not return
-    - An incorrect value for **Response Body**, such as a specific text string
-
-1. Confirm the origin server is not receiving traffic. Load Balancing will issue a notification email that the origin is down.
-
-1. Upgrade the origin and test that the change is working as you intended.
-
-1. Re-enable load balancing for the upgraded origin server by restoring the values you modified in Step 1 to those expected for a healthy origin.
-
-1. Repeat these steps for the other origins across which you are balancing application traffic.
-
-### Using the Cloudflare API to temporarily set origin status to _disabled_
-
-Automate this process with the [Load Balancing Cloudflare API](https://api.cloudflare.com/#load-balancer-pools-modify-a-pool) by setting the status of an origin server to `disabled`.
-
-To temporarily set origin status to _disabled_, use the Update Load Balancer command to set the `enabled` property for that origin object to `false`, as in the example below:
-
-```js
-// PUT https://api.cloudflare.com/client/v4/user/load_balancers/pools/<pool_id>
-{
-  "description": "Production Datacenter #1 - US West ",
-  "created_on": "2016-12-22T16:16:16.206253Z",
-  "modified_on": "2017-01-14T00:11:23.656655Z",
-  "id": "916167df7265e0ab2284400cee32282f",
-  "enabled": true,
-  "minimum_origins": 1,
-  "monitor": null,
-  "name": "Production Datacenter 1",
-  "notification_email": "you@example.com",
-  "origins": [
-    {
-      "name": "server-1",
-      "address": "0.0.1.1",
-      "enabled": false
-    },
-    {
-      "name": "server-2",
-      "address": "0.0.2.2",
-      "enabled": true
-    }
-  ]
-}
-```
-
----
-
-## Load balancing containerized application deployments
-
-Cloudflare’s Load Balancer distributes global traffic intelligently across Google Kubernetes Engine (GKE) and Amazon Web Services EC2 (AWS). Cloudflare’s native Kubernetes support provides a multi-cloud deployment that is transparent to end users.
-
-![](../static/images/best-practices-2.png)
-
-### Prerequisites
-
-Before you begin, be sure you have the following:
-
-- Access to Google Cloud Platform (GCP)
-- Access to AWS
-- Docker image
-- A domain on Cloudflare (on the Free, Pro, or Business plan) with a Load Balancing subscription, configurable in the Traffic app
-
-### Deploying a containerized web application on Google Kubernetes Engine
-
-We will be using [Google Cloud Shell](https://cloud.google.com/shell/) interface, which comes preinstalled with the gcloud console, docker, and kubectl command-line tools used below. If you use Cloud Shell, you don’t need to install these command-line tools on your workstation.
-
-#### Getting started
-
-Go to the [Kubernetes Engine](https://console.cloud.google.com/kubernetes?_ga=2.151836153.-1932148812.1510627946). Click the **Activate Google Cloud Shell** button at the top of the console window. A Cloud Shell session with a command prompt will open in a new frame at the bottom of the console.
-
-![](../static/images/best-practices-3.png)
-
-Set default configuration values by running the following commands:
-
-- `gcloud config set project PROJECT_ID`
-- `gcloud config set compute/zone us-west1-a`
-
-### Deploying a web application
-
-1. Create a container cluster to run the container image. A cluster consists of a pool of Compute Engine VM instances running Kubernetes.
-
-   - Run the following command to create a three-node cluster (our cluster name is _camilia-cluster_): `gcloud container clusters create camilia-cluster --num-nodes=3`
-
-   - It may take several minutes for the cluster to be created. Once the command is complete, run the following command to see the cluster’s three worker VM instances: `gcloud compute instances list`
-
-1. Deploy the application to the cluster. Use the kubectl command-line tool to deploy and manage applications on a Kubernetes Engine cluster.
-   You can create a simple nginx docker container, for example, using the following command* (camilia-nginx* is the name for the deployment):
-   `kubectl run camilia-nginx --image=nginx --port 80`
diff --git a/products/load-balancing/src/content/create-load-balancer-ui/index.md b/products/load-balancing/src/content/create-load-balancer-ui/index.md
index f270318cf5b..6573b4d1d98 100644
--- a/products/load-balancing/src/content/create-load-balancer-ui/index.md
+++ b/products/load-balancing/src/content/create-load-balancer-ui/index.md
@@ -14,9 +14,8 @@ This tutorial provides a general overview of how to create a load balancer, orig
 
 ## Prerequisites
 
-- **Access to Load Balancing**:
-  - A Cloudflare Enterprise plan with Load Balancing enabled
-  - An existing Free, Pro, or Business plan with a Load Balancing subscription
+- **Multiple servers**, either physical or cloud-based
+- **Access to Load Balancing**, available as an add-on for any type of account
 - **Load balancer hostname**: The hostname for which the Cloudflare Load Balancer will manage traffic. The default hostname is the root hostname.
 - **Location**: This walkthrough configures only a single geographic region.
 
@@ -96,9 +95,8 @@ Create [monitors](/understand-basics/monitors) to run health checks that track t
 
 1. For additional settings, select **Advanced health check settings**:
     - **Simulate Zone**: 
-        - Emulates the specified zone while probing
         - Pushes a request from Cloudflare Health Monitors through the Cloudflare stack as if it were a real visitor request to help analyze behavior or validate a configuration
-        - Can support authenticated origin pulls by entering the appropriate zone in the **Simulate Zone** field of the UI
+        - Ensures health checks are compatible with features like [authenticated origin pulls](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull) and [Argo Smart Routing](https://support.cloudflare.com/hc/articles/115000224552)
 
 1. Select **Save**.
 
@@ -183,7 +181,7 @@ Select **Next** to continue.
 
 Customize the behavior of load balancer using load balancing rules. For example, select an [origin pool](/understand-basics/pools) based on the URI path of an HTTP request.
 
-For a walkthrough, see [Create Load Balancing rules](/understand-basics/load-balancing-rules/create-rules).
+For a walkthrough, see [Create Load Balancing rules](/additional-options/load-balancing-rules/create-rules).
 
 ---
 
@@ -209,4 +207,4 @@ You can also configure separate load balancers for each domain and reuse monitor
 
 To delete a load balancer, select **Delete** on the associated balancer.
 
-However, deleting a Load Balancer does not delete associated pools and monitors. To delete pools and monitors in the Cloudflare dashboard, use the **Manage Pools** and **Manage Monitors** buttons within the **Traffic** app, in the **Load Balancing** tab.
\ No newline at end of file
+However, deleting a Load Balancer does not delete associated pools and monitors. To delete pools and monitors in the Cloudflare dashboard, use the **Manage Pools** and **Manage Monitors** buttons within the **Traffic** app, in the **Load Balancing** tab.
diff --git a/products/load-balancing/src/content/index.md b/products/load-balancing/src/content/index.md
index 8af5a582542..f4598b5ab71 100644
--- a/products/load-balancing/src/content/index.md
+++ b/products/load-balancing/src/content/index.md
@@ -1,31 +1,15 @@
 ---
 title: Overview
-order: 1
+order: 0
 pcx-content-type: landing-page
 ---
 
-# Cloudflare Load Balancing docs
+# Cloudflare Load Balancing
 
-Overused or geographically distant servers add unnecessary latency and degrade the user experience. Unreliable or misconfigured servers can drop user requests completely, preventing access to websites, web apps, and APIs. Poor user experiences like these have a direct impact on revenue, reputation, and customer loyalty.
+Cloudflare Load Balancing allows you to distribute traffic across your servers, which reduces server strain and latency and improves the experience for end users.
 
-Cloudflare Load Balancing provides DNS-based load balancing and active health checks against origin servers and pools. It expands on Cloudflare's existing Anycast DNS network to provide resilience against distributed denial of service (DDoS) attacks by steering away from unhealthy origin servers. Users can also enable Geo Steering, which directs traffic to specific origin pools based on the client’s region.
+<ButtonGroup>
+  <Button type="primary" href="/create-load-balancer-ui">Get started</Button>
+  <Button type="secondary" href="/about">Learn more</Button>
+</ButtonGroup>
 
-Cloudflare Load Balancing delivers three key features:
-
-- **Load balancing and failover**: Deliver traffic evenly across healthy servers, automatically failing over when a server is unhealthy or not responsive.
-- **Active health checks**: Set up health checks to monitor your servers at configurable intervals and look for specific status codes, response text, and/or timeouts. Cloudflare monitors your servers from each of our data centers.
-- **Geographic control**: Direct visitors in Europe to your European data center, US visitors to your North American data center, or dive deeper and send traffic to specific data centers based on region or even the visitor's GPS coordinates.
-
-Note that load balancing is enabled at the Cloudflare account level. A single account can create many load balancers.
-
-You can set up a load balancer from the Cloudflare Traffic app or via the Cloudflare API.
-
-## Load Balancing components
-
-Cloudflare Load Balancing has three major components:
-
-- A Cloudflare [**Load Balancer**](/understand-basics/load-balancers) is identified by a DNS hostname (`www.example.com`) for which you want to balance traffic. A load balancer defines which origin-server pools to use, the order in which they should be used, and how to geographically distribute traffic to different pools.
-- [**Pools**](/understand-basics/pools) represent a group of origin servers (or endpoints), each identified by its IP address or hostname. You can configure multiple pools, as well as failover priority (Pool A-> Pool B-> Pool C). If you're familiar with DNS terminology, think of a pool as a “record set,” except we only return addresses of origins that are considered healthy. You can attach health checks to individual pools to tailor monitoring to collections of servers.
-- [**Monitors**](/understand-basics/monitors) configure availability monitoring. When a monitor is attached to a pool, Cloudflare will run health checks on that pool’s origin servers from our data centers around the world. You can customize monitoring for specific URLs by using periodic HTTP/HTTPS requests, which allow you to set request intervals, timeouts, and status codes.
-
-You can reuse monitors and pools across many load balancers. For example, your `.co.uk` domain might use a different ordering of pools (favoring your London servers, for instance) than your `.com.au` domain.
diff --git a/products/load-balancing/src/content/load-balancing-analytics/index.md b/products/load-balancing/src/content/load-balancing-analytics/index.md
new file mode 100644
index 00000000000..49885d9f807
--- /dev/null
+++ b/products/load-balancing/src/content/load-balancing-analytics/index.md
@@ -0,0 +1,202 @@
+---
+title: Analytics
+order: 45
+pcx-content-type: how-to
+---
+
+# Load balancing analytics
+
+Using load balancing analytics, you can:
+- Evaluate traffic flow.
+- Assess the health status of origin servers in your pools.
+- Review changes in pools and pool health over time.
+
+<Aside type="note">
+
+Load balancing analytics are only available to customers on paid plans (Pro, Business, and Enterprise).
+
+</Aside>
+
+## Dashboard Analytics
+
+### Overview metrics
+
+To view **Overview** metrics for your load balancer, go to **Traffic** > **Load Balancing Analytics**.
+
+These metrics show the number of requests routed to specific pools within a load balancer, helping you:
+- Evaluate the effects of adding or removing a pool.
+- Decide when to create new origin pools.
+- Plan for peak traffic demands and future infrastructure needs.
+
+Add additional filters for specific pools, times, regions, and origins.
+
+<Aside type="note">
+
+Load balancing <strong>requests</strong> are the number of uncached requests made by your load balancer. By default, Cloudflare caches resolved IP addresses for up to five seconds.
+
+</Aside>
+
+### Latency
+
+**Latency** metrics show an interactive map, helping you identify regions with **Unhealthy** or **Slow** pools.
+
+To view latency information for your load balancer, go to **Traffic** > **Load Balancing Analytics** > **Latency**.
+
+### Logs
+
+**Logs** provide a history of all origin server status changes and how they affect your load balancing pools. Load Balancing only logs events that represent a status change for an origin, from healthy to unhealthy or vice versa.
+
+To access logs in the dashboard, go to **Traffic** > **Load Balancing Analytics**. You can also access healthcheck logs [using the API](https://api.cloudflare.com/#load-balancer-healthcheck-events-list-healthcheck-events).
+
+## GraphQL Analytics
+
+For more flexibility, get load balancing metrics directly from the [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api).
+
+Get started with a sample query:
+
+<details>
+<summary>Requests per pool</summary>
+<div>
+
+This query shows the number of requests each pool receives from each location in Cloudflare's global network.
+
+```graphql
+---
+header: Query
+---
+{
+  viewer {
+    zones(filter: {zoneTag: "your Zone ID"}) {
+         loadBalancingRequestsAdaptiveGroups( 
+            limit: 100, 
+            filter: {   
+                datetime_geq: "2021-06-26T00:00:00Z", 
+                datetime_leq: "2021-06-26T03:00:00Z",
+                lbName:"lb.example.com"
+            },
+            orderBy: [datetimeFifteenMinutes_DESC] 
+        ) {
+          count
+          dimensions {
+            datetimeFifteenMinutes
+            coloCode
+            selectedPoolName
+        }
+      }
+    }
+  }
+}
+```
+
+```json
+---
+header: Response (truncated)
+---
+{
+    "data": {
+        "viewer": {
+            "zones": [
+                {
+                    "loadBalancingRequestsAdaptiveGroups": [
+                        {
+                            "count": 4,
+                            "dimensions": {
+                                "coloCode": "IAD",
+                                "datetimeFifteenMinutes": "2021-06-26T00:45:00Z",
+                                "selectedPoolName": "us-east"
+                            }
+                        },
+                        ...
+                    ]
+                }
+            ]
+        }
+    }
+}
+```
+
+</div>
+
+</details>
+
+<details>
+<summary>Requests per data center</summary>
+<div>
+
+This query shows the weighted, round-trip time measurement (`avgRttMs`) for individual requests from a specific data center (for example, Singapore or `SIN`) to each pool in a specific load balancer.
+
+```graphql
+---
+header: Query
+---
+{
+  viewer {
+    zones(filter: {zoneTag: "your Zone ID"}) {
+         loadBalancingRequestsAdapative( 
+            limit: 100, 
+            filter: { 
+                datetime_geq: "2021-06-26T00:00:00Z", 
+                datetime_leq: "2021-06-26T03:00:00Z",
+                lbName:"lb.example.com",
+                coloCode: "SIN"
+            },
+            orderBy: [datetime_DESC] 
+        ) {
+        selectedPoolName
+        pools {
+          poolName
+          healthy
+          healthCheckEnabled
+          avgRttMs
+        }
+      }
+    }
+  }
+}
+```
+
+```json
+---
+header: Response (truncated)
+---
+{
+    "data": {
+        "viewer": {
+            "zones": [
+                {
+                    "loadBalancingRequestsAdaptive": [
+                        {
+                            "pools": [
+                                {
+                                    "avgRttMs": 67,
+                                    "healthCheckEnabled": 1,
+                                    "healthy": 1,
+                                    "poolName": "asia-ne"
+                                },
+                                {
+                                    "avgRttMs": 156,
+                                    "healthCheckEnabled": 1,
+                                    "healthy": 1,
+                                    "poolName": "us-east_and_asia-ne"
+                                },
+                                {
+                                    "avgRttMs": 237,
+                                    "healthCheckEnabled": 1,
+                                    "healthy": 1,
+                                    "poolName": "us-east"
+                                },
+                            ],
+                            "selectedPoolName": "asia-ne"
+                        },
+                    ...
+                    ]
+                }
+            ]
+        }
+    }
+}
+```
+
+</div>
+
+</details>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/reference/dns-records.md b/products/load-balancing/src/content/reference/dns-records.md
new file mode 100644
index 00000000000..50d594d4106
--- /dev/null
+++ b/products/load-balancing/src/content/reference/dns-records.md
@@ -0,0 +1,58 @@
+---
+title: DNS records
+order:
+pcx-content-type: reference
+---
+
+# DNS records for load balancing
+
+When you [create a load balancer](/create-load-balancer-ui), we automatically create an LB DNS record for the specified **Hostname**. This functionality allows you to use a hostname with or without an existing DNS record (A, AAAA, CNAME).
+
+## Priority order
+
+For hostnames with existing A, AAAA, or CNAME records, the LB record takes precedence when it is more or equally specific:
+
+- **Scenario 1**:
+
+    - **A, AAAA, or CNAME**: `x.example.com`
+    - **LB record**: `x.example.com`
+    - **Outcome**: LB record takes precedence because it is as specific as the DNS record.
+
+- **Scenario 2**:
+
+    - **A, AAAA, or CNAME**: `y.example.com`
+    - **LB record**: `*.example.com` (wildcard record)
+    - **Outcome**: DNS record takes precedence because it is more specific.
+
+- **Scenario 3**:
+
+    - **A, AAAA, or CNAME**: `*.example.com`
+    - **LB record**: `*.example.com`
+    - **Outcome**: LB record takes precedence because it is as specific as the DNS record.
+
+<Aside type="note">
+
+This behavior only applies to A, AAAA, or CNAME records. An LB record does not take precedence over other types of DNS records (MX, TXT, etc.).
+
+</Aside>
+
+## Disabling a load balancer
+
+When you disable a load balancer, requests to a specific hostname depend on your existing DNS records:
+
+- If you have existing DNS records, these records will be served.
+- If there are no existing records, requests to the hostname will fail.
+
+In both cases, disabling your load balancer prevents traffic from going to any associated origin or fallback pools.
+
+## Universal SSL
+
+### Proxied domains
+
+If you [changed your nameservers](https://support.cloudflare.com/hc/articles/205195708) to point to Cloudflare, you get an SSL certificate by default. Cloudflare has already issued an [SSL certificate](https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl) covering your root domain and up to one level of subdomain (`subdomain.example.com`).
+
+### Non-proxied domains
+
+If your domain is using a [CNAME setup](https://support.cloudflare.com/hc/articles/360020348832) where traffic is not proxied through Cloudflare, you need to take additional actions to get an SSL certificate.
+
+To get an SSL certificate, [create a proxied DNS record](https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/enable-universal-ssl#non-authoritative-partial-domains) for the hostname associated with the load balancer. You may also want to add [Domain Control Validation (DCV)](https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/changing-dcv-method) records to prevent any downtime.
\ No newline at end of file
diff --git a/products/load-balancing/src/content/reference/index.md b/products/load-balancing/src/content/reference/index.md
new file mode 100644
index 00000000000..354cb6fbb1d
--- /dev/null
+++ b/products/load-balancing/src/content/reference/index.md
@@ -0,0 +1,10 @@
+---
+order: 49
+pcx-content-type: navigation
+---
+
+# Reference
+
+See the following pages for more information about Cloudflare Load Balancing:
+
+<DirectoryListing path="/reference"/>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/understand-basics/region-mapping-api.md b/products/load-balancing/src/content/reference/region-mapping-api.md
similarity index 99%
rename from products/load-balancing/src/content/understand-basics/region-mapping-api.md
rename to products/load-balancing/src/content/reference/region-mapping-api.md
index 003e8359883..f65544eed04 100644
--- a/products/load-balancing/src/content/understand-basics/region-mapping-api.md
+++ b/products/load-balancing/src/content/reference/region-mapping-api.md
@@ -1,6 +1,6 @@
 ---
 title: Region Mapping API
-order: 20
+order:
 pcx-content-type: reference
 ---
 
diff --git a/products/load-balancing/src/content/reference/release-notes.md b/products/load-balancing/src/content/reference/release-notes.md
new file mode 100644
index 00000000000..84ec3cf04e5
--- /dev/null
+++ b/products/load-balancing/src/content/reference/release-notes.md
@@ -0,0 +1,52 @@
+---
+order:
+pcx-content-type: reference
+---
+
+# Release notes
+
+## 30 September 2021 — Deprecation of Load Balancing nodes
+
+After 30 September 2021, we will make the following changes to the Load Balancing GraphQL schema:
+- Deprecate nodes:
+    - `loadBalancingRequestsGroups` will be deprecated for `loadBalancingRequestsAdaptiveGroups`
+    - `loadBalancingRequests` will be deprecated for `loadBalancingRequestsAdaptive`
+- Deprecate the `date` field (replace it with the existing `datetime` field)
+- Add the `sampleInterval` field
+
+<details>
+<summary>Example query using new fields</summary>
+<div>
+
+The following example:
+- Replaces `loadBalancingRequestsGroups` with `loadBalancingRequestsAdaptiveGroups`
+- Replaces `date` with `datetime`
+- Uses the new `sampleInterval` field
+
+```json
+query {
+  viewer {
+    zones(filter: { zoneTag: "your Zone ID" }) {
+      loadBalancingRequestsAdaptiveGroups(
+        filter: {
+          datetime_gt: "2021-06-12T04:00:00Z",
+          datetime_lt: "2021-06-13T06:00:00Z"
+        }
+      ) {
+        dimensions {
+          datetime
+          coloCode
+          ...
+        }
+        avg {
+          sampleInterval
+        }
+      }
+    }
+  }
+}
+```
+
+</div>
+
+</details>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/static/images/best-practices-4.png b/products/load-balancing/src/content/static/images/best-practices-4.png
deleted file mode 100644
index e7c1f5ff9e7..00000000000
Binary files a/products/load-balancing/src/content/static/images/best-practices-4.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/best-practices-5.png b/products/load-balancing/src/content/static/images/best-practices-5.png
deleted file mode 100644
index a34a3f50034..00000000000
Binary files a/products/load-balancing/src/content/static/images/best-practices-5.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-1.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-1.png
deleted file mode 100644
index f8a6f2384e3..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-1.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-10.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-10.png
deleted file mode 100644
index 0647f94ab8a..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-10.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-11.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-11.png
deleted file mode 100644
index f5769f34698..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-11.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-12.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-12.png
deleted file mode 100644
index 410c537444b..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-12.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-13.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-13.png
deleted file mode 100644
index 3221ab37547..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-13.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-2.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-2.png
deleted file mode 100644
index 5d985628b59..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-2.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-3.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-3.png
deleted file mode 100644
index 0906ec94e48..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-3.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-4.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-4.png
deleted file mode 100644
index f90588c5157..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-4.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-5.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-5.png
deleted file mode 100644
index c61b27a1319..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-5.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-6.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-6.png
deleted file mode 100644
index aed6cba4f12..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-6.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-7.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-7.png
deleted file mode 100644
index 6f2a136642e..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-7.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-8.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-8.png
deleted file mode 100644
index 6807ffe899d..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-8.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-9.png b/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-9.png
deleted file mode 100644
index db446f26025..00000000000
Binary files a/products/load-balancing/src/content/static/images/creating-a-load-balancer-using-the-traffic-app-9.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/edit-load-balancer-review.png b/products/load-balancing/src/content/static/images/edit-load-balancer-review.png
deleted file mode 100644
index 31d59ffad7c..00000000000
Binary files a/products/load-balancing/src/content/static/images/edit-load-balancer-review.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/event-logs-1.png b/products/load-balancing/src/content/static/images/event-logs-1.png
deleted file mode 100644
index 50ea895d4ec..00000000000
Binary files a/products/load-balancing/src/content/static/images/event-logs-1.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/health-check-component.png b/products/load-balancing/src/content/static/images/health-check-component.png
new file mode 100644
index 00000000000..c50c2d280fb
Binary files /dev/null and b/products/load-balancing/src/content/static/images/health-check-component.png differ
diff --git a/products/load-balancing/src/content/static/images/load-balancer-1.png b/products/load-balancing/src/content/static/images/load-balancer-1.png
deleted file mode 100644
index a1ea021b482..00000000000
Binary files a/products/load-balancing/src/content/static/images/load-balancer-1.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/load-balancer-components.png b/products/load-balancing/src/content/static/images/load-balancer-components.png
new file mode 100644
index 00000000000..ddc59d48e60
Binary files /dev/null and b/products/load-balancing/src/content/static/images/load-balancer-components.png differ
diff --git a/products/load-balancing/src/content/static/images/manage-load-balancers-card.png b/products/load-balancing/src/content/static/images/manage-load-balancers-card.png
deleted file mode 100644
index c636af6fd48..00000000000
Binary files a/products/load-balancing/src/content/static/images/manage-load-balancers-card.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/manage-load-balancers.png b/products/load-balancing/src/content/static/images/manage-load-balancers.png
deleted file mode 100644
index db1d1a8803c..00000000000
Binary files a/products/load-balancing/src/content/static/images/manage-load-balancers.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/monitors-2.png b/products/load-balancing/src/content/static/images/monitors-2.png
deleted file mode 100644
index a95276b89ff..00000000000
Binary files a/products/load-balancing/src/content/static/images/monitors-2.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/railgun-load-balancer-setup.png b/products/load-balancing/src/content/static/images/railgun-load-balancer-setup.png
new file mode 100644
index 00000000000..694f451a1c9
Binary files /dev/null and b/products/load-balancing/src/content/static/images/railgun-load-balancer-setup.png differ
diff --git a/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule-dialog.png b/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule-dialog.png
deleted file mode 100644
index 4be4f908fc6..00000000000
Binary files a/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule-dialog.png and /dev/null differ
diff --git a/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule.png b/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule.png
deleted file mode 100644
index 4494ea9de60..00000000000
Binary files a/products/load-balancing/src/content/static/images/traffic-app-create-custom-rule.png and /dev/null differ
diff --git a/products/load-balancing/src/content/troubleshooting/common-error-codes/index.md b/products/load-balancing/src/content/troubleshooting/common-error-codes/index.md
new file mode 100644
index 00000000000..98c588d31f3
--- /dev/null
+++ b/products/load-balancing/src/content/troubleshooting/common-error-codes/index.md
@@ -0,0 +1,271 @@
+---
+order: 50
+pcx-content-type: faq
+---
+
+# Common error codes
+
+The Cloudflare Load Balancing API adds global health to each pool and origin server. It also gives you a view into what our network sees at a wider level. Cloudflare uses a quorum system to determine pool and origin health status. The quorum is taken from PoPs responsible for running health checks in a region, and the majority result is used.
+
+When troubleshooting failures, use the Cloudflare API for programmatic access to Cloudflare Load Balancing. The Health Check Events and Load Balancer Monitors routes are excellent tools for accessing load balancing event logs and reconfiguring Cloudflare monitors.
+
+You can get a per-data center breakdown of the health of your origins from the Cloudflare API from the List Health Check Events command:
+
+```txt
+GET user/load_balancing_analytics/events
+```
+
+If a health check fails, the breakdown will include the reason.
+
+For a list of optional parameters, which are useful for filtering log results, see _[Cloudflare API: Health Check Events](https://api.cloudflare.com/#load-balancer-healthcheck-events-list-healthcheck-events)_.
+
+Common troubleshooting causes and solutions are listed below.
+
+---
+
+## TCP connection failed
+
+### Cause
+
+Our health checks failed to establish a TCP connection to your origin server.
+
+### Solution
+
+This typically occurs when there is a network failure between Cloudflare and your origin, and/or a firewall refused to allow our connection. Ensure your network and firewall configurations are not interfering with load balancing traffic.
+
+---
+
+## HTTP timeout occurred
+
+### Cause
+
+The origin failed to return an HTTP response within the timeout configured. This happens if you have the timeout set to a low number — 1 or 2 seconds, for instance.
+
+### Solution
+
+We recommend increasing the HTTP response timeout to allow the origin server to respond.
+
+---
+
+## Response code mismatch error
+
+### Cause
+
+Cloudflare receives an HTTP status code that does not match the values defined in the `expected_codes` property of your Cloudflare monitor configuration.
+
+### Solution
+
+Response codes must match the `expected_codes`. Use the List Monitors API command to confirm the values are correct.
+
+### Alternate cause
+
+You may also see this issue if you have a monitor configured to use HTTP connections and your origin server is redirecting to HTTPS. In this case, the response code will often be 301, 302, or 303.
+
+### Solution
+
+Either change your Cloudflare monitor configuration to use HTTPS, or set the value of `follow_redirect` to `true` so that we can resolve the correct status code.
+
+---
+
+## Response body mismatch error
+
+### Cause
+
+The response body returns from your origin server and does not include the (case-insensitive) value of `expected_body` configured in your monitor.
+
+Note that we only read the first 10 KB of the response. If you return a larger response, and the expected_body is not in the first 10 KB, the health check will fail.
+
+### Solution
+
+Ensure the expected_body is in the first 10 KB of the response body.
+
+---
+
+## TLS untrusted certificate error
+
+### Cause
+
+The certificate is not trusted by a public Certificate Authority (CA).
+
+### Solution
+
+If you're using a self-signed certificate, we recommend either using a publicly trusted certificate or setting the `allow_insecure` property on your monitor to `true`.
+
+---
+
+## TLS name mismatch error
+
+### Cause
+
+Our health check (client) was not able to match a name on the server certificate to the hostname of the request.
+
+### Solution
+
+Use the List Monitors command to confirm that the `header` value set in the Cloudflare monitor is correct and the Update Monitors command to make any necessary changes.
+
+---
+
+## TLS protocol error
+
+### Cause
+
+This error can occur if you’re using an older version of TLS or your origin server is not configured for HTTPS.
+
+### Solution
+
+Ensure that your origin server supports TLS 1.0 or greater and is configured for HTTPS.
+
+---
+
+## TLS unrecognized name error
+
+### Cause
+
+The server did not recognize the name provided by the client. When a host header is set, we set this as the ServerName in the initial TLS handshake. If not set, we will not provide a ServerName, which can cause this error.
+
+### Solution
+
+Set the host header in your monitor object.
+
+---
+
+## No route to host error
+
+### Cause
+
+The IP address cannot be reached from our network. Common causes are ISP or hosting provider network issues (e.g. BGP level), or that the IP does not exist.
+
+### Solution
+
+Make sure IP is accurate, and if it is check if there is an ISP or hosting provider network issue.
+
+---
+
+## Exceeded quota error
+
+### Cause
+
+You will receive this error if you attempt to create more objects (monitors, pools, or origins) than are included in your plan.
+
+If using the dashboard, you will not be able to create additional objects.
+
+If you're using the **Cloudflare API**, you will receive this error message.
+
+```
+{
+  "result": null,
+  "success": false,
+  "errors": [
+    {
+      "code": 1006,
+      "message": "Quota exceeded. You are currently allowed 5 monitors. Please re-use or delete any unused monitors."
+    }
+  ],
+  "messages": []
+}
+```
+
+### Solution
+
+- Enterprise customers who need to create more objects (load balancers, pools, origins, or monitors) should reach out to their Customer Success Manager or [contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476) to discuss this issue.
+- Self-service customers upgrade their Load Balancing subscription with more origin servers to increase load balancing capacity.
+
+---
+
+## TCP Timeout
+
+### Cause
+Data transmission was not acknowledged and retransmit of data did not succeed.
+
+### Solution
+Confirm whether the SYN-ACK for the handshake takes place at your origin and _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
+
+---
+
+## TLS Handshake Failure
+
+### Cause
+Indicates that the browser's connection to the web server is not secure.
+
+### Solution
+Change wifi networks, connect to a wired network, or verify the network connection is stable.
+
+---
+
+## Network Unreachable
+
+### Cause
+Cloudflare cannot connect to the origin web server due to network unavailability.  This is usually caused by a network issue or incorrect origin IP.
+
+### Solution
+Check either the IP entered for the origin in Cloudflare's Load Balancer configuration or the IP returned via DNS for the origin hostname.
+
+---
+
+## HTTP Invalid Response
+
+### Cause
+Usually caused by an HTTP 502 error or bad gateway.
+
+### Solution
+Ensure the origin web server responds to requests and that no applications have crashed or are under high load.
+
+---
+
+## DNS Unknown Host
+
+### Cause
+The origin web server hostname does not exist.
+
+### Solution
+Confirm the origin web server resolves to an IP address.
+
+---
+
+## Connection Reset by Peer
+
+### Cause
+A network error occurred while the client received data from the origin web server.
+
+### Solution
+Confirm whether the origin web server is experiencing a high amount of traffic or an error.
+
+---
+
+## Monitor Config Error
+
+### Cause
+There was a configuration error in the monitor and no checks are run against the pool origins.
+
+### Solution
+Review your monitor configuration to ensure it matches an expected request to your origin.  For further assistance, _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
+
+---
+
+## DNS Internal
+
+### Cause
+The origin web server's hostname resolves to an internal or orange-clouded IP address.  No checks are run against the pool origins.
+
+### Solution
+Cloudflare does not allow use of an origin web server hostname that is proxied by Cloudflare.
+
+---
+
+## Other Failure
+
+### Cause
+If the failure cannot be classified as any other type of failure mentioned above.
+
+### Solution
+_[Contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
+
+---
+
+## Load Balancing Not Enabled
+
+### Cause
+Load Balancing is not enabled for your account or zone.
+
+### Solution
+For Enterprise customers, reach out to your Cloudflare Account Team.  Free, Pro, and Business customers _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
diff --git a/products/load-balancing/src/content/troubleshooting/faq/index.md b/products/load-balancing/src/content/troubleshooting/faq/index.md
new file mode 100644
index 00000000000..d98ba206c56
--- /dev/null
+++ b/products/load-balancing/src/content/troubleshooting/faq/index.md
@@ -0,0 +1,8 @@
+---
+order: 48
+pcx-content-type: faq
+---
+
+# FAQs
+
+For a list of commonly asked questions, see [Load Balancing FAQs](https://support.cloudflare.com/hc/articles/4407016052493).
\ No newline at end of file
diff --git a/products/load-balancing/src/content/troubleshooting/index.md b/products/load-balancing/src/content/troubleshooting/index.md
index a8db773a58c..6567fd9ef0d 100644
--- a/products/load-balancing/src/content/troubleshooting/index.md
+++ b/products/load-balancing/src/content/troubleshooting/index.md
@@ -1,274 +1,10 @@
 ---
-title: Troubleshooting
-order: 50
-pcx-content-type: faq
+order: 150
+pcx-content-type: navigation
 ---
 
-# Troubleshoot Cloudflare load balancers
+# Troubleshooting
 
-## Overview
+For more guidance related to common issues with load balancers, refer to the following resources:
 
-The Cloudflare Load Balancing API adds global health to each pool and origin server. It also gives you a view into what our network sees at a wider level. Cloudflare uses a quorum system to determine pool and origin health status. The quorum is taken from PoPs responsible for running health checks in a region, and the majority result is used.
-
-When troubleshooting failures, use the Cloudflare API for programmatic access to Cloudflare Load Balancing. The Health Check Events and Load Balancer Monitors routes are excellent tools for accessing load balancing event logs and reconfiguring Cloudflare monitors.
-
-You can get a per-data center breakdown of the health of your origins from the Cloudflare API from the List Health Check Events command:
-
-```txt
-GET user/load_balancing_analytics/events
-```
-
-If a health check fails, the breakdown will include the reason.
-
-For a list of optional parameters, which are useful for filtering log results, see _[Cloudflare API: Health Check Events](https://api.cloudflare.com/#load-balancer-healthcheck-events-list-healthcheck-events)_.
-
-Common troubleshooting causes and solutions are listed below.
-
----
-
-## TCP connection failed
-
-### Cause
-
-Our health checks failed to establish a TCP connection to your origin server.
-
-### Solution
-
-This typically occurs when there is a network failure between Cloudflare and your origin, and/or a firewall refused to allow our connection. Ensure your network and firewall configurations are not interfering with load balancing traffic.
-
----
-
-## HTTP timeout occurred
-
-### Cause
-
-The origin failed to return an HTTP response within the timeout configured. This happens if you have the timeout set to a low number — 1 or 2 seconds, for instance.
-
-### Solution
-
-We recommend increasing the HTTP response timeout to allow the origin server to respond.
-
----
-
-## Response code mismatch error
-
-### Cause
-
-Cloudflare receives an HTTP status code that does not match the values defined in the `expected_codes` property of your Cloudflare monitor configuration.
-
-### Solution
-
-Response codes must match the `expected_codes`. Use the List Monitors API command to confirm the values are correct.
-
-### Alternate cause
-
-You may also see this issue if you have a monitor configured to use HTTP connections and your origin server is redirecting to HTTPS. In this case, the response code will often be 301, 302, or 303.
-
-### Solution
-
-Either change your Cloudflare monitor configuration to use HTTPS, or set the value of `follow_redirect` to `true` so that we can resolve the correct status code.
-
----
-
-## Response body mismatch error
-
-### Cause
-
-The response body returns from your origin server and does not include the (case-insensitive) value of `expected_body` configured in your monitor.
-
-Note that we only read the first 10 KB of the response. If you return a larger response, and the expected_body is not in the first 10 KB, the health check will fail.
-
-### Solution
-
-Ensure the expected_body is in the first 10 KB of the response body.
-
----
-
-## TLS untrusted certificate error
-
-### Cause
-
-The certificate is not trusted by a public Certificate Authority (CA).
-
-### Solution
-
-If you're using a self-signed certificate, we recommend either using a publicly trusted certificate or setting the `allow_insecure` property on your monitor to `true`.
-
----
-
-## TLS name mismatch error
-
-### Cause
-
-Our health check (client) was not able to match a name on the server certificate to the hostname of the request.
-
-### Solution
-
-Use the List Monitors command to confirm that the `header` value set in the Cloudflare monitor is correct and the Update Monitors command to make any necessary changes.
-
----
-
-## TLS protocol error
-
-### Cause
-
-This error can occur if you’re using an older version of TLS or your origin server is not configured for HTTPS.
-
-### Solution
-
-Ensure that your origin server supports TLS 1.0 or greater and is configured for HTTPS.
-
----
-
-## TLS unrecognized name error
-
-### Cause
-
-The server did not recognize the name provided by the client. When a host header is set, we set this as the ServerName in the initial TLS handshake. If not set, we will not provide a ServerName, which can cause this error.
-
-### Solution
-
-Set the host header in your monitor object.
-
----
-
-## No route to host error
-
-### Cause
-
-The IP address cannot be reached from our network. Common causes are ISP or hosting provider network issues (e.g. BGP level), or that the IP does not exist.
-
-### Solution
-
-Make sure IP is accurate, and if it is check if there is an ISP or hosting provider network issue.
-
----
-
-## Exceeded quota error
-
-### Cause
-
-You will receive this error if you attempt to create more objects (monitors, pools, or origins) than are included in your plan.
-
-If using the dashboard, you will not be able to create additional objects.
-
-If you're using the **Cloudflare API**, you will receive this error message.
-
-```
-{
-  "result": null,
-  "success": false,
-  "errors": [
-    {
-      "code": 1006,
-      "message": "Quota exceeded. You are currently allowed 5 monitors. Please re-use or delete any unused monitors."
-    }
-  ],
-  "messages": []
-}
-```
-
-### Solution
-
-- Enterprise customers who need to create more objects (load balancers, pools, origins, or monitors) should reach out to their Customer Success Manager or [contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476) to discuss this issue.
-- Self-service customers upgrade their Load Balancing subscription with more origin servers to increase load balancing capacity.
-
----
-
-## TCP Timeout
-
-### Cause
-Data transmission was not acknowledged and retransmit of data did not succeed.
-
-### Solution
-Confirm whether the SYN-ACK for the handshake takes place at your origin and _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
-
----
-
-## TLS Handshake Failure
-
-### Cause
-Indicates that the browser's connection to the web server is not secure.
-
-### Solution
-Change wifi networks, connect to a wired network, or verify the network connection is stable.
-
----
-
-## Network Unreachable
-
-### Cause
-Cloudflare cannot connect to the origin web server due to network unavailability.  This is usually caused by a network issue or incorrect origin IP.
-
-### Solution
-Check either the IP entered for the origin in Cloudflare's Load Balancer configuration or the IP returned via DNS for the origin hostname.
-
----
-
-## HTTP Invalid Response
-
-### Cause
-Usually caused by an HTTP 502 error or bad gateway.
-
-### Solution
-Ensure the origin web server responds to requests and that no applications have crashed or are under high load.
-
----
-
-## DNS Unknown Host
-
-### Cause
-The origin web server hostname does not exist.
-
-### Solution
-Confirm the origin web server resolves to an IP address.
-
----
-
-## Connection Reset by Peer
-
-### Cause
-A network error occurred while the client received data from the origin web server.
-
-### Solution
-Confirm whether the origin web server is experiencing a high amount of traffic or an error.
-
----
-
-## Monitor Config Error
-
-### Cause
-There was a configuration error in the monitor and no checks are run against the pool origins.
-
-### Solution
-Review your monitor configuration to ensure it matches an expected request to your origin.  For further assistance, _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
-
----
-
-## DNS Internal
-
-### Cause
-The origin web server's hostname resolves to an internal or orange-clouded IP address.  No checks are run against the pool origins.
-
-### Solution
-Cloudflare does not allow use of an origin web server hostname that is proxied by Cloudflare.
-
----
-
-## Other Failure
-
-### Cause
-If the failure cannot be classified as any other type of failure mentioned above.
-
-### Solution
-_[Contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
-
----
-
-## Load Balancing Not Enabled
-
-### Cause
-Load Balancing is not enabled for your account or zone.
-
-### Solution
-For Enterprise customers, reach out to your Cloudflare Account Team.  Free, Pro, and Business customers _[contact Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476)_.
+<DirectoryListing path="/troubleshooting"/>
\ No newline at end of file
diff --git a/products/load-balancing/src/content/understand-basics/health-details.md b/products/load-balancing/src/content/understand-basics/health-details.md
new file mode 100644
index 00000000000..66edc170a1d
--- /dev/null
+++ b/products/load-balancing/src/content/understand-basics/health-details.md
@@ -0,0 +1,91 @@
+---
+order: 16
+pcx-content-type: concept
+---
+
+# How origins and pools become unhealthy
+
+When we talk about dynamic load balancing, that means your load balancer only directs requests to servers that can handle the traffic. 
+
+But how does your load balancer *know* which servers can handle the traffic? We determine that through a system of monitors, health checks, and origin pools.
+
+---
+
+## Components
+
+Dynamic load balancing happens through a combination of:
+
+- [**Origin pools**](/understand-basics/pools): Contain one or more origin servers.
+- [**Monitors**](/understand-basics/monitors): Are attached to individual origin servers and issue health checks at regular intervals.
+- **Health checks**: Are issued by a monitor at regular interval and — depending on the monitor settings — return a **pass** or **fail** value to make sure an origin is still able to receive traffic.
+
+![Dynamic load balancing involves pools, origins, monitors, and health checks](../static/images/load-balancer-components.png)
+
+---
+
+## How an origin becomes unhealthy
+
+The purpose of each **health check** is to determine whether an origin has changed status from the previous health check.
+
+A health check will fail if one of the following conditions are met:
+
+- The health check exceeds the duration specified in the monitor's **Timeout** field (and does so more than the specified number of **Retries**).
+- The origin does not return the **Expected codes** or **Response body** specified in the monitor's configuration.
+
+Because we want our health checks to be as accurate as possible, we send them from three separate data centers for each of the options in a pool's **Health Check Regions**. 
+
+![Health checks come from three data centers within each selected region.](../static/images/health-check-component.png)
+
+If the majority of data centers for that region pass the health checks, that region is considered healthy. If the majority of regions is healthy, then the origin itself will be considered healthy.
+
+<Aside type="note">
+
+If **Health Check Regions** for a pool is set to **All Data Centers (Enterprise)**, pool health is determined by a majority of data centers.
+
+</Aside>
+
+For greater accuracy and consistency when changing origin health status, you can also set the `consecutive_up` and `consecutive_down` parameters via the [Create Monitor API endpoint](https://api.cloudflare.com/#account-load-balancer-monitors-create-monitor). To change from healthy to unhealthy, an origin will have to be marked healthy a consecutive number of times (specified by `consecutive_down`). The same applies — from unhealthy to healthy — for `consecutive_up`.
+
+---
+
+## How a pool becomes unhealthy
+
+When an [individual origin becomes unhealthy](#how-an-origin-becomes-unhealthy), that may affect the health status of any associated origin pools (visible in the dashboard):
+
+- **Healthy**: All origins are healthy.
+- **Degraded**: At least one origin is unhealthy, but the pool is still considered healthy and could be receiving traffic.
+- **Critical**: The pool has fallen below the number of available origins specified in its **Health Threshold** and will not receive traffic from your load balancer (unless other pools are also unhealthy and this pool is marked as the [**Fallback Pool**](#fallback-pools)).
+- **Health unknown**: There are either no monitors attached to pool origins or the monitors have not yet determined origin health.
+- **No health**: Reserved for your load balancer's [**Fallback Pool**](#fallback-pools).
+
+### Traffic distribution
+
+When a pool reaches **Critical** health, your load balancer will begin diverting traffic according to its [Steering Policy](/understand-basics/traffic-steering):
+
+- **Off**: 
+
+    - If the active pool becomes unhealthy, traffic goes to the next pool in order. 
+    - If an inactive pool becomes unhealthy, traffic continues to go to the active pool (but would skip over the unhealthy pool in the failover order).
+
+- **All other methods**: Traffic is distributed across all remaining pools according to the steering policy.
+
+### Fallback pools
+
+Because a load balancer **Fallback Pool** is meant to be a pool of last resort, it's health is not taken into account when directing traffic.
+
+If all pools in a Load Balancer are manually disabled or unhealthy, traffic will always go to the fallback pool.
+
+---
+
+## How a load balancer becomes unhealthy
+
+When one or more pools become unhealthy, your load balancer might also show a different status in the dashboard:
+
+- **Healthy**: All pools are healthy.
+- **Degraded**: At least one pool is unhealthy, but traffic is not yet going to the [Fallback Pool](#fallback-pools).
+- **Critical**: All pools are unhealthy and traffic is going to the [Fallback Pool](#fallback-pools).
+
+If a load balancer reaches **Critical** health and the pool serving as your fallback pool is also disabled:
+
+- If Cloudflare proxies your hostname, you will see a 530 HTTP/1016 Origin DNS failure.
+- If Cloudflare does not proxy your hostname, you will see the SOA record.
\ No newline at end of file
diff --git a/products/load-balancing/src/content/understand-basics/index.md b/products/load-balancing/src/content/understand-basics/index.md
index 8588cf259f8..4ee4a715251 100644
--- a/products/load-balancing/src/content/understand-basics/index.md
+++ b/products/load-balancing/src/content/understand-basics/index.md
@@ -6,6 +6,6 @@ pcx-content-type: navigation
 
 # Basics of Cloudflare load balancers
 
-This sections comprises a set of concepts and functionalities to help you understand the power of Cloudflare Load Balancing in planning your traffic management. Click on the links below to learn more:
+Review the following topics to learn more about the basic concepts and components involved in Cloudflare Load Balancing.
 
 <DirectoryListing path="/understand-basics"/>
diff --git a/products/load-balancing/src/content/understand-basics/load-balancers.md b/products/load-balancing/src/content/understand-basics/load-balancers.md
index c1837b4ba4e..8aff3c52902 100644
--- a/products/load-balancing/src/content/understand-basics/load-balancers.md
+++ b/products/load-balancing/src/content/understand-basics/load-balancers.md
@@ -7,7 +7,13 @@ pcx-content-type: concept
 
 ## Overview
 
-A Cloudflare load balancer is identified by the DNS hostname whose traffic you want to balance (www.example.com, for example). The load balancer defines which origin server pools to use, the order in which they should be used, and how to geographically distribute traffic among pools.
+A Cloudflare load balancer is identified by the DNS hostname whose traffic you want to balance (`www.example.com`). The load balancer defines which origin server pools to use, the order in which they should be used, and how to geographically distribute traffic among pools.
+
+<Aside type="note">
+
+For more background information on what load balancers are and how they work, check out our <a href="https://www.cloudflare.com/learning/performance/what-is-load-balancing/">Learning Center</a>.
+
+</Aside>
 
 ---
 
@@ -15,7 +21,7 @@ A Cloudflare load balancer is identified by the DNS hostname whose traffic you w
 
 ### Active - Passive Failover
 
-An **active-passive failover** sends traffic to the servers in your active pool until a failure threshold (configurable) is reached. At the point of failure, your load balancer then re-directs traffic to the passive pool.
+An **active-passive failover** sends traffic to the servers in your active pool until a failure threshold (configurable) is reached. At the point of failure, your load balancer then redirects traffic to the passive pool.
 
 This setup ensures uninterrupted service and helps with planned outtages, but it might lead to slower traffic overall.
 
@@ -24,6 +30,7 @@ To set up a load balancer with **active-passive failover**:
 1. In the list of origin pools, set the following order:
     1. `primary`
     1. `secondary`
+1. For **Traffic Steering**, select [**Off**](/understand-basics/traffic-steering#off---standard-failover).
 
 With this setup, your load balancer will direct all traffic to `primary` until `primary` has fewer available origins than specified in its **Health Threshold**. Only then will your load balancer direct traffic to `secondary`.
 
@@ -35,34 +42,19 @@ An **active-active failover** distributes traffic to servers in the same pool un
 
 This setup speeds up overall requests, but is more vulnerable to planned or unplanned outtages.
 
-To set up a load balancer with **active-active failover**:
-1. Create a load balancer with a single origin pool (`primary`) with multiple origins (`origin-1` and `origin-2`).
-1. For equal traffic, choose the same **Weight** for each origin. For guidance on other configurations, see [Weighted load balancers](../weighted-load-balancing).
-
-With this setup, your load balancer will direct all traffic to `primary`, which then directs traffic to `origin-1` and `origin-2` according to their respective weights. If enough origins become so unhealthy that `primary` falls below its **Health Threshold**, traffic would then go to the **fallback pool**.
-
-## Important notes
-
-### Load balancing and existing DNS records
-
-**Adding a Load Balancer does not create a DNS record or SSL certificate.**  To generate an SSL certificate, create a proxied DNS record for the Load Balancer. The Load Balancer record takes precedence over a DNS record for the same host name.
+To set up a load balancer with **active-active failover**, either:
+- Create a load balancer with a single origin pool (`primary`) with multiple origins (`origin-1` and `origin-2`) and set the same [**Weight**](/understand-basics/weighted-load-balancing) for each origin.
+- Create a load balancer with two origin pools (`primary` and `secondary`) and — for [**Traffic Steering**](/understand-basics/traffic-steering) — select any option except for **Off**. 
 
-**When you create a load balancer on Cloudflare**, you can either:
+<Aside type='note'>
 
-- Use a unique hostname with no existing DNS record, or
-- Use a hostname that has an existing DNS record, either as an A, AAAA, or CNAME record.
+For more background reading on server failover and common configurations, see our <a href="https://www.cloudflare.com/learning/performance/what-is-server-failover/">Learning Center</a>.
 
-**If a chosen hostname has an existing DNS record**, the load balancer will supersede the DNS record if the DNS record is an A, AAAA, or canonical name (CNAME) record. It will not supersede other record types.
+</Aside>
 
-**If the load balancer is disabled**, preexisting DNS records will be served.
+## Load balancing and existing DNS records
 
-**If there is no preexisting DNS record with the same name**, disabling the load balancer will prevent clients from resolving the host, and requests will fail.
-
-**If a Load Balancer is manually disabled**, traffic is not served to the associated origins or the fallback. If all pools in a Load Balancer are manually disabled or unhealthy, traffic goes to the fallback pool. No health checks run on the fallback pool and it will return the same HTTP status as your origin.
-
-If the pool serving as your fallback pool is also disabled:
-- If Cloudflare proxies your hostname, you will see a 530 HTTP/1016 Origin DNS failure.
-- If Cloudflare does not proxy your hostname, you will see the SOA record.
+For details about DNS records, refer to [DNS records for load balancing](/reference/dns-records).
 
 ## HTTP keep-alive (persistent HTTP connection)
 
@@ -76,311 +68,17 @@ Ensure HTTP Keep-Alive connections are enabled on your origin. Cloudflare reuses
 
 **For example, F5 BIG-IP load balancers set a session cookie at the beginning of a TCP connection** (if none exists) and then ignore all cookies from subsequent HTTP requests on the same TCP connection. This tends to break session affinity because Cloudflare sends multiple HTTP sessions on the same TCP connection. Configuring the load balancer to parse HTTP requests by cookie headers avoids this issue.
 
-### Railgun (wide area network optimization)
-
-**Railgun is a web proxy system built for Cloudflare**, that allows dynamic content for a website to be cached while also allowing changes to the site to take effect almost instantly. Railgun is currently available to customers with a Business or Enterprise plan, or via one of Cloudflare’s Optimised Partners.
-
-**Railgun compresses web objects, even rapidly changing pages like news sites or personalized content**. Using Railgun in conjunction with Cloudflare Load Balancing speeds up connections between Cloudflare datacenters and DNS origin servers so that uncacheable requests have minimal latency.
-
-![](../static/images/load-balancer-1.png)
-
-**Set up a Railgun listener in front of the load balancer** so that the load balancer can handle HTTP connections normally. Load balancing long-lived TLS connections between the sender and listener is very difficult.
-
-**Use the same load balancer settings as if Railgun were not in place** — for example, HTTP keep-alive connections should be enabled and set to a 90-second timeout, since Railgun is working as an HTTP reverse proxy.
-
-**If Railgun is placed behind the load balancer**, observe the following guidelines to avoid interruptions with site traffic:
-
-1. Use the `railgun-nat.conf` configuration file to set the **internal** addresses of the hosts Railgun will be optimizing (`localhost:8080`, for example). This is important to avoid looping the request outbound to the internet and back to the load balancer only to be forwarded to the origin.
-1. Ensure no firewall rules are in place that will interfere with traffic between the listener and the origin server.
-1. Ensure port 2408 is open and passed through the load balancer so that it does not interfere with the TLS connection between the listener and sender.
-
 ---
 
 ## Properties
 
-Cloudflare Load Balancer objects have the following properties:
-
-<TableWrap>
-
-<table>
-  <thead>
-  <tr>
-   <th><strong>Name / type</strong>
-   </th>
-   <th><strong>Description / example</strong>
-   </th>
-   <th><strong>Constraints</strong>
-   </th>
-  </tr>
-  </thead>
-  <tbody>
-  <tr>
-   <td valign="top"><strong>created_on</strong><br/><Type>string</Type> <PropMeta>(date-time)</PropMeta>
-   </td>
-   <td>The creation timestamp for the load balancer.<br/><br/><Code>"2014-01-01T05:20:00.12345Z"</Code></td>
-   <td valign="top">Read-only</td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>default_pools</strong>
-<br/>
-<Type>array</Type>
-   </td>
-   <td>A list of Pool IDs ordered by failover priority. Cloudflare steers traffic to the first pool in the list, failing over to the next healthy pool and so on down the list.
-<br/><br/>
-Pools defined here are used by default, or when <Code>region_pools</Code> is not configured for a given region.
-<br/><br/>
-<div>
-
-```json
-[
-  "17b5962d775c646f3f9725cbc7a53df4",
-  "9290f38c5d07c2e2f4df57b1f61d4196",
-  "00920f38ce07c2e2f4df50b1f61d4194"
-]
-```
-
-</div>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>description</strong>
-<br/>
-<Type>string</Type>
-   </td>
-   <td>A user-supplied description of the load balancer
-<br/>
-<Code>"Load Balancer for www.example.com"</Code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>enabled</strong>
-<br/>
-<Type>boolean</Type>
-   </td>
-   <td>Enables the load balancer when set to
-<br/>
-<Code>true</Code>
-   </td>
-   <td>Default value: <Code>true</Code>
-<br/>
-Valid values: (<Code>true,false</Code>)
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>fallback_pool</strong>
-<br/>
-<Type>string</Type>
-   </td>
-   <td>The Pool ID for the “pool of last resort,” the pool the load balancer should direct traffic to if all other pools are unhealthy. In most configurations, this is the secondary/passive pool.
-<br/>
-<Code>"17b5962d775c646f3f9725cbc7a53df4"</Code>
-   </td>
-   <td valign="top">Max. length: <Code>32</Code>
-<br/>
-Read-only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>id</strong>
-<br/>
-<Type>string</Type>
-   </td>
-   <td>The load balancer ID
-<br/>
-<Code>"699d98642c564d2e855e9661899b7252"</Code>
-   </td>
-   <td>Max. length: <Code>32</Code>
-<br/>
-Read-only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>modified_on</strong>
-<br/>
-<Type>string</Type> <PropMeta>(date-time)</PropMeta>
-   </td>
-   <td>Timestamp of the last modification to the load balancer configuration
-<br/>
-<Code>"2014-01-01T05:20:00.12345Z"</Code>
-   </td>
-   <td valign="top">Read-only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>name</strong>
-<br/>
-<Type>string</Type>
-   </td>
-   <td>The public DNS hostname of your Cloudflare load balancer.
-<br/><br/>
-If you have an existing DNS record with the same name as your load balancer, the load balancer will have precedence. The pre-existing DNS record is not used unless you delete the Cloudflare load balancer.
-<br/><br/>
-<Code>"www.example.com"</Code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>pop_pools</strong>
-<br/>
-<Type>object</Type>
-   </td>
-   <td>A mapping of Cloudflare PoP identifiers to a list of pool IDs (ordered by their failover priority) for the PoP (datacenter). Any PoPs not explicitly defined will fall back to using <Code>default_pools</Code>.
-<br/><br/>
-<div>
-
-```json
-{
-  "LAX": [
-    "de90f38ced07c2e2f4df50b1f61d4194",
-    "9290f38c5d07c2e2f4df57b1f61d4196"
-  ],
-  "LHR": [
-    "abd90f38ced07c2e2f4df50b1f61d4194",
-    "f9138c5d07c2e2f4df57b1f61d4196"
-  ],
-  "SJC": [
-    "00920f38ce07c2e2f4df50b1f61d4194"
-  ]
-}
-```
-
-</div>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>proxied</strong>
-<br/>
-<Type>boolean</Type>
-   </td>
-   <td>When set to true, HTTP Proxy mode is enabled; when false, DNS-only mode.
-<br/>
-<Code>true</Code>
-   </td>
-   <td>Default value: <Code>false</Code>
-<br/>
-Valid values: (<Code>true,false</Code>)
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>region_pools</strong>
-<br/>
-<Type>object</Type>
-   </td>
-   <td>A mapping of region/country codes to a list of Pool IDs (ordered by their failover priority) for the given region. Any regions not explicitly defined will fall back to using <Code>default_pools</Code>.
-<br/><br/>
-<div>
-
-```json
-{
-  "WNAM": [
-    "de90f38ced07c2e2f4df50b1f61d4194",
-    "9290f38c5d07c2e2f4df57b1f61d4196"
-  ],
-  "ENAM": [
-    "00920f38ce07c2e2f4df50b1f61d4194"
-  ]
-}
-```
-
-</div>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>session_affinity</strong>
-<br/>
-<Type>string</Type>
-   </td>
-   <td>Specifies the type of session affinity the load balancer should use. The default value is <Code>""</Code>, which disables session affinity (as does <Code>"none"</Code>).
-<br/>The supported session affinity types are <Code>"cookie"</Code> and <Code>"ip_cookie"</Code>.
-<br/><br/>
-When set to <Code>"cookie"</Code>, the first request to a proxied load balancer generates a cookie encoding the origin to which the request will be forwarded.
-<br/><br/>
-Subsequent requests by the same client to the same load balancer will be sent to the origin server encoded by the cookie.
-<br/><br/>
-If the cookie has expired or the origin server is unhealthy, a new origin server is identified and a new cookie generated. The <Code>"ip_cookie"</Code> option behaves the same as <Code>"cookie",</Code> except the initial origin selection is stable and based on the client’s IP address.
-
-   </td>
-   <td valign="top">Default value: <Code>""</Code>
-<br/>
-Valid values: <Code>none</Code>, <Code>cookie</Code>, <Code>ip_cookie</Code>, <Code>""</Code>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>session_affinity_ttl</strong>
-<br/>
-<Type>number</Type>
-   </td>
-   <td>Sets the time to live for this load balancer’s session affinity cookies.
-<br/><br/>
-This parameter is ignored unless a supported session affinity policy is set.
-<br/><br/>
-The current default of 23 hours will be used unless <Code>session_affinity_ttl</Code> is explicitly set.
-<br/><br/>
-The accepted range of values is between 1800 and 604800. Once the expiry time has been reached, subsequent requests may get sent to a different origin server.
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>steering_policy</strong><br/><Type>string</Type></td>
-   <td>The traffic steering policy for this load balancer
-<br/>
-The constraint values have the following effect on traffic steering:
-<ul>
-<li><Code>"off"</Code>: enables standard failover</li>
-<li><Code>"geo"</Code>: enables Geo Steering</li>
-<li><Code>"random"</Code>: selects an available pool at random on failover</li>
-<li><Code>"dynamic_latency"</Code>: enables Dynamic Steering</li>
-<li><Code>""</Code>: enables Geo Steering if <Code>region_pools</Code> and/or <Code>pop_pools</Code> is configured; otherwise uses standard failover
-</li>
-</ul>
-   </td>
-   <td valign="top">Default value: <Code>""</Code>
-<br/>
-Valid values: <Code>off</Code>,<Code> geo</Code>,<Code> random</Code>,<Code> dynamic_latency</Code>,<Code> ""</Code>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>ttl</strong>
-<br/>
-<Type>number</Type>
-   </td>
-   <td>The time to live (TTL) of the DNS entry for the IP address returned by this load balancer. This only applies to load balancers where the proxy mode is DNS-only.
-<br/><br/>
-<Code>30</Code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  </tbody>
-</table>
-
-</TableWrap>
+For an up-to-date list of load balancer properties, refer to [Load balancer properties](https://api.cloudflare.com/#load-balancers-properties) in our API documentation.
 
 ---
 
-## Managing load balancers via the Cloudflare API
-
-### Endpoint
-
-The endpoint for managing load balancers is
-
-```txt
-zones/:identifier/load_balancers
-```
-
-### Commands
+## API commands
 
-The Cloudflare API supports the following commands for load balancers. (Examples are given for the user-level endpoint but apply to the account-level endpoint as well.) For detailed instruction, see _[Cloudflare API v4: Load Balancers](https://api.cloudflare.com/#load-balancers-properties)_.
+The Cloudflare API supports the following commands for load balancers.
 
 <TableWrap>
 
@@ -397,7 +95,7 @@ The Cloudflare API supports the following commands for load balancers. (Examples
   </thead>
   <tbody>
   <tr>
-   <td>Create Load Balancer
+   <td><a href="https://api.cloudflare.com/#load-balancers-create-load-balancer">Create Load Balancer</a>
    </td>
    <td><Code>GET</Code>
    </td>
@@ -405,7 +103,7 @@ The Cloudflare API supports the following commands for load balancers. (Examples
    </td>
   </tr>
   <tr>
-   <td>Delete Load Balancer
+   <td><a href="https://api.cloudflare.com/#load-balancers-delete-load-balancer">Delete Load Balancer</a>
    </td>
    <td><Code>DELETE</Code>
    </td>
@@ -413,7 +111,7 @@ The Cloudflare API supports the following commands for load balancers. (Examples
    </td>
   </tr>
   <tr>
-   <td>List Load Balancers
+   <td><a href="https://api.cloudflare.com/#load-balancers-list-load-balancers">List Load Balancers</a>
    </td>
    <td><Code>GET</Code>
    </td>
@@ -421,7 +119,7 @@ The Cloudflare API supports the following commands for load balancers. (Examples
    </td>
   </tr>
   <tr>
-   <td>Load Balancer Details
+   <td><a href="https://api.cloudflare.com/#load-balancers-load-balancer-details">Load Balancer Details</a>
    </td>
    <td><Code>POST</Code>
    </td>
@@ -429,7 +127,7 @@ The Cloudflare API supports the following commands for load balancers. (Examples
    </td>
   </tr>
   <tr>
-   <td>Update Load Balancer
+   <td><a href="https://api.cloudflare.com/#load-balancers-update-load-balancer">Update Load Balancer</a>
    </td>
    <td><Code>PUT</Code>
    </td>
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-logs.md b/products/load-balancing/src/content/understand-basics/load-balancing-logs.md
deleted file mode 100644
index 534b226cfe9..00000000000
--- a/products/load-balancing/src/content/understand-basics/load-balancing-logs.md
+++ /dev/null
@@ -1,137 +0,0 @@
----
-order: 19
-pcx-content-type: reference
----
-# Load Balancing logs
-
-## Overview
-
-Load Balancing logs provide a historical view of status changes to your origins and how those status changes affect pool health.
-
-Load Balancing only logs events that represent a status change for an origin, from healthy to unhealthy or vice versa.
-
----
-
-## Properties
-
-Health check event objects have the following properties:
-
-<TableWrap>
-
-<table>
-  <thead>
-  <tr>
-   <th><strong>Name / type</strong>
-   </th>
-   <th><strong>Description / example</strong>
-   </th>
-   <th><strong>Constraints</strong>
-   </th>
-  </tr>
-  </thead>
-  <tbody>
-  <tr>
-   <td valign="top"><strong>id</strong>
-<p />
-<em>integer</em>
-   </td>
-   <td>Integer identifier that uniquely represents the health check event.
-<p />
-<code class="InlineCode">2</code>
-   </td>
-   <td valign="top">Default value: <code class="InlineCode">1</code>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>origins</strong>
-<p />
-<em>array</em>
-   </td>
-   <td>An array of objects representing the origin servers associated with the pool.
-<p /><code class="InlineCode">[</code>
-<p />
-<code class="InlineCode">{`{`}</code>
-<p />
-<code class="InlineCode">"name": "some-origin",</code>
-<p />
-<code class="InlineCode">"address": "198.51.100.4",</code>
-<p />
-<code class="InlineCode">"ip": "198.51.100.4",</code>
-<p />
-<code class="InlineCode">"enabled": true,</code>
-<p />
-<code class="InlineCode">"healthy": true,</code>
-<p />
-<code class="InlineCode">"failure_reason": "No failures",</code>
-<p />
-<code class="InlineCode">"changed": true</code>
-<p />
-<code class="InlineCode">{`}`}</code>
-<p />
-<code class="InlineCode">]</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>pool</strong>
-<p />
-<em>object</em>
-   </td>
-   <td>An object that represents the pool for which the health check event was generated.
-<p />
-<code class="InlineCode">{`{`}</code>
-<p />
-<code class="InlineCode">"id": "74bc6a8b9b0dda3d651707a2928bad0c",</code>
-<p />
-<code class="InlineCode">"name": "some-pool",</code>
-<p />
-<code class="InlineCode">"healthy": true,</code>
-<p />
-<code class="InlineCode">"changed": true,</code>
-<p />
-<code class="InlineCode">"minimum_origins": 1</code>
-<p />
-<code class="InlineCode">{`}`}</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>timestamp</strong>
-<p />
-<em>string (date-time)</em>
-   </td>
-   <td valign="top">The time at which the event was recorded
-<p />
-<code class="InlineCode">"2014-01-01T05:20:00.12345Z"</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  </tbody>
-</table>
-
-</TableWrap>
-
----
-
-## Accessing Load Balancing Logs from the Cloudflare dashboard
-
-Load Balancing Logs are available from the **Traffic** app of the Cloudflare dashboard within the **Load Balancing Analytics** tab under the **Logs** submenu. You can filter the logs by Date, Pool Health, Pool, Origin Health, and/or Origin.
-
-Click the expansion arrow at the far right of the event to expose more detail, including a list of healthy origins for the pool that was the subject of the event, the health threshold for that pool, Pool ID, and the origin address. Failure events include a reason for the failure and a list of failed origins.
-
----
-
-## Accessing Load Balancing Logs via the Cloudflare API
-
-### Commands
-
-To list health check events, use the List Health Check Events API endpoint:
-
-```bash
-GET user/load_balancing_analytics/events
-```
-
-For a list of optional parameters, which are useful for filtering log results, see _[Cloudflare API v4 Documentation: Health Check Events](https://api.cloudflare.com/#load-balancer-healthcheck-events-list-healthcheck-events)_.
diff --git a/products/load-balancing/src/content/understand-basics/load-balancing-rules/index.md b/products/load-balancing/src/content/understand-basics/load-balancing-rules/index.md
deleted file mode 100644
index 3f42c16f2b9..00000000000
--- a/products/load-balancing/src/content/understand-basics/load-balancing-rules/index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Load Balancing rules
-order: 17
-pcx-content-type: concept
----
-
-# Rules for Cloudflare Load Balancing
-
-Use Load Balancing rules to customize the behavior of your [load balancer](/understand-basics/load-balancers). For example, create a Load Balancing rule that selects an [origin pool](/understand-basics/pools) based on the URI path of an HTTP request.
-
-You can [create Load Balancing rules](/understand-basics/load-balancing-rules/create-rules) whenever you create or edit a load balancer in **Traffic**.
-
-![Create Custom Rule card in Traffic app](../../static/images/traffic-app-create-custom-rule.png)
-
-As with Cloudflare [Firewall rules](https://developers.cloudflare.com/firewall/cf-firewall-rules), each Load Balancing rule is a combination of two elements: an [expression](/understand-basics/load-balancing-rules/expressions) and an [action](/understand-basics/load-balancing-rules/actions). Expressions define the criteria for an HTTP request to trigger an action. The action tells Cloudflare how to handle the request.
-
-When building expressions for Load Balancing rules, refer to [Supported fields and operators](/understand-basics/load-balancing-rules/reference) for definitions and usage.
diff --git a/products/load-balancing/src/content/understand-basics/monitors.md b/products/load-balancing/src/content/understand-basics/monitors.md
index 2f121fce61d..0155d612f06 100644
--- a/products/load-balancing/src/content/understand-basics/monitors.md
+++ b/products/load-balancing/src/content/understand-basics/monitors.md
@@ -5,262 +5,41 @@ pcx-content-type: concept
 
 # Monitors
 
-## Overview
-
 Cloudflare health checks track the health of pools. They are configured through monitors, which define what type of health check to run and how frequently to run them. Cloudflare monitors your servers from each of our data centers.
 
 Health checks that result in a status change for an origin server are recorded as events in the Load Balancing event logs. You can create, attach, and configure health checks from either the Load Balancing dashboard or the Cloudflare API.
 
+<Aside type="note">
+
+Health checks associated with load balancers are different from <strong>Standalone health checks</strong>. For more details about Standalone health checks, see the <a href="https://support.cloudflare.com/hc/articles/4404867308429">Support documentation</a>.
+
+</Aside>
+
 ---
 
 ## Important notes
 
-- **Availability monitoring checks the health of origin servers every 15 seconds**. It reports results via email notifications and the Cloudflare API.
+- **Availability monitoring checks the health of origin servers at the specified interval**. It reports results via email notifications and the Cloudflare API. Shorter intervals will improve failover time, but may increase the load on your origin servers.
 - **The default retry rate is 5 retries/second** and is completely configurable. We do not recommend increasing the retry rate significantly. Retries use exponential backoff (1, 2, 4, 8, 16 seconds by default).
-- **You can configure** **monitoring for specific URLs** by sending periodic HTTP requests to the load balancer, taking advantage of customizable intervals, timeouts, and status codes. Once an origin server is marked unhealthy, multi-region failover reroutes traffic to the next available server in failover order.
+- **You can configure monitoring for specific URLs** by sending periodic HTTP requests to the load balancer, taking advantage of customizable intervals, timeouts, and status codes. Once an origin server is marked unhealthy, multi-region failover reroutes traffic to the next available server in failover order.
 - **Load Balancing monitors use the following HTTP user-agent**: `"Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: $poolid)"`. The `$poolid` contains the first 16 characters of the Load Balancing pool that is the target of the health check.
+- **To increase confidence in pool status**, increase the `consecutive_up` and `consecutive_down` fields when [creating a monitor with the API](https://api.cloudflare.com/#account-load-balancer-monitors-create-monitor). To become healthy or unhealthy, monitored origins must pass this health check the consecutive number of times specified in these parameters.
 - **To prevent health checks from failing**, and to secure user infrastructure against spoofed checks from bad actors, we recommend the following:
   - Only accept connections to hosts listed in the [Cloudflare IP ranges](https://www.cloudflare.com/ips/) in your firewall or web-server.
   - Use Cloudflare's user agent (see above) to reject HTTP requests that don't come from these ranges.
   - Ensure that your firewall or web server does not block or rate limit Cloudflare health checks.
 
----
+<Aside>
 
-## Properties
+For more details about how origins and pools become unhealthy, refer to [Origin and pool health](/understand-basics/health-details).
 
-Monitors support a great deal of customization and have the following properties:
+</Aside>
 
-<TableWrap>
-  <table>
-    <thead>
-      <tr>
-        <th>Name <Type>/type</Type></th>
-        <th>Description <Type>/example</Type></th>
-        <th>Constraints</th>
-      </tr>
-    </thead>
-    <tbody>
-      <tr>
-        <td><strong><Code>port</Code></strong><br/><Type>integer</Type></td>
-        <td>
-          <p>Port number to connect to for the health check. Required for TCP checks. HTTP and HTTPS checks should only define the port when using a non-standard port (HTTP: default 80, HTTPS: default 443).</p>
-          <div><Code>8080</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: 0</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>method</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>The method to use for the health check. This defaults to 'GET' for HTTP/HTTPS based checks and 'connection_established' for TCP based health checks.</p>
-          <div><Code>"GET"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: GET</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>timeout</Code></strong><br/><Type>integer</Type></td>
-        <td>
-          <p>The timeout (in seconds) before marking the health check as failed</p>
-          <div><Code>3</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: 5</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>path</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>The endpoint path to health check against. This parameter is only valid for HTTP and HTTPS monitors.</p>
-          <div><Code>"/health"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: /</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>interval</Code></strong><br/><Type>integer</Type></td>
-        <td>
-          <p>The interval between each health check. Shorter intervals may improve failover time, but will increase load on the origins as we check from multiple locations.</p>
-          <div><Code>90</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: 60 </li>
-            <li>minimum values: 
-            <ul>
-              <li>60 (Pro)</li>
-              <li>10 (Business)</li>
-              <li>5 (Enterprise)</li>
-            </ul></li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>retries</Code></strong><br/><Type>integer</Type></td>
-        <td>
-          <p>The number of retries to attempt in case of a timeout before marking the origin as unhealthy. Retries are attempted immediately.</p>
-          <div><Code>0</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: 2</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>follow_redirects</Code></strong><br/><Type>boolean</Type></td>
-        <td>
-          <p>Follow redirects if returned by the origin. This parameter is only valid for HTTP and HTTPS monitors.</p>
-          <div><Code>true</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: false</li>
-            <li>valid values: (true,false)</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>probe_zone</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>(known as Simulate Zone in the UI) pushes a request from Cloudflare Health Monitors through the Cloudflare stack as if it were a real visitor request to help analyze behavior or validate a configuration.  It allows you to emulate the specified zone while probing.</p>
-        </td>
-        <td>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>expected_body</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>A case-insensitive sub-string to look for in the response body. If this string is not found, the origin will be marked as unhealthy. This parameter is only valid for HTTP and HTTPS monitors.</p>
-<Aside type="info">
-
-The sub-string must appear within the first 10KiB of your response body.
+---
 
-</Aside>
-        </td>
-        <td><div><Code>"alive"</Code></div></td>
-      </tr>
-      <tr>
-        <td><strong><Code>header</Code></strong><br/><Type>object</Type></td>
-        <td>
-          <p>The HTTP request headers to send in the health check. It is recommended you set a Host header by default. The User-Agent header cannot be overridden. This parameter is only valid for HTTP and HTTPS monitors.</p>
-        </td>
-        <td><div>
-
-```json
-{
-  "Host": [
-    "example.com"
-  ],
-  "X-App-ID": [
-    "abc123"
-  ]
-}
-```
-
-</div></td>
-      </tr>
-      <tr>
-        <td><strong><Code>allow_insecure</Code></strong><br/><Type>boolean</Type></td>
-        <td>
-          <p>Do not validate the certificate when monitor use HTTPS. This parameter is currently only valid for HTTP and HTTPS monitors.</p>
-          <div><Code>true</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: false</li>
-            <li>valid values: (true,false)</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>modified_on</Code></strong><br/><Type>string (date-time)</Type></td>
-        <td>
-          <p>Last modification time</p>
-          <div><Code>"2014-01-01T05:20:00.12345Z"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>read only</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>created_on</Code></strong><br/><Type>string (date-time)</Type></td>
-        <td>
-          <p>Creation time</p>
-          <div><Code>"2014-01-01T05:20:00.12345Z"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>read only</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>type</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>The protocol to use for the health check. Currently supported protocols are 'HTTP','HTTPS' and 'TCP'.</p>
-          <div><Code>"https"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: http</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>id</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>API item identifier tag</p>
-          <div><Code>"f1aba936b94213e5b8dca0c0dbf1f9cc"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>
-              max length:
-              32
-            </li>
-            <li>read only</li>
-          </ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>description</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>Object description</p>
-          <div><Code>"Login page monitor"</Code></div>
-        </td>
-        <td>
-          <ul></ul>
-        </td>
-      </tr>
-      <tr>
-        <td><strong><Code>expected_codes</Code></strong><br/><Type>string</Type></td>
-        <td>
-          <p>The expected HTTP response code or code range of the health check. This parameter is only valid for HTTP and HTTPS monitors.</p>
-          <div><Code>"2xx"</Code></div>
-        </td>
-        <td>
-          <ul>
-            <li>default value: 200</li>
-          </ul>
-        </td>
-      </tr>
-    </tbody>
-  </table>
-</TableWrap>
+## Properties
+
+For an up-to-date list of monitor properties, refer to [Monitor properties](https://api.cloudflare.com/#load-balancer-monitors-properties) in our API documentation.
 
 ---
 
@@ -304,71 +83,56 @@ For a list of origins that override a monitor's `Host` header:
 
 ## Managing monitors via the Load Balancing dashboard
 
-Use the **Create Load Balancer** or **Edit Load Balancer** panels in the Load Balancing dashboard to manage health check monitors. For step-by-step guidance, see _[Create, attach, and configuring health checks](/create-load-balancer-ui#create-attach-and-configure-health-checks)_.
+Use the **Create Load Balancer** or **Edit Load Balancer** panels in the Load Balancing dashboard to manage health check monitors. For step-by-step guidance, see _[Create, attach, and configuring monitors](/create-load-balancer-ui#3-create-attach-and-configure-monitors)_.
 
 ---
 
-## Managing monitors via the Cloudflare API
+## API commands
 
-Use the `load_balancers/monitors` endpoint to manage monitors via the Cloudflare API.
-
-### Commands
-
-The Cloudflare API supports the following commands for monitors. (Examples are given for user-level endpoint but apply to the account-level endpoint as well.) For more detail, see _[Cloudflare API: Load Balancer Monitors](https://api.cloudflare.com/#load-balancer-monitors-properties)_.
+The Cloudflare API supports the following commands for monitors. Examples are given for user-level endpoint but apply to the account-level endpoint as well.
 
 <TableWrap>
 
 <table>
   <thead>
     <tr>
-      <th><Code>Command</Code></th>
-      <th><Code>Method</Code></th>
-      <th><Code>Endpoint</Code></th>
+      <th><Strong>Command</Strong></th>
+      <th><Strong>Method</Strong></th>
+      <th><Strong>Endpoint</Strong></th>
     </tr>
   </thead>
   <tbody>
     <tr>
-      <td>Create Monitor</td>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-create-monitor">Create Monitor</a></td>
       <td><Code>POST</Code></td>
       <td><Code>user/load_balancers/monitors</Code></td>
     </tr>
     <tr>
-      <td>Delete Monitor</td>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-delete-monitor">Delete Monitor</a></td>
       <td><Code>DELETE</Code></td>
       <td><Code>user/load_balancers/monitors</Code></td>
     </tr>
     <tr>
-      <td>List Monitors</td>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-list-monitors">List Monitors</a></td>
       <td><Code>GET</Code></td>
       <td><Code>user/load_balancers/monitors</Code></td>
     </tr>
     <tr>
-      <td>Monitor Details</td>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-monitor-details">Monitor Details</a></td>
       <td><Code>GET</Code></td>
       <td><Code>user/load_balancers/monitors/:identifier</Code></td>
     </tr>
     <tr>
-      <td>Update Monitor</td>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-update-monitor">Update Monitor</a></td>
       <td><Code>PUT</Code></td>
       <td><Code>user/load_balancers/monitors</Code></td>
     </tr>
+     <tr>
+      <td><a href="https://api.cloudflare.com/#load-balancer-monitors-preview-monitor">Preview Monitor</a></td>
+      <td><Code>POST</Code></td>
+      <td><Code>user/load_balancers/monitors/:identifier/preview</Code></td>
+    </tr>
   </tbody>
 </table>
 
 </TableWrap>
-
----
-
-## Health check integration with PagerDuty
-
-To integrate Cloudflare Health Check notifications with PagerDuty, follow the steps outlined in PagerDuty’s [Email Integration Guide](https://www.pagerduty.com/docs/guides/email-integration-guide/). If you do not have a PagerDuty account, you will first need to set that up.
-
-PagerDuty will generate an email address that will create incidents based on emails sent to that address.
-
-If you already have email integration configured in PagerDuty, you can find the designated email address by going to **Configuration > Services > Email** (under **Integrations**).
-
-![](../static/images/monitors-1.png)
-
-When creating the Notifier object, configure the email to go to the PagerDuty integration email. Consequently, whenever a pool or origin goes down, an Incident will be created to capture it.
-
-![](../static/images/monitors-2.png)
diff --git a/products/load-balancing/src/content/understand-basics/pools.md b/products/load-balancing/src/content/understand-basics/pools.md
index 200cb42a917..da0040b98e8 100644
--- a/products/load-balancing/src/content/understand-basics/pools.md
+++ b/products/load-balancing/src/content/understand-basics/pools.md
@@ -5,10 +5,14 @@ pcx-content-type: concept
 
 # Pools
 
-## Overview
-
 A Cloudflare Load Balancing pool represents a group of origin servers, each identified by their IP address or hostname. You can configure multiple pools, as well as failover priority (Pool A-> Pool B-> Pool C). If you're familiar with DNS terminology, think of a pool as a “record set,” except we only return addresses that are considered healthy. You can attach health checks to individual pools to tailor monitoring for collections of origin servers.
 
+<Aside>
+
+For more details about how origins and pools become unhealthy, refer to [Origin and pool health](/understand-basics/health-details).
+
+</Aside>
+
 ---
 
 ## Important notes
@@ -29,190 +33,7 @@ When working with pools, note the following:
 
 ## Properties
 
-Cloudflare Pool objects have the following properties:
-
-<TableWrap>
-
-<table>
-  <thead>
-  <tr>
-   <th><strong>Name / type</strong>
-   </th>
-   <th><strong>Description / example</strong>
-   </th>
-   <th><strong>Constraints</strong>
-   </th>
-  </tr>
-  </thead>
-  <tbody>
-  <tr>
-   <td valign="top"><strong>check_regions</strong>
-<p />
-<em>arraynull            </em>
-   </td>
-   <td>A list of regions from which to run health checks. Null means every Cloudflare data center.
-<p />
-<code class="InlineCode">
-[
-<p />
-  "WEU",
-<p />
-  "ENAM"
-<p />
-]
-</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>created_on</strong>
-<p />
-<em>string (date-time)</em>
-   </td>
-   <td>Creation time
-<p />
-<code class="InlineCode">"2014-01-01T05:20:00.12345Z"</code>
-   </td>
-   <td valign="top">Read only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>description</strong>
-<p />
-<em>string</em>
-   </td>
-   <td valign="top">A human-readable description of the pool
-<p />
-<code class="InlineCode">"This pool is for example.com"</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>enabled</strong>
-<p />
-<em>boolean</em>
-   </td>
-   <td>Set to <code class="InlineCode">true</code> to enable the pool; <code class="InlineCode">false</code>, to disable.
-<p /><p />
-Disabled pools will not receive traffic and are excluded from health checks. Disabling a pool will cause any load balancers associated with the pool to failover to the next pool (if any).
-<p />
-<code class="InlineCode">true</code>
-   </td>
-   <td>Default value: <code class="InlineCode">true</code>
-<p />
-Valid values: <code class="InlineCode">true</code>, <code class="InlineCode">false</code>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>id</strong>
-<p />
-<em>string</em>
-   </td>
-   <td valign="top">API item identifier tag for the pool
-<p />
-<code class="InlineCode">"17b5962d775c646f3f9725cbc7a53df4"</code>
-   </td>
-   <td>Max. length: 32 bytes
-<p />
-Read only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>minimum_origins</strong>
-<p />
-<em>integer</em>
-   </td>
-   <td>The minimum number of origins that must be healthy for this pool to serve traffic. If the number of healthy origins falls below this number, the pool will be marked unhealthy and the load balancer will failover to the next available pool.
-<p />
-<code class="InlineCode">2</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>modified_on</strong>
-<p />
-<em>string (date-time)</em>
-   </td>
-   <td valign="top">Last modification time
-<p />
-<code class="InlineCode">"2014-01-01T05:20:00.12345Z"</code>
-   </td>
-   <td>Read only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>monitor</strong>
-<p />
-<em>string</em>
-   </td>
-   <td valign="top">The ID of the monitor to use for health checking origins within this pool
-<p />
-<code class="InlineCode">"f1aba936b94213e5b8dca0c0dbf1f9cc"</code>
-   </td>
-   <td valign="top">Max. length: 32 bytes
-<p />
-Read only
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>name</strong>
-<p />
-<em>string</em>
-   </td>
-   <td>A short name (tag) for the pool. Only alphanumeric characters, hyphens and underscores are allowed.
-<p />
-<code class="InlineCode">"primary-dc-1"</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>notification_email</strong>
-<p />
-<em>string</em>
-   </td>
-   <td>The email address to which health status notifications are sent. This can be an individual mailbox or a mailing list.
-<p />
-<code class="InlineCode">"someone@example.com"</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  <tr>
-   <td valign="top"><strong>origins</strong>
-<p />
-<em>array</em>
-   </td>
-   <td>The list of origins within this pool. Traffic directed at this pool is balanced across all currently healthy origins, provided the pool itself is healthy.
-<p />
-<code class="InlineCode">
-[
-<p />
-  {`{`}
-<p />
-    "name": "app-server-1",
-<p />
-    "address": "0.0.0.0",
-<p />
-    "enabled": true,
-<p />
-    "weight": 0.56
-<p />
-  {`}`}
-<p />
-]
-</code>
-   </td>
-   <td>
-   </td>
-  </tr>
-  </tbody>
-</table>
-
-</TableWrap>
+For an up-to-date list of pool properties, refer to [Pool properties](https://api.cloudflare.com/#load-balancer-pools-properties) in our API documentation.
 
 ---
 
@@ -224,24 +45,18 @@ For example, you might have a pool with origins hosted in multiple AppEngine pro
 
 Since these examples require specific hostnames per origin, your load balancer could not properly route traffic _without_ a `Host` header override.
 
-If you need an origin `Host` header override, add it when [creating](/create-load-balancer-ui#create-and-add-origin-pools) or editing a pool. For security reasons, this header also needs to be a subdomain of the overall zone. See [Configure Cloudflare and Heroku](https://support.cloudflare.com/hc/articles/205893698) for more details.
+If you need an origin `Host` header override, add it when [creating](/create-load-balancer-ui#create-and-add-origin-pools) or editing a pool. For security reasons, this header must meet one of the following criteria:
+- Is a subdomain of a zone associated with this account
+- Matches the origin address
+- Publicly resolves to the origin address
 
 For details about how origin and monitor `Host` headers interact, see [Host header prioritization](/understand-basics/monitors#host-header-prioritization).
 
 ---
 
-## Managing pools via the Cloudflare API
-
-### Endpoints
-
-Pool endpoints are available in the Cloudflare API at both the user and account level, respectively:
-
-- `user/load_balancers/pools`
-- `accounts/:account_identifier/load_balancers/pools`
+## API commands
 
-### Commands
-
-The Cloudflare API supports the following commands. For more detail, see _[Cloudflare API: Load Balancer Pools](https://api.cloudflare.com/#load-balancer-pools-properties)_.
+The Cloudflare API supports the following commands for pools. Examples are given for user-level endpoint but apply to the account-level endpoint as well.
 
 <TableWrap>
 
@@ -258,7 +73,7 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
   </thead>
   <tbody>
   <tr>
-   <td>Create Pool
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-create-pool">Create Pool</a>
    </td>
    <td><code class="InlineCode">POST</code>
    </td>
@@ -266,7 +81,7 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
    </td>
   </tr>
   <tr>
-   <td>Delete Pool
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-delete-pool">Delete Pool</a>
    </td>
    <td><code class="InlineCode">DELETE</code>
    </td>
@@ -274,7 +89,7 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
    </td>
   </tr>
   <tr>
-   <td>List Pools
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-list-pools">List Pools</a>
    </td>
    <td><code class="InlineCode">GET</code>
    </td>
@@ -282,7 +97,7 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
    </td>
   </tr>
   <tr>
-   <td>Pool Details
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-pool-details">Pool Details</a>
    </td>
    <td><code class="InlineCode">GET</code>
    </td>
@@ -290,7 +105,7 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
    </td>
   </tr>
   <tr>
-   <td>Pool Health Details
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-pool-health-details">Pool Health Details</a>
    </td>
    <td><code class="InlineCode">GET</code>
    </td>
@@ -298,12 +113,28 @@ The Cloudflare API supports the following commands. For more detail, see _[Cloud
    </td>
   </tr>
   <tr>
-   <td>Update Pool
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-update-pool">Update Pool</a>
    </td>
    <td><code class="InlineCode">PUT</code>
    </td>
    <td><code class="InlineCode">user/load_balancers/pools/:identifier</code>
    </td>
+  </tr>
+   <tr>
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-preview-pool">Preview Pool</a>
+   </td>
+   <td><code class="InlineCode">POST</code>
+   </td>
+   <td><code class="InlineCode">user/load_balancers/pools/:identifier/preview</code>
+   </td>
+  </tr>
+   <tr>
+   <td><a href="https://api.cloudflare.com/#load-balancer-pools-list-pool-references">List Pool References</a>
+   </td>
+   <td><code class="InlineCode">GET</code>
+   </td>
+   <td><code class="InlineCode">user/load_balancers/pools/:identifier/references</code>
+   </td>
   </tr>
   </tbody>
 </table>
diff --git a/products/load-balancing/src/content/understand-basics/session-affinity.md b/products/load-balancing/src/content/understand-basics/session-affinity.md
index 401424a9472..d5ced0d1a53 100644
--- a/products/load-balancing/src/content/understand-basics/session-affinity.md
+++ b/products/load-balancing/src/content/understand-basics/session-affinity.md
@@ -5,15 +5,19 @@ pcx-content-type: reference
 
 # Session affinity
 
+When you enable session affinity, your load balancer directs all requests from a particular end user to a specific origin server. This continuity preserves information about the user session — such as items in their shopping cart — that might otherwise be lost if requests were spread out among multiple servers.
+
+Session affinity can also help reduce network requests, leading to savings for customers with usage-based billing.
+
 <Aside type='warning' header='Important'>
 
 Cloudflare only supports cookie-based session affinity. Other methods, such as TCP session affinity, are not supported.
 
 </Aside>
 
-## Overview
+## Process
 
-Session Affinity reduces network requests by automatically directing requests from the same client to the same origin web server:
+Session Affinity automatically directs requests from the same client to the same origin web server:
 
 - **When a client makes its first request**, Cloudflare sets a `CFLib` cookie on the client that tracks the associated origin web server.
 - **Subsequent requests by the same client are forwarded to that origin** for the duration of the cookie and as long as the origin server remains healthy.
@@ -27,9 +31,7 @@ The session cookie is secure when [Always Use HTTPS](https://support.cloudflare.
 
 ## Enabling Session Affinity from the Cloudflare dashboard
 
-### Configuring Session Affinity for a new load balancer
-
-Enable Session Affinity when you [create a load balancer](/create-load-balancer-ui), during the **Hostname** step.
+Enable Session Affinity when you [create  or edit a load balancer](/create-load-balancer-ui), during the **Hostname** step.
 
 If you enable Session Affinity, choose one of the following options:
 - **By Cloudflare cookie only**: Sets a `CFLib` cookie to track the associated origin web server
@@ -41,188 +43,25 @@ Session Affinity with Client IP fallback is not supported for load balancers in
 
 </Aside>
 
-### Configuring Session Affinity for an existing load balancer
-
-Configure session affinity for an existing load balancer from the Load Balancing dashboard. 
-
-On a specific load balancer:
-1. Select **Edit**.
-1. Go to the **Hostname** step.
-1. Enable **Session Affinity** and choose a tracking option.
-
 ### Origin Drain
 
-Drain or remove all traffic from an origin without affecting any active customers using Origin Drain. Enable Origin Drain by entering a value in the **Origin drain duration TTL** field, after enabling Session Affinity. **Origin drain duration TTL** is the time (in seconds) it takes to drain all active connections. Traffic drains from any disabled origin or from all origins within a disabled pool.
-
-![Session affinity configuration with origin drain](../static/images/session-affinity-3.png)
+Drain or remove all traffic from an origin without affecting any active customers using Origin Drain. For more details on origin drain, refer to [Performing planned maintenance](/additional-options/planned-maintenance#gradual-rotation).
 
-To check the status of a disabled origin’s drain, use the added **Drain Time** column in the Manage Load Balancer table. **Drain Time** shows the time remaining for a drain in progress. You can edit the **Origin drain duration TTL** field value while an origin drains. Entering a value shorter than the remaining TTL for drains in progress servers current connections to those origins.
-
-![Manage Load Balancer table with draining in progress](../static/images/session-affinity-4.png)
+<Aside type='warning' header='Important'>
 
-When a drain is **Complete**, there are no longer any connections to that origin.
+Origin drain is not supported for load balancers in [DNS-only mode (gray cloud)](/understand-basics/proxy-modes).
 
-![Manage Load Balancer table with draining complete](../static/images/session-affinity-5.png)
+</Aside>
 
 ---
 
 ## Enabling Session Affinity via the Cloudflare API
 
-Session affinity is a property of load balancers. Use the following endpoint to configure Session Affinity (see [_Create a load balancer with the API_](/create-load-balancer-api/)):
-
-```txt
-zones/:identifier/load_balancers
-```
-
-Set the `session_affinity` parameter to configure the feature. The default value is an empty string, which indicates that Session Affinity is disabled. To enable it, use the value “cookie” in your request.
-
-Set the `session_affinity_ttl` parameter to configure the duration of session affinity cookies. Values are in seconds and must be in the range 1800–604800 (30 minutes to seven days). Unless `session_affinity` is explicitly set, the default value of 23 hours is used. This parameter is ignored when Session Affinity is disabled.
-
-For a detailed description of the limitations and values available for `session-affinity` and `session_affinity_ttl`, see [_Load balancers_](/understand-basics/load-balancers/#properties).
-
-### Configuring Session Affinity for a new load balancer
-
-You can configure session affinity as part of your request to the Create Load Balancer command.
-
-**Request example (_curl_)**
-
-```bash
-curl -X POST "https://api.cloudflare.com/client/v4/zones/699d98642c564d2e855e9661899b7252/load_balancers" \
-     -H "X-Auth-Email: user@example.com" \
-     -H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
-     -H "Content-Type: application/json" \
-     --data '   "description":"Load Balancer for www.example.com",
-   "name":"www.example.com",
-   "ttl":30,
-   "fallback_pool":"17b5962d775c646f3f9725cbc7a53df4",
-   "default_pools":[
-      "17b5962d775c646f3f9725cbc7a53df4",
-      "9290f38c5d07c2e2f4df57b1f61d4196",
-      "00920f38ce07c2e2f4df50b1f61d4194"
-   ],
-   "region_pools":{
-      "WNAM":[
-         "de90f38ced07c2e2f4df50b1f61d4194",
-         "9290f38c5d07c2e2f4df57b1f61d4196"
-      ],
-      "ENAM":[
-         "00920f38ce07c2e2f4df50b1f61d4194"
-      ]
-   },
-   "pop_pools":{
-      "LAX":[
-         "de90f38ced07c2e2f4df50b1f61d4194",
-         "9290f38c5d07c2e2f4df57b1f61d4196"
-      ],
-      "LHR":[
-         "abd90f38ced07c2e2f4df50b1f61d4194",
-         "f9138c5d07c2e2f4df57b1f61d4196"
-      ],
-      "SJC":[
-         "00920f38ce07c2e2f4df50b1f61d4194"
-      ]
-   },
-   "proxied":true,
-   "steering_policy":"dynamic_latency",
-   "session_affinity":"cookie",
-   "session_affinity_ttl":5000
-}''
-```
-
-**Response**
-
-```json
-{
-  "success": true,
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": "699d98642c564d2e855e9661899b7252",
-    "created_on": "2014-01-01T05:20:00.12345Z",
-    "modified_on": "2014-01-01T05:20:00.12345Z",
-    "description": "Load Balancer for www.example.com",
-    "name": "www.example.com",
-    "enabled": true,
-    "ttl": 30,
-    "fallback_pool": "17b5962d775c646f3f9725cbc7a53df4",
-    "default_pools": [
-      "17b5962d775c646f3f9725cbc7a53df4",
-      "9290f38c5d07c2e2f4df57b1f61d4196",
-      "00920f38ce07c2e2f4df50b1f61d4194"
-    ],
-    "region_pools": {
-      "WNAM": [
-        "de90f38ced07c2e2f4df50b1f61d4194",
-        "9290f38c5d07c2e2f4df57b1f61d4196"
-      ],
-      "ENAM": [
-        "00920f38ce07c2e2f4df50b1f61d4194"
-      ]
-    },
-    "pop_pools": {
-      "LAX": [
-        "de90f38ced07c2e2f4df50b1f61d4194",
-        "9290f38c5d07c2e2f4df57b1f61d4196"
-      ],
-      "LHR": [
-        "abd90f38ced07c2e2f4df50b1f61d4194",
-        "f9138c5d07c2e2f4df57b1f61d4196"
-      ],
-      "SJC": [
-        "00920f38ce07c2e2f4df50b1f61d4194"
-      ]
-    },
-    "proxied": true,
-    "steering_policy": "dynamic_latency",
-    "session_affinity": "cookie",
-    "session_affinity_ttl": 5000
-  }
-}
-```
-
-### Configuring Session Affinity for an existing load balancer
-
-Use the Update Load Balancer endpoint to configure session affinity for an existing load balancer:
-
-```txt
-PUT zones/:identifier/load_balancers/:identifier
-```
-
-**Request example (curl)**
-
-```bash
-curl -X PUT "https://api.cloudflare.com/client/v4/zones/699d98642c564d2e855e9661899b7252/load_balancers" \
-     -H "X-Auth-Email: user@example.com" \
-     -H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
-     -H "Content-Type: application/json" \
-     --data '   "description":"Load Balancer for www.example.com",
-   "name":"www.example.com",
-   "Enabled":true,
-    "proxied":true,
-   "steering_policy":"dynamic_latency",
-   "session_affinity":"cookie",
-   "session_affinity_ttl":5000
-}''
-```
-
-**Response**
-
-```json
-{
-  "success": true,
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": "699d98642c564d2e855e9661899b7252",
-    "created_on": "2014-01-01T05:20:00.12345Z",
-    "modified_on": "2014-01-01T05:20:00.12345Z",
-    "description": "Load Balancer for www.example.com",
-    "name": "www.example.com",
-    "enabled": true,
-    "proxied": true,
-    "steering_policy": "dynamic_latency",
-    "session_affinity": "cookie",
-    "session_affinity_ttl": 5000
-  }
-}
-```
+Session affinity is a property of load balancers, which you can set with the following endpoints:
+
+- [Create a load balancer](https://api.cloudflare.com/#load-balancers-create-load-balancer)
+- [Edit a load balancer](https://api.cloudflare.com/#load-balancers-update-load-balancer)
+
+Customize the behavior of session affinity by using the `session_affinity`, `session_affinity_ttl`, and `session_affinity_attributes` parameters.
+
+For more details on API commands in context, refer to [Create a load balancer with the API](/create-load-balancer-api/).
diff --git a/products/load-balancing/src/content/understand-basics/traffic-steering.md b/products/load-balancing/src/content/understand-basics/traffic-steering.md
index 59575a779e7..f08c93c2b52 100644
--- a/products/load-balancing/src/content/understand-basics/traffic-steering.md
+++ b/products/load-balancing/src/content/understand-basics/traffic-steering.md
@@ -14,9 +14,9 @@ Configure traffic steering from the Load Balancing dashboard — in either the *
 
 ---
 
-## Off - Standard failover
+## Off - standard failover
 
-Standard failover directs traffic from unhealthy pools to the next healthy pool in the configuration.
+Standard failover directs traffic from unhealthy pools — determined by [health checks](/understand-basics/monitors) and the **Health Threshold** — to the next healthy pool in the configuration. Customers commonly use this option to set up [active - passive failover](/understand-basics/load-balancers#active---passive-failover).
 
 Standard failover uses the pool order to determine failover priority (the failover order).
 
@@ -28,7 +28,7 @@ If no monitors are attached to the load balancer, it will direct traffic to the
 
 ---
 
-## Dynamic Steering
+## Dynamic steering
 
 Dynamic Steering uses health check data to identify the fastest pool for a given Cloudflare Region or data center.
 
@@ -40,11 +40,11 @@ For TCP health checks, calculated latency may not reflect the true latency to th
 
 The diagram below shows how Cloudflare would route traffic to the pool with the lowest EWMA among three regions: Eastern North America, Europe, and Australia. In this case, the ENAM pool is selected, because it has the lowest RTT.
 
-![](../static/images/traffic-steering-2.png)
+![Dynamic steering routes traffic to the fastest available pool](../static/images/traffic-steering-2.png)
 
 ---
 
-## Geo Steering
+## Geo steering
 
 Geo Steering directs traffic to pools to a specific geographical region or — for Enterprise customers only — data center. This option is extremely useful when you want site visitors to access the origin server closest to them, which improves page-loading performance.
 
@@ -54,9 +54,9 @@ Cloudflare has 13 geographic regions that span the world. The region of a client
 
 <RegionMapping/>
 
-For more details on working with regions and region codes, see [Region Mapping API](../region-mapping-api).
+For more details on working with regions and region codes, refer to [Region Mapping API](/reference/region-mapping-api).
 
-## Proximity Steering
+## Proximity steering
 
 Choose **Proximity Steering** to route visitors or internal services to the closest physical data center.
 
@@ -70,10 +70,14 @@ To use proximity steering on a load balancer, you first need to add GPS coordina
 ### How to add proximity steering
 
 To add coordinates when creating or editing a pool:
-1. Select **Configure co-ordinates for Proximity Steering**.
+1. Click the **Configure co-ordinates for Proximity Steering** dropdown.
 1. Enter the latitude and longitude or drag a marker on the map.
 1. Select **Save**.
 
 <Aside type="warning" header="Warning:">
   For accurate proximity steering, add GPS coordinates to all pools within the same load balancer.
-</Aside>
\ No newline at end of file
+</Aside>
+
+## Random steering
+
+Choose **Random** to route traffic to a healthy pool at random. Customers can use this option to set up [active - active failover](/understand-basics/load-balancers#active---active-failover) (or round robin), where traffic is split equally between multiple pools.
diff --git a/products/load-balancing/wrangler.toml b/products/load-balancing/wrangler.toml
index ff4470b4e26..c65c7200998 100644
--- a/products/load-balancing/wrangler.toml
+++ b/products/load-balancing/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/load-balancing*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "4f0f506480c84575af95ee848bee5f4e" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/logs/docs-config.js b/products/logs/docs-config.js
index 312c93c8f08..5404734cdeb 100644
--- a/products/logs/docs-config.js
+++ b/products/logs/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Cloudflare Logs contain detailed information on requests and events processed by our network. Find out about the connecting client, Cloudflare's actions, and the response from the origin server",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/logs",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/logs/src/content/_partials/_enable-read-permissions.md b/products/logs/src/content/_partials/_enable-read-permissions.md
new file mode 100644
index 00000000000..b9630ca543f
--- /dev/null
+++ b/products/logs/src/content/_partials/_enable-read-permissions.md
@@ -0,0 +1 @@
+Only roles with Cloudflare Log Share edit permissions can read and configure Logpush jobs because job configurations may contain sensitive information. Ensure Log Share permissions are enabled before attempting to read or configure a Logpush job.
\ No newline at end of file
diff --git a/products/logs/src/content/about/index.md b/products/logs/src/content/about/index.md
new file mode 100644
index 00000000000..31eedc1335f
--- /dev/null
+++ b/products/logs/src/content/about/index.md
@@ -0,0 +1,18 @@
+---
+order: 20
+pcx-content-type: concept
+---
+
+# About Logpush
+
+Push logs of Cloudflare's datasets to your cloud service in batches. Logpush is available to customers on Cloudflare's Enterprise plan.
+
+Logpush delivers each batch of logs as a gzipped file containing data in newline-delimited JSON format (or [JSON lines](https://jsonlines.org/)) to your destination as soon as possible, generally in less than one minute.
+
+These batches contain no more than 100,000 records per file. That limit may be raised in the future. There is no minimum batch size, and Logpush may deliver more than one file per minute. The number of files delivered depends on the number of logs that need to be delivered. More logs equals more batches and therefore more files. The number of files also depends on the number of Cloudflare log-processing servers needed to handle the volume of logs.
+
+Prior to mid-2020, Logpush sent logs once every five minutes (referred to as Logpush v1). The change to more frequent log pushing allows Cloudflare to deliver information to you as close to real time as possible in smaller files. You may receive log files that contain fewer lines - that’s expected. If you have legacy Logpush jobs configured to the old settings, use the Logpush API to upgrade your job to Logpush v2. All new jobs will use Logpush v2 by default.
+
+<ButtonGroup>
+  <Button type="primary" href="/get-started">Get started</Button>
+</ButtonGroup>
\ No newline at end of file
diff --git a/products/logs/src/content/analytics-integrations/datadog/index.md b/products/logs/src/content/analytics-integrations/datadog/index.md
deleted file mode 100644
index c861a3a34cf..00000000000
--- a/products/logs/src/content/analytics-integrations/datadog/index.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: Datadog
-order: 97
----
-
-# Datadog
-
-This tutorial explains how to analyze Cloudflare metrics using the [Cloudflare Integration tile for Datadog](https://docs.datadoghq.com/integrations/cloudflare/).
-
-## Overview
-
-Before viewing the Cloudflare dashboard in Datadog, note that this integration:
-
-- Is available to all Cloudflare customer plans (Free, Pro, Business and Enterprise)
-- Is based on the [Cloudflare Analytics API](https://api.cloudflare.com/#zone-analytics-dashboard)
-- Provides Cloudflare web traffic and DNS metrics only
-- Does not feature data coming from request logs stored in Cloudflare Logs
-
-## Task 1 - Install the Cloudflare App
-
-To install the Cloudflare App for Datadog:
-
-1. Log in to **Datadog**.
-
-2. Click the **Integrations** tab.
-
-3. In the **search box**, start typing _Cloudflare_. The app tile should appear below the search box.
-   ![Datadog Integrations search for Cloudflare App](../../static/images/datadog/screenshots/datadog-integrations.png)
-
-4. Click the **Cloudflare** tile to begin the installation.
-
-5. Next, click **Configuration** and then complete the following:
-
-   - **Account name**: (Optional) This can be any value. It has not impact on the site data pulled from Cloudflare.
-
-   - **Email**: This value helps keep your account safe. We recommend creating a dedicated Cloudflare user for analytics with the [_Analytics_ role](https://support.cloudflare.com/hc/articles/205065067#12345682) (read-only). Note that the _Analytics_ role is available to Enterprise customers only.
-
-   - **API Key**: Enter your Cloudflare Global API key.
-
-6. Click **Install Integration**.
-   ![Datadog configure and install integration](../../static/images/datadog/screenshots/cloudflare-tile-datadog-fill-details.png)
-
-The Cloudflare App for Datadog should be installed now and you can view the dashboard.
-
-## Task 2 - View the dashboard
-
-By default, the dashboard displays metrics for all sites in your Cloudflare account. Use the dashboard filters see metrics for a specific domain.
-
-The dashboard displays the following metrics:
-
-- **Threats** (threats by type, threats by country)
-- **Requests** (total requests, cached requests, uncached requests, top countries by request, requests by IP class, top content types)
-- **Bandwidth** (total bandwidth, encrypted and unencrypted traffic cached bandwidth, uncached bandwidth)
-- **Caching** (Cache hit rate, request caching rate over time)
-- **HTTP response status errors**
-- **Page views**
-- **Search Engine Bot Traffic**
-- **DNS** (DNS queries, response time, top hostnames, queries by type, stale vs. uncached queries)
-
-![Cloudflare dashboard datadog](../../static/images/datadog/dashboards/cloudflare-dashboard-datadog.png)
diff --git a/products/logs/src/content/analytics-integrations/elastic/index.md b/products/logs/src/content/analytics-integrations/elastic/index.md
deleted file mode 100644
index 6cb8bf1eebe..00000000000
--- a/products/logs/src/content/analytics-integrations/elastic/index.md
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: Elastic
-order: 99
----
-
-# Elastic
-
-This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using Elastic and Kibana.
-
-## Overview
-
-If you haven’t used Cloudflare Logs before, visit our [Logs documentation](/) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
-
-### Prerequisites
-
-Before sending your Cloudflare log data to Elastic, make sure that you:
-
-- Have an existing Elastic instance (versions 6.x and 7.x supported)
-- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
-- Configure [Logpush](/logpush/) or [Logpull](/logpull-api/)
-
-<Aside type="note" header="Note">
-
-Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Elastic.
-</Aside>
-
-## Task 1 - Preparation
-
-Before getting Cloudflare logs into Elastic:
-
-1. Install an AWS Lambda function, available in the file _cloudflare-elastic-lambda.zip_ from GitHub at this location: [https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.3-7.x](https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.3-7.x).
-
-2. Upload the _cloudflare-elastic-lambda.zip_ file to an S3 bucket.
-
-   ![Amazon S3 bucket](../../static/images/elastic/screenshots/cloudflare-elastic-lambda-zip-s3-bucket.png)
-
-## Task 2 - Create Elasticsearch deployment on Elastic Cloud
-
-1. Create an account on [Elastic Cloud](https://cloud.elastic.co) and log in.
-
-2. Once logged in, create a new deployment where the Cloudflare logs will reside.
-   ![Create your first deployment](../../static/images/elastic/screenshots/create-your-first-deployment.png)
-
-3. Configure your new deployment with the following parameters:
-
-   - **Name**: _cloudflare-elastic-logs_
-
-   - **Cloud provider**: _Amazon Web Services_ or _Google Cloud Platform_
-
-   - **Region**: Geographical region in which to host the deployment
-
-   - **Version**: Choose version _6.x_ or _7.x_
-
-   - **Template**: Choose _Hot-Warm Architecture_ (recommended) or _I/O Optimize_
-     ![Create Elastic deployment part 1](../../static/images/elastic/screenshots/create-elastic-deployment-hot-warm-architecture.png)
-
-4. Click **Customize Deployment**. On this page, you can set your Elasticsearch cluster memory and storage.
-
-   - **I/O Optimized Template Configuration**
-     For this options, we recommend configuring your cluster to have 2 availability zones and 8 GB of RAM.
-
-   - **Hot-Warm Template Configuration**
-     For this option, we recommend configuring your cluster as:
-
-     - _Hot Zone_: 2 availability zones, 8 GB RAM
-
-     - _Warm Zone_: 2 availability zones, 8 GB RAM
-
-     ![Create Elastic deployment part 2](../../static/images/elastic/screenshots/configure-hot-and-warm-elastic-8gb-ram.png)
-     In a hot-warm template, the system will automatically manage the data lifecycle for you by migrating old data to less expensive storage. To configure this, click **Configure index management**.
-
-5. Add an index pattern for `cloudflare-*` and set it to migrate data off the hot zone after 7 days.
-   ![Create Elastic deployment part 3](../../static/images/elastic/screenshots/index-curation-add-cloudflare.png)
-
-6. You are now ready to create your Elastic deployment. Click **Create deployment**. The page will refresh with details of your new cluster. It is important to save the randomly generated password (see screenshot). All Elastic deployments are secure by default and are bootstrapped with a randomly generated password for the **Elastic** user. You will use this password to log in to view your Cloudflare logs.
-
-![Elastic generated user details](../../static/images/elastic/screenshots/generated-user-details-elastic-deployment.png)
-
-## Task 3 - Configure the deployment
-
-Next, to configure your deployment:
-
-1.  From [https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.1](https://github.com/cloudflare/cloudflare-elastic/releases/tag/v0.1) download the following files:
-
-    - _cloudflare-index-template.json_
-
-    - _cloudflare-ingest-pipeline-daily.json_
-
-    - _cloudflare-ingest-pipeline-weekly.json_
-
-    - _install-artifacts.sh_
-
-    - _dashboards.json_
-
-2.  Using the Elasticsearch endpoint for your new deployment (found on the main page), run the following command from a terminal, using the random password from above.
-
-        ./install-artifacts.sh -u elastic -p <RANDOM PASSWORD> -e https://_<YOUR DEPLOYMENT ENDPOINT>_:9243
-
-3.  To install the Cloudflare dashboards, log in to the Kibana user interface using the **elastic** username and the randomly generated password.
-
-4.  Navigate to **Management** > **Kibana** > **Saved Objects**.
-
-5.  Upload _dashboards.json_ by clicking the **Import** link.
-
-![Elastic Kibana saved objects import](../../static/images/elastic/screenshots/kibana-saved-objects-import-dashboards.png)
-
-## Task 4 - Create the Lambda function in AWS
-
-To create the Lambda function:
-
-1. Install the function: create the Lambda, which will read Cloudflare logs from S3 and import them into your Elastic cluster.
-
-2. Log in to your AWS console and navigate to the Lambda section. Create a new function, using the Java 8 runtime and give it a name such as _cloudflare-elastic-logs_.
-
-3. Configure the handler as `com.cloudflare.elastic.ElasticLambdaForwarder::handleRequest` and upload the function that we had previously saved to our S3 bucket.
-   ![Elastic function code lambda](../../static/images/elastic/screenshots/function-code-lambda.png)
-
-4. Configure the function. The Lambda function requires the following environment variables:
-
-   - **elastic_hostname**: Copy the Elasticsearch endpoint URL from your deployment. Remove the port number and https:// prefix; for example: `2202aa790db546268248a5bd1e35aea6.us-west1.gcp.cloud.es.io`.
-
-   - **elastic_username**: Enter _elastic_.
-
-   - **elastic_password**: Use the randomly generated password that was created for you.
-     ![Elastic Lambda environment variables](../../static/images/elastic/screenshots/environment-variables-lambda-cloudflare.png)
-
-5. To connect your Cloudflare S3 log bucket. the last step is to tell the Lambda function to listen for events on the S3 bucket where your Cloudflare logs reside. Choose the S3 trigger type and configure it with the name of the S3 bucket. For **Event type**, select _All object create events_.
-
-6. Ensure your execution role is configured. In order for the function to be able to read logs from the S3 bucket, you may have to configure the execution role.
-   ![Elastic Lambda execution role](../../static/images/elastic/screenshots/execution-role-aws.png)
-
-7. View the execution role and add an inline policy that enables the function to read from the bucket.
-   ![Elastic AWS S3 bucket actions](../../static/images/elastic/screenshots/s3-bucket-actions.png)
-
-8. Give the policy a name and save it.
-
-9. Save the Lambda and start logging.
-
-10. Finally, save the Lambda configuration. Once it is saved, the Cloudflare logs will start showing up in Kibana on your Elastic Cloud deployment.
-
-## Task 5 - View the Dashboards in Kibana
-
-Once Successfully imported, you can find all Cloudflare dashboards under **Kibana** > **Dashboard**.
-
-### About the dashboards
-
-There are nine dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more. Filtering can further help you with debugging and tracing.
-
-#### Snapshot
-
-This is a quick overview of the most important metrics from your Cloudflare Logs, including the total number of requests, top visitors by geography, IP, user agent, traffic type, the total number of threats, and bandwidth usage.
-![Cloudflare dashboard - snapshot](../../static/images/elastic/dashboards/elastic-snapshot.png)
-
-#### Security
-
-_Cloudflare - Security (Overview)_ - Get insights on threats to your websites and applications, including the number of threats stopped, threats over time, top threat countries, and more.
-![Cloudflare dashboard - security overview](../../static/images/elastic/dashboards/elastic-security.png)
-
-_Cloudflare - Security (WAF)_ - Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
-![Cloudflare dashboard - security WAF](../../static/images/elastic/dashboards/elastic-security-waf.png)
-
-_Cloudflare - Security (Rate Limiting)_ - Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
-![Cloudflare dashboard - security rate limiting](../../static/images/elastic/dashboards/elastic-security-rate-limiting.png)
-
-_Cloudflare - Security (Bot Management)_ - Reliably detects and mitigates bad bots to prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities.
-![Cloudflare dashboard - bot management](../../static/images/elastic/dashboards/elastic-bot-management.png)
-
-#### Performance
-
-_Cloudflare - Performance (Requests, Bandwidth, Cache)_ - Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
-![Cloudflare dashboard - performance (requests, bandwidth, cache)](../../static/images/elastic/dashboards/elastic-performance.png)
-
-_Cloudflare - Performance (Hostname, Content Type, Request Methods, Connection Type)_ - Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
-![Cloudflare dashboard - performance (hostname, content type, request methods, connection type)](../../static/images/elastic/dashboards/elastic-origin-requests-by-hostname-type.png)
-
-_Cloudflare - Performance (Static vs. Dynamic Content)_ - Get insights into the performance of your static and dynamic content, including slowest URLs.
-![Cloudflare dashboard - performance (static vs. dynamic content)](../../static/images/elastic/dashboards/elastic-performance-static-vs-dynamic-content.png)
-
-#### Reliability
-
-Get insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-![Cloudflare dashboard - reliability](../../static/images/elastic/dashboards/elastic-reliability.png)
-
-### Filters
-
-All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. Filters are applied across the entire dashboard.
-
-![Cloudflare dashboard filters](../../static/images/elastic/screenshots/cloudflare-dashboards-filters-elastic-kibana.png)
-
-<Aside type="note" header="Note">
-
-You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
-</Aside>
-
-The default time interval is set to 24 hours. Note that for correct calculations filter will need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
-
-#### Available Filters
-
-- Date (EdgeStartTimestamp)
-
-- Device Type
-
-- Country
-
-- Hostname
-
-- Client IP
-
-- User Agent
-
-- Request URI
-
-- Edge Response Status
-
-- Origin Response Status
-
-- Origin IP
-
-- RayID
-
-- Worker Subrequest
-
-- Client Request Method
-
-## Debugging tips
-
-### Debug the AWS Lambda function
-
-#### Review the Lambda function logs in AWS
-
-If you detect issues with your AWS Lambda function in Elastic, you can review the AWS CloudWatch logs that are generated automatically for tht specific Lambda function.
-
-To begin, in AWS:
-
-1. Go to **Lambda** > **Functions** > _\<your Lambda function\>_.
-2. Click the **Monitoring** tab.
-3. Click **View logs in CloudWatch**.
-
-![AWS Lambda function monitoring](../../static/images/elastic/screenshots/aws-lambda-monitoring.png)
-
-A list of log streams generated by the Lambda function (see image below) appears. Each stream contains log messages. However, some log streams will either be empty or not contain any useful information. You might need to review several of them.
-
-![AWS Lambda log streams](../../static/images/elastic/screenshots/aws-lambda-log-streams.png)
-
-When you click to review a stream, you want to look for messages starting with the the text _Connected to cluster:_ and ending with _status: [GREEN]_ as shown in the image below.
-
-![AWS Lambda log stream messages](../../static/images/elastic/screenshots/aws-lambda-log-streams-messages.png)
-
-If you see _status: [RED]_, then your cluster isn’t healthy and it’s likely that your Cloudflare logs won’t appear. If this is the case, review how to debug in Kibana (see below).
-
-It is important to verify the return status of the call to Elasticsearch. Lines starting with _Flushing [N] logs to elasticsearch_ and followed by a response line indicate that everything is working as expected.
-
-<Aside type="note" header="Note">
-
-You might see a _WARNING_ message containing text that says _‘y’ year should be replaced…_. You can ignore this message.
-</Aside>
-
-If you run into any other issues, take note of the exact return message and contact your Cloudflare support team.
-
-#### Review the AWS Lambda function health status from the Kibana console in Elastic Cloud
-
-To analyze the health status of the Lambda function from Kibana:
-
-1. From Elastic Cloud, launch the Kibana console.
-   ![Elastic Cloud console](../../static/images/elastic/screenshots/elastic-cloud-console.png)
-2. Find the **Dev Tools** app on the left navigation bar.
-3. Under the **Console** tab, type the following into the left pane: _GET \_cat/indices?v&s=index_.
-4. In the right pane, you should see a table of indices with the column headings: **health status index**, **uuid**, **pri**, **rep**, **docs.count**, **docs.deleted**, **store.size**, and **pri.store.size**.
-
-![Elastic Kibana Dev Tools console 1](../../static/images/elastic/screenshots/elastic-kibana-dev-tools-console-1.png)
-
-The first column should read _green_. If it does not, or if there are no _cloudflare-&lt;DATE>_ indices, then there is a problem loading the logs from the AWS Lambda function.
-
-![Elastic Kibana Dev Tools console 2](../../static/images/elastic/screenshots/elastic-kibana-dev-tools-console-2.png)
diff --git a/products/logs/src/content/analytics-integrations/google-cloud/index.md b/products/logs/src/content/analytics-integrations/google-cloud/index.md
deleted file mode 100644
index 12912ff2ff9..00000000000
--- a/products/logs/src/content/analytics-integrations/google-cloud/index.md
+++ /dev/null
@@ -1,296 +0,0 @@
----
-title: Google Cloud
-order: 100
----
-
-# Google Cloud
-
-## Overview
-
-This tutorial covers how to configure certain Google Cloud Platform (GCP) components so that you can analyze your Cloudflare Logs data.
-
-Before proceeding, you need to enable [Cloudflare Logpush in Google Cloud Storage](/logpush/google-cloud-storage/) to ensure your log data is available for analyzing.
-
-The components we'll use in this tutorial include:
-
-- **Google Cloud Function** to import logs from Google Cloud Storage to Google BigQuery
-- **Google BigQuery** to make log data available to the reporting engine, and
-- **Google Data Studio** to run interactive reports
-
-The following diagram depicts how data flows from Cloudflare Logs through the different components of the Google Cloud Platform discussed in this tutorial.
-
-![Cloudflare Logs data to Google Cloud Platform](../../static/images/cf-logpush-to-google-cloud-platform.png)
-
-<Aside type="info" header="Info">
-
-Google Cloud is offering a credit towards a new Google Cloud account to help you get started. To learn more, visit [Google Cloud Platform Partner Credit](https://cloud.google.com/partners/partnercredit/?PCN=a0n60000003kp9MAAQ).
-</Aside>
-
-## Task 1 - Use Google Cloud Function to import log data into Google BigQuery
-
-After you configured Cloudflare Logpush to send your logs to a Google Cloud Storage bucket, your log data updates every five minutes by default.
-
-Google BigQuery makes data available for both querying using Structured Query Language (SQL) and for configuring as a data source for the Google Data Studio reporting engine. BigQuery is a highly scalable cloud database where SQL queries run quite fast.
-
-Importing data from Google Cloud Storage into Google BigQuery requires creating a function using Google Cloud Function and running it in the Google Cloud Shell. This function triggers every time new Cloudflare log data is uploaded to your Google Cloud Storage bucket.
-
-### Clone and deploy a Google Cloud Function
-
-To a create a cloud function to import data from Google Cloud Storage into Google BigQuery, you will need the following GitHub repository from Cloudflare: https://github.com/cloudflare/GCS-To-Big-Query.
-
-To clone and deploy the cloud function:
-
-1. Run the Google Cloud Platform shell by opening the **Google Cloud Platform** console and clicking the **Google Shell** icon (_Activate Cloud Shell_).
-
-2. Run the following command to download the _master_ zipped archive, uncompress the files to new a directory, and change the command line prompt to the new directory: `curl -LO "https://github.com/cloudflare/cloudflare-gcp/archive/master.zip" && unzip master.zip && cd cloudflare-gcp-master/logpush-to-bigquery`
-
-3. Next, edit the `deploy.sh` file and make sure that:
-
-- **BUCKET_NAME** is set to the bucket you created when you configured Cloudflare Logpush with Google Cloud Platform.
-
-- **DATASET** and **TABLE** are unique names.
-
-  The contents of `deploy.sh` should look similar to this:
-
-  ```bash
-  .
-  .
-  .
-  BUCKET_NAME="my_cloudflarelogs_gcp_storage_bucket"
-  DATASET="my_cloudflare_logs"
-  TABLE="cloudflare_logs"
-  .
-  .
-  .
-  ```
-
-4. Then in the **Google Shell**, run the following command to deploy your instance of the cloud function:
-
-    ```bash
-    sh ./deploy.sh
-    ```
-
-Once you've deployed your new cloud function, verify that it appears in the **Cloud Functions** interface by navigating to **Google Cloud Platform** > **Compute** > **Cloud Functions**.
-
-Also, verify that the data now appears in your table in **BigQuery** by navigating to the appropriate project in **Google Cloud Platform** > **Big Data** > **BigQuery**.
-
-If everything is configured correctly, you can now query any request or visualize data with Google Data Studio or any other analytics tool that supports BigQuery as an input source.
-
-## Task 2 - Analyze log data with Google Data Studio
-
-To analyze and visualize logs, you can use **Google Data Studio** or any other 3rd party services that supports Google BigQuery as an input source.
-
-With Google Data Studio, you can generate graphs and charts from a Google BigQuery table. You can also refresh the data in your reports and get real-time analytics.
-
-### About the Cloudflare Logs Insights Template
-
-Cloudflare has published a [Logs Insights Template](https://datastudio.google.com/u/0/reporting/1ez3m7Yf8AZLfM6aYRjfgF0pPpRvOwhTh/page/mAzI/preview) in the **Google Data Studio Report Gallery**.
-
-![Cloudflare Logs Insights Template on Google Data Studio Gallery](../../static/images/cf-logs-insights-template.png)
-
-The Cloudflare Insights Template features several dashboards, or report pages, to help you analyze your Cloudflare Logs data. You can also use filters within the dashboards to narrow down the analysis by date and time, device type, country, user agent, client IP, hostname, and more. These insights further help with debugging and tracing.
-
-The following dashboards are included in the Insights template:
-
-- **Snapshot**: Gives you an overview of the most important metrics from your Cloudflare logs, including total number of requests, top visitors by geography, IP, user agent, traffic type, total number of threats, and bandwidth usage.
-
-- **Security**: Provides insights on threat identification and mitigations by our **Web Application Firewall**, including **Firewall Rules**, **Rate Limiting**, and **IP Firewall**. Metrics include total threats stopped, threat traffic source, blocked IPs and user agents, top threat requests, Firewall events (SQL injections, XSS, etc.), and rate limiting. Use this data to fine tune the firewall to target obvious threats and avoid false positives.
-
-- **Performance**: Helps you identify and address issues like slow pages and caching misconfigurations. Metrics include total vs. cached bandwidth, cache ratio, top uncached requests, static vs. dynamic content, slowest URIs, and more.
-
-- **Reliability**: Provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-
-### Create a report based on the Insights Template
-
-To create a report for your log data based on the Cloudflare template:
-
-1. In Data Studio, open the Cloudflare [template](https://datastudio.google.com/u/0/reporting/1ez3m7Yf8AZLfM6aYRjfgF0pPpRvOwhTh/page/mAzI/preview) and click **Use Template**. A _Create new report_ dialog opens.
-
-2. Under the **New Data Source** dropdown, select **Create New Data Source**. A page opens where you can enter additional configuration details.
-
-3. Under **Google Connectors**, locate the **BigQuery** card and click **Select**.
-
-4. Next under **MY PROJECTS**, select your **Project**, **Dataset**, and **Table**.
-
-5. Click **Connect** in the upper right.
-
-6. In the list of Cloudflare Logs fields, locate _EdgeStartTimestamp_, click the three vertical dots and select **Duplicate**. This creates _Copy of EdgeStartTimestamp_ right below _EdgeStartTimestamp_.
-
-7. Update the **Type** for _Copy of EdgeStartTimestamp_ to set it to _Date & Time_ > _Date Hour (YYYYMMDDHH)_.
-
-8. Next, update the **Type** for each of the following fields as indicated below:
-
-<table style="border: solid 2px darkgrey; width: 100%;">
-    <thead style="background: #ffeadf;">
-        <tr>
-            <th>Cloudflare Log Field</th>
-            <th>Type</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td>ZoneID</td>
-            <td>Text</td>
-        </tr>
-        <tr>
-            <td>EdgeColoID</td>
-            <td>Text</td>
-        </tr>
-        <tr>
-            <td>ClientSrcPort</td>
-            <td>Text</td>
-        </tr>
-        <tr>
-            <td>EdgeResponseStatus</td>
-            <td>Number</td>
-        </tr>
-        <tr>
-            <td>EdgeRateLimitID</td>
-            <td>Text&nbsp;</td>
-        </tr>
-        <tr>
-            <td>
-                <div>
-                    <div>Copy of EdgeStartTimestamp</div>
-                </div>
-            </td>
-            <td>Date &amp; Time &gt; Date Hour (YYYYMMDDHH)</td>
-        </tr>
-        <tr>
-            <td>OriginResponseStatus</td>
-            <td>Number</td>
-        </tr>
-        <tr>
-            <td>ClientASN</td>
-            <td>Text</td>
-        </tr>
-        <tr>
-            <td>ClientCountry</td>
-            <td>Geo &gt; Country</td>
-        </tr>
-        <tr>
-            <td>CacheResponseStatus</td>
-            <td>Text</td>
-        </tr>
-    </tbody>
-</table>
-
-9. Next, add a new field to identify and calculate threat. In the top right corner, click **+ ADD A FIELD**, then in the add field UI:
-   _ For **Field Name**, type *Threats*.
-   _ In the **Formula** text box, paste the following code:
-
-   ```bash
-   CASE
-   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ip" THEN "ip block"
-   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ctry" THEN "country block"
-   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "zl" THEN "routed by zone lockdown"
-    WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "ua" THEN "blocked user agent"
-   WHEN EdgePathingSrc = "user" AND EdgePathingOp = "ban" AND EdgePathingStatus = "rateLimit" THEN "rate-limiting rule"
-    WHEN EdgePathingSrc = "bic" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "browser integrity check"
-   WHEN EdgePathingSrc = "hot" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "blocked hotlink"
-   WHEN EdgePathingSrc = "macro" AND EdgePathingOp = "chl" AND EdgePathingStatus = "captchaFail" THEN "CAPTCHA challenge failed"
-   WHEN EdgePathingSrc = "macro" AND EdgePathingOp = "chl" AND EdgePathingStatus = "jschlFail" THEN "java script challenge failed"
-   WHEN EdgePathingSrc = "filterBasedFirewall" AND EdgePathingOp = "ban" AND EdgePathingStatus = "unknown" THEN "blocked by filter based firewall"
-   WHEN EdgePathingSrc = "filterBasedFirewall" AND EdgePathingOp = "chl" THEN "challenged by filter based firewall"
-   Else "Other"
-   END
-   ```
-   \* Click **Save** in the lower right corner.
-
-10. Finally, add another new field for grouping status error codes. In the top right corner, click **+ ADD A FIELD**, then in the add field UI:
-    _ For **Field Name**, type *EdgeResponseStatus_Class*.
-    _ In the **Formula** text box, paste the following code:
-
-    ```bash
-    CASE
-    WHEN EdgeResponseStatus > 199 AND EdgeResponseStatus < 300 THEN "2xx"
-    WHEN EdgeResponseStatus > 299 AND EdgeResponseStatus < 400 THEN "3xx"
-    WHEN EdgeResponseStatus > 399 AND EdgeResponseStatus < 500 THEN "4xx"
-    WHEN EdgeResponseStatus > 499 AND EdgeResponseStatus < 600 THEN "5xx"
-    WHEN EdgeResponseStatus = 0 THEN "0 - Served from CF Edge"
-    Else "Other"
-    END
-    ```
-
-- Click **Save** in the lower right corner.
-
-11. To finish, click **Add to Report** in the upper right.
-
-### Refreshing fields and filters manually
-
-After you've added your report, you will notice that not all report components render successfully. To fix this, you need to resolve any errors related to invalid dimensions, metrics, or filters that appear in the affected report components.
-
-#### Fix invalid metric or dimension errors
-
-The following table summarizes which specific components require to be fixed:
-
-<table style="border: solid 2px darkgrey; width: 100%;">
-<thead style="background: #ffeadf;">
-<tr>
-<th>Report page</th>
-<th>Components</th>
-<th>Field to add</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td rowspan="3">2 Security Cloudflare&nbsp;</td>
-<td>
-<p><em>Threats </em>(scorecard)</p>
-</td>
-<td>&nbsp;Threats (Metric)</td>
-</tr>
-<tr>
-<td>
-<p><em>Threats - Record Count (table)</em></p>
-</td>
-<td>&nbsp;Threats (Dimension)</td>
-</tr>
-<tr>
-<td>&nbsp;<em>Threats Over Time&nbsp;</em>(area chart)</td>
-<td>&nbsp;Threats (Breadown Dimension)</td>
-</tr>
-<tr>
-<td>3 Reliability Cloudflare</td>
-<td><em>Status Codes Last 24 hours&nbsp;</em>(bar chart)</td>
-<td><em>Copy of EdgeStartTimeStamp&nbsp;</em>(Dimension)</td>
-</tr>
-<tr>
-<td>5&nbsp;Last 100s Requests Cloudflare</td>
-<td><em>Last 100 Requests</em> (table)</td>
-<td>&nbsp;<em>Copy of EdgeStartTimeStamp</em></td>
-</tr>
-</tbody>
-</table>
-
-For each of the report components listed above:
-
-1. Select the report component affected.
-
-2. On the menu to the right, under the **Data** tab, locate and click **Invalid Dimension** or **Invalid Metric** (as applicable). The **Field Picker** panel opens.
-
-3. Search or type for the field to add, then click to select it.
-
-4. To finish, click away from the panel to return to the main report.
-
-The component should now render correctly.
-
-#### Update data filters
-
-This fix applies to report page: **3 Reliability Cloudflare**, for the following scorecard components in the report:
-
-- **5xx Errors**
-- **4xx Errors**
-- **3xx Errors**
-
-To update the filter associated with each scorecard:
-
-1. Select the report component affected.
-
-2. On the menu to the right, under the **Data** tab, locate the **Filters** > **Scorecard Filter** section and click the **pencil** next to the filter name to edit it. The **Edit Filter** panel opens.
-
-3. In the filtering criteria section, click the dropdown and scroll or search for the field _EdgeResponseStatusClass_ and select it.
-
-4. To finish, click **Save** in the lower right corner.
-
-The component should now render correctly.
diff --git a/products/logs/src/content/analytics-integrations/graylog/index.md b/products/logs/src/content/analytics-integrations/graylog/index.md
deleted file mode 100644
index 335d65530db..00000000000
--- a/products/logs/src/content/analytics-integrations/graylog/index.md
+++ /dev/null
@@ -1,199 +0,0 @@
----
-title: Graylog
-order: 101
----
-
-# Graylog
-
-This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using [Graylog](https://github.com/Graylog2/graylog-s3-lambda/blob/master/content-packs/cloudflare/cloudflare-logpush-content-pack.json).
-
-## Overview
-
-If you haven't used Cloudflare Logs before, visit our [Logs documentation](/) for
-more details. Contact your Cloudflare Customer Account Team to enable logs for
-your account.
-
-### Prerequisites
-
-Before sending your Cloudflare log data to Graylog, make sure that you:
-
-- Have an existing Graylog installation. Both single-node and cluster configurations are supported
-- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
-- Configure [Logpush](https://developers.cloudflare.com/logs/logpush/)
-
-<Aside type="note" header="Note">
-
-Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. All timestamp formats are supported by Graylog.
-</Aside>
-
-## Task 1 - Preparation
-
-Before getting Cloudflare logs into Graylog:
-
-1. Configure Cloudflare [Logpush](https://developers.cloudflare.com/logs/logpush/) to push logs with all desired fields to an AWS S3 bucket of your choice.
-2. Download the latest Graylog Integration for Cloudflare from the Graylog website: [https://go.graylog.com/cloudflare](https://github.com/Graylog2/graylog-s3-lambda/blob/master/content-packs/cloudflare/cloudflare-logpush-content-pack.json).
-3. Decompress the zip file.
-
-Once decompressed, the integration package includes:
-
-- _graylog-s3-lambda.jar_
-- _content-packs/cloudflare/cloudflare-logpush-content-pack.json_
-- _content-packs/cloudflare/threat-lookup.csv_
-
-## Task 2 - Create and configure the AWS Lambda Function
-
-1.  Navigate to the Lambda service page in the AWS web console.
-2.  Create a new Lambda function and specify a _function name_ of your choice and the _Java-8 runtime_.
-3.  Create or specify an execution role with the following permissions. You can also further restrict the resource permissions as desired for your specific set-up.
-
-```bash
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "Policy",
-      "Effect": "Allow",
-      "Action": [
-        "logs:CreateLogGroup"
-        "s3:GetObject",
-        "logs:CreateLogStream",
-        "logs:PutLogEvents"
-      ],
-      "Resource": [
-        "arn:aws:logs:your-region:your-account-number:*"
-        "arn:aws:s3:your-region::cloudflare-bucket-name/*"
-      ]
-    }
-  ]
-}
-```
-
-    **Note:** If your Graylog cluster is running in a VPC, you may need to add the _AWSLambdaVPCAccessExecutionRole_ managed role to allow the Lambda function to route traffic to the VPC.
-
-4.  Once you've created the Lambda function, upload the function code **_graylog-s3-lambda.jar_** downloaded in [Task 1](#task1).  Specify the following method for the Handler: _org.graylog.integrations.s3.GraylogS3Function::handleRequest_.
-
-5.  Specify at least the following required environment variables to configure the Lambda function for your Graylog cluster:
-
-    - **CONTENT_TYPE** (required) - _application/x.cloudflare.log_ value to indicate that the Lambda function will process Cloudflare logs.
-    - **COMPRESSION_TYPE** **_(required_** **)** - _gzip_ since Cloudflare logs are gzip compressed.
-    - **GRAYLOG_HOST** _(required)_ - hostname or IP address of the Graylog host or cluster load balancer.
-    - **GRAYLOG_PORT** _(optional - defaults to 12201)_ - The Graylog service port.
-    - **CONNECT_TIMEOUT** _(optional - defaults to 10000)_ - The number of milliseconds to wait for the connection to be established.
-    - **LOG_LEVEL** _(optional - defaults to INFO)_ - The level of detail to include in the CloudWatch logs generated from the Lambda function. Supported values are _OFF_, _ERROR_, _WARN_, _INFO_, _DEBUG_, _TRACE_, and _ALL_. Increase the logging level to help with troubleshooting. See [Defining Custom Log Levels in Code](https://logging.apache.org/log4j/2.0/manual/customloglevels.html) for more information.
-    - **CLOUDFLARE_LOGPUSH_MESSAGE_FIELDS** _(optional - defaults to all)_ - The fields to parse from the message. Specify as a comma-separated list of field names.
-    - **CLOUDFLARE_LOGPUSH_MESSAGE_SUMMARY_FIELDS** _(optional - defaults to ClientRequestHost, ClientRequestPath, OriginIP, ClientSrcPort, EdgeServerIP, EdgeResponseBytes)_ - The fields to include in the message summary that appears above the parsed fields at the top of each message in Graylog. Specify as a comma-separated list of field names.
-      ![Graylog environment variables](../../static/images/graylog/screenshots/graylog-environment-variables.png)
-
-      **Note:** More configuration variables are available to fine-tune the function configuration in the Graylog Lambda S3 [README](https://github.com/Graylog2/graylog-s3-lambda/blob/master/README.md#step-2-specify-configuration) file.
-
-6.  Create an AWS S3 Trigger for the Lambda function so that the function can process each Cloudflare log field that is written. Specify the same S3 bucket from [Task 1](#task1) and choose the _All object create events_ option. Any other desired file filters can be applied here.
-    ![AWS S3 add trigger](../../static/images/graylog/screenshots/aws-s3-add-trigger.png)
-
-7.  If your Graylog cluster is located within a VPC, you will need to [configure your Lambda function to access resources in a VPC](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html). You may also need to create a [VPC endpoint for the AWS S3 service](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html#create-vpc-endpoint). This allows the Lambda function to access S3 directly when running in a VPC.
-
-<Aside type="note" header="Note">
-
-By default, all log messages are sent over TCPt. TLS encryption between the
-Lambda function and Graylog is not currently supported. We recommend taking
-appropriate measures to secure the log messages in transit, such as placing
-the Lambda function within a secure VPC subnet where the Graylog node or
-cluster is running.
-</Aside>
-
-## Task 3 - Import the content pack in Graylog
-
-Importing the Cloudflare Logpush content pack into Graylog loads the
-necessary configuration to receive Cloudflare logs and installs the
-Cloudflare dashboards.
-
-The following components install with the content pack:
-
-- Cloudflare dashboards ([Task 4](#task4)).
-- A Cloudflare GELF (TCP) input that allows Graylog to receive Cloudflare logs.
-- A Cloudflare message [stream](https://docs.graylog.org/en/3.1/pages/streams.html).
-- [Pipeline](https://docs.graylog.org/en/3.1/pages/pipelines/pipelines.html) rules that help to process and parse Cloudflare log fields.
-
-To import the content pack:
-
-1.  Locate the _cloudflare-logpush-content-pack.json_ file that you downloaded and extracted in [Task 1](#task1).
-2.  In Graylog, go to **System** > **Content Packs** and click **Upload**in the top right. Once uploaded, the Cloudflare Logpush content pack will appear in the list of uploaded content packs.
-    ![Graylog content packs](../../static/images/graylog/screenshots/graylog-content-packs.png)
-3.  Click **Install**.
-    ![Graylog content packs uploaded](../../static/images/graylog/screenshots/graylog-content-packs-uploaded.png)
-4.  In the **Install** dialog, enter an optional install comment, and verify that the correct values are entered for all configuration parameters.
-
-    - A path is required for the MaxMind™️ database, available at [https://dev.maxmind.com/geoip/](https://dev.maxmind.com/geoip/).
-    - A path is also required for the _Threat Lookup_ CSV file, extracted in [Task 1](#task1).
-
-    ![Graylog content pack install](../../static/images/graylog/screenshots/graylog-content-pack-install.png)
-
-5.  Once installed, your Graylog cluster will be ready to receive Cloudflare logs from the Lambda function.
-
-Refer to the Graylog Lambda S3 [README](https://github.com/Graylog2/graylog-s3-lambda/blob/master/README.md) for additional information and troubleshooting tips.
-
-## Task 4 - View the Cloudflare Dashboards
-
-You can view your dashboard in the [Graylog Cloudflare integration page](https://go.graylog.com/cloudflare). The dashboards include:
-
-### Cloudflare - Snapshot
-
-This is an at-a-glance overview of the most important metrics from your websites and applications on the Cloudflare network. You can use dashboard filters to further slice and dice the information for granular analysis of events and trends.
-
-Use this dashboard to:
-
-- Monitor the most important web traffic metrics of your websites and applications on the Cloudflare network
-- View which countries and IPs your traffic is coming from, and analyze the breakdown between mobile and desktop traffic, protocol, methods, and content types
-
-![Graylog dashboard Cloudflare Snapshot](../../static/images/graylog/dashboards/snapshot-cloudflare-dashboard-graylog.png)
-
-### Cloudflare - Security
-
-This overview provides insights into threats to your websites and applications, including number of threats stopped,threats over time, top threat countries, and more.
-
-Use this dashboard to:
-
-- Monitor the most important security and threat metrics for your websites and applications
-- Fine-tune and configure your IP firewall
-
-![Graylog dashboard Cloudflare Security](../../static/images/graylog/dashboards/security-cloudflare-dashboard-graylog.png)
-
-### Cloudflare - Performance
-
-This dashboard helps to identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
-
-Use this dashboard to:
-
-- Monitor caching behavior and identify misconfigurations
-- Improve configuration and caching ratio
-
-![Graylog dashboard Cloudflare Performance](../../static/images/graylog/dashboards/performance-cloudflare-dashboard-graylog.png)
-
-### Cloudflare - Reliability
-
-This dashboard provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-
-Use this dashboard to:
-
-- Investigate errors on your websites and applications by viewing edge and origin response status codes
-- Further analyze errors based on status codes by countries, client IPs, hostnames, and other metrics
-
-![Graylog dashboard Cloudflare Reliability](../../static/images/graylog/dashboards/reliability-cloudflare-dashboard-graylog.png)
-
-### Cloudflare - Bots
-
-Use this dashboard to detect and mitigate bad bots so that you can prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities.
-
-<Aside type="note" header="Note">
-
-To get bot requests identified correctly, use only one Cloudflare
-Firewall Rule, configured with the action _Challenge (Captcha)_. To lear more, consult the [Cloudflare Firewall Rules documentation](https://developers.cloudflare.com/firewall/cf-firewall-rules/).
-</Aside>
-
-Use this dashboard to:
-
-- Investigate bot activity on your website and prevent content scraping,
-  checkout fraud, spam registration, and other malicious activities
-- Use insight to tune Cloudflare to prevent bots from excessive usage and
-  abuse across websites, applications, and API endpoints
-
-![Graylog dashboard Cloudflare Bot Management](../../static/images/graylog/dashboards/bot-management-cloudflare-dashboard-graylog.png)
diff --git a/products/logs/src/content/analytics-integrations/index.md b/products/logs/src/content/analytics-integrations/index.md
deleted file mode 100644
index 89430245a64..00000000000
--- a/products/logs/src/content/analytics-integrations/index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Analytics Integrations
-order: 100
----
-
-# Analytics Integrations
-
-You can analyze Cloudflare Logs data with the following analytics platforms:
-
-- [Datadog](/analytics-integrations/datadog/)
-- [Elastic](/analytics-integrations/elastic/)
-- [Graylog](/analytics-integrations/graylog/)
-- [Google Cloud](/analytics-integrations/google-cloud/)
-- [Looker](/analytics-integrations/looker/)
-- [Splunk](/analytics-integrations/splunk/)
-- [Sumo Logic](/analytics-integrations/sumo-logic/)
diff --git a/products/logs/src/content/analytics-integrations/looker/index.md b/products/logs/src/content/analytics-integrations/looker/index.md
deleted file mode 100644
index 3c780747dc8..00000000000
--- a/products/logs/src/content/analytics-integrations/looker/index.md
+++ /dev/null
@@ -1,150 +0,0 @@
----
-title: Looker
-order: 101
----
-
-# Looker
-
-This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare Log Analytics for Looker](https://looker.com/platform/blocks/source/cloudflare-log-analytics).
-
-## Overview
-
-If you haven’t used Cloudflare Logs before, visit our [Logs documentation](/) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
-
-This tutorial uses Cloudflare Logpush to send logs to [Google Cloud Storage Bucket and Cloud Function](/analytics-integrations/google-cloud/) and then import them into Google Big Query.
-
-### Prerequisites
-
-Before sending your Cloudflare log data to Looker, make sure that you:
-
-- Have an existing Looker account
-- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
-- Configure [Logpush](/logpush/) or [Logpull](/logpull-api/)
-- Load your data in a [database supported by Looker](https://looker.com/solutions/other-databases)
-
-<Aside type="note" header="Note">
-
-Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Looker.
-</Aside>
-
-## Task 1 - Connect your Database to Looker
-
-Looker connects to a database in order to query the data. In this tutorial, we use Google Big Query as an example. Learn [how to connect Google BigQuery to Looker](https://docs.looker.com/setup-and-management/database-config/google-bigquery#create_a_temporary_dataset_for_persistent_derived_tables).
-
-Once you load Cloudflare logs into your database, [connect the database to Looker](https://docs.looker.com/setup-and-management/connecting-to-db).
-
-## Task 2 - Create a new LookML project from the public Git repository
-
-To create your new LookML project:
-
-1. Log in to your Looker account.
-
-2. In the menu bar, click **Develop** and make sure **Development Mode** is set to _ON_.
-
-3. Next, also under **Develop**, click **Manage LookML Projects**.
-
-4. At the top right of the LookML Projects page, click **New LookML Project**.
-
-5. In the **New Project** dialog, enter a project name.
-
-6. For **Starting Point**, choose _Clone Public Git Repository**.**_
-
-7. Enter the _cloudflare_block_ URL for the public Git repository `git://github.com/llooker/cloudflare_block.git`.
-
-8. Click **Create Project**. Looker will pull all of the repository files into a new LookML project.
-
-9. Next, open the project.
-
-10. Click **Deploy from Remote** to pull all remote changes into your local version of the repository.
-    ![Looker manage LookML projects](../../static/images/looker/screenshots/develop-look-ml-project.png)
-
-## Task 3 - Update the connection name
-
-To update the connection name in the LookML files:
-
-1. In your LookML **cloudflare_looker** model file, replace the **connection** name with yours, for example:
-   `connection: "bigquery_lpr"`.
-
-2. Check if any table names need to be updated to your database connection names as well. If you decide to rename the filenames for explore, model name, and view, make sure to update all mentions within the other files. Otherwise, you might encounter errors.
-
-## Task 4 - View the Dashboards
-
-In the main menu, click **Browse** and select **LookML Dashboards**. You should see all the Cloudflare dashboards that were pulled from GitHub.
-
-### About the Dashboards
-
-There are five dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more.
-
-#### Snapshot
-
-This is a quick overview of the most important metrics from your Cloudflare logs, including total number of requests, top visitors by country, client IP, user agent, traffic type, total number of threats, and bandwidth usage.
-
-![Looker Cloudflare Snapshot dashboard](../../static/images/looker/dashboards/snapshot-cloudflare-dashboard-looker.png)
-
-#### Security
-
-This dashboard provides insights on threat identification and mitigation through our Web Application Firewall (WAF), Rate Limiting rules, and IP Firewall. Metrics include total threats stopped, threat traffic source, blocked IPs, and user agents, top threat requests, WAF events (SQL injections, XSS, etc.), and rate limiting. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
-
-![Looker Cloudflare Security dashboard](../../static/images/looker/dashboards/security-cloudflare-dashboard-looker.png)
-
-#### Performance
-
-This dashboard helps you identify and address issues like slow pages and caching misconfigurations. Metrics include total vs. cached bandwidth, cache ratio, top uncached requests, static vs. dynamic content, slowest URIs, and more.
-
-![Looker Cloudflare Performance dashboard](../../static/images/looker/dashboards/performance-cloudflare-dashboard-looker.png)
-
-#### Reliability
-
-This dashboard provides insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-
-![Looker Cloudflare Reliability dashboard](../../static/images/looker/dashboards/reliability-cloudflare-dashboard-looker.png)
-
-#### Bot Management
-
-This dashboard allows to reliably detect and mitigate bad bots to prevent credential stuffing, spam registration, content scraping, click fraud, inventory hoarding, and other malicious activities. Use these insights to tune Cloudflare and prevent bots from excessive usage and abuse across websites, applications, and API endpoints.
-
-![Looker Cloudflare Reliability dashboard](../../static/images/looker/dashboards/bot-management-cloudflare-dashboard-looker.png)
-
-### Filters
-
-All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. The filters apply across the entire dashboard.
-
-![Looker Cloudflare dashboard filters](../../static/images/looker/screenshots/cloudflare-looker-dashboard-filters.png)
-
-The default time interval is set to 24 hours. Note that for correct calculations, by default, filters exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
-
-Available Filters:
-
-- Date (EdgeStartTimestamp)
-
-- Device type
-
-- Country
-
-- Client IP
-
-- Hostname
-
-- Request URI
-
-- Origin Response Status
-
-- Edge response status
-
-- Origin IP
-
-- User Agent
-
-- RayID
-
-- Worker Subrequest
-
-- Client Request Method
-
-With the following pre-set filter values in the Looker dashboards all workers subrequests and client request method PURGE are excluded from the calculations:
-
-- **WorkerSubrequet** set to value _False_
-
-- **ClientRequestMethod** doesn’t equal to _PURGE_
-
-You can always adjust your default filters values according to your needs.
diff --git a/products/logs/src/content/analytics-integrations/splunk/index.md b/products/logs/src/content/analytics-integrations/splunk/index.md
deleted file mode 100644
index d581765b200..00000000000
--- a/products/logs/src/content/analytics-integrations/splunk/index.md
+++ /dev/null
@@ -1,294 +0,0 @@
----
-title: Splunk
-order: 103
----
-
-# Splunk
-
-This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/).
-
-
-### Prerequisites
-
-Before sending your Cloudflare log data to Splunk, ensure that you:
-
-- Have an existing Splunk Enterprise or Cloud account
-- Have a Cloudflare Enterprise account
-- Consult the [Splunk documentation](https://splunkbase.splunk.com/app/4501/) for the Cloudflare App
-
-## Task 1 - Install and Configure the Cloudflare App for Splunk
-
-To install the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/):
-
-1. Log in to your Splunk instance.
-2. Under **Apps** > **Find More Apps**, search for _Cloudflare App for Splunk._
-3. Click **Install**.
-
-![Splunk find Cloudflare app](../../static/images/splunk/screenshots/splunk-cloudflare-app-for-splunk.png)
-
-4. Restart and reopen your Splunk instance.   
-5. Edit the `cloudflare:json` source type in the Cloudflare App for Splunk. To edit the source type:
-   1. Click the **Settings** dropdown and select **Source types**. 
-   2. Uncheck **Show only popular** and search for *cloudflare*. 
-   3. Click **Edit** and change the Regex expression to `([\r\n]+)`. 
-   4. Save your edits.
-
-6. Create an index on Splunk to store the HTTP Event logs. To create an index:
-   1. Open the setup screen by clicking the **Settings** dropdown, then click **Indexes**.
-   2. Select **New Index**. Note that the **Indexes** page also gives you the status of all your existing indexes so that you can see whether you're about to use up your licensed amount of space.
-   3. Name the index **cloudflare**, which is the default index that the Cloudflare App will use. 
-
-7. Set up the HTTP Event Collector (HEC) on Splunk. To create an HEC:
-   1. Click the **Settings** dropdown and select **Data inputs**. 
-   2. Click **+Add new** and follow the wizard. When prompted, submit the following responses:
-      * Name: Cloudflare
-      * Source Type: Select > "cloudflare:json"
-      * App Context: Cloudflare App for Splunk (cloudflare)
-      * Index: cloudflare
-   3. At the end of the wizard you will see a **Token Value**. This token authorizes the Cloudflare Logpush job to send data to your Splunk instance. If you forget to copy it now, Splunk allows you to get the value at any time. 
-
-8. Verify whether Splunk is using a self-signed certificate. You'll need this information when creating the Logpush job. 
-9.  Determine the endpoint to use to send the data to. The endpoint should be:
-
-```bash
-"<protocol>://input-<host>:<port>/<endpoint>" or "<protocol>://http-inputs-<host>:<port>/<endpoint>"
-```
-
-Where:
-* `protocol`: HTTP or HTTPS
-* `input`: `input` or `http-inputs` based on whether you have a self-service or managed cloud plan
-* `host`: The hostname of your Splunk instance. The easiest way to determine the hostname is to look at the URL you went to when you logged in to Splunk.
-* `port`: 443 or 8088
-* `endpoint`: services/collector/raw
-
-For example: `https://prd-p-0qk3h.splunkcloud.com:8088/services/collector/raw`. Refer to the [Splunk Documentation](https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Data/UsetheHTTPEventCollector) for more details and examples. 
-
-**Post Installation Notes**
-
-You can change the **Index Name** after initial configuration by accessing the app **Set up** page by clicking on the **Apps** dropdown and navigating to **Manage Apps** > **Cloudflare App for Splunk** > **Set up**.
-
-![Splunk apps set up interface](../../static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up.png)
-
-You also can find the Index Name manually by visiting **Settings** > **Advanced search** > **Search macros**.
-
-![Splunk search macros](../../static/images/splunk/screenshots/splunk-settings-advanced-search-search-macros.png)
-
-The Cloudflare App for Splunk comes with a custom Cloudflare Data Model that has an acceleration time frame of 1 day but is not accelerated by default. If you enable [Data Model acceleration](https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Acceleratedatamodels), we recommend that the Data Model is only accelerated for 1 or 7 days to ensure there are no adverse effects within your Splunk environment.
-
-Enable or disable acceleration after the initial configuration by accessing the app Set up page by clicking the **Apps** dropdown, then **Manage Apps** > **Cloudflare Set Up**.
-
-![Splunk search macros](../../static/images/splunk/screenshots/splunk-apps-manage-apps-cloudflare-set-up-enable-data-model-acceleration.png)
-
-You can also manually configure Data Models by going to **Settings** > **Data models**. Learn more about data model acceleration in the [Splunk documentation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels).
-
-## Task 2 - Make the API call to create the Logpush job
-
-Create the Logpush job by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/logpush/splunk). The API call creates a Logpush job but does not enable it.
-
-Enable the Logpush job through the the Cloudflare dashboard or through the API by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/logpush/splunk). To enable through the dashboard: 
-
-1. Navigate to the Cloudflare dashboard and select **Analytics** > **Logs**. 
-2. Click **Edit** and select the fields referenced in the Dashboard section below to fully populate all tables and graphs. 
-3. Enable the Logpush job by toggling on the switch next to the Edit link. Data takes a few minutes to populate. 
-
-To validate that you are receiving data, search `index=cloudflare` in Splunk.  
-
-## Task 3 - View the Dashboards
-
-You can analyze Cloudflare logs with the thirteen (13) dashboards listed below.
-
-You can use filters within these dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more to further help with debugging and tracing.
-
-### About the Dashboards
-
-The following dashboards outlined below are available as part of the Cloudflare App for Splunk.
-
-#### Cloudflare - Snapshot
-
-_Web Traffic Overview_ and _Web Traffic Types_: Get an overview of the most important metrics from your websites and applications on the Cloudflare network.
-![Splunk dashboard Cloudflare Snapshot](../../static/images/splunk/dashboards/splunk-cloudflare-snapshot-dashboard.png)
-
-#### Cloudflare - Reliability
-
-_Summary_ and _Detailed_: Get insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-![Splunk dashboard Cloudflare Reliability Summary](../../static/images/splunk/dashboards/splunk-cloudflare-reliability-summary-dashboard.png)
-
-![Splunk dashboard Cloudflare Reliability Detailed](../../static/images/splunk/dashboards/splunk-cloudflare-reliability-detailed-dashboard.png)
-
-#### Cloudflare - Security
-
-_Overview_: Get insights on threats to your websites and applications, including number of threats stopped, threats over time, top threat countries, and more.
-![Splunk dashboard Cloudflare Security Overview](../../static/images/splunk/dashboards/splunk-cloudflare-security-overview.png)
-
-_WAF_: Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
-![Splunk dashboard Cloudflare Security WAF](../../static/images/splunk/dashboards/splunk-cloudflare-security-waf-dashboard.png)
-
-_Rate Limiting_: Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
-![Splunk dashboard Cloudflare Security Rate Limiting](../../static/images/splunk/dashboards/splunk-cloudflare-security-rate-limiting-dashboard.png)
-
-_Bots Summary_ and _Bots Detailed_: Investigate bot activity on your website to prevent content scraping, checkout fraud, spam registration and other malicious activities.
-![Splunk dashboard Cloudflare Security Bots Summary](../../static/images/splunk/dashboards/splunk-cloudflare-security-bot-summary-dashboard.png)
-
-![Splunk dashboard Cloudflare Security Bots Detailed](../../static/images/splunk/dashboards/splunk-cloudflare-security-bots-detailed-dashboard.png)
-
-#### Cloudflare - Performance
-
-_Requests and Cache_ and _Bandwidth_: Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
-![Splunk dashboard Cloudflare Performance Requests and Cache](../../static/images/splunk/dashboards/splunk-cloudflare-performance-requests-and-cache-dashboard.png)
-
-![Splunk dashboard Cloudflare Performance Bandwidth](../../static/images/splunk/dashboards/splunk-cloudflare-performance-bandwidth-dashboard.png)
-
-_Hostname, Content Type, Request Methods, Connection Type_: Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
-
-![Splunk dashboard Cloudflare Performance Hostname, Content Type, Request Methods, Connection Type](../../static/images/splunk/dashboards/splunk-cloudflare-performance-hostname-dashboard.png)
-
-_Static vs. Dynamic Content_: Get insights into the performance of your static and dynamic content, including slowest URLs.
-![Splunk dashboard Cloudflare Performance Static vs. Dynamic Content](../../static/images/splunk/dashboards/splunk-cloudflare-performance-static-vs-dynamic-dashboard.png)
-
-### Filters
-
-All dashboard have a set of filters that you can apply to the entire dashboard, as shown in the following example. Filters are applied across the entire dashboard.
-
-![Splunk Cloudflare filters](../../static/images/splunk/screenshots/splunk-filters.png)
-
-You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
-
-The default time interval is set to 24 hours. Note that for correct calculations filter will need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
-
-Available Filters:
-
-- Time Range (EdgeStartTimestamp)
-
-- Client Country
-
-- Client Device type
-
-- Client IP
-
-- Client Request Host
-
-- Client Request URI
-
-- Client Request User Agent
-
-- Edge response status
-
-- Origin IP
-
-- Origin Response Status
-
-- RayID
-
-- Worker Subrequest
-
-- Client Request Method
-
-## Debugging tips
-
-### Incomplete dashboards
-
-The Splunk Cloudflare App relies on data from the Cloudflare Enterprise Logs fields outlined below. Depending on which fields you have enabled, certain dashboards might not populate fully.
-
-If that is the case, verify and test the Cloudflare App filters below each dashboard (these filters are the same across all dashboards). You can delete any filters that you don’t need, even if such filters include data fields already contained in your logs.
-
-Also, you could compare the list of fields you are getting in Cloudflare Logs with the fields listed in **Splunk** > **Settings** > **Data Model** > **Cloudflare**.
-
-The available fields are:
-
-- CacheCacheStatus
-
-- CacheResponseBytes
-
-- CacheResponseStatus
-
-- ClientASN
-
-- ClientCountry
-
-- ClientDeviceType
-
-- ClientIP
-
-- ClientIPClass
-
-- ClientRequestBytes
-
-- ClientRequestHost
-
-- ClientRequestMethod
-
-- ClientRequestPath
-
-- ClientRequestProtocol
-
-- ClientRequestReferer
-
-- ClientRequestURI
-
-- ClientRequestUserAgent
-
-- ClientSSLCipher
-
-- ClientSSLProtocol
-
-- ClientSrcPort
-
-- EdgeColoCode
-
-- EdgeColoID
-
-- EdgeEndTimestamp
-
-- EdgePathingOp
-
-- EdgePathingSrc
-
-- EdgePathingStatus
-
-- EdgeRateLimitAction
-
-- EdgeRateLimitID
-
-- EdgeRequestHost
-
-- EdgeResponseBytes
-
-- EdgeResponseContentType
-
-- EdgeResponseStatus
-
-- EdgeServerIP
-
-- EdgeStartTimestamp
-
-- FirewallMatchesActions
-
-- FirewallMatchesSources
-
-- FirewallMatchesRuleIDs
-
-- OriginIP
-
-- OriginResponseStatus
-
-- OriginResponseTime
-
-- OriginSSLProtocol
-
-- RayID
-
-- WAFAction
-
-- WAFFlags
-
-- WAFMatchedVar
-
-- WAFProfile
-
-- WAFRuleID
-
-- WAFRuleMessage
-
-- WorkerSubrequest
-
-- ZoneID
diff --git a/products/logs/src/content/analytics-integrations/sumo-logic/index.md b/products/logs/src/content/analytics-integrations/sumo-logic/index.md
deleted file mode 100644
index d95c08cb00c..00000000000
--- a/products/logs/src/content/analytics-integrations/sumo-logic/index.md
+++ /dev/null
@@ -1,279 +0,0 @@
----
-title: Sumo Logic
-order: 105
----
-
-# Sumo Logic
-
-This tutorial explains how to analyze [Cloudflare Logs](https://www.cloudflare.com/products/cloudflare-logs/) using the [Cloudflare App for Sumo Logic](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare).
-
-## Overview
-
-If you haven’t used Cloudflare Logs before, visit our [Logs documentation](/) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
-
-This tutorial describes how to use Cloudflare Logpush to send logs to AWS S3 and the [AWS S3 source collector](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Amazon-Web-Services/AWS-S3-Source) to get logs into Sumo Logic. To learn how to use Logpush to send logs to AWS S3, refer to the [Logpush documentation](/logpush/). Alternatively, you can use [Logpull](/logpull-api/) to get logs to your Sumo Logic instance directly and skip Task 1.
-
-### Prerequisites
-
-Before sending your Cloudflare log data to Sumo Logic, make sure that you:
-
-- Have an existing Sumo Logic account
-- Have a Cloudflare Enterprise account with Cloudflare Logs enabled
-- Configure [Logpush](/logpush/) or [Logpull](/logpull-api/)
-- Consult the [Sumo Logic documentation](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare) for the Cloudflare App
-
-<Aside type="note" header="Note">
-
-Cloudflare logs are HTTP/HTTPS request logs in JSON format and are gathered from our 200+ data centers globally. By default, timestamps are returned as Unix nanosecond integers. We recommend using the RFC 3339 format for sending logs to Sumo Logic.
-</Aside>
-
-## Task 1 - Send Cloudflare Logs data to Sumo Logic
-
-You can use either **Cloudflare Logpush** or **AWS S3** to send your Cloudflare Logs data to Sumo Logic.
-
-### 1.1 - Send logs data via Cloudflare Logpush
-
-To enable Cloudflare Logpush in Sumo Logic:
-
-1. Configure a [Hosted Collector](https://help.sumologic.com/03Send-Data/Hosted-Collectors/Configure-a-Hosted-Collector).
-
-2. Configure an [HTTP Logs and Metrics Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source).
-
-3. Provide the _HTTP Source Address (URL)_ required by the Cloudflare Logpush API or Cloudflare dashboard UI.
-
-4. Enable Cloudflare Logpush to Sumo Logic via either:
-   - the Cloudflare dashboard [Logpush UI](/logpush/logpush-dashboard/), or
-   - the [Logpush API](/logpush/logpush-configuration-api/).
-
-### 1.2 Send log data via AWS S3
-
-To connect AWS S3 to Sumo Logic:
-
-1. [Configure your AWS S3 Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Amazon-Web-Services/AWS-S3-Source).
-
-2. Begin collecting Cloudflare logs data.
-
-## Task 2 - Filter Workers requests
-
-If you have [Cloudflare Workers](https://www.cloudflare.com/products/cloudflare-workers/) enabled and want to filter them out from the logs, do the following:
-
-Under **Processing Rules for Logs** create a **Filter** (processing rule regex on our Cloudflare collector) to exclude any log data where **WorkerSubrequest** is _true_, as illustrated below:
-
-![Sumo Logic Processing Rules for Logs](../../static/images/sumo-logic/screenshots/exclude_Workers-sumo_logic.png)
-
-## Task 3 - Install the Cloudflare App
-
-To install the [Cloudflare App for Sumo Logic](https://help.sumologic.com/07Sumo-Logic-Apps/18SAAS_and_Cloud_Apps/Cloudflare):
-
-1. In the Sumo Logic UI, click **App Catalog** and search for _Cloudflare_.
-   ![Sumo Logic Cloudflare in App Catalog](../../static/images/sumo-logic/screenshots/cloudflare-app-sumo-logic-app-catalog.png)
-
-2. Click **Add to Library** and specify the **Source** category _Cloudflare_, which was completed in Step 1.
-
-You should now be able to see the Cloudflare dashboards populated with your Cloudflare log data.
-
-## Task 4 - View the Dashboards
-
-There are nine dashboards to help you analyze Cloudflare logs. You can also use filters within the dashboards to help narrow the analysis by date and time, device type, country, user agent, client IP, hostname, and more, to further help with debugging and tracing.
-
-### About the Dashboards
-
-#### Cloudflare - Snapshot
-
-Get a quick overview of the most important metrics from your websites and applications on the Cloudflare network.
-![Sumo Logic dashboard Cloudflare Snapshot](../../static/images/sumo-logic/dashboards/cloudflare-snapshot-dashboard-sumo-logic.png)
-
-#### Cloudflare - Reliability
-
-Get insights on the availability of your websites and Applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.
-![Sumo Logic dashboard Cloudflare Reliability](../../static/images/sumo-logic/dashboards/cloudflare-reliability-dashboard-sumo-logic.png)
-
-#### Cloudflare - Security (Overview)
-
-Get insights on threats to your websites and applications, including number of threats stopped, threats over time, top threat countries, and more.
-![Sumo Logic dashboard Cloudflare Security Overview](../../static/images/sumo-logic/dashboards/cloudflare-security-overview-dashboard-sumo-logic.png)
-
-#### Cloudflare - Security (WAF)
-
-Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.
-![Sumo Logic dashboard Cloudflare Security WAF](../../static/images/sumo-logic/dashboards/cloudflare-security-waf-dashboard-sumo-logic.png)
-
-#### Cloudflare - Security (Rate Limiting)
-
-Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.
-![Sumo Logic dashboard Cloudflare Security Rate Limiting](../../static/images/sumo-logic/dashboards/cloudflare-security-rate-limiting-dashboard-sumo-logic.png)
-
-#### Cloudflare - Security (Bot Management)
-
-Investigate bot activity on your website to prevent content scraping, checkout fraud, spam registration and other malicious activities.
-![Sumo Logic dashboard Cloudflare Security Bot Management](../../static/images/sumo-logic/dashboards/cloudflare-security-bot-management-dashboard-sumo-logic.png)
-
-#### Cloudflare - Performance (Requests, Bandwidth, Cache)
-
-Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.
-![Sumo Logic dashboard Cloudflare Performance Requests, Bandwidth, Cache](../../static/images/sumo-logic/dashboards/cloudflare-performance-requests-bandwidth-cache-dashboard-sumo-logic.png)
-
-#### Cloudflare - Performance (Hostname, Content Type, Request Methods, Connection Type)
-
-Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.
-![Sumo Logic dashboard Cloudflare Performance Hostname, Content Type, Request Methods, Connection Type](../../static/images/sumo-logic/dashboards/cloudflare-performance-hostname-content-type-request-methods-connection-type-dashboard-sumo-logic.png)
-
-#### Cloudflare - Performance (Static vs. Dynamic Content)
-
-Get insights into the performance of your static and dynamic content, including slowest URLs.
-![Sumo Logic dashboard Cloudflare - Performance Static vs. Dynamic Content](../../static/images/sumo-logic/dashboards/cloudflare-performance-static-vs-dynamic-content-dashboard-sumo-logic.png)
-
-### Filters
-
-All dashboards have a set of filters that you can apply to the entire dashboard, as shown below.
-
-Click the **funnel icon** in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.
-
-![Sumo Logic dashboard filtering](../../static/images/sumo-logic/screenshots/filter-sumo-logic.png)
-
-<Aside type="note" header="Note">
-
-You can use filters to drill down and examine the data at a granular level. Filters include client country, client device type, client IP, client request host, client request URI, client request user agent, edge response status, origin IP, and origin response status.
-</Aside>
-
-Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.
-
-The default time interval is set to 24 hours. Note that for correct filter calculations, you need to exclude Worker subrequests (**WorkerSubrequest** = _false_) and purge requests (**ClientRequestMethod** is not _PURGE_).
-
-#### Available Filters
-
-- Date (EdgeStartTimestamp)
-
-- client_country
-
-- client_device_type
-
-- client_ip
-
-- client_request_host
-
-- client_request_method
-
-- client_request_uri
-
-- client_request_user_agent
-
-- edge_response_status
-
-- origin_ip
-
-- origin_response_status
-
-- ray_id
-
-- worker_subrequest
-
-## Debugging tips
-
-### Incomplete dashboards
-
-The Sumo Logic Cloudflare App relies on data from the Cloudflare Enterprise Logs fields outlined below. Depending on which fields you have enabled, certain dashboards might not populate fully.
-
-If that is the case, verify and test the Cloudflare App filters below each dashboard (these filters are the same across all dashboards). You can delete any filters that you don’t need, even if such filters include data fields already contained in your logs.
-
-The available fields are:
-
-- CacheCacheStatus
-
-- CacheResponseBytes
-
-- CacheResponseStatus
-
-- ClientASN
-
-- ClientCountry
-
-- ClientDeviceType
-
-- ClientIP
-
-- ClientIPClass
-
-- ClientRequestBytes
-
-- ClientRequestHost
-
-- ClientRequestMethod
-
-- ClientRequestPath
-
-- ClientRequestProtocol
-
-- ClientRequestReferer
-
-- ClientRequestURI
-
-- ClientRequestUserAgent
-
-- ClientSSLCipher
-
-- ClientSSLProtocol
-
-- ClientSrcPort
-
-- EdgeColoCode
-
-- EdgeColoID
-
-- EdgeEndTimestamp
-
-- EdgePathingOp
-
-- EdgePathingSrc
-
-- EdgePathi
-
-- ngStatus
-
-- EdgeRateLimitAction
-
-- EdgeRateLimitID
-
-- EdgeRequestHost
-
-- EdgeResponseBytes
-
-- EdgeResponseContentType
-
-- EdgeResponseStatus
-
-- EdgeServerIP
-
-- EdgeStartTimestamp
-
-- FirewallMatchesActions
-
-- FirewallMatchesSources
-
-- FirewallMatchesRuleIDs
-
-- OriginIP
-
-- OriginResponseStatus
-
-- OriginResponseTime
-
-- OriginSSLProtocol
-
-- RayID
-
-- WAFAction
-
-- WAFFlags
-
-- WAFMatchedVar
-
-- WAFProfile
-
-- WAFRuleID
-
-- WAFRuleMessage
-
-- WorkerSubrequest
-
-- ZoneID
diff --git a/products/logs/src/content/faq/index.md b/products/logs/src/content/faq/index.md
index 2a925a6484f..da243d53761 100644
--- a/products/logs/src/content/faq/index.md
+++ b/products/logs/src/content/faq/index.md
@@ -1,56 +1,84 @@
 ---
-title: FAQs
 order: 130
+pcx-content-type: faq
 ---
 
-# FAQs
+# FAQ
 
 ## General FAQ
 
 ### Once a request has passed through the Cloudflare network, how soon are the logs available?
 
-Logs become available in approximately 1 to 5 minutes.
-
-In the best case, logs take about 1 minute to process, and so we require that calls to the **Logpull API** be for time periods of at least 1 minute in the past. For example, if it’s 9:43 now, you can ask for logs processed between 9:41 and 9:42. The response will include logs for requests that passed through our network between 9:41 and 9:42 and potentially earlier. It’s normal for our processing to take between 3 and 4 minutes, so when you ask for that same time period, you may also see logs of requests that passed through our network at 9:39 or earlier.
-
 When using **Logpush**, logs are pushed in batches as soon as possible. For example, if you receive a file at 10:10, the file consists of logs that were processed shortly before 10:10.
 
-These timings are only a guideline, not a guarantee, and may depend on network conditions, the request volume for your domain, and other factors. Although we try to get the logs to you as fast as possible, we prioritize not losing log data over speed. On rare occasions, you may see a longer delay. In this case, you don’t need to take any action--the logs will be available as soon as they’re processed.
+When using **Logpull**, logs become available in approximately one to five minutes. Cloudflare requires that calls to the **Logpull API** be for time periods of at least one minute in the past. For example, if it is 9:43 now, you can ask for logs processed between 9:41 and 9:42. The response will include logs for requests that passed through our network between 9:41 and 9:42 and potentially earlier. It is normal for our processing to take between three and four minutes, so when you ask for that same time period, you may also see logs of requests that passed through our network at 9:39 or earlier.
+
+These timings are only a guideline, not a guarantee, and may depend on network conditions, the request volume for your domain, and other factors. Although we try to get the logs to you as fast as possible, we prioritize not losing log data over speed. On rare occasions, you may see a longer delay. In this case, you do not need to take any action. The logs will be available as soon as they are processed.
 
 ### Are logs available for customers who are not on an Enterprise plan?
 
-Not yet, but we’re planning to make them available to other customer plans in the future.
+Not yet, but we are planning to make them available to other customer plans in the future.
 
-### When pulling or pushing logs, I occasionally come across a time period with no data, even though I’m sure my domain received requests at that time. Is this normal?
+### When pulling or pushing logs, I occasionally come across a time period with no data, even though I am sure my domain received requests at that time. Is this normal?
 
-Yes, this is normal. The time period for which you pull or receive logs is based on our processing time, not the time the requests passed through our network. If you receive an empty response, it does not mean there were no requests during that time period. It just means we did not process any logs for your domain during that time.
+Yes. The time period for which you pull or receive logs is based on our processing time, not the time the requests passed through our network. Empty responses do not mean there were no requests during that time period, just that we did not process any logs for your domain during that time.
 
 ### Can I receive logs in a format other than JSON?
 
-Currently not. Talk to your account manager or Cloudflare Support if you’re interested in other formats and we’ll consider them for the future.
+Not at this time. Talk to your account manager or Cloudflare Support if you are interested in other formats and we will consider them for the future.
 
-## Logpull API FAQ
+## Logpush FAQ
 
-### How long are logs retained?
+### What happens if my cloud storage destination is temporarily unavailable?
 
-Cloudflare makes logs available for at least 3 days and up to 7 days. If you need your logs for a longer time period, download and store them locally.
+**Logpush** is designed to retry in case of errors. If your destination is temporarily unavailable, Logpush will make the best effort to retry. If Cloudflare persistently receives errors from your destination, Logpush will eventually drop logs. If the errors continue for a prolonged period of time, Logpush will assume that the destination is permanently unavailable and disable your push job. You can always re-enable the job later.
 
-### I’m asking for logs for the time window of 16:10-16:13. However, the timestamps in the logs show requests that are before this time period. Why does that happen?
+### Can I adjust how often logs are pushed?
 
-When you make a call for the time period of 16:10-16:13, you're actually asking for the logs that were received and processed by our system during that time (hence the endpoint name, _logs/received_). the _received_ time is the time the logs are written to disk. There is some delay between the time the request hits the Cloudflare edge and the time it is received and processed. The _request time_ is what you see in the log itself: _EdgeStartTimestamp_ and _EdgeEndTimestamp_ tell you when the edge started and stopped processing the request.
+No. Cloudflare pushes logs in batches as soon as possible.
 
-The advantage of basing the responses on the _time received_ rather than the request or edge time is not needing to worry about late-arriving logs. As long as you're calling our API for continuous time segments, you will always get all of your logs and will never have to make the same call twice. If we based the response on request time, you could never be sure that all the logs for that request time had been processed.
+### My job was accidentally turned off, and I did not receive my logs for a certain time period. Can they still be pushed to me?
 
-## Logpush FAQ
+No. **Logpush** only pushes the logs once as they become available and is unable to backfill. However, the logs are stored for at least 72 hours and can be downloaded using the **Logpull API**.
 
-### What happens if my cloud storage destination is temporarily unavailable?
+### Why am I receiving a validating destination error while setting up a Splunk job? 
+You could be seeing this error for multiple reasons:
+* The Splunk endpoint URL is not correct. Cloudflare only supports Splunk HEC raw endpoint over HTTPS.
+* The Splunk authentication token is not correct. Be sure to URL-encode the token. For example, use "%20" for a whitespace.
+* The certificate for Splunk Server is not properly configured. Certificates generated by Splunk/third-party certificates should have the Common Name field in the certificate match the Splunk server’s domain name. Otherwise you may see errors like: `x509: certificate is valid for SplunkServerDefaultCert, not <your-instance>.splunkcloud.com.`
 
-**Logpush** is designed to retry in case of errors. If your destination is temporarily unavailable, we’ll keep trying until it’s online again and the logs are received. We’ll also automatically catch up, so that you don’t miss any logs. However, if we persistently receive errors from your destination, we’ll take that as a sign that it’s permanently unavailable and disable your push job. It can always be re-enabled later.
+### What is the insecure-skip-verify parameter in Splunk jobs?
+This flag, if set to `true`, makes an insecure connection to Splunk. Setting this value to `true` is equivalent to using the `-k` option with `curl` as shown in Splunk examples and is **not** recommended. Cloudflare highly recommends setting this flag to `false` when using the `insecure-skip-verify` parameter.
 
-### Can I adjust how often logs are pushed?
+### Why do we have the insecure-skip-verify parameter in Splunk jobs if it is not recommended?
+Certificates generated by Splunk/third-party certificates should have the Common Name field in the certificate match the Splunk server’s domain name. Otherwise you may see errors like: `x509: certificate is valid for SplunkServerDefaultCert, not <your-instance>.splunkcloud.com.` This happens especially with the default certificates generated by Splunk on startup. Pushes will never succeed unless the certificates are fixed.
 
-No. Cloudflare pushes logs in batches as soon as possible.
+The proper way to resolve the issue is to fix the certificates. This flag is only here for those rare scenarios when it is not possible to have access or permissions to fix the certificates, like with the Splunk cloud instances, which do not allow changing Splunk server configurations.
+
+### How can I verify that my Splunk HEC is working correctly before setting up a job?
+Ensure that you can publish events to your Splunk instance through `curl` without the `-k` flag and with the `insecure-skip-verify` parameter set to `false` as in the following example:
+
+```bash
+curl  "https://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>" \
+   -H "Authorization: Splunk <SPLUNK-AUTH-TOKEN>" \
+   -d '{"BotScore":99,"BotScoreSrc":"Machine Learning","CacheCacheStatus":"miss","CacheResponseBytes":2478}'
+{"text":"Success","code":0}
+```
+
+### Can I use any HEC network port in the Splunk destination conf?
+No. Cloudflare expects the HEC network port to be configured to `:443` or `:8088`.
+
+### Does Logpush integrate with the Cloudflare Splunk App?
+Yes. See [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/) for more information. As long as you ingest logs using the `cloudflare:json` source type, you can use the Cloudflare Splunk App.
+
+## Logpull API FAQ
+
+### How long are logs retained?
+
+Cloudflare makes logs available for at least three days and up to seven days. If you need your logs for a longer time period, download and store them locally.
+
+### I am asking for logs for the time window of 16:10-16:13. However, the timestamps in the logs show requests that are before this time period. Why does that happen?
 
-### My job was accidentally turned off, and I didn’t receive my logs for a certain time period. Can they still be pushed to me?
+When you make a call for the time period of 16:10-16:13, you are actually asking for the logs that were received and processed by our system during that time (hence the endpoint name, _logs/received_). The _received_ time is the time the logs are written to disk. There is some delay between the time the request hits the Cloudflare edge and the time it is received and processed. The _request time_ is what you see in the log itself: _EdgeStartTimestamp_ and _EdgeEndTimestamp_ tell you when the edge started and stopped processing the request.
 
-No, **Logpush** only pushes the logs once as they become available, and is unable to backfill. However, the logs are stored for a period of at least 72 hours and can be downloaded using the **Logpull API**.
+The advantage of basing the responses on the _time received_ rather than the request or edge time is not needing to worry about late-arriving logs. As long as you are calling our API for continuous time segments, you will always get all of your logs without making duplicate calls. If we based the response on request time, you could never be sure that all the logs for that request time had been processed.
diff --git a/products/logs/src/content/get-started/enable-destinations/aws-s3/index.md b/products/logs/src/content/get-started/enable-destinations/aws-s3/index.md
new file mode 100644
index 00000000000..9445ab6a974
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/aws-s3/index.md
@@ -0,0 +1,92 @@
+---
+title: Enable Amazon S3
+order: 55
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Amazon S3
+
+Cloudflare Logpush supports pushing logs directly to Amazon S3 via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Amazon S3 via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Amazon S3**.
+
+1. Enter or select the following destination information:
+     * **Bucket path**
+     * **Daily subfolders**
+     * **Bucket region**
+     * **Encryption constraint in bucket policy**
+     * For **Grant Cloudflare access to upload files to your bucket**, make sure your bucket has a policy (if you did not add it already):
+        * Copy the JSON policy, then go to your bucket in the Amazon S3 console and paste the policy in **Permissions** > **Bucket Policy** and click **Save**
+
+1. Click **Validate access**.
+    
+1. Enter the **Ownership token** (included in a file or log Cloudflare sends to your provider) and click **Prove ownership**. To find the ownership token, click the **Open** button in the **Overview** tab of the ownership challenge file.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Amazon S3 as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+
+## Manage via API
+
+Cloudflare uses Amazon Identity and Access Management (IAM) to gain access to your S3 bucket. The Cloudflare IAM user needs *PutObject* permission for the bucket.
+
+Logs are written into that bucket as gzipped objects using the S3 Access Control List (ACL)
+*Bucket-owner-full-control* permission.
+
+<EnableReadPermissions/>
+
+For illustrative purposes, imagine that you want to store logs in the bucket *burritobot*, in the *logs* directory. The S3 URL would then be `s3://burritobot/logs`.
+
+To enable Logpush to Amazon S3:
+
+1. Create an S3 bucket. *See [instructions from Amazon](https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html)*. Note: buckets in China regions (cn-north-1, cn-northwest-1) are currently not supported.
+
+1. Edit and paste the policy below into **S3** > **Bucket** > **Permissions** > **Bucket Policy** (make sure to replace the *Resource* value with your own bucket path):
+
+```json
+{
+  "Id": "Policy1506627184792",
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "Stmt1506627150918",
+      "Action": [
+        "s3:PutObject"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:s3:::burritobot/logs/*",
+      "Principal": {
+        "AWS": [
+          "arn:aws:iam::391854517948:user/cloudflare-logpush"
+        ]
+      }
+    }
+  ]
+}
+```
+
+<Aside type="note" header="Note">
+
+Logpush uses multipart upload for S3. Aborted uploads will result in incomplete files remaining in your bucket. To minimize your storage costs, Amazon recommends configuring a lifecycle rule using the `AbortIncompleteMultipartUpload` action. *See [Uploading and copying objects using multipart upload](https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)*.
+</Aside>
diff --git a/products/logs/src/content/get-started/enable-destinations/azure/index.md b/products/logs/src/content/get-started/enable-destinations/azure/index.md
new file mode 100644
index 00000000000..822dc870281
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/azure/index.md
@@ -0,0 +1,63 @@
+---
+title: Enable Microsoft Azure
+order: 62
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Logpush to Microsoft Azure
+
+Cloudflare Logpush supports pushing logs directly to Microsoft Azure via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Microsoft Azure via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Microsoft Azure**.
+
+1. Enter or select the following destination information:
+     * **SAS URL**
+     * **Blob container subpath (optional)**
+     * **Daily subfolders**
+
+1. Click **Validate access**.
+    
+1. Enter the **Ownership token** (included in a file or log Cloudflare sends to your provider) and click **Prove ownership**. To find the ownership token, click the **Open** button in the **Overview** tab of the ownership challenge file.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Microsoft Azure as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+Cloudflare uses a service-level shared access signature (SAS) to gain access to your Blob Storage container. You'll need to provide *Write* permission and an expiration period of at least 5 years, which will allow you to not worry about the SAS token expiring.
+
+<EnableReadPermissions/>
+
+To enable Logpush to Azure:
+
+1. Create a Blob Storage container. *See [instructions from Azure](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal)*.
+
+1. Create a shared access signature (SAS). To learn about shared access signatures, *see [information from Azure](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)*. Logpush requires a *service-level SAS*, which provides the most restricted access. To create a service-level SAS, *see [instructions from Azure](https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas)* or use the *Storage Explorer* feature in your storage account portal. Select *Storage Explorer*, navigate to and then right-click on your blob container to see the *Get Shared Access Signature* option. Select that option, set an expiry time of at least 5 years, and select only *Write* permission.
+
+1. Provide the SAS URL when prompted by the Logpush API or UI.
+
+<Aside type="note" header="Note">
+
+Logpush will stop pushing logs if your SAS token expires, which is why an expiration period of at least 5 years is required. You can always update your Logpush job with a new token if needed.
+</Aside>
diff --git a/products/logs/src/content/get-started/enable-destinations/bigquery/index.md b/products/logs/src/content/get-started/enable-destinations/bigquery/index.md
new file mode 100644
index 00000000000..83e56c5724c
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/bigquery/index.md
@@ -0,0 +1,14 @@
+---
+order: 61
+pcx-content-type: concept
+---
+
+# Enable BigQuery
+
+Configure Logpush to send batches of Cloudflare logs to BigQuery.
+
+BigQuery supports loading up to 1,500 jobs per table per day (including failures) with up to 10 million files in each load. That means you can load into BigQuery once per minute and include up to 10 million files in a load. See BigQuery's quotas for load jobs for more information.  
+
+Logpush delivers batches of logs as soon as possible, which means you could receive more than one batch of files per minute. Ensure your BigQuery job is configured to ingest files on a given time interval, like every minute, as opposed to when files are received. Ingesting files into BigQuery as each Logpush file is received could exhaust your BigQuery quota quickly.
+
+For an example of how to set up a schedule job load with BigQuery, see the [Cloudflare + Google Cloud | Integrations repository](https://github.com/cloudflare/cloudflare-gcp/tree/master/logpush-to-bigquery).
\ No newline at end of file
diff --git a/products/logs/src/content/get-started/enable-destinations/datadog/index.md b/products/logs/src/content/get-started/enable-destinations/datadog/index.md
new file mode 100644
index 00000000000..f27cb1dee22
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/datadog/index.md
@@ -0,0 +1,141 @@
+---
+title: Enable Datadog
+order: 58
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Logpush to Datadog
+
+Cloudflare Logpush supports pushing logs directly to Datadog via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Datadog via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Datadog**.
+
+1. Enter or select the following destination information:
+     * **Datadog URL Endpoint**
+     * **Datadog API Key**
+
+1. Click **Validate access**.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Datadog as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+To set up a Datadog Logpush job:
+1. Create a job with the appropriate endpoint URL and authentication parameters
+1. Enable the job to begin pushing logs
+
+<Aside type="note" header="Note">
+
+Unlike configuring Logpush jobs for AWS S3, GCS, or Azure, there is no ownership challenge when configuring Logpush to Datadog.
+
+</Aside>
+
+<EnableReadPermissions/>
+
+## 1. Create a job
+
+To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
+* `name` (optional) - Use your domain name as the job name.
+* `destination_conf` - A log destination consisting of an endpoint URL, authorization header, and zero or more optional parameters that Datadog supports in the string format below. 
+
+  * `<DATADOG-ENDPOINT-URL>`: The Datadog http logs intake endpoint, which is 'http-intake.logs.datadoghq.com/v1/input' 
+  * `<DATADOG-API-KEY>`: The Datadog API token. For example, '20e6d94e8c57924ad1be3c29bcaee0197d"
+  * `service`, `host`, `ddsource`, `ddtags`: Optional parameters allowed by Datadog
+
+```bash
+"datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>&service=<SERVICE>&host=<HOST>&ddsource=<SOURCE>"
+```
+
+* `dataset` - the category of logs you want to receive. See [Log fields](/reference/log-fields) for the full list of supported datasets. 
+* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](/get-started/logpush-configuration-api/understanding-logpush-api#options)
+
+Example request using cURL:
+
+```bash
+curl -s -X POST \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
+-H "X-Auth-Email: user@example.com" \
+-H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
+-d '{"name":"<DOMAIN_NAME>",
+"destination_conf":"datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",  "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": false,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+
+## 2. Enable (update) a job
+
+To enable a  job, make a `PUT` request to the Logpush jobs endpoint. You’ll use the job ID returned from the previous step in the URL and send `{"enabled": true}` in the request body.
+
+Example request using cURL:
+
+```bash
+curl -s -X PUT \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": true,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+<Aside type="note" header="Note">
+
+The Datadog destination is exclusive to new jobs and might not be backward compatible with older jobs. Create new jobs if you expect to send your logs directly to Datadog instead of modifying already existing ones. If you try to modify an existing job for another destination to push logs to Datadog, you may observe errors.
+
+</Aside>
diff --git a/products/logs/src/content/get-started/enable-destinations/google-cloud-storage/index.md b/products/logs/src/content/get-started/enable-destinations/google-cloud-storage/index.md
new file mode 100644
index 00000000000..69d92e4d89b
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/google-cloud-storage/index.md
@@ -0,0 +1,60 @@
+---
+order: 60
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Google Cloud Storage
+
+Cloudflare Logpush supports pushing logs directly to Google Cloud Storage via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Google Cloud Storage via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Google Cloud Storage**.
+
+1. Enter or select the following destination information:
+     * **Bucket path**
+     * **Daily subfolders**
+     * For **Grant Cloudflare access to upload files to your bucket**, make sure your bucket has added Cloudflare's IAM as a user (if you did not add it already)
+
+1. Click **Validate access**.
+    
+1. Enter the **Ownership token** (included in a file or log Cloudflare sends to your provider) and click **Prove ownership**. To find the ownership token, click the **Open** button in the **Overview** tab of the ownership challenge file.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Google Cloud Storage as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+Cloudflare uses Google Cloud Identity and Access Management (IAM) to gain access to your bucket. The Cloudflare IAM service account needs admin permission for the bucket.
+
+<EnableReadPermissions/>
+
+To enable Logpush to GCS:
+
+1. Create a GCS bucket. *See [instructions from GCS](https://cloud.google.com/storage/docs/creating-buckets#storage-create-bucket-console)*.
+
+1. In **Storage** > **Browser** > **Bucket** > **Permissions**, add the member `logpush@cloudflare-data.iam.gserviceaccount.com` with *Storage Object Admin* permission.
+
+<Aside type="note" header="Note">
+
+Logpush will not work if there is a retention policy on your bucket because this policy prevents overwrites. If you're using the policy to enforce deletion, you can use a lifecycle rule instead. *See [object lifecycle management from GCS](https://cloud.google.com/storage/docs/lifecycle)*.
+</Aside>
diff --git a/products/logs/src/content/get-started/enable-destinations/index.md b/products/logs/src/content/get-started/enable-destinations/index.md
new file mode 100644
index 00000000000..91fdcc90c7c
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/index.md
@@ -0,0 +1,10 @@
+---
+order: 43
+pcx-content-type: navigation
+---
+
+# Enable destinations
+
+Enable pushing logs to your storage service, SIEM, or log management provider.
+
+<DirectoryListing path="/get-started/enable-destinations"/>
\ No newline at end of file
diff --git a/products/logs/src/content/get-started/enable-destinations/other-providers/index.md b/products/logs/src/content/get-started/enable-destinations/other-providers/index.md
new file mode 100644
index 00000000000..c86fcf6660f
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/other-providers/index.md
@@ -0,0 +1,33 @@
+---
+title: Enable other providers
+order: 65
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Logpush to other providers
+
+Cloudflare Logpush supports pushing logs to a limited set of services providers. However, you can configure Logpush via API.
+
+## Manage via the Cloudflare dashboard
+
+Refer to [Enable destinations](/get-started/enable-destinations/) for the list of services you can configure to use with Logpush through the Cloudflare dashboard. Interested in a different service? Take this [survey](https://docs.google.com/forms/d/e/1FAIpQLScwOSabROywVajpMX2ZYCVl3saYs11cP4NIC8QR-wmOAnxOtA/viewform).
+
+## Manage via API
+
+The Cloudflare Logpush API allows you to configure and manage jobs via create, retrieve, update, and delete operations (CRUD).
+
+With Logpush, you can create a job to upload logs of the metadata Cloudflare collects in batches as soon as possible to your cloud service provider. The API allows one job per data set per domain.
+
+<EnableReadPermissions/>
+
+To get started:
+
+1. Set up a storage provider and grant Cloudflare access. Your storage provider may request your Cloudflare API credentials and other information including:
+   - Email address
+   - Cloudflare API key
+   - Zone ID
+   - Destination access details for your cloud service provider
+
+1. Configure your Logpush job. For more information on how to configure a Logpush job, refer to [Logpush API configuration](/reference/logpush-api-configuration).
\ No newline at end of file
diff --git a/products/logs/src/content/get-started/enable-destinations/s3-compatible-endpoints/index.md b/products/logs/src/content/get-started/enable-destinations/s3-compatible-endpoints/index.md
new file mode 100644
index 00000000000..871b2af862e
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/s3-compatible-endpoints/index.md
@@ -0,0 +1,149 @@
+---
+order: 56
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable S3-compatible endpoints
+
+Cloudflare Logpush supports pushing logs to S3-compatible destinations via the Cloudflare dashboard or via API, including:
+
+* [Alibaba Cloud OSS](https://www.alibabacloud.com/help/doc-detail/64919.htm#title-37m-7gl-xy2)
+* [Backblaze B2](https://www.backblaze.com/b2/docs/s3_compatible_api.html)
+* [Digital Ocean Spaces](https://www.digitalocean.com/docs/spaces/)
+* [IBM Cloud Object Storage](https://cloud.ibm.com/apidocs/cos/cos-compatibility)
+* [JD Cloud Object Storage Service](https://docs.jdcloud.com/en/object-storage-service/introduction-2)
+* [Linode Object Storage](https://www.linode.com/products/object-storage/)
+* [Oracle Cloud Object Storage](https://docs.cloud.oracle.com/en-us/iaas/Content/Object/Tasks/s3compatibleapi.htm)
+* On-premise [Ceph Object Gateway](https://docs.ceph.com/en/latest/radosgw/s3/)
+
+For more information about Logpush and the current production APIs, see the [Cloudflare Logpush](/get-started/) documentation.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to an S3-compatible destination via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **S3-Compatible**.
+
+1. Enter or select the following destination information:
+     * **S3 Compatible Bucket Path**
+     * **Bucket region**
+     * **Access Key ID**
+     * **Secret Access Key**
+     * **Endpoint URL**
+
+1. Click **Validate access**.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists the S3-compatible destination as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+To set up S3-compatible endpoints:
+1. Create a job with the appropriate endpoint URL and authentication parameters.
+1. Enable the job to begin pushing logs.
+
+See below for detailed instructions.
+
+<Aside type="note" header="Note">
+
+Unlike Logpush jobs to Amazon S3, there is no ownership challenge with S3-compatible APIs.
+
+</Aside>
+
+<EnableReadPermissions/>
+
+### 1. Create a job
+
+To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
+* `name` (optional) - Use your domain name as the job name.
+* `destination_conf` - A log destination consisting of an endpoint name, bucket name, bucket path, region, access-key-id, and secret-access-key in the following string format:
+
+```bash
+"s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>"
+```
+<Aside type="note" header="Note">
+
+`<ENDPOINT-URL>` is the url without the bucket name or path. Example: `endpoint=sfo2.digitaloceanspaces.com`
+</Aside>
+
+* `dataset` - the category of logs you want to receive; either `http_requests` (default), `spectrum_events` or `firewall_events`
+* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](/get-started/logpush-configuration-api/understanding-logpush-api#options)
+
+Example request using cURL:
+
+```bash
+curl -s -X POST \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
+-d '{"name":"<DOMAIN_NAME>",
+"destination_conf":"s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>", "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": false,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+
+### 2. Enable (update) a job
+
+To enable a  job, make a `PUT` request to the Logpush jobs endpoint. You’ll use the job ID returned from the previous step in the URL, and send `{"enabled": true}` in the request body.
+
+Example request using cURL:
+
+```bash
+curl -s -X PUT \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": true,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
diff --git a/products/logs/src/content/get-started/enable-destinations/splunk/index.md b/products/logs/src/content/get-started/enable-destinations/splunk/index.md
new file mode 100644
index 00000000000..8e80e4f3b62
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/splunk/index.md
@@ -0,0 +1,155 @@
+---
+title: Enable Splunk
+order: 63
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Logpush to Splunk
+
+Cloudflare Logpush supports pushing logs directly to Splunk via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Splunk via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Splunk**.
+
+1. Enter or select the following destination information:
+     * **Splunk raw HTTP Event Collector URL**
+     * **Channel ID**
+     * **Auth Token**
+     * **Source Type**
+     * **Use insecure skip verify option**
+
+1. Click **Validate access**.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Splunk as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+To set up a Splunk Logpush job:
+1. Create a job with the appropriate endpoint URL and authentication parameters
+1. Enable the job to begin pushing logs
+
+<Aside type="note" header="Note">
+
+Unlike configuring Logpush jobs for AWS S3, GCS, or Azure, there is no ownership challenge when configuring Logpush to Splunk.
+
+</Aside>
+
+<EnableReadPermissions/>
+
+### 1. Create a job
+
+To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
+
+* `name` (optional) - Use your domain name as the job name.
+* `destination_conf` - A log destination consisting of an endpoint URL, channel id, insecure-skip-verify flag, sourcetype, authorization header in the string format below. 
+
+  * `<SPLUNK-ENDPOINT-URL>`: The Splunk raw HTTP Event Collector URL with port. Example: `splunk.cf-analytics.com:8088/services/collector/raw`. 
+      * Cloudflare expects the HEC network port to be configured to :443 or :8088. 
+      * Cloudflare expects the Splunk endpoint to be /services/collector/raw while configuring and setting up the Logpush job.  
+      * Ensure you've enabled HEC in Splunk. Refer to [Splunk Analytics Integrations](https://developers.cloudflare.com/fundamentals/data-products/analytics-integrations/splunk) for information on how to set up HEC in Splunk. 
+  * `<SPLUNK-CHANNEL-ID>`: A unique channel ID. This is a random GUID that you can generate by:
+      * Using an online tool like the [GUID generator](https://www.guidgenerator.com/) 
+      * Using command line.  Example: `python -c 'import uuid; print(uuid.uuid4())'` 
+  * `<INSECURE-SKIP-VERIFY>`: Boolean value. Cloudflare recommends setting this value to `false`. Setting this value to `true` is equivalent to using the `-k` option with `curl` as shown in Splunk examples and is **not** recommended. Only set this value to `true` when HEC uses a self-signed certificate.
+
+<Aside type="note" header="Note">
+Cloudflare highly recommends setting this value to <code class="InlineCode">false</code>. Refer to the <a href="../../../faq/index#logpush-faq">Logpush FAQ</a> for more information.
+</Aside>
+
+  * `<SOURCE-TYPE>`: The Splunk sourcetype. Example: `cloudflare:json`
+  * `<SPLUNK-AUTH-TOKEN>`: The Splunk authorization token that’s URL-encoded. Example: `Splunk%20e6d94e8c-5792-4ad1-be3c-29bcaee0197d`   
+
+```bash
+"splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>"
+```
+
+* `dataset` - The category of logs you want to receive, which is either `http_requests` (default), `spectrum_events`, or `firewall_events`.
+
+* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](/get-started/logpush-configuration-api/understanding-logpush-api#options). For timestamp, Cloudflare recommends using `timestamps=rfc3339`
+
+Example request using cURL:
+
+```bash
+curl -s -X POST \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
+-H "X-Auth-Email: user@example.com" \
+-H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
+-d '{"name":"<DOMAIN_NAME>",
+"destination_conf":"splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",  "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": false,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+
+### 2. Enable (update) a job
+
+To enable a  job, make a `PUT` request to the Logpush jobs endpoint. Use the job ID returned from the previous step in the URL and send `{"enabled":true}` in the request body.
+
+Example request using cURL:
+
+```bash
+curl -s -X PUT \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
+```
+
+Response:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 100,
+    "dataset": "http_requests",
+    "enabled": true,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+
+Refer to the [Logpush FAQ](../../../faq#logpush-faq) for troubleshooting information.
\ No newline at end of file
diff --git a/products/logs/src/content/get-started/enable-destinations/sumo-logic/index.md b/products/logs/src/content/get-started/enable-destinations/sumo-logic/index.md
new file mode 100644
index 00000000000..c098494b89a
--- /dev/null
+++ b/products/logs/src/content/get-started/enable-destinations/sumo-logic/index.md
@@ -0,0 +1,65 @@
+---
+title: Enable Sumo Logic
+order: 65
+pcx-content-type: how-to
+---
+
+import EnableReadPermissions from "../../../_partials/_enable-read-permissions.md"
+
+# Enable Logpush to Sumo Logic
+
+Cloudflare Logpush supports pushing logs directly to Sumo Logic via the Cloudflare dashboard or via API.
+
+## Manage via the Cloudflare dashboard
+
+Enable Logpush to Sumo Logic via the dashboard.
+
+To enable the Cloudflare Logpush service:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the Enterprise domain you want to use with Logpush.
+
+1. Go to **Analytics** > **Logs**.
+
+1. Click **Connect a service**. A modal window opens where you will need to complete several steps.
+
+1. Select the data set you want to push to a storage service.
+
+1. Select the data fields to include in your logs. You can add or remove fields later by modifying your settings in **Logs** > **Logpush**.
+
+1. Select **Sumo Logic**.
+
+1. Enter or select the **HTTP Source Address**.
+
+1. Click **Validate access**.
+    
+1. Enter the **Ownership token** (included in a file or log Cloudflare sends to your provider) and click **Prove ownership**. To find the ownership token, click the **Open** button in the **Overview** tab of the ownership challenge file.
+
+1. Click **Save and Start Pushing** to finish enabling Logpush.
+
+Once connected, Cloudflare lists Sumo Logic as a connected service under **Logs** > **Logpush**. Edit or remove connected services from here.
+
+## Manage via API
+
+Cloudflare can send logs to a Hosted Collector with "HTTP Logs & Metrics" as the source. Once you've set up a collector, you simply provide the HTTP Source Address (a unique URL) to which logs can be posted.
+
+<EnableReadPermissions/>
+
+To enable Logpush to Sumo Logic:
+
+1. Configure a Hosted Collector. *See [instructions from Sumo Logic](https://help.sumologic.com/03Send-Data/Hosted-Collectors/Configure-a-Hosted-Collector)*.
+
+1. Configure an HTTP Logs & Metrics Source. *See [instructions from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source)*. The last step indicates how to get the HTTP Source Address (URL).
+
+1. Provide the HTTP Source Address (URL) when prompted by the Logpush API or UI.
+
+<Aside type="note" header="Note">
+
+Logpush will stop working if you regenerate the HTTP Source Address (URL). *See [generate a new URL for an HTTP Source from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source/zGenerate-a-new-URL-for-an-HTTP-Source)*. To use the new URL, you will have to get a new ownership challenge and update the destination for your job.
+</Aside>
+
+<Aside type="info" header="Info">
+
+Sumo Logic may impose throttling and caps on your log ingestion to prevent your account from using "On-Demand Capacity." *See [manage ingestion](https://help.sumologic.com/Manage/Ingestion-and-Volume/01Manage-Ingestion)*.
+</Aside>
diff --git a/products/logs/src/content/get-started/index.md b/products/logs/src/content/get-started/index.md
new file mode 100644
index 00000000000..b40d798534b
--- /dev/null
+++ b/products/logs/src/content/get-started/index.md
@@ -0,0 +1,13 @@
+---
+order: 41
+pcx-content-type: navigation
+---
+
+# Get started
+Cloudflare Logpush supports pushing logs to storage services, SIEMs, and log management providers via the Cloudflare dashboard or Logpush API.
+
+Cloudflare aims to support additional services in the future. Interested in a particular service? Take this [survey](https://goo.gl/forms/0KpMfae63WMPjBmD2).
+
+<ButtonGroup>
+  <Button type="primary" href="/get-started/enable-destinations">Enable destinations</Button>
+</ButtonGroup>
\ No newline at end of file
diff --git a/products/logs/src/content/index.md b/products/logs/src/content/index.md
index f98da451806..a2bcf5b71ab 100644
--- a/products/logs/src/content/index.md
+++ b/products/logs/src/content/index.md
@@ -1,14 +1,15 @@
 ---
-title: Welcome
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
-# Cloudflare Logs documentation
+# Cloudflare Logs
 
-Cloudflare Enterprise customers have access to detailed logs of HTTP requests, Spectrum events, or Firewall events. These logs are helpful for debugging, identifying configuration adjustments, and creating analytics, especially when combined with logs from other sources, such as your application server.
+Cloudflare Enterprise customers have access to detailed logs of the metadata generated by our products. These logs are helpful for debugging, identifying configuration adjustments, and creating analytics, especially when combined with logs from other sources, such as your application server. For information about the types of data Cloudflare collects, refer to [Cloudflare's Data Products](https://developers.cloudflare.com/fundamentals/data-products).
 
-You can have your request or event logs pushed to your cloud service provider using the **Logpush service**, which can be configured via the Cloudflare dashboard or an API.
+Push your request or event logs to your cloud service provider using [Logpush](/get-started/), which can be configured via the Cloudflare dashboard or API.
 
-If you're interested in logs of HTTP requests only, you can also download them using the **Logpull API**. The data from **Logpull** and **Logpush** is exactly the same.  As such, you're free to choose the method that’s most convenient.
+If you only want to see logs of HTTP requests, you can also use [Logpull](/logpull/). The data from **Logpull** and **Logpush** is exactly the same.
 
 Note that by default, Cloudflare does not retain your HTTP request logs. If you're a Spectrum customer, logs of Spectrum events are retained automatically.
diff --git a/products/logs/src/content/log-fields/index.md b/products/logs/src/content/log-fields/index.md
deleted file mode 100644
index 6fce9b6b843..00000000000
--- a/products/logs/src/content/log-fields/index.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Log fields
-order: 50
----
-
-import LogFieldsHTTPRequests from "./_partials/http_requests"
-import LogFieldsSpectrumEvents from "./_partials/spectrum_events"
-import LogFieldsFirewallEvents from "./_partials/firewall_events"
-
-# Log fields
-
-The tables below describe the fields available by log category. The list of fields is also accessible directly from the API:
-`https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields`, where the `dataset` argument indicates the log category (such as `http_requests`, `spectrum_events`, or `firewall_events`).
-
-Unless otherwise noted, fields are available in both Logpush v1 (Logpush prior to mid-2020) and Logpush v2 (all Logpush jobs after mid-2020).
-
-## HTTP requests
-
-<TableWrap>
-
-<LogFieldsHTTPRequests/>
-
-</TableWrap>
-
-## Spectrum events
-
-<TableWrap>
-
-<LogFieldsSpectrumEvents/>
-
-</TableWrap>
-
-## Firewall events
-
-<TableWrap>
-
-<LogFieldsFirewallEvents/>
-
-</TableWrap>
diff --git a/products/logs/src/content/logpull-api/additional-details/index.md b/products/logs/src/content/logpull-api/additional-details/index.md
deleted file mode 100644
index 4e853cb449c..00000000000
--- a/products/logs/src/content/logpull-api/additional-details/index.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: Additional details
-order: 18
----
-
-# Additional details
-
-## Estimating daily data volume
-
-To estimate the amount of data for a zone per day (the number of log lines and the amount of bytes they take up), request a 1% or 10% sample of data for a 1-hour period (use 10% if your volume is low). Note that `start=2018-12-15T00:00:00Z` and `end=2018-12-15T01:00:00Z` span a 1-hour period, and `sample=0.1`.
-
-```bash
-curl -s \
-    -H "X-Auth-Email: <REDACTED>" \
-    -H "X-Auth-Key: <REDACTED>" \
-    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2018-12-15T00:00:00Z&end=2018-12-15T01:00:00Z&sample=0.1" \
-    >sample.log
-...
-$ wc -l sample.log
-83 sample.log
-...
-$ ls -lh sample.log
--rw-r--r-- 1 mik mik 25K Dec 17 15:49 sample.log
-```
-
-Based on this information, the approximate number of messages/day is 19,920 (83*10*24), and the byte size is 6MB (25K*10*24). The size estimate is based on the default response field set. Changing the response field set (*see [Fields](/logpull-api/understanding-the-basics/#fields)*) will change the response size.
-
-To get a good estimate of daily traffic, it is best to get at least 30 log lines in your hourly sample. If the response size is too small (or too large), adjust the sample value, not the time range.
-
-## Compression
-
-Responses are compressed by default (gzip). `cURL` decompresses responses transparently, unless called with:
-
-`-H "accept-encoding: gzip"`
-
- In that case, the output remains gzipped. Compressed data is approximately 5-10% of its uncompressed size. This means that a 1GB uncompressed response gets compressed down to 50-100MB.
-
-## Service expectations
-
-### Successful requests
-
-If the response or timeout limit is exceeded or there is any problem fetching the response, a `200` status will be returned and the response will end with the non-JSON text line “Error streaming data.” Because responses are streamed, there is no way to identify the error ahead of time. A response is successful if it does not end with the “Error streaming data" text line.
-
-Once you receive a successful response for a given zone and time range, the following is true for all subsequent requests:
-
-* The number and content of returned records will be same
-* The order of records returned may (and is likely to) be different
-
-### Response fields
-
-Regarding the inclusion of the *fields* parameter:
-
-* When fields are explicitly included in the request URL, the fields returned will not change
-* When not specified in the URL, the default fields are returned
-* The default fields may change at any time
-
-### Limits
-
-The following usage restrictions apply:
-
-* **Rate limits:** exceeding these limit results in a `429` error response
-  - 15 requests/min per zone
-  - 180 requests/min per user (email address)
-* **Time range:** the maximum difference between the *start* and *end* parameters can be 1 hour
-* **Response size:** the maximum response size is 10GiB per request, which is equivalent to about 15M records when about 55 fields are selected (more records can be retrieved when less fields are selected because the per record size will be smaller)
-* **Timeout:** the response will fail with a terminated connection after 10 minutes
-* **Stream Timeout:** the request will be terminated with a `408` error response if the connection is idle for 30s. This timeout usually means that the request is probably too exhaustive (frequent timeouts (> 12/hr) will result in subsequent queries
-to be blocked with status code 429 for 1hr) and so:
-    * try requesting records using lesser number of fields
-    * try with smaller **start** and **end** parameters
diff --git a/products/logs/src/content/logpull-api/enabling-log-retention/index.md b/products/logs/src/content/logpull-api/enabling-log-retention/index.md
deleted file mode 100644
index 2db93c20790..00000000000
--- a/products/logs/src/content/logpull-api/enabling-log-retention/index.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-title: Enabling log retention
-order: 11
----
-
-# Enabling log retention
-
-By default, your HTTP request logs are not retained. When using the Logpull API for the first time, you'll need to enable retention. You can also turn off retention at any time. Note that after retention is turned off, previously saved logs will be available until the retention period expires (_see [Data retention period](/logpull-api/understanding-the-basics/#data-retention-period)_).
-
-## Endpoints
-
-There are two endpoints for managing log retention:
-
-- `GET /logs/control/retention/flag` - returns whether retention is on
-- `POST /logs/control/retention/flag` - turns retention on or off
-
-<Aside type="note" header="Note">
-
-To make a `POST` call, you must have a Cloudflare account role with "edit" permissions, such as Super Administrator, Administrator, or Log Share.
-</Aside>
-
-## Example API requests using cURL
-
-### Check whether log retention is turned on:
-
-```bash
-curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" GET "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/control/retention/flag" | jq .
-```
-
-#### Response
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "flag": false
-  },
-  "success": true
-}
-```
-
-### Turn on log retention:
-
-```bash
-curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/control/retention/flag" -d'{"flag":true}' | jq .
-```
-
-#### Parameters
-* *flag* - can be either `true` or `false`
-
-#### Response
-
-```bash
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "flag": true
-  },
-  "success": true
-}
-```
-
-## Audit
-
-Turning log retention on or off is recorded in **Cloudflare Audit Logs**.
\ No newline at end of file
diff --git a/products/logs/src/content/logpull-api/index.md b/products/logs/src/content/logpull-api/index.md
deleted file mode 100644
index 4f0cf186028..00000000000
--- a/products/logs/src/content/logpull-api/index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-title: Logpull API
-order: 10
----
-
-# Logpull API
-Cloudflare Logpull is a REST API for consuming request logs over HTTP. These logs contain data related to the connecting client, the request path through the Cloudflare network, and the response from the origin web server.  This data is useful for enriching existing logs on an origin server.
-
-Logpull is available to customers on the Enterprise plan.
\ No newline at end of file
diff --git a/products/logs/src/content/logpull-api/requesting-logs/index.md b/products/logs/src/content/logpull-api/requesting-logs/index.md
deleted file mode 100644
index 7a996c6b779..00000000000
--- a/products/logs/src/content/logpull-api/requesting-logs/index.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Requesting logs
-order: 14
----
-
-# Requesting logs
-
-## Endpoints
-
-The three endpoints the Logpull API supports are:
-
-* `GET /logs/received` - returns HTTP request log data based on the parameters specified
-* `GET /logs/received/fields` - returns the list of all available log fields
-* `GET /logs/rayids/<rayid>` - returns HTTP request log data matching `<rayid>`
-
-## Required authentication headers
-
-The following headers are required for all endpoint calls:
-
-* `X-Auth-Email` - the Cloudflare account email address associated with the domain
-* `X-Auth-Key` - the Cloudflare API key
-
-## Parameters
-
-The API expects endpoint parameters in the GET request query string.  See the example formats below.
-
-`logs/received`
-
-```bash
-https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/received?start=<unix|rfc3339>&end=<unix|rfc3339>[&count=<int>][&sample=<float>][&fields=<fields>][&timestamps=<string>]
-```
-
-`logs/rayids/<rayid>`
-
-```bash
-https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/rayids/<ray_id>?[&fields=<string>][&timestamps=<strings>]
-```
-
-The following table describes the parameters available:
-
-<TableWrap>
-
-| Parameter | Description | Applies to | Required? |
-|---|---|---|--|
-| <em>start</em> | <p>- Inclusive</p> <p>- Timestamp formatted as UNIX (UTC by definition), UNIX Nano, or rfc3339 (specifies time zone)</p> <p>- Must be no more than 7 days earlier than now</p> | /logs/received | Yes |
-| <em>end</em> | <p>- Exclusive</p> <p>- Same format as <em>start</em></p> <p>- Must be at least 1 minute earlier than now and later than <em>start</em></p> | /logs/received | Yes |
-| <em>count</em> | <p>- Return up to that many records</p> <p>- Do not include if returning all records</p> <p>- Results are not sorted; therefore, different data for repeated requests is likely</p> <p></p> <p>- Applies to number of total records returned, not number of sampled records</p> | /logs/received | No |
-| <em>sample</em> | <p>- Return only a sample of records</p> <p>- Do not include if returning all records</p> <p>- Value can range from 0.001 to 1.0 (inclusive)</p> <p>- <em>sample=0.1</em> means return 10% (1 in 10) of all records</p> <p>- Results are random; therefore, different numbers of results for repeated requests are likely</p> | /logs/received | No |
-| <em>fields</em> | <p>- Comma-separated list of fields to return</p> <p>- If empty, the default list is returned</p> | <p>/logs/received</p> <p>/logs/rayids</p> | No |
-| <em>timestamps</em> | <p>- Format in which timestamp fields will be returned</p> <p>- Value options are: <em>unixnano</em> (default), <em>unix</em>, <em>rfc3339</em></p> <p>- Timestamps retuned as integers for <em>unix</em> and <em>unixnano</em> and as strings for <em>rfc3339</em></p> | <p>/logs/received</p> <p>/logs/rayids</p> | No |
-
-</TableWrap>
-
-<Aside type="note" header="Note">
-
-The maximum time range from <em>start</em> to <em>end</em> can't exceed 1 hour. Because <em>start</em> is inclusive and <em>end</em> is exclusive, to get all the data for every minute, starting at 10AM, the proper values are:
-
-`start=2018-05-15T10:00:00Z&end=2018-05-15T10:01:00Z`, then `start=2018-05-15T10:01:00Z&end=2018-05-15T10:02:00Z` and so on.
-
-The overlap will be handled correctly.
-</Aside>
-
-## Example API requests using cURL
-
-`logs/received`
-
-```bash
-curl -s \
-    -H "X-Auth-Email: <REDACTED>" \
-    -H "X-Auth-Key: <REDACTED>" \
-    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2017-07-18T22:00:00Z&end=2017-07-18T22:01:00Z&count=1&fields=RayID,ClientIP"
-```
-
-`logs/rayids`
-
-```bash
-curl -s \
-    -H "X-Auth-Email: <REDACTED>" \
-    -H "X-Auth-Key: <REDACTED>" \
-    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/rayids/47ff6e2c812d3ccb?timestamps=rfc3339"
-```
-
-<Aside type="note" header="Note">
-
-The IATA code returned as part of the Ray ID does not need to included in the request. For example: if you have a RayID such as `49ddb3e70e665831-DFW` only include `49ddb3e70e665831` in your request.
-</Aside>
-
-## Fields
-
-Unless specified in the <em>fields parameter</em>, the API returns a limited set of log fields. This default field set may change at any time. The list of all available fields is at:
-
-`https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/received/fields`
-
-The order in which fields are specified doesn't matter, and the order of fields in the response is not specified.
-
-Using <em>Bash</em> subshell and <em>jq</em>, you can download the logs with all available fields without manually copying and pasting the fields into the request. For example:
-
-```bash
-curl -s \
-    -H "X-Auth-Email: <REDACTED>" \
-    -H "X-Auth-Key: <REDACTED>" \
-    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2017-07-18T22:00:00Z&end=2017-07-18T22:01:00Z&count=1&fields=$(curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received/fields" | jq '. | to_entries[] | .key' -r | paste -sd "," -)"
-```
-
-*See [HTTP request fields](/log-fields/#http-requests)* for the currently available fields.
\ No newline at end of file
diff --git a/products/logs/src/content/logpull-api/understanding-the-basics/index.md b/products/logs/src/content/logpull-api/understanding-the-basics/index.md
deleted file mode 100644
index 152c56c082e..00000000000
--- a/products/logs/src/content/logpull-api/understanding-the-basics/index.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Understanding the basics
-order: 12
----
-
-# Understanding the basics
-
-## Data retention period
-
-You can query for logs starting from 1 minute in the past (relative to the actual time that you're making the query) and going back at least 3 days and up to 7 days.
-
-## Access pattern
-
-The basic access pattern is *give me all the logs for zone Z for minute M* where the minute *M* refers to the time the log entries were written to disk in Cloudflare's log aggregation system.
-
-Try running your query every minute to start. If responses are too small, go up to 5 minutes as this will be appropriate for most zones. If the responses are too large, trying going down to 15 seconds.
-
-If your zone has so many logs that it takes longer than 1 minute to read 1 minute worth of logs, run 2 workers staggered, each requesting 1 minute worth of logs every 2 minutes.
-
-Data returned by the API will not change on repeat calls. The order of messages in the response may be different, but the number and content of the messages will always be the same for a given query as long as the response code is 200 and there is no error reading the response body.
-
-Because our log processing system ingests data in batches, most zones with less than 1 million requests per minute will have "empty" minutes. Queries for such a minute result in responses with status 200 but no data in the body. This does not mean that there were no requests proxied by Cloudflare for that minute. It just means that our system did not process a batch of logs for that zone in that minute.
-
-## Order of the data returned
-
-The `logs/received` API endpoint exposes data by time received, which is the time the event was written to disk in the Cloudflare Logs aggregation system.
-
-Ordering by log aggregation time instead of log generation time results in lower (faster) log pipeline latency and deterministic log pulls. Functionally, it is similar to tailing a log file or reading from *rsyslog* (albeit in chunks).
-
-This means that to obtain logs for a given time range, you can issue one call for each consecutive minute (or other time range). Because log lines are batched by time received and made available, there is no late arriving data. A response for a given minute will never change. You do not have to repeatedly poll a given time range to receive logs as they converge on our aggregation system.
-
-## Format of the data returned
-
-The Logpull API returns data in NDJSON format, whereby each log line is a valid JSON object. Major analysis tools like Google BigQuery and AWS Kinesis require this format.
-
-To turn the resulting log data into a JSON array with one array element per log line, you can use the *jq* tool.  Essentially, you pipe the API response into *jq* using the *slurp* (or simply *s*) flag:
-
-`<API request data> | jq -s`
-
-Below is a sample log with default fields:
-
-```bash
-{
-    "ClientIP": "89.163.242.206",
-    "ClientRequestHost": "www.theburritobot.com",
-    "ClientRequestMethod": "GET",
-    "ClientRequestURI": "/static/img/testimonial-hipster.png",
-    "EdgeEndTimestamp": 1506702504461999900,
-    "EdgeResponseBytes": 69045,
-    "EdgeResponseStatus": 200,
-    "EdgeStartTimestamp": 1506702504433000200,
-    "RayID": "3a6050bcbe121a87"
-}
-```
\ No newline at end of file
diff --git a/products/logs/src/content/logpull/additional-details/index.md b/products/logs/src/content/logpull/additional-details/index.md
new file mode 100644
index 00000000000..d5ec8eb6b02
--- /dev/null
+++ b/products/logs/src/content/logpull/additional-details/index.md
@@ -0,0 +1,70 @@
+---
+order: 18
+pcx-content-type: reference
+---
+
+# Additional details
+
+## Estimating daily data volume
+
+To estimate the amount of data for a zone per day (the number of log lines and the amount of bytes they take up), request a 1% or 10% sample of data for a 1-hour period (use 10% if your volume is low). Note that `start=2018-12-15T00:00:00Z` and `end=2018-12-15T01:00:00Z` span a 1-hour period, and `sample=0.1`.
+
+```bash
+curl -s \
+    -H "X-Auth-Email: <REDACTED>" \
+    -H "X-Auth-Key: <REDACTED>" \
+    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2018-12-15T00:00:00Z&end=2018-12-15T01:00:00Z&sample=0.1" \
+    >sample.log
+...
+$ wc -l sample.log
+83 sample.log
+...
+$ ls -lh sample.log
+-rw-r--r-- 1 mik mik 25K Dec 17 15:49 sample.log
+```
+
+Based on this information, the approximate number of messages/day is 19,920 (83*10*24), and the byte size is 6MB (25K*10*24). The size estimate is based on the default response field set. Changing the response field set (*see [Fields](/logpull/understanding-the-basics/#fields)*) will change the response size.
+
+To get a good estimate of daily traffic, it is best to get at least 30 log lines in your hourly sample. If the response size is too small (or too large), adjust the sample value, not the time range.
+
+## Compression
+
+Responses are compressed by default (gzip). `cURL` decompresses responses transparently, unless called with:
+
+`-H "accept-encoding: gzip"`
+
+ In that case, the output remains gzipped. Compressed data is approximately 5-10% of its uncompressed size. This means that a 1GB uncompressed response gets compressed down to 50-100MB.
+
+## Service expectations
+
+### Successful requests
+
+If the response or timeout limit is exceeded or there is any problem fetching the response, a `200` status will be returned and the response will end with the non-JSON text line “Error streaming data.” Because responses are streamed, there is no way to identify the error ahead of time. A response is successful if it does not end with the “Error streaming data" text line.
+
+Once you receive a successful response for a given zone and time range, the following is true for all subsequent requests:
+
+* The number and content of returned records will be same
+* The order of records returned may (and is likely to) be different
+
+### Response fields
+
+Regarding the inclusion of the *fields* parameter:
+
+* When fields are explicitly included in the request URL, the fields returned will not change
+* When not specified in the URL, the default fields are returned
+* The default fields may change at any time
+
+### Limits
+
+The following usage restrictions apply:
+
+* **Rate limits:** exceeding these limit results in a `429` error response
+  - 15 requests/min per zone
+  - 180 requests/min per user (email address)
+* **Time range:** the maximum difference between the *start* and *end* parameters can be 1 hour
+* **Response size:** the maximum response size is 10GiB per request, which is equivalent to about 15M records when about 55 fields are selected (more records can be retrieved when less fields are selected because the per record size will be smaller)
+* **Timeout:** the response will fail with a terminated connection after 10 minutes
+* **Stream Timeout:** the request will be terminated with a `408` error response if the connection is idle for 30s. This timeout usually means that the request is probably too exhaustive (frequent timeouts (> 12/hr) will result in subsequent queries
+to be blocked with status code 429 for 1hr) and so:
+    * try requesting records using lesser number of fields
+    * try with smaller **start** and **end** parameters
diff --git a/products/logs/src/content/logpull/enabling-log-retention/index.md b/products/logs/src/content/logpull/enabling-log-retention/index.md
new file mode 100644
index 00000000000..98577190d13
--- /dev/null
+++ b/products/logs/src/content/logpull/enabling-log-retention/index.md
@@ -0,0 +1,67 @@
+---
+order: 12
+pcx-content-type: interim
+---
+
+# Enabling log retention
+
+By default, your HTTP request logs are not retained. When using the Logpull API for the first time, you will need to enable retention. You can also turn off retention at any time. Note that after retention is turned off, previously saved logs will be available until the retention period expires (_see [Data retention period](/logpull/understanding-the-basics/#data-retention-period)_).
+
+## Endpoints
+
+There are two endpoints for managing log retention:
+
+- `GET /logs/control/retention/flag` - returns whether retention is on
+- `POST /logs/control/retention/flag` - turns retention on or off
+
+<Aside type="note" header="Note">
+
+To make a `POST` call, you must have a Cloudflare account role with "edit" permissions, such as Super Administrator, Administrator, or Log Share.
+</Aside>
+
+## Example API requests using cURL
+
+### Check whether log retention is turned on:
+
+```bash
+curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" GET "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/control/retention/flag" | jq .
+```
+
+#### Response
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "flag": false
+  },
+  "success": true
+}
+```
+
+### Turn on log retention:
+
+```bash
+curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/control/retention/flag" -d'{"flag":true}' | jq .
+```
+
+#### Parameters
+* *flag* - can be either `true` or `false`
+
+#### Response
+
+```bash
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "flag": true
+  },
+  "success": true
+}
+```
+
+## Audit
+
+Turning log retention on or off is recorded in **Cloudflare Audit Logs**.
\ No newline at end of file
diff --git a/products/logs/src/content/logpull/index.md b/products/logs/src/content/logpull/index.md
new file mode 100644
index 00000000000..267570d52a7
--- /dev/null
+++ b/products/logs/src/content/logpull/index.md
@@ -0,0 +1,11 @@
+---
+order: 120
+pcx-content-type: concept
+---
+
+# Logpull
+Cloudflare Logpull is a REST API for consuming request logs over HTTP. These logs contain data related to the connecting client, the request path through the Cloudflare network, and the response from the origin web server.  This data is useful for enriching existing logs on an origin server.
+
+Logpull is available to customers on the Enterprise plan.
+
+<DirectoryListing path="/logpull"/>
\ No newline at end of file
diff --git a/products/logs/src/content/logpull/requesting-logs/index.md b/products/logs/src/content/logpull/requesting-logs/index.md
new file mode 100644
index 00000000000..b283a5b17de
--- /dev/null
+++ b/products/logs/src/content/logpull/requesting-logs/index.md
@@ -0,0 +1,105 @@
+---
+order: 14
+pcx-content-type: interim
+---
+
+# Requesting logs
+
+## Endpoints
+
+The three endpoints the Logpull API supports are:
+
+* `GET /logs/received` - returns HTTP request log data based on the parameters specified
+* `GET /logs/received/fields` - returns the list of all available log fields
+* `GET /logs/rayids/<rayid>` - returns HTTP request log data matching `<rayid>`
+
+## Required authentication headers
+
+The following headers are required for all endpoint calls:
+
+* `X-Auth-Email` - the Cloudflare account email address associated with the domain
+* `X-Auth-Key` - the Cloudflare API key
+
+## Parameters
+
+The API expects endpoint parameters in the GET request query string.  See the example formats below.
+
+`logs/received`
+
+```bash
+https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/received?start=<unix|rfc3339>&end=<unix|rfc3339>[&count=<int>][&sample=<float>][&fields=<fields>][&timestamps=<string>]
+```
+
+`logs/rayids/<rayid>`
+
+```bash
+https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/rayids/<ray_id>?[&fields=<string>][&timestamps=<strings>]
+```
+
+The following table describes the parameters available:
+
+<TableWrap>
+
+| Parameter | Description | Applies to | Required? |
+|---|---|---|--|
+| <em>start</em> | <p>- Inclusive</p> <p>- Timestamp formatted as UNIX (UTC by definition), UNIX Nano, or rfc3339 (specifies time zone)</p> <p>- Must be no more than 7 days earlier than now</p> | /logs/received | Yes |
+| <em>end</em> | <p>- Exclusive</p> <p>- Same format as <em>start</em></p> <p>- Must be at least 1 minute earlier than now and later than <em>start</em></p> | /logs/received | Yes |
+| <em>count</em> | <p>- Return up to that many records</p> <p>- Do not include if returning all records</p> <p>- Results are not sorted; therefore, different data for repeated requests is likely</p> <p></p> <p>- Applies to number of total records returned, not number of sampled records</p> | /logs/received | No |
+| <em>sample</em> | <p>- Return only a sample of records</p> <p>- Do not include if returning all records</p> <p>- Value can range from 0.001 to 1.0 (inclusive)</p> <p>- <em>sample=0.1</em> means return 10% (1 in 10) of all records</p> <p>- Results are random; therefore, different numbers of results for repeated requests are likely</p> | /logs/received | No |
+| <em>fields</em> | <p>- Comma-separated list of fields to return</p> <p>- If empty, the default list is returned</p> | <p>/logs/received</p> <p>/logs/rayids</p> | No |
+| <em>timestamps</em> | <p>- Format in which timestamp fields will be returned</p> <p>- Value options are: <em>unixnano</em> (default), <em>unix</em>, <em>rfc3339</em></p> <p>- Timestamps retuned as integers for <em>unix</em> and <em>unixnano</em> and as strings for <em>rfc3339</em></p> | <p>/logs/received</p> <p>/logs/rayids</p> | No |
+
+</TableWrap>
+
+<Aside type="note" header="Note">
+
+The maximum time range from <em>start</em> to <em>end</em> can't exceed 1 hour. Because <em>start</em> is inclusive and <em>end</em> is exclusive, to get all the data for every minute, starting at 10AM, the proper values are:
+
+`start=2018-05-15T10:00:00Z&end=2018-05-15T10:01:00Z`, then `start=2018-05-15T10:01:00Z&end=2018-05-15T10:02:00Z` and so on.
+
+The overlap will be handled correctly.
+</Aside>
+
+## Example API requests using cURL
+
+`logs/received`
+
+```bash
+curl -s \
+    -H "X-Auth-Email: <REDACTED>" \
+    -H "X-Auth-Key: <REDACTED>" \
+    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2017-07-18T22:00:00Z&end=2017-07-18T22:01:00Z&count=1&fields=RayID,ClientIP"
+```
+
+`logs/rayids`
+
+```bash
+curl -s \
+    -H "X-Auth-Email: <REDACTED>" \
+    -H "X-Auth-Key: <REDACTED>" \
+    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/rayids/47ff6e2c812d3ccb?timestamps=rfc3339"
+```
+
+<Aside type="note" header="Note">
+
+The IATA code returned as part of the Ray ID does not need to included in the request. For example: if you have a RayID such as `49ddb3e70e665831-DFW` only include `49ddb3e70e665831` in your request.
+</Aside>
+
+## Fields
+
+Unless specified in the <em>fields parameter</em>, the API returns a limited set of log fields. This default field set may change at any time. The list of all available fields is at:
+
+`https://api.cloudflare.com/client/v4/zones/<zone_id>/logs/received/fields`
+
+The order in which fields are specified doesn't matter, and the order of fields in the response is not specified.
+
+Using <em>Bash</em> subshell and <em>jq</em>, you can download the logs with all available fields without manually copying and pasting the fields into the request. For example:
+
+```bash
+curl -s \
+    -H "X-Auth-Email: <REDACTED>" \
+    -H "X-Auth-Key: <REDACTED>" \
+    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2017-07-18T22:00:00Z&end=2017-07-18T22:01:00Z&count=1&fields=$(curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received/fields" | jq '. | to_entries[] | .key' -r | paste -sd "," -)"
+```
+
+*See [HTTP request fields](/reference/log-fields/#http-requests)* for the currently available fields.
\ No newline at end of file
diff --git a/products/logs/src/content/logpull/understanding-the-basics/index.md b/products/logs/src/content/logpull/understanding-the-basics/index.md
new file mode 100644
index 00000000000..9144fdc04f7
--- /dev/null
+++ b/products/logs/src/content/logpull/understanding-the-basics/index.md
@@ -0,0 +1,54 @@
+---
+order: 11
+pcx-content-type: interim
+---
+
+# Understanding the basics
+
+## Access pattern
+
+The basic access pattern is *give me all the logs for zone Z for minute M* where the minute *M* refers to the time the log entries were written to disk in Cloudflare's log aggregation system.
+
+Try running your query every minute to start. If responses are too small, go up to 5 minutes as this will be appropriate for most zones. If the responses are too large, trying going down to 15 seconds.
+
+If your zone has so many logs that it takes longer than 1 minute to read 1 minute worth of logs, run 2 workers staggered, each requesting 1 minute worth of logs every 2 minutes.
+
+Data returned by the API will not change on repeat calls. The order of messages in the response may be different, but the number and content of the messages will always be the same for a given query as long as the response code is 200 and there is no error reading the response body.
+
+Because our log processing system ingests data in batches, most zones with less than 1 million requests per minute will have "empty" minutes. Queries for such a minute result in responses with status 200 but no data in the body. This does not mean that there were no requests proxied by Cloudflare for that minute. It just means that our system did not process a batch of logs for that zone in that minute.
+
+## Order of the data returned
+
+The `logs/received` API endpoint exposes data by time received, which is the time the event was written to disk in the Cloudflare Logs aggregation system.
+
+Ordering by log aggregation time instead of log generation time results in lower (faster) log pipeline latency and deterministic log pulls. Functionally, it is similar to tailing a log file or reading from *rsyslog* (albeit in chunks).
+
+This means that to obtain logs for a given time range, you can issue one call for each consecutive minute (or other time range). Because log lines are batched by time received and made available, there is no late arriving data. A response for a given minute will never change. You do not have to repeatedly poll a given time range to receive logs as they converge on our aggregation system.
+
+## Format of the data returned
+
+The Logpull API returns data in NDJSON format, whereby each log line is a valid JSON object. Major analysis tools like Google BigQuery and AWS Kinesis require this format.
+
+To turn the resulting log data into a JSON array with one array element per log line, you can use the *jq* tool.  Essentially, you pipe the API response into *jq* using the *slurp* (or simply *s*) flag:
+
+`<API request data> | jq -s`
+
+Below is a sample log with default fields:
+
+```bash
+{
+    "ClientIP": "89.163.242.206",
+    "ClientRequestHost": "www.theburritobot.com",
+    "ClientRequestMethod": "GET",
+    "ClientRequestURI": "/static/img/testimonial-hipster.png",
+    "EdgeEndTimestamp": 1506702504461999900,
+    "EdgeResponseBytes": 69045,
+    "EdgeResponseStatus": 200,
+    "EdgeStartTimestamp": 1506702504433000200,
+    "RayID": "3a6050bcbe121a87"
+}
+```
+
+## Data retention period
+
+You can query for logs starting from 1 minute in the past (relative to the actual time that you make the query) and going back at least 3 days and up to 7 days.
\ No newline at end of file
diff --git a/products/logs/src/content/logpush/aws-s3/index.md b/products/logs/src/content/logpush/aws-s3/index.md
deleted file mode 100644
index d7a74eb243c..00000000000
--- a/products/logs/src/content/logpush/aws-s3/index.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Enable Amazon S3
-order: 55
----
-
-# Enable Amazon S3
-
-Cloudflare uses Amazon Identity and Access Management (IAM) to gain access to your S3 bucket. The Cloudflare IAM user needs *PutObject* permission for the bucket.
-
-Logs are written into that bucket as gzipped objects using the S3 Access Control List (ACL)
-*Bucket-owner-full-control* permission.
-
-For illustrative purposes, imagine that you want to store logs in the bucket *burritobot*, in the *logs* directory. The S3 URL would then be `s3://burritobot/logs`.
-
-To enable Logpush to Amazon S3:
-
-1. Create an S3 bucket. *See [instructions from Amazon](https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html)*. Note: buckets in China regions (cn-north-1, cn-northwest-1) are currently not supported.
-
-2. Edit and paste the policy below into **S3** > **Bucket** > **Permissions** > **Bucket Policy** (make sure to replace the *Resource* value with your own bucket path):
-
-```json
-{
-  "Id": "Policy1506627184792",
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "Stmt1506627150918",
-      "Action": [
-        "s3:PutObject"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:s3:::burritobot/logs/*",
-      "Principal": {
-        "AWS": [
-          "arn:aws:iam::391854517948:user/cloudflare-logpush"
-        ]
-      }
-    }
-  ]
-}
-```
-
-<Aside type="note" header="Note">
-
-Logpush uses multipart upload for S3. Aborted uploads will result in incomplete files remaining in your bucket. To minimize your storage costs, Amazon recommends configuring a lifecycle rule using the `AbortIncompleteMultipartUpload` action. *See [Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Policy](https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)*.
-</Aside>
diff --git a/products/logs/src/content/logpush/azure/index.md b/products/logs/src/content/logpush/azure/index.md
deleted file mode 100644
index 293df711b5f..00000000000
--- a/products/logs/src/content/logpush/azure/index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: Enable Microsoft Azure
-order: 62
----
-
-# Enable Microsoft Azure
-
-Cloudflare uses a service-level shared access signature (SAS) to gain access to your Blob Storage container. You'll need to provide *Write* permission and an expiration period of at least 5 years, which will allow you to not worry about the SAS token expiring.
-
-To enable Logpush to Azure:
-
-1. Create a Blob Storage container. *See [instructions from Azure](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal)*.
-
-2. Create a shared access signature (SAS). To learn about shared access signatures, *see [information from Azure](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)*. Logpush requires a *service-level SAS*, which provides the most restricted access. To create a service-level SAS, *see [instructions from Azure](https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas)* or use the *Storage Explorer* feature in your storage account portal. Select *Storage Explorer*, navigate to and then right-click on your blob container to see the *Get Shared Access Signature* option. Select that option, set an expiry time of at least 5 years, and select only *Write* permission.
-
-3. Provide the SAS URL when prompted by the Logpush API or UI.
-
-<Aside type="note" header="Note">
-
-Logpush will stop pushing logs if your SAS token expires, which is why an expiration period of at least 5 years is required. You can always update your Logpush job with a new token if needed.
-</Aside>
diff --git a/products/logs/src/content/logpush/datadog/index.md b/products/logs/src/content/logpush/datadog/index.md
deleted file mode 100644
index b61e03aff57..00000000000
--- a/products/logs/src/content/logpush/datadog/index.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-title: Enable Datadog
-order: 58
----
-
-# Enable Logpush to Datadog
-
-Cloudflare Logpush now supports pushing logs directly to Datadog via API.
-
-To set up a Datadog Logpush job:
-1. Create a job with the appropriate endpoint URL and authentication parameters
-2. Enable the job to begin pushing logs
-
-<Aside type="note" header="Note">
-
-Note: Unlike configuring Logpush jobs for AWS S3, GCS, or Azure, there is no ownership challenge when configuring Logpush to Datadog. 
-
-</Aside>
-
-## 1. Create a job
-
-To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
-* `name` (optional) - Use your domain name as the job name.
-* `destination_conf` - A log destination consisting of an endpoint URL, authorization header, and zero or more optional parameters that Datadog supports in the string format below. 
-
-  * `<DATADOG-ENDPOINT-URL>`: The Datadog http logs intake endpoint, which is 'http-intake.logs.datadoghq.com/v1/input' 
-  * `<DATADOG-API-KEY>`: The Datadog API token. For example, '20e6d94e8c57924ad1be3c29bcaee0197d"
-  * `service`, `host`, `ddsource`, `ddtags`: Optional parameters allowed by Datadog
-
-```bash
-"datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>&service=<SERVICE>&host=<HOST>&ddsource=<SOURCE>"
-```
-
-* `dataset` - the category of logs you want to receive. See [Log fields](https://developers.cloudflare.com/logs/log-fields) for the full list of supported datasets. 
-* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](https://developers.cloudflare.com/logs/logpush/logpush-configuration-api/understanding-logpush-api#options)
-
-Example request using cURL:
-
-```bash
-curl -s -X POST \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
--H "X-Auth-Email: user@example.com" \
--H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
--d '{"name":"<DOMAIN_NAME>",
-"destination_conf":"datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",  "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": false,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-## 2. Enable (update) a job
-
-To enable a  job, make a `PUT` request to the Logpush jobs endpoint. You’ll use the job ID returned from the previous step in the URL and send `{"enabled": true}` in the request body.
-
-Example request using cURL:
-
-```bash
-curl -s -X PUT \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": true,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "datadog://<DATADOG-ENDPOINT-URL>?header_DD-API-KEY=<DATADOG-API-KEY>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-## Troubleshooting
-
-### I am observing errors pushing to Datadog after I modify an existing job for another destination to push logs to Datadog.
-Datadog destination is exclusive to new jobs and might not be backward compatible with older jobs. Create new jobs if you expect to send your logs directly to Datadog instead of modifying already existing ones.
diff --git a/products/logs/src/content/logpush/google-cloud-storage/index.md b/products/logs/src/content/logpush/google-cloud-storage/index.md
deleted file mode 100644
index 3090a4befa0..00000000000
--- a/products/logs/src/content/logpush/google-cloud-storage/index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Enable Google Cloud Storage
-order: 60
----
-
-# Enable Google Cloud Storage
-
-Cloudflare uses Google Cloud Identity and Access Management (IAM) to gain access to your bucket. The Cloudflare IAM service account needs admin permission for the bucket.
-
-To enable Logpush to GCS:
-
-1. Create a GCS bucket. *See [instructions from GCS](https://cloud.google.com/storage/docs/creating-buckets#storage-create-bucket-console)*.
-
-2. In **Storage** > **Browser** > **Bucket** > **Permissions**, add the member `logpush@cloudflare-data.iam.gserviceaccount.com` with *Storage Object Admin* permission.
-
-<Aside type="note" header="Note">
-
-Logpush will not work if there is a retention policy on your bucket because this policy prevents overwrites. If you're using the policy to enforce deletion, you can use a lifecycle rule instead. *See [object lifecycle management from GCS](https://cloud.google.com/storage/docs/lifecycle)*.
-</Aside>
diff --git a/products/logs/src/content/logpush/index.md b/products/logs/src/content/logpush/index.md
deleted file mode 100644
index 4048db7ca75..00000000000
--- a/products/logs/src/content/logpush/index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Logpush Service
-order: 40
----
-
-# Logpush Service
-
-## Overview
-
-Push logs of Cloudflare's datasets to your cloud service in batches. Logpush is available to customers on Cloudflare's Enterprise plan.
-
-Logpush delivers each batch of logs as a gzipped file containing data in newline-delimited JSON format (or [JSON lines](https://jsonlines.org/)) to your destination as soon as possible, generally in less than one minute.
-
-These batches contain no more than 100,000 records per file. That limit may be raised in the future. There is no minimum batch size, and Logpush may deliver more than one file per minute. The number of files delivered depends on the number of logs that need to be delivered. More logs equals more batches and therefore more files. The number of files also depends on the number of Cloudflare log-processing servers needed to handle the volume of logs.
-
-Prior to mid-2020, Logpush sent logs once every five minutes (referred to as Logpush v1). The change to more frequent log pushing allows Cloudflare to deliver information to you as close to real time as possible in smaller files. You may receive log files that contain fewer lines - that’s expected. If you have legacy Logpush jobs configured to the old settings, use the Logpush API to upgrade your job to Logpush v2.  
-
-## Get started
-Configure Logpush using the [Cloudflare UI (Dashboard)](/logpush/logpush-dashboard/) or [API](/logpush/logpush-configuration-api/).
-
-If enabling via the API, you can push to the following storage services:
-- [AWS S3](/logpush/aws-s3/)
-- [S3-compatible endpoints](/logpush/s3-compatible-endpoints)
-- [Google Cloud Storage](/logpush/google-cloud-storage/)
-- [Microsoft Azure Blob Storage](/logpush/azure/)
-
-You also can push to the following SIEMs and log management providers:
-- [Datadog](/logpush/datadog)
-- [Splunk](/logpush/splunk)
-- [Sumo Logic](/logpush/sumo-logic/)
-
-Cloudflare aims to support additional plans and services in the future. Interested in a particular service? Take this [survey](https://goo.gl/forms/0KpMfae63WMPjBmD2).
diff --git a/products/logs/src/content/logpush/logpush-configuration-api/index.md b/products/logs/src/content/logpush/logpush-configuration-api/index.md
deleted file mode 100644
index 28a566ffc5e..00000000000
--- a/products/logs/src/content/logpush/logpush-configuration-api/index.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Manage via the Logpush API
-order: 50
----
-
-# Manage via the Logpush API
-
-The **Cloudflare Logpush API** allows you to configure and manage jobs via create, retrieve, update, and delete operations (CRUD).
-
-With Logpush, you can create a job to upload logs of your HTTP requests, Spectrum events, or Firewall events in batches as soon as possible to your cloud service provider. The API allows one job per data set per domain.
-
-To get started:
-
-1. Set up a storage provider and grant Cloudflare access. For specific instructions:
-
-   - [Enable Amazon S3](/logpush/aws-s3/)
-   - [Enable Datadog](/logpush/datadog/)
-   - [Enable Google Cloud Storage](/logpush/google-cloud-storage/)
-   - [Enable Microsoft Azure](/logpush/azure/)
-   - [Enable Splunk](/logpush/splunk/)
-   - [Enable Sumo Logic](/logpush/sumo-logic/)
-   - [Enable S3-compatible endpoints](/logpush/s3-compatible-endpoints/)
-
-2. Have your Cloudflare API credentials and other information handy, including:
-
-   - Email address
-   - Cloudflare API key
-   - Zone ID
-   - Destination access details for your cloud service provider
-
-Next, to configure your Logpush job via the API, consult the following resources:
-
-- [Understanding the Logpush API](/logpush/logpush-configuration-api/understanding-logpush-api/)
-- [Tutorial - Manage Logpush with cURL](/tutorials/tutorial-logpush-curl/)
-- [Example - Logpush using Python](/tutorials/example-logpush-python/)
diff --git a/products/logs/src/content/logpush/logpush-configuration-api/understanding-logpush-api.md b/products/logs/src/content/logpush/logpush-configuration-api/understanding-logpush-api.md
deleted file mode 100644
index 8771c105b04..00000000000
--- a/products/logs/src/content/logpush/logpush-configuration-api/understanding-logpush-api.md
+++ /dev/null
@@ -1,170 +0,0 @@
----
-title: Understanding the Logpush API
-order: 61
----
-
-# Understanding the Logpush API
-
-## Endpoints
-
-The table below summarizes the job operations available.
-
-The `<zone_id>` argument is the zone id (hexadecimal string), which can be found using [API's zones endpoint](https://api.cloudflare.com/#getting-started-resource-ids).
-The `<job>` argument is the numeric job id. The `<dataset>` argument indicates the log category (such as `http_requests`, `spectrum_events`, or `firewall_events`).
-
-<TableWrap>
-
-| Operation | Description | URL |
-|---|---|---|
-| POST | Create job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs</em> |
-| GET | Retrieve job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
-| GET | Retrieve all jobs for all data sets | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs</em> |
-| GET | Retrieve all jobs for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/jobs</em> |
-| GET | Retrieve all available fields for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/fields</em> |
-| GET | Retrieve all default fields for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/fields/default</em> |
-| PUT | Update job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
-| DELETE | Delete job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
-| POST | Check whether destination exists | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/validate/destination/exists</em> |
-| POST | Get ownership challenge | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/ownership</em> |
-| POST | Validate ownership challenge | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/ownership/validate</em> |
-| POST | Validate log options | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/validate/origin</em> |
-
-</TableWrap>
-
-For concrete examples, see the tutorial [Manage Logpush with cURL](/tutorials/tutorial-logpush-curl/).
-
-## Connecting
-
-The Logpush API requires credentials like any other Cloudflare API.
-
-```bash
-$ curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" \
-    'https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs'
-```
-
-## Ownership
-
-Before creating a new job, ownership of the destination must be proven.
-
-To issue an ownership challenge token to your destination:
-
-```bash
-$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/ownership -d '{"destination_conf":"s3://<BUCKET_PATH>?region=us-west-2"}' | jq .
-```
-
-A challenge file will be written to the destination, and the filename will be in the response (the filename may be expressed as a path if appropriate for your destination):
-
-```bash
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "valid": true,
-    "message": "",
-    "filename": "<path-to-challenge-file>.txt"
-  },
-  "success": true
-}
-```
-
-You will need to provide the token contained in the file when creating a job.
-
-<Aside type="note" header="Note">
-
-When using Sumo Logic, you may find it helpful to have [Live Tail](https://help.sumologic.com/05Search/Live-Tail/About-Live-Tail) open to see the challenge file as soon as it's uploaded.
-</Aside>
-
-## Destination
-
-You can specify your cloud service provider destination via the required `destination_conf` parameter.
-
-* **AWS S3**: bucket + optional directory + region + optional encryption parameter (if required by your policy); for example: `s3://bucket/[dir]?region=<region>[&sse=AES256]`
-* **Datadog**: Datadog endpoint URL + Datadog API key + optional parameters; for example: `datadog://<DATADOG-ENDPOINT-URL>?header_DD-API_KEY=<DATADOG-API-KEY>&service=<SERVICE>&host=<HOST>&ddsource=<SOURCE>`
-* **Google Cloud Storage**: bucket + optional directory; for example: `gs://bucket/[dir]`
-* **Microsoft Azure**: service-level SAS URL with `https` replaced by `azure` + optional directory added before query string; for example: `azure://<BlobContainerPath>/[dir]?<QueryString>`
-* **Splunk**: Splunk endpoint URL + Splunk channel ID + insecure-skip-verify flag + Splunk sourcetype + Splunk authorization token; for example: `splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>`
-* **Sumo Logic**: HTTP source address URL with `https` replaced by `sumo`; for example: `sumo://<SumoEndpoint>/receiver/v1/http/<UniqueHTTPCollectorCode>`
-
-For S3, Google Cloud Storage, and Azure, logs can be separated into daily subdirectories by using the special string `{DATE}` in the URL path; for example: `s3://mybucket/logs/{DATE}?region=us-east-1&sse=AES256` or `azure://myblobcontainer/logs/{DATE}?[QueryString]`. It will be substituted with the date in `YYYYMMDD` format, like `20180523`.
-
-For more information on the value for your cloud storage provider, consult the following conventions:
-
-* [AWS S3 CLI](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html) (S3Uri path argument type)
-* [Google Cloud Storage CLI](https://cloud.google.com/storage/docs/gsutil) (Syntax for accessing resources)
-* [Microsoft Azure Shared Access Signature](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
-* [Sumo Logic HTTP Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source)
-
-To check if a destination is already in use:
-
-```bash
-$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/destination/exists -d '{"destination_conf":"s3://foo"}' | jq .
-```
-
-### Response
-
-```bash
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "exists": false
-  },
-  "success": true
-}
-```
-
-There can be only 1 job writing to each unique destination. For S3 and GCS, a destination is defined as bucket + path. This means two jobs can write to the same bucket, but must write to different subdirectories in that bucket.
-
-## Job object
-
-<Aside type="info" header="Info">
-
-See a detailed description of the [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties).
-</Aside>
-
-## Options
-
-Logpush repeatedly pulls logs on your behalf and uploads them to your destination.
-
-Log options, such as fields or sampling rate, are configured in the `logpull_options` job parameter (*see [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties)*). For example, the following query gets data from the Logpull API:
-
-```bash
-curl -sv \
-    -H'X-Auth-Email: <REDACTED>' \
-    -H'X-Auth-Key: <REDACTED>' \
-    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2018-08-02T10:00:00Z&end=2018-08-02T10:01:00Z&fields=RayID,EdgeStartTimestamp"
-```
-
-In Logpush, the *Logpull options* would be: `"logpull_options": "fields=RayID,EdgeStartTimestamp"`. *See [Logpull API parameters](/logpull-api/requesting-logs/#parameters)* for more info.
-
-If you don't change any options, you will receive logs with default fields that are unsampled (i.e., `sample=1`).
-
-The three options that you can customize are:
-
-1. Fields: See *[Log fields](/log-fields/)* for the currently available fields. The list of fields is also accessible directly from the API: `https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields`. Default fields: `https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields/default`.
-2. Sampling rate: Value can range from 0.001 to 1.0 (inclusive). `sample=0.1` means return 10% (1 in 10) of all records.
-3. Timestamp format: The format in which timestamp fields will be returned. Value options: unixnano (default), unix, rfc3339.
-
-To check if `logpull_options` is valid:
-
-```bash
-$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/origin -d '{"logpull_options":"fields=RayID,ClientIP,EdgeStartTimestamp&timestamps=rfc3339","dataset": "http_requests"}' | jq .
-```
-
-### Response
-
-```bash
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "valid": true,
-    "message": "",
-  },
-  "success": true
-}
-```
-
-## Audit
-
-The following actions are recorded in **Cloudflare Audit Logs**: create, update, and delete job.
diff --git a/products/logs/src/content/logpush/logpush-dashboard/index.md b/products/logs/src/content/logpush/logpush-dashboard/index.md
deleted file mode 100644
index 8d25206a8c0..00000000000
--- a/products/logs/src/content/logpush/logpush-dashboard/index.md
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: Manage via the Cloudflare UI
-order: 45
----
-
-# Manage via the Cloudflare UI
-
-Before enabling **Cloudflare Logpush**, make sure that you have already configured a destination in your cloud service.
-
-<Aside type="info" header="Info">
-
-Learn  how to set up a destination for:
-
-* [Amazon S3](/logpush/aws-s3/)
-* [Google Cloud Storage](/logpush/google-cloud-storage/)
-* [Microsoft Azure](/logpush/azure/)
-* [Sumo Logic](/logpush/sumo-logic/)
-
-</Aside>
-
-To enable the Clouflare Logpush service:
-
-1. Log in to the Cloudflare dashboard
-
-2. Ensure the Enterprise domain you want to use with Logpush is selected
-
-3. Select the **Analytics** app in the top menu
-
-4. Select the **Logs** section in the secondary menu
-
-5. Select **Connect a service**. A modal window opens where you will need to complete several steps
-
-6. Under **Select service**, pick your cloud service provider and click **Next**
-
-7. Complete the steps below based on your provider, then continue to *step 8*
-
-   * For **Amazon S3**, enter or select the following:
-     * **Bucket path**
-     * **Daily subfolders**
-     * **Bucket region**
-     * **Encryption constraint in bucket policy**
-     * For **Grant Cloudflare access to upload files to your bucket**, make sure your bucket has a policy (if you did not add it already):
-        * Copy the JSON policy, then go to your bucket in the Amazon S3 console and paste the policy in **Permissions** > **Bucket Policy** and click **Save**
-
-   * For **Google Cloud Storage**, enter or select the following:
-     * **Bucket path**
-     * **Daily subfolders**
-     * For **Grant Cloudflare access to upload files to your bucket**, make sure your bucket has a Cloudflare IAM user (if you did not add it already):
-       * See *step 2* in [Enable Google Cloud Storage](/logpush/google-cloud-storage/)
-
-   * For **Microsoft Azure**, enter or select the following:
-     * **SAS URL**
-       * See [Enable Microsoft Azure](/logpush/azure/) for instructions on creating this URL
-     * **Blob container subpath (optional)**
-     * **Daily subfolders**
-
-   * For **Sumo Logic**, enter or select the following:
-     * **HTTP Source Address**
-       * See [Enable Sumo Logic](/logpush/sumo-logic/) for instructions on getting this address
-
-8.  In the Cloudflare dashboard, click **Validate access**
-
-9.  Follow the on-screen instructions to enter the **Ownership token** (included in a file or log Cloudflare sends to your provider), then click **Prove ownership**
-
-<Aside type="note" header="Note">
-
-Tips for seeing the token:
-
-* **Amazon S3**: click the **Open** button in the **Overview** tab of the ownership challenge file
-* **Microsoft Azure**: use the **Storage Explorer** feature to navigate to and open the file
-* **Sumo Logic**: use the [Live Tail](https://help.sumologic.com/05Search/Live-Tail/About-Live-Tail) feature to see your log containing the token as soon as it's received
-
-</Aside>
-
-10. Next in the **Customize log** screen, select the data set in which you're interested (currently `HTTP requests` or `Spectrum events`). You can keep the default fields to include in your log or make changes. You can add or remove fields at a later time by modifying your settings in **Logs** > **Logpush** (select the wrench icon).
-
-11. To finish enabling Logpush, click **Save and Start Pushing**
-
-Once connected, Cloudflare lists the provider you just configured under **Logs** > **Logpush**. This is where you can make changes or remove the provider.
\ No newline at end of file
diff --git a/products/logs/src/content/logpush/s3-compatible-endpoints/index.md b/products/logs/src/content/logpush/s3-compatible-endpoints/index.md
deleted file mode 100644
index 046b3446f61..00000000000
--- a/products/logs/src/content/logpush/s3-compatible-endpoints/index.md
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: Enable S3-compatible endpoints
-order: 56
----
-
-# Enable S3-compatible endpoints
-
-Cloudflare Logpush now supports S3-compatible destinations in an API-only beta, including:
-
-* [Digital Ocean Spaces](https://www.digitalocean.com/docs/spaces/)
-* [Backblaze B2](https://www.backblaze.com/b2/docs/s3_compatible_api.html)
-* [Alibaba Cloud OSS](https://www.alibabacloud.com/help/doc-detail/64919.htm#title-37m-7gl-xy2)
-* [JD Cloud Object Storage Service](https://docs.jdcloud.com/en/object-storage-service/introduction-2)
-* [Oracle Cloud Object Storage](https://docs.cloud.oracle.com/en-us/iaas/Content/Object/Tasks/s3compatibleapi.htm)
-* [Linode Object Storage](https://www.linode.com/products/object-storage/)
-* On-premise [Ceph Object Gateway](https://docs.ceph.com/en/latest/radosgw/s3/)
-
-For more information about Logpush and the current production APIs, see the [Cloudflare Logpush](https://developers.cloudflare.com/logs/logpush) documentation.
-
-To set up S3-compatible endpoints:
-1. Create a job with the appropriate endpoint URL and authentication parameters
-2. Then, enable the job to begin pushing logs
-
-See below for detailed instructions.
-
-<Aside type="note" header="Note">
-
-Unlike Logpush jobs to Amazon S3, there is no ownership challenge with S3-compatible APIs.
-
-</Aside>
-
-## 1. Create a job
-
-To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
-* `name` (optional) - Use your domain name as the job name.
-* `destination_conf` - A log destination consisting of an endpoint name, bucket name, bucket path, region, access-key-id, and secret-access-key in the following string format:
-
-```bash
-"s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>"
-```
-<Aside type="note" header="Note">
-
-`<ENDPOINT-URL>` is the url without the bucket name or path. Example: `endpoint=sfo2.digitaloceanspaces.com`
-</Aside>
-
-* `dataset` - the category of logs you want to receive; either `http_requests` (default), `spectrum_events` or `firewall_events`
-* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](https://developers.cloudflare.com/logs/logpush/logpush-configuration-api/understanding-logpush-api#options)
-
-Example request using cURL:
-
-```bash
-curl -s -X POST \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
--d '{"name":"<DOMAIN_NAME>",
-"destination_conf":"s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>", "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": false,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-## 2. Enable (update) a job
-
-To enable a  job, make a `PUT` request to the Logpush jobs endpoint. You’ll use the job ID returned from the previous step in the URL, and send `{"enabled": true}` in the request body.
-
-Example request using cURL:
-
-```bash
-curl -s -X PUT \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": true,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "s3://<BUCKET-NAME>/<BUCKET-PATH>?region=<REGION>&access-key-id=<ACCESS-KEY-ID>&secret-access-key=<SECRET-ACCESS-KEY>&endpoint=<ENDPOINT-URL>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
diff --git a/products/logs/src/content/logpush/splunk/index.md b/products/logs/src/content/logpush/splunk/index.md
deleted file mode 100644
index 8ef73492d35..00000000000
--- a/products/logs/src/content/logpush/splunk/index.md
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Enable Splunk
-order: 63
----
-
-# Enable Logpush to Splunk
-
-Cloudflare Logpush now supports pushing logs directly to Splunk via API.
-
-To set up a Splunk Logpush job:
-1. Create a job with the appropriate endpoint URL and authentication parameters
-2. Enable the job to begin pushing logs
-
-<Aside type="note" header="Note">
-
-Note: Unlike configuring Logpush jobs for AWS S3, GCS, or Azure, there is no ownership challenge when configuring Logpush to Splunk.
-
-</Aside>
-
-## 1. Create a job
-
-To create a job, make a `POST` request to the Logpush jobs endpoint with the following fields:
-
-* `name` (optional) - Use your domain name as the job name.
-* `destination_conf` - A log destination consisting of an endpoint URL, channel id, insecure-skip-verify flag, sourcetype, authorization header in the string format below. 
-
-  * `<SPLUNK-ENDPOINT-URL>`: The Splunk raw HTTP Event Collector URL with port. Example: `splunk.cf-analytics.com:8088/services/collector/raw`. 
-      * Cloudflare expects the HEC network port to be configured to :443 or :8088. 
-      * Cloudflare expects the Splunk endpoint to be /services/collector/raw while configuring and setting up the Logpush job.  
-      * Ensure you've enabled HEC in Splunk. Refer to [Splunk Analytics Integrations](https://developers.cloudflare.com/logs/analytics-integrations/splunk) for information on how to set up HEC in Splunk. 
-  * `<SPLUNK-CHANNEL-ID>`: A unique channel ID. This is a random GUID that you can generate by:
-      * Using an online tool like the [GUID generator](https://www.guidgenerator.com/) 
-      * Using command line.  Example: `python -c 'import uuid; print(uuid.uuid4())'` 
-  * `<INSECURE-SKIP-VERIFY>`: Boolean value. Cloudflare recommends setting this value to false. Setting this value to true is equivalent to using the `-k` option with curl as shown in Splunk examples and is NOT recommended. Only set this value to true when HEC uses a self-signed certificate.
-
-<Aside type="note" header="Note">
-      * Cloudflare highly recommends setting this value to false. Refer to the FAQ below for more information.
-</Aside>
-
-  * `<SOURCE-TYPE>`: The Splunk sourcetype. Example: `cloudflare:json`
-  * `<SPLUNK-AUTH-TOKEN>`: The Splunk authorization token that’s URL-encoded. Example: `Splunk%20e6d94e8c-5792-4ad1-be3c-29bcaee0197d`   
-
-```bash
-"splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>"
-```
-
-* `dataset` - The category of logs you want to receive, which is either `http_requests` (default), `spectrum_events`, or `firewall_events`.
-
-* `logpull_options` (optional) - To configure fields, sample rate, and timestamp format, see [Logpush API options](https://developers.cloudflare.com/logs/logpush/logpush-configuration-api/understanding-logpush-api#options). For timestamp, Cloudflare recommends using `timestamps=rfc3339`
-
-Example request using cURL:
-
-```bash
-curl -s -X POST \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
--H "X-Auth-Email: user@example.com" \
--H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
--d '{"name":"<DOMAIN_NAME>",
-"destination_conf":"splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",  "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "dataset":"http_requests"}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": false,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-## 2. Enable (update) a job
-
-To enable a  job, make a `PUT` request to the Logpush jobs endpoint. Use the job ID returned from the previous step in the URL and send `{"enabled":true}` in the request body.
-
-Example request using cURL:
-
-```bash
-curl -s -X PUT \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/100 -d'{"enabled":true}' | jq .
-```
-
-Response:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 100,
-    "dataset": "http_requests",
-    "enabled": true,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-## FAQs
-
-### Why am I receiving a validating destination error while setting up a Splunk job? 
-You could be seeing this error for multiple reasons:
-* The Splunk endpoint URL is not correct. Cloudflare only supports Splunk HEC raw endpoint over HTTPS.
-* The Splunk authentication token is not correct. Be sure to URL-encode the token. For example, use "%20" for a whitespace.
-* The certificate for Splunk Server is not properly configured. Certificates generated by Splunk/third party certificates should have the Common Name field in the certificate match the Splunk server’s domain name. Otherwise you may see errors like: `x509: certificate is valid for SplunkServerDefaultCert, not <your-instance>.splunkcloud.com.`
-
-
-### What's the insecure-skip-verify parameter?
-This flag, if set to true, makes an insecure connection to Splunk. Setting this value to true is equivalent to using the `-k` option with curl as shown in Splunk examples and is NOT recommended. Cloudflare highly recommends setting this flag to false when using the `insecure-skip-verify` parameter.
-
-### Why do we have the insecure-skip-verify parameter if it's not recommended?
-Certificates generated by Splunk/third party certificates should have the Common Name field in the certificate match the Splunk server’s domain name. Otherwise you may see errors like: `x509: certificate is valid for SplunkServerDefaultCert, not <your-instance>.splunkcloud.com.` This happens especially with the default certificates generated by Splunk on startup. Pushes will never succeed unless the certificates are fixed. 
-
-The proper way to resolve the issue is to fix the certificates. This flag is only here for those rare scenarios when it’s not possible to have access/permissions to fix the certificates, like with the Splunk cloud instances, which don’t allow changing Splunk server configurations.
-
-### How can I verify that my Splunk HEC is working correctly before setting up a job?
-Ensure that you can publish events to your Splunk instance through `curl` without the `-k` flag and with the `insecure-skip-verify` parameter set to `false` as in the following example: 
-
-```bash
-curl  "https://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>" \
-   -H "Authorization: Splunk <SPLUNK-AUTH-TOKEN>" \
-   -d '{"BotScore":99,"BotScoreSrc":"Machine Learning","CacheCacheStatus":"miss","CacheResponseBytes":2478}'
-{"text":"Success","code":0}%
-```
-
-### Can I use any HEC network port in the destination conf?
-No. Cloudflare expects the HEC network port to be configured to :443 or :8088. 
-
-### Does this integrate with the Cloudflare Splunk App?
-Yes. See [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501/) for more information. As long as you ingest logs using the `cloudflare:json` source type, you can use the Cloudflare Splunk App.
\ No newline at end of file
diff --git a/products/logs/src/content/logpush/sumo-logic/index.md b/products/logs/src/content/logpush/sumo-logic/index.md
deleted file mode 100644
index ba5b3c5fc6e..00000000000
--- a/products/logs/src/content/logpush/sumo-logic/index.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-title: Enable Sumo Logic
-order: 65
----
-
-# Enable Sumo Logic
-
-Cloudflare can send logs to a Hosted Collector with "HTTP Logs & Metrics" as the source. Once you've set up a collector, you simply provide the HTTP Source Address (a unique URL) to which logs can be posted.
-
-To enable Logpush to Sumo Logic:
-
-1. Configure a Hosted Collector. *See [instructions from Sumo Logic](https://help.sumologic.com/03Send-Data/Hosted-Collectors/Configure-a-Hosted-Collector)*.
-
-2. Configure an HTTP Logs & Metrics Source. *See [instructions from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source)*. The last step indicates how to get the HTTP Source Address (URL).
-
-3. Provide the HTTP Source Address (URL) when prompted by the Logpush API or UI.
-
-<Aside type="note" header="Note">
-
-Logpush will stop working if you regenerate the HTTP Source Address (URL). *See [generate a new URL for an HTTP Source from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source/zGenerate-a-new-URL-for-an-HTTP-Source)*. To use the new URL, you will have to get a new ownership challenge and update the destination for your job.
-</Aside>
-
-<Aside type="info" header="Info">
-
-Sumo Logic may impose throttling and caps on your log ingestion to prevent your account from using "On-Demand Capacity." *See [manage ingestion](https://help.sumologic.com/Manage/Ingestion-and-Volume/01Manage-Ingestion)*.
-</Aside>
diff --git a/products/logs/src/content/reference/firewall-fields.md b/products/logs/src/content/reference/firewall-fields.md
new file mode 100644
index 00000000000..257562dce37
--- /dev/null
+++ b/products/logs/src/content/reference/firewall-fields.md
@@ -0,0 +1,65 @@
+---
+order: 123
+pcx-content-type: reference
+---
+
+# Firewall fields
+
+The Firewall fields contain rules to block requests that contain specific types of content.
+
+## FirewallMatchesActions
+
+<TableWrap>
+
+| Value | Action | Description |
+|---|---|---|
+| <em>unknown</em> | Unknown | Take no other action |
+| <em>allow</em> | Allow | Bypass all subsequent rules |
+| <em>block</em> | Drop | Block with an HTTP 403 response |
+| <em>challenge</em> | Challenge Drop | Issue a CAPTCHA challenge |
+| <em>jschallenge</em> | Challenge Drop | Issue a JS challenge |
+| <em>log</em> | Log | Take no action other than logging the event |
+| <em>connectionClose</em> | Close | Close connection |
+| <em>challengeSolved</em> | Allow | Allow once CAPTCHA challenge solved |
+| <em>challengeFailed</em> | Drop | Block following invalid CAPTCHA solve attempt |
+| <em>challengeBypassed</em> | Allow | CAPTCHA challenge not issued because visitor had previously passed a CAPTCHA challenge|
+| <em>jschallengeSolved</em> | Allow | Allow once JS challenge solved |
+| <em>jschallengeFailed</em> | Drop | Drop if JS challenge failed |
+| <em>jschallengeBypassed</em> | Allow | JS challenge not issued because the visitor had previously passed a JS or CAPTCHA challenge  |
+| <em>bypass</em> | Allow | Bypass all subsequent firewall rules |
+| <em>managedChallenge</em> | Challenge Drop | Issue managed challenge |
+| <em>managedChallengeSkipped</em> | Allow | Skip managed challenge and allow |
+| <em>managedChallengeNonInteractiveSolved</em> | Allow | Allow once the managed challenge is solved via non-interactive interstitial page |
+| <em>managedChallengeInteractiveSolved</em> | Allow | Allow once the managed challenged is solved via interactive interstitial page |
+| <em>managedChallengeBypassed</em> | Allow | Challenge was not presented because visitor had clearance from previous challenge |
+
+</TableWrap>
+
+## FirewallMatchesSources
+
+<TableWrap>
+
+| Value | Description |
+|---|---|
+| <em>unknown</em> | Used if an event is received from a new source but the logging system has not been updated |
+| <em>asn</em> | Allow or block based on autonomous system number |
+| <em>country</em> | Allow or block based on country |
+| <em>ip</em> | Allow or block based on IP address |
+| <em>ipRange</em> | Allow or block based on range of IP addresses |
+| <em>securityLevel</em> | Allow or block based on requester's security level |
+| <em>zoneLockdown</em> | Restrict all access to a specific zone |
+| <em>waf</em> | Allow or block based on the WAF product settings. This is the WAF/managed rules system that is being phased out. |
+| <em>firewallRules</em> | Allow or block based on a zone's firewall rules configuration |
+| <em>uaBlock</em> | Allow or block based on the Cloudflare User Agent Blocking product settings |
+| <em>rateLimit</em> | Allow or block based on a rate limiting rule, whether set by you or by Cloudflare |
+| <em>bic</em> | Allow or block based on the Browser Integrity Check product settings |
+| <em>hot</em> | Allow or block based on the Hotlink Protection product settings |
+| <em>l7ddos</em> | Allow or block based on the L7 DDoS product settings |
+| <em>validation</em> | Allow or block based on a request that is invalid (cannot be customized) |
+| <em>botFight</em> | Allow or block based on the Bot Fight Mode (classic) product settings |
+| <em>botManagement</em> | Allow or block based on the Bot Management product settings |
+| <em>dlp</em> | Allow or block based on the Data Loss Prevention product settings |
+| <em>firewallManaged</em> | Allow or block based on the Firewall Managed Rules product settings |
+| <em>firewallCustom</em> | Allow or block based on a rule configured in the Firewall Custom Rulesets |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/glossary.md b/products/logs/src/content/reference/glossary.md
index 858a9b9c8d7..484e809a246 100644
--- a/products/logs/src/content/reference/glossary.md
+++ b/products/logs/src/content/reference/glossary.md
@@ -1,6 +1,6 @@
 ---
-title: Glossary
 order: 121
+pcx-content-type: interim
 ---
 
 # Glossary
diff --git a/products/logs/src/content/reference/index.md b/products/logs/src/content/reference/index.md
index 9cf83fcacd0..a75154da978 100644
--- a/products/logs/src/content/reference/index.md
+++ b/products/logs/src/content/reference/index.md
@@ -1,12 +1,10 @@
 ---
-title: Reference
-order: 120
+order: 110
+pcx-content-type: navigation
 ---
 
 # Reference
 
 These reference resources are useful for gaining a more in-depth understanding of the terminology and status codes that are part of the Cloudflare Logs data. This information is especially important when integrating your data with third-party tools:
 
-- [Glossary](/reference/glossary/)
-- [Pathing Status](/reference/pathing-status/)
-- [WAF fields](/reference/waf-fields/)
+<DirectoryListing path="/reference"/>
diff --git a/products/logs/src/content/reference/log-fields/account/audit_logs.md b/products/logs/src/content/reference/log-fields/account/audit_logs.md
new file mode 100644
index 00000000000..29c3d9a7335
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/account/audit_logs.md
@@ -0,0 +1,31 @@
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: Audit logs
+---
+
+# Audit logs
+
+The descriptions below detail the fields available for `audit_logs`.
+
+<TableWrap>
+
+| Field | Value | Type |
+| -- | -- | -- |
+| ActionResult | Whether the action was successful | bool |
+| ActionType | Type of action taken | string |
+| ActorEmail | Email of the actor | string |
+| ActorID | Unique identifier of the actor in Cloudflare's system | string |
+| ActorIP | Physical network address of the actor | string |
+| ActorType | Type of user that started the audit trail | string |
+| ID | Unique identifier of an audit log | string |
+| Interface | Entry point or interface of the audit log | string |
+| Metadata | Additional audit log-specific information. Metadata is organized in key:value pairs. Key and Value formats can vary by ResourceType. | object |
+| NewValue | Contains the new value for the audited item | object |
+| OldValue | Contains the old value for the audited item | object |
+| OwnerID | The identifier of the user that was acting or was acted on behalf of. If a user did the action themselves, this value will be the same as the ActorID. | string |
+| ResourceID | Unique identifier of the resource within Cloudflare's system | string |
+| ResourceType | The type of resource that was changed | string |
+| When | When the change happened | int or string |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/log-fields/account/gateway_dns.md b/products/logs/src/content/reference/log-fields/account/gateway_dns.md
new file mode 100644
index 00000000000..62d64093ffa
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/account/gateway_dns.md
@@ -0,0 +1,37 @@
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: Gateway DNS
+---
+
+# Gateway DNS
+
+The descriptions below detail the fields available for `gateway_dns`.
+
+<TableWrap>
+
+| Field | Value | Type |
+| -- | -- | -- |
+| ColoID | The ID of the colo that received the DNS query | int |
+| ColoName | The name of the colo that received the DNS query | string |
+| Datetime | The date and time the corresponding DNS request was made | int or string |
+| DeviceID | UUID of the device where the HTTP request originated from | string |
+| DstIP | The destination IP address the DNS query was made to | string |
+| DstPort | The destination port used at the edge. The port changes based on the protocol used by the DNS query. | int |
+| Email | Email used to authenticate the client | string |
+| Location | Name of the location the DNS request is coming from. Location is created by the customer. | string |
+| MatchedCategoryIDs | ID or IDs of category that the domain was matched with the policy | array[int] |
+| Policy | Name of the policy that was applied (if any) | string |
+| Protocol | The protocol used for the DNS query by the client i.e. UDP, TCP, DoH, DoT, WARP | string |
+| QueryCategoryIDs | ID or IDs of category that the domain belongs to | array[int] |
+| QueryName | Query name | string |
+| QueryNameReversed | Query name in reverse | string |
+| QuerySize | The size of the DNS request in bytes | int |
+| QueryType | The type of DNS query e.g. A, AAAA, MX, TXT etc | string |
+| RData | The rdata objects e.g. type and data | array[object] |
+| ResolverDecision | Result of the DNS query i.e. Allowed, Blocked etc | int |
+| SrcIP | The source IP address making the DNS query | string |
+| SrcPort | The port used by the client when they sent the DNS request | int |
+| UserID | User identity where the HTTP request originated from | string |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/log-fields/account/gateway_http.md b/products/logs/src/content/reference/log-fields/account/gateway_http.md
new file mode 100644
index 00000000000..69da3eb8763
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/account/gateway_http.md
@@ -0,0 +1,42 @@
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: Gateway HTTP
+---
+
+# Gateway HTTP
+
+The descriptions below detail the fields available for `gateway_http`.
+
+<TableWrap>
+
+| Field | Value | Type |
+| -- | -- | -- |
+| AccountID | Cloudflare account tag | string |
+| Action | Action performed by gateway on the HTTP request | string |
+| BlockedFileHash | Hash of the file blocked in the response, if any | string |
+| BlockedFileName | File name blocked in the request, if any | string |
+| BlockedFileReason | Reason file was blocked in the response, if any | string |
+| BlockedFileSize | File size(bytes) blocked in the response, if any | string |
+| BlockedFileType | File type blocked in the response eg. exe, bin, if any | string |
+| Datetime | The date and time the corresponding HTTP request was made | int or string |
+| DestinationIP | Destination ip of the request | string |
+| DestinationPort | Destination port of the request | string |
+| DeviceID | UUID of the device where the HTTP request originated from | string |
+| DownloadedFileNames | List of files downloaded in the HTTP request | array[string] |
+| Email | Email used to authenticate the client | string |
+| HTTPHost | Content of the host header in the HTTP request | string |
+| HTTPMethod | HTTP request method | string |
+| HTTPVersion | Version name for the HTTP request | string |
+| IsIsolated | If the requested was isolated with Cloudflare Browser Isolation or not | bool |
+| PolicyID | The gateway policy UUID applied to the request, if any | string |
+| Referer | Contents of the referer header in the HTTP request | string |
+| RequestID | Cloudflare request ID. This might be empty on bypass action | string |
+| SourceIP | Source ip of the request | string |
+| SourcePort | Source port of the request | string |
+| URL | HTTP request URL | string |
+| UploadedFileNames | List of files uploaded in the HTTP request | array[string] |
+| UserAgent | Contents of the user agent header in the HTTP request | string |
+| UserID | User identity where the HTTP request originated from | string |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/log-fields/account/index.md b/products/logs/src/content/reference/log-fields/account/index.md
new file mode 100644
index 00000000000..a1011632fd9
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/account/index.md
@@ -0,0 +1,9 @@
+---
+title: Account-scoped data sets
+order: 20
+pcx-content-type: navigation
+---
+
+# Account-scoped data sets
+
+<DirectoryListing path="/reference/log-fields/account"/>
diff --git a/products/logs/src/content/reference/log-fields/index.md b/products/logs/src/content/reference/log-fields/index.md
new file mode 100644
index 00000000000..946ad5471cd
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/index.md
@@ -0,0 +1,24 @@
+---
+title: Log fields
+order: 50
+pcx-content-type: navigation
+---
+
+# Log fields
+
+The data sets below describe the fields available by log category. The list of fields is also accessible directly from the API:
+`https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields` for zone-scoped data sets or `https://api.cloudflare.com/client/v4/accounts/<account_id>/logpush/datasets/<dataset>/fields` for account-scoped data sets, where the `dataset` argument indicates the log category (such as `http_requests`, `spectrum_events`, `firewall_events`, etc).
+
+Zone-scoped HTTP requests are available in both Logpush and Logpull. All other data sets are only available through Logpush.
+
+Unless otherwise noted, fields are available in both Logpush v1 (Logpush prior to mid-2020) and Logpush v2 (all Logpush jobs after mid-2020).
+
+## Zone-scoped data sets
+
+<DirectoryListing path="/reference/log-fields/zone"/>
+
+## Account-scoped data sets
+
+<DirectoryListing path="/reference/log-fields/account"/>
+
+For more information on logs available in Cloudflare for Teams, refer to [Teams logs](https://developers.cloudflare.com/cloudflare-one/analytics/logs).
\ No newline at end of file
diff --git a/products/logs/src/content/log-fields/_partials/firewall_events.md b/products/logs/src/content/reference/log-fields/zone/firewall_events.md
similarity index 94%
rename from products/logs/src/content/log-fields/_partials/firewall_events.md
rename to products/logs/src/content/reference/log-fields/zone/firewall_events.md
index 1e6aeecdd6b..f2a7c3ea7af 100644
--- a/products/logs/src/content/log-fields/_partials/firewall_events.md
+++ b/products/logs/src/content/reference/log-fields/zone/firewall_events.md
@@ -1,4 +1,15 @@
-<!-- Code generated by logshare-api. DO NOT EDIT. -->
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: Firewall events
+---
+
+# Firewall events
+
+The descriptions below detail the fields available for `firewall_events`.
+
+<TableWrap>
+
 | Field | Value | Type |
 | -- | -- | -- |
 | Action | The code of the first-class action the Cloudflare Firewall took on this request. <br />Possible actions are <em>unknown</em> \| <em>allow</em> \| <em>block</em> \| <em>challenge</em> \| <em>jschallenge</em> \| <em>log</em> \| <em>connectionclose</em> \| <em>challengesolved</em> \| <em>challengefailed</em> \| <em>challengebypassed</em> \| <em>jschallengesolved</em> \| <em>jschallengefailed</em> \| <em>jschallengebypassed</em> \| <em>bypass</em> \| <em>managedchallenge</em> \| <em>managedchallengeskipped</em> \| <em>managedchallengenoninteractivesolved</em> \| <em>managedchallengeinteractivesolved</em> \| <em>managedchallengebypassed</em> | string |
@@ -29,3 +40,5 @@
 | RayID | The RayID of the request | string |
 | RuleID | The Cloudflare security product-specific RuleID triggered by this request | string |
 | Source | The Cloudflare security product triggered by this request. <br />Possible sources are <em>unknown</em> \| <em>asn</em> \| <em>country</em> \| <em>ip</em> \| <em>iprange</em> \| <em>securitylevel</em> \| <em>zonelockdown</em> \| <em>waf</em> \| <em>firewallrules</em> \| <em>uablock</em> \| <em>ratelimit</em> \| <em>bic</em> \| <em>hot</em> \| <em>l7ddos</em> \| <em>validation</em> \| <em>botfight</em> \| <em>apishield</em> \| <em>botmanagement</em> \| <em>dlp</em> \| <em>firewallmanaged</em> \| <em>firewallcustom</em> | string |
+
+</TableWrap>
diff --git a/products/logs/src/content/log-fields/_partials/http_requests.md b/products/logs/src/content/reference/log-fields/zone/http_requests.md
similarity index 96%
rename from products/logs/src/content/log-fields/_partials/http_requests.md
rename to products/logs/src/content/reference/log-fields/zone/http_requests.md
index 51156f5259c..b4c1ba3db16 100644
--- a/products/logs/src/content/log-fields/_partials/http_requests.md
+++ b/products/logs/src/content/reference/log-fields/zone/http_requests.md
@@ -1,4 +1,15 @@
-<!-- Code generated by logshare-api. DO NOT EDIT. -->
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: HTTP requests
+---
+
+# HTTP requests
+
+The descriptions below detail the fields available for `http_requests`.
+
+<TableWrap>
+
 | Field | Value | Type |
 | -- | -- | -- |
 | BotScore | Cloudflare Bot Score. Scores below 30 are commonly associated with automated traffic. Available for Bot Management customers (please contact your account team to enable). | int |
@@ -37,7 +48,7 @@
 | EdgePathingOp | Indicates what type of response was issued for this request (unknown = no specific action) | string |
 | EdgePathingSrc | Details how the request was classified based on security checks (unknown = no specific classification) | string |
 | EdgePathingStatus | Indicates what data was used to determine the handling of this request (unknown = no data) | string |
-| EdgeRateLimitAction | The action taken by the blocking rule; empty if no action taken | string |
+| EdgeRateLimitAction | The action taken by the blocking rule; empty if no action taken. <br />Possible values are <em>unknown</em> \| <em>simulate</em> \| <em>ban</em> \| <em>challenge</em> \| <em>jsChallenge</em> | string |
 | EdgeRateLimitID | The internal rule ID of the rate-limiting rule that triggered a block (ban) or log action. 0 if no action taken. | int |
 | EdgeRequestHost | Host header on the request from the edge to the origin | string |
 | EdgeResponseBodyBytes | Size of the HTTP response body returned to clients. Available in Logpush v2 only. | int |
@@ -81,3 +92,5 @@
 | WorkerSubrequestCount | Number of subrequests issued by a worker when handling this request | int |
 | ZoneID | Internal zone ID | int |
 | ZoneName | The human-readable name of the zone (e.g. 'cloudflare.com'). Available in Logpush v2 only. | string |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/log-fields/zone/index.md b/products/logs/src/content/reference/log-fields/zone/index.md
new file mode 100644
index 00000000000..8f655cf1409
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/zone/index.md
@@ -0,0 +1,9 @@
+---
+title: Zone-scoped data sets
+order: 10
+pcx-content-type: navigation
+---
+
+# Zone-scoped data sets
+
+<DirectoryListing path="/reference/log-fields/zone"/>
diff --git a/products/logs/src/content/reference/log-fields/zone/nel_reports.md b/products/logs/src/content/reference/log-fields/zone/nel_reports.md
new file mode 100644
index 00000000000..975400784e2
--- /dev/null
+++ b/products/logs/src/content/reference/log-fields/zone/nel_reports.md
@@ -0,0 +1,23 @@
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: NEL reports
+---
+
+# NEL reports
+
+The descriptions below detail the fields available for `nel_reports`.
+
+<TableWrap>
+
+| Field | Value | Type |
+| -- | -- | -- |
+| ClientIPASN | Client ASN | int |
+| ClientIPASNDescription | Client ASN description | string |
+| ClientIPCountry | Client country | string |
+| LastKnownGoodColoCode | IATA airport code of colo client connected to | string |
+| Phase | The phase of connection the error occurred in; <em>dns</em> \| <em>connection</em> \| <em>application</em> \| <em>unknown</em> | string |
+| Timestamp | Timestamp for error report | int or string |
+| Type | The type of error in the phase | string |
+
+</TableWrap>
diff --git a/products/logs/src/content/log-fields/_partials/spectrum_events.md b/products/logs/src/content/reference/log-fields/zone/spectrum_events.md
similarity index 94%
rename from products/logs/src/content/log-fields/_partials/spectrum_events.md
rename to products/logs/src/content/reference/log-fields/zone/spectrum_events.md
index 87e4a13f964..695273c8bfb 100644
--- a/products/logs/src/content/log-fields/_partials/spectrum_events.md
+++ b/products/logs/src/content/reference/log-fields/zone/spectrum_events.md
@@ -1,4 +1,15 @@
-<!-- Code generated by logshare-api. DO NOT EDIT. -->
+---
+[//]: # (Code generated by logshare-api. DO NOT EDIT.)
+
+title: Spectrum events
+---
+
+# Spectrum events
+
+The descriptions below detail the fields available for `spectrum_events`.
+
+<TableWrap>
+
 | Field | Value | Type |
 | -- | -- | -- |
 | Application | The unique public ID of the application on which the event occurred | string |
@@ -32,3 +43,5 @@
 | ProxyProtocol | Which form of proxy protocol is applied to the given connection; <em>off</em> \| <em>v1</em> \| <em>v2</em> \| <em>simple</em> | string |
 | Status | A code indicating reason for connection closure | int |
 | Timestamp | Timestamp at which the event took place | int or string |
+
+</TableWrap>
diff --git a/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-curl/index.md b/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-curl/index.md
new file mode 100644
index 00000000000..3c79bbed803
--- /dev/null
+++ b/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-curl/index.md
@@ -0,0 +1,301 @@
+---
+order: 87
+pcx-content-type: tutorial
+---
+
+# Manage Logpush with cURL
+
+You can manage your Cloudflare Logpush service from the command line using cURL.
+
+Before getting started, review:
+
+* [Logpush API configuration](/reference/logpush-api-configuration)
+* [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties)
+
+## Step 1 - Get ownership challenge
+
+```bash
+$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/ownership \
+-H "X-Auth-Email: user@example.com" \ 
+-H "X-Auth-Key: api_key" \
+-H "Content-Type: application/json" \ 
+--data '{"destination_conf":"s3://<BUCKET_PATH>?region=us-west-2"}' | jq .
+```
+
+### Parameters
+* *destination_conf* - see [Destination](/reference/logpush-api-configuration/#destination) for details
+
+### Response
+
+A challenge file will be written to the destination, and the filename will be in the response (the filename may be expressed as a path if appropriate for your destination). For example:
+
+```bash
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": {
+    "filename": "burritobot/logs/ownership-challenge.txt",
+    "valid": true,
+    "message": ""
+  }
+}
+```
+
+You will need to provide the token contained in this file when creating a job in the next step.
+
+<Aside type="note" header="Note">
+
+When using Sumo Logic, you may find it helpful to have [Live Tail](https://help.sumologic.com/05Search/Live-Tail/About-Live-Tail) open to see the challenge file as soon as it's uploaded.
+</Aside>
+
+## Step 2 - Create a job
+
+```bash
+curl -s -X POST \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
+-d'{"name":"<DOMAIN_NAME>", "destination_conf":"s3://<BUCKET_PATH>?region=us-west-2", "dataset": "http_requests", "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "ownership_challenge":"00000000000000000000"}' | jq .
+```
+
+### Parameters
+
+* *name* (optional) - we suggest using your domain name as the job name; cannot be changed after the job is created
+* *destination_conf* - see [Destination](/reference/logpush-api-configuration/#destination) for details
+* *dataset* - the category of logs you want to receive; either  `http_requests` (default), `spectrum_events`, or `firewall_events`; cannot be changed after the job is created
+* *logpull_options* (optional) - see [Options](/reference/logpush-api-configuration/#options)
+    * Typically includes the desired fields and timestamp format
+    * Set the timestamp format to RFC 3339 (`&timestamps=rfc3339`) for:
+      * Google BigQuery usage
+      * Automated timestamp parsing within Sumo Logic; *see [timestamps from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/04Reference-Information-for-Sources/Timestamps%2C-Time-Zones%2C-Time-Ranges%2C-and-Date-Formats) for details*
+* *ownership_challenge* - challenge token required to prove destination ownership
+
+### Response
+
+In the response, you get a newly-created job ID. For example:
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "id": 146,
+    "dataset": "http_requests",
+    "enabled": false,
+    "name": "<DOMAIN_NAME>",
+    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
+    "last_complete": null,
+    "last_error": null,
+    "error_message": null
+  },
+  "success": true
+}
+```
+
+Note that you can validate the `logpull_options` parameter before including it in your job configuration:
+
+```bash
+curl -s -X POST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/origin -d '{"logpull_options": "fields=EdgeStartTimestamp,RayID,CacheCacheStatus&timestamps=rfc3339", "dataset": "http_requests"}' | jq .
+```
+
+### Response
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "message": "",
+    "valid": true
+  },
+  "success": true
+}
+```
+
+## Step 3 - Enable (update) a job
+
+Start by retrieving information about a specific job, using a job ID:
+
+```bash
+curl -s -X GET \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
+```
+
+### Response
+
+```json
+{
+ "errors": [],
+ "messages": [],
+ "result": {
+     "id": 146,
+     "dataset": "http_requests",
+     "enabled": false,
+     "name": "<DOMAIN_NAME>",
+     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
+     "last_complete": null,
+     "last_error": null,
+     "error_message": null
+ },
+ "success": true
+}
+```
+
+Note that by default a job is not enabled (`"enabled": false`).
+
+If you don't remember your job ID, you can retrieve it using your zone ID:
+
+```bash
+curl -s -X GET \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs | jq .
+```
+
+Next, to enable the job, send an update request:
+
+```bash
+curl -s -X PUT \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 -d'{"enabled":true}' | jq .
+```
+
+### Response
+
+```json
+{
+ "errors": [],
+ "messages": [],
+ "result": {
+     "id": 146,
+     "dataset": "http_requests",
+     "enabled": true,
+     "name": "<DOMAIN_NAME>",
+     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
+     "last_complete": null,
+     "last_error": null,
+     "error_message": null
+ },
+ "success": true
+}
+```
+
+Once the job is enabled, you will start receiving logs within a few minutes and then in batches as soon as possible until you disable the job. For zones with very high request volume, it may take several hours before you start receiving logs for the first time.
+
+In addition to modifying *enabled*, you can also update the value for *logpull_options*. To modify *destination_conf*, you will need to request an ownership challenge and provide the associated token with your update request. You can also delete your current job and create a new one.
+
+Once a job has been enabled and has started executing, the *last_complete* field will show the time when the last batch of logs was successfully sent to the destination:
+
+### Request to get job by ID and see *last_complete* info
+
+```bash
+curl -s -X GET \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>logpush/jobs/146 | jq .
+```
+
+### Response
+
+```json
+{"errors": [],
+ "messages": [],
+ "result": {
+     "id": 146,
+     "dataset": "http_requests",
+     "enabled": true,
+     "name": "<DOMAIN_NAME>",
+     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
+     "last_complete": "2018-08-09T21:26:00Z",
+     "last_error": null,
+     "error_message": null
+ },
+ "success": true
+}
+```
+
+## Step 4 - Delete a job
+
+```bash
+curl -s -X DELETE \
+https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
+```
+
+Be careful when deleting a job because this action cannot be reversed.
+
+### Response
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": {},
+  "success": true
+}
+```
+
+## Step 5 - Retrieve your job
+
+Retrieve a specific job, using the job ID:
+
+```bash
+curl -s -X GET https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
+```
+
+### Response
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": [
+    {
+     "id": 146,
+     "dataset": "http_requests",
+     "enabled": true,
+     "name": "<DOMAIN_NAME>",
+     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
+     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
+     "last_complete": null,
+     "last_error": null,
+     "error_message": null
+    }
+  ],
+  "success": true
+}
+```
+
+Retrieve all jobs for all data sets:
+
+```bash
+curl -s -X GET https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs | jq .
+```
+
+### Response
+
+```json
+{
+  "errors": [],
+  "messages": [],
+  "result": [
+    {
+      "id": 8029,
+      "dataset": "spectrum_events",
+      "enabled": true,
+      "name": "<DOMAIN_NAME>",
+      "logpull_options": "fields=Application,ClientAsn,ClientIP,ColoCode,Event,OriginIP,Status",
+      "destination_conf": "s3://<BUCKET_PATH_SPECTRUM_EVENTS>?region=us-west-2",
+      "last_complete": "2019-10-01T00:25:00Z",
+      "last_error": null,
+      "error_message": null
+    },
+    {
+      "id": 7826,
+      "dataset": "http_requests",
+      "enabled": false,
+      "name": "<DOMAIN_NAME>",
+      "logpull_options": "fields=ClientIP,ClientRequestHost,ClientRequestMethod,ClientRequestURI,EdgeEndTimestamp,EdgeResponseBytes,EdgeResponseStatus,EdgeStartTimestamp,RayID&timestamps=rfc3339&sample=0.06",
+      "destination_conf": "s3://<BUCKET_PATH_HTTP_REQUESTS>?region=us-west-2",
+      "last_complete": "2019-09-24T21:15:00Z",
+      "last_error": null,
+      "error_message": null
+    },
+```
diff --git a/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-python/index.md b/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-python/index.md
new file mode 100644
index 00000000000..191b4b1dfe4
--- /dev/null
+++ b/products/logs/src/content/reference/logpush-api-configuration/examples/example-logpush-python/index.md
@@ -0,0 +1,58 @@
+---
+order: 88
+pcx-content-type: interim
+---
+
+# Manage Logpush with Python
+
+```python
+import json
+import requests
+
+url = "https://api.cloudflare.com/client/v4/"
+
+x_auth_email = "EMAIL_REDACTED"
+x_auth_key = "KEY_REDACTED"
+
+zone_id = "ZONE_REDACTED"
+destination_conf = "s3://BUCKET_REDACTED/logs?region=us-west-1"
+
+logpush_url = url + "/zones/%s/logpush" % zone_id
+
+headers = {
+  'X-Auth-Email': x_auth_email,
+  'X-Auth-Key': x_auth_key,
+  'Content-Type': 'application/json'
+}
+
+# Create job
+r = requests.post(logpush_url + "/jobs", headers=headers, data=json.dumps({"destination_conf":destination_conf}))
+print(r.status_code, r.text)
+assert r.status_code == 201
+assert r.json()["result"]["enabled"] == False
+
+# Keep id of the new job
+id = r.json()["result"]["id"]
+
+# Get job
+r = requests.get(logpush_url + "/jobs/%s" % id, headers=headers)
+print(r.status_code, r.text)
+assert r.status_code == 200
+
+# Get all jobs for a zone
+r = requests.get(logpush_url + "/jobs", headers=headers)
+print(r.status_code, r.text)
+assert r.status_code == 200
+assert len(r.json()["result"]) > 0
+
+# Update job
+r = requests.put(logpush_url + "/jobs/%s" % id, headers=headers, data=json.dumps({"enabled":True}))
+print(r.status_code, r.text)
+assert r.status_code == 200
+assert r.json()["result"]["enabled"] == True
+
+# Delete job
+r = requests.delete(logpush_url + "/jobs/%s" % id, headers=headers)
+print(r.status_code, r.text)
+assert r.status_code == 200
+```
\ No newline at end of file
diff --git a/products/logs/src/content/reference/logpush-api-configuration/examples/index.md b/products/logs/src/content/reference/logpush-api-configuration/examples/index.md
new file mode 100644
index 00000000000..67c2517a4ef
--- /dev/null
+++ b/products/logs/src/content/reference/logpush-api-configuration/examples/index.md
@@ -0,0 +1,8 @@
+---
+order: 47
+pcx-content-type: navigation
+---
+
+# Logpush examples
+
+<DirectoryListing path="/reference/logpush-api-configuration/examples"/>
\ No newline at end of file
diff --git a/products/logs/src/content/reference/logpush-api-configuration/index.md b/products/logs/src/content/reference/logpush-api-configuration/index.md
new file mode 100644
index 00000000000..9f7f9939dc0
--- /dev/null
+++ b/products/logs/src/content/reference/logpush-api-configuration/index.md
@@ -0,0 +1,174 @@
+---
+order: 41
+pcx-content-type: concept
+---
+
+# Logpush API configuration
+
+## Endpoints
+
+The table below summarizes the job operations available.
+
+The `<zone_id>` argument is the zone id (hexadecimal string), which can be found using [API's zones endpoint](https://api.cloudflare.com/#getting-started-resource-ids).
+The `<job>` argument is the numeric job id. The `<dataset>` argument indicates the log category (such as `http_requests`, `spectrum_events`, or `firewall_events`).
+
+<TableWrap>
+
+| Operation | Description | URL |
+|---|---|---|
+| POST | Create job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs</em> |
+| GET | Retrieve job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
+| GET | Retrieve all jobs for all data sets | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs</em> |
+| GET | Retrieve all jobs for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/jobs</em> |
+| GET | Retrieve all available fields for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/fields</em> |
+| GET | Retrieve all default fields for a data set  | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/datasets/&lt;dataset&gt;/fields/default</em> |
+| PUT | Update job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
+| DELETE | Delete job | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/jobs/&lt;job&gt;</em> |
+| POST | Check whether destination exists | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/validate/destination/exists</em> |
+| POST | Get ownership challenge | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/ownership</em> |
+| POST | Validate ownership challenge | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/ownership/validate</em> |
+| POST | Validate log options | <em>https://api.cloudflare.com/client/v4/zones/&lt;zone_id&gt;/logpush/validate/origin</em> |
+
+</TableWrap>
+
+For concrete examples, see the tutorial [Manage Logpush with cURL](/get-started/logpush-configuration-api/examples/example-logpush-curl/).
+
+## Connecting
+
+The Logpush API requires credentials like any other Cloudflare API.
+
+```bash
+$ curl -s -H "X-Auth-Email: <REDACTED>" -H "X-Auth-Key: <REDACTED>" \
+    'https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs'
+```
+
+## Ownership
+
+Before creating a new job, ownership of the destination must be proven.
+
+To issue an ownership challenge token to your destination:
+
+```bash
+$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/ownership \
+-H "X-Auth-Email: user@example.com" \ 
+-H "X-Auth-Key: api_key" \
+-H "Content-Type: application/json" \ 
+--data '{"destination_conf":"s3://<BUCKET_PATH>?region=us-west-2"}' | jq .
+```
+
+A challenge file will be written to the destination, and the filename will be in the response (the filename may be expressed as a path if appropriate for your destination):
+
+```bash
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "valid": true,
+    "message": "",
+    "filename": "<path-to-challenge-file>.txt"
+  },
+  "success": true
+}
+```
+
+You will need to provide the token contained in the file when creating a job.
+
+<Aside type="note" header="Note">
+
+When using Sumo Logic, you may find it helpful to have [Live Tail](https://help.sumologic.com/05Search/Live-Tail/About-Live-Tail) open to see the challenge file as soon as it's uploaded.
+</Aside>
+
+## Destination
+
+You can specify your cloud service provider destination via the required `destination_conf` parameter.
+
+* **AWS S3**: bucket + optional directory + region + optional encryption parameter (if required by your policy); for example: `s3://bucket/[dir]?region=<region>[&sse=AES256]`
+* **Datadog**: Datadog endpoint URL + Datadog API key + optional parameters; for example: `datadog://<DATADOG-ENDPOINT-URL>?header_DD-API_KEY=<DATADOG-API-KEY>&service=<SERVICE>&host=<HOST>&ddsource=<SOURCE>`
+* **Google Cloud Storage**: bucket + optional directory; for example: `gs://bucket/[dir]`
+* **Microsoft Azure**: service-level SAS URL with `https` replaced by `azure` + optional directory added before query string; for example: `azure://<BlobContainerPath>/[dir]?<QueryString>`
+* **Splunk**: Splunk endpoint URL + Splunk channel ID + insecure-skip-verify flag + Splunk sourcetype + Splunk authorization token; for example: `splunk://<SPLUNK-ENDPOINT-URL>?channel=<SPLUNK-CHANNEL-ID>&insecure-skip-verify=<INSECURE-SKIP-VERIFY>&sourcetype=<SOURCE-TYPE>&header_Authorization=<SPLUNK-AUTH-TOKEN>`
+* **Sumo Logic**: HTTP source address URL with `https` replaced by `sumo`; for example: `sumo://<SumoEndpoint>/receiver/v1/http/<UniqueHTTPCollectorCode>`
+
+For S3, Google Cloud Storage, and Azure, logs can be separated into daily subdirectories by using the special string `{DATE}` in the URL path; for example: `s3://mybucket/logs/{DATE}?region=us-east-1&sse=AES256` or `azure://myblobcontainer/logs/{DATE}?[QueryString]`. It will be substituted with the date in `YYYYMMDD` format, like `20180523`.
+
+For more information on the value for your cloud storage provider, consult the following conventions:
+
+* [AWS S3 CLI](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html) (S3Uri path argument type)
+* [Google Cloud Storage CLI](https://cloud.google.com/storage/docs/gsutil) (Syntax for accessing resources)
+* [Microsoft Azure Shared Access Signature](https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
+* [Sumo Logic HTTP Source](https://help.sumologic.com/03Send-Data/Sources/02Sources-for-Hosted-Collectors/HTTP-Source)
+
+To check if a destination is already in use:
+
+```bash
+$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/destination/exists -d '{"destination_conf":"s3://foo"}' | jq .
+```
+
+### Response
+
+```bash
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "exists": false
+  },
+  "success": true
+}
+```
+
+There can be only 1 job writing to each unique destination. For S3 and GCS, a destination is defined as bucket + path. This means two jobs can write to the same bucket, but must write to different subdirectories in that bucket.
+
+## Job object
+
+<Aside type="info" header="Info">
+
+See a detailed description of the [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties).
+</Aside>
+
+## Options
+
+Logpush repeatedly pulls logs on your behalf and uploads them to your destination.
+
+Log options, such as fields or sampling rate, are configured in the `logpull_options` job parameter (*see [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties)*). For example, the following query gets data from the Logpull API:
+
+```bash
+curl -sv \
+    -H'X-Auth-Email: <REDACTED>' \
+    -H'X-Auth-Key: <REDACTED>' \
+    "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2018-08-02T10:00:00Z&end=2018-08-02T10:01:00Z&fields=RayID,EdgeStartTimestamp"
+```
+
+In Logpush, the *Logpull options* would be: `"logpull_options": "fields=RayID,EdgeStartTimestamp"`. *See [Logpull API parameters](/logpull/requesting-logs/#parameters)* for more info.
+
+If you don't change any options, you will receive logs with default fields that are unsampled (i.e., `sample=1`).
+
+The three options that you can customize are:
+
+1. Fields: See *[Log fields](../../../reference/log-fields/)* for the currently available fields. The list of fields is also accessible directly from the API: `https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields`. Default fields: `https://api.cloudflare.com/client/v4/zones/<zone_id>/logpush/datasets/<dataset>/fields/default`.
+1. Sampling rate: Value can range from 0.001 to 1.0 (inclusive). `sample=0.1` means return 10% (1 in 10) of all records.
+1. Timestamp format: The format in which timestamp fields will be returned. Value options: unixnano (default), unix, rfc3339.
+
+To check if `logpull_options` is valid:
+
+```bash
+$ curl -s -XPOST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/origin -d '{"logpull_options":"fields=RayID,ClientIP,EdgeStartTimestamp&timestamps=rfc3339","dataset": "http_requests"}' | jq .
+```
+
+### Response
+
+```bash
+{
+  "errors": [],
+  "messages": [],
+  "result": {
+    "valid": true,
+    "message": "",
+  },
+  "success": true
+}
+```
+
+## Audit
+
+The following actions are recorded in **Cloudflare Audit Logs**: create, update, and delete job.
diff --git a/products/logs/src/content/reference/pathing-status.md b/products/logs/src/content/reference/pathing-status.md
index 64410a6c945..e4e84690cb1 100644
--- a/products/logs/src/content/reference/pathing-status.md
+++ b/products/logs/src/content/reference/pathing-status.md
@@ -1,15 +1,117 @@
 ---
-title: Pathing status
 order: 122
+pcx-content-type: reference
 ---
 
 # Pathing status
 
+## Understanding pathing
+
 Cloudflare issues the following **Edge Pathing Statuses**:
 
-- EdgePathingSrc: The stage that made the routing decision
-- EdgePathingOp: The specific action or operation taken
-- EdgePathingStatus: Additional information complementing the **EdgePathingOp**
+- **EdgePathingSrc** (pathing source): The stage that made the routing decision
+- **EdgePathingOp** (pathing operation): The specific action or operation taken
+- **EdgePathingStatus** (pathing status): Additional information complementing the **EdgePathingOp**
+
+### EdgePathingSrc
+
+**EdgePathingSrc** refers to the system that last handled the request before an error occurred or the request was passed to the cache server. Typically, this will be the macro/reputation list. Possible pathing sources include:
+
+* *err*
+* *sslv* (SSL verification checker)
+* *bic* (browser integrity check)
+* *hot* (hotlink protection)
+* *macro* (the reputation list)
+* *skip* (Always Online or CDNJS resources)
+* *user* (user firewall rule)
+
+For example:
+
+```bash
+$ jq -r .EdgePathingSrc logs.json | sort -n | uniq -c | sort -n | tail
+1 err
+5 user
+93 macro
+```
+
+### EdgePathingOp
+
+**EdgePathingOp** indicates how the request was handled. *wl* is a request that passed all checks and went to your origin server. Other possible values are:
+
+* *errHost* (host header mismatch, DNS errors, etc.)
+* *ban* (blocked by IP address, range, etc.)
+* *tempOk* (challenge successfully completed)
+* *chl* (challenge issued)
+
+For example:
+
+```bash
+$ jq -r .EdgePathingOp logs.json | sort -n | uniq -c | sort -n | tail
+1 chl
+1 errHost
+97 wl
+```
+
+### EdgePathingStatus
+
+**EdgePathingStatus** is the value *EdgePathingSrc* returns. With a pathing source of *macro*, *user*, or *err*, the pathing status indicates the list where the IP address was found. *nr* is the most common value and it means that the request was not flagged by a security check. Some values indicate the class of user; for example, *se* means search engine. Others indicate whether the visitor saw an error or a captcha, such as, *captchaNew* or *jschlOK*.
+
+For example:
+
+```bash
+$ jq -r .EdgePathingStatus logs.json | sort -n | uniq -c | sort -n | tail
+1 captchaNew
+1 dnsErr
+5 ip
+92 nr
+```
+
+## How does pathing map to Threat Analytics?
+
+Certain combinations of pathing have been labeled in the Cloudflare **Threat Analytics** feature (in the **Analytics** app in the Cloudflare dashboard). The mapping is as follows:
+
+<TableWrap>
+
+| Pathing | Label |
+|---|---|
+| bic.ban.unknown | Bad browser |
+| hot.ban.unknown | Blocked hotlink |
+| hot.ban.ip | |
+| macro.ban.ip | Bad IP |
+| user.ban.ctry | Country block |
+| user.ban.ip | IP block (user) |
+| user.ban.ipr16 | IP range block (/16) |
+| user.ban.ipr24 | IP range block (/24) |
+| macro.chl.captchaErr | Captcha Error |
+| macro.chl.captchaFail | Human Challenged |
+| macro.chl.captchaNew | New CAPTCHA (CF) |
+| macro.chl.jschlFail | Browser Challenged |
+| macro.chl.jschlNew | Challenged threat |
+| macro.chl.jschlErr | Bot request |
+| user.chl.captchaNew | New CAPTCHA (user) |
+
+</TableWrap>
+
+## Understanding response fields
+
+The response status appears in three places in a request:
+
+* *edgeResponse*
+* *cacheResponse*
+* *originResponse*
+
+In your logs, the edge is what first accepts a visitor's request. The cache then accepts the request and either forwards it to your origin or responds from the cache. It's possible to have a request that has only an *edgeResponse* or a request that has an *edgeResponse* and a  *cacheResponse*, but no *originResponse*.
+
+This is how you can see where a request terminates. Requests with only an *edgeResponse* likely hit a security check or processing error. Requests with an *edgeResponse* and a *cacheResponse* either were served from the cache or saw an error contacting your origin server. Requests that have an *originResponse* went all the way to your origin server and errors seen would have been served directly from there.
+
+For example, the following query shows the status code and pathing information for all requests that terminated at the Cloudflare edge:
+
+```bash
+$ jq -r 'select(.OriginResponseStatus == null) | select(.CacheResponseStatus == null) |"\(.EdgeResponseStatus) / \(.EdgePathingSrc) / \(.EdgePathingStatus) / \(.EdgePathingOp)"' logs.json | sort -n | uniq -c | sort -n
+1 403 / macro / captchaNew / chl
+1 403 / macro / nr / wl
+1 409 / err / dnsErr / errHost
+```
 
 The information stored is broken down based on the following categories (click for details below):
 
diff --git a/products/logs/src/content/reference/waf-fields.md b/products/logs/src/content/reference/waf-fields.md
index 94b1157fd19..af708965fdb 100644
--- a/products/logs/src/content/reference/waf-fields.md
+++ b/products/logs/src/content/reference/waf-fields.md
@@ -1,13 +1,13 @@
 ---
-title: WAF fields
 order: 123
+pcx-content-type: reference
 ---
 
 # WAF fields
 
 The Web Application Firewall (WAF) contains rules managed by Cloudflare to block requests that contain malicious content.
 
-## WAFAction
+## WAF Action
 
 <TableWrap>
 
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Looker.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Looker.png
deleted file mode 100644
index e9cf18dadf2..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Looker.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-elastic.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-elastic.png
deleted file mode 100644
index 9cbfe4865a4..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-elastic.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-1.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-1.png
deleted file mode 100644
index a15a4d4e56c..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-1.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-2.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-2.png
deleted file mode 100644
index bc34d059b3d..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-2.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-1.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-1.png
deleted file mode 100644
index 0e0e6110164..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-1.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-2.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-2.png
deleted file mode 100644
index f9189a9d4f7..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-2.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-sumo-Logic.png b/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-sumo-Logic.png
deleted file mode 100644
index 4cdead76666..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-sumo-Logic.png and /dev/null differ
diff --git a/products/logs/src/content/static/images/bot-management/screenshots/create-firewall-rule-for-bots.png b/products/logs/src/content/static/images/bot-management/screenshots/create-firewall-rule-for-bots.png
deleted file mode 100644
index 649c119de6b..00000000000
Binary files a/products/logs/src/content/static/images/bot-management/screenshots/create-firewall-rule-for-bots.png and /dev/null differ
diff --git a/products/logs/src/content/tutorials/bot-management-dashboard.md b/products/logs/src/content/tutorials/bot-management-dashboard.md
deleted file mode 100644
index a897cfa7fb7..00000000000
--- a/products/logs/src/content/tutorials/bot-management-dashboard.md
+++ /dev/null
@@ -1,120 +0,0 @@
----
-title: Bot Management Dashboard
-order: 90
----
-
-# Bot Management Dashboard
-
-This tutorial explains how to activate Cloudflare **Bot Management** and view related dashboards in the Elastic, Google Data Studio, Looker, Splunk, and Sumo Logic analytics platforms.
-
-## Overview
-
-[Bot Management](https://www.cloudflare.com/products/bot-management/) is a Cloudflare Enterprise feature. To enable it, contact your Cloudflare Account Team.
-
-If you haven’t used Cloudflare Logs before, visit our [Logs documentation](/) for more details. Contact your Cloudflare Customer Account Team to enable logs for your account.
-
-### Prerequisites
-
-Before getting started, make sure that you:
-
-- Have a Cloudflare Enterprise account with Cloudflare Logs and Bot Management enabled
-- Configure [Logpush](/logpush/) or [Logpull](/logpull-api/)
-- Have enabled the [_EdgePathingSrc_ and _EdgePathingStatus_](/reference/pathing-status/) fields in Cloudflare Logs to ensure bot requests are captured
-- Are familiar with [Cloudflare Bot Management](https://support.cloudflare.com/hc/articles/360027519452)
-- Follow your analytics provider’s guides for getting logs from AWS S3 or Google Cloud Platform into your analytics platform
-
-<Aside type="note" header="Note">
-
-You can also refer to our [tutorials for enabling logs and dashboards for several analytics providers](/analytics-integrations/).
-</Aside>
-
-## Task 1 - Configure Cloudflare to Detect Bot Traffic
-
-Before proceeding, make sure that you’ve enabled Cloudflare Bot Management for your Enterprise account. To start:
-
-1. In the Cloudflare dashboard, create a Firewall rule. [_Learn more_](https://developers.cloudflare.com/firewall/cf-dashboard/create-edit-delete-rules/).
-2. For **Rule name**, enter _Bot management - Generic_.
-3. Under **Expression Preview,** click **Edit Expression**, then copy and paste the following expression: `(cf.bot_management.score lt 30 and not cf.bot_management.verified_bot)`.
-   - This rule only selects requests with a bot score less than 30 and excludes good bots. Requests with a score under 30 are considered bad bots. Your Firewall rule can be as granular as required. For example, applying conditions only for a specific URL, like login or sign-up pages.
-4. Choose an **action**: _Log_ or _Challenge (Captcha)_.
-   - Cloudflare recommends starting with the action of _Log_ and running it for several days in order to identify which requests fall under the rule above to check if any false positives are registered. You can refine the rule expression further, based on your findings. Once you complete testing, switch the rule action to _Challenge (Captcha)_.
-5. Click **Save**.
-
-![Create Cloudflare Firewall rule to identify bad bots](../static/images/bot-management/screenshots/create-firewall-rule-for-bots.png)
-
-## Task 2 - View Bot Traffic Dashboards
-
-### Viewing dashboards for existing analytics integrations
-
-The Cloudflare Bot Management Dashboard is already available in Elastic, Google Data Studio, Looker, Splunk, and Sumo Logic. If you use any of those platforms, you do not need to do anything else to view these existing dashboards.
-
-See the [Analytics Integrations](/analytics-integrations/) and [Analyze log data with Google Cloud](/analytics-integrations/google-cloud/) sections for details.
-
-### Viewing dashboards for other platforms
-
-If you use a platform that is not part of the integrations mentioned above, you will need to design your own dashboards.
-
-The following sub-sections describe how to identify bot requests and perform the correct calculations using data from your Cloudflare logs.
-
-#### Identify bot requests
-
-Combining the following two fields reveals if the request is a **bot** request:
-
-    EdgePathingSrc = 'filterBasedFirewall' AND EdgePathingStatus = 'captchaNew'
-
-#### Identify valid requests
-
-Valid requests are those for which the user can solve the CAPTCHA. In this case, `EdgePathingStatus = 'captchaSucc'`.
-
-The following combination of fields reveals which CAPTCHAs were solved:
-
-    EdgePathingSrc = 'filterBasedFirewall' AND EdgePathingStatus = 'captchaSucc'
-
-#### Calculate number of bad bots
-
-To start, make sure to exclude solved CAPTCHAs from calculations:
-
-    Bad Bots = SUM(EdgePathingSrc = 'filterBasedFirewall' AND EdgePathingStatus = 'captchaNew') - SUM(EdgePathingSrc = 'filterBasedFirewall' AND EdgePathingStatus = 'captchaSucc' )
-
-If you see a significant increase in CAPTCHA conversion rate, contact your Cloudflare Account Team for further investigation.
-
-### Understand the Bot Management Dashboard
-
-The Bot Management Dashboard consists of three columns to help you better understand and monitor traffic behavior. You can also analyze the ratio between all traffic and bot traffic.
-
-The columns are:
-
-1. Global Traffic - Shows all requests
-
-2. Solved CAPTCHAs - Shows requests with solved CAPTCHAs
-
-3. Bad Bots - Shows confirmed bad bot requests, which exclude solved CAPTCHAs
-
-<Aside type="note" header="Note">
-
-**Limitations**: To identify bot requests correctly, the associated Firewall rules can only be set to the action _Challenge (Captcha)_. If you have more than one rule with this same action (and used for purposes other than bot management), such rule will interfere and you will see overlapping or conflicting metrics without the option to identify which Firewall rule triggered.
-</Aside>
-
-#### Example dashboards
-
-The following images demonstrate some of the dashboards available.
-
-**Elastic** ([_Learn more_](/analytics-integrations/elastic/))
-![Cloudflare Bot Management in Elastic](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-elastic.png)
-
-**Google Data Studio** ([_Learn more_](/analytics-integrations/google-cloud/))
-![Cloudflare Bot Management in Google Data Studio page 1](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-1.png)
-![Cloudflare Bot Management in Google Data Studio page 2](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-google-data-studio-page-2.png)
-
-**Graylog** ([_Learn more_](/analytics-integrations/graylog/))
-![Cloudflare Bot Management in Graylog](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Graylog.png)
-
-**Looker** ([_Learn more_](/analytics-integrations/looker/))
-![Cloudflare Bot Management in Looker](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-Looker.png)
-
-**Splunk** ([_Learn more_](/analytics-integrations/splunk/))
-![Cloudflare Bot Management in Splunk page 1](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-1.png)
-![Cloudflare Bot Management in Splunk page 2](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-splunk-page-2.png)
-
-**Sumo Logic** ([_Learn more_](/analytics-integrations/sumo-logic/))
-![Cloudflare Bot Management in Sumo Logic](../static/images/bot-management/dashboards/cloudflare-bot-management-dashboard-sumo-Logic.png)
diff --git a/products/logs/src/content/tutorials/example-logpush-python.md b/products/logs/src/content/tutorials/example-logpush-python.md
deleted file mode 100644
index fef77e3d5fd..00000000000
--- a/products/logs/src/content/tutorials/example-logpush-python.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Logpush using Python (example)
-order: 88
----
-
-# Logpush using Python (example)
-
-```python
-import json
-import requests
-
-url = "https://api.cloudflare.com/client/v4/"
-
-x_auth_email = "EMAIL_REDACTED"
-x_auth_key = "KEY_REDACTED"
-
-zone_id = "ZONE_REDACTED"
-destination_conf = "s3://BUCKET_REDACTED/logs?region=us-west-1"
-
-logpush_url = url + "/zones/%s/logpush" % zone_id
-
-headers = {
-  'X-Auth-Email': x_auth_email,
-  'X-Auth-Key': x_auth_key,
-  'Content-Type': 'application/json'
-}
-
-# Create job
-r = requests.post(logpush_url + "/jobs", headers=headers, data=json.dumps({"destination_conf":destination_conf}))
-print(r.status_code, r.text)
-assert r.status_code == 201
-assert r.json()["result"]["enabled"] == False
-
-# Keep id of the new job
-id = r.json()["result"]["id"]
-
-# Get job
-r = requests.get(logpush_url + "/jobs/%s" % id, headers=headers)
-print(r.status_code, r.text)
-assert r.status_code == 200
-
-# Get all jobs for a zone
-r = requests.get(logpush_url + "/jobs", headers=headers)
-print(r.status_code, r.text)
-assert r.status_code == 200
-assert len(r.json()["result"]) > 0
-
-# Update job
-r = requests.put(logpush_url + "/jobs/%s" % id, headers=headers, data=json.dumps({"enabled":True}))
-print(r.status_code, r.text)
-assert r.status_code == 200
-assert r.json()["result"]["enabled"] == True
-
-# Delete job
-r = requests.delete(logpush_url + "/jobs/%s" % id, headers=headers)
-print(r.status_code, r.text)
-assert r.status_code == 200
-```
\ No newline at end of file
diff --git a/products/logs/src/content/tutorials/index.md b/products/logs/src/content/tutorials/index.md
index 51a5de22893..3d8397464ec 100644
--- a/products/logs/src/content/tutorials/index.md
+++ b/products/logs/src/content/tutorials/index.md
@@ -1,18 +1,12 @@
 ---
-title: Tutorials and examples
 order: 80
+pcx-content-type: navigation
 ---
 
-# Tutorials and examples
+# Tutorials
 
-Learn to manage and analyze your Cloudflare Logs with the following resources.
+Learn to manage and analyze your Cloudflare Logs with the following resources. For information about Cloudflare's analytics integrations, refer to [Analytics Integrations](https://developers.cloudflare.com/fundamentals/data-products/analytics-integrations).
 
 ### Logpull and Logpsuh
 
-- [Parsing Cloudflare Logs JSON data](/tutorials/parsing-json-log-data/)
-
-### Logpush
-
-- [Manage Logpush with cURL](/tutorials/tutorial-logpush-curl/)
-- [Logpush using Python (example)](/tutorials/example-logpush-python/)
-- [Analyze logs with Google Cloud Platform](/analytics-integrations/google-cloud/)
+- [Parsing Cloudflare Logs JSON data](/tutorials/parsing-json-log-data/)
\ No newline at end of file
diff --git a/products/logs/src/content/tutorials/parsing-json-log-data.md b/products/logs/src/content/tutorials/parsing-json-log-data.md
index d8b21f03b56..74bd058c39a 100644
--- a/products/logs/src/content/tutorials/parsing-json-log-data.md
+++ b/products/logs/src/content/tutorials/parsing-json-log-data.md
@@ -1,6 +1,6 @@
 ---
-title: Parse Cloudflare Logs JSON data
 order: 85
+pcx-content-type: interim
 ---
 
 # Parse Cloudflare Logs JSON data
@@ -77,108 +77,6 @@ $ jq -r 'select(.WAFAction == "drop") | .ClientIP' logs.json | sort -n | uniq -c
 1 127.0.0.1
 ```
 
-## Understanding pathing
-
-The three pathing fields stored in Cloudflare Logs are:
-
-* *EdgePathingSrc* (pathing source)
-* *EdgePathingOp* (pathing operation)
-* *EdgePathingStatus* (pathing status)
-
-***EdgePathingSrc*** refers to the system that last handled the request before an error occurred or the request was passed to the cache server. Typically, this will be the macro/reputation list. Possible pathing sources include:
-
-* *err*
-* *sslv* (SSL verification checker)
-* *bic* (browser integrity check)
-* *hot* (hotlink protection)
-* *macro* (the reputation list)
-* *skip* (Always Online or CDNJS resources)
-* *user* (user firewall rule)
-
-For example:
-
-```bash
-$ jq -r .EdgePathingSrc logs.json | sort -n | uniq -c | sort -n | tail
-1 err
-5 user
-93 macro
-```
-
-***EdgePathingOp*** indicates how the request was handled. *wl* is a request that passed all checks and went to your origin server. Other possible values are:
-
-* *errHost* (host header mismatch, DNS errors, etc.)
-* *ban* (blocked by IP address, range, etc.)
-* *tempOk* (challenge successfully completed)
-* *chl* (challenge issued)
-
-For example:
-
-```bash
-$ jq -r .EdgePathingOp logs.json | sort -n | uniq -c | sort -n | tail
-1 chl
-1 errHost
-97 wl
-```
-
-***EdgePathingStatus*** is the value *EdgePathingSrc* returns. With a pathing source of *macro*, *user*, or *err*, the pathing status indicates the list where the IP address was found. *nr* is the most common value and it means that the request was not flagged by a security check. Some values indicate the class of user; for example, *se* means search engine. Others indicate whether the visitor saw an error or a captcha, such as, *captchaNew* or *jschlOK*.
-
-For example:
-
-```bash
-$ jq -r .EdgePathingStatus logs.json | sort -n | uniq -c | sort -n | tail
-1 captchaNew
-1 dnsErr
-5 ip
-92 nr
-```
-
-## How does pathing map to Threat Analytics?
-
-Certain combinations of pathing have been labeled in the Cloudflare **Threat Analytics** feature (in the **Analytics** app in the Cloudflare dashboard). The mapping is as follows:
-
-<TableWrap>
-
-| Pathing | Label |
-|---|---|
-| bic.ban.unknown | Bad browser |
-| hot.ban.unknown | Blocked hotlink |
-| hot.ban.ip | |
-| macro.ban.ip | Bad IP |
-| user.ban.ctry | Country block |
-| user.ban.ip | IP block (user) |
-| user.ban.ipr16 | IP range block (/16) |
-| user.ban.ipr24 | IP range block (/24) |
-| macro.chl.captchaErr | Captcha Error |
-| macro.chl.captchaFail | Human Challenged |
-| macro.chl.captchaNew | New CAPTCHA (CF) |
-| macro.chl.jschlFail | Browser Challenged |
-| macro.chl.jschlNew | Challenged threat |
-| macro.chl.jschlErr | Bot request |
-| user.chl.captchaNew | New CAPTCHA (user) |
-
-</TableWrap>
-
-## Understanding response fields
-
-The response status appears in three places in a request:
-
-* *edgeResponse*
-* *cacheResponse*
-* *originResponse*
-
-In your logs, the edge is what first accepts a visitor's request. The cache then accepts the request and either forwards it to your origin or responds from the cache. It's possible to have a request that has only an *edgeResponse* or a request that has an *edgeResponse* and a  *cacheResponse*, but no *originResponse*.
-
-This is how you can see where a request terminates. Requests with only an *edgeResponse* likely hit a security check or processing error. Requests with an *edgeResponse* and a *cacheResponse* either were served from the cache or saw an error contacting your origin server. Requests that have an *originResponse* went all the way to your origin server and errors seen would have been served directly from there.
-
-For example, the following query shows the status code and pathing information for all requests that terminated at the Cloudflare edge:
-
-```bash
-$ jq -r 'select(.OriginResponseStatus == null) | select(.CacheResponseStatus == null) |"\(.EdgeResponseStatus) / \(.EdgePathingSrc) / \(.EdgePathingStatus) / \(.EdgePathingOp)"' logs.json | sort -n | uniq -c | sort -n
-1 403 / macro / captchaNew / chl
-1 403 / macro / nr / wl
-1 409 / err / dnsErr / errHost
-```
-
 ## Showing cached requests
 
 To see your cache ratios, try the following query:
diff --git a/products/logs/src/content/tutorials/tutorial-logpush-curl.md b/products/logs/src/content/tutorials/tutorial-logpush-curl.md
deleted file mode 100644
index bff9d065123..00000000000
--- a/products/logs/src/content/tutorials/tutorial-logpush-curl.md
+++ /dev/null
@@ -1,299 +0,0 @@
----
-title: Manage Logpush with cURL
-order: 87
----
-
-# Manage Logpush with cURL
-
-You can manage your Cloudflare Logpush service from the command line using cURL.
-
-Before getting started, review:
-
-* [Understanding the Logpush API](/logpush/logpush-configuration-api/understanding-logpush-api)
-* [Logpush job object definition](https://api.cloudflare.com/#logpush-jobs-properties)
-
-## Step 1 - Get ownership challenge
-
-```bash
-curl -s -X POST \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/ownership \
--d '{"destination_conf":"s3://<BUCKET_PATH>?region=us-west-2"}' | jq .
-```
-
-### Parameters
-* *destination_conf* - see [Destination](/logpush/logpush-configuration-api/understanding-logpush-api/#destination) for details
-
-### Response
-
-A challenge file will be written to the destination, and the filename will be in the response (the filename may be expressed as a path if appropriate for your destination). For example:
-
-```bash
-{
-  "success": true,
-  "errors": [],
-  "messages": [],
-  "result": {
-    "filename": "burritobot/logs/ownership-challenge.txt",
-    "valid": true,
-    "message": ""
-  }
-}
-```
-
-You will need to provide the token contained in this file when creating a job in the next step.
-
-<Aside type="note" header="Note">
-
-When using Sumo Logic, you may find it helpful to have [Live Tail](https://help.sumologic.com/05Search/Live-Tail/About-Live-Tail) open to see the challenge file as soon as it's uploaded.
-</Aside>
-
-## Step 2 - Create a job
-
-```bash
-curl -s -X POST \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs \
--d'{"name":"<DOMAIN_NAME>", "destination_conf":"s3://<BUCKET_PATH>?region=us-west-2", "dataset": "http_requests", "logpull_options":"fields=RayID,EdgeStartTimestamp&timestamps=rfc3339", "ownership_challenge":"00000000000000000000"}' | jq .
-```
-
-### Parameters
-
-* *name* (optional) - we suggest using your domain name as the job name; cannot be changed after the job is created
-* *destination_conf* - see [Destination](/logpush/logpush-configuration-api/understanding-logpush-api/#destination) for details
-* *dataset* - the category of logs you want to receive; either  `http_requests` (default), `spectrum_events`, or `firewall_events`; cannot be changed after the job is created
-* *logpull_options* (optional) - see [Options](/logpush/logpush-configuration-api/understanding-logpush-api/#options)
-    * Typically includes the desired fields and timestamp format
-    * Set the timestamp format to RFC 3339 (`&timestamps=rfc3339`) for:
-      * Google BigQuery usage
-      * Automated timestamp parsing within Sumo Logic; *see [timestamps from Sumo Logic](https://help.sumologic.com/03Send-Data/Sources/04Reference-Information-for-Sources/Timestamps%2C-Time-Zones%2C-Time-Ranges%2C-and-Date-Formats) for details*
-* *ownership_challenge* - challenge token required to prove destination ownership
-
-### Response
-
-In the response, you get a newly-created job ID. For example:
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "id": 146,
-    "dataset": "http_requests",
-    "enabled": false,
-    "name": "<DOMAIN_NAME>",
-    "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
-    "last_complete": null,
-    "last_error": null,
-    "error_message": null
-  },
-  "success": true
-}
-```
-
-Note that you can validate the `logpull_options` parameter before including it in your job configuration:
-
-```bash
-curl -s -X POST https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/validate/origin -d '{"logpull_options": "fields=EdgeStartTimestamp,RayID,CacheCacheStatus&timestamps=rfc3339", "dataset": "http_requests"}' | jq .
-```
-
-### Response
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {
-    "message": "",
-    "valid": true
-  },
-  "success": true
-}
-```
-
-## Step 3 - Enable (update) a job
-
-Start by retrieving information about a specific job, using a job ID:
-
-```bash
-curl -s -X GET \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
-```
-
-### Response
-
-```json
-{
- "errors": [],
- "messages": [],
- "result": {
-     "id": 146,
-     "dataset": "http_requests",
-     "enabled": false,
-     "name": "<DOMAIN_NAME>",
-     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
-     "last_complete": null,
-     "last_error": null,
-     "error_message": null
- },
- "success": true
-}
-```
-
-Note that by default a job is not enabled (`"enabled": false`).
-
-If you don't remember your job ID, you can retrieve it using your zone ID:
-
-```bash
-curl -s -X GET \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs | jq .
-```
-
-Next, to enable the job, send an update request:
-
-```bash
-curl -s -X PUT \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 -d'{"enabled":true}' | jq .
-```
-
-### Response
-
-```json
-{
- "errors": [],
- "messages": [],
- "result": {
-     "id": 146,
-     "dataset": "http_requests",
-     "enabled": true,
-     "name": "<DOMAIN_NAME>",
-     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
-     "last_complete": null,
-     "last_error": null,
-     "error_message": null
- },
- "success": true
-}
-```
-
-Once the job is enabled, you will start receiving logs within a few minutes and then in batches as soon as possible until you disable the job. For zones with very high request volume, it may take several hours before you start receiving logs for the first time.
-
-In addition to modifying *enabled*, you can also update the value for *logpull_options*. To modify *destination_conf*, you will need to request an ownership challenge and provide the associated token with your update request. You can also delete your current job and create a new one.
-
-Once a job has been enabled and has started executing, the *last_complete* field will show the time when the last batch of logs was successfully sent to the destination:
-
-### Request to get job by ID and see *last_complete* info
-
-```bash
-curl -s -X GET \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>logpush/jobs/146 | jq .
-```
-
-### Response
-
-```json
-{"errors": [],
- "messages": [],
- "result": {
-     "id": 146,
-     "dataset": "http_requests",
-     "enabled": true,
-     "name": "<DOMAIN_NAME>",
-     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
-     "last_complete": "2018-08-09T21:26:00Z",
-     "last_error": null,
-     "error_message": null
- },
- "success": true
-}
-```
-
-## Step 4 - Delete a job
-
-```bash
-curl -s -X DELETE \
-https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
-```
-
-Be careful when deleting a job because this action cannot be reversed.
-
-### Response
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": {},
-  "success": true
-}
-```
-
-## Step 5 - Retrieve your job
-
-Retrieve a specific job, using the job ID:
-
-```bash
-curl -s -X GET https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/146 | jq .
-```
-
-### Response
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": [
-    {
-     "id": 146,
-     "dataset": "http_requests",
-     "enabled": true,
-     "name": "<DOMAIN_NAME>",
-     "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
-     "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
-     "last_complete": null,
-     "last_error": null,
-     "error_message": null
-    }
-  ],
-  "success": true
-}
-```
-
-Retrieve all jobs for all data sets:
-
-```bash
-curl -s -X GET https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs | jq .
-```
-
-### Response
-
-```json
-{
-  "errors": [],
-  "messages": [],
-  "result": [
-    {
-      "id": 8029,
-      "dataset": "spectrum_events",
-      "enabled": true,
-      "name": "<DOMAIN_NAME>",
-      "logpull_options": "fields=Application,ClientAsn,ClientIP,ColoCode,Event,OriginIP,Status",
-      "destination_conf": "s3://<BUCKET_PATH_SPECTRUM_EVENTS>?region=us-west-2",
-      "last_complete": "2019-10-01T00:25:00Z",
-      "last_error": null,
-      "error_message": null
-    },
-    {
-      "id": 7826,
-      "dataset": "http_requests",
-      "enabled": false,
-      "name": "<DOMAIN_NAME>",
-      "logpull_options": "fields=ClientIP,ClientRequestHost,ClientRequestMethod,ClientRequestURI,EdgeEndTimestamp,EdgeResponseBytes,EdgeResponseStatus,EdgeStartTimestamp,RayID&timestamps=rfc3339&sample=0.06",
-      "destination_conf": "s3://<BUCKET_PATH_HTTP_REQUESTS>?region=us-west-2",
-      "last_complete": "2019-09-24T21:15:00Z",
-      "last_error": null,
-      "error_message": null
-    },
-```
diff --git a/products/logs/wrangler.toml b/products/logs/wrangler.toml
index 672714fbd35..f37eebdc375 100644
--- a/products/logs/wrangler.toml
+++ b/products/logs/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/logs*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "363aafe4266d4760a395aa350fedfa2e" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/magic-firewall/README.md b/products/magic-firewall/README.md
new file mode 100644
index 00000000000..83d8d4e2ca8
--- /dev/null
+++ b/products/magic-firewall/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Magic Firewall docs
+
+[View docs →](https://developers.cloudflare.com/magic-firewall)
+
+[Read contributor guidelines →](https://github.com/cloudflare/cloudflare-docs/blob/6d67d0dda5bfac6f02157dd896ce4ba77ef2acbe/CONTRIBUTING.md)
diff --git a/products/magic-firewall/docs-config.js b/products/magic-firewall/docs-config.js
new file mode 100644
index 00000000000..0d5ad17c567
--- /dev/null
+++ b/products/magic-firewall/docs-config.js
@@ -0,0 +1,33 @@
+module.exports = {
+  product: "Magic Firewall",
+  pathPrefix: "/magic-firewall",
+  productIconKey: "firewall",
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/magic-firewall",
+  externalLinks: [
+    {
+      title: "Magic Transit home",
+      url: "https://www.cloudflare.com/magic-transit/"
+    },
+    {
+      title: "Blog: Magic WAN & Magic Firewall",
+      url: "https://blog.cloudflare.com/introducing-magic-firewall/"
+    },
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:magic-firewall"]'}
+  },
+  siteMetadata: {
+    title: "Cloudflare Magic Firewall docs",
+    description: "Magic Firewall a network-level firewall delivered through Cloudflare to secure your enterprise.",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/magic-firewall",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+  }
+}
diff --git a/products/magic-firewall/package.json b/products/magic-firewall/package.json
new file mode 100644
index 00000000000..ea02638c7ca
--- /dev/null
+++ b/products/magic-firewall/package.json
@@ -0,0 +1,14 @@
+{
+  "private": true,
+  "dependencies": {
+    "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+  },
+  "scripts": {
+    "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+    "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+    "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+    "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+    "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+    "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+  }
+}
diff --git a/products/magic-firewall/src/content/examples.md b/products/magic-firewall/src/content/examples.md
new file mode 100644
index 00000000000..a6d1a5bb46c
--- /dev/null
+++ b/products/magic-firewall/src/content/examples.md
@@ -0,0 +1,63 @@
+---
+title: Examples
+order:  5
+pcx-content-type: configuration
+---
+
+# Examples
+
+## Skip Action
+
+The example below blocks all tcp ports, but allows one port (8080)
+by using the skip action.
+
+```
+curl -X POST https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
+-H 'Content-Type: application/json' \
+-H 'X-Auth-Email: user@example.com' \
+-H 'X-Auth-Key: 00000000000' \
+--data '{
+    "name": "Example ruleset",
+    "kind": "root",
+    "phase": "magic_transit",
+    "description": "Example ruleset description",
+    "rules": [
+      {
+        "action": "skip",
+        "action_parameters": { "ruleset": "current" },
+        "expression": "tcp.dstport in { 8080 } ",
+        "description": "Allow port 8080"
+      },
+      {
+        "action": "block",
+        "expression": "tcp.dstport in { 1..65535 }",
+        "description": "Block all tcp ports"
+      }
+    ]
+}'
+```
+
+## Blocking a Country
+
+The example below allows all packets with a source or destion IP coming from Brazil by using its 2-letter country code in <a href="https://www.iso.org/obp/ui/#search/code/">ISO 3166-1 Alpha 2</a> format. 
+
+
+```
+curl -X POST https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
+-H 'Content-Type: application/json' \
+-H 'X-Auth-Email: user@example.com' \
+-H 'X-Auth-Key: 00000000000' \
+--data '{
+    "name": "Example ruleset",
+    "kind": "root",
+    "phase": "magic_transit",
+    "description": "Example ruleset description",
+    "rules": [
+      {
+        "action": "block",
+        "expression": "ip.geoip.country == \"BR\"",
+        "description": "Block traffic from Brazil"
+      }
+    ]
+}'
+```
diff --git a/products/magic-transit/src/content/magic-firewall/forming-an-expression.md b/products/magic-firewall/src/content/forming-an-expression.md
similarity index 76%
rename from products/magic-transit/src/content/magic-firewall/forming-an-expression.md
rename to products/magic-firewall/src/content/forming-an-expression.md
index 7426a71565b..2d004a7c773 100644
--- a/products/magic-transit/src/content/magic-firewall/forming-an-expression.md
+++ b/products/magic-firewall/src/content/forming-an-expression.md
@@ -1,11 +1,12 @@
 ---
-title: Forming an expression
+title: Form expressions
 order: 4
+pcx-content-type: concept
 ---
 
 # Forming an expression
 
-Rules are written as using the Cloudflare Firewall Rules language - a DSL intended to mimic Wireshark semantics. See the documentation for more details: https://developers.cloudflare.com/firewall/cf-firewall-language
+Rules are written as using the Cloudflare Firewall Rules language - a DSL intended to mimic Wireshark semantics. For more information, refer to the [Firewall Rules language](]https://developers.cloudflare.com/firewall/cf-firewall-language).
 
 To start with a simple case, here's how you'd match a source IP:
 
@@ -15,11 +16,11 @@ Expressions can be more complex by joining multiple clauses via a logical operat
 
 ```ip.src == 192.0.2.1 && (tcp.flags.push || tcp.flags.reset)```
 
-# Capabilities
+## Capabilities
 
 You can use Magic Firewall to skip or block packets based on source or destination IP, source or destination port, protocol, packet length, or bit field match.
 
-# Restrictions
+## Restrictions
 
 Wirefilter comparisons support CIDR notation, but only inside sets.  For example:
 
@@ -28,7 +29,7 @@ ip.src == 192.0.2.0/24  # bad
 ip.src in { 192.0.2.0/24 }  # good
 ```
 
-Expressions have a complexity limit. It is most easily reached when there are many joined or nested clauses in the expression.  Here's an example:
+Expressions have a complexity limit that is easily reached when many joined or nested clauses are in the expression.  Here's an example:
 
 ```
 (tcp.dstport == 1000 || tcp.dstport == 1001) && (tcp.dstport == 1002 || tcp.dstport == 1003) && (tcp.dstport == 1004 || tcp.dstport == 1005) && (tcp.dstport == 1006 || tcp.dstport == 1007) && (tcp.dstport == 1008 || tcp.dstport == 1009) && (tcp.dstport == 1010 || tcp.dstport == 1011) && (tcp.dstport == 1012 || tcp.dstport == 1013) && (tcp.dstport == 1014 || tcp.dstport == 1015) && (tcp.dstport == 1016 || tcp.dstport == 1017)
diff --git a/products/magic-firewall/src/content/index.md b/products/magic-firewall/src/content/index.md
new file mode 100644
index 00000000000..072e568c93a
--- /dev/null
+++ b/products/magic-firewall/src/content/index.md
@@ -0,0 +1,33 @@
+---
+title: Magic Firewall
+order: 2
+pcx-content-type: concept
+---
+
+# Magic Firewall
+
+Magic Firewall is a network-level firewall delivered through Cloudflare to protect your network. It is
+configurable by all Magic Transit customers from the dashboard under **Firewall Rulesets** or by making calls to Cloudflare's API. Rules can be crafted in Wireshark syntax, a domain-specific language common in the networking world and the same syntax used across our other products. With this syntax, you can easily craft powerful rules to precisely allow or deny any traffic in or out of your network.
+
+Access to the API is controlled by the `#waf:read` and `#waf:write` permissions.
+
+Magic Firewall allows you to define skip and block rules on any packet characteristics including source and destination IP, source and destination port, protocol, packet length, and bit field match.
+
+Start by [adding a rule](/magic-firewall/rules)!
+
+<Aside type='warning' header='Important'>
+
+When you or your end users are using other Cloudflare services (eg. CDN, Spectrum) that proxy traffic, be aware of the following:
+
+- Firewall rules that block traffic based on source IP address may not work as intended because rules are evaluated after Cloudflare terminates the incoming TCP connections.
+- You must allow [Cloudflare IP addresses](https://www.cloudflare.com/ips/).
+- When using Magic Firewall, fragmented packets are reassembled into complete packets before they are inspected. As a result, you cannot create firewall rules for fragments.
+
+</Aside>
+
+<Aside type="warning" header="Beta">
+
+The Magic Firewall API is currently in beta; contact your account team if you're interested in early access.
+  
+</Aside>
+
diff --git a/products/magic-firewall/src/content/rules.md b/products/magic-firewall/src/content/rules.md
new file mode 100644
index 00000000000..c65aaddbee9
--- /dev/null
+++ b/products/magic-firewall/src/content/rules.md
@@ -0,0 +1,32 @@
+---
+title: Rules
+order:  2
+pcx-content-type: how-to
+---
+
+# Rules
+
+You can check for an existing root ruleset from the dashboard or via the [Account rulesets API](https://api.cloudflare.com/#account-rulesets-properties). If you are a new Magic Transit customer, you may not have a root ruleset created for your account.
+
+To view examples for root rulesets, review the the [Magic Firewall Terraform documentation](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/magic_firewall_ruleset).
+
+## Add a rule
+
+1. From your dashboard, click **Firewall Rulesets**.
+1. Click **Magic Firewall**.
+1. Click **Add a Rule**.
+1. Fill out the information for your new rule.
+1. When you are done, click **Add new rule**.
+
+## Update a rule
+
+1. From your dashboard, click **Firewall Rulesets**.
+1. Click **Magic Firewall**. A list of firewall rules displays.
+1. Locate the rule you want to edit and click **Edit**.
+1. Update the rule with your changes and click **Edit rule**.
+
+## Delete an existing rule
+
+1. Locate the rule you'd like to delete in the list.
+1. From the end of the row, click **Delete**.
+1. Click **Delete** again to confirm the deletion.
diff --git a/products/magic-firewall/wrangler.toml b/products/magic-firewall/wrangler.toml
new file mode 100644
index 00000000000..4bdf8b2ad01
--- /dev/null
+++ b/products/magic-firewall/wrangler.toml
@@ -0,0 +1,14 @@
+name = "magic-firewall"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/magic-firewall*"
+
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
diff --git a/products/magic-transit/docs-config.js b/products/magic-transit/docs-config.js
index 9d5194f8425..53e2a4c1fd9 100644
--- a/products/magic-transit/docs-config.js
+++ b/products/magic-transit/docs-config.js
@@ -32,6 +32,6 @@ module.exports = {
     description: "Magic Transit delivers network functions at Cloudflare scale—DDoS protection, traffic acceleration, and much more from every Cloudflare data center—for on-premise, cloud-hosted, and hybrid networks.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/magic-transit",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/magic-transit/src/content/about/bandwidth-measurement.md b/products/magic-transit/src/content/about/bandwidth-measurement.md
index 2b2489dcbc4..21cfe28fdae 100644
--- a/products/magic-transit/src/content/about/bandwidth-measurement.md
+++ b/products/magic-transit/src/content/about/bandwidth-measurement.md
@@ -1,9 +1,10 @@
 ---
-order: 4
+order: 
+pcx-content-type: concept 
 ---
 
 # Bandwidth measurement
 
-Cloudflare measures Magic Transit usage based on the 95th percentile of clean bandwidth for your network. "Clean bandwidth" refers to the egress traffic routed to your network after all DDoS mitigation and firewall functions are applied, so this usage measurement explicitly does not include attack traffic that is blocked at Cloudflare's edge.
+Cloudflare measures Magic Transit usage based on the 95th percentile of clean bandwidth for your network. "Clean bandwidth" refers to the egress traffic routed to your network after all DDoS mitigation and firewall functions are applied. The usage measurement explicitly excludes attack traffic blocked at Cloudflare's edge.
 
 To measure 95th percentile bandwidth, Cloudflare records clean bandwidth leaving our edge at five minute intervals, sorts these measurements in descending order, and discards the top 5% of recorded measurements. The highest remaining value constitutes the 95th percentile bandwidth measurement for that time period.
diff --git a/products/magic-transit/src/content/about/flow-based-monitoring.md b/products/magic-transit/src/content/about/flow-based-monitoring.md
new file mode 100644
index 00000000000..56a959b80cc
--- /dev/null
+++ b/products/magic-transit/src/content/about/flow-based-monitoring.md
@@ -0,0 +1,26 @@
+---
+title: Flow-based monitoring
+order:
+pcx-content-type: how-to
+---
+
+# Flow-based monitoring
+
+Flow-based monitoring works with [Magic Transit on demand](/on-demand) to detect and notify you about attacks based on traffic flows from your data centers. You can configure your routers to continuously send NetFlow data to Cloudflare where the flow data is ingested and analyzed for volumetric DDoS attacks. When an attack is detected, Cloudflare automatically notifies you by email, [webhook](https://developers.cloudflare.com/fundamentals/notifications/configure-create/create-notifications#webhooks-to-external-services), or [PagerDuty](https://developers.cloudflare.com/fundamentals/notifications/configure-create/create-notifications#pagerduty) with information about the attack.
+
+You can choose to activate IP advertisement via the Cloudflare dashboard or API.. After Magic Transit is activated and your traffic is flowing through Cloudflare, you only receive the clean traffic back to your network over your GRE tunnels.
+
+To activate IP advertisement via the Cloudflare dashboard, refer to [​using the IP Prefixes page to configure dynamic advertisement](https://developers.cloudflare.com/byoip/dynamic-advertisement/configure-dynamic-advertisement#use-the-ip-prefixes-page-to-configure-dynamic-advertisement).
+
+To activate IP advertisement via the API, refer to the [IP Address Management Dynamic Advertisement API](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-properties).
+
+## Enable Flow-based monitoring alerts
+
+1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login) and select **Notifications**.
+1. From **Notifications**, click **Add**.
+1. Locate **Magic Transit** in the list and click **Select** to add a Flow-based Monitoring: Volumetric Attack notification.
+1. Enter a name and description for the notification.
+1. Add an email address for the person who should receive the notification.
+1. Click **Create** when you are done.
+
+For more information on receiving notifications via PagerDuty or using webhooks, refer to [create a notification](https://developers.cloudflare.com/fundamentals/notifications/configure-create/create-notifications).
\ No newline at end of file
diff --git a/products/magic-transit/src/content/about/health-checks.md b/products/magic-transit/src/content/about/health-checks.md
new file mode 100644
index 00000000000..68a8a63a77d
--- /dev/null
+++ b/products/magic-transit/src/content/about/health-checks.md
@@ -0,0 +1,28 @@
+---
+order: 
+pcx-content-type: concept
+---
+
+# Health checks
+
+Magic Transit health checks monitor network status and the health of specific network components. To accurately and precisely monitor the health of a specific route, each Cloudflare edge server associated with your network asynchronously emits health check probes every 60 seconds.
+
+Because Cloudflare sends probes asynchronously, origin routers typically receive several hundred per minute. This allows Magic Transit to detect failures almost immediately.
+
+Magic Transit performs two types of health checks: endpoint health checks and tunnel health checks.
+
+## Endpoint health checks
+
+Endpoint health checks evaluate connectivity from Cloudflare distributed data centers to your origin network. Designed to provide a broad picture of Internet health, endpoint probes flow over available tunnels and do not inform tunnel selection or steering logic.
+
+Cloudflare edge servers issue endpoint health checks outside of customer network namespaces and typically target endpoints beyond the tunnel-terminating border router. Each server sends one endpoint health check every ten minutes.
+
+During onboarding, you [specify IP addresses to configure endpoint health checks](/get-started/configure-tunnels/specify-ip-addresses-for-endpoint-health-checks).
+
+## Tunnel health checks
+
+Tunnel health checks monitor the status of the Generic Routing Encapsulation (GRE) tunnels that route traffic from Cloudflare to your origin network. Magic Transit relies on health checks to steer traffic to the best available routes.
+
+During onboarding, you [specify the GRE tunnel endpoints](/get-started/configure-tunnels/specify-gre-tunnel-endpoints) the tunnel probes originating from Cloudflare's edge network will target.
+
+Tunnel health check results are exposed via an [API](https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/). These results are aggregated from individual health check results done on Cloudflare servers.
diff --git a/products/magic-transit/src/content/about/health-checks/endpoint.md b/products/magic-transit/src/content/about/health-checks/endpoint.md
deleted file mode 100644
index 0119ef140f2..00000000000
--- a/products/magic-transit/src/content/about/health-checks/endpoint.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Endpoint
-order: 2
----
-
-# Endpoint health checks
-
-Endpoint health checks evaluate connectivity from Cloudflare distributed data centers to your origin network. Designed to provide a broad picture of Internet health, endpoint probes flow over available tunnels and do not inform tunnel selection or steering logic.
-
-Cloudflare edge servers issue endpoint health checks outside of customer network namespaces and typically target endpoints beyond the tunnel-terminating border router. Each server sends one endpoint health check every ten minutes.
-
-Cloudflare configures health checks with endpoint IP addresses you supply during the onboarding process. For more on endpoint health check configuration, see _[Specify IP addresses for endpoint health checks](/set-up/provide-configuration-data/specify-ip-addresses-for-endpoint-health-checks)_.
diff --git a/products/magic-transit/src/content/about/health-checks/index.md b/products/magic-transit/src/content/about/health-checks/index.md
deleted file mode 100644
index ec3179be140..00000000000
--- a/products/magic-transit/src/content/about/health-checks/index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 0
----
-
-# Health checks
-
-Magic Transit health checks monitor network status and the health of specific network components. To accurately and precisely monitor the health of a specific route, each Cloudflare edge server associated with your network asynchronously emits health check probes every 60 seconds.
-
-Because Cloudflare sends probes asynchronously, origin routers typically receive several hundred per minute. This allows Magic Transit to detect failures almost immediately.
-
-Magic Transit performs two types of health check:
-
-- __[Endpoint health checks](/about/health-checks/endpoint/)__ determine the overall health of inter-network connections by probing an endpoint deep within your network, across active tunnels.
-
-- __[Tunnel health checks](/about/health-checks/tunnel)__ monitor the Generic Routing Encapsulation (GRE) tunnels that route traffic from Cloudflare to your network. Tunnel health check probes originate from within your dedicated network namespaces and typically target your GRE tunnel endpoint. Health check results influence how Cloudflare steers traffic across primary and failover tunnels so that packets transit the healthiest available routes.
diff --git a/products/magic-transit/src/content/about/health-checks/tunnel.md b/products/magic-transit/src/content/about/health-checks/tunnel.md
deleted file mode 100644
index d7f853dca71..00000000000
--- a/products/magic-transit/src/content/about/health-checks/tunnel.md
+++ /dev/null
@@ -1,102 +0,0 @@
----
-title: Tunnel
-order: 1
----
-
-# Tunnel health checks
-
-Tunnel health checks monitor the status of the Generic Routing Encapsulation (GRE) tunnels that route traffic from Cloudflare to your origin network. Magic Transit relies on health checks to steer traffic to the best available routes.
-
-Tunnel probes originate from Cloudflare’s edge network and target the GRE tunnel endpoints you supply during the Magic Transit [onboarding process](/set-up/onboarding/).
-
-Tunnel health check results are exposed via an [API](https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-magic-transit-tunnel-healthcheck-results/). These results are aggregated from individual health check results done on Cloudflare servers.
-
-## Probe construction
-
-A tunnel health check probe consists of an ICMP (Internet Control Message Protocol) reply packet that originates from an IP address on the origin side of the GRE tunnel and whose destination address is a public Cloudflare IP.
-
-Cloudflare encapsulates the ICMP reply packet and transmits the probe across the GRE tunnel to the origin. When the probe reaches the origin router, the router decapsulates the ICMP reply and forwards it to the specified destination IP. The probe is successful when Cloudflare receives the reply.
-
-Every Cloudflare edge server configured to process your traffic sends a tunnel health check probe every 60 seconds. When a probe attempt fails, each server detecting the failure quickly probes up to 2 more times to obtain an accurate result.
-
-<Aside type='note' header='Note'>
-
-To avoid control plane policies enforced by the origin network, tunnel health checks use an encapsulated ICMP reply (rather than an ICMP echo request). To use echo request packets, please contact your Cloudflare account team.
-
-</Aside>
-
-This Wireshark screenshot shows a collection of example health check packets:
-
-![Magic Transit Tunnel health check packets](../../static/tunnel-health-check-packets.png)
-
-Since each Cloudflare edge server that processes your traffic emits a probe every 60 seconds, expect your network to receive several hundred health check packets per second. This represents a relatively trivial amount of traffic.
-
-## Tunnel traffic management
-
-Magic Transit uses tunnel health check packets to prioritize and steer traffic among tunnels.
-
-### Health state and prioritization
-
-There are three tunnel health states: **_Healthy_** tunnels are preferred to **_Degraded_** tunnels, and _Degraded_ tunnels are preferred to those that are **_Down_**.
-
-Magic Transit steers traffic to tunnels based on priorities you set when you [assign tunnel route priorities](/set-up/provide-configuration-data/assign-tunnel-route-priorities) during the [onboarding process](/set-up/onboarding).
-
-Tunnel routes with lower values have priority over those with higher values.
-
-<Aside type='note' header='Note'>
-
-Since Cloudflare does not synchronize the health checks among edge servers and the Internet is not homogenous, Cloudflare edge servers may be able to reach the origin infrastructure from some locations at a given time but not others.
-
-As a result, tunnel health may be in different states in different parts of the world at the same time. In our example, both tunnels could receive traffic simultaneously, even though Tunnel 1 has priority over Tunnel 2.
-
-</Aside>
-
-#### Failure
-
-When 0.1% or more of tunnel health checks (at least 2) fail in the previous 5 minutes, Magic Transit considers the link lossy and sets the tunnel state to _Degraded_. In response, Magic Transit immediately sets tunnel status to _Degraded_ and applies a priority penalty. Magic Transit requires 2 failures so that a single lost packet does not trigger a penalty.
-
-When all health checks (at least 3 samples) in the last 1 second fail, Magic Transit immediately transitions the tunnel from _Healthy_ to _Down_ and applies a priority penalty to routes through that tunnel.
-
-When Magic Transit identifies a route that is not healthy, it applies the these penalties:
-
-- _Degraded_: Add 500,000 to priority.
-- _Down_: Add 1,000,000 to priority.
-
-The values for failure penalties are designed to be extreme so that they always exceed the priority values you assign in the [routing configuration](/set-up/provide-configuration-data/assign-tunnel-route-priorities).
-
-Applying a penalty rather than removing the route altogether preserves redundancy and maintains options for customers with only one tunnel. It also supports the case when multiple tunnels are unhealthy.
-
-#### Recovery
-
-Once a tunnel is in the _Down_ state, edge servers continue to emit probes every 60 seconds. When a probe returns _Healthy_, the edge server that received the healthy packet immediately sends two more probes. If these probes return _Healthy_, Magic Transit sets tunnel status to _Degraded_.
-
-Tunnels in a _Degraded_ state transition to _Healthy_ when the failure rate for the previous 30 probes is less than 5%. This transition may take up to 30 minutes.
-
-Magic Transit’s tunnel health check system allows a tunnel to transition quickly from _Healthy_ to _Degraded_ or _Down_ but only slowly from _Degraded_ or _Down_ to _Healthy_. This [hysteresis](https://en.wikipedia.org/wiki/Hysteresis) dampens changes to tunnel routing caused by flapping and other intermittent network failures.
-
-<Aside type="note" header="Note">
-Cloudflare always attempts to send traffic over available tunnel routes with the highest priority, even when all configured tunnels are in an unhealthy state.
-</Aside>
-
-### Example
-
-Consider 2 tunnels and their associated routing priorities. Lower route values have priority:
-
-- Tunnel 1, route priority 100
-- Tunnel 2, route priority 200
-
-When both tunnels are in a _Healthy_ state, routing priority directs traffic exclusively to Tunnel 1, since its route priority of 100 beats that of Tunnel 2. Tunnel 2 does not receive any traffic, except for tunnel health check probes. Endpoint health checks only flow over Tunnel 1 to their destination inside the origin network.
-
-#### Failure response
-
-If the link between Tunnel 1 and Cloudflare becomes unusable, Cloudflare edge servers discover the failure on their next health check probe and immediately issue two more probes.
-
-When an edge server does not receive the proper ICMP reply packets from these two additional probes, it labels Tunnel 1 _Down_ and downgrades Tunnel 1 priority to 1,000,100, shifting priority to Tunnel 2. Immediately, Magic Transit steers packets arriving at that edge server to Tunnel 2.
-
-#### Recovery response
-
-Suppose the connectivity issue that had set Tunnel 1 health to _Down_ is now resolved. At the next health check interval, the issuing edge server receives a successful probe and immediately sends two more probes to validate tunnel health.
-
-When all three probes return successfully, Magic Transit transitions the tunnel from _Down_ to _Degraded_. As part of this transition, Cloudflare reduces the priority penalty for that route so that its priority is 500,100.  Since Tunnel 2 has a priority of 200, traffic continues to flow over Tunnel 2.
-
-Edge servers continue probing Tunnel 1. When the health check failure rate drops below 0.1% for a 5-minute period, Magic Transit sets tunnel status to _Healthy_. Tunnel 1’s routing priority is fully restored to 100, and traffic steering returns the data flow to Tunnel 1.
diff --git a/products/magic-transit/src/content/about/index.md b/products/magic-transit/src/content/about/index.md
index 7ac26edb617..bbfd011207e 100644
--- a/products/magic-transit/src/content/about/index.md
+++ b/products/magic-transit/src/content/about/index.md
@@ -1,20 +1,17 @@
 ---
 title: About
 order: 1
+pcx-content-type: concept
 ---
 
 # About Magic Transit
 
-![Magic Transit deployment diagram](../static/magic-transit-architecture.png)
-
 Magic Transit delivers its connectivity, security, and performance benefits by serving as the “front door” to your IP network. This means it accepts IP packets destined for your network, processes them, and then outputs them to your origin infrastructure.
 
 The Cloudflare network uses Border Gateway Protocol (BGP) to announce your company’s IP address space, extending your network presence globally, and Cloudflare uses [Anycast](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) to ingest your traffic. Today, Cloudflare’s Anycast edge network spans 193 cities in more than 90 countries around the world.
 
 Once packets hit Cloudflare’s network, traffic is inspected for attacks, filtered, steered, accelerated, and sent onward to your origin. Magic transit connects to your origin infrastructure using Anycast Generic Routing Encapsulation (GRE) tunnels over the Internet or, with [Cloudflare Network Interconnect (CNI)](https://developers.cloudflare.com/network-interconnect), via physical or virtual interconnect.
 
-For more on how Magic Transit works, see these articles:
+For more on how Magic Transit works, review the information below.
 
 <DirectoryListing path="/about"/>
-
-For a guide to the Magic Transit onboarding process, requirements, and configuration data, see [_Set up Magic Transit_](/set-up).
diff --git a/products/magic-transit/src/content/about/probe-construction.md b/products/magic-transit/src/content/about/probe-construction.md
new file mode 100644
index 00000000000..eb0f9685938
--- /dev/null
+++ b/products/magic-transit/src/content/about/probe-construction.md
@@ -0,0 +1,95 @@
+---
+title: Probe construction
+order: 
+pcx-content-type: concept
+---
+
+# Probe construction
+
+A tunnel health check probe contains an ICMP (Internet Control Message Protocol) reply packet that originates from an IP address on the origin side of the GRE tunnel and whose destination address is a public Cloudflare IP.
+
+Cloudflare encapsulates the ICMP reply packet and sends the probe across the GRE tunnel to the origin. When the probe reaches the origin router, the router decapsulates the ICMP reply and forwards it to the specified destination IP. The probe is successful when Cloudflare receives the reply.
+
+Every Cloudflare edge server configured to process your traffic sends a tunnel health check probe every 60 seconds. When a probe attempt fails, each server detecting the failure quickly probes up to two more times to obtain an accurate result. Because Cloudflare edge servers send probes every 60 seconds, you can expect your network to receive several hundred health check packets per second. This represents a relatively trivial amount of traffic.
+
+<Aside type='note' header='Note'>
+
+To avoid control plane policies enforced by the origin network, tunnel health checks use an encapsulated ICMP reply instead of an ICMP echo request. To use echo request packets, contact your Cloudflare account team.
+
+</Aside>
+
+<details>
+<summary>
+    Wireshark example of health check packets
+</summary>
+  <div class="special-class" markdown="1">
+
+![Magic Transit Tunnel health check packets](../static/tunnel-health-check-packets.png)
+</div>
+</details>
+
+## Health state and prioritization
+
+There are three tunnel health states: **Healthy**, **Degraded**, and **Down**.
+
+**Healthy** tunnels are preferred to **Degraded** tunnels, and Degraded tunnels are preferred to those that are **Down**.
+
+Magic Transit steers traffic to tunnels based on priorities you set when you [assign tunnel route priorities](/get-started/configure-tunnels/assign-tunnel-route-priorities) during onboarding. Tunnel routes with lower values have priority over those with higher values.
+
+<Aside type='note' header='Note'>
+
+Cloudflare edge servers may be able to reach the origin infrastructure from some locations at a given time but not others. This occurs because Cloudflare does not synchronize health checks among edge servers and because the Internet is not homogenous.
+
+As a result, tunnel health may be in different states in different parts of the world at the same time. In this example, both tunnels could receive traffic simultaneously, even though Tunnel 1 has priority over Tunnel 2.
+
+</Aside>
+
+## Tunnel health check failure
+
+When at least two or 0.1% or more of tunnel health checks fail in the previous five minutes, Magic Transit considers the link lossy and sets the tunnel state to **Degraded**. Magic Transit then immediately sets the tunnel status to **Degraded** and applies a priority penalty and requires two failures so that a single lost packet does not trigger a penalty.
+
+When all health checks or at least three samples in the last one second fail, Magic Transit immediately transitions the tunnel from **Healthy** to **Down** and applies a priority penalty to routes through that tunnel.
+
+When Magic Transit identifies a route that is not healthy, it applies the these penalties:
+
+- Degraded: Add 500,000 to priority.
+- Down: Add 1,000,000 to priority.
+
+The values for failure penalties are intentionally extreme so that they always exceed the priority values assigned during [routing configuration](/get-started/configuure-tunnels/assign-tunnel-route-priorities).
+
+Applying a penalty instead of removing the route altogether preserves redundancy and maintains options for customers with only one tunnel. Penalties also support the case when multiple tunnels are unhealthy.
+
+## Recovery
+
+Once a tunnel is in the **Down** state, edge servers continue to emit probes every 60 seconds. When a probe returns **Healthy**, the edge server that received the healthy packet immediately sends two more probes. If the two probes return **Healthy**, Magic Transit sets the tunnel status to **Degraded**.
+
+Tunnels in a **Degraded** state transition to **Healthy** when the failure rate for the previous 30 probes is less than 5%. This transition may take up to 30 minutes.
+
+Magic Transit’s tunnel health check system allows a tunnel to quickly transition from **Healthy** to **Degraded** or **Down**, but tunnel transition occurs slowly from **Degraded** or **Down** to **Healthy**. This scenario is referred to as hysteresis — which is when a system's output depends on its history of past inputs — and dampens changes to tunnel routing caused by flapping and other intermittent network failures.
+
+<Aside type="note" header="Note">
+Cloudflare always attempts to send traffic over available tunnel routes with the highest priority, even when all configured tunnels are in an unhealthy state.
+</Aside>
+
+## Example
+
+Consider two tunnels and their associated routing priorities. Remember that lower route values have priority.
+
+- Tunnel 1, route priority 100
+- Tunnel 2, route priority 200
+
+When both tunnels are in a **Healthy** state, routing priority directs traffic exclusively to Tunnel 1 because its route priority of 100 beats that of Tunnel 2. Tunnel 2 does not receive any traffic, except for tunnel health check probes. Endpoint health checks only flow over Tunnel 1 to their destination inside the origin network.
+
+### Failure response
+
+If the link between Tunnel 1 and Cloudflare becomes unusable, Cloudflare edge servers discover the failure on their next health check probe and immediately issue two more probes.
+
+When an edge server does not receive the proper ICMP reply packets from these two additional probes, the edge server labels Tunnel 1 as **Down** and downgrades Tunnel 1 priority to 1,000,100. The priority then shifts to Tunnel 2, and Magic Transit immediately steers packets arriving at that edge server to Tunnel 2.
+
+### Recovery response
+
+Suppose the connectivity issue that set Tunnel 1 health to **Down** becomes resolved. At the next health check interval, the issuing edge server receives a successful probe and immediately sends two more probes to validate tunnel health.
+
+When all three probes return successfully, Magic Transit transitions the tunnel from **Down** to **Degraded**. As part of this transition, Cloudflare reduces the priority penalty for that route so that its priority becomes 500,100. Because Tunnel 2 has a priority of 200, traffic continues to flow over Tunnel 2.
+
+Edge servers will continue probing Tunnel 1. When the health check failure rate drops below 0.1% for a five minute period, Magic Transit sets tunnel status to **Healthy**. Tunnel 1’s routing priority is fully restored to 100, and traffic steering returns the data flow to Tunnel 1.
diff --git a/products/magic-transit/src/content/about/traffic-steering.md b/products/magic-transit/src/content/about/traffic-steering.md
index 30100f1c40a..b1a48fefca7 100644
--- a/products/magic-transit/src/content/about/traffic-steering.md
+++ b/products/magic-transit/src/content/about/traffic-steering.md
@@ -1,18 +1,19 @@
 ---
-order: 2
+order: 
+pcx-content-type: concept
 ---
 
 # Traffic steering
 
-Magic Transit uses a static configuration to route traffic through [Generic Routing Encapsulation (GRE) tunnels](/about/tunnels-and-encapsulation) from Cloudflare’s edge to your data center(s).
+Magic Transit uses a static configuration to route traffic through [Generic Routing Encapsulation (GRE) tunnels](/about/tunnels-and-encapsulation) from Cloudflare’s edge to your data center.
 
-Magic Transit steers traffic along GRE tunnel routes based on priorities you define. You [assign tunnel route priorities](/set-up/provide-configuration-data/assign-tunnel-route-priorities) during the Magic Transit [onboarding process](/set-up/onboarding/).
+Magic Transit steers traffic along GRE tunnel routes based on priorities you define during the onboarding process.
 
-The example in this diagram has three tunnel routes. Tunnels 1 and 2 have top priority—Tunnel 3 is secondary.
+The example in this diagram has three tunnel routes. Tunnels 1 and 2 have top priority and Tunnel 3 is secondary.
 
 ![Example route priorities](../static/mt-traffic-steering-ecmp-baseline.png)
 
-When there are multiple routes with equal priority and different next-hops—Tunnel 1 versus Tunnel 2, for example—Cloudflare uses equal-cost multi-path (ECMP) routing.
+When there are multiple routes with equal priority and different next-hops, Cloudflare uses equal-cost multi-path (ECMP) routin. An example of multiple routes with equality priority would  beTunnel 1 versus Tunnel 2.
 
 The use of ECMP routing provides load balancing across tunnels with the same priority.
 
@@ -24,30 +25,51 @@ Using ECMP has a number of consequences:
 
 * Routing to equal-cost paths is probabilistic.
 
-* Packets in the same session (or flow)—with the same source and destination—have the same hash and thus use the same next hop.
+* Packets in the same session (or flow) with the same source and destination have the same hash. The packets also use the same next hop.
 
-* Routing changes in the number of equal-cost next hops—for example, due to dynamic prioritization triggered by health check events—can cause traffic to use different tunnels.
+* Routing changes in the number of equal-cost next hops can cause traffic to use different tunnels. For example, dynamic prioritization triggered by health check events can cause traffic to use different tunnels.
 
 As a result, ECMP provides load balancing across tunnels with the same priority.
 
-## Examples
+### Examples
 
-This diagram illustrates how ECMP distributes traffic equally across 2 paths with the same priority:
+This diagram illustrates how ECMP distributes traffic equally across 2 paths with the same priority.
+
+<details>
+<summary>
+  Normal traffic flow
+</summary>
+  <div class="special-class" markdown="1">
 
 ![ECMP diagram of health network](../static/mt-traffic-steering-ecmp-normal.png)
+</div>
+</details>
 
 When Magic Transit health checks determine that GRE Tunnel 2 is unhealthy, that route is dynamically de-prioritized, leaving Tunnel 1 the sole top-priority route. As a result, traffic is steered away from Tunnel 2, and all traffic flows to Tunnel 1:
 
-![ECMP diagram of unhealthy Tunnel 2](../static/mt-traffic-steering-ecmp-failure-1.png)
+<details>
+<summary>
+  Failover traffic flow: Scenario 1
+</summary>
+  <div class="special-class" markdown="1">
 
-When Magic Transit determines that GRE Tunnel 1 is unhealthy as well, that route is also de-prioritized, leaving GRE Tunnel 3 as the top priority route. In that case, all traffic flows to GRE Tunnel 3:
+![ECMP diagram of unhealthy Tunnel 2](../static/mt-traffic-steering-ecmp-failure-1.png)
+</div>
+</details>
 
-![ECMP diagram of unhealthy Tunnels 1 and 2](../static/mt-traffic-steering-ecmp-failure-2.png)
+When Magic Transit determines that GRE Tunnel 1 is unhealthy as well, that route is also de-prioritized, leaving GRE Tunnel 3 as the top priority route. In that case, all traffic flows to GRE Tunnel 3.
 
-When Magic Transit determines that Tunnels 1 and 2 are healthy again, it re-prioritizes those routes, and traffic flow returns to normal:
+<details>
+<summary>
+  Failover traffic flow: Scenario 2
+</summary>
+  <div class="special-class" markdown="1">
 
-![ECMP diagram of health network](../static/mt-traffic-steering-ecmp-normal.png)
+![ECMP diagram of unhealthy Tunnels 1 and 2](../static/mt-traffic-steering-ecmp-failure-2.png)
+</div>
+</details>
 
+When Magic Transit determines that Tunnels 1 and 2 are healthy again, it re-prioritizes those routes, and traffic flow returns to normal.
 ## ECMP and bandwidth utilization
 
 Because ECMP is probabilistic, the algorithm routes roughly the same number of flows through each tunnel. However it does _not_ consider the amount of traffic already sent through a tunnel when deciding where to route the next packet.
diff --git a/products/magic-transit/src/content/about/tunnels-and-encapsulation.md b/products/magic-transit/src/content/about/tunnels-and-encapsulation.md
index 46069adccf9..c45797b9417 100644
--- a/products/magic-transit/src/content/about/tunnels-and-encapsulation.md
+++ b/products/magic-transit/src/content/about/tunnels-and-encapsulation.md
@@ -1,12 +1,13 @@
 ---
-order: 3
+order: 
+pcx-content-type: concept
 ---
 
 # Tunnels & encapsulation
 
-Magic Transit uses [Generic Routing Encapsulation (GRE)](https://www.cloudflare.com/learning/network-layer/what-is-gre-tunneling/) tunnels to transmit packets from Cloudflare’s edge to your origin network. Cloudflare sets up GRE tunnel endpoints on edge servers (inside your network namespace), and you [set up tunnel endpoints](/set-up/provide-configuration-data/specify-gre-tunnel-endpoints) on routers at your data center.
+Magic Transit uses [Generic Routing Encapsulation (GRE)](https://www.cloudflare.com/learning/network-layer/what-is-gre-tunneling/) tunnels to transmit packets from Cloudflare’s edge to your origin network. Cloudflare sets up GRE tunnel endpoints on edge servers inside your network namespace, and you [set up tunnel endpoints](/get-started/configure-tunnels/specify-gre-tunnel-endpoints) on routers at your data center.
 
-This diagram illustrates the flow of traffic with Magic Transit:
+This diagram illustrates the flow of traffic with Magic Transit.
 
 ![GRE tunnel flow](../static/mt-gre-tunnel-flow.png)
 
@@ -20,17 +21,17 @@ Egress packets are routed by your ISP interface, not Cloudflare.
 
 Magic Transit encapsulates IP packets destined for your network and transmits them across the GRE tunnels to your tunnel endpoint router, which decapsulates the packets and sends them to your internal network.
 
-This diagram illustrates how Magic Transit encapsulates packets at the Cloudflare edge and transmits them to a customer’s tunnel endpoint router (Acme in this example):
+In the diagram below, Magic Transit encapsulates packets at the Cloudflare edge and transmits them to a customer’s — Acme for example — tunnel endpoint router.
 
 ![Encapsulation diagram](../static/magic-transit-anycast-1.png)
 
 <Aside type='note' header='Note'>
 
-To accommodate the additional header data introduced by encapsulation, the maximum segment size (MSS) must be adjusted so that packets comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.
+To accommodate additional header data introduced by encapsulation, the maximum segment size (MSS) must be adjusted so that packets comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.
 
 Because egress packets are routed via your ISP interface, not Cloudflare, you must set this value at your physical egress interfaces (not the GRE tunnel interfaces).
 
-For instructions, see [_Set Maximum Segment Size_](/set-up/requirements/#set-maximum-segment-size).
+For instructions, refer to [Set Maximum Segment Size](/get-started/requirements/#set-maximum-segment-size).
 
 </Aside>
 
@@ -38,8 +39,8 @@ For instructions, see [_Set Maximum Segment Size_](/set-up/requirements/#set-max
 
 Magic Transit uses [Anycast](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) IP addresses for Cloudflare’s GRE tunnel endpoints, meaning that any server in any data center is capable of encapsulating and decapsulating packets for the same GRE tunnel.
 
-This works because the GRE protocol is stateless—each packet is processed independently and does not require any negotiation or coordination between tunnel endpoints. While the tunnel endpoint is technically bound to an _IP address_, it need not be bound to a specific _device_. Any device that can strip off the outer headers and then route the inner packet can handle any GRE packet sent over the tunnel.
+This works because the GRE protocol is stateless—each packet is processed independently and does not require any negotiation or coordination between tunnel endpoints. Tunnel endpoints are technically bound to IP addresses but do not need to be bound to specific devices. Any device that can strip off the outer headers and then route the inner packet can handle any GRE packet sent over the tunnel.
 
-The result is that Cloudflare’s Anycast GRE architecture provides a conduit to your GRE tunnel for every server in every data center on Cloudflare’s global edge network, as illustrated in this diagram:
+Cloudflare’s Anycast GRE architecture provides a conduit to your GRE tunnel for every server in every data center on Cloudflare’s global edge network as shown in the image below.
 
 ![Cloudflare Anycast GRE](../static/magic-transit-anycast-2.png)
diff --git a/products/magic-transit/src/content/get-started/configure-tunnels/assign-tunnel-route-priorities.md b/products/magic-transit/src/content/get-started/configure-tunnels/assign-tunnel-route-priorities.md
new file mode 100644
index 00000000000..05853139755
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/configure-tunnels/assign-tunnel-route-priorities.md
@@ -0,0 +1,213 @@
+---
+order:
+pcx-content-type: how-to
+---
+
+# Assign tunnel routes
+
+Magic Transit uses a static configuration to route your traffic through [Generic Routing Encapsulation (GRE) tunnels](/about/tunnels-and-encapsulation) from Cloudflare’s edge to your data centers.
+
+You must assign a route priority to each GRE tunnel–subnet pair in your GRE configuration using the following guidelines:
+
+- Lower values have greater priority.
+- When the priority values for prefix entries match, Cloudflare uses equal-cost multi-path (ECMP) packet forwarding to route traffic. You can refer to an example of this scenario with the **103.21.244.0/24** subnet in the edge routing configuration example below.
+
+<details>
+<summary>
+    Edge routing configuration example
+</summary>
+<div>
+<table>
+  <thead>
+    <tr>
+      <th><strong>GRE tunnel</strong></th>
+      <th><strong>Subnet</strong></th>
+      <th><strong>Priority</strong></th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td>103.21.245.0/24</td>
+      <td>200</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td>103.21.245.0/24</td>
+      <td>200</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td>103.21.245.0/24</td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td>103.21.245.0/24</td>
+      <td>100</td>
+    </tr>
+  </tbody>
+</table>
+</div>
+</details>
+
+For more on how Cloudflare uses ECMP packet forwarding, refer to [Traffic steering](/about/traffic-steering).
+
+## Map route prefixes smaller than /24
+
+You must provide your prefixes and the tunnels they should be mapped to in order for Cloudflare to route your traffic from the edge to your data centers via GRE tunnels. Use the table below as reference.
+
+| Prefix          | GRE Tunnel |
+| --------------- | ---------- |
+| 103.21.244.0/29 | GRE_1_IAD  |
+| 103.21.244.8/29 | GRE_2_ATL  |
+
+The minimum advertising prefix is /24, but because Cloudflare uses GRE tunnels as an outer wrapper for your traffic, we can route prefixes within that /24 to different tunnel end points.
+
+For example, you can send `x.x.x.0/29` to Datacenter 1 and `x.x.x.8/29` to Datacenter 2. This is helpful when you operate in an environment with constrained IP resources.
+
+## Static routes
+
+Magic Transit uses the static routes you provide to route traffic through GRE tunnels. A route with a lower **Priority** value is used as the preferred route, and routes with the same priority value use equal-cost multi-path (ECMP) packet forwarding to route traffic.
+
+You can also create and edit static routes using [Magic Transit Static Routes API](https://api.cloudflare.com/#magic-transit-static-routes-properties).
+
+### Create a static route
+
+1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/login) and select **Magic Transit**.
+1. Next to **Static routes configuration**, click **Configure**.
+1. On the **Static Routes** page, click **Create** to add a new route.
+1. Enter the information for your route.
+1. While optional, we highly recommend testing your route before adding it by clicking **Test routes**.
+1. If your test was successful, click **Add routes** when you are done.
+
+### Edit a static route
+
+1. After navigating to the **Static routes configuration** page, click **Edit** next to the route you want to modify.
+1. Enter the updated route information and click **Edit routes** when you are done.
+
+## Scoped routes for GRE tunnels
+
+To reduce latency for your GRE tunnel configurations, especially if you operate your own Anycast network, Cloudflare can steer your traffic by scoping it to specific Cloudflare data center regions. Valid Cloudflare regions include AFR, APAC, EEUR, ENAM, ME, OC, SAM, WEUR, and WNAM.
+
+To configure scoping for your traffic, you must provide Cloudflare with GRE tunnel data for each Cloudflare region.
+
+<details>
+<summary>
+  Scoping configuration data example
+</summary>
+<div>
+<table>
+ <thead>
+  <tr>
+   <th>GRE tunnel</th>
+   <th>Region code</th>
+   </tr>
+  </thead>
+  <tbody>
+  <tr>
+     <td>GRE_1_IAD</td>
+     <td>AFR</td>
+  </tr>
+  <tr>
+    <td>GRE_2_IAD</td>
+    <td>EEUR</td>
+  </tr>
+  <tr>
+    <td>GRE_3_ATL</td>
+    <td>ENAM</td>
+  </tr>
+  <tr>
+    <td>GRE_4_ATL</td>
+    <td>ME</td>
+    </tr>
+</tbody>
+</table>
+</div>
+</details>
+
+Cloudflare has nine geographic regions across the world which are listed below.
+
+<details>
+<summary>
+  Region codes and associated regions
+</summary>
+<div>
+<table>
+  <thead>
+    <tr>
+      <th>Region code</th>
+      <th>Region</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+    <td>AFR</td>
+    <td>Africa
+    </td>
+    </tr>
+    <tr>
+    <td>APAC</td>
+    <td>Asia Pacific
+    </td>
+    </tr>
+    <tr>
+    <td>EEUR</td>
+    <td>Eastern Europe
+    </td>
+    </tr>
+    <tr>
+    <td>ENAM</td>
+    <td>Eastern North America
+    </td>
+    </tr>
+    <tr>
+    <td>ME</td>
+    <td>Middle East
+    </td>
+    </tr>
+    <tr>
+    <td>OC</td>
+    <td>Oceania
+    </td>
+    </tr>
+    <tr>
+    <td>SAM</td>
+    <td>South America
+    </td>
+    </tr>
+    <tr>
+    <td>WEUR</td>
+    <td>Western Europe
+    </td>
+    </tr>
+    <tr>
+    <td>WNAM</td>
+    <td>Western North America
+    </td>
+    </tr>
+  </tbody>
+</table>
+</div>
+</details>
+
diff --git a/products/magic-transit/src/content/get-started/configure-tunnels/index.md b/products/magic-transit/src/content/get-started/configure-tunnels/index.md
new file mode 100644
index 00000000000..5e0990d867e
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/configure-tunnels/index.md
@@ -0,0 +1,10 @@
+---
+order: 
+pcx-content-type: navigation
+---
+
+# Configure tunnels
+
+Cloudflare requires configuration data from the processes below to set up Magic Transit for your organization.
+
+<DirectoryListing path="/get-started/configure-tunnels"/>
diff --git a/products/magic-transit/src/content/get-started/configure-tunnels/specify-gre-tunnel-endpoints.md b/products/magic-transit/src/content/get-started/configure-tunnels/specify-gre-tunnel-endpoints.md
new file mode 100644
index 00000000000..ff597723f36
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/configure-tunnels/specify-gre-tunnel-endpoints.md
@@ -0,0 +1,82 @@
+---
+order: 
+type: table
+pcx-content-type: how-to
+---
+
+# Specify tunnel endpoints
+
+<ContentColumn>
+
+## Anycast edge IP addresses
+
+Cloudflare will assign two Anycast IP addresses shortly after your onboarding kickoff call. Use these Anycast edge addresses as the GRE tunnel destinations on your data center routers/endpoints.
+
+## Generic Routing Encapsulation (GRE)
+
+Cloudflare recommends two GRE tunnels for each ISP and data center router combination, one per Anycast IP.
+
+To configure the GRE tunnel(s) between Cloudflare and your data centers, you must provide the following data for each tunnel:
+
+- **Customer edge IP address**—A public Internet routable IP address outside of the prefixes Cloudflare will advertise on your behalf. These are generally IP addresses provided by your ISP. If you intend to use a physical or virtual connection like [Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/), you do not need to provide edge addresses because Cloudflare will provide them.
+- **Private subnet**—A 31-bit subnet (/31 in CIDR notation) supporting 2 hosts, one for each side of the tunnel. Select the subnet from the following private IP space:
+  - 10.0.0.0–10.255.255.255
+  - 172.16.0.0–172.31.255.255
+  - 192.168.0.0–192.168.255.255
+* **Private IP addresses**—The private IP address assigned to the **Cloudflare** and **customer** sides of the tunnel
+
+</ContentColumn>
+
+<details>
+<summary>
+    Edge routing configuration example
+</summary>
+<div>
+<table>
+  <thead>
+    <tr>
+      <th style='min-width:70px'>GRE tunnel</th>
+      <th style='min-width:125px'>Customer edge IP</th>
+      <th style='min-width:100px'>Anycast IP</th>
+      <th style='min-width:130px'>Private subnet</th>
+      <th style='min-width:115px'>Customer private IP</th>
+      <th style='min-width:100px'>Cloudflare private IP</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td>104.18.112.75</td>
+      <td>Anycast IP 1</td>
+      <td>10.10.10.100/31</td>
+      <td>10.10.10.100</td>
+      <td>10.10.10.101</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td>104.18.112.75</td>
+      <td>Anycast IP 2</td>
+      <td>10.10.10.102/31</td>
+      <td>10.10.10.102</td>
+      <td>10.10.10.103</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td>104.40.112.125</td>
+      <td>Anycast IP 1</td>
+      <td>10.10.10.104/31</td>
+      <td>10.10.10.104</td>
+      <td>10.10.10.105</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td>104.40.112.125</td>
+      <td>Anycast IP 2</td>
+      <td>10.10.10.106/31</td>
+      <td>10.10.10.106</td>
+      <td>10.10.10.107</td>
+    </tr>
+  </tbody>
+</table>
+</div>
+</details>
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-ip-addresses-for-endpoint-health-checks.md b/products/magic-transit/src/content/get-started/configure-tunnels/specify-ip-addresses-for-endpoint-health-checks.md
similarity index 84%
rename from products/magic-transit/src/content/set-up/provide-configuration-data/specify-ip-addresses-for-endpoint-health-checks.md
rename to products/magic-transit/src/content/get-started/configure-tunnels/specify-ip-addresses-for-endpoint-health-checks.md
index e26c80e1cfe..999da3d18d8 100644
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-ip-addresses-for-endpoint-health-checks.md
+++ b/products/magic-transit/src/content/get-started/configure-tunnels/specify-ip-addresses-for-endpoint-health-checks.md
@@ -1,5 +1,6 @@
 ---
-order: 4
+order: 
+pcx-content-type: how-to
 ---
 
 # Specify IP addresses for endpoint health checks
@@ -8,12 +9,12 @@ Magic Transit uses endpoint health checks to determine the overall health of you
 
 When choosing which endpoint IP addresses to monitor with health checks, use these guidelines:
 
-- Provide 1 IP address for each of the prefixes to be advertised by Cloudflare.
+- Provide one IP address for each of the prefixes Cloudflare will advertise.
 - Redundant IPs routed via the same ISP and infrastructure are not necessary but are useful when troubleshooting.
 
 Cloudflare pings health check IPs from within the [published Cloudflare IP range](https://www.cloudflare.com/ips/), which is also available via the [Cloudflare API](https://api.cloudflare.com/#cloudflare-ips-properties).
 
-For an example endpoint health check configuration, refer to this table:
+For an example endpoint health check configuration, refer to the table below.
 
 | Prefix          | Endpoint IP address |
 | --------------- | ------------------- |
diff --git a/products/magic-transit/src/content/get-started/configure-tunnels/specify-prefixes-to-advertise.md b/products/magic-transit/src/content/get-started/configure-tunnels/specify-prefixes-to-advertise.md
new file mode 100644
index 00000000000..4eb51df3916
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/configure-tunnels/specify-prefixes-to-advertise.md
@@ -0,0 +1,53 @@
+---
+order: 
+pcx-content-type: how-to
+---
+
+# Specify prefixes to advertise
+
+List all prefixes and the ASNs where they should originate. When specifying prefixes, observe these guidelines:
+
+- Prefixes must support at least 256 hosts (/24 in classless inter-domain routing CIDR notation.
+- Internet Routing Registry entries and Letters of Authorization must match the prefixes and originating prefixes you submit to Cloudflare.
+- When using contiguous prefixes, specify aggregate prefixes where possible.
+- When using Route Origin Authorizations (ROAs) to sign routes for [resource public key infrastructure (RPKI)](https://tools.ietf.org/html/rfc8210), the prefix and originating ASN must match the onboarding submission.
+- If you do not own an ASN, you can use the Cloudflare Customer ASN (AS209242).
+
+<details>
+<summary>
+  Prefix configuration example
+</summary>
+<div class="special-class" markdown="1">
+
+| Prefix          | Originating AS |
+| ----------------| -------------- |
+| 103.21.244.0/23 | AS209242       |
+| 131.0.72.0/22   | AS395747       |
+| 103.21.245.0/24 | AS395747       |
+
+</div>
+</details>
+
+<Aside type='note' header='Note'>
+
+When customers supply their own ASN, Cloudflare prepends the main Cloudflare ASN (AS13335) to the BGP AS_PATH. For example, if the customer ASN is AS64496, anyone directly peering with Cloudflare sees the path as `13335 64496`.
+
+If you do not have an ASN or do not want to bring your ASN to Cloudflare, you can use the Cloudflare Customer ASN (AS209242). In this case, the path becomes `13335 209242`.
+
+</Aside>
+
+## Border Gateway Protocol (BGP) control for advertisements
+
+Use BGP to control the status of your prefix — advertised or withdrawn — from Cloudflare's edge for more flexibility and control over your routes. The BGP controlled advertisement system works by establishing BGP sessions to Cloudflare's routing endpoints, which propagate BGP routes globally across all the locations at Cloudflare's edge.
+
+To prevent unexpected behavior, you must use either BGP control or dynamic advertisement for your prefixes but you cannot use both.
+
+![BGP control diagram](../../static/bgp-control-diagram.png)
+
+To begin using BGP control, contact your account team with the following information:
+
+- BGP endpoint IP addresses
+- Prefixes you want to use with BGP control
+- Your ASN for the BGP session
+
+After receiving your information, Cloudflare updates firewall filters to establish the BGP session and provides you with the BGP endpoints to control your prefixes.
diff --git a/products/magic-transit/src/content/get-started/index.md b/products/magic-transit/src/content/get-started/index.md
new file mode 100644
index 00000000000..dbc9e75afb3
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/index.md
@@ -0,0 +1,62 @@
+---
+order: 1
+pcx-content-type: navigation
+---
+
+# Get started
+
+The onboarding process, from scoping to going live, typically takes about ten business days, and Cloudflare can significantly accelerate this timeline in active-attack scenarios.
+
+Throughout the onboarding process, Cloudflare partners closely with your organization to accomplish the following tasks:
+
+## 1. Scope your configuration
+
+Starting with an initial kickoff call, Cloudflare engages with your organization to confirm the scope and timeline for setting up Magic Transit.
+
+*Duration:* Less than one business day
+
+After your call with Cloudflare, verify that you meet the [onboarding requirements](/get-started/requirements/).
+
+## 2. [Configure tunnels](/get-started/configure-tunnels)
+
+Cloudflare sets up Anycast tunnels for Magic Transit based on configuration details you supply.
+
+*Duration:* ~4 business days
+
+Provide the information specified in [Specify GRE Tunnel Endpoints](/get-started/configure-tunnels/specify-gre-tunnel-endpoints/) so that Cloudflare can set up your tunnels.
+
+## 3. Run pre-flight checks
+
+After Cloudflare stages the tunnels, Cloudflare validates tunnel connectivity, Letter of Authorization (LOA), Internet Routing Registry (IRR), and maximum segment size (MSS) configurations.
+
+To ensure that the integration is ready to go live the following week, complete this step by close of business Thursday.
+
+*Duration:* ~4 business days
+
+## 4. Configure edge network
+
+Once Cloudflare’s pre-flight checks have passed and your account team verifies the date to complete the change, the process of onboarding your prefixes to Cloudflare’s edge network begins.
+
+To configure the edge network, Cloudflare routes traffic sourced from Cloudflare’s network and attracts traffic from the broader Internet by advertising your customer-owned prefixes.
+
+These routing changes return any traffic generated within the Cloudflare edge network to the GRE tunnels set up for Magic Transit. This can happen if:
+
+- An IP within your Magic Transit prefix accesses a web property proxied by Cloudflare.
+- You have a proxied zone set up on Cloudflare with a target IP within a Magic Transit prefix range.
+
+You control the edge router advertisement, which dictates whether Cloudflare’s edge network advertises your prefixes. Advertisement is activated at the go-live call, routing traffic via Cloudflare and the GRE tunnels to your data centers.
+
+*Duration:* ~5 business days
+
+<Aside type='warning' header='Important'>
+
+You must put the appropriate MSS clamps in place before routing changes are made. Failure to apply an MSS clamp can result in dropped packets and hard-to-debug connectivity issues.
+
+When using [Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/) with Magic Transit, you must set the MSS clamp size to 1332 bytes to accommodate additional overhead from the foo-over-UDP (FOU) protocol and IPv6. These are used to backhaul data from the data center where traffic is ingested (close to the end user) to the facility with the CNI link.
+
+</Aside>
+
+## 5. Go live and announce prefixes
+
+Once edge network configuration is complete, schedule a go-live call. During this call, you announce your prefixes from Cloudflare’s edge network for the first time.
+
diff --git a/products/magic-transit/src/content/get-started/requirements.md b/products/magic-transit/src/content/get-started/requirements.md
new file mode 100644
index 00000000000..10773b35cd2
--- /dev/null
+++ b/products/magic-transit/src/content/get-started/requirements.md
@@ -0,0 +1,110 @@
+---
+title: Requirements
+order: 
+pcx-content-type: tutorial
+---
+
+# Requirements
+
+You  must meet the following onboarding requirements before using Magic Transit.
+
+## Use compatible tunnel endpoint routers
+
+Magic Transit relies on Generic Routing Encapsulation (GRE) tunnels to transmit packets from Cloudflare’s edge to your origin network. 
+
+The routers at your GRE tunnel endpoints must meet the following requirements to ensure compatibility with Magic Transit. 
+
+- Support GRE tunneling.
+- Allow configuration of at least one tunnel per Internet service provider (ISP).
+- Support maximum segment size (MSS) clamping.
+
+## Draft Letter of Authorization
+
+Draft a [Letter of Authorization (LOA)](https://developers.cloudflare.com/byoip/loa) that identifies the prefixes you want to advertise and gives Cloudflare permission to announce them. The LOA is required by Cloudflare's transit providers so they can accept the routes Cloudflare advertises on your behalf. See this [LOA template](https://developers.cloudflare.com/byoip/loa/loa-template) for an example.
+
+## Verify Internet Routing Registry entries
+
+Verify your Internet Routing Registry (IRR) entries match corresponding origin autonomous system numbers (ASNs) to ensure Magic Transit routes traffic to the correct autonomous systems (AS). For guidance, refer to [Verify IRR entries](https://developers.cloudflare.com/byoip/irr-records/verify-irr-entries).
+
+## Set maximum segment size
+
+![Packet flow diagram](../static/mss-values-and-packet.png)
+
+The SYN-ACK packet sent to the client during TCP handshake encodes the value for maximum segment size (MSS). Egress packets are routed via your ISP interface, and each packet must comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.
+
+Cloudflare uses GRE tunnels to deliver packets from our edge to your data centers, while Cloudflare Magic Transit encapsulates these packets, adding a new IP header and GRE protocol header.
+
+ You must set the MSS value to 1436 bytes at your physical egress interfaces — not the GRE tunnel interfaces — to accommodate the additional header data.
+
+<table>
+  <thead>
+    <tr>
+      <th></th>
+      <th>Standard Internet routable MTU</th>
+      <th align="right">1500 bytes</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>&#45;</td>
+      <td>Original IP header</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>Original protocol header (TCP)</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>New IP header</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>New protocol header (GRE)</td>
+      <td align="right">4 bytes</td>
+    </tr>
+    <tr>
+      <td>&#61;</td>
+      <td>Maximum segment size (MSS)</td>
+      <td align="right">1436 bytes</td>
+    </tr>
+  </tbody>
+</table>
+
+Unless you apply these MSS settings at the origin, client machines do not know that they must use an MSS of 1436 bytes when sending packets to your origin.
+
+### Follow router vendor guidelines
+
+Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router.
+
+The following table lists several commonly used router vendors with links to MSS clamping instructions:
+
+| Router device | URL                                                                                                                                                                                                   |
+| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cisco         | [TC IP Adjust MSS](https://www.cisco.com/en/US/docs/ios-xml/ios/ipapp/command/ip_tcp_adjust-mss_through_ip_wccp_web-cache_accelerated.html#GUID-68044D35-A53E-42C1-A7AB-9236333DA8C4)                 |
+| Juniper       | [TCP MSS – Edit System](https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/tcp-mss-edit-system.html)                                                          |
+
+### Verify MSS settings at your origin
+
+Run the following command on the servers egressing the prefixes you want to add to Magic Transit to verify that your routers have the correct MSS setting (1436 bytes) at your origin.
+
+```sh
+$ curl 167.71.125.57:8080
+```
+
+You should see the following result:
+
+```txt
+Local: 167.71.125.57:8080
+Remote: 172.68.141.62:44108
+Local MSS: 1436
+Remote MSS: 1436
+```
+
+<Aside type='warning' header='Important'>
+
+When you do not have a publicly available TCP endpoint for which Cloudflare can verify your MSS settings, you must provide a screenshot of the cURL command results, similar to the one above.
+
+</Aside>
diff --git a/products/magic-transit/src/content/index.md b/products/magic-transit/src/content/index.md
index 02a7bb9d755..27380f1e7f1 100644
--- a/products/magic-transit/src/content/index.md
+++ b/products/magic-transit/src/content/index.md
@@ -1,6 +1,7 @@
 ---
-title: Welcome
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Cloudflare Magic Transit
@@ -9,7 +10,13 @@ order: 0
 
 Magic Transit delivers network functions at Cloudflare scale—DDoS protection, traffic acceleration, and much more from every Cloudflare data center—for on-premise, cloud-hosted, and hybrid networks.
 
+<Aside type="note" header="Note">
+
+Magic Transit is not yet supported on Cloudflare's China Network.
+
+</Aside>
+
 <ButtonGroup>
-  <Button type="primary" href="/set-up">Set up Magic Transit</Button>
+  <Button type="primary" href="/get-started">Get started</Button>
   <Button type="secondary" href="/about">Learn more</Button>
 </ButtonGroup>
diff --git a/products/magic-transit/src/content/magic-firewall/adding-rules.md b/products/magic-transit/src/content/magic-firewall/adding-rules.md
deleted file mode 100644
index 8849abaaee3..00000000000
--- a/products/magic-transit/src/content/magic-firewall/adding-rules.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: Adding rules
-order:  2
----
-
-# Adding rules
-
-To view examples for root rulesets, review the the [Magic Firewall Terraform documentation](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/magic_firewall_ruleset).
-
-## Step 1: Check if you already have an existing root ruleset
-
-If you're a new Magic Transit customer, you may not have a root ruleset created for your account.
-
-API Example:
-```
-curl https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000'
-```
-
-<Aside type='note' header='Note'>
-Your account ID can be found via the `/client/v4/accounts` endpoint.
-</Aside>
-
-An account without a root ruleset will return a response like this one:
-
-```
-{
-    "result": [],
-    "success": true,
-    "errors": [],
-    "messages": []
-}
-```
-
-## Step 2: Add a ruleset with an existing rule
-
-If you haven't setup any rules before, you'll need to make a POST call to create the root ruleset with some initial rules.
-
-API Example:
-
-```
-curl -X POST https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000' \
---data '{
-  "name": "Example ruleset",
-  "kind": "root",
-  "description": "Example ruleset description",
-  "phase": "magic_transit",
-  "rules": [
-    {
-      "action": "block",
-      "expression": "ip.src == 172.16.0.7",
-      "description": "Block IP 172.16.0.7"
-    }
-  ]
-}'
-```
-
-Example response:
-
-```
-{
-  "result": {
-    "id": "4376358e00ec4c42b0450b1afed120bf",
-    "name": "Example ruleset",
-    "description": "Example ruleset description",
-    "kind": "root",
-    "version": "1",
-    "rules": [
-      {
-        "id": "02ad6deb502c4f82b7a2531e878ac003",
-        "version": "1",
-        "action": "block",
-        "expression": "ip.src == 172.16.0.7",
-        "description": "Block IP 172.16.0.7"
-        "last_updated": "2020-10-21T20:25:35.473609Z",
-        "ref": "02ad6deb502c4f82b7a2531e878ac003",
-        "enabled": true
-      }
-    ],
-    "last_updated": "2020-10-21T20:25:35.473609Z",
-    "phase": "magic_transit"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
diff --git a/products/magic-transit/src/content/magic-firewall/examples.md b/products/magic-transit/src/content/magic-firewall/examples.md
deleted file mode 100644
index c68ef7d0b2d..00000000000
--- a/products/magic-transit/src/content/magic-firewall/examples.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Examples
-order:  5
----
-
-# Examples
-
-## Skip Action
-
-The example below blocks all tcp ports, but allows one port (8080)
-by using the skip action.
-
-```
-curl -X POST https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000' \
---data '{
-    "name": "Example ruleset",
-    "kind": "root",
-    "phase": "magic_transit",
-    "description": "Example ruleset description",
-    "rules": [
-      {
-        "action": "skip",
-        "action_parameters": { "ruleset": "current" },
-        "expression": "tcp.dstport in { 8080 } ",
-        "description": "Allow port 8080"
-      },
-      {
-        "action": "block",
-        "expression": "tcp.dstport in { 1..65535 }",
-        "description": "Block all tcp ports"
-      }
-    ]
-}'
-```
diff --git a/products/magic-transit/src/content/magic-firewall/index.md b/products/magic-transit/src/content/magic-firewall/index.md
deleted file mode 100644
index 36ba416e771..00000000000
--- a/products/magic-transit/src/content/magic-firewall/index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Magic Firewall
-order: 1
----
-
-# Magic Firewall
-
-Magic Firewall is a network-level firewall delivered through Cloudflare to protect your network. It is
-configurable by all Magic Transit customers by making calls to Cloudflare's API. Rules can be crafted in
-Wireshark syntax, a domain specific language common in the networking world and the same syntax we use
-across our other products. With this syntax, you can easily craft extremely powerful rules to precisely
-allow or deny any traffic in or out of your network.
-
-Access to the API is controlled by the `#waf:read` and `#waf:write` permissions.
-
-Magic Firewall allows you to define skip and block rules on any packet characteristics including source and destination IP, source and destination port, protocol, packet length, and bit field match.
-
-Start by [adding a rule](/magic-firewall/adding-rules)!
-
-<Aside type='warning' header='Important'>
-
-When you or your end users are using other Cloudflare services (eg. CDN, Spectrum) that proxy traffic, be aware of the following:
-
-- Firewall rules that block traffic based on source IP address may not work as intended, since rules are evaluated after Cloudflare terminates the incoming TCP connections.
-- You must allow [Cloudflare IP addresses](https://www.cloudflare.com/ips/).
-- When using Magic Firewall, fragmented packets are reassembled into complete packets before they are inspected. As a result, you cannot create firewall rules for fragments.
-
-</Aside>
-
-<Aside type="warning" header="Beta">
-
-The Magic Firewall API is currently in beta; contact your account team if you're interested in early access.
-
-</Aside>
diff --git a/products/magic-transit/src/content/magic-firewall/updating-rules.md b/products/magic-transit/src/content/magic-firewall/updating-rules.md
deleted file mode 100644
index 4270202b4b5..00000000000
--- a/products/magic-transit/src/content/magic-firewall/updating-rules.md
+++ /dev/null
@@ -1,134 +0,0 @@
----
-title: Updating rules
-order:  3
----
-
-# Updating rules
-
-## Step 1: Display the existing ruleset
-
-API Example:
-
-```
-curl -X GET https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000'
-```
-
-Example data:
-
-```
-{
-  "result": [
-    {
-      "id": "4376358e00ec4c42b0450b1afed120bf",
-      "name": "stop bad people",
-      "description": "block traffic with known bad patterns",
-      "kind": "root",
-      "version": "1",
-      "last_updated": "2020-10-21T20:25:35.473609Z",
-      "phase": "magic_transit"
-    }
-  ],
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-## Step 2: Fetch the existing rules
-
-To add a rule to an existing ruleset, we'll need the two things from the previous step:
-
-* The ruleset ID: `4376358e00ec4c42b0450b1afed120bf`
-* The version: `1`
-
-We'll use this to fetch the existing rules to help us construct the call to update the ruleset:
-
-```
-curl https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets/4376358e00ec4c42b0450b1afed120bf/versions/1 \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000' | jq '.result | {description: .description, rules: [ .rules[] | {id: .id, description: .description, action: .action, action_parameters: .action_parameters, expression: .expression} ]}'
-```
-
-<Aside type='note' header='Note'>
-
-What's up with that jq command? The API response has quite a bit of extra information, e.g. the last updated timestamp, that cannot be sent back to the API when making a PUT request. You do not need to use jq, but make sure you only send fields that are relevant to the update request.
-
-</Aside>
-
-Example response:
-```
-{
-  "description": "block traffic with known bad patterns",
-  "rules": [
-    {
-      "id": "02ad6deb502c4f82b7a2531e878ac003",
-      "action": "block",
-      "expression": "ip.src == 172.16.0.7",
-      "description": "only allow plain http"
-    }
-  ]
-}
-```
-
-## Step 3: Update the ruleset
-
-Now, we have enough to make the call to update the ruleset:
-
-```
-curl -X PUT https://api.cloudflare.com/client/v4/accounts/${account_id}/rulesets/${ruleset_id} \
--H 'Content-Type: application/json' \
--H 'X-Auth-Email: user@example.com' \
--H 'X-Auth-Key: 00000000000' \
---data '{
-  "description": "block traffic with known bad patterns",
-  "rules": [
-    {
-      "id": "02ad6deb502c4f82b7a2531e878ac003",
-      "action": "block",
-      "expression": "ip.src == 172.16.0.7",
-      "description": "Block any traffic from source IP 172.16.0.7"
-    }
-  ]
-}'
-```
-
-Example response:
-```
-{
-  "result": {
-    "id": "4376358e00ec4c42b0450b1afed120bf",
-    "name": "stop bad people",
-    "description": "block traffic with known bad patterns",
-    "kind": "root",
-    "version": "2",
-    "rules": [
-      {
-        "id": "02ad6deb502c4f82b7a2531e878ac003",
-        "version": "2",
-        "action": "block",
-        "expression": "ip.src == 172.16.0.1",
-        "description": "Block any traffic from source IP 172.16.0.1",
-        "last_updated": "2020-10-21T21:58:18.607633Z",
-        "ref": "02ad6deb502c4f82b7a2531e878ac003",
-        "enabled": true
-      }
-    ],
-    "last_updated": "2020-10-21T21:58:18.607633Z",
-    "phase": "magic_transit"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-<Aside type='note' header='Note'>
-
-The version number has incremented on the ruleset and it's contained rule. You may recall that earlier a version number was used to retrieve the ruleset details via `/accounts/${account_id}/rulesets/${ruleset_id}/versions/${version}`
-which means you can fetch older versions of the ruleset for comparison.  Only the most recent version of a ruleset is applied at the edge.
-
-</Aside>
diff --git a/products/magic-transit/src/content/network-interconnect.md b/products/magic-transit/src/content/network-interconnect.md
new file mode 100644
index 00000000000..e964297231b
--- /dev/null
+++ b/products/magic-transit/src/content/network-interconnect.md
@@ -0,0 +1,23 @@
+---
+title: Network Interconnect
+order: 3
+pcx-content-type: tutorial
+---
+
+# Network Interconnect and Magic Transit
+
+Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience.
+
+Use Cloudflare Network Interconnect with Magic Transit to decrease jitter, drive throughput improvements, and harden infrastructure to attack.
+
+For more information about Network Interconnect, refer to the [Network Interconnect documentation](https://developers.cloudflare.com/network-interconnect/).
+
+## Guidelines
+
+When working with Magic Transit and CNI, observe these guidelines:
+
+- You must implement MSS clamping because Cloudflare Network Interconnect does not support 1500 byte packets.
+
+- Set the MSS clamp size to 1332 bytes to accommodate the additional overhead from the Foo-over-UDP (FOU) protocol and IPv6. These are used to backhaul data from the data center where traffic is ingested — close to the end user — to the facility with the CNI link.
+
+- Cloudflare Network Interconnect does not process outgoing traffic from your data centers. Egress traffic returns to end users through direct server return (DSR) not through Cloudflare. For this reason, CNI cannot replace your existing transit providers.
diff --git a/products/magic-transit/src/content/on-demand.md b/products/magic-transit/src/content/on-demand.md
new file mode 100644
index 00000000000..778b13156c6
--- /dev/null
+++ b/products/magic-transit/src/content/on-demand.md
@@ -0,0 +1,21 @@
+---
+title: On-demand
+order: 4
+pcx-content-type: concept
+---
+
+# Magic Transit on-demand
+
+Customers with access to the Magic Transit on-demand option can [configure prefix advertisement](https://developers.cloudflare.com/byoip/dynamic-advertisement/configure-dynamic-advertisement) from the **IP Prefixes** page in their Cloudflare account home or via the [Cloudflare API](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-properties).
+
+A common workflow is to enable prefix advertisement during an attack so that you can take advantage of Cloudflare protection and then disable advertisement once the incident is resolved.
+
+To ensure smooth operation in general and simplify the advertisement process during an attack scenario, refer to [Dynamic advertisement: Best practices](https://developers.cloudflare.com/byoip/dynamic-advertisement/best-practices).
+
+<Aside type='note' header='Note'>
+
+After you set up Magic Transit, all Cloudflare traffic to your prefixes uses GRE tunnels to reach your origin. This is true even when you disable dynamic advertising.
+
+As a result, you may see traffic at the tunnel endpoint even when dynamic advertisement is disabled. For example, you may see traffic from other Cloudflare products that you or your end users are using.
+
+</Aside>
diff --git a/products/magic-transit/src/content/set-up/index.md b/products/magic-transit/src/content/set-up/index.md
deleted file mode 100644
index b1d35f8a8af..00000000000
--- a/products/magic-transit/src/content/set-up/index.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: Set up
-order: 2
----
-
-# Set up Magic Transit
-
-Magic Transit setup is straightforward but involves significant configuration of critical network infrastructure. To ensure smooth integration with Magic Transit, Cloudflare uses the process described in these articles:
-
-- __[Onboarding](/set-up/onboarding/)__ outlines the onboarding process, from scoping to going live, which typically takes about 10 business days. Cloudflare can significantly accelerate this timeline in active-attack scenarios.
-- __[Requirements](/set-up/requirements)__ covers router compatibility, letters of authorization (LOA), internet routing registry (IRR) verification, and maximum segment size (MSS) settings.
-- __[Provide configuration data](/set-up/provide-configuration-data/)__ defines customer configuration data required for Cloudflare to set up Magic Transit for your organization.
-- __[Configure Magic Transit firewall](/magic-firewall/)__ outlines recommended Magic Transit firewall policies and customization.
diff --git a/products/magic-transit/src/content/set-up/onboarding.md b/products/magic-transit/src/content/set-up/onboarding.md
deleted file mode 100644
index 8299db8cc2d..00000000000
--- a/products/magic-transit/src/content/set-up/onboarding.md
+++ /dev/null
@@ -1,64 +0,0 @@
----
-title: Onboarding
-order: 1
----
-
-# Magic Transit onboarding
-
-The onboarding process, from scoping to going live, typically takes about 10 business days, and Cloudflare can significantly accelerate this timeline in active-attack scenarios.
-
-Throughout the onboarding process, Cloudflare partners closely with your organization to accomplish the following tasks:
-
-## Scope your configuration
-
-Starting with an initial kickoff call, Cloudflare engages with your organization to confirm the scope and timeline for setting up Magic Transit.
-
-*Duration:* Less than 1 business day
-
-*Customer requirements:* See _[Requirements](/set-up/requirements/)_
-
-## Configure tunnels
-
-Cloudflare sets up Anycast tunnels for Magic Transit based on configuration details you supply, as outlined below.
-
-*Duration:* ~4 business days
-
-*Customer requirements:* Supply information specified in _[Specify GRE Tunnel Endpoints](/set-up/provide-configuration-data/specify-gre-tunnel-endpoints/)_ so that Cloudflare can set up your tunnels.
-
-## Run pre-flight checks
-
-Once Cloudflare has staged the tunnels, we validate tunnel connectivity, LOA, IRR, and maximum segment size (MSS) configurations.
-
-To ensure that the integration is ready to go live the following week, complete this step by close of business Thursday.
-
-*Duration:* ~4 business days
-
-## Configure edge network
-
-Once Cloudflare’s pre-flight checks have passed and a date to complete the change has been verified by your account team, engineering will start the process of onboarding your prefixes to Cloudflare’s edge network.
-
-To configure the edge network, Cloudflare does the following:
-
-1. Route traffic sourced from Cloudflare’s network.
-1. Attract traffic from the broader Internet by advertising your customer-owned prefixes.
-
-These routing changes return any traffic generated within the Cloudflare edge network to the GRE tunnels set up for Magic Transit. This can happen under the following 2 conditions:
-
-- An IP within your Magic Transit prefix accesses a web property proxied by Cloudflare.
-- You have a proxied zone set up on Cloudflare with a target IP within a Magic Transit prefix range.
-
-You control the edge router advertisement, which dictates whether Cloudflare’s edge network advertises your prefixes. Advertisement is activated at the go-live call, routing traffic via Cloudflare and the GRE tunnels to your data center(s).
-
-<Aside type='warning' header='Important'>
-
-It is critical that you put the appropriate MSS clamps in place before routing changes are made. Failure to apply an MSS clamp may result in dropped packets and hard-to-debug connectivity issues.
-
-When using [Cloudflare Network Interconnect](/network-interconnect/) with Magic Transit, you must set the MSS clamp size to 1332 bytes to accommodate additional overhead from the foo-over-UDP (FOU) protocol and IPv6. These are used to backhaul data from the colocation facility where traffic is ingested (close to the end user) to the facility with the CNI link.
-
-</Aside>
-
-*Duration:* ~5 business days
-
-## Go live and announce prefixes
-
-Once edge network configuration is complete, the final step is to schedule a go-live call. During this call you announce your prefixes from Cloudflare’s edge network for the first time.
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/assign-tunnel-route-priorities.md b/products/magic-transit/src/content/set-up/provide-configuration-data/assign-tunnel-route-priorities.md
deleted file mode 100644
index 5aa80a84d70..00000000000
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/assign-tunnel-route-priorities.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-order: 2
----
-
-# Assign tunnel route priorities
-
-Magic Transit uses a static configuration to route your traffic through [Generic Routing Encapsulation (GRE) tunnels](/about/tunnels-and-encapsulation) from Cloudflare’s edge to your data center(s).
-
-You must assign a route priority to each GRE tunnel–subnet pair in your GRE configuration, as follows:
-
-- Lower values have greater priority.
-- When the priority values for prefix entries match—as illustrated by the 103.21.244.0/24 subnet in the example routing configuration (in boldface)—Cloudflare uses equal-cost multi-path (ECMP) packet forwarding to route traffic.
-
-For more on how Cloudflare uses ECMP packet forwarding, see [_Traffic steering_](/about/traffic-steering).
-
-For an example edge routing configuration, refer to this table:
-
-<table>
-  <thead>
-    <tr>
-      <th><strong>GRE tunnel</strong></th>
-      <th><strong>Subnet</strong></th>
-      <th><strong>Priority</strong></th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td>GRE_1_IAD</td>
-      <td><strong>103.21.244.0/24</strong></td>
-      <td>100</td>
-    </tr>
-    <tr>
-      <td>GRE_2_IAD</td>
-      <td><strong>103.21.244.0/24</strong></td>
-      <td>100</td>
-    </tr>
-    <tr>
-      <td>GRE_3_ATL</td>
-      <td><strong>103.21.244.0/24</strong></td>
-      <td>100</td>
-    </tr>
-    <tr>
-      <td>GRE_4_ATL</td>
-      <td><strong>103.21.244.0/24</strong></td>
-      <td>100</td>
-    </tr>
-    <tr>
-      <td>GRE_1_IAD</td>
-      <td>103.21.245.0/24</td>
-      <td>200</td>
-    </tr>
-    <tr>
-      <td>GRE_2_IAD</td>
-      <td>103.21.245.0/24</td>
-      <td>200</td>
-    </tr>
-    <tr>
-      <td>GRE_3_ATL</td>
-      <td>103.21.245.0/24</td>
-      <td>100</td>
-    </tr>
-    <tr>
-      <td>GRE_4_ATL</td>
-      <td>103.21.245.0/24</td>
-      <td>100</td>
-    </tr>
-  </tbody>
-</table>
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/index.md b/products/magic-transit/src/content/set-up/provide-configuration-data/index.md
deleted file mode 100644
index 5864308b0ec..00000000000
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-order: 2
----
-
-# Provide configuration data
-
-For details on the configuration data required for Cloudflare to set up Magic Transit for your organization, see these articles:
-
-<DirectoryListing path="/set-up/provide-configuration-data"/>
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/map-routes-for-prefixes-smaller-than-24.md b/products/magic-transit/src/content/set-up/provide-configuration-data/map-routes-for-prefixes-smaller-than-24.md
deleted file mode 100644
index f314d69a977..00000000000
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/map-routes-for-prefixes-smaller-than-24.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-order: 3
----
-
-# Map route prefixes smaller than /24
-
-In order for Cloudflare to route your traffic from the edge to your data center(s) via GRE tunnels, you must provide your prefixes and the tunnels to which they should be mapped, similar to the example in the table below.
-
-| Prefix          | GRE Tunnel |
-| --------------- | ---------- |
-| 103.21.244.0/29 | GRE_1_IAD  |
-| 103.21.244.8/29 | GRE_2_ATL  |
-
-The minimum advertising prefix is /24. However, since we use GRE tunnels as an outer wrapper for your traffic, we can route prefixes within that /24 to different tunnel end points.
-
-For example, you can send `x.x.x.0/29` to Datacenter 1 and `x.x.x.8/29` to Datacenter 2. This is helpful when you operate in an environment with constrained IP resources.
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-gre-tunnel-endpoints.md b/products/magic-transit/src/content/set-up/provide-configuration-data/specify-gre-tunnel-endpoints.md
deleted file mode 100644
index 9261fa489b8..00000000000
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-gre-tunnel-endpoints.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-order: 1
-type: table
----
-
-# Specify tunnel endpoints
-
-<ContentColumn>
-
-## Anycast edge IP addresses
-
-Cloudflare will assign 2 Anycast IP addresses shortly after your [onboarding](/set-up/onboarding)  kickoff call. Use these Anycast edge addresses as the GRE tunnel destinations on your data center routers/endpoints.
-
-## Generic Routing Encapsulation (GRE)
-
-Cloudflare recommends 2 GRE tunnels for each ISP and data center router combination, one per Anycast IP.
-
-To configure the GRE tunnel(s) between Cloudflare and your data center(s), you must provide the following data for each tunnel:
-
-* **Customer edge IP address**—A public Internet routable IP address that is outside of the prefixes Cloudflare will advertise on your behalf. These are generally IP addresses provided by your ISP. If you intend to use a physical or virtual connection ([Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/about)), you do not need to provide edge addresses—Cloudflare will provide them.
-* **Private subnet**—A 31-bit subnet (/31 in CIDR notation) supporting 2 hosts, one for each side of the tunnel. Select the subnet from the following private IP space:
-  * 10.0.0.0–10.255.255.255
-  * 172.16.0.0–172.31.255.255
-  * 192.168.0.0–192.168.255.255
-* **Private IP addresses**—The private IP address assigned to the **Cloudflare** and **customer** sides of the tunnel
-
-For an example GRE tunnel configuration, refer to this table:
-
-</ContentColumn>
-
-<table>
-  <thead>
-    <tr>
-      <th style='min-width:70px'>GRE tunnel</th>
-      <th style='min-width:125px'>Customer edge IP</th>
-      <th style='min-width:100px'>Anycast IP</th>
-      <th style='min-width:130px'>Private subnet</th>
-      <th style='min-width:115px'>Customer private IP</th>
-      <th style='min-width:100px'>Cloudflare private IP</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td>GRE_1_IAD</td>
-      <td>104.18.112.75</td>
-      <td>Anycast IP 1</td>
-      <td>10.10.10.100/31</td>
-      <td>10.10.10.100</td>
-      <td>10.10.10.101</td>
-    </tr>
-    <tr>
-      <td>GRE_2_IAD</td>
-      <td>104.18.112.75</td>
-      <td>Anycast IP 2</td>
-      <td>10.10.10.102/31</td>
-      <td>10.10.10.102</td>
-      <td>10.10.10.103</td>
-    </tr>
-    <tr>
-      <td>GRE_3_ATL</td>
-      <td>104.40.112.125</td>
-      <td>Anycast IP 1</td>
-      <td>10.10.10.104/31</td>
-      <td>10.10.10.104</td>
-      <td>10.10.10.105</td>
-    </tr>
-    <tr>
-      <td>GRE_4_ATL</td>
-      <td>104.40.112.125</td>
-      <td>Anycast IP 2</td>
-      <td>10.10.10.106/31</td>
-      <td>10.10.10.106</td>
-      <td>10.10.10.107</td>
-    </tr>
-  </tbody>
-</table>
-
-<ContentColumn>
-
-## Scoped routes for GRE tunnels
-
-To reduce latency for your GRE tunnel configurations, especially if you operate your own Anycast network, Cloudflare can steer your traffic by scoping it to specific Cloudflare data center regions.
-
-Valid Cloudflare regions include AFR, APAC, EEUR, ENAM, ME, OC, SAM, WEUR, and WNAM.
-
-To configure scoping for your traffic, you must provide Cloudflare with GRE tunnel data for each Cloudflare region.
-
-For an example of scoping configuration data, see the table below. It lists GRE tunnels and their associated Cloudflare region codes:
-
-<table>
- <thead>
-  <tr>
-   <th>GRE tunnel</th>
-   <th>Region code</th>
-   </tr>
-  </thead>
-  <tbody>
-  <tr>
-     <td>GRE_1_IAD</td>
-     <td>AFR</td>
-  </tr>
-  <tr>
-    <td>GRE_2_IAD</td>
-    <td>EEUR</td>
-  </tr>
-  <tr>
-    <td>GRE_3_ATL</td>
-    <td>ENAM</td>
-  </tr>
-  <tr>
-    <td>GRE_4_ATL</td>
-    <td>ME</td>
-    </tr>
-</tbody>
-</table>
-
-Cloudflare has nine geographic regions across the world. This table lists region codes and their associated regions:
-
-<table>
-  <thead>
-    <tr>
-      <th>Region code</th>
-      <th>Region</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-    <td>AFR</td>
-    <td>Africa
-    </td>
-    </tr>
-    <tr>
-    <td>APAC</td>
-    <td>Asia Pacific
-    </td>
-    </tr>
-    <tr>
-    <td>EEUR</td>
-    <td>Eastern Europe
-    </td>
-    </tr>
-    <tr>
-    <td>ENAM</td>
-    <td>Eastern North America
-    </td>
-    </tr>
-    <tr>
-    <td>ME</td>
-    <td>Middle East
-    </td>
-    </tr>
-    <tr>
-    <td>OC</td>
-    <td>Oceania
-    </td>
-    </tr>
-    <tr>
-    <td>SAM</td>
-    <td>South America
-    </td>
-    </tr>
-    <tr>
-    <td>WEUR</td>
-    <td>Western Europe
-    </td>
-    </tr>
-    <tr>
-    <td>WNAM</td>
-    <td>Western North America
-    </td>
-    </tr>
-  </tbody>
-</table>
-
-</ContentColumn>
diff --git a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-prefixes-to-advertise.md b/products/magic-transit/src/content/set-up/provide-configuration-data/specify-prefixes-to-advertise.md
deleted file mode 100644
index 381f1c75bd5..00000000000
--- a/products/magic-transit/src/content/set-up/provide-configuration-data/specify-prefixes-to-advertise.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-order: 0
----
-
-# Specify prefixes to advertise
-
-List all prefixes and the ASNs from which you want them to originate.
-
-When specifying prefixes, observe these guidelines:
-
-- Prefixes must support at least 256 hosts (/24 in classless inter-domain routing [CIDR] notation).
-- Internet Routing Registry entries and Letters of Authorization must match the prefixes and originating prefixes you submit to Cloudflare.
-- When using contiguous prefixes, specify aggregate prefixes where possible.
-- When using Route Origin Authorizations (ROAs) to sign routes for [resource public key infrastructure (RPKI)](https://tools.ietf.org/html/rfc8210), the prefix and originating ASN must match the onboarding submission.
-- If you do not own an ASN, you may use our Cloudflare Customer ASN (AS209242) as the originating AS.
-
-For an example prefix configuration, refer to this table:
-
-| Prefix          | Originating AS |
-| ----------------| -------------- |
-| 103.21.244.0/23 | AS209242       |
-| 131.0.72.0/22   | AS395747       |
-| 103.21.245.0/24 | AS395747       |
-
-<Aside type='note' header='Note'>
-
-When customers supply their own ASN, Cloudflare prepends the main Cloudflare ASN (AS13335) to the BGP AS_PATH. For example, if the customer ASN is AS64496, anyone directly peering with Cloudflare sees the path as `13335 64496`.
-
-If you do not have an ASN or do not want to bring your ASN to Cloudflare, you can use the Cloudflare Customer ASN (AS209242). In this case, the path becomes `13335 209242`.
-
-</Aside>
diff --git a/products/magic-transit/src/content/set-up/requirements.md b/products/magic-transit/src/content/set-up/requirements.md
deleted file mode 100644
index 2d57d3b8d8f..00000000000
--- a/products/magic-transit/src/content/set-up/requirements.md
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: Requirements
-alwaysopen: true
-order: 1
-hidden: false
----
-
-# Requirements
-
-Cloudflare requires that you meet the following Magic Transit onboarding requirements:
-
-## Use compatible tunnel endpoint routers
-
-Magic Transit relies on Generic Routing Encapsulation (GRE) tunnels to transmit packets from Cloudflare’s edge to your origin network. To ensure compatibility with Magic Transit, the routers at your GRE tunnel endpoints must meet these requirements:
-
-- Support GRE tunneling.
-- Allow configuration of at least 1 tunnel per Internet service provider (ISP).
-- Support maximum segment size (MSS) clamping.
-
-## Draft Letter of Authorization
-
-Draft a [Letter of Authorization (LOA)](https://developers.cloudflare.com/byoip/loa) that identifies the prefixes you want to advertise and gives Cloudflare permission to announce them. See this [LOA template](https://developers.cloudflare.com/byoip/loa/loa-template) for an example.
-
-## Verify Internet Routing Registry entries
-
-To ensure that Magic Transit routes traffic to the correct autonomous systems (AS), verify that your Internet Routing Registry (IRR) entries match corresponding origin autonomous system numbers (ASNs). For guidance, see [_Verify IRR entries_](https://developers.cloudflare.com/byoip/irr-records/verify-irr-entries).
-
-## Set maximum segment size
-
-![Packet flow diagram](../static/mss-values-and-packet.png)
-
-The SYN-ACK packet sent to the client during TCP handshake encodes the value for maximum segment size (MSS). Egress packets are routed via your ISP interface, and each packet must comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.
-
-Cloudflare uses GRE tunnels to deliver packets from our edge to your data center(s), while Cloudflare Magic Transit encapsulates these packets, adding a new IP header and GRE protocol header.
-
-To accommodate the additional header data, **you must set the MSS value to 1436 bytes at your physical egress interfaces** (not the GRE tunnel interfaces):
-
-<table>
-  <thead>
-    <tr>
-      <th></th>
-      <th>Standard Internet routable MTU</th>
-      <th align="right">1500 bytes</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td>&#45;</td>
-      <td>Original IP header</td>
-      <td align="right">20 bytes</td>
-    </tr>
-    <tr>
-      <td>&#45;</td>
-      <td>Original protocol header (TCP)</td>
-      <td align="right">20 bytes</td>
-    </tr>
-    <tr>
-      <td>&#45;</td>
-      <td>New IP header</td>
-      <td align="right">20 bytes</td>
-    </tr>
-    <tr>
-      <td>&#45;</td>
-      <td>New protocol header (GRE)</td>
-      <td align="right">4 bytes</td>
-    </tr>
-    <tr>
-      <td>&#61;</td>
-      <td>Maximum segment size (MSS)</td>
-      <td align="right">1436 bytes</td>
-    </tr>
-  </tbody>
-</table>
-
-Unless you apply these MSS settings at the origin, client machines do not know that they must use an MSS of 1436 bytes when sending packets to your origin.
-
-### Follow router vendor guidelines
-
-Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router.
-
-The following table lists several commonly used router vendors with links to MSS clamping instructions:
-
-| Router device | URL                                                                                                                                                                                                   |
-| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Cisco         | [TC IP Adjust MSS](https://www.cisco.com/en/US/docs/ios-xml/ios/ipapp/command/ip_tcp_adjust-mss_through_ip_wccp_web-cache_accelerated.html#GUID-68044D35-A53E-42C1-A7AB-9236333DA8C4)                 |
-| Juniper       | [TCP MSS – Edit System](https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/tcp-mss-edit-system.html)                                                          |
-
-### Verify MSS settings at your origin
-
-To verify that your routers have the correct MSS setting (1436 bytes) at your origin, run the following command on the servers egressing the prefixes you want to add to Magic Transit:
-
-```sh
-$ curl 167.71.125.57:8080
-```
-
-You should see the following result:
-
-```txt
-Local: 167.71.125.57:8080
-Remote: 172.68.141.62:44108
-Local MSS: 1436
-Remote MSS: 1436
-```
-
-<Aside type='warning' header='Important'>
-
-When you do not have a publicly available TCP endpoint for which Cloudflare can verify your MSS settings, you must provide a screenshot of the cURL command results, similar to the one above.
-
-</Aside>
diff --git a/products/magic-transit/src/content/static/bgp-control-diagram.png b/products/magic-transit/src/content/static/bgp-control-diagram.png
new file mode 100644
index 00000000000..c90b0a1b887
Binary files /dev/null and b/products/magic-transit/src/content/static/bgp-control-diagram.png differ
diff --git a/products/magic-transit/src/content/use-magic-transit-on-demand.md b/products/magic-transit/src/content/use-magic-transit-on-demand.md
deleted file mode 100644
index 271a8039c33..00000000000
--- a/products/magic-transit/src/content/use-magic-transit-on-demand.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-title: Use on demand
-order: 5
----
-
-# Use Magic Transit on demand
-
-Customers with access to the Magic Transit on-demand option can [configure prefix advertisement](https://developers.cloudflare.com/byoip/dynamic-advertisement/configure-dynamic-advertisement) from the **IP Prefixes** page in their Cloudflare account home or via the [Cloudflare API](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-properties).
-
-A common workflow is to enable prefix advertisement during an attack so that you can take advantage of Cloudflare protection and then disable advertisement once the incident is resolved.
-
-To ensure smooth operation in general and simplify the advertisement process during an attack scenario, see [_Dynamic advertisement: Best practices_](https://developers.cloudflare.com/byoip/dynamic-advertisement/best-practices).
-
-<Aside type='note' header='Note'>
-
-Once you have set up Magic Transit, all Cloudflare traffic to your prefixes uses GRE tunnels to reach your origin. This is true even when you disable dynamic advertising.
-
-As a result, you may see traffic at the tunnel endpoint even when dynamic advertisement is disabled—traffic from other Cloudflare products that you or your end users are using, for example.
-
-</Aside>
diff --git a/products/magic-transit/src/content/use-magic-transit-with-cni.md b/products/magic-transit/src/content/use-magic-transit-with-cni.md
deleted file mode 100644
index bf48afdf344..00000000000
--- a/products/magic-transit/src/content/use-magic-transit-with-cni.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Use Network Interconnect
-order: 4
----
-
-# Use Cloudflare Network Interconnect
-
-## Onboarding
-
-The onboarding process to set up Magic Transit with [Cloudflare Network Interconnect (CNI)](https://developers.cloudflare.com/network-interconnect) includes the steps below.
-
-1. Scope your configuration.
-
-2. Cloudflare generates Letters of Authorization (LOAs) for your CNI cross-connects and sends them to your organization.
-
-3. Order the cross-connects you want to use with CNI. You can use any of the following:
-    * **Private network interconnects (PNI)** - Available at any of our [private peering facilities](https://www.peeringdb.com/net/4224).
-    * **Virtual private network interconnects (vPNI)** - Allows you to easily connect with Cloudflare at any of our interconnection platform locations.
-
-4. Send Cloudflare confirmation after the cross-connects are set up.
-
-5. Cloudflare provides the GRE IPs and BGP Peering info after onboarding the GRE tunnels in CNI links.
-
-6. Work with Cloudflare to establish the BGP session for the PNI on both sides. This requires a BGP call and a ~2 hour maintenance window provided by the customer.
-
-7. Configure the GRE tunnel over the PNI.
-
-8. Cloudflare up-prefs the CNI connection and turns Magic Transit back on.
-
-Each step can take 1–7 business days.
-
-For more details on the CNI onboarding process, see [_Set up Cloudflare Network Interconnect: Onboarding_](https://developers.cloudflare.com/network-interconnect/set-up-cni).
-
-## Guidelines
-
-When working with Magic Transit and CNI, observe these guidelines:
-
-* Because Cloudflare Network Interconnect does not support 1500 byte packets, you must implement MSS clamping.
-
-* Set the MSS clamp size to 1332 bytes to accommodate the additional overhead from the Foo-over-UDP (FOU) protocol and IPv6. These are used to backhaul data from the colocation facility where traffic is ingested—close to the end user—to the facility with the CNI link.
-
-* Cloudflare Network Interconnect does not process outgoing traffic from your data centers. Egress traffic returns to end users through direct server return (DSR), not through Cloudflare. For this reason, CNI cannot replace your existing transit providers.
diff --git a/products/magic-transit/wrangler.toml b/products/magic-transit/wrangler.toml
index cd914273c7d..ab48bdf5ba3 100644
--- a/products/magic-transit/wrangler.toml
+++ b/products/magic-transit/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/magic-transit*"
+kv_namespaces = [ 
+  { binding = "REDIRECTS", id = "ef0489aa65e14a65b56515aa1b6ba84d" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/magic-wan/README.md b/products/magic-wan/README.md
new file mode 100644
index 00000000000..bb76c3804c0
--- /dev/null
+++ b/products/magic-wan/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Magic WAN docs
+
+[View docs →](https://developers.cloudflare.com/magic-wan)
+
+[Read contributor guidelines →](https://github.com/cloudflare/cloudflare-docs/blob/6d67d0dda5bfac6f02157dd896ce4ba77ef2acbe/CONTRIBUTING.md)
diff --git a/products/magic-wan/docs-config.js b/products/magic-wan/docs-config.js
new file mode 100644
index 00000000000..e0bfffa270b
--- /dev/null
+++ b/products/magic-wan/docs-config.js
@@ -0,0 +1,33 @@
+module.exports = {
+  product: "Magic WAN",
+  pathPrefix: "/magic-wan",
+  productIconKey: "magic-wan",
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/magic-wan",
+  externalLinks: [
+    {
+      title: "Magic WAN home",
+      url: "https://www.cloudflare.com/magic-wan/"
+    },
+    {
+      title: "Blog: Magic WAN & Magic Firewall",
+      url: "https://blog.cloudflare.com/magic-wan-firewall/"
+    },
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "b23088ab4d346409f9d3ece6606344c3",
+    algoliaOptions: { 'facetFilters': '["project:magic-wan"]'}
+  },
+  siteMetadata: {
+    title: "Cloudflare Magic WAN docs",
+    description: "Magic WAN replaces legacy WAN architectures with Cloudflare’s network, providing global connectivity, cloud-based security, performance, and control through one simple user interface.",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/magic-wan",
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+  }
+}
diff --git a/products/magic-wan/package.json b/products/magic-wan/package.json
new file mode 100644
index 00000000000..ea02638c7ca
--- /dev/null
+++ b/products/magic-wan/package.json
@@ -0,0 +1,14 @@
+{
+  "private": true,
+  "dependencies": {
+    "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+  },
+  "scripts": {
+    "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+    "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+    "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+    "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+    "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+    "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+  }
+}
diff --git a/products/magic-wan/src/content/get-started/configure-tunnels/assign-tunnel-priorities.md b/products/magic-wan/src/content/get-started/configure-tunnels/assign-tunnel-priorities.md
new file mode 100644
index 00000000000..bd90fc769c0
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/configure-tunnels/assign-tunnel-priorities.md
@@ -0,0 +1,70 @@
+---
+title: Assign tunel properties
+order: 5
+pcx-content-type: how-to
+---
+
+# Assign tunnel route priorities
+
+Magic WAN uses a static configuration to route your traffic through [Generic Routing Encapsulation (GRE) tunnels](https://developers.cloudflare.com/magic-transit/about/tunnels-and-encapsulation) from Cloudflare’s edge to your locations
+
+You must assign a route priority to each GRE tunnel–subnet pair in your GRE configuration, as follows:
+
+- Lower values have greater priority.
+- When the priority values for prefix entries match—as illustrated by the 103.21.244.0/24 subnet in the example routing configuration (in boldface)—Cloudflare uses equal-cost multi-path (ECMP) packet forwarding to route traffic.
+
+For more on how Cloudflare uses ECMP packet forwarding, see [Traffic steering](https://developers.cloudflare.com/magic-transit/about/traffic-steering).
+
+For an example edge routing configuration, refer to this table:
+
+<table>
+  <thead>
+    <tr>
+      <th><strong>GRE tunnel</strong></th>
+      <th><strong>Subnet</strong></th>
+      <th><strong>Priority</strong></th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td><strong>103.21.244.0/24</strong></td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td>103.21.245.0/24</td>
+      <td>200</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td>103.21.245.0/24</td>
+      <td>200</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td>103.21.245.0/24</td>
+      <td>100</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td>103.21.245.0/24</td>
+      <td>100</td>
+    </tr>
+  </tbody>
+</table>
\ No newline at end of file
diff --git a/products/magic-wan/src/content/get-started/configure-tunnels/index.md b/products/magic-wan/src/content/get-started/configure-tunnels/index.md
new file mode 100644
index 00000000000..cf4c4fc3911
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/configure-tunnels/index.md
@@ -0,0 +1,11 @@
+---
+title: Configure tunnels
+order: 3
+pcx-content-type: how-to
+---
+
+# Configure tunnels
+
+Complete the tasks in the order shown below to configure your tunnels.
+
+<DirectoryListing path="/get-started/configure-tunnels"/>
diff --git a/products/magic-wan/src/content/get-started/configure-tunnels/map-route-prefixes.md b/products/magic-wan/src/content/get-started/configure-tunnels/map-route-prefixes.md
new file mode 100644
index 00000000000..9fe96bf1e76
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/configure-tunnels/map-route-prefixes.md
@@ -0,0 +1,18 @@
+---
+title: Map route prefixes
+order: 6
+pcx-content-type: how-to
+---
+
+# Map route prefixes smaller than /24
+
+Before Cloudflare can route your traffic from the edge to your locations via GRE tunnels, you must provide your prefixes and the tunnels to which they should be mapped, similar to the example in the table below.
+
+| Prefix          | GRE Tunnel |
+| --------------- | ---------- |
+| 103.21.244.0/29 | GRE_1_IAD  |
+| 103.21.244.8/29 | GRE_2_ATL  |
+
+The minimum advertising prefix is /24. However, because Cloudflare uses GRE tunnels as an outer wrapper for your traffic, Cloudflare can route prefixes within that /24 to different tunnel endpoints.
+
+For example, you can send `x.x.x.0/29` to Datacenter 1 and `x.x.x.8/29` to Datacenter 2, which is helpful when operating in environments with constrained IP resources.
\ No newline at end of file
diff --git a/products/magic-wan/src/content/get-started/configure-tunnels/specify-ip-addresses.md b/products/magic-wan/src/content/get-started/configure-tunnels/specify-ip-addresses.md
new file mode 100644
index 00000000000..8c082808aec
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/configure-tunnels/specify-ip-addresses.md
@@ -0,0 +1,20 @@
+---
+title: Specify IP address for endpoint health checks
+order: 7
+pcx-content-type: how-to
+---
+
+# Specify IP addresses for endpoint health checks
+
+Magic WAN uses endpoint health checks to determine the overall health of your inter-network connections. Probes originate from Cloudflare infrastructure, outside customer network namespaces, and target IP addresses deep within your network. This process occurs beyond the tunnel-terminating border router, and these “long distance” probes are purely diagnostic.
+
+When choosing which endpoint IP addresses to monitor with health checks, keep in mind that redundant IPs routed via the same ISP and infrastructure are unnecessary but are useful when troubleshooting.
+
+Cloudflare pings health check IPs from within the [published Cloudflare IP range](https://www.cloudflare.com/ips/), which is also available via the [Cloudflare API](https://api.cloudflare.com/#cloudflare-ips-properties).
+
+For an example endpoint health check configuration, see the table below.
+
+| Prefix          | Endpoint IP address |
+| --------------- | ------------------- |
+| 103.21.244.0/24 | 103.21.244.100      |
+| 103.21.245.0/24 | 103.21.245.100      |
diff --git a/products/magic-wan/src/content/get-started/configure-tunnels/specify-tunnel-endpoints.md b/products/magic-wan/src/content/get-started/configure-tunnels/specify-tunnel-endpoints.md
new file mode 100644
index 00000000000..5c5beceb811
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/configure-tunnels/specify-tunnel-endpoints.md
@@ -0,0 +1,38 @@
+---
+title: Specify tunnel endpoints
+order: 4
+pcx-content-type: how-to
+---
+
+# Specify tunnel endpoints
+
+## Anycast edge IP addresses
+
+Cloudflare assigns two Anycast IP addresses shortly after your onboarding kickoff call. Use these Anycast edge addresses as the GRE tunnel destinations on your location's routers/endpoints.
+
+## Generic Routing Encapsulation (GRE)
+
+Cloudflare recommends two GRE tunnels for each ISP and location router combination, one per Anycast IP.
+
+To configure the GRE tunnel(s) between Cloudflare and your locations, you must provide the following data for each tunnel:
+
+* **Customer edge IP address** — A public Internet routable IP address that is outside of the prefixes Cloudflare will advertise on your behalf. These are generally IP addresses provided by your ISP. If you intend to use a physical or virtual connection ([Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/)), you do not need to provide edge addresses. Cloudflare will provide them.
+* **Private subnet** — A 31-bit subnet (/31 in CIDR notation) supporting 2 hosts, one for each side of the tunnel. Select the subnet from the following private IP space:
+  * 10.0.0.0–10.255.255.255
+  * 172.16.0.0–172.31.255.255
+  * 192.168.0.0–192.168.255.255
+* **Private IP addresses** — The private IP address assigned to the **Cloudflare** and **customer** sides of the tunnel
+
+For an example GRE tunnel configuration, see [GRE tunnel configuration example](/reference/configuration-examples#gre-tunnel-configuration-example).
+
+## Scoped routes for GRE tunnels
+
+To reduce latency for your GRE tunnel configurations, especially if you operate your own Anycast network, Cloudflare can steer your traffic by scoping it to specific Cloudflare data center regions.
+
+Valid Cloudflare regions include AFR, APAC, EEUR, ENAM, ME, OC, SAM, WEUR, and WNAM.
+
+To configure scoping for your traffic, you must provide Cloudflare with GRE tunnel data for each Cloudflare region.
+
+For an example of scoping configuration data, see [scoping configuration data example](/reference/configuration-examples#scoping-configuration-data-example).
+
+For a list of Cloudflare's geographic regions across the world and their codes, see [regions and region codes](/reference/configuration-examples#regions-and-region-codes).
diff --git a/products/magic-wan/src/content/get-started/index.md b/products/magic-wan/src/content/get-started/index.md
new file mode 100644
index 00000000000..a12187d9170
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/index.md
@@ -0,0 +1,29 @@
+---
+title: Get Started
+order: 1
+pcx-content-type: how-to
+---
+
+# Get started
+
+Before you can begin using Magic WAN, be sure to complete the onboarding steps below.
+
+## 1. Scope your configuration
+
+The onboarding process begins with an initial kickoff call where Cloudflare engages with your organization to confirm the scope and timeline for setting up Magic WAN.
+
+After your call with Cloudflare, verify that you meet the [onboarding requirements](verify-requirements).
+
+## 2. [Configure tunnels](/get-started/configure-tunnels)
+
+Cloudflare sets up Anycast tunnels for Magic WAN based on the configuration details you provide. This process usually takes about four days.
+
+## 3. Run pre-flight checks
+
+After Cloudflare stages the tunnels, Cloudflare validates tunnel connectivity, the Letter of Authorization (LOA) is signed, and the announcement date is set.
+
+## 4. Go live
+
+During this step, provide Cloudflare with the LOA for your prefixes and the exchange GRE tunnel information. During this call, you should also [review your Firewall configuration](https://developers.cloudflare.com/magic-transit/magic-firewall).
+
+## 5. Monitor and tune configuration
diff --git a/products/magic-wan/src/content/get-started/verify-requirements.md b/products/magic-wan/src/content/get-started/verify-requirements.md
new file mode 100644
index 00000000000..b0bad9bdae0
--- /dev/null
+++ b/products/magic-wan/src/content/get-started/verify-requirements.md
@@ -0,0 +1,108 @@
+---
+title: Verify requirements
+order: 2
+pcx-content-type: how-to
+---
+
+# Requirements
+
+Before you can begin using Magic WAN, verify that you meet Cloudflare's onboarding requirements.
+
+## Use compatible tunnel endpoint routers
+
+Magic WAN relies on Generic Routing Encapsulation (GRE) tunnels to transmit packets from Cloudflare’s edge to your origin network. To ensure compatibility with Magic WAN, the routers at your GRE tunnel endpoints must:
+
+- Support GRE tunneling
+- Allow configuration of at least one tunnel per Internet service provider (ISP)
+- Support maximum segment size (MSS) clamping
+
+## Draft Letter of Authorization
+
+Draft a [Letter of Authorization (LOA)](https://developers.cloudflare.com/byoip/loa). The LOA is required by Cloudflare's transit providers so they can accept the routes Cloudflare advertises on your behalf. For an example, see the [LOA template](https://developers.cloudflare.com/byoip/loa/loa-template).
+
+## Verify Internet Routing Registry entries
+
+To ensure that Magic WAN routes traffic to the correct autonomous systems (AS), verify that your Internet Routing Registry (IRR) entries match corresponding origin autonomous system numbers (ASNs). For guidance, see [_Verify IRR entries_](https://developers.cloudflare.com/byoip/irr-records/verify-irr-entries).
+
+## Set maximum segment size
+
+![Packet flow diagram](../images/mss-values-and-packet.png)
+
+The SYN-ACK packet sent to the client during TCP handshake encodes the value for maximum segment size (MSS). Egress packets are routed via your ISP interface, and each packet must comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.
+
+Cloudflare uses GRE tunnels to deliver packets from our edge to your locations, while Cloudflare Magic WAN encapsulates these packets, adding a new IP header and GRE protocol header.
+
+To accommodate the additional header data, **you must set the MSS value to 1436 bytes at your physical egress interfaces** (not the GRE tunnel interfaces):
+
+<table>
+  <thead>
+    <tr>
+      <th></th>
+      <th>Standard Internet routable MTU</th>
+      <th align="right">1500 bytes</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>&#45;</td>
+      <td>Original IP header</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>Original protocol header (TCP)</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>New IP header</td>
+      <td align="right">20 bytes</td>
+    </tr>
+    <tr>
+      <td>&#45;</td>
+      <td>New protocol header (GRE)</td>
+      <td align="right">4 bytes</td>
+    </tr>
+    <tr>
+      <td>&#61;</td>
+      <td>Maximum segment size (MSS)</td>
+      <td align="right">1436 bytes</td>
+    </tr>
+  </tbody>
+</table>
+
+Unless you apply these MSS settings at the origin, client machines do not know that they must use an MSS of 1436 bytes when sending packets to your origin.
+
+### Follow router vendor guidelines
+
+Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router.
+
+The table lists several commonly used router vendors with links to MSS clamping instructions:
+
+| Router device | URL                                                                                                                                                                                                   |
+| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cisco         | [TC IP Adjust MSS](https://www.cisco.com/en/US/docs/ios-xml/ios/ipapp/command/ip_tcp_adjust-mss_through_ip_wccp_web-cache_accelerated.html#GUID-68044D35-A53E-42C1-A7AB-9236333DA8C4)                 |
+| Juniper       | [TCP MSS – Edit System](https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/tcp-mss-edit-system.html)                                                          |
+
+### Verify MSS settings at your origin
+
+To verify that your routers have the correct MSS setting (1436 bytes) at your origin, run the following command on the servers egressing the prefixes you want to add to Magic WAN:
+
+```sh
+$ curl 167.71.125.57:8080
+```
+
+You should see the following result:
+
+```txt
+Local: 167.71.125.57:8080
+Remote: 172.68.141.62:44108
+Local MSS: 1436
+Remote MSS: 1436
+```
+
+<Aside type='warning' header='Important'>
+
+If you do not have a publicly available TCP endpoint that Cloudflare can use to verify your MSS settings, you must provide a screenshot of the cURL command results, similar to the example above.
+
+</Aside>
diff --git a/products/magic-wan/src/content/images/mss-values-and-packet.png b/products/magic-wan/src/content/images/mss-values-and-packet.png
new file mode 100644
index 00000000000..3ebf8777f79
Binary files /dev/null and b/products/magic-wan/src/content/images/mss-values-and-packet.png differ
diff --git a/products/magic-wan/src/content/index.md b/products/magic-wan/src/content/index.md
new file mode 100644
index 00000000000..9706b6e5bf2
--- /dev/null
+++ b/products/magic-wan/src/content/index.md
@@ -0,0 +1,13 @@
+---
+title: Overview
+order: 0
+pcx-content-type: landing-page
+---
+
+# Cloudflare Magic WAN
+
+Magic WAN provides secure, performant connectivity and routing for your entire corporate networking, reducing cost and operation complexity. [Magic Firewall](https://developers.cloudflare.com/magic-transit/magic-firewall) integrates smoothly with Magic WAN, enabling you to enforce network firewall policies at the edge, across traffic from any entity within your network.
+
+With Magic WAN, you can securely connect any traffic source - data centers, offices, devices, cloud properties - to Cloudflare’s network and configure routing policies to get the bits where they need to go, all within one SaaS solution. 
+
+Magic WAN supports a variety of on-ramps including Anycast GRE tunnels, [Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/), Argo Tunnel, [WARP](https://developers.cloudflare.com/warp-client/), and a variety of Network On-ramp Partners.
\ No newline at end of file
diff --git a/products/magic-wan/src/content/reference/configuration-examples.md b/products/magic-wan/src/content/reference/configuration-examples.md
new file mode 100644
index 00000000000..34ddda84b6c
--- /dev/null
+++ b/products/magic-wan/src/content/reference/configuration-examples.md
@@ -0,0 +1,146 @@
+---
+order: 9
+pcx-content-type: reference
+---
+
+# Configuration examples
+
+## GRE tunnel configuration example
+
+<table>
+  <thead>
+    <tr>
+      <th style='min-width:70px'>GRE tunnel</th>
+      <th style='min-width:125px'>Customer edge IP</th>
+      <th style='min-width:100px'>Anycast IP</th>
+      <th style='min-width:130px'>Private subnet</th>
+      <th style='min-width:115px'>Customer private IP</th>
+      <th style='min-width:100px'>Cloudflare private IP</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>GRE_1_IAD</td>
+      <td>104.18.112.75</td>
+      <td>Anycast IP 1</td>
+      <td>10.10.10.100/31</td>
+      <td>10.10.10.100</td>
+      <td>10.10.10.101</td>
+    </tr>
+    <tr>
+      <td>GRE_2_IAD</td>
+      <td>104.18.112.75</td>
+      <td>Anycast IP 2</td>
+      <td>10.10.10.102/31</td>
+      <td>10.10.10.102</td>
+      <td>10.10.10.103</td>
+    </tr>
+    <tr>
+      <td>GRE_3_ATL</td>
+      <td>104.40.112.125</td>
+      <td>Anycast IP 1</td>
+      <td>10.10.10.104/31</td>
+      <td>10.10.10.104</td>
+      <td>10.10.10.105</td>
+    </tr>
+    <tr>
+      <td>GRE_4_ATL</td>
+      <td>104.40.112.125</td>
+      <td>Anycast IP 2</td>
+      <td>10.10.10.106/31</td>
+      <td>10.10.10.106</td>
+      <td>10.10.10.107</td>
+    </tr>
+  </tbody>
+</table>
+
+## Scoping configuration data example
+
+The table below lists GRE tunnels and their associated Cloudflare region codes.
+
+<table>
+ <thead>
+  <tr>
+   <th>GRE tunnel</th>
+   <th>Region code</th>
+   </tr>
+  </thead>
+  <tbody>
+  <tr>
+     <td>GRE_1_IAD</td>
+     <td>AFR</td>
+  </tr>
+  <tr>
+    <td>GRE_2_IAD</td>
+    <td>EEUR</td>
+  </tr>
+  <tr>
+    <td>GRE_3_ATL</td>
+    <td>ENAM</td>
+  </tr>
+  <tr>
+    <td>GRE_4_ATL</td>
+    <td>ME</td>
+    </tr>
+</tbody>
+</table>
+
+## Regions and Region Codes
+
+Cloudflare has nine geographic regions across the world. This table lists region codes and their associated regions.
+
+<table>
+  <thead>
+    <tr>
+      <th>Region code</th>
+      <th>Region</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+    <td>AFR</td>
+    <td>Africa
+    </td>
+    </tr>
+    <tr>
+    <td>APAC</td>
+    <td>Asia Pacific
+    </td>
+    </tr>
+    <tr>
+    <td>EEUR</td>
+    <td>Eastern Europe
+    </td>
+    </tr>
+    <tr>
+    <td>ENAM</td>
+    <td>Eastern North America
+    </td>
+    </tr>
+    <tr>
+    <td>ME</td>
+    <td>Middle East
+    </td>
+    </tr>
+    <tr>
+    <td>OC</td>
+    <td>Oceania
+    </td>
+    </tr>
+    <tr>
+    <td>SAM</td>
+    <td>South America
+    </td>
+    </tr>
+    <tr>
+    <td>WEUR</td>
+    <td>Western Europe
+    </td>
+    </tr>
+    <tr>
+    <td>WNAM</td>
+    <td>Western North America
+    </td>
+    </tr>
+  </tbody>
+</table>
diff --git a/products/magic-wan/src/content/reference/index.md b/products/magic-wan/src/content/reference/index.md
new file mode 100644
index 00000000000..94b2c2df818
--- /dev/null
+++ b/products/magic-wan/src/content/reference/index.md
@@ -0,0 +1,10 @@
+---
+order: 8
+pcx-content-type: navigation
+---
+
+# Reference
+
+Review different configuration examples for GRE tunnels and scoping along with region codes.
+
+<DirectoryListing path="/reference"/>
diff --git a/products/magic-wan/wrangler.toml b/products/magic-wan/wrangler.toml
new file mode 100644
index 00000000000..4ba51e79e31
--- /dev/null
+++ b/products/magic-wan/wrangler.toml
@@ -0,0 +1,14 @@
+name = "magic-wan"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/magic-wan*"
+
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
diff --git a/products/network-interconnect/docs-config.js b/products/network-interconnect/docs-config.js
index 9033eb81f11..5dbcb0f1d84 100644
--- a/products/network-interconnect/docs-config.js
+++ b/products/network-interconnect/docs-config.js
@@ -28,6 +28,6 @@ module.exports = {
     description: "For a faster, more reliable, and more secure experience than connecting over the Internet.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/network-interconnect",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/network-interconnect/src/content/interconnect-types.md b/products/network-interconnect/src/content/interconnect-types.md
index 5c7e4232c1b..ac984cc318b 100644
--- a/products/network-interconnect/src/content/interconnect-types.md
+++ b/products/network-interconnect/src/content/interconnect-types.md
@@ -24,7 +24,7 @@ Private network interconnects can range from 10G to 100G. The smallest compatibl
 
 ## Virtual private network interconnect
 
-Cloudflare partners with Equinix, Megaport, PCCW ConsoleConnect, PacketFabric, and Zayo to provide virtual private network interconnects (vPNI) that easily connect you with Cloudflare at any of our interconnection platform locations. For more information about our partner program, see [Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/).
+Cloudflare partners with Equinix, Megaport, Console Connect, PacketFabric, Coresite, Epsilon and Zayo to provide virtual private network interconnects (vPNI) that easily connect you with Cloudflare at any of our interconnection platform locations. For more information about our partner program, see [Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/).
 
 Choose a vPNI when you are already using our partner providers or when you want a quick and easy way to onboard a secure cloud experience.
 
diff --git a/products/network-interconnect/src/content/partners/console-connect.md b/products/network-interconnect/src/content/partners/console-connect.md
new file mode 100644
index 00000000000..4be992a7b2e
--- /dev/null
+++ b/products/network-interconnect/src/content/partners/console-connect.md
@@ -0,0 +1,15 @@
+---
+title: Console Connect
+order: 1
+pcx-content-type: tutorial
+---
+
+# Console Connect Users
+
+1. Click **+** to create a new connection.
+1. From the **Choose source port** dropdown, choose your source port.
+1. Select **Another Company** and then enter **Cloudflare**.
+1. For **Rate Limit (speed)**, choose your rate limit.
+1. Select **Next**.
+1. Review the pricing information, and when you are done, click **Save Payment**.
+1. Cloudflare will accept the connection and your Account Team will get in touch with next steps for BGP session establishment
diff --git a/products/network-interconnect/src/content/partners/equinix-fabric.md b/products/network-interconnect/src/content/partners/equinix-fabric.md
new file mode 100644
index 00000000000..6e96c0636c1
--- /dev/null
+++ b/products/network-interconnect/src/content/partners/equinix-fabric.md
@@ -0,0 +1,22 @@
+---
+title: Equinix Fabric
+order: 2
+pcx-content-type: tutorial
+---
+
+# Equinix Users
+
+## Order an Equinix Fabric Connection
+
+After you confirm the locations and speed with you account team, order the Equinix Fabric connections to Cloudlfare.
+
+1. Navigate to <https://fabric.equinix.com/>
+1. Under **I want to connect to:**, choose **A Service Provider**.
+1. Under **Select a Service Provider**, search for **Cloudflare** and click **Select**.
+1. Choose **Magic Transit** or **Cloudflare NaaS**. If you're unsure, choose **Cloudflare NaaS** which can can be used to configure any service.
+1. Under **Origin** > **Connect Using**, choose your port.
+1. Under **Destination**, choose your location. If the location you want is not listed, contact your Cloudflare account team to request a new location under the Interconnect Anywhere program.
+1. Under **Connection Information** > **VLAN ID**, enter a VLAN ID. Cloudflare chooses its own VLAN ID and Equinix Fabric maps between the two. To use the same VLAN ID as Cloudflare, ask your account team for Cloudflare's VLAN ID and they will provide it.
+1. Click **Next** and then **Submit Order**.
+
+Cloudflare will accept the connection and your account team will contact you to establish the BGP session.
\ No newline at end of file
diff --git a/products/network-interconnect/src/content/partners/index.md b/products/network-interconnect/src/content/partners/index.md
new file mode 100644
index 00000000000..b79fdd76d3b
--- /dev/null
+++ b/products/network-interconnect/src/content/partners/index.md
@@ -0,0 +1,120 @@
+---
+title: Partners
+order: 4
+pcx-content-type: reference
+---
+
+# Partner Program
+
+## Virtual Private Interconnection
+
+Cloudflare partners with multiple network fabric providers to offer as many connectivity options and locations as possible. During the [configure the cross-connect](/set-up-cni/configure-cross-connect) step, you'll initiate a connection from your chosen provider's admin portal.
+
+<Aside type='note'>
+
+You can read more about the partner program on our website. See 
+ the [Cloudflare Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/).
+
+</Aside>
+
+* [Console Connect](/partners/console-connect)
+* [Equinix Fabric](/partners/equinix-fabric)
+* [Megaport](/partners/megaport)
+* [PacketFabric](/partners/packet-fabric)
+* CoreSite OCX (_coming soon_)
+* Epsilon Infiny (_coming soon_)
+* Zayo (_coming soon_)
+
+<Aside type='note'>
+
+If you can't find a Cloudflare port close to your infrastructure from your fabric provider's dashboard, contact interconnection@cloudflare.com to request a port closer to your location under the _Interconnect Anywhere_ program.
+
+</Aside>
+
+## Physical Interconnection
+
+Cloudflare collaborates with data center providers to streamline the physical network interconnect provisioning process in our physical locations. The locations below are available with our PNI partners.
+
+Metro | Data Center
+---------|----------
+| **Africa** |
+Cape Town | [Teraco Cape Town, South Africa](https://www.peeringdb.com/fac/1225)
+Johannesburg | [Teraco Johannesburg Campus, South Africa](https://www.peeringdb.com/fac/850)
+Durban | [Teraco Durban, South Africa](https://www.peeringdb.com/fac/1289)
+| **Asia** |
+Kwai Chung | [Equinix HK2 - Hong Kong](https://www.peeringdb.com/fac/1118)
+Osaka | [Equinix OS1 - Osaka](https://www.peeringdb.com/fac/1791)
+Singapore | [Equinix SG1 - Singapore](https://www.peeringdb.com/fac/282)
+Tokyo | [Equinix TY1 - Tokyo](https://www.peeringdb.com/fac/168)
+Tokyo | [Equinix TY2 - Tokyo](https://www.peeringdb.com/fac/452)
+| **Australia** |
+Sydney | [Equinix SY1/SY2 - Sydney](https://www.peeringdb.com/fac/131)
+| **Europe** |
+Brussels | [Interxion Brussels](https://www.peeringdb.com/fac/68)
+Düsseldorf | [Interxion Dusseldorf (DUS1, DUS2)](https://www.peeringdb.com/fac/106)
+Madrid | [Interxion Madrid (MAD1, MAD2)](https://www.peeringdb.com/fac/130)
+Marseille | [Interxion Marseille (MRS1, MRS2, MRS3)](https://www.peeringdb.com/fac/226)
+Vienna | [Interxion Vienna (VIE1, VIE2)](https://www.peeringdb.com/fac/67)
+Zagreb | [Interxion Zagreb (previously Altus IT) ZAG1](https://www.peeringdb.com/fac/1368)
+Koropi | [Lamda Hellix Athens Campus (Athens-1 & Athens-2)](https://www.peeringdb.com/fac/1949)
+Amsterdam | [Equinix AM1/AM2 - Amsterdam, Luttenbergweg](https://www.peeringdb.com/fac/375)
+Amsterdam | [Equinix AM5 - Amsterdam, Schepenbergweg](https://www.peeringdb.com/fac/1236)
+Barcelona | [Equinix BA1 - Barcelona](https://www.peeringdb.com/fac/122)
+Dublin | [Equinix DB2 - Dublin, Kilcarbery](https://www.peeringdb.com/fac/178)
+Frankfurt | [Equinix FR5 - Frankfurt, KleyerStrasse](https://www.peeringdb.com/fac/60)
+Geneva | [Equinix GV2 - Geneva, West](https://www.peeringdb.com/fac/826)
+Helsinki | [Equinix HE3 - Helsinki, Suvilahti](https://www.peeringdb.com/fac/1457)
+Istanbul | [Equinix IL2 - Istanbul](https://www.peeringdb.com/fac/4148)
+London | [Equinix LD8 - London, Docklands](https://www.peeringdb.com/fac/45)
+Lisbon | [Equinix LS1 - Lisbon](https://www.peeringdb.com/fac/126)
+Manchester | [Equinix MA1 - Manchester, Williams/Kilburn](https://www.peeringdb.com/fac/76)
+Munich | [Equinix MU1/MU3 - Munich](https://www.peeringdb.com/fac/480)
+Paris | [Equinix PA2 - Paris, Saint-Denis](https://www.peeringdb.com/fac/306)
+Stockholm | [Equinix SK1 - Stockholm, Bromma](https://www.peeringdb.com/fac/156)
+Warsaw | [Equinix WA1 - Warsaw, Centrum LIM](https://www.peeringdb.com/fac/509)
+Zurich | [Equinix ZH4 - Zurich](https://www.peeringdb.com/fac/833)
+| **North America** |
+Denver | [CoreSite - Denver (DE1)](https://www.peeringdb.com/fac/389)
+Los Angeles | [CoreSite - Los Angeles (LA1) One Wilshire](https://www.peeringdb.com/fac/19)
+Kansas City | [Netrality Kansas City - 1102 Grand](https://www.peeringdb.com/fac/435)
+St. Louis | [Netrality St. Louis - 210 N Tucker](https://www.peeringdb.com/fac/1978)
+Philadelphia | [Netrality Philadelphia - 401 N Broad](https://www.peeringdb.com/fac/2111)
+Southfield | [EdgeConneX Detroit (EDCDET01)](https://www.peeringdb.com/fac/1927)
+Katy | [EdgeConneX Houston (EDCHOU01)](https://www.peeringdb.com/fac/1910)
+Jacksonville | [EdgeConneX Jacksonville (EDCJAX01)](https://www.peeringdb.com/fac/2076)
+Las Vegas | [EdgeConneX Las Vegas (EDCLAS01)](https://www.peeringdb.com/fac/1918)
+Memphis | [EdgeConneX Memphis (EDCMEM01)](https://www.peeringdb.com/fac/1930)
+Eden Prairie | [EdgeConneX Minneapolis (EDCMSP01)](https://www.peeringdb.com/fac/2601)
+Nashville | [EdgeConneX Nashville (EDCNAS01)](https://www.peeringdb.com/fac/1924)
+Norfolk | [EdgeConneX Norfolk (EDCNOR01)](https://www.peeringdb.com/fac/1921)
+Tempe | [EdgeConneX Phoenix (EDCPHX01)](https://www.peeringdb.com/fac/1917)
+Pittsburgh | [EdgeConneX Pittsburgh (EDCPIT01)](https://www.peeringdb.com/fac/1925)
+Hillsboro | [EdgeConneX Portland (EDCPOR01)](https://www.peeringdb.com/fac/1922)
+Richmond | [EdgeConneX Richmond (EDCRIC01)](https://www.peeringdb.com/fac/2075)
+Rancho Cordova | [EdgeConneX Sacramento (EDCSAC01)](https://www.peeringdb.com/fac/1926)
+Salt Lake City | [EdgeConneX Salt Lake City (EDCSLC01)](https://www.peeringdb.com/fac/2077)
+San Diego | [EdgeConneX San Diego (EDCSDG01)](https://www.peeringdb.com/fac/1928)
+Talahassee | [EdgeConneX Tallahassee (EDCTAL01)](https://www.peeringdb.com/fac/2074)
+Atlanta | [Digital Realty ATL (56 Marietta)](https://www.peeringdb.com/fac/125)
+Charlotte | [Digital Realty CLT (113 N Myers St)](https://www.peeringdb.com/fac/4770)
+New York | [Digital Realty NYC (111 8th Ave)](https://www.peeringdb.com/fac/16)
+Miami | [DataBank Miami (MIA1)](https://www.peeringdb.com/fac/1718)
+Seattle | [Westin Building Seattle](https://www.peeringdb.com/fac/71)
+Atlanta | [Equinix AT2/AT3 - Atlanta](https://www.peeringdb.com/fac/11)
+Chicago | [Equinix CH1/CH2/CH4 - Chicago](https://www.peeringdb.com/fac/7)
+Dallas | [Equinix DA1 - Dallas](https://www.peeringdb.com/fac/4)
+Ashburn | [Equinix DC1-DC15 - Ashburn](https://www.peeringdb.com/fac/1)
+Los Angeles | [Equinix LA1 - Los Angeles](https://www.peeringdb.com/fac/8)
+Miami | [Equinix MI1 - Miami, NOTA](https://www.peeringdb.com/fac/15)
+Newark | [Equinix NY1 - New York, Newark](https://www.peeringdb.com/fac/9)
+Seattle | [Equinix SE2/SE3 - Seattle](https://www.peeringdb.com/fac/86)
+San Jose | [Equinix SV1/SV5/SV10 - Silicon Valley, San Jose](https://www.peeringdb.com/fac/6)
+Toronto | [Equinix TR1 - Toronto](https://www.peeringdb.com/fac/12)
+Buffalo | [365 Data Centers Buffalo (BU1)](https://www.peeringdb.com/fac/2087)
+Nashville | [365 Data Centers Nashville (NA1)](https://www.peeringdb.com/fac/561)
+Tampa | [365 Data Centers Tampa (TA1)](https://www.peeringdb.com/fac/2086)
+Indianapolis | [365 Data Centers Indianapolis (IN1)](https://www.peeringdb.com/fac/2018)
+| **South America** |
+Rio de Janeiro | [Equinix RJ2 - Rio de Janeiro](https://www.peeringdb.com/fac/1899)
+Barueri | [Equinix SP2 - São Paulo](https://www.peeringdb.com/fac/1283)
+Barueri | [Equinix SP4 - São Paulo](https://www.peeringdb.com/fac/165)
diff --git a/products/network-interconnect/src/content/partners/megaport.md b/products/network-interconnect/src/content/partners/megaport.md
new file mode 100644
index 00000000000..94f91b52967
--- /dev/null
+++ b/products/network-interconnect/src/content/partners/megaport.md
@@ -0,0 +1,31 @@
+---
+title: Megaport
+order: 3
+pcx-content-type: tutorial
+---
+
+# Megaport Users
+
+## Create a VXC with a service key
+
+Once the service key is created and shared, anybody with the key can create a connection.
+
+1. Log in to the [Megaport Portal](https://portal.megaport.com/).
+1. Find the Megaport you want to use for the connection and click **+Connection**.
+1. Under **Choose Destination Type**, click **Enter Service Key**.
+1. Under **Service Key** > **Megaport Service Key Id**, enter the service key.
+ Megaport validates the key and displays basic information about the key.
+1.  Click **Next**.
+1.  Specify these connection details:
+
+    -   **Name your connection** - The name of your VXC shown in the Megaport Portal.
+    -   **Invoice Reference** - Optional. This can be any text, such as a PO number or billing reference number.
+    -   **Rate Limit** - The speed of your connection in Mbps up to the maximum limit defined by the key.
+    -   **Preferred A-End VLAN** -- Optional. Specifies an unused VLAN ID for the connection. This must be a unique VLAN ID on the Megaport and can range from 2 to 4093. If you don't specify a value, Megaport assigns one.
+
+        (The B-End VLAN for the Cloudflare side termination automatically populates based on the service key.)
+
+1. Click **Next**. A summary page appears that includes the monthly cost.     
+1. Click **Back** to make changes or click **Add VXC** to move this configuration to your cart. Once you have finished this configuration, you can configure additional VXCs or proceed through the checkout process.
+
+Cloudflare will accept the connection and your account team will contact you to establish the BGP session.
diff --git a/products/network-interconnect/src/content/partners/packet-fabric.md b/products/network-interconnect/src/content/partners/packet-fabric.md
new file mode 100644
index 00000000000..651ff9a4342
--- /dev/null
+++ b/products/network-interconnect/src/content/partners/packet-fabric.md
@@ -0,0 +1,17 @@
+---
+title: PacketFabric
+order: 4
+pcx-content-type: tutorial
+---
+
+# PacketFabric Users
+
+1. From the PacketFabric dashboard, select **Marketplace**.
+1. In the Search bar, enter **Cloudflare**.
+1. Select **Cloudflare** as the provider.
+1. From **Choose a Location**, choose a location from the dropdown.
+1. Under **Select Source Port**, choose a port.
+1. Under **Select Virtual Circuit Speed**, choose a speed from the dropdown.
+1. Click **Place Order**.
+1. Click **Okay** in the Virtual Circuit Request Dispatched notice.
+1. Cloudflare will accept the connection and your account team will contact you to establish the BGP session.
\ No newline at end of file
diff --git a/products/network-interconnect/src/content/set-up-cni/configure-cross-connect.md b/products/network-interconnect/src/content/set-up-cni/configure-cross-connect.md
index 2cc0ea680a3..fd27f29943f 100644
--- a/products/network-interconnect/src/content/set-up-cni/configure-cross-connect.md
+++ b/products/network-interconnect/src/content/set-up-cni/configure-cross-connect.md
@@ -15,6 +15,12 @@ To configure the network cross-connect for physical links, Cloudflare generates
 * Order cross-connects at the locations the LOA specifies.
 * Verify when the cross-connects are complete.
 
+<Aside type='note'>
+
+To review physical interconnection locations, see [Partners](/partners#physical-interconnection).
+
+</Aside>
+
 ## Virtual Links
 
 To configure the network cross-connect for virtual links, you must create a request from the partner dashboard. Cloudflare will then review and accept the request.
@@ -27,26 +33,12 @@ For more information, see the [Cloudflare Network Interconnect Partner Program](
 
 </Aside>
 
-### Equinix Users
-
-Equinix uses a request-based model, which means Equinix users must make a request for a connection to Cloudflare, and Cloudflare will accept and provision the connection. In this scenario, VLAN is not necessary because every user has a specific VLAN that does not require mapping to Cloudflare's VLAN.
-
-1. Open your Equinix dashboard.
-1. Select Cloudflare as the service provider.
-1. Select your port, Cloudflare port, and port speed.
-1. Select your VLANID.
-1. Submit the connection for Cloudflare approval.
-
-![Equinix from Cloudflare's perspective](../static/equinix-cloudflare.png)
-
-The image above shows the Equinix network interconnect from Cloudflare's perspective.
-
-![Equinix from user perspective](../static/equinix-customer.png)
-
-The image above shows the Equinix network interconnect from a user's perspective.
-
-### Megaport Users
-
-Cloudflare provides you with a service key to provision the connection. The service key contains all of the necessary information to provision the connection, including the connection size, location, and VLAN.
+### Follow your partner's instructions below
 
-After you provide verification, Cloudflare assigns IP addresses to use with the cross-connect.
+* [Console Connect](/partners/console-connect)
+* [Equinix Fabric](/partners/equinix-fabric)
+* [Megaport](/partners/megaport)
+* [PacketFabric](/partners/packet-fabric)
+* CoreSite OCX (_coming soon_)
+* Epsilon Infiny (_coming soon_)
+* Zayo (_coming soon_)
diff --git a/products/network-interconnect/src/content/static/console-connect-connections.png b/products/network-interconnect/src/content/static/console-connect-connections.png
new file mode 100644
index 00000000000..b8cb3582c54
Binary files /dev/null and b/products/network-interconnect/src/content/static/console-connect-connections.png differ
diff --git a/products/network-interconnect/src/content/static/console-connect-port.png b/products/network-interconnect/src/content/static/console-connect-port.png
new file mode 100644
index 00000000000..7a317cc052d
Binary files /dev/null and b/products/network-interconnect/src/content/static/console-connect-port.png differ
diff --git a/products/network-interconnect/src/content/static/console-connect-pricing.png b/products/network-interconnect/src/content/static/console-connect-pricing.png
new file mode 100644
index 00000000000..71e04c54a3f
Binary files /dev/null and b/products/network-interconnect/src/content/static/console-connect-pricing.png differ
diff --git a/products/network-interconnect/src/content/static/console-connect-search.png b/products/network-interconnect/src/content/static/console-connect-search.png
new file mode 100644
index 00000000000..9880622ed70
Binary files /dev/null and b/products/network-interconnect/src/content/static/console-connect-search.png differ
diff --git a/products/network-interconnect/src/content/static/console-connect-speed.png b/products/network-interconnect/src/content/static/console-connect-speed.png
new file mode 100644
index 00000000000..4beebdcb668
Binary files /dev/null and b/products/network-interconnect/src/content/static/console-connect-speed.png differ
diff --git a/products/network-interconnect/src/content/static/equinix-cloudflare.png b/products/network-interconnect/src/content/static/equinix-cloudflare.png
deleted file mode 100644
index c4302b121e8..00000000000
Binary files a/products/network-interconnect/src/content/static/equinix-cloudflare.png and /dev/null differ
diff --git a/products/network-interconnect/src/content/static/equinix-connect.png b/products/network-interconnect/src/content/static/equinix-connect.png
new file mode 100644
index 00000000000..81eb6062442
Binary files /dev/null and b/products/network-interconnect/src/content/static/equinix-connect.png differ
diff --git a/products/network-interconnect/src/content/static/equinix-create.png b/products/network-interconnect/src/content/static/equinix-create.png
new file mode 100644
index 00000000000..83413a3e1a4
Binary files /dev/null and b/products/network-interconnect/src/content/static/equinix-create.png differ
diff --git a/products/network-interconnect/src/content/static/equinix-customer.png b/products/network-interconnect/src/content/static/equinix-customer.png
deleted file mode 100644
index 1205bcf8a7d..00000000000
Binary files a/products/network-interconnect/src/content/static/equinix-customer.png and /dev/null differ
diff --git a/products/network-interconnect/src/content/static/equinix-details.png b/products/network-interconnect/src/content/static/equinix-details.png
new file mode 100644
index 00000000000..137c6a15c2e
Binary files /dev/null and b/products/network-interconnect/src/content/static/equinix-details.png differ
diff --git a/products/network-interconnect/src/content/static/equinix-search.png b/products/network-interconnect/src/content/static/equinix-search.png
new file mode 100644
index 00000000000..0674a74b331
Binary files /dev/null and b/products/network-interconnect/src/content/static/equinix-search.png differ
diff --git a/products/network-interconnect/src/content/static/equinix-source-and-destination.png b/products/network-interconnect/src/content/static/equinix-source-and-destination.png
new file mode 100644
index 00000000000..13809569620
Binary files /dev/null and b/products/network-interconnect/src/content/static/equinix-source-and-destination.png differ
diff --git a/products/page-shield/docs-config.js b/products/page-shield/docs-config.js
index 8967afcef16..556f50c23bf 100644
--- a/products/page-shield/docs-config.js
+++ b/products/page-shield/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Provide client-side protection as part of your domain's firewall",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/page-shield",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
\ No newline at end of file
diff --git a/products/page-shield/src/content/script-monitor/get-started/index.md b/products/page-shield/src/content/script-monitor/get-started/index.md
index 4bb8e55fd2a..1811f24c3be 100644
--- a/products/page-shield/src/content/script-monitor/get-started/index.md
+++ b/products/page-shield/src/content/script-monitor/get-started/index.md
@@ -12,15 +12,7 @@ To enable Script Monitor:
 1. In your dashboard, go to **Firewall** > **Page Shield**.
 1. For **Script Monitor**, select **On**.
 
-## Monitor domain scripts
-
-Once you have activated Script Monitor, review the **Script Monitor dashboard** to see which scripts are running on your domain. Scripts on the dashboard appear in close to real time, so use the dashboard when proactively looking for scripts.
-
-If you see unexpected scripts on the dashboard, check them for signs of malicious activity.
-
-<Aside type="note" header="Note:">
-If you recently activated Script Monitor, you may see a delay in reporting.
-</Aside>
+For more guidance on using the Script Monitor dashboard, see [Monitor scripts](../use-dashboard)
 
 ## Configure alerts
 
diff --git a/products/page-shield/src/content/script-monitor/use-dashboard/index.md b/products/page-shield/src/content/script-monitor/use-dashboard/index.md
new file mode 100644
index 00000000000..b0241f223f5
--- /dev/null
+++ b/products/page-shield/src/content/script-monitor/use-dashboard/index.md
@@ -0,0 +1,25 @@
+---
+title: Monitor scripts
+order: 0
+pcx-content-type: how-to
+---
+
+# Monitor scripts on your site
+
+Once you have [activated Script Monitor](../get-started), review the **Script Monitor dashboard** to see which scripts are running on your domain. Scripts on the dashboard appear in close to real time, so use the dashboard when proactively looking for scripts.
+
+If you see unexpected scripts on the dashboard, check them for signs of malicious activity.
+
+## Use the Script Monitor dashboard
+
+To review scripts tracked by Script Monitor:
+1. In your dashboard, go to **Firewall** > **Page Shield**.
+1. Review your scripts.
+1. To filter scripts, use the following options:
+    - **Search**: Search for a specific URL
+    - **Host**: Look for scripts appearing on specific hostnames
+    - **Exclude**: Remove specific URLs from the results
+
+<Aside type="note" header="Note:">
+If you recently activated Script Monitor, you may see a delay in reporting.
+</Aside>
\ No newline at end of file
diff --git a/products/pages/docs-config.js b/products/pages/docs-config.js
index f43e6041dc0..50608f7f091 100644
--- a/products/pages/docs-config.js
+++ b/products/pages/docs-config.js
@@ -31,6 +31,6 @@ module.exports = {
     author: '@cloudflare',
     url: 'http://developers.cloudflare.com/pages',
     image:
-      'https://repository-images.githubusercontent.com/253644261/3c9cd080-e25c-11ea-9db6-57a083cfdb49',
+      'https://www.cloudflare.com/img/cf-twitter-card.png',
   },
 }
diff --git a/products/pages/src/content/framework-guides/astro.md b/products/pages/src/content/framework-guides/astro.md
new file mode 100644
index 00000000000..8d631ac237e
--- /dev/null
+++ b/products/pages/src/content/framework-guides/astro.md
@@ -0,0 +1,90 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy an Astro site
+
+[Astro](https://astro.build) is a new static-site generator that allows you to build faster, SEO-friendly websites that use less client-side JavaScript code. By default, Astro builds websites that have zero JavaScript runtime code.
+
+In this guide, you will create a new Astro application and deploy it using Cloudflare Pages.
+
+<Aside type="warning">
+
+**Note:** At the time of publication, Astro is in early beta. Refer to the Astro [GitHub repository](https://github.com/snowpackjs/astro) to stay current with the project's status.
+
+</Aside>
+
+## Setting up a new project
+
+Create a new project directory (e.g., `astro-site`) and then initiate Astro's official setup tool by running [`npm init`](https://docs.npmjs.com/cli/v6/commands/npm-init) in your terminal inside that new `astro-site` directory:
+
+```sh
+$ mkdir astro-site && cd astro-site
+$ npm init astro
+```
+
+During `init`, Astro will ask you which project type you would like to set up. Your answers will not affect the rest of this tutorial. Select an answer ideal for your project.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+# Setup the local repository
+$ git init
+$ git remote add origin https://github.com/<username>/<repo>
+$ git branch -M main
+
+# Commit all initial files
+$ git add -A
+$ git commit -m "initial commit"
+
+# Send commit to new GitHub repo
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option  | Value              |
+| --------------------- | ------------------ |
+| Production branch     | `main`             |
+| Build command         | `npm run build`    |
+| Build directory       | `dist`             |
+| Environment Variables | `NODE_VERSION: 14` |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+<Aside type="warning">
+
+**Important:** Astro requires Node.js v14.x or later to build successfully. You must expand the **Environment Variables (advanced)** section and add a `NODE_VERSION` variable with a value of `14` or greater.
+
+</Aside>
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Astro site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-blazor-site.md b/products/pages/src/content/framework-guides/deploy-a-blazor-site.md
new file mode 100644
index 00000000000..3e310178c11
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-blazor-site.md
@@ -0,0 +1,74 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Blazor Site  
+  
+[Blazor](https://blazor.net) is an SPA framework that can use C# code, rather than JavaScript in the browser. In this guide, you will build a site using Blazor, and deploy it using Cloudflare Pages.  
+
+## Install .NET
+
+Blazor uses C#, so you will need to [install the .NET SDK](https://dotnet.microsoft.com/download) by grabbing the newest installation from the [.NET downloads page](https://dotnet.microsoft.com/download) and download and running the installer.  
+
+## Creating a new Blazor WASM project  
+
+There are two types of Blazor projects: Blazor Server applications, which run on the server, and Blazor WASM (WebAssembly), which run in the browser. Since Blazor Server is not static, this guide will use Blazor WASM. Create a new Blazor WASM application by running the following command in your terminal:
+
+```sh
+$ dotnet new blazorwasm my-blazor-project
+```
+## Creating the build script
+
+To deploy, Cloudflare Pages will need a way to build the Blazor project. In the project's directory root, create a `build.sh` file. Populate the file with this:
+
+```
+#!/bin/sh
+curl -sSL https://dot.net/v1/dotnet-install.sh > dotnet-install.sh
+chmod +x dotnet-install.sh
+./dotnet-install.sh -c 5.0 -InstallDir ./dotnet5
+./dotnet5/dotnet --version
+./dotnet5/dotnet publish -c Release -o output
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+$ dotnet new gitignore
+$ git init
+$ git add -A
+$ git commit -m "Initial commit"
+$ git remote add origin https://github.com/yourgithubusername/githubrepo.git
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** dashboard and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value            |
+| -------------------- | ---------------- |
+| Production branch    | `main`           |
+| Build command        | `./build.sh`     |
+| Build directory      | `output/wwwroot` |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `dotnet`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your Blazor site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Blazor site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-gatsby-site.md b/products/pages/src/content/framework-guides/deploy-a-gatsby-site.md
new file mode 100644
index 00000000000..bf521c571dd
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-gatsby-site.md
@@ -0,0 +1,62 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Gatsby site
+
+Gatsby is an open-source React framework for creating websites and apps. In this guide, you will create a new Gatsby application and deploy it using Cloudflare Pages. You will be using the `gatsby` CLI to create a new Gatsby site.
+
+## Installing Gatsby
+
+Install the `gatsby` CLI by running the following command in your terminal:
+
+```sh
+$ npm install -g gatsby-cli
+```
+
+## Creating a new project
+
+With Gatsby installed, you can create a new project using `gatsby new`. The `new` command accepts a GitHub URL for using an existing template. As an example, use the `gatsby-starter-lumen` template by running the following command in your terminal. You can find more in [Gatsby's Starters section](https://www.gatsbyjs.com/starters/?v=2):
+
+```sh
+$ gatsby new my-gatsby-site https://github.com/alxshelepenok/gatsby-starter-lumen
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following command in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value          |
+| -------------------- | -------------- |
+| Production branch    | `main`         |
+| Build command        | `gatsby build` |
+| Build directory      | `public`       |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `gatsby`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your Gatsby site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Gatsby site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-hugo-site.md b/products/pages/src/content/framework-guides/deploy-a-hugo-site.md
new file mode 100644
index 00000000000..81f4c06bad2
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-hugo-site.md
@@ -0,0 +1,194 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Hugo site
+
+Hugo is a tool for generating static sites, written in Go. It is incredibly fast and has great high-level, flexible primitives for managing your content using Markdown and JSON.
+
+In this guide, you will create a new Hugo application and deploy it using Cloudflare Pages. You will use the `hugo` CLI to create a new Hugo site.
+
+## Installing Hugo
+
+First, install the Hugo CLI, using the specific instructions for your operating system below:
+
+### Linux
+
+Your Linux distro's package manager may include Hugo. If this is the case, install it directly using your distro's package manager -- for instance, in Ubuntu, run the following command:
+
+```sh
+$ sudo apt-get install hugo
+```
+
+If your package manager does not include Hugo or you would like to download a release directly, refer to the [**Manual**](/framework-guides/deploy-a-hugo-site#manual-installation) section.
+
+### Homebrew (macOS)
+
+If you use the package manager [Homebrew](https://brew.sh), run the `brew install` command in your terminal to install Hugo:
+
+```sh
+$ brew install hugo
+```
+
+### Windows (Chocolatey)
+
+If you use the package manager [Chocolatey](https://chocolatey.org/), run the `choco install` command in your terminal to install Hugo:
+
+```sh
+$ choco install hugo --confirm
+```
+
+### Manual installation
+
+The Hugo GitHub repository contains pre-built versions of the Hugo command-line tool for various operating systems, which can be found on [the Releases page](https://github.com/gohugoio/hugo/releases).
+
+For more instruction on installing these releases, refer to [Hugo's install guide](https://gohugo.io/getting-started/installing/).
+
+## Creating a new project
+
+With Hugo installed, create a new project by running the `hugo new` command in your terminal:
+
+```sh
+$ hugo new site my-hugo-site
+```
+
+Hugo sites use themes to customize the look and feel of the statically built HTML site. There are a number of themes available at [themes.gohugo.io](https://themes.gohugo.io) -- for now, use the [Terminal theme](https://themes.gohugo.io/hugo-theme-terminal/) by running the following commands in your terminal:
+
+```sh
+$ cd my-hugo-site
+$ git init
+$ git submodule add https://github.com/panr/hugo-theme-terminal.git themes/terminal
+$ git submodule update --init --recursive
+```
+
+You should also copy the default configuration provided by the theme into the `config.toml` file in your project's directory. Take the following information and customize it per your site's needs:
+
+```toml
+baseurl = "/"
+languageCode = "en-us"
+theme = "terminal"
+paginate = 5
+
+[params]
+  # dir name of your main content (default is `content/posts`).
+  # the list of set content will show up on your index page (baseurl).
+  contentTypeName = "posts"
+
+  # ["orange", "blue", "red", "green", "pink"]
+  themeColor = "orange"
+
+  # if you set this to 0, only submenu trigger will be visible
+  showMenuItems = 2
+
+  # show selector to switch language
+  showLanguageSelector = false
+
+  # set theme to full screen width
+  fullWidthTheme = false
+
+  # center theme with default width
+  centerTheme = false
+
+  # set a custom favicon (default is a `themeColor` square)
+  # favicon = "favicon.ico"
+
+  # set post to show the last updated
+  # If you use git, you can set `enableGitInfo` to `true` and then post will automatically get the last updated
+  showLastUpdated = false
+  # Provide a string as a prefix for the last update date. By default, it looks like this: 2020-xx-xx [Updated: 2020-xx-xx] :: Author
+  # updatedDatePrefix = "Updated"
+
+  # set all headings to their default size (depending on browser settings)
+  # it's set to `true` by default
+  # oneHeadingSize = false
+
+[params.twitter]
+  # set Twitter handles for Twitter cards
+  # see https://developer.twitter.com/en/docs/tweets/optimize-with-cards/guides/getting-started#card-and-content-attribution
+  # do not include @
+  creator = ""
+  site = ""
+
+[languages]
+  [languages.en]
+    languageName = "English"
+    title = "Terminal"
+    subtitle = "A simple, retro theme for Hugo"
+    owner = ""
+    keywords = ""
+    copyright = ""
+    menuMore = "Show more"
+    readMore = "Read more"
+    readOtherPosts = "Read other posts"
+    missingContentMessage = "Page not found..."
+    missingBackButtonLabel = "Back to home page"
+
+    [languages.en.params.logo]
+      logoText = "Terminal"
+      logoHomeLink = "/"
+
+    [languages.en.menu]
+      [[languages.en.menu.main]]
+        identifier = "about"
+        name = "About"
+        url = "/about"
+      [[languages.en.menu.main]]
+        identifier = "showcase"
+        name = "Showcase"
+        url = "/showcase"
+```
+
+## Creating a post
+
+Create a new post to give your Hugo site some initial content. Run the `hugo new` command in your terminal to generate a new post:
+
+```sh
+$ hugo new posts/hello-world.md
+```
+
+Inside of `hello-world.md`, add some initial content to create your post. Remove the `draft` line in your post's frontmatter when you are ready to publish the post. Any posts with `draft: true` set will be skipped by Hugo's build process.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value    |
+| -------------------- | -------- |
+| Production branch    | `main`   |
+| Build command        | `hugo`   |
+| Build directory      | `public` |
+
+</TableLayout>
+
+After completing configuration, click the **Save and Deploy** button. You should see Cloudflare Pages installing `hugo` and your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your Hugo site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Using a specific Hugo version
+
+You can set the environment variable `HUGO_VERSION` under Settings to use a specific version of Hugo.
+
+For example, `HUGO_VERSION`: `0.81.0`
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Hugo site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-jekyll-site.md b/products/pages/src/content/framework-guides/deploy-a-jekyll-site.md
new file mode 100644
index 00000000000..cd2bbf4e0c6
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-jekyll-site.md
@@ -0,0 +1,95 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Jekyll site
+
+Jekyll is an open-source framework for creating websites, based around Markdown with Liquid templates. In this guide, you will create a new Jekyll application and deploy it using Cloudflare Pages. You use the `jekyll` CLI to create a new Jekyll site.
+
+<Aside type="note">
+
+If you have an existing Jekyll site on GitHub Pages, refer to [the Jekyll migration guide](/migrations/migrating-jekyll-from-github-pages).
+
+</Aside>
+
+## Installing Jekyll
+
+Jekyll is written in Ruby, meaning that you will need a functioning Ruby installation, like `rbenv`, to install Jekyll.
+
+To install Ruby on your computer, follow the [`rbenv` installation instructions](https://github.com/rbenv/rbenv#installation) and select a recent version of Ruby by running the `rbenv` command in your terminal:
+
+```sh
+$ rbenv install 2.7.2
+```
+
+With Ruby installed, you can install the `jekyll` Ruby gem:
+
+```sh
+$ gem install jekyll
+```
+
+## Creating a new project
+
+With Jekyll installed, you can create a new project running the `jekyll new` in your terminal:
+
+```sh
+$ jekyll new my-jekyll-site
+```
+
+Create a base `index.html` in your newly created folder to give your site content:
+
+```html
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Hello from Cloudflare Pages</title>
+  </head>
+  <body>
+    <h1>Hello from Cloudflare Pages</h1>
+  </body>
+</html>
+```
+
+Optionally, you may use a theme with your new Jekyll site if you would like to start with great styling defaults. For example, the [`minimal-mistakes`](https://github.com/mmistakes/minimal-mistakes) theme has a ["Starting from `jekyll new`"](https://mmistakes.github.io/minimal-mistakes/docs/quick-start-guide/#starting-from-jekyll-new) section to help you add the theme to your new site.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+If you are migrating an existing Jekyll project to Pages, confirm that your `Gemfile` is committed as part of your codebase. Pages will look at your Gemfile and run `bundle install` to install the required dependencies for your project, including the `jekyll` gem.
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value          |
+| -------------------- | -------------- |
+| Production branch    | `main`         |
+| Build command        | `jekyll build` |
+| Build directory      | `_site`        |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deployment. You should see Cloudflare Pages installing `jekyll`, your project dependencies, and building your site before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to [the Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your Jekyll site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Jekyll site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-nextjs-site.md b/products/pages/src/content/framework-guides/deploy-a-nextjs-site.md
new file mode 100644
index 00000000000..e5385573f97
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-nextjs-site.md
@@ -0,0 +1,58 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Next.js site
+
+Next.js is an open-source React framework for creating websites and apps. In this guide, you will create a new Next.js application and deploy it using Cloudflare Pages.
+
+## Creating a new project
+
+Create a new project using `npx` or `yarn` by running either of the following commands in your terminal:
+
+```sh
+$ npx create-next-app --example with-static-export my-app
+# or
+$ yarn create next-app --example with-static-export my-app
+```
+
+After creating your project, a new `my-app` directory will be generated using the official [`with-static-export`](https://github.com/vercel/next.js/tree/canary/examples/with-static-export) example as a template.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value           |
+| -------------------- | ----------------|
+| Production branch    | `main`           |
+| Build command        | `npm run export` |
+| Build directory      | `out`            |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `next`, your project dependencies, and building your site before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`.
+Every time you commit new code to your Next.js site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Next.js site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-preact-site.md b/products/pages/src/content/framework-guides/deploy-a-preact-site.md
new file mode 100644
index 00000000000..f87fa35c0b7
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-preact-site.md
@@ -0,0 +1,83 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Preact site
+
+[Preact](https://preactjs.com) is a popular, open-source framework for building modern web applications. Preact can also be used as a lightweight alternative to React because the two share the same API and component model.
+
+In this guide, you will create a new Preact application and deploy it using Cloudflare Pages.
+You will use [`wmr`](https://github.com/preactjs/wmr), an all-in-one development tool built by the Preact team, to quickly generate an optimized web application.
+
+## Setting up a new project
+
+Create a new project by running the [`npm init`](https://docs.npmjs.com/cli/v6/commands/npm-init) command in your terminal, giving it a title:
+
+```sh
+$ npm init wmr your-project-name
+$ cd your-project-name
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+# Setup the local repository
+$ git init
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+
+# Commit all initial files
+$ git add -A
+$ git commit -m "initial commit"
+
+# Send commit to new GitHub repo
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value           |
+| -------------------- | --------------- |
+| Production branch    | `main`          |
+| Build command        | `npm run build` |
+| Build directory      | `dist`          |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
+
+<Aside type="note">
+
+**Note:** You will notice that within the `package.json` file, the `"build"` script uses the `--prerender` flag. With this, `wmr` produces static HTML pages – along with their assets – which is perfect for Pages.
+
+</Aside>
+
+After you have deployed your site, you will receive a unique subdomain for your project on `*.pages.dev`.
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Preact site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-react-application.md b/products/pages/src/content/framework-guides/deploy-a-react-application.md
new file mode 100644
index 00000000000..b47eb0f259c
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-react-application.md
@@ -0,0 +1,56 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a React application
+
+React is a popular framework for building reactive and powerful front-end applications, built by the open-source team at Facebook.
+
+In this guide, you will create a new React application and deploy it using Cloudflare Pages. You will use `create-react-app`, a batteries-included tool for generating new React applications.
+
+## Setting up a new project
+
+Create a new project using `npx`, giving it the title `my-react-app` in your terminal.
+
+```sh
+$ npx create-react-app my-react-app
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set u**p builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value           |
+| -------------------- | --------------- |
+| Production branch    | `main`          |
+| Build command        | `npm run build` |
+| Build directory      | `build`         |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `create-react-app`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your React application, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your React site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-sphinx-site.md b/products/pages/src/content/framework-guides/deploy-a-sphinx-site.md
new file mode 100644
index 00000000000..7d66b7b27c4
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-sphinx-site.md
@@ -0,0 +1,251 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Sphinx site
+
+[Sphinx](https://www.sphinx-doc.org/) is a tool that makes it easy to create documentation and was originally made for the publication of Python documentation. It is well known for its simplicity and ease of use.
+
+In this guide, you will create a new Sphinx project and deploy it using Cloudflare Pages.
+
+## Prerequisites
+
+  * Python 3 - Sphinx is based on Python, therefore you must have Python installed
+
+  * [pip](https://pypi.org/project/pip/) - The PyPA recommended tool for installing Python packages
+
+  * [pipenv](https://pipenv.pypa.io/en/latest/) - automatically creates and manages a virtualenv for your projects
+
+<Aside type="note">
+
+If you are already running a version of Python 3.7, ensure that Python version 3.7 is also installed on your computer before you begin this guide. Python 3.7 is the latest version supported by Cloudflare Pages.
+ 
+</Aside>
+
+
+The latest version of Python 3.7 is 3.7.11:
+
+[Python 3.7.11](https://www.python.org/downloads/release/python-3711/)
+
+### Installing Python
+
+Refer to the official Python documentation for installation guidance:
+
+- [Windows](https://www.python.org/downloads/windows/)
+- [Linux/UNIX](https://www.python.org/downloads/source/)
+- [Mac OS X](https://www.python.org/downloads/mac-osx/)
+- [Other](https://www.python.org/download/other/)
+
+### Installing Pipenv
+
+If you already had an earlier version of Python installed before installing version 3.7, other global packages you may have installed could interfere with the following steps to install Pipenv, or your other Python projects which depend on global packages.
+
+[Pipenv](https://pipenv.pypa.io/en/latest/) is a Python-based package manager that makes managing virtual environments simple. This guide will not require you to have prior experience with or knowledge of Pipenv to complete your Sphinx site deployment. Cloudflare Pages natively supports the use of Pipenv and, by default, has the latest version installed.
+
+The quickest way to install Pipenv is by running the command:
+
+```shell
+$ pip install --user pipenv
+```
+
+This command will install Pipenv to your user level directory and will make it accessible via your terminal. You can confirm this by running the following command and reviewing the expected output:
+
+```shell
+$ pipenv --version
+pipenv, version 2021.5.29
+```
+
+### Creating a Sphinx project directory
+
+From your terminal, run the following commands to create a new directory and navigate to it:
+
+```shell
+$ mkdir my-wonderful-new-sphinx-project
+$ cd my-wonderful-new-sphinx-project
+```
+### Pipenv with Python 3.7
+
+Pipenv allows you to specify which version of Python to associate with a virtual environment. For the purpose of this guide, the virtual environment for your Sphinx project must use Python 3.7.
+
+Use the following command:
+
+```shell
+~my-wonderful-new-sphinx-project$ pipenv --python 3.7
+```
+You should see the following output:
+
+```shell
+Creating a virtualenv for this project...
+Pipfile: /home/ubuntu/my-wonderful-new-sphinx-project/Pipfile
+Using /usr/bin/python3.7m (3.7.11) to create virtualenv...
+⠸ Creating virtual environment...created virtual environment CPython3.7.11.final.0-64 in 1598ms
+  creator CPython3Posix(dest=/home/ubuntu/.local/share/virtualenvs/my-wonderful-new-sphinx-project-Y2HfWoOr, clear=False, no_vcs_ignore=False, global=False)
+  seeder FromAppData(download=False, pip=bundle, setuptools=bundle, wheel=bundle, via=copy, app_data_dir=/home/ubuntu/.local/share/virtualenv)
+    added seed packages: pip==21.1.3, setuptools==57.1.0, wheel==0.36.2
+  activators BashActivator,CShellActivator,FishActivator,PowerShellActivator,PythonActivator,XonshActivator
+
+✔ Successfully created virtual environment! 
+Virtualenv location: /home/ubuntu/.local/share/virtualenvs/my-wonderful-new-sphinx-project-Y2HfWoOr
+Creating a Pipfile for this project...
+```
+
+List the contents of the directory:
+
+```shell
+~my-wonderful-new-sphinx-project$ ls
+Pipfile
+```
+
+
+
+### Installing Sphinx
+
+Before installing Sphinx, create the directory you want your project to live in.
+
+From your terminal, run the following command to install Sphinx:
+
+```shell
+~/my-wonderful-new-sphinx-project$ pipenv install sphinx
+```
+
+You should see output similar to the following:
+
+```shell
+Installing sphinx...
+Adding sphinx to Pipfile's [packages]...
+✔ Installation Succeeded 
+Pipfile.lock not found, creating...
+Locking [dev-packages] dependencies...
+Locking [packages] dependencies...
+Building requirements...
+Resolving dependencies...
+✔ Success! 
+Updated Pipfile.lock (763aa3)!
+Installing dependencies from Pipfile.lock (763aa3)...
+  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 0/0 — 00:00:00
+To activate this project's virtualenv, run pipenv shell.
+Alternatively, run a command inside the virtualenv with pipenv run.
+```
+
+This will install Sphinx into a new virtual environment managed by Pipenv. You should see a directory structure like this:
+
+```shell
+my-wonderful-new-sphinx-project
+|--Pipfile
+|--Pipfile.lock
+```
+
+## Creating a new project
+
+With Sphinx installed, you can now run the quickstart command to create a template project for you. This command will only work within the Pipenv environment you created in the previous step. To enter that environment, run the following command from your terminal:
+
+```shell
+~/my-wonderful-new-sphinx-project$ pipenv shell
+Launching subshell in virtual environment...
+ubuntu@sphinx-demo:~/my-wonderful-new-sphinx-project$  . /home/ubuntu/.local/share/virtualenvs/my-wonderful-new-sphinx-project-Y2HfWoOr/bin/activate
+```
+
+Now run the following command:
+
+```shell
+(my-wonderful-new-sphinx-project) user@hostname:~/my-wonderful-new-sphinx-project$ sphinx-quickstart
+```
+
+You will be presented with a number of questions, please answer them in the following:
+
+```shell
+$ Separate source and build directories (y/n) [n]: Y
+$ Project name: <Your project name>
+$ Author name(s): <You Author Name>
+$ Project release []: <You can accept default here or provide a version>
+$ Project language [en]: <You can accept en here or provide a regional language code>
+```
+
+This will create four new files in your active directory, `source/conf.py`, `index.rst`, `Makefile` and `make.bat`:
+
+```shell
+my-wonderful-new-sphinx-project
+|--Pipfile
+|--Pipfile.lock
+|--source
+|----_static
+|----_templates
+|----conf.py
+|----index.rst
+|--Makefile
+|--make.bat
+```
+
+You now have everything you need to start deploying your site to Cloudflare Pages. For learning how to create documentation with Sphinx, refer to the official [Sphinx documentation](https://www.sphinx-doc.org/en/master/usage/quickstart.html).
+
+## Creating a GitHub repository
+
+In a separate terminal window that is not within the pipenv shell session, verify that SSH key-based authentication is working:
+
+```shell
+$ eval "$(ssh-agent)"
+$ ssh-add -T ~/.ssh/id_rsa.pub
+$ ssh -T git@github.com
+
+The authenticity of host 'github.com (140.82.113.4)' can't be established.
+RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
+Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
+Warning: Permanently added 'github.com,140.82.113.4' (RSA) to the list of known hosts.
+Hi yourgithubusername! You've successfully authenticated, but GitHub does not provide shell access.
+```
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```shell
+$ git init
+$ git config user.name "Your Name"
+$ git config user.email "username@domain.com"
+$ git remote add origin git@github.com:yourgithubusername/githubrepo.git
+$ git add .
+$ git commit -m "Initial commit"
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value          |
+| -------------------- | -------------- |
+| Production branch    | `main`         |
+| Build command        | `make html`    |
+| Build directory      | `build/html`   |
+
+</TableLayout>
+
+Below the configuration, make sure to set the environment variable for specifying the `PYTHON_VERSION`.
+
+For example:
+
+<TableLayout>
+
+| Variable name         | Value          |
+| --------------------  | -------------- |
+| PYTHON_VERSION        | 3.7            |
+
+</TableLayout>
+
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `Pipenv`, your project dependencies, and building your site, before deployment.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Sphinx site, Cloudflare Pages will automatically rebuild your project and deploy it.
+
+You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Sphinx site on Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-svelte-site.md b/products/pages/src/content/framework-guides/deploy-a-svelte-site.md
new file mode 100644
index 00000000000..3ab996a2f9c
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-svelte-site.md
@@ -0,0 +1,127 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Svelte site
+
+[Svelte](https://svelte.dev) is an increasingly popular, open-source framework for building user interfaces and web applications. Unlike most frameworks, Svelte is primarily a compiler that converts your component code into efficient JavaScript that surgically updates the DOM when your application state changes.
+
+In this guide, you will create a new Svelte application and deploy it using Cloudflare Pages.
+You will use [`SvelteKit`](https://kit.svelte.dev/), the official Svelte framework for building web applications of all sizes.
+
+<Aside type="warning">
+
+**Note:** At this guide's time of publication, SvelteKit is still in beta. However, the Svelte team is confident that the steps below are stable. This guide will be updated as needed, both during and after the beta phase.
+
+</Aside>
+
+## Setting up a new project
+
+Create a new project by running the [`npm init`](https://docs.npmjs.com/cli/v6/commands/npm-init) command in your terminal, giving it a title:
+
+```sh
+$ npm init svelte@next my-svelte-app
+$ cd my-svelte-app
+```
+
+During `init`, SvelteKit will prompt you for customization choices. Your answers will not affect the rest of this tutorial. Choose the option that is ideal for your project.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+# Setup the local repository
+$ git init
+$ git remote add origin https://github.com/<username>/<repo>
+$ git branch -M main
+
+# Commit all initial files
+$ git add -A
+$ git commit -m "initial commit"
+
+# Send commit to new GitHub repo
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option  | Value              |
+| --------------------- | ------------------ |
+| Production branch     | `main`             |
+| Build command         | `npm run build`    |
+| Build directory       | `build`            |
+| Environment Variables | `NODE_VERSION: 14` |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+<Aside type="warning">
+
+**Important:** SvelteKit requires Node.js v14.x or later to build successfully. You must expand the **Environment Variables (advanced)** section and add a `NODE_VERSION` variable with a value of `14` or greater.
+
+</Aside>
+
+### SvelteKit Configuration
+
+By default, SvelteKit prepares our project with the assumption that it will deployed to a Node.js server. This is not appropriate for this tutorial, but luckily SvelteKit is flexible and has a ready-made "adapter" for your needs. A few, easy changes have to be made.
+
+First, remove the [`@sveltejs/adapter-node`](https://www.npmjs.com/package/@sveltejs/adapter-node) dependency and install the [`@sveltejs/adapter-static`](https://www.npmjs.com/package/@sveltejs/adapter-static) package instead:
+
+```sh
+$ npm uninstall @sveltejs/adapter-node
+$ npm install @sveltejs/adapter-static@next --save-dev
+```
+
+Then, in the `svelte.config.cjs` file, update the adapter selection:
+
+```diff
+const sveltePreprocess = require('svelte-preprocess');
+--const node = require('@sveltejs/adapter-node');
+const pkg = require('./package.json');
+
+module.exports = {
+  // ... truncated ...
+	kit: {
+--		adapter: node(),
+++		adapter: require('@sveltejs/adapter-static')(),
+		// ... truncated ...
+	}
+};
+```
+
+<Aside type="note">
+
+**Important:** Remember to commit and push these changes to your GitHub repository.
+
+</Aside>
+
+### Finalize Setup
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Svelte site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-vue-application.md b/products/pages/src/content/framework-guides/deploy-a-vue-application.md
new file mode 100644
index 00000000000..d703fc872e4
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-vue-application.md
@@ -0,0 +1,57 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Vue application
+
+Vue is a progressive JavaScript framework for building user interfaces. A core principle of Vue is incremental adoption: this makes it easy to build Vue applications that live side-by-side with your existing code.
+
+In this guide, you will create a new Vue application and deploy it using Cloudflare Pages. You will use `vue-cli`, a batteries-included tool for generating new Vue applications.
+
+## Setting up a new project
+
+First, install the Vue CLI using NPM, and then run `vue create` in your terminal to create a new project called `my-vue-app`:
+
+```sh
+$ npm install -g @vue/cli
+$ vue create my-vue-app
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** dashboard and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value           |
+| -------------------- | --------------- |
+| Production branch    | `main`          |
+| Build command        | `npm run build` |
+| Build directory      | `dist`          |
+
+</TableLayout>
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `vue`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+Every time you commit new code to your Vue application, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Vue site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-a-zola-site.md b/products/pages/src/content/framework-guides/deploy-a-zola-site.md
new file mode 100644
index 00000000000..b484f588298
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-a-zola-site.md
@@ -0,0 +1,119 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy a Zola site
+
+[Zola](https://www.getzola.org/) is a fast static site generator in a single binary with everything built-in. In this guide, you'll create a new Zola application and deploy it using Cloudflare Pages. You will use the `zola` CLI to create a new Zola site.
+
+## Installing Zola
+
+First, [install](https://www.getzola.org/documentation/getting-started/installation/) the `zola` CLI, using the specific instructions for your operating system below:
+
+### macOS (Homebrew)
+
+If you use the package manager [Homebrew](https://brew.sh), run the `brew install` command in your terminal to install Zola:
+
+```sh
+$ brew install zola
+```
+
+### Windows (Chocolatey)
+
+If you use the package manager [Chocolatey](https://chocolatey.org/), run the `choco install` command in your terminal to install Zola:
+
+```sh
+$ choco install zola
+```
+
+### Windows (Scoop)
+
+If you use the package manager [Scoop](https://scoop.sh/), run the `scoop install` command in your terminal to install Zola:
+
+```sh
+$ scoop install zola
+```
+
+### Linux (pkg)
+
+Your Linux distro's package manager may include Zola. If this is the case, you can install it directly using your distro's package manager -- for example, using `pkg`, run the following command in your terminal:
+
+```sh
+$ pkg install zola
+```
+
+If your package manager does not include Zola or you would like to download a release directly, refer to the [**Manual**](/framework-guides/deploy-a-zola-site#manual-installation) section below.
+
+### Manual installation
+
+The Zola GitHub repository contains pre-built versions of the Zola command-line tool for various operating systems, which can be found on [the Releases page](https://github.com/getzola/zola/releases).
+
+For more instruction on installing these releases, refer to [Zola's install guide](https://www.getzola.org/documentation/getting-started/installation/).
+
+## Creating a new project
+
+With Zola installed, create a new project by running the `zola init` command in your terminal using the default template:
+
+```sh
+$ zola init my-zola-project
+```
+
+Upon running `zola init`, you will prompted with  three questions: 
+1. What is the URL of your site? (https://example.com): 
+You can leave this one blank for now.
+
+2. Do you want to enable Sass compilation? [Y/n]: Y
+3. Do you want to enable syntax highlighting? [y/N]: y
+4. Do you want to build a search index of the content? [y/N]: y
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value          |
+| -------------------- | -------------- |
+| Production branch    | `main`         |
+| Build command        | `zola build` |
+| Build directory      | `public`       |
+
+</TableLayout>
+
+Below the configuration, make sure to set the **Environment Variables (advanced)** for specifying the `ZOLA_VERSION`. 
+
+For example, `ZOLA_VERSION`: `0.13.0`.
+
+After configuring your site, you can begin your first deploy. You should see Cloudflare Pages installing `zola`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+
+You can now add that subdomain as the `base_url` in your  `config.toml` file. 
+
+For example: 
+``` yaml
+# The URL the site will be built for
+base_url = "https://my-zola-project.pages.dev"
+```
+
+Every time you commit new code to your Zola site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Zola site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-an-angular-application.md b/products/pages/src/content/framework-guides/deploy-an-angular-application.md
new file mode 100644
index 00000000000..67bc4848331
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-an-angular-application.md
@@ -0,0 +1,124 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy an Angular application
+
+Angular is an incredibly popular framework for building reactive and powerful front-end applications.
+
+In this guide, you will create a new Angular application and deploy it using Cloudflare Pages. You will use the Angular CLI, a batteries-included tool for generating new Angular applications.
+
+## Setting up a new project
+
+If you already have [Angular CLI](https://angular.io/cli) installed globally, invoke the `ng` executable directly:
+
+```sh
+# Create the project
+$ ng new my-angular-app
+# Enter the new directory
+$ cd my-angular-app
+```
+
+Alternatively, you can use [`npx`](https://www.npmjs.com/package/npx), which is included with all modern `npm` versions, to avoid the global installation:
+
+<Aside>
+
+**Note:** All modern versions of `npm` already include the `npx` executable. You do not need to install anything for this approach.
+
+</Aside>
+
+```sh
+# Create the project
+$ npx @angular/cli new my-angular-app
+# Enter the new directory
+$ cd my-angular-app
+```
+
+With both approaches, the Angular CLI will prompt you for customization choices. Your answers will not affect the rest of this tutorial. Choose the option that is ideal for your project.
+
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value                            |
+| -------------------- | -------------------------------- |
+| Production branch    | `main`                           |
+| Build command        | `npm run build -- -c production` |
+| Build directory      | `dist/my-angular-app`            |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+#### Angular CLI Configuration
+
+Angular CLI expects to build and manage multiple projects by default.
+
+When you generated a new project, you called it `"my-angular-app"` which means that Angular CLI created an `angular.json` file with a `"my-angular-app"` configuration key under the `"projects"` block. The CLI does this to prepare your workspace for new projects and configurations to be added at any point in time. It should look similar to this:
+
+```js
+// angular.json
+{
+  // ...
+  "projects": {
+    "my-angular-app": {
+      "projectType": "application",
+      // ...
+      "architect": {
+        "build": {
+          "builder": "@angular-devkit/build-angular:browser",
+          "options": {
+            "outputPath": "dist/my-angular-app",
+            "index": "src/index.html",
+            // ...
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+You will notice that there is an `outputPath` option within the `projects.my-angular-app.architect.build` object. This value tells Angular CLI where to place the "my-angular-app" project's output files. By default, it is `dist/my-angular-app` which is reflected in the **Build directory** setting of the Pages configuration.
+
+You can modify this `outputPath` value but you must update the Pages settings too.
+
+### Finalize Setup
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies – including Angular CLI – and builds the project as specified.
+
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. 
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Angular CLI site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-an-eleventy-site.md b/products/pages/src/content/framework-guides/deploy-an-eleventy-site.md
new file mode 100644
index 00000000000..6b7ae01ade1
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-an-eleventy-site.md
@@ -0,0 +1,52 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy an Eleventy site
+
+[Eleventy](https://www.11ty.dev/) is a simple static site generator. In this guide, you will create a new Eleventy site and deploy it using Cloudflare Pages. You will be using the `eleventy` CLI to create a new Eleventy site.
+
+## Installing Eleventy
+
+Install the `eleventy` CLI by running the following command in your terminal:
+
+```sh
+$ npm install -g @11ty/eleventy
+```
+
+## Creating a new project
+
+There are a lot of [starter projects](https://www.11ty.dev/docs/starter/) available on the Eleventy website. As an example, use the `eleventy-base-blog` project by running the following commands in your terminal:
+
+```sh
+git clone https://github.com/11ty/eleventy-base-blog.git my-blog-name
+cd my-blog-name
+npm install
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After creating a new repository, prepare and push your local application to GitHub by running the following command in your terminal:
+
+```sh
+$ git remote set-url origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and choose "Eleventy" from the Framework preset dropdown.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`.
+Every time you commit new code to your Eleventy site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Eleventy site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/deploy-anything.md b/products/pages/src/content/framework-guides/deploy-anything.md
new file mode 100644
index 00000000000..86b822ebce1
--- /dev/null
+++ b/products/pages/src/content/framework-guides/deploy-anything.md
@@ -0,0 +1,47 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploying your site
+
+Cloudflare supports deploying any static HTML website to Cloudflare Pages. If you manage your website without using a framework or static site generator, or if your framework is not listed in [Framework guides](/framework-guides), you can still deploy it using this guide.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+$ git remote add origin https://github.com/yourgithubusername/githubrepo
+$ git branch -M main
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option     | Value              |
+| ------------------------ | ------------------ |
+| Production branch        | `main`             |
+| Build command (optional) | `yourbuildcommand` |
+| Build output directory   | `yourbuilddir`     |
+
+</TableLayout>
+
+Unlike many of our framework guides, the build command and build directory for your site are going to be completely custom. If you do not need a build step, input  `exit 0` into the **Build command** field.
+
+After configuring your site, you can begin your first deploy. Your custom build command (if provided) will run, and Pages will deploy your static site.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+After you have deployed your site, you will receive a unique subdomain for your project on `*.pages.dev`. Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Learn more
+
+By completing this guide, you have successfully deployed your site on Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/elderjs.md b/products/pages/src/content/framework-guides/elderjs.md
new file mode 100644
index 00000000000..5ffb18491c3
--- /dev/null
+++ b/products/pages/src/content/framework-guides/elderjs.md
@@ -0,0 +1,78 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy an Elder.js site
+
+[Elder.js](https://elderguide.com/tech/elderjs/) is an SEO-focused framework for building static sites with [Svelte](/framework-guides/deploy-a-svelte-site).
+
+In this guide, you will create a new Elder.js application and deploy it using Cloudflare Pages.
+
+## Setting up a new project
+
+Create a new project using [`npx degit Elderjs/template`](https://docs.npmjs.com/cli/v6/commands/npm-init), giving it a project name:
+
+```sh
+$ npx degit Elderjs/template elderjs-app
+$ cd elderjs-app
+```
+
+The Elder.js template includes a number of pages and examples showing how to build your static site, but by simply generating the project, it is already ready to be deployed to Cloudflare Pages.
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+# Setup the local repository
+$ git init
+$ git remote add origin https://github.com/<username>/<repo>
+$ git branch -M main
+
+# Commit all initial files
+$ git add -A
+$ git commit -m "initial commit"
+
+# Send commit to new GitHub repo
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value             |
+| -------------------- | ---------------   |
+| Production branch    | `main`            |
+| Build command        | `npm run build`   |
+| Build directory      | `public`          |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+### Finalize Setup
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Elder.js site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/framework-guides/index.md b/products/pages/src/content/framework-guides/index.md
new file mode 100644
index 00000000000..8db1ed173b8
--- /dev/null
+++ b/products/pages/src/content/framework-guides/index.md
@@ -0,0 +1,11 @@
+---
+type: overview
+order: 3
+pcx-content-type: navigation
+---
+
+import ContentTable from "../components/content-table"
+
+# Framework guides
+
+<ContentTable path="framework-guides" />
\ No newline at end of file
diff --git a/products/pages/src/content/framework-guides/nuxt.md b/products/pages/src/content/framework-guides/nuxt.md
new file mode 100644
index 00000000000..7e3a82e22d1
--- /dev/null
+++ b/products/pages/src/content/framework-guides/nuxt.md
@@ -0,0 +1,76 @@
+---
+pcx-content-type: how-to
+---
+
+# Deploy an Nuxt.js site
+
+[Nuxt.js](https://nuxtjs.org/) is a framework making web development simple and powerful.
+
+In this guide, you will create a new Nuxt.js application and deploy it using Cloudflare Pages.
+
+## Setting up a new project
+
+Create a new project using `npx`, giving it the title `my-nuxt-app` in your terminal.
+
+```sh
+$ npx create-nuxt-app my-nuxt-app
+$ cd my-nuxt-app
+```
+
+## Creating a GitHub repository
+
+Create a new GitHub repository by visiting [repo.new](https://repo.new). After your repository is set up, push your application to GitHub by running the following commands in your terminal:
+
+```sh
+# Setup the local repository
+$ git init
+$ git remote add origin https://github.com/<username>/<repo>
+$ git branch -M main
+
+# Commit all initial files
+$ git add -A
+$ git commit -m "initial commit"
+
+# Send commit to new GitHub repo
+$ git push -u origin main
+```
+
+## Deploying with Cloudflare Pages
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**.
+
+You will be asked to authorize access to your GitHub account if you have not already done so. Cloudflare needs this so that it can monitor and deploy your projects from the source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) when you want to add more repositories to Cloudflare Pages.
+
+Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value             |
+| -------------------- | ---------------   |
+| Production branch    | `main`            |
+| Build command        | `npm run build`   |
+| Build directory      | `dist`            |
+
+</TableLayout>
+
+Optionally, you can customize the **Project name** field. It defaults to the GitHub repository's name, but it does not need to match. The **Project name** value is assigned as your `*.pages.dev` subdomain.
+
+### Finalize Setup
+
+After completing configuration, click the **Save and Deploy** button.
+
+You will see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
+
+Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
+
+Additionally, you will have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project with a real URL before deploying them to production.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/get-started).
+
+</Aside>
+
+## Learn more
+
+By completing this guide, you have successfully deployed your Nuxt.js site to Cloudflare Pages. To get started with other frameworks, [refer to the list of Framework guides](/framework-guides).
diff --git a/products/pages/src/content/getting-started/images/build-settings.png b/products/pages/src/content/get-started/images/build-settings.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/build-settings.png
rename to products/pages/src/content/get-started/images/build-settings.png
diff --git a/products/pages/src/content/getting-started/images/configuration.png b/products/pages/src/content/get-started/images/configuration.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/configuration.png
rename to products/pages/src/content/get-started/images/configuration.png
diff --git a/products/pages/src/content/getting-started/images/deploy-log.png b/products/pages/src/content/get-started/images/deploy-log.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/deploy-log.png
rename to products/pages/src/content/get-started/images/deploy-log.png
diff --git a/products/pages/src/content/getting-started/images/domains.png b/products/pages/src/content/get-started/images/domains.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/domains.png
rename to products/pages/src/content/get-started/images/domains.png
diff --git a/products/pages/src/content/get-started/images/root-directory.png b/products/pages/src/content/get-started/images/root-directory.png
new file mode 100644
index 00000000000..97cdb62d07b
Binary files /dev/null and b/products/pages/src/content/get-started/images/root-directory.png differ
diff --git a/products/pages/src/content/getting-started/images/settings.png b/products/pages/src/content/get-started/images/settings.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/settings.png
rename to products/pages/src/content/get-started/images/settings.png
diff --git a/products/pages/src/content/getting-started/images/site-dashboard.png b/products/pages/src/content/get-started/images/site-dashboard.png
similarity index 100%
rename from products/pages/src/content/getting-started/images/site-dashboard.png
rename to products/pages/src/content/get-started/images/site-dashboard.png
diff --git a/products/pages/src/content/get-started/index.md b/products/pages/src/content/get-started/index.md
new file mode 100644
index 00000000000..0ad7134ac17
--- /dev/null
+++ b/products/pages/src/content/get-started/index.md
@@ -0,0 +1,116 @@
+---
+order: 1
+pcx-content-type: configuration
+---
+
+# Get started
+
+In this guide, you will get started with Cloudflare Pages, and deploy your first website to the Pages platform.
+
+<Aside>
+
+You will be signing up for a Cloudflare account. You may also want to create a custom domain, but this is not required.
+
+</Aside>
+
+## Connecting your GitHub account
+
+### Sign in to Cloudflare Pages
+
+To begin, go to the [Cloudflare Pages site](https://pages.dev) and sign in with your Cloudflare account. If you do not have an account yet, you can sign up as you get started deploying your new Pages site.
+
+### Connect to GitHub
+
+Signing in with GitHub allows [Cloudflare Pages](https://pages.dev) to deploy your projects, update your GitHub PRs with [preview deployments](/platform/preview-deployments), and more. After you sign in, select **Create a project** in the Pages dashboard.
+
+## Configuration and deployment
+
+### Selecting a GitHub repository
+
+You can select a GitHub project from your personal account or an organization you have given Pages access to. This allows you to choose a GitHub repository to deploy using Pages. Both private and public repositories are supported.
+
+<Aside>
+
+If you do not have a project, [refer to our extensive How to section](/how-to) to learn how to create and deploy common frameworks and tools to Cloudflare Pages.
+
+</Aside>
+
+### Configuring your deployment
+
+Once you have selected a repository, select **Install & Authorize** and **Begin setup**. You can then customize your deployment in the **Set up builds and deployments** page.
+
+Your **project name** will be used to generate your project's hostname. By default, this matches your GitHub project name.
+
+**Production branch** indicates the branch that Cloudflare Pages should use to deploy the production version of your site. For most projects, this is the `main` or `master` branch. All other branches that are not your production branch will be used for [preview deployments](/platform/preview-deployments).
+
+![Configuration](./images/configuration.png)
+
+#### Build settings
+
+Depending on the framework, tool, or project you are deploying to Cloudflare Pages, you will need to specify the site's **build command** and **build output directory** to tell Cloudflare Pages how to deploy your site. The contents of this directory are uploaded to Cloudflare Pages as your website's contents.
+
+Our deployment dashboard provides a number of framework-specific presets, which provide the default values for the selected framework. If you are unsure what the correct values are for this section, refer to our documentation on [build configuration](/platform/build-configuration). If you do not need a build step, you may input  `exit 0` into the **Build command** field.
+
+![Build settings](./images/build-settings.png)
+
+Cloudflare Pages begins by working from your repository's root directory. The entire build pipeline, including the installation steps, will begin from this location. If you would like to change this, specify a new root directory location through the **Root directory (advanced)** > **Path** field.
+
+![Root directory](./images/root-directory.png)
+
+#### Environment variables
+
+Environment variables are a common way of providing configuration to your build workflow. While setting up your project, you can specify a number of key-value pairs as environment variables. These can be further customized once your project has finished building for the first time.
+
+After you have chosen your _Framework preset_, configured **Root directory (advanced)**, and customized your **Environment variables (optional)**, you are ready to deploy.
+
+## Your first deploy
+
+Once you have finished setting your build configuration, select **Save and Deploy**. Your project build logs will output as Cloudflare Pages installs your project dependencies, builds the project, and deploys it to Cloudflare's global network.
+
+![Deploy log](./images/deploy-log.png)
+
+When your project has finished deploying, you will receive a unique URL to view your deployed site.
+
+## Managing your site
+
+After your first deploy, select **Continue to project** to see see your project's configuration in the Cloudflare Pages dashboard. On this page, you can see your project's current deployment status, the production URL and associated commit, and all past deployments.
+
+![Site dashboard](./images/site-dashboard.png)
+
+### Adding a custom domain
+
+While every Cloudflare Pages site receives a custom subdomain during deployment, you may also wish to point custom domains (or subdomains) to your site. To do this, select the **Custom domains** section in your site dashboard.
+
+![Domains](./images/domains.png)
+
+ Select **Set up a domain**, provide the domain that you would like to serve your Cloudflare Pages site on and select **Continue**. Depending on the domain, you will need to configure nameservers or add a custom CNAME record to point the domain to your Cloudflare Pages site.
+
+#### Configure nameservers
+
+Configure your nameservers to point to Cloudflare's name servers. If your nameservers are successfully pointed to Cloudflare, Cloudflare will proceed by creating a CNAME record for you.
+
+#### Add a custom CNAME record
+
+If you do not want to point your nameservers to Cloudflare, you can still use a custom CNAME record to use a single domain with Cloudflare Pages. You can configure your DNS settings in the **DNS** section of the Cloudflare dashboard.
+
+| Type         | Name               | Content            |
+| ------------ | ------------------ | ------------------ |
+| `CNAME`      | `domain.com`       | `custom.pages.dev` |
+
+<Aside type="note">
+
+To ensure a custom domain is added successfully, you must go through the [Adding a custom domain](/getting-started#adding-a-custom-domain) process described above. Manually adding a custom CNAME record pointing to your Cloudflare Pages site - without first associating the domain (or subdomains) in the Cloudflare Pages dashboard - will result in your domain failing to resolve at the CNAME record address, and display a [522 error](https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#522error).
+
+</Aside>
+
+## Advanced project settings
+
+In the **Settings** section, you can configure advanced settings, such as changing your project name, updating your GitHub configuration, or updating your build command or build directory.
+
+![Settings](./images/settings.png)
+
+### Access policies
+
+You can use [Cloudflare Access](https://www.cloudflare.com/teams-access/) to manage access to your deployment previews. By default, these deployment URLs are public. Enabling the access policy will restrict viewing project deployments to your Cloudflare account.
+
+Once enabled, you can [set up a multi-user account](https://support.cloudflare.com/hc/en-us/articles/205065067-Setting-up-Multi-User-accounts-on-Cloudflare) to allow other members of your team to view preview deployments.
diff --git a/products/pages/src/content/getting-started/index.md b/products/pages/src/content/getting-started/index.md
deleted file mode 100644
index 012ef17ac07..00000000000
--- a/products/pages/src/content/getting-started/index.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-order: 1
----
-
-# Getting started
-
-In this guide, you'll get started with Cloudflare Pages, and deploy your first website to the platform.
-
-<Aside>
-
-You'll be signing up for a Cloudflare account. You may also want a custom domain available, but it isn't required.
-
-</Aside>
-
-## Connecting your GitHub account
-
-### Sign in to Cloudflare Pages
-
-To begin, go to the [Cloudflare Pages site](https://pages.dev) and sign in with your Cloudflare account. If you don't have one yet, you can sign up for an account as you get started deploying your new site.
-
-### Connect to GitHub
-
-Signing in with GitHub allows [Cloudflare Pages](https://pages.dev) to deploy your projects, update your GitHub PRs with [preview deployments](/platform/preview-deployments), and more. When you sign in, you'll also have the option of specifying any GitHub organizations that you'd like to connect to Cloudflare Pages. This allows you to deploy both public and private repositories for your own account, as well as repositories for your company or organization.
-
-## Configuration and deployment
-
-### Selecting a GitHub repository
-
-You can select a GitHub project from your personal account or an organization you've given Pages access to. This allows you to choose a GitHub repository to deploy using Pages. Both private and public repositories are supported.
-
-<Aside>
-
-Don't have a project? [Check out our extensive How-To section](/how-to) to learn how to create and deploy common frameworks and tools to Cloudflare Pages.
-
-</Aside>
-
-### Configuring your deployment
-
-Once you've selected a repository, you can customize your deployment in the "Deployment settings" page.
-
-Your **project name** will be used to generate your deploy's hostname. By default, this matches your GitHub project name.
-
-**Production branch** indicates the branch that Cloudflare Pages should use to deploy the "production" version of your site. For most projects, this is the `main` or `master` branch. All other branches that _aren't_ your production branch will be used for [preview deployments](/platform/preview-deployments).
-
-![Configuration](./images/configuration.png)
-
-#### Build settings
-
-Depending on the framework, tool, or project you're deploying to Cloudflare Pages, you'll need to specify the site's **build command** and **publish directory** to tell Cloudflare Pages how to deploy your site.
-
-Our deployment UI provides a number of "presets", pre-filling values for many common deployment scenarios. If you're unsure what the correct values are for this section, check out our documentation for [build configuration](/platform/build-configuration).
-
-![Build settings](./images/build-settings.png)
-
-#### Environment variables
-
-Environment variables are a common way of providing configuration to your build workflow. While setting up your project, you can specify a number of key-value pairs as environment variables. These can be further customized once your project has finished building for the first time.
-
-## Your first deploy
-
-Once you've finished setting your build configuration, Cloudflare Pages will begin deploying your site! Your project build logs will output as Cloudflare Pages installs your project dependencies, build the project, and deploys it to Cloudflare's global network.
-
-![Deploy log](./images/deploy-log.png)
-
-When your project has finished deploying, you'll receive a unique URL to view your deployed site. Congrats! You've deployed your first site with Cloudflare Pages 🚀
-
-## Managing your site
-
-Selecting "Continue to project" after your first deploy, you'll see your project's configuration in the Cloudflare Pages dashboard. Here, you can see your project's current deployment status, the production URL and associated commit, and all past deployments.
-
-![Site dashboard](./images/site-dashboard.png)
-
-### Adding a custom domain
-
-While every Cloudflare Pages site receives a custom subdomain during deployment, you may also wish to point custom domains (or subdomains) to your site. To do this, go to the "Domains" tab in your site dashboard.
-
-![Domains](./images/domains.png)
-
-Click the "Set up a domain" button, and provide the domain that you'd like to serve your Cloudflare Pages site on. Depending on the domain, you'll need to configure nameservers or add a custom CNAME record to point the domain to your Cloudflare Pages site.
-
-#### Configure nameservers
-
-Configure your nameservers to point to Cloudflare's name servers. If your nameservers are successfully pointed to Cloudflare, we'll proceed by creating a CNAME record for you!
-
-#### Add a custom CNAME record
-
-If you don't want to point your nameservers to Cloudflare, you can still use a custom CNAME record to use a single domain with Cloudflare Pages.
-
-| Domain       | CNAME              |
-| ------------ | ------------------ |
-| `domain.com` | `custom.pages.dev` |
-
-## Advanced project settings
-
-In the "Settings" tab, you can configure advanced settings, such as **changing your project name**, **updating your GitHub configuration**, or **updating your build command or build directory**.
-
-![Settings](./images/settings.png)
-
-### Access policies
-
-You can use [Cloudflare Access](https://www.cloudflare.com/teams-access/) to manage access to your deployment previews. By default, these deployment URLs are public. Enabling the access policy will restrict viewing project deployments to your Cloudflare account.
-
-Once enabled, you can [set up a multi-user account](https://support.cloudflare.com/hc/en-us/articles/205065067-Setting-up-Multi-User-accounts-on-Cloudflare) to allow other members of your team to view preview deployments.
diff --git a/products/pages/src/content/how-to/add-custom-http-headers.md b/products/pages/src/content/how-to/add-custom-http-headers.md
new file mode 100644
index 00000000000..9943f164080
--- /dev/null
+++ b/products/pages/src/content/how-to/add-custom-http-headers.md
@@ -0,0 +1,88 @@
+---
+pcx-content-type: how-to
+---
+
+# Add custom HTTP headers
+
+Cloudflare provides HTTP header customization for Pages projects through Cloudflare Workers [serverless functions](https://www.cloudflare.com/learning/serverless/what-is-serverless/). You may want to add, remove, or alter HTTP headers for security or performance reasons. 
+
+If you have not deployed a Worker before, get started with our [tutorial](https://developers.cloudflare.com/workers/get-started/guide). For the purpose of this tutorial, accomplish steps one ("Sign up for a Workers account") through four ("Generate a new project") before returning to this page. 
+
+Before continuing, ensure that your Cloudflare Pages project is connected to a [custom domain](https://developers.cloudflare.com/pages/getting-started#adding-a-custom-domain). 
+
+## Writing a Workers function
+
+Workers functions are written in [JavaScript](https://www.cloudflare.com/learning/serverless/serverless-javascript/). When a Worker makes a request to a Cloudflare Pages application, it will receive a response. The response a Worker receives is immutable, meaning it cannot be changed. In order to add, delete, or alter headers, clone the response and modify the headers on a new `Response` instance. Return the new response to the browser with your desired header changes. An example of this is shown below: 
+
+```js
+---
+header: Setting custom headers with a Workers function
+---
+addEventListener('fetch', event => {
+  event.respondWith(handleRequest(event.request))
+})
+
+async function handleRequest(request) {
+  // This proxies your Pages application under the condition that your Worker script is deployed on the same custom domain as your Pages project
+  const response = await fetch(request)
+  
+  // Clone the response so that it is no longer immutable
+  const newResponse = new Response(response.body, response)
+
+  // Add a custom header with a value
+  newResponse.headers.append("x-workers-hello", "Hello from Cloudflare Workers")
+
+  // Delete headers
+  newResponse.headers.delete("x-header-to-delete")
+  newResponse.headers.delete("x-header2-to-delete")
+
+  // Adjust the value for an existing header
+  newResponse.headers.set("x-header-to-change", "NewValue")
+
+  return newResponse
+}
+```
+
+## Deploying a Workers function in the dashboard
+
+The easiest way to start deploying your Workers function is by typing [workers.new](https://workers.new/) in the browser. Log into your account to be automatically directed to the Workers dashboard. From the Workers dashboard, write your function or use one of the [examples from the Workers documentation](https://developers.cloudflare.com/workers/examples).
+
+Click **Save and Deploy** when your script is ready and set a [route](https://developers.cloudflare.com/workers/platform/routes/) in your domain's zone settings.
+
+For example, [here is a Workers script](https://developers.cloudflare.com/workers/examples/security-headers) you can copy and paste into the Workers dashboard that sets common security headers whenever a request hits your Pages URL, such as X-XSS-Protection, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Content-Security-Policy (CSP), and more.
+
+## Deploying a Workers function using the CLI
+
+If you would like to skip writing this file yourself, you can use our `custom-headers-example` [template](https://github.com/signalnerve/custom-headers-example) to generate a new Workers function with [wrangler](https://developers.cloudflare.com/workers/cli-wrangler/install-update), the Workers CLI tool. 
+
+```sh 
+---
+header: Generating a serverless function with wrangler
+---
+$ wrangler generate projectname https://github.com/cloudflare/custom-headers-example
+```
+To operate your Workers function alongside your Pages application, deploy it to the same custom domain as your Pages application. To do this, update the `wrangler.toml` file in your project with your account and zone details: 
+
+```toml
+---
+filename: wrangler.toml
+highlight: [4,6,7]
+---
+name = "custom-headers-example"
+type = "javascript"
+
+account_id = "FILL-IN-YOUR-ACCOUNT-ID"
+workers_dev = false
+route = "FILL-IN-YOUR-WEBSITE.com/*"
+zone_id = "FILL-IN-YOUR-ZONE-ID"
+```
+
+If you do not know how to find your Account ID and Zone ID, refer to [our guide](https://developers.cloudflare.com/workers/get-started/guide#7-configure-your-project-for-deployment).
+
+Once you have configured your `wrangler.toml`, run `wrangler publish` in your terminal to deploy your Worker:
+
+```sh
+$ wrangler publish
+``` 
+
+After you have deployed your Worker, your desired HTTP header adjustments will take effect. While the Worker is deployed, you should continue to see the content from your Pages application as normal.
diff --git a/products/pages/src/content/how-to/deploy-a-gatsby-site.md b/products/pages/src/content/how-to/deploy-a-gatsby-site.md
deleted file mode 100644
index ffd0b91cb7b..00000000000
--- a/products/pages/src/content/how-to/deploy-a-gatsby-site.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Deploy a Gatsby site
-
-Gatsby is an open-source React framework for creating websites and apps. In this guide, you'll create a new Gatsby application and deploy it using Cloudflare Pages. We'll be using the `gatsby` CLI to create a new Gatsby site.
-
-## Installing Gatsby
-
-First, install the `gatsby` CLI:
-
-```sh
-$ npm install -g gatsby-cli
-```
-
-## Creating a new project
-
-With Gatsby installed, you can create a new project using `gatsby new`. The `new` command accepts a GitHub URL for using an existing template. For now, we'll use the `gatsby-starter-lumen` template, but you can find more in [Gatsby's Starters section](https://www.gatsbyjs.com/starters/?v=2):
-
-```sh
-$ gatsby new my-gatsby-site https://github.com/alxshelepenok/gatsby-starter-lumen
-```
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value          |
-| -------------------- | -------------- |
-| Production branch    | `main`         |
-| Build command        | `gatsby build` |
-| Build directory      | `public`       |
-
-</TableLayout>
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `gatsby`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your Gatsby site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Gatsby site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-hugo-site.md b/products/pages/src/content/how-to/deploy-a-hugo-site.md
deleted file mode 100644
index 08ecce7b8ff..00000000000
--- a/products/pages/src/content/how-to/deploy-a-hugo-site.md
+++ /dev/null
@@ -1,188 +0,0 @@
-# Deploy a Hugo site
-
-Hugo is a tool for generating static sites, written in Go. It's incredibly fast and has great high-level, flexible primitives for managing your content using Markdown and JSON.
-
-In this guide, you'll create a new Hugo application and deploy it using Cloudflare Pages. We'll be the `hugo` CLI to create a new Hugo site.
-
-## Installing Hugo
-
-First, install the Hugo CLI, using the specific instructions for your operating system below:
-
-### Linux
-
-Your Linux distro's package manager may include Hugo. If this is the case, you can install it directly using your distro's package manager -- for instance, in Ubuntu:
-
-```sh
-$ sudo apt-get install hugo
-```
-
-If your package manager doesn't include Hugo or you'd like to download a release directly, see the "Manual" section below.
-
-### Homebrew (macOS)
-
-If you use the package manager [Homebrew](https://brew.sh), you can use `brew install` to install Hugo:
-
-```sh
-$ brew install hugo
-```
-
-### Windows (Chocolatey)
-
-If you use the package manager [Chocolatey](https://chocolatey.org/), you can use `choco install` to install Hugo:
-
-```sh
-$ choco install hugo --confirm
-```
-
-### Manual installation
-
-The Hugo GitHub repository contains pre-built versions of the Hugo command-line tool for various operating systems, which can be found on [the Releases page](https://github.com/gohugoio/hugo/releases).
-
-For more instruction on installing these releases, see [Hugo's install guide](https://gohugo.io/getting-started/installing/).
-
-## Creating a new project
-
-With Hugo installed, you can create a new project using `hugo new`:
-
-```sh
-$ hugo new site my-hugo-site
-```
-
-Hugo sites use _themes_ to customize the look and feel of the statically built HTML site. There are a number of themes available at [themes.gohugo.io](https://themes.gohugo.io) -- for now, we'll pick the [Terminal theme](https://themes.gohugo.io/hugo-theme-terminal/) and install it:
-
-```sh
-$ cd my-hugo-site
-$ git init
-$ git clone https://github.com/panr/hugo-theme-terminal.git themes/terminal
-```
-
-You should also copy the default configuration provided by the theme into the `config.toml` file. Take the following information and customize it per your site's needs:
-
-```toml
-baseurl = "/"
-languageCode = "en-us"
-theme = "terminal"
-paginate = 5
-
-[params]
-  # dir name of your main content (default is `content/posts`).
-  # the list of set content will show up on your index page (baseurl).
-  contentTypeName = "posts"
-
-  # ["orange", "blue", "red", "green", "pink"]
-  themeColor = "orange"
-
-  # if you set this to 0, only submenu trigger will be visible
-  showMenuItems = 2
-
-  # show selector to switch language
-  showLanguageSelector = false
-
-  # set theme to full screen width
-  fullWidthTheme = false
-
-  # center theme with default width
-  centerTheme = false
-
-  # set a custom favicon (default is a `themeColor` square)
-  # favicon = "favicon.ico"
-
-  # set post to show the last updated
-  # If you use git, you can set `enableGitInfo` to `true` and then post will automatically get the last updated
-  showLastUpdated = false
-  # Provide a string as a prefix for the last update date. By default, it looks like this: 2020-xx-xx [Updated: 2020-xx-xx] :: Author
-  # updatedDatePrefix = "Updated"
-
-  # set all headings to their default size (depending on browser settings)
-  # it's set to `true` by default
-  # oneHeadingSize = false
-
-[params.twitter]
-  # set Twitter handles for Twitter cards
-  # see https://developer.twitter.com/en/docs/tweets/optimize-with-cards/guides/getting-started#card-and-content-attribution
-  # do not include @
-  creator = ""
-  site = ""
-
-[languages]
-  [languages.en]
-    languageName = "English"
-    title = "Terminal"
-    subtitle = "A simple, retro theme for Hugo"
-    owner = ""
-    keywords = ""
-    copyright = ""
-    menuMore = "Show more"
-    readMore = "Read more"
-    readOtherPosts = "Read other posts"
-    missingContentMessage = "Page not found..."
-    missingBackButtonLabel = "Back to home page"
-
-    [languages.en.params.logo]
-      logoText = "Terminal"
-      logoHomeLink = "/"
-
-    [languages.en.menu]
-      [[languages.en.menu.main]]
-        identifier = "about"
-        name = "About"
-        url = "/about"
-      [[languages.en.menu.main]]
-        identifier = "showcase"
-        name = "Showcase"
-        url = "/showcase"
-```
-
-## Creating a post
-
-Finally, you can create a new post to give your Hugo site some initial content. Run the `hugo new` command to generate a new post:
-
-```sh
-$ hugo new posts/hello-world.md
-```
-
-Inside of `hello-world.md`, you can add some initial content to flesh out your post. Make sure to remove the `draft` line in your post's frontmatter when you're ready to publish the post: any posts with `draft: true` set will be skipped by Hugo's build process.
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value    |
-| -------------------- | -------- |
-| Production branch    | `main`   |
-| Build command        | `hugo`   |
-| Build directory      | `public` |
-
-</TableLayout>
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `hugo`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your Hugo site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Using a specific Hugo version
-
-You can set the environment variable `HUGO_VERSION` under Settings to use a specific version of Hugo.
-
-For example, `HUGO_VERSION`: `0.81.0`
-
-## Learn more
-
-Congrats, you've deployed your Hugo site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-jekyll-site.md b/products/pages/src/content/how-to/deploy-a-jekyll-site.md
deleted file mode 100644
index f0406c1aa7d..00000000000
--- a/products/pages/src/content/how-to/deploy-a-jekyll-site.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# Deploy a Jekyll site
-
-Jekyll is an open-source React framework for creating websites and apps. In this guide, you'll create a new Jekyll application and deploy it using Cloudflare Pages. We'll be using the `jekyll` CLI to create a new Jekyll site.
-
-## Installing Jekyll
-
-Jekyll is written in Ruby, meaning that you'll need a functioning Ruby installation in order to install Jekyll.
-
-We recommend using [`rbenv`](https://github.com/rbenv/rbenv) to install Ruby on your computer. Follow the [`rbenv` install instructions](https://github.com/rbenv/rbenv#installation), and install a recent version of Ruby using `rbenv`:
-
-```sh
-$ rbenv install 2.7.2
-```
-
-With Ruby installed, you can install the `jekyll` Ruby gem:
-
-```sh
-$ gem install jekyll
-```
-
-## Creating a new project
-
-With Jekyll installed, you can create a new project using `jekyll new`:
-
-```sh
-$ jekyll new my-jekyll-site
-```
-
-You should create a base `index.html` in your newly created folder so that your site has content:
-
-```html
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <title>Hello from Cloudflare Pages</title>
-  </head>
-  <body>
-    <h1>Hello from Cloudflare Pages</h1>
-  </body>
-</html>
-```
-
-Optionally, you can also use a theme with your new Jekyll site if you'd like to start with great styling defaults. For instance, the [minimal-mistakes](https://github.com/mmistakes/minimal-mistakes) theme has a ["Starting from `jekyll new`"](https://mmistakes.github.io/minimal-mistakes/docs/quick-start-guide/#starting-from-jekyll-new) section to help you add the theme to your new site.
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-If you're migrating an existing Jekyll project to Pages, you should confirm that your `Gemfile` is committed as part of your codebase. Pages will look at your Gemfile and run `bundle install` to install the required dependencies for your project, including the `jekyll` gem.
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value          |
-| -------------------- | -------------- |
-| Production branch    | `main`         |
-| Build command        | `jekyll build` |
-| Build directory      | `_site`        |
-
-</TableLayout>
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `jekyll`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your Jekyll site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Jekyll site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-nextjs-site.md b/products/pages/src/content/how-to/deploy-a-nextjs-site.md
deleted file mode 100644
index 48721a0aae6..00000000000
--- a/products/pages/src/content/how-to/deploy-a-nextjs-site.md
+++ /dev/null
@@ -1,58 +0,0 @@
-# Deploy a Next.js site
-
-Next.js is an open-source React framework for creating websites and apps. In this guide, you'll create a new Next.js application and deploy it using Cloudflare Pages.
-
-## Creating a new project
-
-Create a new project using npx
-```sh
-$ npx create-next-app
-```
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value           |
-| -------------------- | ----------------|
-| Production branch    | `main`          |
-| Build command        | `npm run build` |
-| Build directory      | `out`           |
-
-</TableLayout>
-
-Your `build` command in `package.json` should build and export your Next.js application, like this: 
-
-```json
-{
-  "scripts": {
-    "build": "next build && next export"
-  }
-}
-```
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `next`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your Next.js site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Next.js site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-preact-site.md b/products/pages/src/content/how-to/deploy-a-preact-site.md
deleted file mode 100644
index 84b806062dc..00000000000
--- a/products/pages/src/content/how-to/deploy-a-preact-site.md
+++ /dev/null
@@ -1,75 +0,0 @@
-# Deploy a Preact site
-
-[Preact](https://preactjs.com) is a popular, open-source framework for building modern web applications. Preact can also be used as a lightweight alternative to React because the two share the same API and component model.
-
-In this guide, you'll create a new Preact application and deploy it using Cloudflare Pages.
-We'll be using [`wmr`](https://github.com/preactjs/wmr), an all-in-one development tool built by the Preact team, to quickly generate an optimized web application.
-
-## Setting up a new project
-
-Create a new project using [`npm init`](https://docs.npmjs.com/cli/v6/commands/npm-init), giving it a title:
-
-```sh
-$ npm init wmr your-project-name
-$ cd your-project-name
-```
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). You can then push your application to GitHub:
-
-```sh
-# setup the local repository
-$ git init
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-
-# commit all initial files
-$ git add -A
-$ git commit -m "initial commit"
-
-# send commit to new GitHub repo
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Pages by going to the [Cloudflare dashboard](https://dash.cloudflare.com/) and clicking the "Create a project" button.
-
-You will be asked to authorize access to your GitHub account, if you haven't already done so. Cloudflare needs this so that it can monitor and deploy your projects from source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) as you wish to attach more repositories to Cloudflare Pages.
-
-Select the new GitHub repository that you created above and, in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value           |
-| -------------------- | --------------- |
-| Production branch    | `main`          |
-| Build command        | `npm run build` |
-| Build directory      | `dist`          |
-
-</TableLayout>
-
-Optionally, you can customize the `Project Name` setting. It defaults to the repository's name, but it does not need to match. This value is assigned as your `pages.dev` subdomain.
-
-Once you've configured your site, click the "Save and Deploy" button!
-
-You'll see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
-
-<Aside>
-
-**Note:** You will notice that within the `package.json` file, the `"build"` script uses the `--prerender` flag. With this, `wmr` produces static HTML pages – along with their assets – which is perfect for Pages.
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`.
-
-Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
-
-Additionally, you'll have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project _with a real URL_ before deploying them to production.
-
-## Learn more
-
-Congratulations! You've deployed your Preact site to Cloudflare Pages!
-
-To learn more about what you can do with the platform, [check out our How To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-react-application.md b/products/pages/src/content/how-to/deploy-a-react-application.md
deleted file mode 100644
index 3c228887653..00000000000
--- a/products/pages/src/content/how-to/deploy-a-react-application.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Deploy a React application
-
-React is an incredibly popular framework for building reactive and powerful frontend applications, built by the open-source team at Facebook.
-
-In this guide, you'll create a new React application and deploy it using Cloudflare Pages. We'll be using `create-react-app`, a batteries-included tool for generating new React applications.
-
-## Setting up a new project
-
-Create a new project using `npx`, giving it the title `my-react-app`.
-
-```sh
-$ npx create-react-app my-react-app
-```
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value           |
-| -------------------- | --------------- |
-| Production branch    | `main`          |
-| Build command        | `npm run build` |
-| Build directory      | `build`         |
-
-</TableLayout>
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `create-react-app`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your React application, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your React site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-sphinx-site.md b/products/pages/src/content/how-to/deploy-a-sphinx-site.md
deleted file mode 100644
index 643cc6b61e0..00000000000
--- a/products/pages/src/content/how-to/deploy-a-sphinx-site.md
+++ /dev/null
@@ -1,163 +0,0 @@
-# Deploy a Sphinx site
-
-[Sphinx](https://www.sphinx-doc.org/) is a tool that makes it easy to create beautiful documentation, originally created
-for Python documentation. It has found favour among many for its simplicity and ease of use.
-
-In this guide you'll create a new Sphinx project and deploy it using Cloudflare Pages.
-
-## Prerequisites
-
-There are a few prerequisites before you can begin creating your Sphinx site, namely you'll need to install it!
-
-### Installing Python
-
-Sphinx is a Python based tool, which means you'll need to have Python installed to make use of it. We **recommend**
-installing Python version 3.7 as this is the latest version at the time of writing Cloudflare Pages supports. Please
-refer to the official Python docs on installing for your platform at their relevant pages:
-
-- [Windows](https://www.python.org/downloads/windows/)
-- [Linux/UNIX](https://www.python.org/downloads/source/)
-- [Mac OS X](https://www.python.org/downloads/mac-osx/)
-- [Other](https://www.python.org/download/other/)
-
-### Installing Pipenv
-
-Wonderful, by now you should have Python installed. If you already had Python installed, please be mindful that any
-other global packages you may have installed could interfere with the following steps to install Pipenv, or your other
-Python projects which depend on global packages!
-
-[Pipenv](https://pipenv.pypa.io/en/latest/) is a Python based package manager that makes managing virtual environments
-super simple. If you're not familiar with it yet, don't worry, it's easy to pick up. Cloudflare Pages natively supports
-the use of Pipenv and by default has the latest version installed.
-
-The quickest way to install Pipenv is by running the command:
-
-```shell
-$ pip install --user pipenv
-```
-
-This will install Pipenv to your user level directory and will make it accessible via your terminal. You can confirm
-this by running the following command and seeing the expected output:
-
-```shell
-$ pipenv --version
-pipenv, version 2020.11.15
-```
-
-### Installing Sphinx
-
-Just one last step before can install Sphinx, we first have to create the directory we want our project to live in. From
-your terminal run the following commands to create a new directory and navigate within it:
-
-```shell
-$ mkdir my-wonderful-new-sphinx-project
-$ cd my-wonderful-new-sphinx-project
-```
-
-We're finally ready to install Sphinx. From your terminal run the following command to install Sphinx:
-
-```shell
-$ pipenv install sphinx
-```
-
-This will install sphinx into a new virtual environment managed by Pipenv, you should see a directory structure like
-this:
-
-```shell
-my-wonderful-new-sphinx-project
-|--Pipfile
-|--Pipfile.lock
-```
-
-## Creating a new project
-
-With Sphinx installed you can now run the quickstart command to create a template project for you. This command will
-only work within the Pipenv environment we created in the previous step. To enter that environment run the following
-command from your terminal:
-
-```shell
-$ pipenv shell
-```
-
-Now run the following command:
-
-```shell
-$ sphinx-quickstart
-```
-
-You will be presented with a number of questions, please answer them in the following:
-
-```shell
-$ Separate source and build directories (y/n) [n]: Y
-$ Project name: <Your project name>
-$ Author name(s): <You Author Name>
-$ Project release []: <You can accept default here or provide a version>
-$ Project language [en]: <You can accept en here or provide a regional language code>
-```
-
-This will create four new files in your active directory, `source/conf.py`, `index.rst`, `Makefile` and `make.bat`:
-
-```shell
-my-wonderful-new-sphinx-project
-|--Pipfile
-|--Pipfile.lock
-|--source
-|----conf.py
-|--index.rst
-|--Makefile
-|--make.bat
-```
-
-You now have everything you need to start deploying your site to Cloudflare Pages. For learning how to create beautiful
-documentation with Sphinx please see the official
-docs [here](https://www.sphinx-doc.org/en/master/usage/quickstart.html).
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can
-push your local application to GitHub:
-
-```shell
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard, and creating a new site. Select your new GitHub
-repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value          |
-| -------------------- | -------------- |
-| Production branch    | `main`         |
-| Build command        | `make html`    |
-| Build directory      | `build/html`   |
-
-</TableLayout>
-
-Below the configuration, make sure to set the environment variable for specifying the `PYTHON_VERSION`.
-
-For example, `PYTHON_VERSION`: `3.7`.
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `Pipenv`,
-your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check
-out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit
-new code to your Hugo site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get
-access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look
-to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Sphinx site on Cloudflare Pages! To learn more about what you can do with the
-platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-svelte-site.md b/products/pages/src/content/how-to/deploy-a-svelte-site.md
deleted file mode 100644
index 82b2e29b29a..00000000000
--- a/products/pages/src/content/how-to/deploy-a-svelte-site.md
+++ /dev/null
@@ -1,112 +0,0 @@
-# Deploy a Svelte site
-
-[Svelte](https://svelte.dev) is an increasingly popular, open-source framework for building user interfaces and web applications. Unlike most frameworks, Svelte is primarily a compiler that converts your component code into efficient JavaScript that surgically updates the DOM when your application state changes.
-
-In this guide, you'll create a new Svelte application and deploy it using Cloudflare Pages.
-We'll be using [`SvelteKit`](https://kit.svelte.dev/), the official Svelte framework for building web applications of all sizes.
-
-<Aside type="warning">
-
-**Note:** At the time of writing, SvelteKit is still in beta. However, the Svelte team is confident that the steps below are stable. This guide will be updated as needed, both during and after the beta phase.
-
-</Aside>
-
-## Setting up a new project
-
-Create a new project using [`npm init`](https://docs.npmjs.com/cli/v6/commands/npm-init), giving it a title:
-
-```sh
-$ npm init svelte@next my-svelte-app
-$ cd my-svelte-app
-```
-
-During `init`, SvelteKit will prompt you for customization choices. Your answers _will not_ affect the rest of this tutorial, so please feel free to select what's ideal for your project.
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). You can then push your application to GitHub:
-
-```sh
-# setup the local repository
-$ git init
-$ git remote add origin https://github.com/<username>/<repo>
-$ git branch -M main
-
-# commit all initial files
-$ git add -A
-$ git commit -m "initial commit"
-
-# send commit to new GitHub repo
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Pages by going to the [Cloudflare dashboard](https://dash.cloudflare.com/) and clicking the "Create a project" button.
-
-You will be asked to authorize access to your GitHub account, if you haven't already done so. Cloudflare needs this so that it can monitor and deploy your projects from source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) as you wish to attach more repositories to Cloudflare Pages.
-
-Select the new GitHub repository that you created above and, in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value           |
-| -------------------- | --------------- |
-| Production branch    | `main`          |
-| Build command        | `npm run build` |
-| Build directory      | `build`          |
-
-</TableLayout>
-
-Optionally, you can customize the `Project Name` setting. It defaults to the repository's name, but it does not need to match. This value is assigned as your `pages.dev` subdomain.
-
-### SvelteKit Configuration
-
-By default, SvelteKit prepares our project with the assumption that it will deployed to a Node.js server. This isn't appropriate for our case, but luckily SvelteKit is flexible and has a ready-made "adapter" for our needs. A few changes have to be made, but it will be a very easy process!
-
-First, let's remove the [`@sveltejs/adapter-node`](https://www.npmjs.com/package/@sveltejs/adapter-node) dependency and install the [`@sveltejs/adapter-static`](https://www.npmjs.com/package/@sveltejs/adapter-static) package instead:
-
-```sh
-$ npm uninstall @sveltejs/adapter-node
-$ npm install @sveltejs/adapter-static@next --save-dev
-```
-
-Then, in the `svelte.config.cjs` file, we need to update the adapter selection too:
-
-```diff
-const sveltePreprocess = require('svelte-preprocess');
---const node = require('@sveltejs/adapter-node');
-const pkg = require('./package.json');
-
-module.exports = {
-  // ... truncated ...
-	kit: {
---		adapter: node(),
-++		adapter: require('@sveltejs/adapter-static')(),
-		// ... truncated ...
-	}
-};
-```
-
-<Aside>
-
-**Important:** Remember to commit and push these changes to your GitHub repository!
-
-</Aside>
-
-### Finalize Setup
-
-Once you've configured your site, click the "Save and Deploy" button!
-
-You'll see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
-
-Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
-
-Additionally, you'll have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project _with a real URL_ before deploying them to production.
-
-
-## Learn more
-
-Congratulations! You've deployed your Svelte site to Cloudflare Pages!
-
-To learn more about what you can do with the platform, [check out our How To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-vue-application.md b/products/pages/src/content/how-to/deploy-a-vue-application.md
deleted file mode 100644
index 35ce1e2bc02..00000000000
--- a/products/pages/src/content/how-to/deploy-a-vue-application.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Deploy a Vue application
-
-Vue is a progressive JavaScript framework for building user interfaces. A core principle of Vue is "incremental adoption": this makes it easy to build Vue applications that live side-by-side with your existing code.
-
-In this guide, you'll create a new Vue application and deploy it using Cloudflare Pages. We'll be using `vue-cli`, a batteries-included tool for generating new Vue applications.
-
-## Setting up a new project
-
-First, install the Vue CLI using NPM, and then run `vue create` to create a new project called `my-vue-app`:
-
-```sh
-$ npm install -g @vue/cli
-$ vue create my-vue-app
-```
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value           |
-| -------------------- | --------------- |
-| Production branch    | `main`          |
-| Build command        | `npm run build` |
-| Build directory      | `dist`          |
-
-</TableLayout>
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `vue`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Every time you commit new code to your Vue application, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Vue site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-a-zola-site.md b/products/pages/src/content/how-to/deploy-a-zola-site.md
deleted file mode 100644
index bfd70aeb6c9..00000000000
--- a/products/pages/src/content/how-to/deploy-a-zola-site.md
+++ /dev/null
@@ -1,113 +0,0 @@
-# Deploy a Zola site
-
-[Zola](https://www.getzola.org/) is a fast static site generator in a single binary with everything built-in. In this guide, you'll create a new Zola application and deploy it using Cloudflare Pages. We'll be using the `zola` CLI to create a new Zola site.
-
-## Installing Zola
-
-First, [install](https://www.getzola.org/documentation/getting-started/installation/) the `zola` CLI, using the specific instructions for your operating system below:
-
-### Homebrew (macOS)
-
-If you use the package manager [Homebrew](https://brew.sh), you can use `brew install` to install Zola:
-
-```sh
-$ brew install zola
-```
-
-### Windows (Chocolatey)
-
-If you use the package manager [Chocolatey](https://chocolatey.org/), you can use `choco install` to install Zola:
-
-```sh
-$ choco install zola
-```
-
-If you use the package manager [Scoop](https://scoop.sh/), you can use `scoop install` to install Zola:
-
-```sh
-$ scoop install zola
-```
-
-### Linux
-
-Your Linux distro's package manager may include Zola. If this is the case, you can install it directly using your distro's package manager -- for instance, using `pkg`:
-
-```sh
-$ pkg install zola
-```
-
-If your package manager doesn't include Zola or you'd like to download a release directly, see the "Manual" section below.
-
-### Manual installation
-
-The Zola GitHub repository contains pre-built versions of the Zola command-line tool for various operating systems, which can be found on [the Releases page](https://github.com/getzola/zola/releases).
-
-For more instruction on installing these releases, see [Zola's install guide](https://www.getzola.org/documentation/getting-started/installation/).
-
-## Creating a new project
-
-With Zola installed, you can create a new project using `zola init`. For now, we'll use the default template:
-
-```sh
-$ zola init my-zola-project
-```
-
-Upon running `zola init`, you will prompted with  three questions: 
-1. What is the URL of your site? (https://example.com): 
-You can leave this one blank  for  now 
-
-2. Do you want to enable Sass compilation? [Y/n]: Y
-3. Do you want to enable syntax highlighting? [y/N]: y
-4. Do you want to build a search index of the content? [y/N]: y
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard, and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value          |
-| -------------------- | -------------- |
-| Production branch    | `main`         |
-| Build command        | `zola build` |
-| Build directory      | `public`       |
-
-</TableLayout>
-
-Below the configuration, make sure to set the Environment Variable for specifying the `ZOLA_VERSION`. 
-
-For example, `ZOLA_VERSION`: `0.13.0`.
-
-Once you've configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `zola`, your project dependencies, and building your site, before deploying it.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. 
-
-You can now add that subdomain as the `base_url` in your  `config.toml` file. 
-
-For example: 
-``` yaml
-# The URL the site will be built for
-base_url = "https://my-zola-project.pages.dev"
-```
-
-Every time you commit new code to your Zola site, Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your Zola site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-an-angular-application.md b/products/pages/src/content/how-to/deploy-an-angular-application.md
deleted file mode 100644
index cdaf0a0beec..00000000000
--- a/products/pages/src/content/how-to/deploy-an-angular-application.md
+++ /dev/null
@@ -1,121 +0,0 @@
-# Deploy an Angular application
-
-Angular is an incredibly popular framework for building reactive and powerful frontend applications.
-
-In this guide, you'll create a new Angular application and deploy it using Cloudflare Pages. We'll be using Angular CLI, a batteries-included tool for generating new Angular applications.
-
-## Setting up a new project
-
-If you already have [Angular CLI](https://angular.io/cli) installed globally, you may invoke the `ng` executable directly:
-
-```sh
-# Create the project
-$ ng new my-angular-app
-# Enter the new directory
-$ cd my-angular-app
-```
-
-Alternatively, you can use [`npx`](https://www.npmjs.com/package/npx), which is included with all modern `npm` versions, to avoid the global installation:
-
-<Aside>
-
-**Note:** All modern versions of `npm` already include the `npx` executable. You do not need to install anything for this approach.
-
-</Aside>
-
-```sh
-# Create the project
-$ npx @angular/cli new my-angular-app
-# Enter the new directory
-$ cd my-angular-app
-```
-
-With both approaches, the Angular CLI will prompt you for customization choices. Your answers _will not_ affect the rest of this tutorial, so please feel free to select what's ideal for your project.
-
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). You can then push your new application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Pages by going to the [Cloudflare dashboard](https://dash.cloudflare.com/) and clicking the "Create a project" button.
-
-You will be asked to authorize access to your GitHub account, if you haven't already done so. Cloudflare needs this so that it can monitor and deploy your projects from source. You may narrow access to specific repositories if you prefer; however, you will have to update this list as you attach more repositories to Cloudflare Pages.
-
-Select the new GitHub repository that you created above and, in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value                            |
-| -------------------- | -------------------------------- |
-| Production branch    | `main`                           |
-| Build command        | `npm run build -- -c production` |
-| Build directory      | `dist/my-angular-app`            |
-
-</TableLayout>
-
-Optionally, you can customize the `Project Name` setting. It defaults to the repository's name, but it does not need to match. This value is assigned as your `pages.dev` subdomain.
-
-#### Angular CLI Configuration
-
-Angular CLI expects to build and manage multiple projects by default.
-
-When we generated a new project, we called it "my-angular-app" which means that Angular CLI created an `angular.json` file with a `"my-angular-app"` configuration key under the `"projects"` block. The CLI does this to prepare your workspace for new projects and configurations to be added at any point in time. It should look similar to this:
-
-```js
-// angular.json
-{
-  // ...
-  "projects": {
-    "my-angular-app": {
-      "projectType": "application",
-      // ...
-      "architect": {
-        "build": {
-          "builder": "@angular-devkit/build-angular:browser",
-          "options": {
-            "outputPath": "dist/my-angular-app",
-            "index": "src/index.html",
-            // ...
-          }
-        }
-      }
-    }
-  }
-}
-```
-
-You'll notice that there's an `outputPath` option within the `projects.my-angular-app.architect.build` object. This value tells Angular CLI where to place the "my-angular-app" project's output files. By default, it is `dist/my-angular-app` which is reflected in the "Build directory" setting of the Pages configuration.
-
-Of course, you can modify this `outputPath` value – but you must remember to update the Pages settings, too!
-
-### Finalize Setup
-
-Once you've configured your site, click the "Save and Deploy" button!
-
-You'll see your first deploy pipeline in progress. Pages installs all dependencies – including Angular CLI – and builds the project as specified.
-
-<Aside>
-
-**Note:** For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`.
-
-Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
-
-Additionally, you'll have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project _with a real URL_ before deploying them to production.
-
-## Learn more
-
-Congratulations! You've deployed your Angular CLI site to Cloudflare Pages!
-
-To learn more about what you can do with the platform, [check out our How To section](/how-to).
diff --git a/products/pages/src/content/how-to/deploy-anything.md b/products/pages/src/content/how-to/deploy-anything.md
deleted file mode 100644
index 37ad69a6e26..00000000000
--- a/products/pages/src/content/how-to/deploy-anything.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Deploying your site
-
-We support deploying any static HTML website to Cloudflare Pages. If you manage your website without using a framework or static site generator, or if your framework isn't listed in our [How-To](/how-to) section, you can still deploy it using this guide.
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). Once you've created a new repository, you can push your local application to GitHub:
-
-```sh
-$ git remote add origin https://github.com/yourgithubusername/githubrepo
-$ git branch -M main
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Cloudflare Pages by going to the dashboard and creating a new site. Select your new GitHub repository that you created above, and in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option     | Value              |
-| ------------------------ | ------------------ |
-| Production branch        | `main`             |
-| Build command (optional) | `yourbuildcommand` |
-| Build directory          | `yourbuilddir`     |
-
-</TableLayout>
-
-Unlike many of our How-To guides, the build command and build directory for your site are going to be completely custom. If you don't use a build command for your site, you can omit that field.
-
-Once you've configured your site, you can begin your first deploy. Your custom build command (if provided) will run, and Pages will deploy your static site.
-
-<Aside>
-
-For the complete guide to deploying your first site to Cloudflare Pages, check out [our Getting Started guide](/getting-started).
-
-</Aside>
-
-Once you've deployed your site, you'll receive a unique subdomain for your project on `pages.dev`. Cloudflare Pages will automatically rebuild your project and deploy it. You'll also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
-
-## Learn more
-
-Congrats, you've deployed your custom site on Cloudflare Pages! To learn more about what you can do with the platform, [check out our How-To section](/how-to).
diff --git a/products/pages/src/content/how-to/elderjs.md b/products/pages/src/content/how-to/elderjs.md
deleted file mode 100644
index 53602eb2541..00000000000
--- a/products/pages/src/content/how-to/elderjs.md
+++ /dev/null
@@ -1,70 +0,0 @@
-# Deploy an Elder.js site
-
-[Elder.js](https://elderguide.com/tech/elderjs/) is an SEO-focused framework for building static sites with [Svelte](/how-to/svelte).
-
-In this guide, you'll create a new Elder.js application and deploy it using Cloudflare Pages.
-
-## Setting up a new project
-
-Create a new project using [`npx degit Elderjs/template`](https://docs.npmjs.com/cli/v6/commands/npm-init), giving it a project name:
-
-```sh
-$ npx degit Elderjs/template elderjs-app
-$ cd elderjs-app
-```
-
-The Elder.js template includes a number of pages and examples showing how to build your static site, but by simply generating the project, it's already ready to be deployed to Cloudflare Pages.
-
-## Creating a GitHub repository
-
-Create a new GitHub repository by visiting [repo.new](https://repo.new). You can then push your application to GitHub:
-
-```sh
-# setup the local repository
-$ git init
-$ git remote add origin https://github.com/<username>/<repo>
-$ git branch -M main
-
-# commit all initial files
-$ git add -A
-$ git commit -m "initial commit"
-
-# send commit to new GitHub repo
-$ git push -u origin main
-```
-
-## Deploying with Cloudflare Pages
-
-You can deploy your site to Pages by going to the [Cloudflare dashboard](https://dash.cloudflare.com/) and clicking the "Create a project" button.
-
-You will be asked to authorize access to your GitHub account, if you haven't already done so. Cloudflare needs this so that it can monitor and deploy your projects from source. You may narrow access to specific repositories if you prefer; however, you will have to manually update this list [within your GitHub settings](https://github.com/settings/installations) as you wish to attach more repositories to Cloudflare Pages.
-
-Select the new GitHub repository that you created above and, in the configuration section, provide the following information:
-
-<TableLayout>
-
-| Configuration option | Value             |
-| -------------------- | ---------------   |
-| Production branch    | `main`            |
-| Build command        | `npm run build`   |
-| Build directory      | `public`          |
-
-</TableLayout>
-
-Optionally, you can customize the `Project Name` setting. It defaults to the repository's name, but it does not need to match. This value is assigned as your `pages.dev` subdomain.
-
-### Finalize Setup
-
-Once you've configured your site, click the "Save and Deploy" button!
-
-You'll see your first deploy pipeline in progress. Pages installs all dependencies and builds the project as specified.
-
-Cloudflare Pages will automatically rebuild your project and deploy it on every new pushed commit.
-
-Additionally, you'll have access to [preview deployments](/platform/preview-deployments), which repeat the build-and-deploy process for pull requests. With these, you can preview changes to your project _with a real URL_ before deploying them to production.
-
-## Learn more
-
-Congratulations! You've deployed your Elder.js site to Cloudflare Pages!
-
-To learn more about what you can do with the platform, [check out our How To section](/how-to).
diff --git a/products/pages/src/content/how-to/index.md b/products/pages/src/content/how-to/index.md
index fd858db655d..0f708ac1644 100644
--- a/products/pages/src/content/how-to/index.md
+++ b/products/pages/src/content/how-to/index.md
@@ -1,11 +1,11 @@
 ---
 type: overview
-hideChildren: true
 order: 3
+pcx-content-type: navigation
 ---
 
 import ContentTable from "../components/content-table"
 
-# How To
+# How to
 
-<ContentTable path="how-to" />
\ No newline at end of file
+<ContentTable path="how-to" />
diff --git a/products/pages/src/content/how-to/media/tunnel.png b/products/pages/src/content/how-to/media/tunnel.png
new file mode 100644
index 00000000000..35e39123bed
Binary files /dev/null and b/products/pages/src/content/how-to/media/tunnel.png differ
diff --git a/products/pages/src/content/how-to/npm-private-registry.md b/products/pages/src/content/how-to/npm-private-registry.md
index 247d739fd0d..91c7c5e8b0c 100644
--- a/products/pages/src/content/how-to/npm-private-registry.md
+++ b/products/pages/src/content/how-to/npm-private-registry.md
@@ -1,12 +1,16 @@
-# Install Private Packages
+---
+pcx-content-type: how-to
+---
+
+# Install private packages
 
 Cloudflare Pages supports custom package registries, allowing you to include private dependencies in your application. While this walkthrough focuses specifically on [npm](https://www.npmjs.com/), the Node package manager and registry, the same approach can be applied to other registry tools.
 
-We'll be adjusting the [Environment Variables](/platform/build-configuration#environment-variables) in our Pages project's settings. An existing website can be modified at any time, but new projects can be initialized with these settings, too. Either way, altering the project settings won't be reflected ***until its next deployment***.
+You will be be adjusting the [environment variables](/platform/build-configuration#environment-variables) in your Pages project's **Settings**. An existing website can be modified at any time, but new projects can be initialized with these settings, too. Either way, altering the project settings will not be reflected until its next deployment.
 
 <Aside type="warning">
 
-**Important:** Be sure to trigger a new deployment after changing any settings!
+**Important:** Be sure to trigger a new deployment after changing any settings.
 
 </Aside>
 
@@ -15,58 +19,58 @@ We'll be adjusting the [Environment Variables](/platform/build-configuration#env
 
 Every package registry should have a means of issuing new access tokens. Ideally, you should create a new token specifically for Pages, as you would with any other CI/CD platform.
 
-With npm, you can [create and view tokens through its website](https://docs.npmjs.com/creating-and-viewing-access-tokens) or you can use the `npm` CLI. If you have the CLI set up locally and are authenticated, you can run the following commands:
+With npm, you can [create and view tokens through its website](https://docs.npmjs.com/creating-and-viewing-access-tokens) or you can use the `npm` CLI. If you have the CLI set up locally and are authenticated, run the following commands in your terminal:
 
 ```sh
-# verify the current npm user is correct
+# Verify the current npm user is correct
 $ npm whoami
 
-# create a readonly token
+# Create a readonly token
 $ npm token create --read-only
 #-> Enter password, if prompted
 #-> Enter 2FA code, if configured
 ```
 
-You'll end up with a read-only token that looks like a UUID string. Save this value for a later step.
+This will produce a read-only token that looks like a UUID string. Save this value for a later step.
 
 
-## Private Modules on the npm Registry
+## Private modules on the npm registry
 
-When your application is **only** using private modules from the npm registry, then this section is for you!
+The following section applies to users with applications that are only using private modules from the npm registry.
 
-Simply add a new [Environment Variable](/platform/build-configuration#environment-variables) named `NPM_TOKEN` and paste the [read-only token you created](#registry-access-token) as its value.
+In your Pages project's **Settings** > **Environment variables**, add a new [environment variable](/platform/build-configuration#environment-variables) named `NPM_TOKEN` to the **Production** and **Preview** environments and paste the [read-only token you created](#registry-access-token) as its value.
 
 <Aside type="warning">
 
-**Important:** Add the `NPM_TOKEN` variable to both the "Production" and "Preview" environments.
+**Important:** Add the `NPM_TOKEN` variable to both the **Production** and **Preview** environments.
 
 </Aside>
 
-By default, `npm` looks for an environment variable named `NPM_TOKEN` and _because_ we didn't define a [custom registry endpoint](#custom-registry-endpoints), the npm registry is assumed. Local development should continue to work as expected, provided that you and your teammates are authenticated with npm accounts (see `npm whoami` and `npm login`) that have been granted access to the private package(s).
+By default, `npm` looks for an environment variable named `NPM_TOKEN` and because you did not define a [custom registry endpoint](#custom-registry-endpoints), the npm registry is assumed. Local development should continue to work as expected, provided that you and your teammates are authenticated with npm accounts (see `npm whoami` and `npm login`) that have been granted access to the private package(s).
 
 
-## Custom Registry Endpoints
+## Custom registry endpoints
 
 When multiple registries are in use, a project will need to define its own root-level [`.npmrc`](https://docs.npmjs.com/cli/v7/configuring-npm/npmrc) configuration file. An example `.npmrc` file may look like this:
 
 ```ini
 @foobar:registry=https://npm.pkg.github.com
-//registry.npmjs.org/:_authToken=$TOKEN_FOR_NPM
-//npm.pkg.github.com/:_authToken=$TOKEN_FOR_GITHUB
+//registry.npmjs.org/:_authToken=${TOKEN_FOR_NPM}
+//npm.pkg.github.com/:_authToken=${TOKEN_FOR_GITHUB}
 ```
 
 Here, all packages under the `@foobar` scope are directed towards the GitHub Packages registry. Then the registries are assigned their own access tokens via their respective environment variable names.
 
 <Aside>
 
-**Note:** You only need to define an Access Token for the npm registry (see `TOKEN_FOR_NPM` in our example) if it is hosting private packages that your application requires.
+**Note:** You only need to define an Access Token for the npm registry (refer to `TOKEN_FOR_NPM` in our example) if it is hosting private packages that your application requires.
 
 </Aside>
 
-Your Pages project must then have the matching [Environment Variables](/platform/build-configuration#environment-variables) defined for all environments. In our example, that means `TOKEN_FOR_NPM` must contain [the read-only npm token](#registry-access-token) value and `TOKEN_FOR_GITHUB` must contain its own [personal access token](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token#creating-a-token).
+Your Pages project must then have the matching [environment variables](/platform/build-configuration#environment-variables) defined for all environments. In our example, that means `TOKEN_FOR_NPM` must contain [the read-only npm token](#registry-access-token) value and `TOKEN_FOR_GITHUB` must contain its own [personal access token](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token#creating-a-token).
 
 
-### Managing Multiple Environments
+### Managing multiple environments
 
 In the event that your local development no longer works with your new `.npmrc` file, you will need to add some additional changes:
 
@@ -77,11 +81,11 @@ In the event that your local development no longer works with your new `.npmrc`
 3. Create a new `is-pages.js` file in your project's root directory:
 
     ```js
-    // Pages always has `NODE_VERSION` defined
-    if (process.env.NODE_VERSION == null) process.exit(1);
+    // Pages always has `CF_PAGES` defined
+    if (!process.env.CF_PAGES) process.exit(1);
     ```
 
-4. In your `package.json` file, create a new `"preinstall"` script, which will rename the `.npmrc.pages` file to `.npmrc` **only** during the Pages build process:
+4. In your `package.json` file, create a new `"preinstall"` script, which will rename the `.npmrc.pages` file to `.npmrc` only during the Pages build process:
 
     ```js
     // package.json
diff --git a/products/pages/src/content/how-to/preview-with-cloudflare-tunnel.md b/products/pages/src/content/how-to/preview-with-cloudflare-tunnel.md
new file mode 100644
index 00000000000..eb5b3259092
--- /dev/null
+++ b/products/pages/src/content/how-to/preview-with-cloudflare-tunnel.md
@@ -0,0 +1,56 @@
+---
+pcx-content-type: how-to
+---
+
+# Preview Local Projects with Cloudflare Tunnel
+
+[Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) runs a lightweight daemon (`cloudflared`) in your infrastructure that establishes outbound connections (Tunnels) between your origin web server and the Cloudflare edge. In practical terms, you can use Cloudflare Tunnel to allow remote access to services running on your local machine. It is an alternative to popular tools like [Ngrok](https://ngrok.com), and provides free, long-running tunnels via the [TryCloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/trycloudflare) service.
+
+While Cloudflare Pages provides unique [deploy preview URLs](/platform/preview-deployments) for new branches and commits on your projects, Cloudflare Tunnel can be used to provide access to locally running applications and servers during the development process. In this guide, you will install Cloudflare Tunnel, and create a new tunnel to provide access to a locally running application. You will need a Cloudflare account to begin using Cloudflare Tunnel.
+
+## Installing Cloudflare Tunnel
+
+Cloudflare Tunnel can be installed on Windows, Linux, and macOS. To learn about installing Cloudflare Tunnel, refer to the ["Install cloudflared"](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation) page in the Cloudflare for Teams documentation.
+
+Confirm that `cloudflared` is installed correctly by running `cloudflared --version` in your command line:
+
+```sh
+$ cloudflared --version
+cloudflared version 2021.5.9 (built 2021-05-21-1541 UTC)
+```
+
+## Run a local service
+
+The easiest way to get up and running with Cloudflare Tunnel is to have an application running locally, such as a [React](/framework-guides/deploy-a-react-application) or [Svelte](/framework-guides/deploy-a-svelte-site) site. When you are developing an application with these frameworks, they will often make use of a `npm run develop` script, or something similar, which mounts the application and runs it on a `localhost` port. For example, the popular `create-react-app` tool runs your in-development React application on port 3000, making it accessible at the `http://localhost:3000` address.
+
+## Start a Cloudflare Tunnel
+
+With a local development server running, a new Cloudflare Tunnel can be instantiated by running `cloudflared tunnel` in a new command line window, passing in the `--url` flag with your `localhost` URL and port. `cloudflared` will output logs to your command line, including a banner with a tunnel URL:
+
+```sh
+$ cloudflared tunnel --url http://localhost:3000
+2021-07-15T20:11:29Z INF Cannot determine default configuration path. No file [config.yml config.yaml] in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /etc/cloudflared /usr/local/etc/cloudflared]
+2021-07-15T20:11:29Z INF Version 2021.5.9
+2021-07-15T20:11:29Z INF GOOS: linux, GOVersion: devel +11087322f8 Fri Nov 13 03:04:52 2020 +0100, GoArch: amd64
+2021-07-15T20:11:29Z INF Settings: map[url:http://localhost:3000]
+2021-07-15T20:11:29Z INF cloudflared will not automatically update when run from the shell. To enable auto-updates, run cloudflared as a service: https://developers.cloudflare.com/argo-tunnel/reference/service/
+2021-07-15T20:11:29Z INF Initial protocol h2mux
+2021-07-15T20:11:29Z INF Starting metrics server on 127.0.0.1:42527/metrics
+2021-07-15T20:11:29Z WRN Your version 2021.5.9 is outdated. We recommend upgrading it to 2021.7.0
+2021-07-15T20:11:29Z INF Connection established connIndex=0 location=ATL
+2021-07-15T20:11:32Z INF Each HA connection's tunnel IDs: map[0:cx0nsiqs81fhrfb82pcq075kgs6cybr86v9vdv8vbcgu91y2nthg]
+2021-07-15T20:11:32Z INF +-------------------------------------------------------------+
+2021-07-15T20:11:32Z INF |  Your free tunnel has started! Visit it:                    |
+2021-07-15T20:11:32Z INF |    https://seasonal-deck-organisms-sf.trycloudflare.com     |
+2021-07-15T20:11:32Z INF +-------------------------------------------------------------+
+```
+
+In this example, the randomly-generated URL `https://seasonal-deck-organisms-sf.trycloudflare.com` has been created and assigned to your tunnel instance. Visiting this URL in a browser will show the application running, with requests being securely forwarded through Cloudflare's edge network, through the tunnel running on your machine, to `localhost:3000`:
+
+![Cloudflare Tunnel example](./media/tunnel.png)
+
+## Next Steps
+
+Cloudflare Tunnel can be configured in a variety of ways and can be used beyond providing access to your in-development applications. For example, you can provide `cloudflared` with a [configuration file](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/config) to add more complex routing and tunnel setups that go beyond a simple `--url` flag. You can also [attach a Cloudflare DNS record](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns) to a domain or subdomain for an easily accessible, long-lived tunnel to your local machine.
+
+Finally, by incorporating Cloudflare Access, you can provide [secure access to your tunnels](https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-apps) without exposing your entire server, or compromising on security. Refer to the [Cloudflare for Teams documentation](https://developers.cloudflare.com/cloudflare-one/) to learn more about what you can do with Cloudflare's entire suite of Zero Trust tools.
diff --git a/products/pages/src/content/index.md b/products/pages/src/content/index.md
index b7759f3b56c..a9f95a783d1 100644
--- a/products/pages/src/content/index.md
+++ b/products/pages/src/content/index.md
@@ -2,30 +2,35 @@
 title: Overview
 order: 0
 type: overview
+pcx-content-type: landing-page
 ---
 
 <ContentColumn>
 
 # Cloudflare Pages documentation
 
-Deploy your dynamic frontend applications using Cloudflare Pages! Pages are super fast, always up-to-date, and deployed directly from your GitHub account.
+Deploy your dynamic frontend applications using Cloudflare Pages. Pages are super fast, always up-to-date, and deployed directly from your GitHub account.
 
-Get started deploying your first site using our starter guide below, or check out our examples page to explore the vast ecosystem of tools and framework that we support on the platform.
+Get started deploying your first site using our **Get started** guide below, or refer to our **Framework guides** page to explore the vast ecosystem of tools and frameworks that Pages supports.
 
-<Link to="/getting-started" className="Button Button-is-docs-primary">Get started</Link> &nbsp;&nbsp; <Link to="/how-to" className="Button Button-is-docs-secondary">See what you can build</Link> &nbsp;&nbsp; <Link to="https://pages.dev" className="Button Button-is-docs-secondary">Your Cloudflare Pages dashboard</Link>
+<ButtonGroup>
+  <Button type="primary" href="/get-started">Get started</Button>
+  <Button type="secondary" href="/framework-guides">See the framework guides</Button>
+  <Button type="secondary" href="https://pages.dev">Your Cloudflare Pages dashboard</Button>
+</ButtonGroup>
 
 ## Popular pages
 
-- [Deploy a React application](/how-to/deploy-a-react-application)
+- [Deploy a React application](/framework-guides/deploy-a-react-application)
 - [Build configuration](/platform/build-configuration)
 
 --------------------------------
 
 ## Community
 
-You can [connect with the Pages community on Discord](https://discord.gg/cloudflaredev) to ask questions, show off what you’re building, and discuss the platform with other developers. 
+You can [connect with the Pages community on Discord](https://discord.gg/cloudflaredev) to ask questions, show off what you are building, and discuss the platform with other developers. 
 
-[Follow @CloudflareDev on Twitter](https://twitter.com/cloudflaredev) to learn about product announcements, new tutorials, and what's new in Cloudflare Pages.
+[Follow @CloudflareDev on Twitter](https://twitter.com/cloudflaredev) to learn about product announcements, new tutorials, and what is new in Cloudflare Pages.
 
 ---
 
diff --git a/products/pages/src/content/migrations/index.md b/products/pages/src/content/migrations/index.md
index 908c9f6ba20..da041b7c94a 100644
--- a/products/pages/src/content/migrations/index.md
+++ b/products/pages/src/content/migrations/index.md
@@ -2,10 +2,11 @@
 type: overview
 hideChildren: true
 order: 4
+pcx-content-type: navigation
 ---
 
 import ContentTable from "../components/content-table"
 
-# Migrations
+# Migration guides
 
 <ContentTable path="migrations" />
diff --git a/products/pages/src/content/migrations/migrating-from-firebase.md b/products/pages/src/content/migrations/migrating-from-firebase.md
index 6b82f1b64f7..3ab2d497d0f 100644
--- a/products/pages/src/content/migrations/migrating-from-firebase.md
+++ b/products/pages/src/content/migrations/migrating-from-firebase.md
@@ -1,17 +1,18 @@
 ---
 updated: 2020-09-28
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Migrating from Firebase
 
-In this tutorial, you'll learn how to migrate an existing Firebase application to Cloudflare Pages. You should already have an existing project deployed on Firebase that you'd like to host on Cloudflare Pages.
+In this tutorial, you will learn how to migrate an existing Firebase application to Cloudflare Pages. You should already have an existing project deployed on Firebase that you would like to host on Cloudflare Pages.
 
 ## Finding your build command and build directory
 
-To move your application to Cloudflare Pages, you'll need to find your build command and build directory.
+To move your application to Cloudflare Pages, you will need to find your build command and build directory.
 
-You'll use these to tell Cloudflare Pages how to deploy your project. If you've been deploying manually from your local machine using the `firebase` command-line tool, the `firebase.json` configuration file should include a `public` key that will be your build directory:
+You will use these to tell Cloudflare Pages how to deploy your project. If you have been deploying manually from your local machine using the `firebase` command-line tool, the `firebase.json` configuration file should include a `public` key that will be your build directory:
 
 ```json
 ---
@@ -22,20 +23,20 @@ header: firebase.json
 }
 ```
 
-Firebase Hosting doesn't ask for your build command, so if you're running a standard JavaScript set up, you'll probably be using `npm build` or a command specific to the framework or tool you're using (e.g. `ng build`).
+Firebase Hosting does not ask for your build command, so if you are running a standard JavaScript set up, you will probably be using `npm build` or a command specific to the framework or tool you are using (e.g., `ng build`).
 
-Once you've found your build directory and build command, you can move your project to Cloudflare Pages.
+After you have found your build directory and build command, you can move your project to Cloudflare Pages.
 
 ## Creating a new Pages project
 
-If you haven't pushed your static site to GitHub before, you should do so before continuing. This will also give you access to great features like automatic deployments, and [deployment previews](/platform/preview-deployments).
+If you have not pushed your static site to GitHub before, you should do so before continuing. This will also give you access to features like automatic deployments, and [deployment previews](/platform/preview-deployments).
 
-You can create a new repo by visiting [repo.new](https://repo.new) and following the instructions to push your project up to GitHub.
+You can create a new repository by visiting [repo.new](https://repo.new) and following the instructions to push your project up to GitHub.
 
-You can use the ["Getting started" guide](/getting-started) to add your project to Cloudflare Pages, using the **build command** and **build directory** that you saved earlier.
+Use the [Get started guide](/get-started) to add your project to Cloudflare Pages, using the **build command** and **build directory** that you saved earlier.
 
 ## Cleaning up your old application and assigning the domain
 
-Once you've deployed your application, you should go into the Firebase dashboard and remove your old Firebase project. In your Cloudflare DNS settings for your domain, make sure that you've updated the CNAME record for your domain from Firebase to Cloudflare Pages.
+Once you have deployed your application, go to the Firebase dashboard and remove your old Firebase project. In your Cloudflare DNS settings for your domain, make sure to update the CNAME record for your domain from Firebase to Cloudflare Pages.
 
-Congrats! You've migrated your Firebase project to Cloudflare Pages.
+By completing this guide, you have successfully migrated your Firebase project to Cloudflare Pages.
diff --git a/products/pages/src/content/migrations/migrating-from-netlify/index.md b/products/pages/src/content/migrations/migrating-from-netlify/index.md
index bf30bb18765..961522f496b 100644
--- a/products/pages/src/content/migrations/migrating-from-netlify/index.md
+++ b/products/pages/src/content/migrations/migrating-from-netlify/index.md
@@ -1,44 +1,47 @@
 ---
 updated: 2020-09-22
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Migrating from Netlify to Pages
 
-In this tutorial, you'll learn how to deploy your Netlify application to Cloudflare Pages.
+In this tutorial, you will learn how to deploy your Netlify application to Cloudflare Pages.
+
+<Aside type="note">
+
+Features such as Netlify's Forms and Serverless Functions are currently not supported in Cloudflare Pages. Cloudflare Pages does not directly support HTTP header customization, but it can be done through Workers. Refer to the ["Add custom HTTP headers"](/how-to/add-custom-http-headers) guide for more information.
 
-<Aside>
-You should already have an existing project deployed on Netlify that you'd like to host on Cloudflare Pages. Features such as Netlify's Forms and Serverless Functions are currently not supported in Cloudflare Pages.
 </Aside>
 
 ## Finding your build command and build directory
 
-To move your application to Cloudflare Pages, you'll need to find your build command and build directory. Cloudflare Pages will use this information to build your application and deploy it.
+To move your application to Cloudflare Pages, find your build command and build directory. Cloudflare Pages will use this information to build and deploy your application.
 
 In your Netlify Dashboard, find the project that you want to deploy. It should be configured to deploy from a GitHub Repo.
 
 ![Selecting a site in the Netlify Dashboard](./netlify-deploy-1.png)
 
-Inside of your site dashboard, select "Site Settings", and then "Build & Deploy".
+Inside of your site dashboard, select **Site Settings**, and then **Build & Deploy**.
 
 ![Selecting Site Settings in site dashboard](./netlify-deploy-2.png)
 
 ![Selecting Build and Deploy in sidebar](./netlify-deploy-3.png)
 
-In the "Build & deploy" tab, find the "Build settings" panel, which will have the **Build command** and **Publish directory** fields. Save these for deploying to Cloudflare Pages! In the below image, my **Build command** is `yarn build`, and my **Publish directory** is `build/`.
+In the **Build & Deploy** tab, find the **Build settings** panel, which will have the **Build command** and **Publish directory** fields. Save these for deploying to Cloudflare Pages. In the below image, **Build command** is `yarn build`, and **Publish directory** is `build/`.
 
 ![Finding the "Build command" and "Publish directory" fields](./netlify-deploy-4.png)
 
 ## Creating a new Pages project
 
-Once you've found your build directory and build command, you can move your project to Cloudflare Pages.
+Once you have found your build directory and build command, you can move your project to Cloudflare Pages.
 
-The [Getting started guide](/getting-started) will show you how to add your GitHub project to Cloudflare Pages.
+The [Get started guide](/get-started) will instruct you how to add your GitHub project to Cloudflare Pages.
 
 If you choose to use a custom domain for your Pages, you can set it to the same custom domain as your currently deployed Netlify application. When Pages finishes the initial deploy of your site, you will need to delete the Workers application to start sending requests to Cloudflare Pages.
 
 ## Cleaning up your old application and assigning the domain
 
-In your DNS settings for your domain, make sure that you've updated the CNAME record for your domain from Netlify to Cloudflare Pages. With your DNS record updated, requests will go to your Pages application.
+In **DNS** on the Cloudflare dashboard, review that you have updated the CNAME record for your domain from Netlify to Cloudflare Pages. With your DNS record updated, requests will go to your Pages application.
 
-Congrats! You've migrated your Netlify project to Cloudflare Pages.
+With the above steps completed, you have successfully migrated your Netlify project to Cloudflare Pages.
diff --git a/products/pages/src/content/migrations/migrating-from-vercel/index.md b/products/pages/src/content/migrations/migrating-from-vercel/index.md
index 42a1286e1f7..9222633049a 100644
--- a/products/pages/src/content/migrations/migrating-from-vercel/index.md
+++ b/products/pages/src/content/migrations/migrating-from-vercel/index.md
@@ -1,42 +1,45 @@
 ---
 updated: 2020-09-23
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Migrating from Vercel to Pages
 
-In this tutorial, you'll learn how to deploy your Vercel application to Cloudflare Pages.
+In this tutorial, you will learn how to deploy your Vercel application to Cloudflare Pages.
+
+<Aside type="note">
+
+You should already have an existing project deployed on Vercel that you would like to host on Cloudflare Pages. Features such as Vercel's serverless functions are currently not supported in Cloudflare Pages.
 
-<Aside>
-You should already have an existing project deployed on Vercel that you'd like to host on Cloudflare Pages. Features such as Vercel's serverless functions are currently not supported in Cloudflare Pages.
 </Aside>
 
 ## Finding your build command and build directory
 
-To move your application to Cloudflare Pages, you'll need to find your build command and build directory. Cloudflare Pages will use this information to build your application and deploy it.
+To move your application to Cloudflare Pages, you will need to find your build command and build directory. Cloudflare Pages will use this information to build your application and deploy it.
 
-In your Vercel Dashboard, find the project that you want to deploy. It should be configured to deploy from a GitHub Repo.
+In your Vercel Dashboard, find the project that you want to deploy. It should be configured to deploy from a GitHub repository.
 
 ![Selecting a site in the Vercel Dashboard](./vercel-deploy-1.png)
 
-Inside of your site dashboard, select "Settings".
+Inside of your site dashboard, select **Settings**.
 
 ![Selecting Site Settings in site dashboard](./vercel-deploy-2.png)
 
-Find the "Build & Development settings" panel, which will have the **Build Command** and **Output Directory** fields. If you're using a framework, these values may not be filled in, but will show the defaults used by the framework. Save these for deploying to Cloudflare Pages! In the below image, my **Build Command** is `npm run build`, and my **Output Directory** is `build`.
+Find the **Build & Development settings** panel, which will have the **Build Command** and **Output Directory** fields. If you are using a framework, these values may not be filled in, but will show the defaults used by the framework. Save these for deploying to Cloudflare Pages. In the below image, the **Build Command** is `npm run build`, and the **Output Directory** is `build`.
 
 ![Finding the "Build Command" and "Output Directory" fields](./vercel-deploy-3.png)
 
 ## Creating a new Pages project
 
-Once you've found your build directory and build command, you can move your project to Cloudflare Pages.
+After you have found your build directory and build command, you can move your project to Cloudflare Pages.
 
-The [Getting started guide](/getting-started) will show you how to add your GitHub project to Cloudflare Pages.
+The [Get started guide](/get-started) will instruct you how to add your GitHub project to Cloudflare Pages.
 
 If you choose to use a custom domain for your Pages, you can set it to the same custom domain as your currently deployed Vercel application. When Pages finishes the initial deploy of your site, you will need to delete the Workers application to start sending requests to Cloudflare Pages.
 
 ## Cleaning up your old application and assigning the domain
 
-In your DNS settings for your domain, make sure that you've updated the CNAME record for your domain from Vercel to Cloudflare Pages. With your DNS record updated, requests will go to your Pages application.
+In your DNS settings for your domain, make sure that you have updated the CNAME record for your domain from Vercel to Cloudflare Pages. With your DNS record updated, requests will go to your Pages application.
 
-Congrats! You've migrated your Vercel project to Cloudflare Pages.
+By completing this guide, you have successfully migrated your Vercel project to Cloudflare Pages.
diff --git a/products/pages/src/content/migrations/migrating-from-workers/index.md b/products/pages/src/content/migrations/migrating-from-workers/index.md
index 48504db3d37..51ec0a286bd 100644
--- a/products/pages/src/content/migrations/migrating-from-workers/index.md
+++ b/products/pages/src/content/migrations/migrating-from-workers/index.md
@@ -1,36 +1,37 @@
 ---
 updated: 2020-08-13
 difficulty: Beginner
+pcx-content-type: tutorial
 ---
 
 # Migrating from Workers Sites to Pages
 
-In this tutorial, you'll learn how to migrate an existing [Cloudflare Workers Sites](https://workers.cloudflare.com/sites) application to Cloudflare Pages.
+In this tutorial, you will learn how to migrate an existing [Cloudflare Workers Sites](https://workers.cloudflare.com/sites) application to Cloudflare Pages.
 
 As a prerequisite, you should have a Cloudflare Workers Sites project, created with [Wrangler](https://github.com/cloudflare/wrangler).
 
-Cloudflare Pages provides built-in defaults for every aspect of serving your site. Currently, you can't port custom behavior in your Workers script—such as custom caching logic—over to your Cloudflare Pages, so if you need that behavior, you should keep using your Cloudflare Workers application.
+Cloudflare Pages provides built-in defaults for every aspect of serving your site. Currently, you cannot port custom behavior in your Workers script — such as custom caching logic — over to your Cloudflare Pages. If you need that behavior, keep using your Cloudflare Workers application.
 
-If you're building a straightforward static site, and haven't ever considered adding custom behavior to our Workers Sites templates, moving to Pages is a great fit. You'll get added benefits like [preview deployments](/platform/preview-deployments) and automatic branch deploys with no extra configuration needed.
+If you did not need to customize a Workers Sites template, migrating your static site to Cloudflare Pages will be easy to do. You will be able to access features like [preview deployments](/platform/preview-deployments) and automatic branch deploys with no extra configuration needed.
 
 ## Removing unnecessary code
 
 Workers Sites projects consist of the following pieces:
 
 1. An application built with a [static site tool](/how-to) or a static collection of HTML, CSS and JavaScript
-2. (If using a static site tool) a build directory (called `bucket` in `wrangler.toml`) where the static project builds HTML, CSS, and JS
+2. If using a static site tool, a build directory (called `bucket` in `wrangler.toml`) where the static project builds HTML, CSS, and JS
 3. A Workers application for serving that directory
 
-When moving to Cloudflare Pages, you can remove the Workers application, and any associated `wrangler.toml` configuration files or build output. Instead, you should write down both your **build command** (if you have one), and the `bucket` field, or **build directory**, from `wrangler.toml`.
+When moving to Cloudflare Pages, remove the Workers application, and any associated `wrangler.toml` configuration files or build output. Instead, note and record your **build command** (if you have one), and the `bucket` field, or **build directory**, from the `wrangler.toml` file in your project's directory.
 
 ## Creating a new Pages project
 
-Once you have these written down, you can remove everything else from your application, and push the new version of your project up to GitHub. You can use the ["Getting started" guide](/getting-started) to add your project to Cloudflare Pages, using the **build command** and **build directory** that you saved earlier.
+After you have recorded your **build command** and **build directory** in a separate location, remove everything else from your application, and push the new version of your project up to GitHub. Follow the ["Get started" guide](/get-started) to add your project to Cloudflare Pages, using the **build command** and **build directory** that you saved earlier.
 
 If you choose to use a custom domain for your Pages, you can set it to the same custom domain as your currently deployed Workers application. When Pages finishes the initial deploy of your site, you will need to delete the Workers application to start sending requests to Cloudflare Pages.
 
 ## Cleaning up your old application and assigning the domain
 
-Once you've deployed your application, you should go into the [Workers dashboard](https://dash.cloudflare.com/?to=/:account/workers) and remove your old Workers project.
+After you have deployed your application, navigate to [Workers](https://dash.cloudflare.com/?to=/:account/workers) and remove your old Workers project by going to your **Workers project** > **Settings** > **Delete**.
 
-With your Workers application removed, requests will go to your Pages application. Congrats! You've migrated your Workers Sites project to Cloudflare Pages.
+With your Workers application removed, requests will go to your Pages application. By completing this guide, you have successfully migrated your Workers Sites project to Cloudflare Pages.
diff --git a/products/pages/src/content/migrations/migrating-jekyll-from-github-pages.md b/products/pages/src/content/migrations/migrating-jekyll-from-github-pages.md
new file mode 100644
index 00000000000..02d33ffa7ec
--- /dev/null
+++ b/products/pages/src/content/migrations/migrating-jekyll-from-github-pages.md
@@ -0,0 +1,149 @@
+---
+updated: 2021-07-27
+difficulty: Beginner
+pcx-content-type: tutorial
+---
+
+# Migrating a Jekyll-based site from GitHub Pages
+
+In this tutorial, you will learn how to to migrate an existing [GitHub Pages site using Jekyll](https://docs.github.com/en/pages/setting-up-a-github-pages-site-with-jekyll/about-github-pages-and-jekyll) to Cloudflare Pages. Jekyll is one of the most popular static site generators used with GitHub Pages, and migrating your GitHub Pages site to Cloudflare Pages will take a few short steps.
+
+This tutorial will guide you through:
+
+1. Adding the necessary dependencies used by GitHub Pages to your project configuration.
+2. Creating a new Cloudflare Pages site, connected to your existing GitHub repository.
+3. Building and deploying your site on Cloudflare Pages.
+4. (Optional) Migrating your custom domain.
+
+Including build times, this tutorial should take you less than 15 minutes to complete.
+
+<Aside type="note">
+
+If you have a Jekyll-based site not deployed on GitHub Pages, refer to [the Jekyll framework guide](/framework-guides/deploy-a-jekyll-site).
+
+</Aside>
+
+## Before you begin
+
+This tutorial assumes:
+
+1. You have an existing GitHub Pages site using [Jekyll](https://jekyllrb.com/)
+2. You have some familiarity with running Ruby's command-line tools, and have both `gem` and `bundle` installed.
+3. You know how to use a few basic Git operations, including `add`, `commit`, `push`, and `pull`.
+4. You have read the [Get Started](/getting-started) guide for Cloudflare Pages.
+
+If you do not have Rubygems (`gem`) or Bundler (`bundle`) installed on your machine, refer to the installation guides for [Rubygems](https://rubygems.org/pages/download) and [Bundler](https://bundler.io/).
+
+## Preparing your GitHub Pages repository
+
+<Aside type="note">
+
+If your GitHub Pages repository already has a `Gemfile` and `Gemfile.lock` present, you can skip this step entirely. The GitHub Pages environment assumes a default set of Jekyll plugins that are not explicitly specified in a `Gemfile`.
+
+</Aside>
+
+Your existing Jekyll-based repository must specify a `Gemfile` (Ruby's dependency configuration file) to allow Cloudflare Pages to fetch and install those dependencies during the [build step](/platform/build-configuration).
+
+Specifically, you will need to create a `Gemfile` and install the `github-pages` gem, which includes all of the dependencies that the GitHub Pages environment assumes.
+
+```sh
+---
+header: Create a Gemfile
+---
+$ cd my-github-pages-repo
+$ bundle init
+```
+
+Open the `Gemfile` that was created for you, and add the following line to the bottom of the file:
+
+```ruby
+---
+header: Specifying the github-pages version
+---
+gem "github-pages", "~> 215", group: :jekyll_plugins
+```
+
+Your `Gemfile` should resemble the below:
+
+```ruby
+---
+filename: Gemfile
+---
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
+
+# gem "rails"
+gem "github-pages", "~> 215", group: :jekyll_plugins
+```
+
+Run `bundle update`, which will install the `github-pages` gem for you, and create a `Gemfile.lock` file with the resolved dependency versions.
+
+```sh
+---
+header: Running bundle update
+---
+$ bundle update
+# Bundler will show a lot of output as it fetches the dependencies
+```
+
+This should complete successfully. If not, verify that you have copied the `github-pages` line above exactly, and have not commented it out with a leading `#`.
+
+You will now need to commit these files to your repository so that Cloudflare Pages can reference them in the following steps:
+
+```sh
+---
+header: Commit Gemfile and Gemfile.lock
+---
+$ git add Gemfile Gemfile.lock
+$ git commit -m "deps: added Gemfiles"
+$ git push origin main
+```
+
+## Configuring your Pages project
+
+With your GitHub Pages project now explicitly specifying its dependencies, you can start configuring Cloudflare Pages. The process is almost identical to [deploying a Jekyll site](/framework-guides/deploy-a-jekyll-site).
+
+<Aside type="note">
+
+If you are configuring your Cloudflare Pages site for the first time, refer to the [Get started guide](/get-started#connect-to-github), which explains how to connect your existing GitHub repository to Cloudflare Pages.
+
+</Aside>
+
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, provide the following information:
+
+<TableLayout>
+
+| Configuration option | Value          |
+| -------------------- | -------------- |
+| Production branch    | `main`         |
+| Build command        | `jekyll build` |
+| Build directory      | `_site`        |
+
+</TableLayout>
+
+After you have configured your site, you can begin your first deploy. You should see Cloudflare Pages installing `jekyll`, your project dependencies, and building your site, before deploying it.
+
+<Aside type="note">
+
+For the complete guide to deploying your first site to Cloudflare Pages, refer to the [Get started guide](/getting-started).
+
+</Aside>
+
+After deploying your site, you will receive a unique subdomain for your project on `*.pages.dev`. Every time you commit new code to your Jekyll site, Cloudflare Pages will automatically rebuild your project and deploy it. You will also get access to [preview deployments](/platform/preview-deployments) on new pull requests, so you can preview how changes look to your site before deploying them to production.
+
+## Migrating your custom domain
+
+If you are using a [custom domain with GitHub Pages](https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site), you must update your DNS record(s) to point at your new Cloudflare Pages deployment. This will require you to update the `CNAME` record at the DNS provider for your domain to point to `<your-pages-site>.pages.dev`, replacing `<your-username>.github.io`.
+
+Note that it may take some time for DNS caches to expire and for this change to be reflected, depending on the DNS TTL (time-to-live) value you set when you originally created the record.
+
+Refer to the [adding a custom domain](/getting-started#adding-a-custom-domain) section of the Get started guide for a list of detailed steps.
+
+## What's next?
+
+* Learn how to [customize HTTP response headers](/how-to/add-custom-http-headers) for your Pages site using Cloudflare Workers.
+* Understand how to [rollback a potentially broken deployment](/platform/rollbacks) to a previously working version.
+* [Configure redirects](/platform/redirects) so that visitors are always directed to your 'canonical' custom domain.
diff --git a/products/pages/src/content/platform/api.md b/products/pages/src/content/platform/api.md
new file mode 100644
index 00000000000..2c004088360
--- /dev/null
+++ b/products/pages/src/content/platform/api.md
@@ -0,0 +1,186 @@
+---
+order: 7
+pcx-content-type: concept
+---
+
+# REST API
+
+The [Pages API](https://api.cloudflare.com/#pages-project-properties) empowers you to build automations and integrate Pages with your development workflow. At a high level, the API endpoints let you manage deployments and builds and configure projects. Cloudflare supports [Deploy Hooks](/platform/deploy-hooks) for headless CMS deployments. Refer to the [API documentation](https://api.cloudflare.com/) for a full breakdown of object types and endpoints.
+
+## How to use the API
+
+### Get an API Key
+
+Go to the [API Tokens](https://dash.cloudflare.com/profile/api-tokens) page and copy your **Global API Key**.
+
+### Make requests
+
+Now, you can authenticate and make requests to the API using your email and key in the request headers. For example, here is an API request to get all deployments in a project.
+
+```
+curl --location --request GET 'https://api.cloudflare.com/client/v4/accounts/{account_id}/pages/projects/{project_name}/deployments' \
+--header 'X-Auth-Email: {email}' \
+--header 'X-Auth-Key: {auth_key}' \
+```
+
+Try it with one of your projects by replacing `{account_id}`, `{project_name}`, `{email}`, and `{auth_key}`. You can find your `account_id` in the [Workers dashboard](https://dash.cloudflare.com/?to=/:account/workers).
+
+## Examples
+
+The API is even more powerful when combined with Cloudflare Workers: the easiest way to deploy serverless functions on Cloudflare's global network. The following section includes three code examples on how to use the Pages API. To build and deploy these samples, refer to the [Get started guide](https://developers.cloudflare.com/workers/get-started/guide).
+
+### Triggering a new build every hour
+
+Suppose we have a CMS that pulls data from live sources to compile a static output. You can keep the static content as recent as possible by triggering new builds periodically using the API.
+
+```js
+const endpoint =
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/pages/projects/{project_name}/deployments";
+const email = "{your_email}";
+
+addEventListener("scheduled", (event) => {
+  event.waitUntil(handleScheduled(event.scheduledTime));
+});
+
+async function handleScheduled(request) {
+  const init = {
+    method: "POST",
+    headers: {
+      "content-type": "application/json;charset=UTF-8",
+      "X-Auth-Email": email,
+      "X-Auth-Key": API_KEY,
+      //We recommend you store API keys as secrets using the Workers dashboard or using Wrangler as documented here https://developers.cloudflare.com/workers/cli-wrangler/commands#secret
+    },
+  };
+
+  const response = await fetch(endpoint, init);
+  return new Response(200);
+}
+```
+
+After you have deployed the JavaScript Worker, set a cron trigger through the Workers dashboard to run this script periodically. Refer to the [Cron Triggers guide](https://developers.cloudflare.com/workers/platform/cron-triggers) for more details.
+
+### Deleting old deployments after a week
+
+Cloudflare Pages hosts and serves all project deployments on preview links. Suppose you want to keep your project private and prevent access to your old deployments. You can use the API to delete deployments after a month, so that they are no longer public online.
+
+```js
+const deployments_endpoint =
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/pages/projects/{project_name}/deployments";
+const email = "{your_email}";
+const expiration_days = 7;
+
+addEventListener("scheduled", (event) => {
+  event.waitUntil(handleScheduled(event.scheduledTime));
+});
+
+async function handleScheduled(request) {
+  const init = {
+    headers: {
+      "content-type": "application/json;charset=UTF-8",
+      "X-Auth-Email": email,
+      "X-Auth-Key": API_KEY,
+      // You should store API keys as secrets using the Workers dashboard or using Wrangler
+      // @see https://developers.cloudflare.com/workers/cli-wrangler/commands#secret
+    },
+  };
+
+  let response = await fetch(deployments_endpoint, init);
+  let deployments = await response.json();
+  let to_delete = [];
+
+  deployments.result.forEach(function (deploy) {
+    if (
+      (Date.now() - new Date(deploy.created_on)) / 86400000 >
+      expiration_days
+    ) {
+      to_delete.push(deploy.id);
+    }
+  });
+
+  const delete_request = {
+    method: "DELETE",
+    headers: {
+      "content-type": "application/json;charset=UTF-8",
+      "X-Auth-Email": email,
+      "X-Auth-Key": API_KEY,
+    },
+  };
+  for (const id of to_delete) {
+    await fetch(deployments_endpoint + "/" + id, delete_request);
+  }
+  return new Response("OK", { status: 200 });
+}
+```
+
+After you have deployed the JavaScript Worker, you can set a cron trigger through the Workers dashboard to run this script periodically. Refer to the [Cron Triggers guide](https://developers.cloudflare.com/workers/platform/cron-triggers) for more details.
+
+### Sharing project information
+
+Imagine you are working on a development team using Pages to build your websites. You would want an easy way to share deployment preview links and build status without having to share Cloudflare accounts. Using the API, you can easily share project information, including deployment status and preview links, and serve this content as HTML from a Cloudflare Worker.
+
+```js
+const deployments_endpoint =
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/pages/projects/{project_name}/deployments";
+const project_endpoint =
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/pages/projects/{project_name}";
+
+const email = "{your_email}";
+
+addEventListener("fetch", (event) => {
+  event.respondWith(handleRequest(event.request));
+});
+
+async function handleRequest(request) {
+  const init = {
+    headers: {
+      "content-type": "application/json;charset=UTF-8",
+      "X-Auth-Email": email,
+      "X-Auth-Key": API_KEY,
+      //We recommend you store API keys as secrets using the Workers dashboard or using Wrangler as documented here https://developers.cloudflare.com/workers/cli-wrangler/commands#secret
+    },
+  };
+
+  let style = `body { padding: 6em; font-family: sans-serif; } h1 { color: #f6821f }`;
+  let content = ``;
+
+  content += `<h2>Project</h2>`;
+  let response = await fetch(project_endpoint, init);
+  let project_response = await response.json();
+  content += `<p>Project Name: ${project_response.result.name}</p>`;
+  content += `<p>Project ID: ${project_response.result.id}</p>`;
+  content += `<p>Pages Subdomain: ${project_response.result.subdomain}</p>`;
+  content += `<p>Domains: ${project_response.result.domains}</p>`;
+  content += `<a href="${project_response.result.canonical_deployment.url}"><p>Latest preview: ${project_response.result.canonical_deployment.url}</p></a>`;
+
+  content += `<h2>Deployments</h2>`;
+  let d_response = await fetch(deployments_endpoint, init);
+  let deployments_response = await d_response.json();
+  deployments_response.result.forEach(function (deploy) {
+    content += `<a href="${deploy.url}"><p>Deployment: ${deploy.id}</p></a>`;
+  });
+
+  let results = `
+<!DOCTYPE html>
+<head>
+  <title>Example Pages Project</title>
+</head>
+<body>
+  <style>${style}</style>
+  <div id="container">
+  ${content}
+  </div>
+</body>`;
+  return new Response(results, {
+    headers: {
+      "content-type": "text/html;charset=UTF-8",
+    },
+  });
+}
+```
+
+## Additional information
+
+- [Pages API Docs](https://api.cloudflare.com/#pages-project-properties)
+- [Workers Getting Started Guide](https://developers.cloudflare.com/workers/get-started/guide)
+- [Workers Cron Triggers](https://developers.cloudflare.com/workers/platform/cron-triggers)
diff --git a/products/pages/src/content/platform/build-configuration.md b/products/pages/src/content/platform/build-configuration.md
index 840a7d9c2ce..2af61b39d5f 100644
--- a/products/pages/src/content/platform/build-configuration.md
+++ b/products/pages/src/content/platform/build-configuration.md
@@ -1,22 +1,34 @@
+---
+order: 2
+pcx-content-type: concept
+---
+
 # Build configuration
 
+You may tell Cloudflare Pages how your site needs to be built as well as where its output files will be located.
+
 ## Build commands and directories
 
-You should provide a build command to tell Cloudflare Pages how to build your application. For projects not listed here, consider reading the tool's documentation or framework, and submit a pull request to add it here!
+You should provide a build command to tell Cloudflare Pages how to build your application. For projects not listed here, consider reading the tool's documentation or framework, and submit a pull request to add it here.
 
 Build directories indicates where your project's build command outputs the built version of your Cloudflare Pages site. Often, this defaults to the industry-standard `public`, but you may find that you need to customize it.
 
-Below are some standard build commands and directories for popular frameworks and tools.
+## Framework presets
+
+Cloudflare maintains a list of build configurations for popular frameworks and tools. These are accessible during project creation. Below are some standard build commands and directories for popular frameworks and tools. 
+
+If you are not using a framework, you may input `exit 0` into the **Build command** field.
 
 <TableWrap>
 
-| Framework/tool               | Build command                       | Build directory             |
+| Framework/tool               | Build command                       | Build output directory      |
 | ---------------------------- | ----------------------------------- | --------------------------- |
 | Angular (Angular CLI)        | `ng build`                          | `dist`                      |
 | Brunch                       | `brunch build --production`         | `public`                    |
 | Docusaurus                   | `npm run build`                     | `build`                     |
 | Eleventy                     | `eleventy`                          | `_site`                     |
 | Ember.js                     | `ember build`                       | `dist`                      |
+| Expo                         | `expo build:web`                    | `web-build`                 |
 | Gatsby                       | `gatsby build`                      | `public`                    |
 | GitBook                      | `gitbook build`                     | `_book`                     |
 | Gridsome                     | `gridsome build`                    | `dist`                      |
@@ -38,13 +50,21 @@ Below are some standard build commands and directories for popular frameworks an
 
 ## Environment variables
 
-If your project makes use of environment variables to build your site, you can provide custom environment variables via the Pages UI.
+If your project makes use of environment variables to build your site, you can provide custom environment variables by going to **Account Home** > **Pages** > **your Pages project** > **Settings** > **Environment variables**.
+
+The following system environment variables are injected by default (but can be overridden):
+
+| Environment Variable  | Injected value                        | Example use-case                                                               |
+| --------------------- | ------------------------------------- | ------------------------------------------------------------------------------ |
+| `CF_PAGES`            | `1`                                   | Changing build behaviour when run on Pages vs locally                          |
+| `CF_PAGES_COMMIT_SHA` | `<sha1-hash-of-current-commit>`       | Passing current commit ID to error reporting e.g. Sentry                       |
+| `CF_PAGES_BRANCH`     | `<branch-name-of-current-deployment>` | Customising build based on branch e.g. disabling debug logging on `production` |
 
 ## Language support and tools
 
-Cloudflare Pages' build environment has broad support for a variety of languages, such as Ruby, Node.js, Python, PHP, and Go (and many more). 
+Cloudflare Pages' build environment has broad support for a variety of languages, such as Ruby, Node.js, Python, PHP, and Go. 
 
-If you need to use a specific version of a language, e.g. Node.js or Ruby, you can specify it by providing an associated environment variable in your build configuration, or setting the relevant file in your source code. 
+If you need to use a specific version of a language, (e.g., Node.js or Ruby) you can specify it by providing an associated environment variable in your build configuration, or setting the relevant file in your source code. 
 
 Here are the pinned versions for tools included in the Cloudflare Workers build environment, and how to override them as relevant:
 
@@ -55,10 +75,11 @@ Here are the pinned versions for tools included in the Cloudflare Workers build
 | Erlang    | 21              |                      |                           |
 | Go        | 1.12            | `GO_VERSION`         |                           |
 | Java      | 8               |                      |                           |
-| Node.js   | 10              | `NODE_VERSION`       | `.nvmrc`, `.node-version` |
+| Node.js   | 12.18.0         | `NODE_VERSION`       | `.nvmrc`, `.node-version` |
 | PHP       | 5.6             | `PHP_VERSION`        |                           |
 | Python    | 2.7             | `PYTHON_VERSION`     | `runtime.txt`, `Pipfile`  |
 | Ruby      | 2.6.2           | `RUBY_VERSION`       | `.ruby-version`           |
+| .NET      | 3.1.302         |                      |                           |
 
 Many common tools have been pre-installed as well. The environment variable available for overriding the pinned version is specified, as available:
 
@@ -82,4 +103,4 @@ Many common tools have been pre-installed as well. The environment variable avai
 | Yarn        | Version 1.13.0                  | `YARN_VERSION`       |
 | Zola        | (requires environment variable) | `ZOLA_VERSION`       |
 
-If you're looking to set a specific version of a framework your Cloudflare Pages project is using, note that Pages will respect your package manager of choice during your build process. For instance, if you use Gatsby.js, your `package.json` should indicate a version of the `gatsby` NPM package, which will be installed using `npm install` as your project builds on Cloudflare Pages.
+If you want to set a specific version of a framework your Cloudflare Pages project is using, note that Pages will respect your package manager of choice during your build process. For example, if you use Gatsby.js, your `package.json` should indicate a version of the `gatsby` npm package, which will be installed using `npm install` as your project builds on Cloudflare Pages.
diff --git a/products/pages/src/content/platform/contentful.png b/products/pages/src/content/platform/contentful.png
new file mode 100644
index 00000000000..8cba1c95190
Binary files /dev/null and b/products/pages/src/content/platform/contentful.png differ
diff --git a/products/pages/src/content/platform/deploy-hooks-add.png b/products/pages/src/content/platform/deploy-hooks-add.png
new file mode 100644
index 00000000000..e11b36d330b
Binary files /dev/null and b/products/pages/src/content/platform/deploy-hooks-add.png differ
diff --git a/products/pages/src/content/platform/deploy-hooks-configure.png b/products/pages/src/content/platform/deploy-hooks-configure.png
new file mode 100644
index 00000000000..8f2034ddf8e
Binary files /dev/null and b/products/pages/src/content/platform/deploy-hooks-configure.png differ
diff --git a/products/pages/src/content/platform/deploy-hooks-deployment-logs.png b/products/pages/src/content/platform/deploy-hooks-deployment-logs.png
new file mode 100644
index 00000000000..c050ceccb10
Binary files /dev/null and b/products/pages/src/content/platform/deploy-hooks-deployment-logs.png differ
diff --git a/products/pages/src/content/platform/deploy-hooks-details.png b/products/pages/src/content/platform/deploy-hooks-details.png
new file mode 100644
index 00000000000..f7831a1a70f
Binary files /dev/null and b/products/pages/src/content/platform/deploy-hooks-details.png differ
diff --git a/products/pages/src/content/platform/deploy-hooks.md b/products/pages/src/content/platform/deploy-hooks.md
new file mode 100644
index 00000000000..d616b59445e
--- /dev/null
+++ b/products/pages/src/content/platform/deploy-hooks.md
@@ -0,0 +1,61 @@
+---
+order: 3
+pcx-content-type: concept
+---
+
+# Deploy Hooks
+
+With Deploy Hooks, you can trigger deployments using event sources beyond commits in your source repository. Each event source may obtain its own unique URL, which will receive HTTP POST requests in order to initiate new deployments. This feature allows you to integrate Pages with new or existing workflows. For example, you may:
+
+- Automatically deploy new builds whenever content in a Headless CMS system changes
+- Implement a fully customized CI/CD pipeline, deploying only under desired conditions 
+- Schedule a CRON trigger to update your website on a fixed timeline
+
+To create a Deploy Hook, navigate from **Account Home** to **Pages** and select your desired Pages project. Navigate to **Settings** > **Builds & deployments** and select **Add deploy hook** to start configuration.
+
+![deploy hooks](deploy-hooks-add.png)
+
+## Parameters needed
+To configure your Deploy Hook, you must enter two key parameters:
+   1. **Deploy hook name:** a unique identifier for your Deploy Hook (e.g. “contentful-site”)
+   2. **Branch to build:** the repository branch your Deploy Hook should build
+
+![deploy hooks](deploy-hooks-configure.png)
+
+## Using your Deploy Hook
+Once your configuration is complete, the Deploy Hook’s unique URL is ready to be used. You will see both the URL as well as the POST request snippet available to copy. 
+![deploy hooks](deploy-hooks-details.png)
+
+Every time a request is sent to your Deploy Hook, a new build will be triggered. Review the **Source** column of your deployment log to see which deployment were triggered by a Deploy Hook.  
+
+![deploy hooks](deploy-hooks-deployment-logs.png)
+
+## Security Considerations
+Deploy Hooks are uniquely linked to your project and do not require additional authentication to be used. While this does allow for complete flexibility, it is important that you protect these URLs in the same way you would safeguard any proprietary information or application secret. 
+
+If you suspect unauthorized usage of a Deploy Hook, you should delete the Deploy Hook and generate a new one in its place.
+
+## Integrating Deploy Hooks with common CMS platforms
+Every CMS provider is different and will offer different pathways in integrating with Pages' Deploy Hooks. The following section contains step-by-step instructions for a select number of popular CMS platforms.
+
+### Contentful
+Contentful supports integration with Cloudflare Pages via its **Webhooks** feature. In your Contentful project settings, go to **Webhooks**, create a new Webhook, and paste in your unique Deploy Hook URL in the **URL** field. Optionally, you can specify events that the Contentful Webhook should forward. By default, Contentful will trigger a Pages deployment on all project activity, which may be a bit too frequent. You can filter for specific events, such as Create, Publish, and many others. 
+
+![Configuring Deploy Hooks with Contentful](./contentful.png)
+
+### Ghost 
+You can configure your Ghost website to trigger Pages deployments by creating a new **Custom Integration**. In your Ghost website’s settings, create a new Custom Integration in the **Integrations** page.
+
+Each custom integration created can have multiple **webhooks** attached to it. Create a new webhook with the **Add webhook** button and select **Site changed (rebuild)** as the **Event**. Then paste your unique Deploy Hook URL as the **Target URL** value. After creating this webhook, your Cloudflare Pages application will redeploy whenever your Ghost site changes.
+
+![Configuring Deploy Hooks with Ghost](./ghost.png)
+
+### Sanity
+In your Sanity project's Settings page, find the **Webhooks** section, and add the Deploy Hook URL, as seen below. By default, the Webhook will trigger your Pages Deploy Hook for all datasets inside of your Sanity project. You can filter notifications to individual datasets, such as production, using the **Dataset** field:
+
+![Configuring Deploy Hooks with Sanity](./sanity.png)
+
+### WordPress
+You can configure WordPress to trigger a Pages Deploy Hook by installing the free **WP Webhooks** plugin. The plugin includes a number of triggers, such as **Send Data on New Post, Send Data on Post Update** and **Send Data on Post Deletion**, all of which allow you to trigger new Pages deployments as your WordPress data changes. Select a trigger on the sidebar of the plugin settings and then [**Add Webhook URL**](https://wordpress.org/plugins/wp-webhooks/), pasting in your unique Deploy Hook URL.
+
+![Configuring Deploy Hooks with WordPress](./wordpress.png)
diff --git a/products/pages/src/content/platform/ghost.png b/products/pages/src/content/platform/ghost.png
new file mode 100644
index 00000000000..2b739a04c76
Binary files /dev/null and b/products/pages/src/content/platform/ghost.png differ
diff --git a/products/pages/src/content/platform/git.pause.png b/products/pages/src/content/platform/git.pause.png
new file mode 100644
index 00000000000..d6db53aa101
Binary files /dev/null and b/products/pages/src/content/platform/git.pause.png differ
diff --git a/products/pages/src/content/platform/github-integration.md b/products/pages/src/content/platform/github-integration.md
index 97c2016d80b..3eb531b3c22 100644
--- a/products/pages/src/content/platform/github-integration.md
+++ b/products/pages/src/content/platform/github-integration.md
@@ -1,19 +1,34 @@
+---
+order: 1
+pcx-content-type: concept
+---
+
 # GitHub integration
 
-We support connecting Cloudflare Pages to your GitHub repositories to look for new changes to your project.
+Cloudflare supports connecting Cloudflare Pages to your GitHub repositories to look for new changes to your project.
 
 ## Custom branches
 
-If you have a custom Git workflow that makes use of specific branches for representing your "production" build of your project, you can specify a custom branch when creating (or managing an existing) Cloudflare Pages project.
+If you have a custom Git workflow that makes use of specific branches for representing your production build of your project, you can specify a custom branch when creating (or managing an existing) Cloudflare Pages project.
 
-For instance, imagine that you merge new code into the `main` branch, and when it's time to deploy your project, you merge a set of commits into the `production` branch. In the Cloudflare Pages UI, you can set the default branch to `production`.
+For example, imagine that you merge new code into the `main` branch. When it is time to deploy your project, you merge a set of commits into the `production` branch. In the Cloudflare Pages dashboard, you can set the default branch to `production`.
 
-In fact, you can also use [preview deployments](/platform/preview-deployments) to get a glimpse at how the new version of your project looks _before_ even merging to `production`. To do this, enable preview deployments, and you'll be able to access a deployed version of your `main` branch, or whatever other branches exist, whether created manually or via pull requests.
+You can also use [preview deployments](/platform/preview-deployments) to preview how the new version of your project looks before merging to `production`. To do this, make sure that preview deployments are enabled. You can check this by going to the Pages project's **Settings** > **Builds & deployments** > and verifying that automatic deployments are enabled and **Pause deployments** is unselected. With preview deployments, you will be able to access a deployed version of your `main` branch, or other branches that exist, whether created manually or through pull requests.
 
 ## Organizational access
 
-When authorizing Cloudflare Pages to access your GitHub account, you can also specify access to _organizations_ that you belong to on GitHub. This means that you can deploy projects to Cloudflare Pages from your open-source team, company, or side project.
+When authorizing Cloudflare Pages to access your GitHub account, you can also specify access to organizations that you belong to on GitHub. This means that you can deploy projects to Cloudflare Pages from your open-source team, company, or side project.
 
 ## Removing access to your GitHub account
 
-You can remove Cloudflare Pages' access to your GitHub account by viewing the ["Applications" page](https://github.com/settings/installations) on GitHub. Note that removing access to GitHub will also disable new builds, though the last build of your site will continue to be hosted via Cloudflare Pages.
+You can remove Cloudflare Pages' access to your GitHub account by viewing the [**Applications** page](https://github.com/settings/installations) on GitHub. Note that removing access to GitHub will also disable new builds, though the last build of your site will continue to be hosted via Cloudflare Pages.
+
+## Pausing Automatic Builds
+
+By default, Cloudflare Pages automatically builds and deploys a project whenever its repository receives new commits. You can pause this behavior to keep your website at a particular version and manually deploy new versions when desired.
+
+To pause automatic deployments, go to the Pages project's **Settings** > **Builds & deployments** > select **Pause deployments** at the end of the page.
+
+![pause button](git.pause.png)
+
+Selecting **Pause deployments** will present a confirmation and, once confirmed, the **Pause deployments** button will be replaced with a **Resume deployments** button. While paused, your **Deployments** list will present a banner message, reminding you that automatic deployments are not enabled.
diff --git a/products/pages/src/content/platform/index.md b/products/pages/src/content/platform/index.md
index ccf900f7d3c..3905506589f 100644
--- a/products/pages/src/content/platform/index.md
+++ b/products/pages/src/content/platform/index.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: navigation
+---
+
 # Platform
 
 <DirectoryListing path="/platform"/>
diff --git a/products/pages/src/content/platform/known-issues.md b/products/pages/src/content/platform/known-issues.md
index 27ce28705f6..2a6c50ba0b4 100644
--- a/products/pages/src/content/platform/known-issues.md
+++ b/products/pages/src/content/platform/known-issues.md
@@ -1,3 +1,8 @@
+---
+order: 9
+pcx-content-type: concept
+---
+
 # Known issues
 
 Here are some known bugs and issues that we're aware of with Cloudflare Pages:
@@ -7,5 +12,8 @@ Here are some known bugs and issues that we're aware of with Cloudflare Pages:
 - pages.dev subdomains currently can't be changed. If you need to change your pages.dev subdomain, delete your project and create a new one.
 - Hugo builds automatically run an old version. To run the latest version of Hugo (for instance, 0.80.0), you'll need to set an environment variable. Set `HUGO_VERSION` to `0.80.0` or the Hugo version of your choice.
 - By default, we use Node 10 in the Pages build environment. If you need to use a newer Node version, see our [Build configuration page](https://developers.cloudflare.com/pages/platform/build-configuration) for configuration options.
+- For users migrating from Netlify, Cloudflare does not support Netlify's Forms and Serverless Functions features. Cloudflare Pages does not directly support HTTP header customization, but it can be done through Workers. Refer to the ["Add custom HTTP headers"](/how-to/add-custom-http-headers) guide for more information.
+- It is currently not possible to add a custom domain with a wildcard, e.g. *.domain.com.
+- Cloudflare Pages is not supported with Cloudflare Apps; you may see a 1014 error if you use both in a deployment.
 
-Having an issue that you don't see listed above? Let us know in the Cloudflare Workers Discord! Get your invite at [discord.gg/cloudflaredev](https://discord.gg/cloudflaredev), and share your bug report in the #pages channel.
+If you have an issue that you do not see listed, let the team know in the Cloudflare Workers Discord. Get your invite at [discord.gg/cloudflaredev](https://discord.gg/cloudflaredev), and share your bug report in the #pages-help channel.
diff --git a/products/pages/src/content/platform/limits.md b/products/pages/src/content/platform/limits.md
index 05c0054b99b..c1f3202f958 100644
--- a/products/pages/src/content/platform/limits.md
+++ b/products/pages/src/content/platform/limits.md
@@ -1,10 +1,17 @@
+---
+order: 8
+pcx-content-type: concept
+---
+
 # Limits
 
-Below, we've listed the limits for users using the Cloudflare Pages free plan. For more details on removing these limits, check out our [Cloudflare plans](https://www.cloudflare.com/plans) page.
+Below are limits observed by the Cloudflare Pages free plan. For more details on removing these limits, refer to our [Cloudflare plans](https://www.cloudflare.com/plans) page.
 
 ## Builds
 
-Each time you push new code to your GitHub repository, we'll build and deploy your site. You can deploy up to 500 times per month on the free plan. Check out the Pro and Business plans on our [pricing page](https://pages.cloudflare.com/#pricing) if you need to deploy more frequently!
+Each time you push new code to your GitHub repository, Pages will build and deploy your site. You can deploy up to 500 times per month on the free plan. Refer to the Pro and Business plans on the Pages [pricing page](https://pages.cloudflare.com/#pricing) if you need to deploy more frequently. 
+
+Builds will timeout after 20 minutes.
 
 ## Custom domains
 
@@ -12,11 +19,11 @@ A Cloudflare Pages project can be attached to a maximum of ten (10) custom domai
 
 ## Files
 
-We take each file in your site and upload it to our globally distributed network to bring low latency to every user that visits your site. Cloudflare Pages sites can contain up to 20,000 files.
+Pages uploads each file on your site to Cloudflare's globally distributed network to deliver a low latency exprience to every user that visits your site. Cloudflare Pages sites can contain up to 20,000 files.
 
 ## File size
 
-The maximum file size for a Cloudflare Pages site asset is 25MB.
+The maximum file size for a single Cloudflare Pages site asset is 25MB.
 
 ## Preview deployments
 
@@ -28,5 +35,4 @@ Your Pages site can be managed by an unlimited number of users via the Cloudflar
 
 ## Sites
 
-Cloudflare Pages supports deploying unlimited sites to your account. In order to protect against abuse of the service, we may temporarily disable your ability to create new Pages projects, if you're deploying a large number of applications in a short amount of time. Please email workers-support@cloudflare.com if you need this restriction removed.
-
+Cloudflare Pages supports deploying unlimited sites to your account. In order to protect against abuse of the service, Cloudflare may temporarily disable your ability to create new Pages projects, if you are deploying a large number of applications in a short amount of time. Please email workers-support@cloudflare.com if you need this restriction removed.
\ No newline at end of file
diff --git a/products/pages/src/content/platform/preview-deployment-generated.png b/products/pages/src/content/platform/preview-deployment-generated.png
new file mode 100644
index 00000000000..0e50eb19a31
Binary files /dev/null and b/products/pages/src/content/platform/preview-deployment-generated.png differ
diff --git a/products/pages/src/content/platform/preview-deployment-mergedone.png b/products/pages/src/content/platform/preview-deployment-mergedone.png
new file mode 100644
index 00000000000..2b3052ad21d
Binary files /dev/null and b/products/pages/src/content/platform/preview-deployment-mergedone.png differ
diff --git a/products/pages/src/content/platform/preview-deployments.md b/products/pages/src/content/platform/preview-deployments.md
index b381846616b..4e9851d2386 100644
--- a/products/pages/src/content/platform/preview-deployments.md
+++ b/products/pages/src/content/platform/preview-deployments.md
@@ -1,9 +1,30 @@
+---
+order: 3
+pcx-content-type: concept
+---
+
 # Preview deployments
 
-Preview deployments allow you to preview new versions of your project without deploying it to production.
+Preview deployments allow you to preview new versions of your project without deploying it to production. To view preview deployments, navigate from the **Account Home** > **Pages** and select your project.
+
+Every time you open a new pull request on your GitHub repository, Cloudflare Pages will create a unique preview URL, which will stay updated as you continue to push new commits to the branch.
+
+For example, if you have a repo called `user-example` connected to Pages, this will give you a `user-example.pages.dev` subdomain. If `main` is your default branch, then any commits to the `main` branch will update your `user-example.pages.dev` content, as well as any [custom domains](/get-started#adding-a-custom-domain) attached to the project. 
+
+![development preview](preview-deployment-mergedone.png)
+
+While developing `user-example`, you may push new changes to a `development` branch, for example. 
+
+In this example, after you create the new `development` branch, Pages will automatically generate a preview deployment for these changes available at `373f31e2.user-example.pages.dev` - where `373f31e2` is a randomly generated hash. 
+
+Each new branch you create will receive a new, randomly-generated hash in front of your `pages.dev` subdomain.
+
+![development preview](preview-deployment-generated.png)
+
+Any additional changes to the `development` branch will continue to update this `373f31e2.user-example.pages.dev` preview address until the `development` branch is merged with the `main` production branch. 
 
-Every time you open a new pull request on your GitHub repository, Cloudflare Pages will create a unique preview URL, which will stay up-to-date as you continue to push new commits to the branch.
+Any custom domains, as well as your `user-example.pages.dev` site, will not be affected by preview deployments. 
 
 ## Customizing preview deployments access
 
-By default, preview deployments are enabled and available publicly. In your project's settings, you can require visitors to authenticate using [Cloudflare Access](https://www.cloudflare.com/teams-access/) to be able to view preview deployment. This allows you to lock down access to these preview deployments to your teammates, organization, or anyone else you specify via [Access policies](https://developers.cloudflare.com/access/setting-up-access/configuring-access-policies/).
\ No newline at end of file
+By default, preview deployments are enabled and available publicly. In your project's settings, you can require visitors to authenticate using [Cloudflare Access](https://www.cloudflare.com/teams-access/) to be able to view preview deployment. This allows you to lock down access to these preview deployments to your teammates, organization, or anyone else you specify via [Access policies](https://developers.cloudflare.com/access/setting-up-access/configuring-access-policies/).
diff --git a/products/pages/src/content/platform/redirects.md b/products/pages/src/content/platform/redirects.md
index 36ee21676f6..58e7ae70fcc 100644
--- a/products/pages/src/content/platform/redirects.md
+++ b/products/pages/src/content/platform/redirects.md
@@ -1,11 +1,27 @@
+---
+order: 6
+pcx-content-type: concept
+---
+
 # Redirects
 
 ## Creating redirects
-To use redirects on Cloudflare Pages, declare your redirects in a `_redirects` plain text file in the output folder of your project. The [build output folder](https://developers.cloudflare.com/pages/platform/build-configuration) is project-specific so the `_redirects` file should not always be in the root directory of the repo. Changes to redirects will be updated to your website at build time so make sure you commit and push the file to trigger a new build each time you update redirects.
 
-Redirects can be stated as such with one redirect per line in the form: 
+To use redirects on Cloudflare Pages, declare your redirects in a `_redirects` plain text file in the output folder of your project. The [build output folder](/platform/build-configuration) is project-specific so the `_redirects` file should not always be in the root directory of the repository. Changes to redirects will be updated to your website at build time so make sure you commit and push the file to trigger a new build each time you update redirects.
 
-[source] [destination] [code]
+Only one redirect can be defined per line and must follow this format:
+
+```
+[source] [destination] [code?]
+```
+
+<Aside heading="Status Code">
+  
+  The `[code]` parameter is optional, and when not defined, will default to a `302` status code.
+  
+</Aside>
+
+A complete example with multiple redirects may look like the following:
 
 ```
 ---
@@ -18,10 +34,10 @@ filename: _redirects
 /trailing /trailing/ 301
 /notrailing/ /nottrailing 301
 ```
- 
-There is a limit of 100 redirects and a 1000 character limit per redirect line. Incorrectly formatted lines in the file are ignored. If there are multiple redirects for the same source, the topmost redirect is applied. 
 
-We currently offer limited support for advanced redirects. More support will be added in the future.
+A project is limited to 100 total redirects. Each redirect declaration has a 1000-character limit. Malformed definitions are ignored. If there are multiple redirects for the same `source` path, the topmost redirect is applied. If the same `source` URL has multiple redirects, the topmost redirect is applied.
+
+Cloudflare currently offers limited support for advanced redirects. More support will be added in the future.
 
 <TableWrap>
 
@@ -32,13 +48,13 @@ We currently offer limited support for advanced redirects. More support will be
 | Splats                          | No      | /blog/* /blog/:splat                                                     |
 | Placeholders                    | No      | /blog/:year/:month/:date/:slug /news/:year/:month/:date/:slug            |
 | Query Parameters                | No      | /shop id=:id /blog/:id 301                                               |
-| Force (shadowing)                | No      | /workers/ /workers/index.html 200!                                       |
+| Force (shadowing)               | No      | /workers/ /workers/index.html 200!                                       |
 | Domain-level redirects          | No      | workers.example.com/* workers.example.com/blog/:splat 301 |
 | Redirect by country or language | No      | / /us 302 Country=us                                                     |
 
 </TableWrap>
 
 
-## See also
+## Additional information
 
 - [Transform Rules](https://developers.cloudflare.com/rules/transform)
diff --git a/products/pages/src/content/platform/rollbacks.md b/products/pages/src/content/platform/rollbacks.md
new file mode 100644
index 00000000000..ee88291e101
--- /dev/null
+++ b/products/pages/src/content/platform/rollbacks.md
@@ -0,0 +1,19 @@
+---
+order: 5
+pcx-content-type: concept
+---
+
+# Rollbacks
+
+Rollbacks allow you to instantly revert your project to a previous production deployment.
+
+Any production deployment that has been successfully built is a valid rollback target. When your project has rolled back to a previous deployment, you may still rollback to deployments that are newer than your current version. Note that preview deployments are not valid rollback targets.
+
+In order to perform a rollback, go to **Deployments** in your Pages project. Browse the **All deployments** list and select  the three dotted actions menu for the desired target. Select **Rollback to this deployment** for a confirmation window to appear. When confirmed, your project's production deployment will change instantly.
+
+![rollbacks preview](rollbacks.png)
+
+## Additional information
+
+- [Preview Deployments](/platform/preview-deployments)
+- [Pausing Automatic Builds](/platform/github-integration#pausing-automatic-builds)
diff --git a/products/pages/src/content/platform/rollbacks.png b/products/pages/src/content/platform/rollbacks.png
new file mode 100644
index 00000000000..11da92e9d53
Binary files /dev/null and b/products/pages/src/content/platform/rollbacks.png differ
diff --git a/products/pages/src/content/platform/sanity.png b/products/pages/src/content/platform/sanity.png
new file mode 100644
index 00000000000..f8051703a0b
Binary files /dev/null and b/products/pages/src/content/platform/sanity.png differ
diff --git a/products/pages/src/content/platform/serving-pages.md b/products/pages/src/content/platform/serving-pages.md
index 6ba242d29d4..395428eff93 100644
--- a/products/pages/src/content/platform/serving-pages.md
+++ b/products/pages/src/content/platform/serving-pages.md
@@ -1,6 +1,11 @@
+---
+order: 4
+pcx-content-type: concept
+---
+
 # Serving Pages
 
-Cloudflare Pages includes a number of "good defaults" for serving your Pages sites. This page details some of those decisions, so you can understand how Pages works, and how you might want to override some of the default behaviors.
+Cloudflare Pages includes a number of defaults for serving your Pages sites. This page details some of those decisions, so you can understand how Pages works, and how you might want to override some of the default behaviors.
 
 ## Route matching
 
@@ -8,13 +13,13 @@ If an HTML file is found with a matching path to the current route requested, Pa
 
 ## Not Found behavior
 
-You can define a custom page to be displayed when Pages can't find a requested file by creating a `404.html` file. Pages will attempt to find the *closest* 404 page, that is, if one isn't found in the *same* directory as the route you're currently requesting, it will continue to look up the directory tree for a matching `404.html` file, ending in `/404.html`. This means that you can define custom 404 paths for situations like `/blog/404.html` *and* `/404.html`, and Pages will automatically render the correct one depending on the situation.
+You can define a custom page to be displayed when Pages cannot find a requested file by creating a `404.html` file. Pages will then attempt to find the closest 404 page. If one is not found in the same directory as the route you are currently requesting, it will continue to look up the directory tree for a matching `404.html` file, ending in `/404.html`. This means that you can define custom 404 paths for situations like `/blog/404.html` and `/404.html`, and Pages will automatically render the correct one depending on the situation.
 
 ## Single-page app (SPA) rendering
 
-If your project doesn't include a top-level `404.html` file, Pages assumes that you're deploying a single-page application. This includes frameworks like React, Vue, and Angular. Pages' default single-page application behavior matches all incoming paths to the root (`/`), allowing you to capture URLs like `/about` or `/help` and respond to them from within your SPA. 
+If your project does not include a top-level `404.html` file, Pages assumes that you are deploying a single-page application. This includes frameworks like React, Vue, and Angular. Pages' default single-page application behavior matches all incoming paths to the root (`/`), allowing you to capture URLs like `/about` or `/help` and respond to them from within your SPA. 
 
 
 ## Caching and performance
 
-Pages includes good caching defaults. That means that every time you deploy an asset to Pages, it remains cached on our CDN until your next deploy. As much as possible, Pages sets `ETag` and `If-None-Match` headers to allow clients to also cache content in their browsers — for more details on these behaviors, check out the MDN ["HTTP Caching" page](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching). Pages will also serve Gzip and Brotli responses whenever possible.
+Pages includes good caching defaults. That means that every time you deploy an asset to Pages, it remains cached on the Cloudflare CDN until your next deploy. As much as possible, Pages sets `ETag` and `If-None-Match` headers to allow clients to also cache content in their browsers — for more details on these behaviors, refer to the MDN [HTTP Caching page](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching). Pages will also serve Gzip and Brotli responses whenever possible.
diff --git a/products/pages/src/content/platform/wordpress.png b/products/pages/src/content/platform/wordpress.png
new file mode 100644
index 00000000000..5c964a8ed14
Binary files /dev/null and b/products/pages/src/content/platform/wordpress.png differ
diff --git a/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/hooks.png b/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/hooks.png
new file mode 100644
index 00000000000..f8051703a0b
Binary files /dev/null and b/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/hooks.png differ
diff --git a/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/index.md b/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/index.md
index 54f3848e0b1..c9c2d20008e 100644
--- a/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/index.md
+++ b/products/pages/src/content/tutorials/build-a-blog-using-nuxt-and-sanity/index.md
@@ -1,8 +1,12 @@
+---
+pcx-content-type: tutorial
+---
+
 # Build a blog using Nuxt.js and Sanity.io on Cloudflare Pages
 
 ## Introduction
 
-In this tutorial, we'll build a blog application using Nuxt.js and Sanity.io and deploy it on Cloudflare Pages. Nuxt.js is a powerful static site generator built on the frontend framework Vue.js, and Sanity.io is a headless CMS tool built for managing your application's data without needing to maintain a database.
+In this tutorial, you will build a blog application using Nuxt.js and Sanity.io and deploy it on Cloudflare Pages. Nuxt.js is a powerful static site generator built on the front-end framework Vue.js. Sanity.io is a headless CMS tool built for managing your application's data without needing to maintain a database.
 
 ## Prerequisites
 
@@ -11,11 +15,11 @@ In this tutorial, we'll build a blog application using Nuxt.js and Sanity.io and
 
 ## Creating a new Sanity project
 
-To begin, we'll create a new Sanity project. We'll use one of Sanity's templates, the _blog_ template, but if you'd like to do something differently, you can modify the schema or pick a custom template.
+To begin, create a new Sanity project, using one of Sanity's templates, the blog template. If you would like to customize your configuration, you can modify the schema or pick a custom template.
 
 ### Installing Sanity and configuring your dataset
 
-To do this, we'll install the `@sanity/cli` client from NPM, and create a new project using `sanity init`:
+Create your new Sanity project by installing the `@sanity/cli` client from NPM, and running `sanity init` in your terminal:
 
 ```sh
 ---
@@ -24,11 +28,11 @@ header: Installing the Sanity client and creating a new project
 $ npm install -g @sanity/cli && sanity init
 ```
 
-When you create a Sanity project, you can choose to use one of their pre-defined schemas. Schemas describe the shape of your data in your Sanity dataset -- if you were to start a brand new project, you may choose to initialize the schema from scratch, but for now, select the "Blog" schema.
+When you create a Sanity project, you can choose to use one of their pre-defined schemas. Schemas describe the shape of your data in your Sanity dataset -- if you were to start a brand new project, you may choose to initialize the schema from scratch, but for now, select the **Blog** schema.
 
 ### Inspecting your schema
 
-With your project created, you can navigate into the folder and start up the _studio_ locally:
+With your project created, you can navigate into the folder and start up the studio locally:
 
 ```sh
 ---
@@ -38,13 +42,13 @@ $ cd my-sanity-project
 $ sanity start
 ```
 
-The Sanity studio is where you can create new records for your dataset. By default, running the studio locally makes it available at `localhost:3333` -- go there now and create your author record, as well as a blog post or two!
+The Sanity studio is where you can create new records for your dataset. By default, running the studio locally makes it available at `localhost:3333`– go there now and create your author record. You can also create blog posts here.
 
 ![Sanity studio preview](./sanity-studio.png)
 
 ### Deploying your dataset
 
-When you're ready to deploy your studio, you can run `sanity deploy` to choose a unique URL for your studio. This means that you (or anyone else you invite to manage your blog) can access the studio at a `yoururl.sanity.studio` domain.
+When you are ready to deploy your studio, run `sanity deploy` to choose a unique URL for your studio. This means that you (or anyone else you invite to manage your blog) can access the studio at a `yoururl.sanity.studio` domain.
 
 ```sh
 ---
@@ -53,13 +57,20 @@ header: Deploying the studio
 $ sanity deploy
 ```
 
-Once you've deployed your Sanity studio, you'll need to go into Sanity's management panel ([manage.sanity.io](https://manage.sanity.io)), find your project, select "API", and add `http://localhost:3000` as an allowed CORS origin for your project. This means that requests that come to your Sanity dataset from your Nuxt application will be whitelisted.
+Once you have deployed your Sanity studio:
+
+1. Go into Sanity's management panel ([manage.sanity.io](https://manage.sanity.io)).
+2. Find your project.
+3. Select **API**. 
+4. Add `http://localhost:3000` as an allowed CORS origin for your project.
+
+This means that requests that come to your Sanity dataset from your Nuxt application will be whitelisted.
 
 ![CORS settings](./cors.png)
 
 ## Creating a new Nuxt.js project
 
-Next, we'll create a Nuxt.js project. In a new terminal, use `create-nuxt-app` to set up a new Nuxt project:
+Next, create a Nuxt.js project. In a new terminal, use `create-nuxt-app` to set up a new Nuxt project:
 
 ```sh
 ---
@@ -68,9 +79,9 @@ header: Creating a new Nuxt.js project
 $ npx create-nuxt-app blog
 ```
 
-Importantly, you should ensure that you select a rendering mode of "Universal (SSR / SSG)" and a deployment target of "Static (Static/JAMStack hosting)", while going through the setup process.
+Importantly, ensure that you select a rendering mode of **Universal (SSR / SSG)** and a deployment target of **Static (Static/JAMStack hosting)**, while going through the setup process.
 
-Once you've completed your project, `cd` into your new project, and start a local development server by running `yarn dev` (or, if you chose NPM as your package manager, `npm run dev`):
+After you have completed your project, `cd` into your new project, and start a local development server by running `yarn dev` (or, if you chose NPM as your package manager, `npm run dev`):
 
 ```sh
 ---
@@ -82,7 +93,7 @@ $ yarn dev
 
 ### Integrating Sanity.io
 
-With your Nuxt.js application spun up, it's time to add Sanity's `@sanity/nuxt` plugin to your Nuxt project:
+After your Nuxt.js application is set up, add Sanity's `@sanity/nuxt` plugin to your Nuxt project:
 
 ```sh
 ---
@@ -91,7 +102,7 @@ header: Adding @nuxt/sanity
 $ yarn add @nuxtjs/sanity @sanity/client
 ```
 
-To configure the plugin in your Nuxt.js application, you'll need to provide some configuration details. The easiest way to do this it to copy the `sanity.json` folder from your studio into your application directory (though there are other methods, too: [check out the docs!](https://sanity.nuxtjs.org/quick-start)).
+To configure the plugin in your Nuxt.js application, you will need to provide some configuration details. The easiest way to do this is to copy the `sanity.json` folder from your studio into your application directory (though there are other methods, too: [refer to the `@nuxt/sanity` documentation](https://sanity.nuxtjs.org/getting-started/quick-start/).
 
 ```sh
 ---
@@ -100,7 +111,7 @@ header: Adding sanity.json
 $ cp ../my-sanity-project/sanity.json .
 ```
 
-Finally, you'll need to add `@nuxtjs/sanity` as a "build module" in your Nuxt configuration:
+Finally, add `@nuxtjs/sanity` as a **build module** in your Nuxt configuration:
 
 ```js
 ---
@@ -115,11 +126,11 @@ filename: nuxt.config.js
 
 ### Setting up components
 
-With Sanity configured in your application, you can begin using it to render your blog. We'll set up a few pages to pull data from your Sanity API and render it. Note that if you aren't familiar with Nuxt, it's recommended that you check out the [Nuxt guide](https://nuxtjs.org/guide), which will teach you some fundamentals concepts around building applications with Nuxt.
+With Sanity configured in your application, you can begin using it to render your blog. You will now set up a few pages to pull data from your Sanity API and render it. Note that if you are not familiar with Nuxt, it is recommended that you review the [Nuxt guide](https://nuxtjs.org/guide), which will teach you some fundamentals concepts around building applications with Nuxt.
 
 ### Setting up the index page
 
-To begin, we'll update the `index` page, which will be rendered when we visit the root route (`/`). In `pages/index.vue`:
+To begin, update the `index` page, which will be rendered when you visit the root route (`/`). In `pages/index.vue`:
 
 ```vue
 ---
@@ -163,9 +174,9 @@ export default {
 </style>
 ```
 
-Vue SFCs, or _single file components_, are a unique Vue feature that allow you to combine JavaScript, HTML and CSS into a single file. In `pages/index.vue`, we provide a `template` tag, which represents our Vue component.
+Vue SFCs, or _single file components_, are a unique Vue feature that allow you to combine JavaScript, HTML and CSS into a single file. In `pages/index.vue`, a `template` tag is provided, which represents the Vue component.
 
-Importantly, we use the `v-for` directive to tell Vue to render HTML for each `post` in an array of `posts`:
+Importantly, `v-for` is used as a directive to tell Vue to render HTML for each `post` in an array of `posts`:
 
 ```html
 ---
@@ -176,11 +187,11 @@ header: Inspecting the v-for directive
 </div>
 ```
 
-To populate that `posts` array, we use the `asyncData` function, which is provided by Nuxt to make asynchronous calls (e.g. network requests) to populate the page's data.
+To populate that `posts` array, the `asyncData` function is used, which is provided by Nuxt to make asynchronous calls (e.g., network requests) to populate the page's data.
 
-The `$sanity` object is provided by the Nuxt + Sanity.js integration as a way to make requests to your Sanity dataset. By calling `$sanity.fetch`, and passing a query, we can retrieve specific data from our Sanity dataset, and return it as our page's data.
+The `$sanity` object is provided by the Nuxt and Sanity.js integration as a way to make requests to your Sanity dataset. By calling `$sanity.fetch`, and passing a query, you can retrieve specific data from our Sanity dataset, and return it as your page's data.
 
-If you haven't used Sanity before, you'll probably be unfamiliar with _GROQ_, the _GRaph Oriented Query language_ provided by Sanity for interfacing with your dataset. GROQ is a powerful language that allows you to tell the Sanity API _what_ data you want out of your dataset. For our first query, we'll simply tell Sanity to retrieve every object in the dataset with a `_type` value of `post`:
+If you have not used Sanity before, you will probably be unfamiliar with GROQ, the GRaph Oriented Query language provided by Sanity for interfacing with your dataset. GROQ is a powerful language that allows you to tell the Sanity API what data you want out of your dataset. For our first query, you will tell Sanity to retrieve every object in the dataset with a `_type` value of `post`:
 
 ```js
 ---
@@ -192,7 +203,7 @@ const posts = await $sanity.fetch(query)
 
 ### Setting up the blog post page
 
-Our `index` page renders a link for each blog post in our dataset, using the `slug` value to set the URL for a blog post. For instance, if I create a blog post called "Hello World" and set the slug to `hello-world`, my Nuxt application should be able to handle a request to the page `/hello-world`, and retrieve the corresponding blog post from Sanity.
+Our `index` page renders a link for each blog post in our dataset, using the `slug` value to set the URL for a blog post. For example, if I create a blog post called "Hello World" and set the slug to `hello-world`, my Nuxt application should be able to handle a request to the page `/hello-world`, and retrieve the corresponding blog post from Sanity.
 
 Nuxt has built-in support for these kind of pages, by creating a new file in `pages` in the format `_slug.vue`. In the `asyncData` function of your page, you can then use the `params` argument to reference the slug:
 
@@ -209,7 +220,7 @@ export default {
 </script>
 ```
 
-With that in mind, we can build `pages/_slug.vue` to take the incoming `slug` value, make a query to Sanity to find the matching blog post, and render the `post` title for the blog post:
+With that in mind, you can build `pages/_slug.vue` to take the incoming `slug` value, make a query to Sanity to find the matching blog post, and render the `post` title for the blog post:
 
 ```vue
 ---
@@ -231,7 +242,7 @@ import { groq } from '@nuxtjs/sanity'
 
 export default {
   async asyncData({ params, $sanity }) {
-    const query = groq`*[_type == "post" && slug.current == "/${params.slug}"][0]`
+    const query = groq`*[_type == "post" && slug.current == "${params.slug}"][0]`
     const post = await $sanity.fetch(query)
     return { post }
   }
@@ -253,11 +264,11 @@ p { margin: 1rem 0; }
 </style>
 ```
 
-When visiting, for instance, `/hello-world`, Nuxt will take the incoming slug `hello-world`, and make a GROQ query to Sanity for any objects with a `_type` of `post`, as well as a slug that matches the value `/hello-world`. From that set, we can get the first object in the array (using the array index operator you'd find in JavaScript -- `[0]`) and set it as `post` in our page data.
+When visiting, for example, `/hello-world`, Nuxt will take the incoming slug `hello-world`, and make a GROQ query to Sanity for any objects with a `_type` of `post`, as well as a slug that matches the value `/hello-world`. From that set, you can get the first object in the array (using the array index operator you would find in JavaScript – `[0]`) and set it as `post` in your page data.
 
 ### Rendering content for a blog post
 
-We've rendered the `post` title for our blog, but we're still missing the content of the blog post itself. To render this, we'll need to import the [`sanity-blocks-vue-component`](https://github.com/rdunk/sanity-blocks-vue-component) package, which takes Sanity's [Portable Text](https://www.sanity.io/docs/presenting-block-text) format and renders it as a Vue component.
+You have rendered the `post` title for our blog, but you are still missing the content of the blog post itself. To render this, import the [`sanity-blocks-vue-component`](https://github.com/rdunk/sanity-blocks-vue-component) package, which takes Sanity's [Portable Text](https://www.sanity.io/docs/presenting-block-text) format and renders it as a Vue component.
 
 First, install the NPM package:
 
@@ -268,7 +279,7 @@ header: Add sanity-blocks-vue-component package
 $ yarn add sanity-blocks-vue-component
 ```
 
-Once the package is installed, create `plugins/sanity-blocks.js`, which will import the component and register it as the Vue component `block-content`:
+After the package is installed, create `plugins/sanity-blocks.js`, which will import the component and register it as the Vue component `block-content`:
 
 ```js
 ---
@@ -279,7 +290,7 @@ import BlockContent from "sanity-blocks-vue-component";
 Vue.component("block-content", BlockContent);
 ```
 
-In your Nuxt config, `nuxt.config.js`, import that file as part of the `plugins` directive:
+In your Nuxt configuration, `nuxt.config.js`, import that file as part of the `plugins` directive:
 
 ```js
 ---
@@ -290,7 +301,7 @@ filename: nuxt.config.js
 }
 ```
 
-In `pages/_slug.vue`, you can now use the `<block-content>` component to render your content! This takes the format of a custom HTML component, and takes three arguments: `:blocks`, which indicates _what_ to render (in our case, `child`), `v-for`, which accepts an _iterator_ of where to get `child` from (in our case, `post.body`), and `:key`, which helps Vue [keep track of state rendering](https://vuejs.org/v2/guide/list.html#Maintaining-State) by providing a unique value for each post: that is, the `_id` value.
+In `pages/_slug.vue`, you can now use the `<block-content>` component to render your content. This takes the format of a custom HTML component, and takes three arguments: `:blocks`, which indicates what to render (in our case, `child`), `v-for`, which accepts an iterator of where to get `child` from (in our case, `post.body`), and `:key`, which helps Vue [keep track of state rendering](https://vuejs.org/v2/guide/list.html#Maintaining-State) by providing a unique value for each post: that is, the `_id` value.
 
 ```vue
 ---
@@ -314,7 +325,7 @@ import { groq } from '@nuxtjs/sanity'
 
 export default {
   async asyncData({ params, $sanity }) {
-    const query = groq`*[_type == "post" && slug.current == "/${params.slug}"][0]`
+    const query = groq`*[_type == "post" && slug.current == "${params.slug}"][0]`
     const post = await $sanity.fetch(query)
     return { post }
   }
@@ -336,7 +347,7 @@ p { margin: 1rem 0; }
 </style>
 ```
 
-In `pages/index.vue`, we can also use the `block-content` component to render a _summary_ of the content, by taking the first block in your blog post content and rendering it:
+In `pages/index.vue`, you can use the `block-content` component to render a summary of the content, by taking the first block in your blog post content and rendering it:
 
 ```vue
 ---
@@ -387,28 +398,32 @@ export default {
 
 <StreamVideo id="cdf12588663302139f022c26c4e5cede" />
 
-There's many other things inside of your blog schema that you can add to your project. As an exercise, consider one of the following to dig in and continue to develop your understanding of how to build with a headless CMS:
+There are many other things inside of your blog schema that you can add to your project. As an exercise, consider one of the following to continue developing your understanding of how to build with a headless CMS:
 
 - Create `pages/authors.vue`, and render a list of authors (similar to `pages/index.vue`, but for objects with `_type == "author"`)
 - Read the Sanity docs on [using references in GROQ](https://www.sanity.io/docs/how-queries-work#references-and-joins-db43dfd18d7d), and use it to render author information in a blog post page
 
 ## Publishing with Cloudflare Pages
 
-Publishing your project with Cloudflare Pages is an easy, two-step process: first, push your project to GitHub, and then in the Cloudflare Pages UI, set up a new project based on that GitHub repository. Pages will deploy a new version of your site each time you publish, and will even set up preview deployments whenever you open a new pull request.
+Publishing your project with Cloudflare Pages is an easy, two-step process: first, push your project to GitHub, and then in the Cloudflare Pages dashboard, set up a new project based on that GitHub repository. Pages will deploy a new version of your site each time you publish, and will even set up preview deployments whenever you open a new pull request.
 
 To push your project to GitHub, [create a new repo](https://repo.new), and follow the instructions to push your local Git repository to GitHub.
 
-Once you've pushed your project to GitHub, go to the Pages UI, and create a new project. When asked for your project's build configuration, just choose "Nuxt" -- Pages will set the correct fields for you automatically.
+After you've pushed your project to GitHub, deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, choose _Nuxt_. Pages will set the correct fields for you automatically.
+
+When your site has been deployed, you will receive a unique URL to view it in production.
+
+In order to automatically deploy your project when your Sanity.io data changes, you can use [Deploy Hooks](/platform/deploy-hooks). Create a new Deploy Hook URL in your **Pages project** > **Settings**. In your Sanity project's Settings page, find the **Webhooks** section, and add the Deploy Hook URL, as seen below:
 
-When your site has been deployed, you'll receive a unique URL to view it in production.
+![Creating a deploy hook in Sanity.io](./hooks.png)
 
-_A note about automatic deployments:_ at launch, Cloudflare Pages does not have support for webhooks. This means that you'll need to trigger a deploy manually from the Cloudflare Pages UI when you make a change to your Sanity dataset. Support for this feature will be available in the future, and this tutorial will be updated accordingly!
+Now, when you make a change to your Sanity.io dataset, Sanity will make a request to your unique Deploy Hook URL, which will begin a new Cloudflare Pages deploy. By doing this, your Pages application will remain up-to-date as you add new blog posts, or edit existing ones.
 
 ## Conclusion
 
-Congrats, you've deployed your own blog, powered by Nuxt, Sanity.io, and Cloudflare Pages. You can find the source code for both codebases on GitHub:
+By completing this guide, you have successfully deployed your own blog, powered by Nuxt, Sanity.io, and Cloudflare Pages. You can find the source code for both codebases on GitHub:
 
 - Blog frontend: https://github.com/signalnerve/nuxt-sanity-blog
 - Sanity dataset: https://github.com/signalnerve/sanity-blog-schema
 
-If you enjoyed this tutorial, you may be interested in learning how you can use Cloudflare Workers, our powerful serverless function platform, to augment your existing site. [Check out the tutorial to learn more!](/tutorials/build-an-api-with-workers)
+If you enjoyed this tutorial, you may be interested in learning how you can use Cloudflare Workers, our powerful serverless function platform, to augment your existing site. [Refer to the tutorial to learn more.](/tutorials/build-an-api-with-workers)
diff --git a/products/pages/src/content/tutorials/build-an-api-with-workers/index.md b/products/pages/src/content/tutorials/build-an-api-with-workers/index.md
index a002a33fa6b..a8612b9a5a4 100644
--- a/products/pages/src/content/tutorials/build-an-api-with-workers/index.md
+++ b/products/pages/src/content/tutorials/build-an-api-with-workers/index.md
@@ -1,20 +1,24 @@
+---
+pcx-content-type: tutorial
+---
+
 # Build an API for your frontend using Cloudflare Workers
 
 ## Introduction
 
-In this tutorial, we'll build an API on Cloudflare Workers that can be used by your Pages application. Workers serve as a great companion to your frontend applications on Cloudflare Pages. In this tutorial, we'll build a simple JSON API that returns blog posts that can be retrieved and rendered in a frontend application.
+In this tutorial, you will build an API on [Cloudflare Workers](https://www.cloudflare.com/learning/serverless/glossary/serverless-and-cloudflare-workers/) that can be used by your Pages application. Workers serve as a great companion to your front-end applications on Cloudflare Pages. In this tutorial, you will build a simple JSON API that returns blog posts that can be retrieved and rendered in a frontend application.
 
-This tutorial contains two, separate applications: the backend, a serverless API deployed on Cloudflare Workers, and the frontend, built with React and deployed using Cloudflare Pages.
+This tutorial contains two, separate applications: the backend, a [serverless](https://www.cloudflare.com/learning/serverless/what-is-serverless/) API deployed on Cloudflare Workers, and the front end, built with React and deployed using Cloudflare Pages.
 
-If you're interested in a more comprehensive approach to building applications like this, you may benefit from moving from a serverless API for your content to a headless CMS — see our [headless CMS tutorial] to learn more!
+If you are interested in a more comprehensive approach to building applications like this, you may benefit from moving from a serverless API for your content to a headless CMS — refer to the [headless CMS tutorial] to learn more.
 
 ## Deploying a serverless API
 
 ### Generating a new project
 
-Let's begin by creating a new Cloudflare Workers project. If you haven't used Cloudflare Workers, or installed Wrangler, the command-line tool for managing and publishing Workers projects, you should check out the Quick Start guide in the Workers documentation. Once you've configured Wrangler and authenticated it with your Cloudflare account, you can return here to generate your API codebase.
+Begin by creating a new Cloudflare Workers project. If you have not used Cloudflare Workers, or installed [Wrangler](https://developers.cloudflare.com/workers/cli-wrangler/install-update), the command-line tool for managing and publishing Workers projects, refer to the [Get started guide](https://developers.cloudflare.com/workers/get-started/guide) in the Workers documentation. Once you have configured Wrangler and authenticated it with your Cloudflare account, return here to generate your API codebase.
 
-We'll use the Workers TypeScript template to generate our project. Don't worry if you don't know TypeScript -- we won't be writing any complicated types, and if you're using VS Code or another editor with TypeScript support, your code will be validated and checked by the editor as you build your application. Run `wrangler generate` to create a new project using the template:
+You will use the Workers TypeScript template to generate our project. Don't worry if you do not know TypeScript — you will not be writing any complicated types, and if you are using VS Code or another editor with TypeScript support, your code will be validated and checked by the editor as you build your application. Run `wrangler generate` in your terminal to create a new project using the template:
 
 ```sh
 ---
@@ -25,9 +29,9 @@ $ wrangler generate serverless-api https://github.com/cloudflare/worker-typescri
 
 ### Adding a router
 
-Our Workers application will serve as a backend API to return blog post data using JSON to our static application. This means that it should have two routes: `/api/posts`, which will return a list of blog posts, and `/api/posts/:id`, which will be used to retrieve a specific blog post based on ID.
+Your Workers application will serve as a backend API to return blog post data using JSON to our static application. This means that it should have two routes: `/api/posts`, which will return a list of blog posts, and `/api/posts/:id`, which will be used to retrieve a specific blog post based on ID.
 
-While you can manually parse incoming URLs, it's much easier to use a routing library to consistently handle incoming requests. We'll install and use [itty-router](https://github.com/kwhitley/itty-router), an open-source routing library with support for Cloudflare Workers:
+While you can manually parse incoming URLs, it is much easier to use a routing library to consistently handle incoming requests. Install and use [itty-router](https://github.com/kwhitley/itty-router), an open-source routing library with support for Cloudflare Workers by running the following command in your terminal:
 
 ```sh
 ---
@@ -37,7 +41,7 @@ $ npm install itty-router
 ---
 ```
 
-With `itty-router` installed, we can open up `handler.ts` and set up our router. Begin by importing the `itty-router` package and setting up a new instance of the `Router` class:
+With `itty-router` installed, you can open up `handler.ts` and set up your router. Begin by importing the `itty-router` package and setting up a new instance of the `Router` class:
 
 ```ts
 ---
@@ -58,15 +62,15 @@ router
 export const handleRequest = request => router.handle(request)
 ```
 
-The above routing configuration defines three routes: `/api/posts`, `/api/posts/:id`, and a _wildcard_ route, which will be called if the incoming request doesn't match the first two routes.
+The above routing configuration defines three routes: `/api/posts`, `/api/posts/:id`, and a wildcard route, which will be called if the incoming request does not match the first two routes.
 
 Create two files, `handlers/posts.ts` and `handlers/post.ts`, which will contain the handler code for our two API routes.
 
 ### Implementing API routes
 
-In `handlers/posts.ts`, we'll return an array of posts as a JSON array. If you've never worked with JSON APIs before, all you need to know is that a serverless API returning JSON needs to define a `Content-type` header, which should be set to `application/json`. Any JSON data coming back as part of the response body should be turned into a JSON string using `JSON.stringify`.
+In `handlers/posts.ts`, you will return an array of posts as a JSON array. If you have never worked with JSON APIs before, all you need to know is that a serverless API returning JSON needs to define a `Content-type` header, which should be set to `application/json`. Any JSON data coming back as part of the response body should be turned into a JSON string using `JSON.stringify`.
 
-In the below sample, we'll stub out the `posts` array, and later, we'll come back and fill it in with real data:
+In the below sample, you will stub out the `posts` array, and later, you will come back and fill it in with real data:
 
 ```ts
 ---
@@ -83,9 +87,9 @@ const Posts = () => {
 export default Posts
 ```
 
-`Posts` is a simple function with no arguments that returns a JSON response. When an application makes a GET request to `/api/posts`, they'll receive a JSON-encoded array back, which they can use to render a list of blog posts.
+`Posts` is a simple function with no arguments that returns a JSON response. When an application makes a GET request to `/api/posts`, they will receive a JSON-encoded array back, which they can use to render a list of blog posts.
 
-We'll define something similar for `handlers/post.ts`, which returns a single blog post. Importantly, we'll use the request argument that `itty-router` passes to handlers, using it to retrieve the `:id` parameter that we defined in `handler.ts`. Again, we'll stub out the `post` data, but you can already begin to see in the below sample how to retrieve the `:id` param inside of a handler:
+You will define something similar for `handlers/post.ts`, which returns a single blog post. Importantly, you will use the request argument that `itty-router` passes to handlers, using it to retrieve the `:id` parameter that we defined in `handler.ts`. Again, you will stub out the `post` data, but you can already begin to see in the below sample how to retrieve the `:id` param inside of a handler:
 
 ```ts
 ---
@@ -107,7 +111,7 @@ export default Post
 
 ### Defining a static data class
 
-Until now, we've used empty stub data to return data in our API routes. To make this application meaningful, we'll define a static data class, called `PostsStore`, to simulate how you might retrieve data from a database or other data source. In `posts_store.ts`:
+Until now, you have used empty stub data to return data in our API routes. To make this application meaningful, define a static data class, called `PostsStore`, to simulate how you might retrieve data from a database or other data source. In `posts_store.ts`:
 
 ```ts
 ---
@@ -139,9 +143,9 @@ export default class PostsStore {
 }
 ```
 
-We're still referring to static content, but by building a `PostsStore` class, we can abstract the retrieval of posts and easily imagine a future where this class talks to a database, key-value store, or however you prefer to store your data.
+You are still referring to static content, but by building a `PostsStore` class, you can abstract the retrieval of posts and easily imagine a future where this class talks to a database, key-value store, or however you prefer to store your data.
 
-With `PostsStore` set up, we can import it and use it in our handlers:
+With `PostsStore` set up, you can import it and use it in our handlers:
 
 ```ts
 ---
@@ -181,7 +185,7 @@ export default Post
 
 ### Adding CORS headers
 
-Before we're ready to deploy, we'll make one more change to our handlers, adding [CORS headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) to allow our frontend application to make requests to the API. In our handlers, we'll update the `headers` variable accordingly:
+Before you are ready to deploy, you will make one more change to our handlers, adding [CORS headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) to allow your frontend application to make requests to the API. In your handlers, you will update the `headers` variable accordingly:
 
 ```ts
 ---
@@ -227,7 +231,7 @@ export default Post
 
 ### Publishing the API
 
-With our API configured, we're ready to publish! Run `wrangler publish`, and when you've successfully deployed your application, you should be able to make requests to your API to see data returned in the console:
+With your API configured, you are ready to publish. Run `wrangler publish` in your terminal, and when you have successfully deployed your application, you should be able to make requests to your API to see data returned in the console:
 
 ```sh
 ---
@@ -237,9 +241,9 @@ $ curl serverless-api.signalnerve.workers.dev/api/posts
 $ curl serverless-api.signalnerve.workers.dev/api/posts/1
 ```
 
-## Deploying a new React application to pages
+## Deploying a new React application to Pages
 
-With our serverless API deployed, we can now build the frontend of our application with React. First, we'll generate the application, and then we'll define the functionality by adding routing, and rendering blog posts from the API. Once we're happy with the implementation locally, we'll use Cloudflare Pages to deploy it in just a matter of minutes!
+With your serverless API deployed, we can now build the frontend of our application with React. First, you will generate the application, and then you will define the functionality by adding routing, and rendering blog posts from the API. Once you are happy with the implementation locally, you will use Cloudflare Pages to deploy it in just a matter of minutes.
 
 ### Generating a new React application
 
@@ -297,7 +301,7 @@ function App() {
   return (
     <Router>
       <Posts path="/" />
-      <Post path="/:id" />
+      <Post path="/posts/:id" />
     </Router>
   );
 }
@@ -305,7 +309,7 @@ function App() {
 export default App;
 ```
 
-Create a new folder called `components`, and inside of it, create two files: `posts.js`, and `post.js`. These components will load the blog posts from our API, and render them. Let's begin with `posts.js`:
+Create a new folder called `components`, and inside of it, create two files: `posts.js`, and `post.js`. These components will load the blog posts from our API, and render them. Begin with `posts.js`:
 
 ```js
 ---
@@ -355,7 +359,7 @@ filename: "src/components/post.js"
 import React, { useEffect, useState } from "react";
 import { Link } from "@reach/router";
 
-const Posts = ({ id }) => {
+const Post = ({ id }) => {
   const [post, setPost] = useState({});
 
   useEffect(() => {
@@ -386,26 +390,28 @@ const Posts = ({ id }) => {
   );
 };
 
-export default Posts;
+export default Post;
 ```
 
 ### Publishing with Cloudflare Pages
 
-Publishing your project with Cloudflare Pages is an easy, two-step process: first, push your project to GitHub, and then in the Cloudflare Pages UI, set up a new project based on that GitHub repository. Pages will deploy a new version of your site each time you publish, and will even set up preview deployments whenever you open a new pull request.
+Publishing your project with Cloudflare Pages is an easy, two-step process: first, push your project to GitHub, and then in the Cloudflare Pages dashboard, set up a new project based on that GitHub repository. 
+
+Pages will deploy a new version of your site each time you publish and will set up preview deployments whenever you open a new pull request.
 
-To push your project to GitHub, [create a new repo](https://repo.new), and follow the instructions to push your local Git repository to GitHub.
+To push your project to GitHub, [create a new repository](https://repo.new), and follow the instructions to push your local Git repository to GitHub.
 
-Once you've pushed your project to GitHub, go to the Pages UI, and create a new project. When asked for your project's build configuration, just choose "React" -- Pages will set the correct fields for you automatically.
+Deploy your site to Pages by logging into the [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Pages** and selecting **Create a project**. Select the new GitHub repository that you created and, in the **Set up builds and deployments** section, choose **React** -- Pages will automatically apply the correct build settings for you.
 
-When your site has been deployed, you'll receive a unique URL to view it in production.
+When your site has been deployed, you will receive a unique URL to view it in production.
 
-Congrats, you've deployed your own blog, powered by Cloudflare Workers and Cloudflare Pages.
+You have now deployed your own blog, powered by Cloudflare Workers and Cloudflare Pages.
 
 ## Custom domains
 
-Cloudflare Workers and Pages both provide first-class support for custom domains. This means that you can deploy your Pages application to a custom domain, as you would for any normal website, and _also_ deploy your API (`/api/posts` and `/api/posts/:id`) "over" your Pages application, by specifying a route in your `wrangler.toml`.
+Cloudflare Workers and Pages both provide first-class support for custom domains. This means that you can deploy your Pages application to a custom domain, as you would for any normal website, and also deploy your API (`/api/posts` and `/api/posts/:id`) "over" your Pages application, by specifying a route in your `wrangler.toml` file.
 
-For instance, given the example domain "myblog.com", you could set up your API application's `wrangler.toml` with the following config:
+For example, given the example domain `myblog.com`, you could set up your API application's `wrangler.toml` with the following config:
 
 ```toml
 ---
@@ -416,15 +422,15 @@ route = "*myblog.com/api*"
 zone_id = "$zoneId"
 ```
 
-Now, when you run `wrangler publish`, your API will be published and served on `myblog.com`, but _only_ when you visit a route matching `/api*` -- this means that your basic routes (`/`, `/posts/:id`, etc.) will be sent to your frontend Pages application, but any API routes will be intercepted and handled by your Workers application.
+Now, when you run `wrangler publish`, your API will be published and served on `myblog.com`, but only when you visit a route matching `/api*` -- this means that your basic routes (`/`, `/posts/:id`, etc.) will be sent to your front-end Pages application, but any API routes will be intercepted and handled by your Workers application.
 
 ## Conclusion
 
-In this tutorial, you built a full blog application by combining a frontend deployed with Cloudflare Pages, and a serverless API built with Cloudflare Workers. You can find the source code for both codebases on GitHub:
+In this tutorial, you built a full blog application by combining a front end deployed with Cloudflare Pages, and a serverless API built with Cloudflare Workers. You can find the source code for both codebases on GitHub:
 
 - Blog frontend: https://github.com/signalnerve/blog-frontend
 - Serverless API: https://github.com/signalnerve/serverless-api
 
-If you enjoyed this tutorial, check out our [headless CMS tutorial]!
+If you enjoyed this tutorial, refer to the [headless CMS tutorial] to learn how to build a blog using Nuxt.js and Sanity.io.
 
-[headless CMS tutorial]:https://developers.cloudflare.com/pages/tutorials/build-a-blog-using-nuxt-and-sanity
+[headless CMS tutorial]:/tutorials/build-a-blog-using-nuxt-and-sanity
diff --git a/products/pages/src/content/tutorials/index.md b/products/pages/src/content/tutorials/index.md
index 2a8fd62145c..6fc8cbbd758 100644
--- a/products/pages/src/content/tutorials/index.md
+++ b/products/pages/src/content/tutorials/index.md
@@ -1,7 +1,7 @@
 ---
 type: overview
-hideChildren: true
 order: 3
+pcx-content-type: navigation
 ---
 
 import DocsTutorials from "../../components/docs-tutorials"
diff --git a/products/partners/README.md b/products/partners/README.md
new file mode 100644
index 00000000000..8fa236d27ce
--- /dev/null
+++ b/products/partners/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Partners docs
+ 
+[View docs →](https://developers.cloudflare.com/partners)
+ 
+[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
\ No newline at end of file
diff --git a/products/partners/docs-config.js b/products/partners/docs-config.js
new file mode 100644
index 00000000000..2725e809bbb
--- /dev/null
+++ b/products/partners/docs-config.js
@@ -0,0 +1,29 @@
+module.exports = {
+  product: "Partners",
+  pathPrefix: "/partners",
+  productLogoPathD: require('./src/content/icons/partners').pathD,
+  contentRepo: "cloudflare/cloudflare-docs",
+  contentRepoFolder: "products/partners",
+  externalLinks: [
+    {
+      title: "Cloudflare Partners homepage",
+      url: "https://www.cloudflare.com/partners"
+    },
+    {
+      title: "Cloudflare homepage",
+      url: "https://cloudflare.com"
+    }
+  ],
+  search: {
+    indexName: "developers-cloudflare",
+    apiKey: "",
+    algoliaOptions: { 'facetFilters': ''}
+  },
+  siteMetadata: {
+    title: "Cloudflare Partners docs",
+    description: "The Cloudflare Partner Network includes Channel Partners who deliver our security, reliability and performance solutions with a broad range of value-added and managed services, and Alliance Partners who embed Cloudflare into their applications.",
+    author: "@cloudflare",
+    url: "https://developers.cloudflare.com/partners",
+    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+  }
+}
\ No newline at end of file
diff --git a/products/partners/package.json b/products/partners/package.json
new file mode 100644
index 00000000000..71104525ae0
--- /dev/null
+++ b/products/partners/package.json
@@ -0,0 +1,14 @@
+{
+  "private": true,
+  "dependencies": {
+    "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+  },
+  "scripts": {
+    "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+    "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+    "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+    "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+    "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+    "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+  }
+}
\ No newline at end of file
diff --git a/products/partners/src/content/analytics/index.md b/products/partners/src/content/analytics/index.md
new file mode 100644
index 00000000000..5943cd7f0da
--- /dev/null
+++ b/products/partners/src/content/analytics/index.md
@@ -0,0 +1,11 @@
+---
+title: Analytics
+order: 1
+pcx-content-type: navigation
+---
+
+# Analytics
+
+Review visualized metrics to identify security threats, find opportunities to improve performance, and troubleshoot problems for all sites in your account. Cloudflare's analytics products summarize the data collected by Cloudflare for you and include extensive information about attack and mitigation activity detected by Firewall, load balancer steering decisions, threat and event data, and more.
+
+[View Analytics Integrations documentation](https://developers.cloudflare.com/fundamentals/data-products/analytics-integrations)
\ No newline at end of file
diff --git a/products/partners/src/content/icons/partners.js b/products/partners/src/content/icons/partners.js
new file mode 100644
index 00000000000..ccdef01f03a
--- /dev/null
+++ b/products/partners/src/content/icons/partners.js
@@ -0,0 +1,3 @@
+module.exports = {
+  pathD: "M24.0165 24.684C25.4257 24.684 26.8032 24.2661 27.9749 23.4832C29.1466 22.7003 30.0598 21.5875 30.5991 20.2856C31.1384 18.9837 31.2795 17.5511 31.0046 16.169C30.7297 14.7869 30.0511 13.5173 29.0546 12.5209C28.0582 11.5244 26.7886 10.8458 25.4065 10.5709C24.0244 10.296 22.5918 10.4371 21.2899 10.9764C19.9879 11.5156 18.8752 12.4289 18.0923 13.6006C17.3094 14.7723 16.8915 16.1498 16.8915 17.559C16.8931 19.4482 17.6442 21.2595 18.9801 22.5954C20.316 23.9312 22.1273 24.6824 24.0165 24.684ZM24.0165 13.4377C24.8323 13.4377 25.6299 13.6797 26.3082 14.1329C26.9866 14.5862 27.5153 15.2304 27.8275 15.9842C28.1397 16.7379 28.2214 17.5673 28.0622 18.3675C27.9031 19.1677 27.5102 19.9027 26.9333 20.4796C26.3564 21.0565 25.6214 21.4493 24.8212 21.6085C24.0211 21.7676 23.1917 21.686 22.4379 21.3737C21.6842 21.0615 21.0399 20.5328 20.5867 19.8545C20.1334 19.1761 19.8915 18.3786 19.8915 17.5627C19.8915 16.4687 20.3261 15.4195 21.0997 14.6459C21.8733 13.8723 22.9225 13.4377 24.0165 13.4377Z M9.03894 27.7928C10.0773 27.7928 11.0923 27.4849 11.9557 26.908C12.819 26.3311 13.4919 25.5112 13.8893 24.5518C14.2867 23.5925 14.3906 22.5369 14.1881 21.5185C13.9855 20.5001 13.4855 19.5647 12.7513 18.8304C12.017 18.0962 11.0816 17.5962 10.0632 17.3936C9.04476 17.1911 7.98916 17.295 7.02985 17.6924C6.07054 18.0898 5.2506 18.7627 4.67373 19.626C4.09685 20.4894 3.78894 21.5044 3.78894 22.5428C3.79033 23.9347 4.3439 25.2693 5.32816 26.2535C6.31243 27.2378 7.64698 27.7914 9.03894 27.7928ZM9.03894 20.2928C9.48395 20.2928 9.91896 20.4247 10.289 20.672C10.659 20.9192 10.9474 21.2706 11.1177 21.6817C11.288 22.0929 11.3325 22.5453 11.2457 22.9817C11.1589 23.4182 10.9446 23.8191 10.6299 24.1337C10.3153 24.4484 9.91435 24.6627 9.47789 24.7495C9.04144 24.8363 8.58904 24.7918 8.1779 24.6215C7.76677 24.4512 7.41537 24.1628 7.16813 23.7928C6.9209 23.4228 6.78894 22.9878 6.78894 22.5428C6.78954 21.9464 7.02685 21.3747 7.44875 20.9532C7.87064 20.5318 8.44259 20.295 9.03894 20.295V20.2928Z M40.5112 28.575H37.4865C36.3725 28.574 35.2726 28.8237 34.2682 29.3055C33.2866 28.1391 32.0619 27.2013 30.6798 26.558C29.2977 25.9146 27.7917 25.5812 26.2672 25.581H21.7327C20.2109 25.5813 18.7076 25.9136 17.3275 26.5548C15.9474 27.196 14.7238 28.1307 13.7422 29.2935C12.7413 28.8193 11.6473 28.5738 10.5397 28.575H7.51571C5.5307 28.5772 3.62759 29.3666 2.22384 30.7701C0.820079 32.1735 0.0302906 34.0765 0.02771 36.0615L1.52771 37.5615H46.5L48 36.0615C47.9976 34.0763 47.2077 32.1731 45.8038 30.7696C44.3998 29.366 42.4964 28.5768 40.5112 28.575ZM7.51571 31.575H10.5397C11.083 31.5777 11.6213 31.6793 12.1282 31.875C11.7558 32.7321 11.5008 33.6355 11.37 34.5607H3.28571C3.59698 33.6877 4.17049 32.9322 4.92771 32.3978C5.68493 31.8633 6.58885 31.5759 7.51571 31.575ZM14.4007 34.5622C14.7489 32.8743 15.6681 31.3579 17.0036 30.2684C18.3391 29.179 20.0092 28.5831 21.7327 28.581H26.2672C27.9907 28.5828 29.6609 29.1786 30.9966 30.2679C32.3322 31.3572 33.2516 32.8736 33.6 34.5615L14.4007 34.5622ZM36.63 34.5622C36.4999 33.6396 36.2462 32.7388 35.8755 31.884C36.3887 31.6823 36.935 31.5775 37.4865 31.575H40.5112C41.4382 31.5759 42.3422 31.8635 43.0993 32.3983C43.8564 32.9331 44.4297 33.6889 44.7405 34.5622H36.63Z M39.0105 27.7928C40.0489 27.7928 41.0639 27.4849 41.9272 26.908C42.7906 26.3311 43.4635 25.5112 43.8609 24.5518C44.2582 23.5925 44.3622 22.5369 44.1596 21.5185C43.9571 20.5001 43.457 19.5647 42.7228 18.8304C41.9886 18.0962 41.0531 17.5962 40.0347 17.3936C39.0163 17.1911 37.9607 17.295 37.0014 17.6924C36.0421 18.0898 35.2222 18.7627 34.6453 19.626C34.0684 20.4894 33.7605 21.5044 33.7605 22.5428C33.7619 23.9347 34.3155 25.2693 35.2997 26.2535C36.284 27.2378 37.6185 27.7914 39.0105 27.7928ZM39.0105 20.2928C39.4555 20.2928 39.8905 20.4247 40.2605 20.672C40.6305 20.9192 40.9189 21.2706 41.0892 21.6817C41.2595 22.0929 41.3041 22.5453 41.2173 22.9817C41.1304 23.4182 40.9162 23.8191 40.6015 24.1337C40.2868 24.4484 39.8859 24.6627 39.4495 24.7495C39.013 24.8363 38.5606 24.7918 38.1495 24.6215C37.7383 24.4512 37.3869 24.1628 37.1397 23.7928C36.8925 23.4228 36.7605 22.9878 36.7605 22.5428C36.7611 21.9464 36.9984 21.3747 37.4203 20.9532C37.8422 20.5318 38.4142 20.295 39.0105 20.295V20.2928Z",
+}
diff --git a/products/partners/src/content/index.md b/products/partners/src/content/index.md
new file mode 100644
index 00000000000..8e0283b97f9
--- /dev/null
+++ b/products/partners/src/content/index.md
@@ -0,0 +1,15 @@
+---
+title: Overview
+order: 0
+pcx-content-type: landing-page
+---
+
+# Partners
+
+At Cloudflare, we love our partners. Partners play a vital role in Cloudflare's mission to help build a better Internet for customers worldwide.
+
+The Cloudflare Partner Network includes Channel Partners who deliver our security, reliability, and performance solutions with a broad range of value-added and managed services, and Alliance Partners who embed Cloudflare into their applications. Our Technology Partners offer customers complementary solutions within the cloud stack.
+
+<ButtonGroup>
+  <Button type="primary" a href="https://portal.cloudflarepartners.com/English/">Partner Portal</Button>
+</ButtonGroup>
diff --git a/products/partners/src/content/logs/index.md b/products/partners/src/content/logs/index.md
new file mode 100644
index 00000000000..5a057f0bd53
--- /dev/null
+++ b/products/partners/src/content/logs/index.md
@@ -0,0 +1,11 @@
+---
+title: Logs
+order: 2
+pcx-content-type: navigation
+---
+
+# Logs
+
+Cloudflare Enterprise customers have access to detailed logs of the metadata generated by our products. These logs are helpful for debugging, identifying configuration adjustments, and creating analytics, especially when combined with logs from other sources, such as your application server.
+
+[View Logs documentation](https://developers.cloudflare.com/logs/get-started/enable-destinations)
diff --git a/products/partners/src/content/network-interconnect/index.md b/products/partners/src/content/network-interconnect/index.md
new file mode 100644
index 00000000000..ce29c41d171
--- /dev/null
+++ b/products/partners/src/content/network-interconnect/index.md
@@ -0,0 +1,13 @@
+---
+title: Network Interconnect
+order: 3
+pcx-content-type: navigation
+---
+
+# Cloudflare Network Interconnect
+
+Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience.
+
+Cloudflare partners with multiple network fabric providers to offer as many connectivity options and locations as possible.
+
+[View Cloudflare Network Interconnect Partner documentation](https://developers.cloudflare.com/network-interconnect/partners)
diff --git a/products/partners/wrangler.toml b/products/partners/wrangler.toml
new file mode 100644
index 00000000000..eca482bc247
--- /dev/null
+++ b/products/partners/wrangler.toml
@@ -0,0 +1,14 @@
+name = "partners"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+ 
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/partners*"
+ 
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
\ No newline at end of file
diff --git a/products/railgun/README.md b/products/railgun/README.md
new file mode 100644
index 00000000000..b442de647d9
--- /dev/null
+++ b/products/railgun/README.md
@@ -0,0 +1,5 @@
+# Cloudflare Railgun docs
+ 
+[View docs →](https://developers.cloudflare.com/railgun)
+ 
+[Read contributor guidelines →](https://developers.cloudflare.com/docs-engine/contributing/content-framework)
diff --git a/products/railgun/docs-config.js b/products/railgun/docs-config.js
new file mode 100644
index 00000000000..b4b903bfe34
--- /dev/null
+++ b/products/railgun/docs-config.js
@@ -0,0 +1,25 @@
+module.exports = {
+    product: "Railgun",
+    pathPrefix: "/railgun",
+    productIconKey: "railgun",
+    contentRepo: "cloudflare/cloudflare-docs",
+    contentRepoFolder: "products/railgun",
+    externalLinks: [
+      {
+        title: "Cloudflare homepage",
+        url: "https://cloudflare.com"
+      }
+    ],
+    search: {
+      indexName: "developers-cloudflare",
+      apiKey: "b23088ab4d346409f9d3ece6606344c3",
+      algoliaOptions: { 'facetFilters': '["project:railgun"]'}
+    },
+    siteMetadata: {
+      title: "Railgun Documentation",
+      description: "Improve loading times by caching dynamically generated or personalized web pages, dramatically reducing bandwidth usage and improving download times.",
+      author: "@cloudflare",
+      url: "https://developers.cloudflare.com/railgun",
+      image: "https://www.cloudflare.com/img/cf-twitter-card.png"
+    }
+  }
\ No newline at end of file
diff --git a/products/railgun/package.json b/products/railgun/package.json
new file mode 100644
index 00000000000..3334a89ef07
--- /dev/null
+++ b/products/railgun/package.json
@@ -0,0 +1,14 @@
+{
+    "private": true,
+    "dependencies": {
+        "cloudflare-docs-engine": "git+https://github.com/cloudflare/cloudflare-docs-engine.git"
+    },
+    "scripts": {
+        "bootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh bootstrap",
+        "build": "node_modules/cloudflare-docs-engine/bin/commands.sh build",
+        "develop": "node_modules/cloudflare-docs-engine/bin/commands.sh develop",
+        "ghactionsbootstrap": "node_modules/cloudflare-docs-engine/bin/commands.sh ghactionsbootstrap",
+        "savechanges": "node_modules/cloudflare-docs-engine/bin/commands.sh savechanges",
+        "serve": "node_modules/cloudflare-docs-engine/bin/commands.sh serve"
+    }
+}
diff --git a/products/railgun/src/content/changelog.md b/products/railgun/src/content/changelog.md
new file mode 100644
index 00000000000..a8e8effd6ce
--- /dev/null
+++ b/products/railgun/src/content/changelog.md
@@ -0,0 +1,70 @@
+---
+order: 21
+pcx-content-type: reference
+---
+
+# Changelog
+
+```txt
+* Apr 23 2018 Cloudflare Inc <help@cloudflare.com> - 5.3.3
+- Uses go 1.10.1
+
+* Mar 12 2018 Cloudflare Inc <help@cloudflare.com> - 5.3.2
+- Passthrough URIs with invalid percent encoding
+
+* Nov 28 2017 Cloudflare Inc <help@cloudflare.com> - 5.3.1
+- Fix IPv6 connections sometimes going to the wrong port
+
+* Nov 8 2016 CloudFlare Inc <help@cloudflare.com> - 5.3.0
+- Improve rg-listener.conf format and help text
+- Standardise error codes for origin failures
+- Return HTTP 527 for communication errors between sender and listener
+- Set railgun user agent if none is specified by client
+- Add memcached as package dependency
+
+* Dec 16 2015 CloudFlare Inc <help@cloudflare.com> - 5.2.0
+- Refactor listener's response/error event flow code
+- Retry transient HTTP errors once
+
+* Sep 21 2015 CloudFlare Inc <help@cloudflare.com> - 5.1.0
+- Better handling of origin request failures
+
+* Jul 13 2015 CloudFlare Inc <help@cloudflare.com> - 5.0.2
+- Switch to new GPG key for CloudFlare packages
+
+* Jan 10 2015 CloudFlare Inc <help@cloudflare.com> - 5.0.0
+- Performance and stability improvements
+- Better handling of HTTP keepalives
+- Reduced needed size for memcache
+- Misc bugfixes
+
+* Jul 15 2013 CloudFlare Inc <help@cloudflare.com> - 4.0.0
+- Optimize compression method
+- Remove libz and libcrypto dependencies
+- Add clearer error messages
+- Misc bugfixes
+
+* Feb 25 2013 CloudFlare Inc <help@cloudflare.com> - 3.3.0
+- Depend on libssl for speedier crypto routines than current Go
+- Add more options for debugging and memcache control
+- Improved diagnostic tools
+- Misc bugfixes
+
+* Nov 20 2012 CloudFlare Inc <help@cloudflare.com> - 2.7.0
+- memcached fixes and timeout adjustments
+- Direct HTTP request failover improvements
+- Misc bugfixes
+
+* Sep 14 2012 CloudFlare Inc <help@cloudflare.com> - 2.6.0
+- Implement memcached backend
+- Add activation and SSL systems
+- Misc bugfixes
+
+* Fri Sep 14 2012 CloudFlare Inc <help@cloudflare.com> - 2.0.0
+- Cache backend revamp
+- Performance improvements
+- Misc bufixes
+
+* Wed Jun 28 2012 CloudFlare Inc <help@cloudflare.com> - 1.0.0
+- Initial release.
+```
\ No newline at end of file
diff --git a/products/railgun/src/content/index.md b/products/railgun/src/content/index.md
new file mode 100644
index 00000000000..4cb33bcd661
--- /dev/null
+++ b/products/railgun/src/content/index.md
@@ -0,0 +1,13 @@
+---
+title: Overview
+order: 0
+pcx-content-type: landing-page
+---
+
+# Railgun documentation
+
+Railgun is a WAN optimization technology developed by Cloudflare and is available to Cloudflare Business and Enterprise customers, as well as [Optimized Partners](http://www.cloudflare.com/partner-programs). Railgun requires a piece of software called the Railgun Listener to be installed on your web server’s network. Railgun takes about an hour to install, setup, and test.
+
+## User’s guide
+
+<DirectoryListing path="/user-guide"/>
diff --git a/products/railgun/src/content/license-agreement.md b/products/railgun/src/content/license-agreement.md
new file mode 100644
index 00000000000..e64aafa6d41
--- /dev/null
+++ b/products/railgun/src/content/license-agreement.md
@@ -0,0 +1,53 @@
+---
+title: License agreement
+order: 20
+pcx-content-type: reference
+---
+
+# License
+
+SERVICES AGREEMENT
+
+Your installation of this software is symbol of your signature indicating that you accept the terms of this Services Agreement (this “Agreement”). This Agreement is a legal agreement between you (either an individual or a single entity) and CloudFlare Inc. for the services being provided to you by CloudFlare or its authorized representative (the “Services”), including any computer software and any associated media, printed materials, and “online” or electronic documentation provided in connection with the Services (the “Software” and together with the Services are hereinafter collectively referred to as the “Solution”). If the user is not an individual, then “you” means your company, its officers, members, employees, agents, representatives, successors and assigns. BY USING THE SOLUTION, YOU ARE INDICATING THAT YOU HAVE READ, AND AGREE TO BE BOUND BY, THE POLICIES, TERMS, AND CONDITIONS SET FORTH BELOW IN THEIR ENTIRETY WITHOUT LIMITATION OR QUALIFICATION, AS WELL AS BY ALL APPLICABLE LAWS AND REGULATIONS, AS IF YOU HAD HANDWRITTEN YOUR NAME ON A CONTRACT. IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS, YOU MAY NOT USE THE SOLUTION.
+
+1\. GRANT OF RIGHTS
+
+1.1 Grant of License. The Solution is licensed by CloudFlare and its licensors, not sold. Subject to the terms and conditions of this Agreement, CloudFlare hereby grants you a nonexclusive, nonsublicensable, nontransferable license to use the Solution.
+
+1.2 Restrictions. The license granted herein is granted solely to you and not, by implication or otherwise, to any of your parents, subsidiaries or affiliates. No right is granted hereunder to use the Solution to perform services for third parties. All rights not expressly granted hereunder are reserved to CloudFlare. You may not use the Solution except as explicitly permitted under this Agreement. You are expressly prohibited from modifying, adapting, translating, preparing derivative works from, decompiling, reverse engineering, disassembling or otherwise attempting to derive source code from the Software used to provide the Services or any internal data files generated by the Solution. You are also prohibited from removing, obscuring or altering any copyright notice, trademarks, or other proprietary rights notices affixed to or associated with the Solution.
+
+1.3 Ownership. As between the parties, CloudFlare and/or its licensors own and shall retain all right, title, and interest in and to the Solution, including any and all technology embodied therein, including all copyrights, patents, trade secrets, trade dress and other proprietary rights associated therewith, and any derivative works created there from.
+
+2\. LIMITATION OF LIABILITY
+
+YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT DOWNLOADING THE SOFTWARE IS AT YOUR SOLE RISK. THE SOFTWARE IS PROVIDED “AS IS” AND WITHOUT WARRANTY OF ANY KIND AND CloudFlare, ITS LICENSORS AND ITS AUTHORIZED REPRESENTATIVES (TOGETHER FOR PURPOSES HEREOF, “CloudFlare”) EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CloudFlare DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OR THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE SOFTWARE WILL BE CORRECTED. FURTHERMORE, CLOUDFLARE DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE SOFTWARE OR RELATED DOCUMENTATION IN TERMS OF THEIR CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY CloudFlare SHALL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY.
+
+3\. CONFIDENTIALITY
+
+It may be necessary during the set up and performance of the Solution for the parties to exchange Confidential Information. “Confidential Information” means any information whether oral, or written, of a private, secret, proprietary or confidential nature, concerning either party or its business operations, including without limitation: (a) your data and (b) CloudFlare’s access control systems, specialized network equipment and techniques related to the Solution, use policies, which include trade secrets of CloudFlare and its licensors. Each party agrees to use the same degree of care to protect the confidentiality of the Confidential Information of the other party and to prevent its unauthorized use or dissemination as it uses to protect its own Confidential Information of a similar nature, but in no event shall exercise less than due diligence and reasonable care. Each party agrees to use the Confidential Information of the other party only for purposes related to the performance of this Agreement. All Confidential Information remains the property of the party disclosing the information and no license or other rights to Confidential Information is granted or implied hereby.
+
+4\. TERM AND TERMINATION
+
+4.1 Term. This Agreement shall be effective upon download or install of the Software.
+
+4.2 Termination. This Agreement may be terminated by CloudFlare or its authorized representative by written notice to you if any of the following events occur: (i) you fail to pay any amounts due for the Services and the Solution when due and after written notice of such nonpayment has been given to you; (ii) you are in material breach of any term, condition, or provision of this Agreement or any other agreement executed by you with CloudFlare or its authorized representative in connection with the provision of the Solution and Services (a “Related Agreement”); or (iii) you terminate or suspend your business, becomes subject to any bankruptcy or insolvency proceeding under federal or state statutes, or become insolvent or subject to direct control by a trustee, receiver or similar authority.
+
+4.3 Effect of Termination. Upon the termination of this Agreement for any reason: (1) all license rights granted hereunder shall terminate and (2) all Confidential Information shall be returned to the disclosing party or destroyed.
+
+5\. MISCELLANEOUS
+
+5.1 Assignment. You may not assign any of your rights or delegate any of your obligations under this Agreement, whether by operation of law or otherwise, without the prior express written consent of CloudFlare or its authorized representative. Any such assignment without the prior express written consent of CloudFlare or its authorized representative shall be void. Subject to the foregoing, this Agreement will bind and inure to the benefit of the parties, their respective successors and permitted assigns.
+
+5.2 Waiver and Amendment. No modification, amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by the party to be charged. No failure or delay by either party in exercising any right, power, or remedy under this Agreement, except as specifically provided herein, shall operate as a waiver of any such right, power or remedy. Without limiting the foregoing, terms and conditions on any purchase orders or similar materials submitted by you to CloudFlare or its authorized representative shall be of no force or effect.
+
+5.3 Governing Law. This Agreement shall be governed by the laws of the State of California, USA, excluding conflict of laws and provisions, and excluding the United Nations Convention on Contracts for the International Sale of Goods.
+
+5.4 Notices. All notices, demands or consents required or permitted under this Agreement shall be in writing. Notice shall be sent to you at the e-mail address provided by you to CloudFlare or its authorized representative in connection with the Solution.
+
+5.5 Independent Contractors. The parties are independent contractors. Neither party shall be deemed to be an employee, agent, partner or legal representative of the other for any purpose and neither shall have any right, power or authority to create any obligation or responsibility on behalf of the other.
+
+5.6 Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, such provision shall be changed and interpreted so as to best accomplish the objectives of the original provision to the fullest extent allowed by law and the remaining provisions of this Agreement shall remain in full force and effect.
+
+5.7 Force Majeure. CloudFlare shall not be liable to the other party for any failure or delay in performance caused by reasons beyond its reasonable control.
+
+5.8 Complete Understanding. This Agreement and the Related Agreement constitute the final, complete and exclusive agreement between the parties with respect to the subject matter hereof, and supersedes all previous written and oral agreements and communications related to the subject matter of this Agreement. To the extent this Agreement and the Related Agreement conflict, this Agreement shall control.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/administration.md b/products/railgun/src/content/user-guide/administration.md
new file mode 100644
index 00000000000..4e265dda6ac
--- /dev/null
+++ b/products/railgun/src/content/user-guide/administration.md
@@ -0,0 +1,84 @@
+---
+order: 9
+pcx-content-type: how-to
+---
+
+# Administration
+
+## Overview
+
+Multiple Railguns may be added to a Cloudflare account. Only one registered and activated Railgun may be used per domain.
+
+Railgun can be load-balanced and multiple Railgun daemons can be used per activated public IP and token. There is no need to register each Railgun daemon.
+
+## Adding a Railgun
+
+1. Navigate to the [Railgun listing page](https://www.cloudflare.com/a/account/my-account/).
+1. Enter the descriptive title of your choosing.
+1. Press the `Add` button.
+1. Within your Railgun configuration file, update `activation.public_ip` to the public IP or a hostname which resolves to the public IP of your Railgun’s server and set the `activation.token` to the activation key displayed on the page.
+1. Start the Railgun daemon so that it can proceed with activation.
+1. If everything went smoothly, the red icon will change to a green check-mark after refreshing the page and the Railgun can then be toggled on.
+1. If the Railgun fails to activate, check your logs for errors and [contact support](https://support.cloudflare.com/hc/articles/200172476) if the issue persists.
+
+## Enabling Railgun
+
+1. Navigate to the Railgun Settings section of the Speed page for your domain for your domain and select the desired Railgun from the drop-down menu.
+1. Switch the toggle to `On`.
+
+## Collecting and Reporting Statistics
+
+Railgun can report statistics via syslog, JSON via a HTTP POST request, or through its own simple HTTP server when enabled. To enable statistics collection, first set `stats.enabled` to `1` within the main Railgun configuration file (`railgun.conf`). To enable syslog statistics reporting, set `stats.log` to `1`. To enable reporting via an HTTP POST request of JSON data to the specified URL, set `stats.url` to a valid URL. `stats.interval` determines how frequently stats will be logged or POSTed in minutes.
+
+If `stats.listen` is set to a non-empty `host:post` string, Railgun will spawn a local HTTP server and listen on that interface awaiting a `GET /` HTTP request. The response will be JSON-encoded statistics. The statistics returned will change according to `stats.interval`. If the Railgun statistics port is not protected via a firewall, the host portion should be set to a loopback interface (e.g., `127.0.0.1` or `localhost`) to prevent external access. An example response follows:
+
+```sh
+$ curl -v http://127.0.0.1:22408/
+
+> GET / HTTP/1.1
+> Accept: */*
+>
+< HTTP/1.1 200 OK
+< Content-Length: 1191
+< Content-Type: application/json
+< Date: Tue, 02 Apr 2013 16:56:57 GMT
+{
+    "bytes_retrieved": 2794091,
+    "conveyor_cleans_chunk": 1,
+    "conveyor_cleans_hasher": 1,
+    "conveyor_get": 0,
+    "conveyor_give": 0,
+    "conveyor_queue_chunk": 3,
+    "conveyor_queue_hasher": 29,
+    "conveyor_removed_chunk": 0,
+    "conveyor_removed_hasher": 0,
+    "conveyor_retained_chunk": 3212,
+    "conveyor_retained_hasher": 19468,
+    "conveyor_tuned_chunk": 753,
+    "conveyor_tuned_hasher": 1471,
+    "delta_compression_ratio": 6890,
+    "memstats.Frees": 51773495,
+    "memstats.Mallocs": 52696575,
+    "memstats.alloc": 128060840,
+    "memstats.heap_alloc": 128060840,
+    "memstats.heap_idle": 22933504,
+    "memstats.heap_in_use": 134352896,
+    "memstats.heap_objects": 923080,
+    "memstats.heap_released": 0,
+    "memstats.heap_sys": 157286400,
+    "memstats.lookups": 305636,
+    "memstats.num_gc": 133,
+    "memstats.pause_ns": 164422,
+    "memstats.stack_in_use": 3940352,
+    "memstats.stack_sys": 6160384,
+    "memstats.sys": 448807352,
+    "memstats.total_alloc": 5162978952,
+    "no_origin_response": 1,
+    "origin_retries": 0,
+    "requests_completed": 2455,
+    "requests_started": 2295,
+    "uncompressed_chunks": 2552,
+    "wan_bytes_sent": 2952019,
+    "wan_starts": 44
+}
+```
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/client-api/enable-and-disable-connections.md b/products/railgun/src/content/user-guide/client-api/enable-and-disable-connections.md
new file mode 100644
index 00000000000..3db73cf4399
--- /dev/null
+++ b/products/railgun/src/content/user-guide/client-api/enable-and-disable-connections.md
@@ -0,0 +1,452 @@
+---
+order: 13
+pcx-content-type: configuration
+---
+
+# Enable and disable connections
+
+After a Railgun has been activated, it can be assigned to a particular domain with the [conn_set](/user-guide/client-api/enable-and-disable-connections/#post-conn_set) API call. [conn_setmode_enabled](/user-guide/client-api/enable-and-disable-connections/#post-conn_setmode_enabled) and [conn_setmode_disabled](/user-guide/client-api/enable-and-disable-connections/#post-conn_setmode_disabled) can be used to toggle Railgun on or off for the domain. [conn_set](/user-guide/client-api/enable-and-disable-connections/#post-conn_set) also accepts a mode parameter to assign and enable Railgun in a single API call. [zone_conn_get_active](/user-guide/client-api/list-railgun-details/#post-zone_conn_get_active) can be used to view active Railgun connections.
+
+## POST conn_set
+
+`POST /api/v2/railgun/conn_set`
+
+Establish a connection between a domain and a Railgun.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **mode** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_set HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+mode=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_set",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_set
+
+`GET /api/v2/railgun/conn_set`
+
+Establish a connection between a domain and a Railgun.
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **mode** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_set?email=&tkn=&rtkn=&z=&mode= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+mode=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_set",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_setmode_enabled
+
+`POST /api/v2/railgun/conn_setmode_enabled`
+
+Enable a Railgun. If request is successful, the specified Railgun will be enabled and traffic for the specified domain will be proxied through Railgun.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_setmode_enabled HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_enabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_setmode_enabled
+
+`GET /api/v2/railgun/conn_setmode_enabled`
+
+Enable a Railgun. If request is successful, the specified Railgun will be enabled and traffic for the specified domain will be proxied through Railgun.
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_setmode_enabled?email=&tkn=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_enabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_setmode_disabled
+
+`POST /api/v2/railgun/conn_setmode_disabled`
+
+Disable a Railgun. If request is successful, the specified Railgun will be disabled and traffic for the specified domain will no longer use Railgun.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_setmode_disabled HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_disabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_setmode_disabled
+
+`GET /api/v2/railgun/conn_setmode_disabled`
+
+Disable a Railgun. If request is successful, the specified Railgun will be disabled and traffic for the specified domain will no longer use Railgun.
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_setmode_disabled?email=&tkn=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_disabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_delete
+
+`POST /api/v2/railgun/conn_delete`
+
+Remove a connection between a domain and a Railgun. This API call will allow a connected Railgun to be assigned to a different domain. Removing the connection of an enabled Railgun and domain will disable Railgun for the domain until a new connection is made with [conn_set](/user-guide/client-api/enable-and-disable-connections/#post-conn_set).
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_delete HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_delete",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_delete
+
+`GET /api/v2/railgun/conn_delete`
+
+Remove a connection between a domain and a Railgun. This API call will allow a connected Railgun to be assigned to a different domain. Removing the connection of an enabled Railgun and domain will disable Railgun for the domain until a new connection is made with [conn_set](/user-guide/client-api/enable-and-disable-connections/#post-conn_set).
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_delete?email=&tkn=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_delete",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
diff --git a/products/railgun/src/content/user-guide/client-api/index.md b/products/railgun/src/content/user-guide/client-api/index.md
new file mode 100644
index 00000000000..86391ab6904
--- /dev/null
+++ b/products/railgun/src/content/user-guide/client-api/index.md
@@ -0,0 +1,14 @@
+---
+order: 10
+pcx-content-type: reference
+---
+
+# Client API
+
+## Overview
+
+This article is intended for Cloudflare users with a Business or Enterprise subscription. Hosting partners must use the Optimized Partner API. All Railgun API requests must either include a Client API token and email address as a request parameter. API keys can be found and managed on the [My Account](https://www.cloudflare.com/my-account) page. All API requests should be directed at `https://www.cloudflare.com/`.
+
+Multiple Railguns may be added to a Cloudflare account. Only one registered and activated Railgun may be used per domain. Railgun can be load-balanced and multiple Railgun daemons can be used per activated public IP and token. There is no need to register each Railgun daemon.
+
+All API methods may be performed either as `GET` requests that include query string parameters or `POST` requests. The return status of the API request and any relevant errors messages are within the returned JSON response body. The `result` member indicates success or failure and the `msg` member contains further details if applicable.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/client-api/list-railgun-details.md b/products/railgun/src/content/user-guide/client-api/list-railgun-details.md
new file mode 100644
index 00000000000..81c0c4855c1
--- /dev/null
+++ b/products/railgun/src/content/user-guide/client-api/list-railgun-details.md
@@ -0,0 +1,338 @@
+---
+order: 12
+pcx-content-type: configuration
+---
+
+# List Railgun details
+
+The following API calls can be used to determine details and the status or one or more Railguns assigned to an account. These calls are sometimes needed to determine the unique `rtkn` or `id` assigned to a Railgun.
+
+## POST user_get_all
+
+`POST /api/v2/railgun/user_get_all`
+
+Assign a Railgun to a domain.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/user_get_all HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_user_get_all",
+        "railguns": {
+            "count": 5,
+            "objs": [
+                {
+                    "cdate": "2012-10-27 16:34:37.718746-07",
+                    "edate": "2012-11-06 13:02:16.153332-08",
+                    "props": {
+                        "build": "2012-10-27-1257",
+                        "number": "2.6.0",
+                        "revision": "ff3f8f25f5238de327cf34059659de0738399176"
+                    },
+                    "railgun_activated_on": "2012-11-06 13:02:16.122355-08",
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "1",
+                    "railgun_ip": null,
+                    "railgun_mode": "1",
+                    "railgun_name": "RG_100f5777999990edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for example.com",
+                    "railgun_rec_id": "100",
+                    "railgun_rec_name": "rg-d65dfffff666a75fd3dea2a7cfeede90.port2408.net",
+                    "railgun_status": "V",
+                    "railgun_tag": "a18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                },
+                {
+                    "cdate": "2012-11-02 00:03:33.17205-07",
+                    "edate": "2012-11-02 00:03:33.17205-07",
+                    "props": {
+                        "build": null,
+                        "number": null,
+                        "revision": null
+                    },
+                    "railgun_activated_on": null,
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "178",
+                    "railgun_ip": null,
+                    "railgun_mode": "0",
+                    "railgun_name": "RG_000f7777999690edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for mydomain.com",
+                    "railgun_rec_id": null,
+                    "railgun_rec_name": null,
+                    "railgun_status": "INI",
+                    "railgun_tag": "d18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                }
+            ]
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET user_get_all
+
+`GET /api/v2/railgun/user_get_all`
+
+Assign a Railgun to a domain.
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/user_get_all?email=&tkn= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_user_get_all",
+        "railguns": {
+            "count": 5,
+            "objs": [
+                {
+                    "cdate": "2012-10-27 16:34:37.718746-07",
+                    "edate": "2012-11-06 13:02:16.153332-08",
+                    "props": {
+                        "build": "2012-10-27-1257",
+                        "number": "2.6.0",
+                        "revision": "ff3f8f25f5238de327cf34059659de0738399176"
+                    },
+                    "railgun_activated_on": "2012-11-06 13:02:16.122355-08",
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "1",
+                    "railgun_ip": null,
+                    "railgun_mode": "1",
+                    "railgun_name": "RG_100f5777999990edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for example.com",
+                    "railgun_rec_id": "100",
+                    "railgun_rec_name": "rg-d65dfffff666a75fd3dea2a7cfeede90.port2408.net",
+                    "railgun_status": "V",
+                    "railgun_tag": "a18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                },
+                {
+                    "cdate": "2012-11-02 00:03:33.17205-07",
+                    "edate": "2012-11-02 00:03:33.17205-07",
+                    "props": {
+                        "build": null,
+                        "number": null,
+                        "revision": null
+                    },
+                    "railgun_activated_on": null,
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "178",
+                    "railgun_ip": null,
+                    "railgun_mode": "0",
+                    "railgun_name": "RG_000f7777999690edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for mydomain.com",
+                    "railgun_rec_id": null,
+                    "railgun_rec_name": null,
+                    "railgun_status": "INI",
+                    "railgun_tag": "d18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                }
+            ]
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST zone_conn_get_active
+
+`POST /api/v2/railgun/zone_conn_get_active`
+
+List all active Railgun connections for a domain.
+
+### Form parameters
+
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/zone_conn_get_active HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_zone_conn_get_active",
+        "railgun_conn": {
+            "obj": {
+                    "railgun_conn_id": "2",
+                    "railgun_id": "123",
+                    "railgun_conn_status": "V",
+                    "railgun_conn_mode": "1",
+                    "railgun_enabled": "t",
+                }
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET zone_conn_get_active
+
+`GET /api/v2/railgun/zone_conn_get_active`
+
+List all active Railgun connections for a domain.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/zone_conn_get_active?email=&tkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_zone_conn_get_active",
+        "railgun_conn": {
+            "obj": {
+                    "railgun_conn_id": "2",
+                    "railgun_id": "123",
+                    "railgun_conn_status": "V",
+                    "railgun_conn_mode": "1",
+                    "railgun_enabled": "t",
+                }
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
diff --git a/products/railgun/src/content/user-guide/client-api/manage-railguns.md b/products/railgun/src/content/user-guide/client-api/manage-railguns.md
new file mode 100644
index 00000000000..ab1c28c935d
--- /dev/null
+++ b/products/railgun/src/content/user-guide/client-api/manage-railguns.md
@@ -0,0 +1,230 @@
+---
+order: 11
+pcx-content-type: configuration
+---
+
+# Manage Railguns
+
+Creating and activating a Railgun requires two API calls. First, a Railgun must be initialized using the `init` call. The activation API call is made by Railgun when the daemon is started and does not need to be made by a user.
+
+## POST init
+
+`POST /api/v2/railgun/init`  
+
+Create a Railgun. If request is successful, a new Railgun is added to a user account and placed in initializing status (`INI`).
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **name** – Name of Railgun
+* **pubname** – Name of Railgun shown to users
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/init HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+pubname=My%20Railgun
+name=my-railgun
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_init",
+         "railgun_id": "1",
+         "railgun_name": "RG_a1b2c3d4e5f6g7h8i9j0k1",
+         "railgun_status": "INI",
+         "rtkn": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET init
+
+`GET /api/v2/railgun/init`
+
+Create a Railgun. If request is successful, a new Railgun is added to a user account and placed in initializing status (`INI`).
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **name** – Name of Railgun
+* **pubname** – Name of Railgun shown to users
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/init?email=&tkn=&pubname=&name= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+pubname=My%20Railgun
+name=my-railgun
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_init",
+         "railgun_id": "1",
+         "railgun_name": "RG_a1b2c3d4e5f6g7h8i9j0k1",
+         "railgun_status": "INI",
+         "rtkn": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST delete
+
+`POST /api/v2/railgun/delete`
+
+Delete a Railgun. If request is successful, the Railgun with a token matching `rtkn` is removed from the account and set to deleted status (`D`).
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/delete HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_delete",
+         "railgun_id": "1",
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET delete
+
+`GET /api/v2/railgun/delete`
+
+Delete a Railgun. If request is successful, the Railgun with a token matching `rtkn` is removed from the account and set to deleted status (`D`).
+
+### Query parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/delete?email=&tkn=&rtkn= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+email=user%40cloudflare.com
+tkn=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_delete",
+         "railgun_id": "1",
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
diff --git a/products/railgun/src/content/user-guide/increase-logging.md b/products/railgun/src/content/user-guide/increase-logging.md
new file mode 100644
index 00000000000..9118add9ea8
--- /dev/null
+++ b/products/railgun/src/content/user-guide/increase-logging.md
@@ -0,0 +1,45 @@
+---
+order: 22
+pcx-content-type: reference
+---
+
+# Increase logging for Railgun
+
+When troubleshooting or testing the Railgun Listener, it may be necessary to raise the level of verbosity to capture more log data for debugging. 
+
+In order to increase logging, the `log.level` within `railgun.conf` should be set to **5** in order for all events within the Listener instance to be captured during troubleshooting.
+
+<Aside>
+
+**Note**: The Railgun service running on the server will also need to be restarted. For changes to take effect, input the following: 
+
+```sh
+$ service railgun restart
+```
+
+</Aside>
+
+The log files for Railgun can be found in the following locations for each supported operating system:
+
+<details>
+<summary>Debian/Ubuntu</summary>
+<div>
+
+Default Location: `/var/log/syslog`. When the `log.level` set to **5** in `railgun.conf`, no further action is needed to have very verbose logs appear in syslog.
+
+</div>
+</details>
+
+<details>
+<summary>CentOS/RHEL</summary>
+<div>
+
+Default Location: `/var/log/messages`.
+
+By default, CentOS and RHEL omit many logs from `/messages`. A few extra steps are needed to achieve the same level of verbosity as Debian/Ubuntu:
+
+1. Editing `/etc/rsyslog.conf` so that the line that reads: `*.info;mail.none;authpriv.none;cron.none /var/log/messages` is updated to be: `*.* /var/log/messages`. Comment out the default line and add this on a new line below it. Another option is to create a new log file.
+1. Restarting `rsyslog` and Railgun services. This may need to be done with `sudo` or as `root`: `service rsyslog restart service railgun restart`. If Railgun or `memcached` fails over/crashes, logs can be found under `/var/log/railgun/panic.log`.
+
+</div>
+</details>
diff --git a/products/railgun/src/content/user-guide/index.md b/products/railgun/src/content/user-guide/index.md
new file mode 100644
index 00000000000..680f930f76b
--- /dev/null
+++ b/products/railgun/src/content/user-guide/index.md
@@ -0,0 +1,9 @@
+---
+title: User guide
+order: 1
+pcx-content-type: navigation
+---
+
+# General documentation for end users
+
+<DirectoryListing path="/user-guide"/>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/introduction.md b/products/railgun/src/content/user-guide/introduction.md
new file mode 100644
index 00000000000..00a2e2421df
--- /dev/null
+++ b/products/railgun/src/content/user-guide/introduction.md
@@ -0,0 +1,116 @@
+---
+order: 2
+pcx-content-type: reference
+---
+
+# Introduction
+
+One of the major advantages of using Cloudflare is that cacheable content (such as images, JavaScript, CSS and HTML) is both cached by Cloudflare and delivered from our data centers around the world. Because Cloudflare has data centers covering the entire globe, cached content gets delivered quickly to web surfers wherever they are (and overcomes latency problems).
+
+But only about 66% of content is cacheable. The other 34% must be obtained from the real origin web server. Railgun overcomes this problem by using a scheme that is able to cache dynamically generated or personalized web pages dramatically reducing bandwidth used and improving download times.
+
+Railgun is a single daemon that runs on a 64-bit system which uses alternative compression techniques to dramatically speed up WAN performance.
+
+It proxies traffic through a special protocol that would normally travel between Cloudflare and your origin server over HTTP.
+
+Typically, the markup of websites, or the body a JSON API response, does not change that frequently from one request to the next. Instead of transferring the entire request between Cloudflare and your environment, Railgun will transfer only the changes in markup from one request to the next. This cuts down on bandwidth, transfer time, and overall page load times. Railgun caches these differences in memory to make page processing as fast as possible.
+
+## Requirements
+
+<TableWrap>
+    <table>
+        <tr>
+            <th>&nbsp;</th>
+            <th>Business and Enterprise Users</th>
+            <th>Optimized Partners</th>
+        </tr>
+        <tr>
+            <td><strong>Hardware</strong></td>
+            <td>
+                <ul>
+                    <li>Dual core processor</li>
+                    <li>4 GB RAM</li>
+                    <li>64-bit Architecture</li>
+                </ul>
+            </td>
+            <td>
+                <ul>
+                    <li>Quad core processor</li>
+                    <li>8 GB RAM</li>
+                    <li>64-bit Architecture</li>
+                </ul>
+            </td>
+        </tr>
+        <tr>
+            <td><strong>Software</strong></td>
+            <td>
+                <ul>
+                    <li>Memcache &gt;= 1.4 with at least 512 MB of storage (&gt;1 GB recommended)</li>
+                </ul>
+            </td>
+            <td>
+                <ul>
+                    <li>Memcache &gt;= 1.4 with at least 1 GB of storage (&gt;2 GB recommended)</li>
+                </ul>
+            </td>
+        </tr>
+        <tr>
+            <td><strong>Operating System</strong></td>
+            <td>
+                <ul>
+                    <li>Debian 8, 9</li>
+                    <li>Ubuntu Linux 12.04, 14.04, 16.04</li>
+                    <li>Red Hat Enterprise Linux 6, 7</li>
+                    <li>CentOS 6, 7</li>
+                </ul>
+            </td>
+            <td>&nbsp;</td>
+        </tr>
+        <tr>
+            <td><strong>Network</strong></td>
+            <td>
+                <ul>
+                    <li>Port 2408 open to traffic from our <a href="https://www.cloudflare.com/ips">IPs</a></li>
+                </ul>
+            </td>
+            <td>&nbsp;</td>
+        </tr>
+    </table>
+</TableWrap>
+
+## Support
+
+When contacting [Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476), provide the following information (if accessible):
+* Your `railgun.conf` and `railgun-nat.conf` (if applicable) files.
+* Output from `/var/log/messages` from Railgun.
+* A copy of `/var/log/railgun/panic.log`, if not empty.
+
+Providing the IP address or hostname of your Railgun server will also allow our Support team to test connectivity remotely. Please let us know if you have firewalled your Railgun server when lodging support request.
+
+## Implementation Details
+
+Railgun works by recognizing that uncacheable web pages do not change very rapidly. For example, we captured the CNN homepage HTML once, then again after five minutes and then again after one hour. The page sizes were 92,516, five minutes later still 92,516 and one hour later 93,727.
+
+CNN sets the caching on this page to 60 seconds. After one minute it’s necessary to download the entire page again. But looking inside the page itself not much has changed. In fact, the change between versions is on order of 100s of bytes out of almost 100k. Here’s a screenshot of one of the small binary differences between the CNN home page at five minute intervals. The yellow bytes have changed, the rest have not:
+
+![Binary of CNN homepage](./media/cnn.webp)
+
+Experiments at Cloudflare has revealed similar change values across the web. For example, reddit.com changes by about 2.15% over five minutes and 3.16% over an hour. The New York Times home page changes by about 0.6% over five minutes and 3% over an hour. BBC News changes by about 0.4% over five minutes and 2% over an hour.
+
+Although the dynamic web is not cacheable, it’s also not changing quickly. That means that from moment to moment there’s only a small change between versions of a page. Railgun uses this fact to achieve very high rates of compression. This is very similar to how video compression looks for changes from frame to frame; Railgun looks for changes on a page from download to download.
+
+Railgun consists of two components: the sender and the listener. The sender is installed at every Cloudflare data center around the world. The listener is a software component that premium customers install on their network.
+
+The sender and listener establish a permanent TCP connection that’s secured by TLS. This TCP connection is used for the Railgun protocol. It’s an all binary multiplexing protocol that allows multiple HTTP requests to be run simultaneously and asynchronously across the link.
+
+To a web client the Railgun system looks like a proxy server, but instead of being a server it’s a wide-area link with special properties. One of those properties is that it performs compression on non-cacheable content by synchronizing page versions.
+
+Each end of the Railgun link keeps track of the last version of a web page that’s been requested. When a new request comes in for a page that Railgun has already seen, only the changes are sent across the link. The listener component make an HTTP request to the real, origin web server for the uncacheable page, makes a comparison with the stored version and sends across the differences.
+
+The sender then reconstructs the page from its cache and the difference sent by the other side.
+
+Of course, compression is used on web pages today. The most common technique is to gzip the page itself. CNN actually does this and sends 23,529 bytes of gzipped data which when decompressed become 92,516 bytes of page (so the page is compressed to 25.25% of its original size). And Google has proposed a somewhat complex dictionary based scheme called SDCH which is not widely deployed.
+
+But the Railgun compression technique goes much further. The compression between versions 1 and 2 of the page above (at five minute intervals) results in just 266 bytes of difference data being sent (a compression to 0.29% of the original page size). The one hour difference (versions 2 to 3 above) is 2,885 bytes (a compression to 3% of the original page size). Clearly, Railgun compression outpeforms gzip enormously.
+
+For pages that are frequently accessed the deltas are often so small that they fit inside a single TCP packet, and because the connection between the two parts of Railgun is kept active problems with TCP connection time and slow start are eliminated.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/media/cnn.webp b/products/railgun/src/content/user-guide/media/cnn.webp
new file mode 100644
index 00000000000..54f1f8af7cd
Binary files /dev/null and b/products/railgun/src/content/user-guide/media/cnn.webp differ
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/enable-and-disable-connections.md b/products/railgun/src/content/user-guide/optimized-partner-api/enable-and-disable-connections.md
new file mode 100644
index 00000000000..376661d4eed
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/enable-and-disable-connections.md
@@ -0,0 +1,548 @@
+---
+order: 17
+pcx-content-type: configuration
+---
+
+# Enable and disable connections
+
+After a Railgun has been activated, it can be exposed to a particular domain with the [suggestion_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-suggestion_set) API call. [suggestion_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-suggestion_set) also accepts the `auto_enabled` parameter to assign and enable Railgun for the domain globally in a single API call. If `auto_enabled` is not set to `1`, then the connection needed to enable Railgun for the domain must be made manually using the [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_set) method. [conn_setmode_enabled](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_setmode_enabled) and [conn_setmode_disabled](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_setmode_disabled) can be used to toggle Railgun on or off for the domain globally. [zone_conn_get_active](/user-guide/optimized-partner-api/list-railgun-details#post-zone_conn_get_active) can be used to view active Railgun connections.
+
+## POST suggestion_set
+
+`POST /api/v2/railgun/suggestion_set`
+
+Expose a verified Railgun to a domain via the Cloudflare Settings user-interface. This method allows an end-user to select and enable the specified Railgun within the Cloudflare Settings user-interface. If `auto_enabled` is set to `0`, it is also necessary to perform a [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_set) for the Railgun in order to setup a connection with the domain.
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **auto_enabled** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/suggestion_set HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+auto_enabled=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+        "act": "railgun_suggest",
+        "railgun_id": "1",
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET suggestion_set
+
+`GET /api/v2/railgun/suggestion_set`
+
+Expose a verified Railgun to a domain via the Cloudflare Settings user-interface. This method allows an end-user to select and enable the specified Railgun within the Cloudflare Settings user-interface. If `auto_enabled` is set to `0`, it is also necessary to perform a [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_set) for the Railgun in order to setup a connection with the domain.
+
+### Query parameters
+
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **auto_enabled** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/suggestion_set?host_key=&rtkn=&z=&mode= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+auto_enabled=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+        "act": "railgun_suggest",
+        "railgun_id": "1",
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_set
+
+`POST /api/v2/railgun/conn_set`
+
+Establish a connection between a domain and a Railgun without requiring the domain’s user to utilize the Cloudflare Settings user-interface to change or deactivate it. The `mode` parameter can be set to `1` in order to enable the Railgun globally if `conn_set` succeeds.
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **mode** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_set HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+mode=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+        "act": "railgun_conn_set",
+        "railgun_conn_id": "1",
+        "railgun_rec_name": "rg-d65dfffff666a77fd3dea2a7cfeede90.port2408.net"
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_set
+
+`GET /api/v2/railgun/conn_set`
+
+Establish a connection between a domain and a Railgun without requiring the domain’s user to utilize the Cloudflare Settings user-interface to change or deactivate it. The `mode` parameter can be set to `1` in order to enable the Railgun globally if `conn_set` succeeds.
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+* **mode** – Railgun operation mode, `1` for active `0` for inactive
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_set?host_key=&rtkn=&z=&mode= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+mode=0
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+        "act": "railgun_conn_set",
+        "railgun_conn_id": "1",
+        "railgun_rec_name": "rg-d65dfffff666a77fd3dea2a7cfeede90.port2408.net"
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_setmode_enabled
+
+`POST /api/v2/railgun/conn_setmode_enabled`
+
+Enable a Railgun. If request is successful, the specified Railgun will be enabled and traffic for the specified domain will be proxied through Railgun.
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_setmode_enabled HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_enabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_setmode_enabled
+
+`GET /api/v2/railgun/conn_setmode_enabled`
+
+Enable a Railgun. If request is successful, the specified Railgun will be enabled and traffic for the specified domain will be proxied through Railgun.
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_setmode_enabled?host_key=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_enabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_setmode_disabled
+
+`POST /api/v2/railgun/conn_setmode_disabled`
+
+Disable a Railgun. If request is successful, the specified Railgun will be disabled and traffic for the specified domain will no longer use Railgun.
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_setmode_disabled HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_disabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_setmode_disabled
+
+`GET /api/v2/railgun/conn_setmode_disabled`
+
+Disable a Railgun. If request is successful, the specified Railgun will be disabled and traffic for the specified domain will no longer use Railgun.
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_setmode_disabled?host_key=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_setmode_disabled",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST conn_delete
+
+`POST /api/v2/railgun/conn_delete`
+
+Remove a connection between a domain and a Railgun. This API call will allow a connected Railgun to be assigned to a different domain. Removing the connection of an enabled Railgun and domain will disable Railgun for the domain until a new connection is made with [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_set).
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/conn_delete HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_delete",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET conn_delete
+
+`GET /api/v2/railgun/conn_delete`
+
+Remove a connection between a domain and a Railgun. This API call will allow a connected Railgun to be assigned to a different domain. Removing the connection of an enabled Railgun and domain will disable Railgun for the domain until a new connection is made with [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#post-conn_set).
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **z** – Domain name
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/conn_delete?host_key=&rtkn=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_conn_delete",
+         "railgun_id": "1"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/index.md b/products/railgun/src/content/user-guide/optimized-partner-api/index.md
new file mode 100644
index 00000000000..91619c8df1f
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/index.md
@@ -0,0 +1,14 @@
+---
+order: 14
+pcx-content-type: reference
+---
+
+# Optimized partner API
+
+## Overview
+
+This article is intended for Cloudflare Optimized Hosting Partners. End-users must utilize the Client API. All Railgun API requests must include a [Host API](http://www.cloudflare.com/docs/host-api.html) token as a request parameter. You can apply for an API key or read more about Cloudflare Hosting Partner programs [in our Partnerships page](https://www.cloudflare.com/partner-programs). All API requests should be directed at `https://www.cloudflare.com/`.
+
+Multiple Railguns may be added to a Cloudflare host account. Only one registered and activated Railgun may be used per domain. Railgun can be load-balanced and multiple Railgun daemons can be used per activated public IP and token. There is no need to register each Railgun daemon if they share a public IP.
+
+All API methods may be performed either as `GET` requests that include query string parameters or `POST` requests. The return status of the API request and any relevant errors messages are within the returned JSON response body. The `result` member indicates success or failure and the `msg` member contains further details if applicable.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/list-railgun-details.md b/products/railgun/src/content/user-guide/optimized-partner-api/list-railgun-details.md
new file mode 100644
index 00000000000..f74d052a5ab
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/list-railgun-details.md
@@ -0,0 +1,333 @@
+---
+order: 16
+pcx-content-type: configuration
+---
+
+# List Railgun details
+
+The following API calls can be used to determine details and the status or one or more Railguns assigned to an account. These calls are sometimes needed to determine the unique `rtkn` or `id` assigned to a Railgun.
+
+## POST host_get_all
+
+`POST /api/v2/railgun/host_get_all`
+
+Assign a Railgun to a domain
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/host_get_all HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters
+
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_host_get_all",
+        "railguns": {
+            "count": 5,
+            "objs": [
+                {
+                    "cdate": "2012-10-27 16:34:37.718746-07",
+                    "edate": "2012-11-06 13:02:16.153332-08",
+                    "props": {
+                        "build": "2012-10-27-1257",
+                        "number": "2.6.0",
+                        "revision": "ff3f8f25f5238de327cf34059659de0738399176"
+                    },
+                    "railgun_activated_on": "2012-11-06 13:02:16.122355-08",
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "1",
+                    "railgun_ip": null,
+                    "railgun_mode": "1",
+                    "railgun_name": "RG_100f5777999990edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for example.com",
+                    "railgun_rec_id": "100",
+                    "railgun_rec_name": "rg-d65dfffff666a77fd3dea2a7cfeede90.port2408.net",
+                    "railgun_status": "V",
+                    "railgun_tag": "a18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                },
+                {
+                    "cdate": "2012-11-02 00:03:33.17205-07",
+                    "edate": "2012-11-02 00:03:33.17205-07",
+                    "props": {
+                        "build": null,
+                        "number": null,
+                        "revision": null
+                    },
+                    "railgun_activated_on": null,
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "178",
+                    "railgun_ip": null,
+                    "railgun_mode": "0",
+                    "railgun_name": "RG_000f7777999690edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for mydomain.com",
+                    "railgun_rec_id": null,
+                    "railgun_rec_name": null,
+                    "railgun_status": "INI",
+                    "railgun_tag": "d18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                }
+            ]
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET host_get_all
+
+`GET /api/v2/railgun/host_get_all`
+
+Assign a Railgun to a domain
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/host_get_all?host_key= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_host_get_all",
+        "railguns": {
+            "count": 5,
+            "objs": [
+                {
+                    "cdate": "2012-10-27 16:34:37.718746-07",
+                    "edate": "2012-11-06 13:02:16.153332-08",
+                    "props": {
+                        "build": "2012-10-27-1257",
+                        "number": "2.6.0",
+                        "revision": "ff3f8f25f5238de327cf34059659de0738399176"
+                    },
+                    "railgun_activated_on": "2012-11-06 13:02:16.122355-08",
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "1",
+                    "railgun_ip": null,
+                    "railgun_mode": "1",
+                    "railgun_name": "RG_100f5777999990edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for example.com",
+                    "railgun_rec_id": "100",
+                    "railgun_rec_name": "rg-d65dfffff666a77fd3dea2a7cfeede90.port2408.net",
+                    "railgun_status": "V",
+                    "railgun_tag": "a18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                },
+                {
+                    "cdate": "2012-11-02 00:03:33.17205-07",
+                    "edate": "2012-11-02 00:03:33.17205-07",
+                    "props": {
+                        "build": null,
+                        "number": null,
+                        "revision": null
+                    },
+                    "railgun_activated_on": null,
+                    "railgun_api_key": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp",
+                    "railgun_deleted_on": null,
+                    "railgun_host_id": null,
+                    "railgun_id": "178",
+                    "railgun_ip": null,
+                    "railgun_mode": "0",
+                    "railgun_name": "RG_000f7777999690edb60d2db56627f9",
+                    "railgun_port": "2408",
+                    "railgun_pubname": "Railgun for mydomain.com",
+                    "railgun_rec_id": null,
+                    "railgun_rec_name": null,
+                    "railgun_status": "INI",
+                    "railgun_tag": "d18bbbbc555f4g6h2i8j222l711n",
+                    "railgun_type": "user",
+                    "railgun_user_id": "1000"
+                }
+            ]
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST zone_conn_get_active
+
+`POST /api/v2/railgun/zone_conn_get_active`
+
+List all active Railgun connections for a domain.
+
+### Form parameters
+
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/zone_conn_get_active HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_zone_conn_get_active",
+        "railgun_conn": {
+            "obj": {
+                    "railgun_conn_id": "2",
+                    "railgun_id": "123",
+                    "railgun_conn_status": "V",
+                    "railgun_conn_mode": "1",
+                    "railgun_enabled": "t",
+                }
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET zone_conn_get_active
+
+`GET /api/v2/railgun/zone_conn_get_active`
+
+List all active Railgun connections for a domain.
+
+### Form parameters
+ 	
+* **email** – User account email
+* **tkn** – User API token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/zone_conn_get_active?host_key=&z= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+z=example.com
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_zone_conn_get_active",
+        "railgun_conn": {
+            "obj": {
+                    "railgun_conn_id": "2",
+                    "railgun_id": "123",
+                    "railgun_conn_status": "V",
+                    "railgun_conn_mode": "1",
+                    "railgun_enabled": "t",
+                }
+        }
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/manage-railguns.md b/products/railgun/src/content/user-guide/optimized-partner-api/manage-railguns.md
new file mode 100644
index 00000000000..780bec97dc4
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/manage-railguns.md
@@ -0,0 +1,223 @@
+---
+order: 15
+pcx-content-type: configuration
+---
+# Manage Railguns
+
+Creating and activating a Railgun requires two API calls. First, a Railgun must be initialized and then activated using the `init` and `activate` calls respectively. The activation API call is made by Railgun when the daemon is started and does not need to be made by a user.
+
+The response body of the `init` API call will contain the activation token (`rtkn`) required activation. Set `activation.token` within the Railgun configuration file to the value of `rtkn` from the API call response.
+
+## POST init
+
+`POST /api/v2/railgun/init`
+
+Create a Railgun. If request is successful, a new Railgun is added to a host account and placed in initializing status (`INI`).
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **name** – Name of Railgun (optional)
+* **pubname** – Name of Railgun shown to users (optional)
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/init HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+name=my-railgun
+pubname=My%20Railgun
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_init",
+         "railgun_id": "1",
+         "railgun_name": "RG_a1b2c3d4e5f6g7h8i9j0k1",
+         "railgun_status": "INI",
+         "rtkn": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET init
+
+`GET /api/v2/railgun/init`
+
+Create a Railgun. If request is successful, a new Railgun is added to a host account and placed in initializing status (`INI`).
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **name** – Name of Railgun (optional)
+* **pubname** – Name of Railgun shown to users (optional)
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/init?host_key=&pubname=&name= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+name=my-railgun
+pubname=My%20Railgun
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_init",
+         "railgun_id": "1",
+         "railgun_name": "RG_a1b2c3d4e5f6g7h8i9j0k1",
+         "railgun_status": "INI",
+         "rtkn": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5pp"
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## POST delete
+
+`POST /api/v2/railgun/delete`
+
+Delete a Railgun. If request is successful, the Railgun with a token matching `rtkn` is removed from the account and set to deleted status (`D`).
+
+### Form parameters
+ 	
+* **host_key** – Host API key
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/delete HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_delete",
+         "railgun_id": "1",
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
+
+## GET delete
+
+`GET /api/v2/railgun/delete`
+
+Delete a Railgun. If request is successful, the Railgun with a token matching `rtkn` is removed from the account and set to deleted status (`D`).
+
+### Query parameters
+ 	
+* **host_key** – Host API key
+* **rtkn** – Railgun token
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+GET /api/v2/railgun/delete?host_key=&rtkn= HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example query string parameters:
+
+host_key=e111dff66d1fddfda6a888c9992d4366
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+         "act": "railgun_delete",
+         "railgun_id": "1",
+     },
+     "result": "success"
+}
+```
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/railguns-via-ip-ranges.md b/products/railgun/src/content/user-guide/optimized-partner-api/railguns-via-ip-ranges.md
new file mode 100644
index 00000000000..f049cdbe6f6
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/railguns-via-ip-ranges.md
@@ -0,0 +1,65 @@
+---
+order: 18
+pcx-content-type: configuration
+---
+
+# Railguns via IP ranges
+
+It is possible to make a Railgun available to domains via IP ranges. This can be done by setting one or more IP range(s) that a Railgun will use. Once the Railgun IP Range(s) have been set, any domains that have origin IP(s) that fall within a Railgun’s IP Range(s) will have the ability to select and enable the Railgun.
+
+## POST ipr_set
+
+`POST /api/v2/railgun/ipr_set`
+
+Set the IP range(s) for a Railgun. This will expose the railgun to domains whose origin IP(s) are contained within the Railgun’s IP range.
+
+The `ipr` holds IPv4 or IPv6 host addresses, and optionally their subnet, all in one field. The subnet is represented by the number of network address bits present in the host address (the “netmask”). If the netmask is 32 AND the address is IPv4, then the value does not indicate a subnet, only a single host. In IPv6, the address length is 128 bits, so 128 bits specify a unique host address.
+
+The input format for this type is address/y where address is an IPv4 or IPv6 address and y is the number of bits in the netmask. If the /y portion is missing, the netmask is 32 for IPv4 and 128 for IPv6, so the value represents just a single host. On display, the /y portion is suppressed if the netmask specifies a single host.
+
+For internal reasons, Cloudflare restricts the netmask range of 8 < netmask < 32 for IPv4 and 112 < netmask < 128 for IPv6.
+
+### Form parameters
+ 	
+* **rtkn** – Railgun token
+* **ipr** – One or more Railgun IP addresses/ranges. Use JSON array format.
+
+<details>
+<summary>Example request</summary>
+<div>
+
+```txt
+POST /api/v2/railgun/ipr_set HTTP/1.1
+Host: www.cloudflare.com
+Accept: */*
+Content-Type: application/x-www-form-urlencoded
+
+Example form parameters:
+
+rtkn=7h8i9j0k1l2m3n4o5p6q7r8id9h0j1l
+ipr=["203.0.0.0/8","208.0.0.0/8","207.0.0.7","BE81::02C3:B44F:FE1E:8329/112"]
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example response</summary>
+<div>
+
+```json
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+     "msg": null,
+     "response": {
+        "act": "railgun_ipr_set",
+        "railgun_id": "1079",
+    },
+    "result": "success"
+}
+```
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/optimized-partner-api/using-curl-with-the-api.md b/products/railgun/src/content/user-guide/optimized-partner-api/using-curl-with-the-api.md
new file mode 100644
index 00000000000..8d013712865
--- /dev/null
+++ b/products/railgun/src/content/user-guide/optimized-partner-api/using-curl-with-the-api.md
@@ -0,0 +1,94 @@
+---
+order: 19
+pcx-content-type: configuration
+---
+
+# Using cURL with the API
+
+Here is how to create, activate, assign, and enable a Railgun using cURL and the Optimized Partner API.
+
+1. Look up the `user_key` for the domain to add a Railgun to. This can be done using the [user_lookup](http://www.cloudflare.com/docs/host-api.html#s3.2.3) Host API method and the user’s email address or unique ID:
+
+```json
+$ curl -s 'https://api.cloudflare.com/host-gw.html?act=user_lookup&host_key=YOUR_HOST_API_KEY&cloudflare_email=user@example.com'
+
+{
+    "msg": null,
+    "request": {
+        "act": "user_lookup",
+        "cloudflare_email": "user@example.com"
+    },
+    "response": {
+        "cloudflare_email": "user@example.com",
+        "hosted_zones": [
+            "example.com"
+        ],
+        "unique_id": "UNIQUE_ID (CAN BE USED IN PLACE OF USER'S EMAIL)",
+        "user_api_key": "USER_API_KEY (NOT USED FOR RAILGUN)",
+        "user_authed": true,
+        "user_exists": true,
+        "user_key": "UNIQUE_USER_KEY_OF_32_CHARACTERS"
+    },
+    "result": "success"
+}
+```
+
+2. Next, call the `init` API method to create a new Railgun using the `host_key` and `user_key`:
+
+```json
+$ curl 'https://www.cloudflare.com/api/v2/railgun/init?host_key=YOUR_HOST_API_KEY&pubname=My%20Railgun'
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_init",
+        "railgun_id": "1",
+        "railgun_name": "GENERATED_OR_SPECIFIED_RG_NAME",
+        "railgun_status": "INI",
+        "rtkn": "30_CHARACTER_RTKN"
+    },
+    "result": "success"
+}
+```
+
+3. The Railgun daemon should then be started so that it may complete the activation process, which should be logged via syslog after startup:
+
+```sh
+$  tail -f /var/log/messages
+Oct 27 22:29:41 www railgun[Activation]: Activation POST completed.
+Oct 27 22:29:41 www railgun[Activation]: Assigned Railgun ID: 1
+Oct 27 22:29:41 www railgun[Activation]: Acquired cert from server
+```
+
+4. Next, the `suggestion_set` method is called with `auto_enabled` set to `0` in order to expose the Railgun to the domain. Setting `auto_enabled` to `0` will not enable Railgun for the domain, it will only expose the Railgun instance to the domain within Cloudflare Settings. To expose, associate, and enable Railgun in a single API call, set `auto_enabled` to `1`.
+
+```sh
+$ curl 'https://www.cloudflare.com/api/v2/railgun/suggestion_set?host_key=YOUR_HOST_API_KEY&z=example.com&rtkn=30_CHARACTER_RTKN&auto_enabled=0'
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_suggest",
+        "railgun_id": "1",
+    },
+    "result": "success"
+}
+```
+
+5. The user should now be able to see the Railgun configuration dropdown menu within their Cloudflare Settings panel. The user can now test and enable Railgun themselves. If `auto_enabled` had been set to `1`, the following `conn_set` call is not necessary and would’ve been performed automatically.
+
+6. Finally, the `conn_set` method is called to associate the Railgun with the domain and create the necessary port2408.net DNS records and SSL certificate. It is possible to test Railgun without enabling it using a special HTTP header. More details on testing with the port2408.net hostname (`railgun_rec_name`) in the installation documentation.
+
+```
+$ curl 'https://www.cloudflare.com/api/v2/railgun/conn_set?host_key=YOUR_HOST_API_KEY&z=example.com&rtkn=30_CHARACTER_RTKN&mode=0'
+
+{
+    "msg": null,
+    "response": {
+        "act": "railgun_conn_set",
+        "railgun_conn_id": "2",
+        "railgun_rec_name": "rg-ffffffff1111111111111111.port2408.net"
+    },
+    "result": "success"
+}
+```
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/railgun-ca-certificates.md b/products/railgun/src/content/user-guide/railgun-ca-certificates.md
new file mode 100644
index 00000000000..b7659762624
--- /dev/null
+++ b/products/railgun/src/content/user-guide/railgun-ca-certificates.md
@@ -0,0 +1,35 @@
+---
+order: 23
+pcx-content-type: reference
+---
+
+# Using Railgun with Origin CA Certificates
+
+While using Railgun and configuring Origin CA certificates, please note that additional steps are needed to avoid service impact for HTTPS requests being sent from the Listener to the site's origin (where the origin CA certificates are installed). This is due to the default trust store that is shipped with the Railgun Listener being an identical copy of the root certificates that it trusts (identical to what NSS/Mozilla trusts).
+
+This means that when enabling Full SSL (Strict) in the dashboard while Railgun is enabled, the Listener will no longer consider the origin presenting the Origin CA certificate as trustworthy, resulting in a 520 error.
+
+<Aside>
+
+**Note**: This error condition will only occur if `validate.cert` is enabled (for example, set to **1**) from the `railgun.conf` file.
+
+</Aside>
+
+Here is an example of the error generated when `validate.cert = 1`, the origin uses an Origin CA leaf, and the Origin CA roots are not in the trust store for Railgun specified by `ca.bundle`:
+
+```
+rg-listener: [2a074d8b36f00000-ATL] www.example.com origin request failed 123.123.123.123:443 to %!!(MISSING)s(MISSING): x509: certificate signed by unknown authority
+```
+
+Here are the following options available to avoid these errors:
+
+1. Set `validate.cert = 0` in the `railgun.conf` file.
+1. Add to the trust store specified in the `ca.bundle` parameter in the `railgun.conf`. This can be done by simply adding these root certificates at the end of the file using a text editor.
+
+By default, `railgun.conf` defines the Listener's trust store as (for Debian/Ubuntu): `ca.bundle = /etc/ssl/railgun-ca-certs.crt`.
+
+<Aside>
+
+**Note**: As a reminder, the Listener will need to be restarted after making changes to the configuration file.
+
+</Aside>
diff --git a/products/railgun/src/content/user-guide/railgun-execution.md b/products/railgun/src/content/user-guide/railgun-execution.md
new file mode 100644
index 00000000000..8e91485d8e0
--- /dev/null
+++ b/products/railgun/src/content/user-guide/railgun-execution.md
@@ -0,0 +1,90 @@
+---
+order: 8
+pcx-content-type: reference
+---
+
+# Railgun execution
+
+Railgun consists of two programs: `rg-listener` and `rg-sender`. `rg-listener` is to be installed at a hosting provider or end-user environment and listens for WAN connections. `rg-sender` is to be installed at Cloudflare locations and establishes connections across the WAN.
+
+`rg-sender` acts as an HTTP proxy and accepts HTTP requests (with the `CF-ORIGIN-IP` and `CF-WAN-ID` headers) and sends them across the WAN to the `rg-listener` which then contacts the real web server.
+
+Both ends use memcached for page caching for the delta compression. If memcached is not working then both ends still operate without delta compression.
+
+Both programs write a log file containing detailed information about operation. `rg-listener` reads a configuration file named `rg.config` which is assumed to be in the same directory as the program. The location of the configuration file can be set on the command line with the `-config` option.
+
+## Runtime Options
+
+<TableWrap>
+
+Option | Description
+---------|----------
+`-config[=\| ]PATH` | The path to the `rg.config` configuration file to use
+`-version` | Output version information and exit
+</TableWrap>
+
+## Configuration Parameters
+
+<TableWrap>
+
+Parameter | Description
+----------|------------
+`wan.ip` | The IP on which to listen for WAN connections. Default to an empty string meaning all interfaces.
+`wan.port` | The port on which to listen for WAN connections. Defaults to 2408.
+`stderr.file` | Name of log file to write stderr messages to. Useful for debugging crashes.
+`log.level` | The maximum level of log message to output. 0 = errors only; 1 = informational messages; 5 = debugging. The default is 0.
+`syslog.addr` | The network address (`hostname:port`) of the syslog server to connect to using UDP, or a path for a connection using a Unix domain socket. Defaults to the empty string which means that the system configured syslog will be used via a Unix domain socket.
+`lan.timeout` | The number of seconds to wait while trying to connect to a web server or for a read from the server. Defaults to 30.
+`wan.tls` | Whether to use TLS for the WAN connection. Defaults to 1 and should only be set to 0 for testing. If no certificate files are provided, but `wan.tls=1` and `activate.server` is non-empty, `rg-listener` will attempt to acquire a certificate from the activation server.
+`memcached.servers` | Space separated list of memcached servers in `host:port` format that will be used for caching. There is not default and this must be set.
+`memcached.timeout` | The maximum amount of time (in ms) to wait for retrieval of a cached page from memcached. The default is 100.
+`memcached.expiration` | The expiration time of individual memcached items in seconds. The default is 600 seconds (10 minutes). If set to 0 then the expiration time is infinite.
+`memcached.connect` | The `host:port` for the memcached server. Defaults to `127.0.0.1:11211`.
+`memcached.limit` | The maximum size (in bytes) of pages that will be stored in memcached. Defaults to 100,000.
+`stats.enabled` | Determines whether statistics are gathered or not. Defaults to 0 (set to 1 for statistics output).
+`stats.url` | Sets the URL (e.g. `http://stats.example.com:9090/`) to periodically POST stats to. Defaults to empty for disabled.
+`stats.log` | Determines whether stats are periodically written to syslog. Defaults to 0 (set to 1 for logged statistics).
+`stats.interval` | How often (in minutes) stats are generated (and logged and POSTed to the `stats.url`). Default is 1 indicating every minute.
+`stats.listen` | `host:port` on which to listen and create a simple HTTP JSON API through which stats can be read via a `GET /`. Defaults to empty for disabled.
+`pid.file` | The name of a file into which the PID will be written. Defaults to an empty string which means that no PID file is created.
+`cert.file` | Name of file containing the certificate presented by this server to connections. No default.
+`key.file` | Name of file containing the private key for the `cert.file`. No default.
+`validate.cert` | Whether to validate the certificate presented when making a TLS connection. Defaults to 1 (meaning perform the validation).
+`map.file` | Name of a file containing `domain=ip` pairs that is used to override DNS and the `CF-ORIGIN-IP` setting. Defaults to no file.
+`activation.railgun_host` | The public facing, resolvable, hostname through which the CF CDN can connect to this rg-listener. DNS lookups are done at request-time. Use in place of `activation.public_ip`.
+`activation.public_ip` | The external IP (or a hostname which resolves to the IP) of your Railgun instance used for activation and automatic DNS record updates. No Default.
+`activation.token` | 32 character hash used for activation (see https://www.cloudflare.com/a/account/my-account). No default.
+`activation.heartbeat_interval` | Interval, in seconds, between heartbeats to activation server. Defaults to 0/off.
+`memprofile.file` | Name of the file to which the heap profile will be written when `SIGUSR1` is received. There is no default value which means that the memory profile will not be created and memory profiling will be disabled.
+`cpuprofile.file` | Name of the file to which the CPU profile will be written when `SIGUSR1` is received. There is no default value which means that the CPU profile will not be created. Note that the `SIGUSR1` signal toggles profiling on and off and the file will be written on every transition to off.
+`cpuprofile.intial` | Whether to begin profiling immediately on startup. It is only valid when `cpuprofile.file` is set and valid. It is 0 by default, requiring an explicit signal to begin profiling.
+`memstats.file` | Name of the file to which information about current memory use will be written when `SIGUSR2` is received. This is intended for internal use.
+`ca.bundle` | Name of a file containing PEM-encoded CA root certificates that will be used for verifying connections to origin servers using TLS. Defaults to empty string which means use the system roots.
+`origin.idleconns` | Sets the number of idle TCP connections that will be kept open to the origin server for connection pooling. Defaults to 1.
+`insecure.origin` | If this is set to 1 (to indicate true) then connections to the origin web server will be made insecurely at all times (i.e. proxied HTTPS connections will use HTTP). This is only safe if the network topology between railgun and the origin server cannot be eavesdropped upon. Defaults to 0 (false).
+`origin.cf-railgun` | If set to 1 then a Cf-Railgun header will be sent to the origin web server when the request goes through railgun. Defaults to 0. The Cf-Railgun will not have a compression ratio in it, instead it has the word ‘origin’.
+`compress.data` | Whether LZ4 compression is to be enabled or not. The default is 0 (disabled). Set to 1 to enable.
+`cpu.oversubscribe` | Tuning feature used to set a multiplier on the number of cores available to oversubscribe. Default is 1.
+`stream.size` | If the HTTP response body is greater than this number of bytes it will not be delta compressed and the body will be streamed across the WAN as it is read from the HTTP server. Defaults to 250000.
+</TableWrap>
+
+## Running
+
+1. Create a `rg.config` file containing the parameters above.
+2. Start memcached and then run `rg-listener` with the `-config` option set to the path of the `rg.config` file. Errors on start will output to stderr.
+
+## Signal Handling
+
+Railgun handles some signals for easier daemon control.
+
+### SIGHUP
+
+Reload configuration file. Certain configuration options cannot be dynamically changed and require a full restart. The following parameters can be changed at runtime: compress.data, lan.timeout, log.level, map.file, memcached.expiration, memcached.limit, memcached.servers, memcached.timeout, stats.url, syslog.addr, validate.cert
+
+### SIGQUIT
+
+Perform a graceful shutdown without dropping active connections. Upon successful shutdown, deactivate the Railgun matching the `activation.token` via the Cloudflare API until the instance is restarted.
+
+### SIGUSR2
+
+Perform a binary upgrade by spawning a new child, and then terminating the previously running parent process. This signal is automatically sent during the post-install for binary yum/apt package upgrades.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/set-up/configuration-activation.md b/products/railgun/src/content/user-guide/set-up/configuration-activation.md
new file mode 100644
index 00000000000..20e22b27e9e
--- /dev/null
+++ b/products/railgun/src/content/user-guide/set-up/configuration-activation.md
@@ -0,0 +1,97 @@
+---
+order: 6
+pcx-content-type: tutorial
+---
+
+# Configuration and activation
+
+Railgun is configured in `/etc/railgun/railgun.conf` (GNU/Linux). The most important directives are `wan.port`, which specifies the port Railgun listens on, `memcached.servers`, a space separated list of `host:port` memcached instances for Railgun to utilize. It is also possible to specify the full path to a single socket file for memcached. Using a socket file is recommended for best performance if your memcached does not require network communication. Make sure at least one memcached instance is defined. Full details on the available options [can be found in the Railgul Execution docs](/user-guide/railgun-execution).
+
+If you will be using Railgun in combination with a website hosted behind the same NAT scheme, then you will also need to configure static IP mapping. In other words, if your website and Railgun node are running behind the same router or firewall, there are extra configuration steps necessary to properly route requests. More details in the [Potential problems and common issues](/user-guide/set-up/potential-problems) section. Contact support for assistance, or you can use the examples in `/etc/railgun/railgun-nat.conf` to define one yourself.
+
+Railgun requires an activation step before usage. To activate, you will need to update the configuration file with the external IP address or a hostname which resolves to the external IP of your Railgun instance for `activation.public_ip` and your activation token for `activation.token`. You can determine the external IP address of a server with the following command:
+
+```sh
+$ curl icanhazip.com
+```
+
+By default, Railgun will listen on all interfaces. It is best practice to specify the interface you would like Railgun to use. You can do that by setting the wan.ip option to the IP address of the interface you would like Railgun to listen on. **This is especially important if you have a local link IPv6 address, as Railgun will prefer that to an IPv4 address and may not work as a result.**
+
+Business and Enterprise users can find the Railgun activation token listed on the [Account Settings page](https://www.cloudflare.com/a/account/my-account). Details on this page can be found in the Administration documentation. Optimized Partners must use the [init](/user-guide/optimized-partner-api/manage-railguns#get-init) API method to acquire an activation token (`rtkn`). Business and Enterprise users should add a Railgun on the listing page, if you haven’t already. It can be named anything you like. After adding a Railgun, the token will be listed on the page and you can toggle the Railgun to ‘On.’ The token is a 32 character hash of numbers and letters. Copy this hash into the `activation.token` option in your Railgun configuration file. If your public IP and activation token are properly configured, the first time you start Railgun it will register and download a newly generated SSL certificate to encrypt traffic. To make sure that activation works properly, check your logs for a successful activation response when starting Railgun:
+
+```sh
+$  tail -f /var/log/messages
+Oct 27 22:29:41 www rg-listener: [Activation] Activation POST completed.
+Oct 27 22:29:41 www rg-listener: [Activation] Assigned Railgun ID: 1
+Oct 27 22:29:41 www rg-listener: [Activation] Acquired cert from server
+```
+
+If there is a certificate error in the system log or during startup, ensure that the necessary certificate bundle is installed as described in [Preparing the Environment](/user-guide/set-up/preparing-environment) so that Railgun may connect securely back to Cloudflare’s activation servers.
+
+As an example, we are going to use domain port2408.net. The newly generated certificate is signed against the port2408.net domain and our system will automatically set your new port2408.net subdomain to resolve to the IP specified by `activation.public_ip`. You can use this hostname to test Railgun without enabling the service for all users. More details are in the [Testing Railgun](/user-guide/set-up/configuration-activation/#testing-railgun) section below.
+
+## Starting the service
+
+You should start the service in the manner that your operating system recommends. This is likely either by using the `init` script directly, or by invoking the service command:
+
+```sh
+(GNU/Linux)
+$ /etc/init.d/railgun start
+Starting railgun:                                          [  OK  ]
+
+$ service railgun start
+Starting railgun:                                          [  OK  ]
+```
+
+After running the init script, there should be an `rg-listener` process listening on the configured port (2408 by default). You can use netstat to make sure:
+
+```sh
+(GNU/Linux)
+$ netstat -plnt | grep 2408
+tcp        0      0 :::2408                     :::*                        LISTEN      2981/rg-listener
+```
+
+Provided that your port is open to Cloudflare traffic, it’s time for testing. If you don’t see the process running, then there may be an issue with activation or your configuration. The Railgun panic log, which is written to `/var/log/railgun/panic.log` by default, may contain more information. You can also attempt to start Railgun without the `init` script to see if any errors are present at start:
+
+```sh
+(GNU/Linux)
+$ sudo -u railgun /usr/bin/rg-listener -config=/etc/railgun/railgun.conf
+```
+## Testing Railgun
+
+Once you have configured Railgun, you can test its operation using the **Test** button on the Cloudflare dashboard found in **Speed** > **Optimization** > scroll down to Railgun > **Test**. This will indicate whether a request to your web server uses Railgun.
+
+The log file can also be used to monitor results. By default, we log only errors. For testing, you need to raise the `log.level` option from 0 to 5 in your Railgun configuration and then restart the service. You can then tail the logs to watch the requests being processed:
+
+```sh
+$  tail -f /var/log/messages
+Oct 27 23:35:57 www railgun[199.27.130.135:22114]: Handling new WAN connection
+Oct 27 23:35:57 www railgun[199.27.130.135:22114]: Rx [0000000000... FnPing 2012-10-27 23:37:55.872617 +0000 UTC]
+Oct 27 23:35:57 www railgun[199.27.130.135:22114]: Tx [0000000000... FnPong 2012-10-27 23:37:55.872617 +0000 UTC]
+Oct 27 23:35:57 www railgun[199.27.130.135:22114]: Transmit time: 550us
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: Rx [ab18927f79... FnBegin ab18927f79... FnRequest HEAD http://example.com/ HTTP/1.1 188.165.194.208  ab18927f79... FnData DENone 374   ab18927f79... FnPush]
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... waiting for request
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... HEAD http://example.com/ HTTP/1.1 188.165.194.208 []
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... Starting connection to LAN
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... connected to 192.0.43.10:80
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... Request sent to server
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... waiting for response
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... Response is ready
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... Received response
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... Forcing wantedDelta
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... HTTP/1.1 301 Moved Permanently
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: Tx [ab18927f79... FnData DENone 328  ]
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... completed (0 body bytes in 0.001572 seconds/0)#012
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: ab18927f79... waiting for request
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: Transmit time: 88us
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: Tx [ab18927f79... FnPush]
+Oct 27 23:36:06 www railgun[199.27.130.135:22114]: Transmit time: 48us
+```
+
+**Railgun will produce 5xx messages when the rg-listener service is unable to reach the origin web server.** Checking that the route between the Railgun server and the web server is clear is essential before contacting support. The easiest way of checking that is by performing a curl command from the Railgun server to the origin web server. If Railgun and the web server are both run on the same physical server, check that it allows loopback HTTP connections on ports 80 and 443 in its firewall settings. Please ensure the correct port is open and contact support if errors persist.
+
+## Going live
+
+It is recommended that you consult the [Testing Railgun](/user-guide/installation#testing-railgun) section before enabling Railgun for all visitors to your site.
+
+When you wish to go live, Enterprise and Business users should select the desired Railgun for your domain on the [Cloudflare Settings](https://www.cloudflare.com/a/account/my-account) page from the drop-down and then toggle the switch to ‘On’. Optimized Partners should use the [conn_set](/user-guide/optimized-partner-api/enable-and-disable-connections#get-conn_set) with `mode` set to `0` or [conn_setmode_enabled](/user-guide/optimized-partner-api/enable-and-disable-connections#get-conn_setmode_enabled) method to enable Railgun. Railgun may take up to five minutes to fully activate, after which you should see the `CF-Railgun` HTTP header present in responses from all your active Cloudflare DNS records.
diff --git a/products/railgun/src/content/user-guide/set-up/index.md b/products/railgun/src/content/user-guide/set-up/index.md
new file mode 100644
index 00000000000..5473cb02833
--- /dev/null
+++ b/products/railgun/src/content/user-guide/set-up/index.md
@@ -0,0 +1,8 @@
+---
+order: 3
+pcx-content-type: tutorial
+---
+
+# Installation
+
+<DirectoryListing path="/user-guide/set-up"/>
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/set-up/installation-overview.md b/products/railgun/src/content/user-guide/set-up/installation-overview.md
new file mode 100644
index 00000000000..dd3093e79c8
--- /dev/null
+++ b/products/railgun/src/content/user-guide/set-up/installation-overview.md
@@ -0,0 +1,28 @@
+---
+order: 5
+pcx-content-type: tutorial
+---
+
+# Installation Overview
+
+## Package Repository
+
+Railgun is available only for 64-bit systems. The best way of installing Railgun is via the [Package Repository](https://pkg.cloudflare.com/). Run the commands mentioned on the Package Repository page in order to set this up. Debian, CentOS, Red Hat Enterprise Linux, and Amazon Linux users may utilize the Railgun binary package repository. Ubuntu and Debian users will be automatically subscribed to the APT repo after installing one of the packages linked below. Other users will need to install the `cloudflare-release` RPM as described on the repository home page. Installation of that RPM will install the repository and GPG key.
+
+Once this has been set up, run the following command as root:
+
+### RPM-based
+
+```sh
+$ yum install railgun-stable
+```
+
+### DEB-based
+
+```sh
+$ apt-get install railgun-stable
+```
+
+## System Startup
+
+Installing the package will automatically add `/etc/init.d/railgun` to be started on boot on GNU/Linux.
\ No newline at end of file
diff --git a/products/railgun/src/content/user-guide/set-up/potential-problems.md b/products/railgun/src/content/user-guide/set-up/potential-problems.md
new file mode 100644
index 00000000000..ae34121ae6c
--- /dev/null
+++ b/products/railgun/src/content/user-guide/set-up/potential-problems.md
@@ -0,0 +1,65 @@
+---
+title: Potential problems and common issues
+order: 7
+pcx-content-type: tutorial
+---
+
+# Potential problems
+
+If you notice consistent 523, 524 or other error responses, please check the [System Status Map](https://www.cloudflarestatus.com/) and [contact support](https://support.cloudflare.com/) as needed. Railgun will fall-back to direct HTTP requests if our endpoints can’t contact your Railgun daemon, but consistent error responses may indicate a system or origin server problem. When contacting support, please provide a screenshot of ```http://www.yourdomain.com/cdn-cgi/trace``` if you are able, or a [traceroute](https://support.cloudflare.com/hc/en-us/articles/200169336-How-do-I-run-a-traceroute-) to your domain so we know which datacenter your requests are hitting. You can then [pause](https://support.cloudflare.com/hc/en-us/articles/200169176-How-do-I-temporarily-deactivate-Cloudflare-) Cloudflare via the website to disable the service and resume normal website traffic.
+
+Railgun does not perform DNS queries when it receives a request for maximum efficiency and to prevent tampering. This means that the daemon is unaware of NAT routing or firewalls. NAT does not allow for addressing a public interface from within the associated LAN and Railgun requests will timeout and produce 502 errors. **This can be corrected by setting up a static IP mapping.** You can set that either through the hosts file for your system (usually at the path /etc/hosts) or through the `railgun-nat.conf` file in the same directory as the `railgun.conf` file. Please contact support if you require assistance with the NAT configuration file.
+
+
+## Common issues
+
+**Requests to** `example.com:2083` **go to port 443**
+
+To run Railgun on non-standard ports you need to add the correct mapping to the `railgun-nat.conf` file. Otherwise, the connection goes to standard ports `80` or `443`. Example:
+
+```txt
+default = 127.0.0.1
+example.com:2083 = 127.0.0.1:2083
+```
+
+---
+
+**Railgun is returning an HTTP 502 in its error logs**
+
+This commonly occurs when Railgun cannot reach your origin web server over port 443 (or port 80) within 30 seconds. Verify that the server your Railgun instance is on can connect via `telnet <host> 443`.
+
+---
+
+**Railgun is returning a** `connection failed 127.0.0.1:443/welcome.cloudflare.com: x509: certificate is valid for www.cloudflare.com, not welcome.cloudflare.com` **error**
+
+Your origin webserver should have a certificate matching its hostname. If you are on an internal network and are aware of the risks, you can set `validate.cert = 0` in `railgun.conf` to turn off certificate validation (not recommended).
+
+---
+
+**I’m seeing** `bad Content-Length: "-1"`
+
+Railgun expects that all POST, PUT, PATCH (and other non-idempotent methods) requests have either a `Content-Length` header or a `Transfer-Encoding: chunked` header present.
+
+---
+
+**There are errors containing** `memcached: connection failed` (Unix socket) **or** `dial tcp 127.0.0.1:11211: i/o timeout` (TCP) **in the logs**
+
+Railgun cannot connect to the memcached server. These errors should not cause visible errors, but will cause Railgun to stream (and not compress) responses.
+
+You should confirm that memcached is running, is accepting connections, and confirm the state of your memcached server via the memcached `stats` command.
+
+---
+
+**How can I tell what the compression ratio for a request is?**
+
+`rg-diag` is installed alongside Railgun, and allows you to decode the `Cf-Railgun` header. Example:
+
+```sh
+$ bin/rg-diag -decode="151df128a1 2.05 0.009465 0031 5360"
+
+Compression ratio 2.05%
+Railgun version 5360
+Railgun Flag map.file used to change IP
+Railgun Flag rg-sender sent dictionary
+Railgun Flag rg-listener found dictionary
+```****
diff --git a/products/railgun/src/content/user-guide/set-up/preparing-environment.md b/products/railgun/src/content/user-guide/set-up/preparing-environment.md
new file mode 100644
index 00000000000..18b69691f7a
--- /dev/null
+++ b/products/railgun/src/content/user-guide/set-up/preparing-environment.md
@@ -0,0 +1,29 @@
+---
+order: 4
+pcx-content-type: tutorial
+---
+
+# Preparing the Environment
+
+There are no dependencies to install Railgun. The only external requirement is a Memcached instance for Railgun to use as a cache backend. However, you should ensure that the latest CA certificate bundle is installed for your Operating System as it will be used to connect securely back to Cloudflare during activation. CentOS, Red Hat, Debian, and Ubuntu users should make sure that the `ca-certificates` package is installed and up-to-date via `yum` or `apt`.
+
+Users of [mod_cloudflare](https://www.cloudflare.com/resources-downloads), an Apache module which displays a visitor’s true source IP, should update their Apache configuration to include the IP of their Railgun instance as a trusted proxy. If Apache and Railgun run on the same server, the following line is needed within your Apache configuration (typically, `/etc/apache2/httpd.conf` or `/etc/httpd/httpd.conf`):
+
+```
+CloudFlareRemoteIPTrustedProxy 127.0.0.1
+```
+
+If Railgun and Apache are on two separate machines, configure mod_cloudflare to use the source IP of Railgun. This may be on a NATed address or the public IP, depending on your network configuration.
+
+```
+CloudFlareRemoteIPTrustedProxy 192.168.1.100
+```
+
+Railgun runs on port 2408 via TCP by default and this port will need to be open to connections from Cloudflare [IPs](https://www.cloudflare.com/ips). If you are unfamiliar with networking, please reach out to your hosting provider to determine the proper way to open the port for your environment. You can script out adding rules for software firewalls as follows (use with caution):
+
+```sh
+$ for i in `curl https://www.cloudflare.com/ips-v4`; do ufw allow proto tcp from $i to any port 2408; done
+$ for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -s $i --dport 2408 -j ACCEPT; done
+```
+
+For users with very restrictive firewall egress (outbound) policies, outbound TCP port 443 will also need to be allowed for Railgun activation to function properly. In addition, you will need to allow Railgun to make outbound connections to your web server on any ports that it listens on.
\ No newline at end of file
diff --git a/products/railgun/wrangler.toml b/products/railgun/wrangler.toml
new file mode 100644
index 00000000000..61f78086c3b
--- /dev/null
+++ b/products/railgun/wrangler.toml
@@ -0,0 +1,14 @@
+name = "railgun"
+type = "webpack"
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99" # cloudflare-docs.workers.dev
+workers_dev = true
+ 
+[env.production]
+workers_dev = false
+account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
+zone_id = "351cf9fc660523187714fa772ad5ca49"
+route = "https://developers.cloudflare.com/railgun*"
+ 
+[site]
+bucket = ".docs/public/"
+entry-point = ".docs/workers-site"
\ No newline at end of file
diff --git a/products/randomness-beacon/docs-config.js b/products/randomness-beacon/docs-config.js
index cfde506f867..52192f4ccac 100644
--- a/products/randomness-beacon/docs-config.js
+++ b/products/randomness-beacon/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Explore drand: a distributed service providing public randomness in an application-agnostic, secure, and efficient way.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/randomness-beacon",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/randomness-beacon/src/content/about/Background.md b/products/randomness-beacon/src/content/about/Background.md
index c42d919216e..38f148bfd1b 100644
--- a/products/randomness-beacon/src/content/about/Background.md
+++ b/products/randomness-beacon/src/content/about/Background.md
@@ -1,6 +1,7 @@
 ---
 title: Background
 order: 1
+pcx-content-type: concept
 ---
 
 # Where did it all begin?
diff --git a/products/randomness-beacon/src/content/about/Drand.md b/products/randomness-beacon/src/content/about/Drand.md
index 71ebdad7171..3e86042622e 100644
--- a/products/randomness-beacon/src/content/about/Drand.md
+++ b/products/randomness-beacon/src/content/about/Drand.md
@@ -1,6 +1,7 @@
 ---
 title: Drand Project
 order: 0
+pcx-content-type: concept
 ---
 
 # What is drand?
diff --git a/products/randomness-beacon/src/content/about/Future.md b/products/randomness-beacon/src/content/about/Future.md
index fc0c90dafd2..4abb6cdad84 100644
--- a/products/randomness-beacon/src/content/about/Future.md
+++ b/products/randomness-beacon/src/content/about/Future.md
@@ -1,6 +1,7 @@
 ---
 title: Future of Drand
 order: 2
+pcx-content-type: concept
 ---
 
 # What do you see as the future of this project?
diff --git a/products/randomness-beacon/src/content/about/index.md b/products/randomness-beacon/src/content/about/index.md
index 1926df579a9..600df558c96 100644
--- a/products/randomness-beacon/src/content/about/index.md
+++ b/products/randomness-beacon/src/content/about/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # About Drand
diff --git a/products/randomness-beacon/src/content/cryptographic-background/index.md b/products/randomness-beacon/src/content/cryptographic-background/index.md
index feee3d4d46c..ff78aca5946 100644
--- a/products/randomness-beacon/src/content/cryptographic-background/index.md
+++ b/products/randomness-beacon/src/content/cryptographic-background/index.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # Cryptographic Background
diff --git a/products/randomness-beacon/src/content/cryptographic-background/randomness-generation.md b/products/randomness-beacon/src/content/cryptographic-background/randomness-generation.md
index 042700407d2..a12e22bdd12 100644
--- a/products/randomness-beacon/src/content/cryptographic-background/randomness-generation.md
+++ b/products/randomness-beacon/src/content/cryptographic-background/randomness-generation.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: interim
 ---
 
 # Randomness Generation
diff --git a/products/randomness-beacon/src/content/cryptographic-background/setup-phase.md b/products/randomness-beacon/src/content/cryptographic-background/setup-phase.md
index 4e01655cfd4..762e88387df 100644
--- a/products/randomness-beacon/src/content/cryptographic-background/setup-phase.md
+++ b/products/randomness-beacon/src/content/cryptographic-background/setup-phase.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: interim
 ---
 
 # Setup Phase
diff --git a/products/randomness-beacon/src/content/index.md b/products/randomness-beacon/src/content/index.md
index 97f0e10de4e..3eb15983656 100644
--- a/products/randomness-beacon/src/content/index.md
+++ b/products/randomness-beacon/src/content/index.md
@@ -1,10 +1,10 @@
 ---
-title: Welcome
+title: Overview
 order: 0
-type: overview
+pcx-content-type: landing-page
 ---
 
-# Cloudflare Randomness Beacon docs
+# Cloudflare Randomness Beacon
 
 <ContentColumn>
 
diff --git a/products/randomness-beacon/src/content/operator-guide/index.md b/products/randomness-beacon/src/content/operator-guide/index.md
index 7043c1109a2..8bd86e210d1 100644
--- a/products/randomness-beacon/src/content/operator-guide/index.md
+++ b/products/randomness-beacon/src/content/operator-guide/index.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: reference
 ---
 
 # Operator Guide
diff --git a/products/randomness-beacon/src/content/user-guide/index.md b/products/randomness-beacon/src/content/user-guide/index.md
index f50511c3809..22dfb7b83e5 100644
--- a/products/randomness-beacon/src/content/user-guide/index.md
+++ b/products/randomness-beacon/src/content/user-guide/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: reference
 ---
 
 # User Guide
diff --git a/products/registrar/docs-config.js b/products/registrar/docs-config.js
index d3bf7de335e..ea64602b12f 100644
--- a/products/registrar/docs-config.js
+++ b/products/registrar/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Welcome to Cloudflare Registrar. The first registrar you can love.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/registrar",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/registrar/src/content/_partials/_before-you-begin.md b/products/registrar/src/content/_partials/_before-you-begin.md
new file mode 100644
index 00000000000..c195914fff5
--- /dev/null
+++ b/products/registrar/src/content/_partials/_before-you-begin.md
@@ -0,0 +1,10 @@
+## Before transferring a domain to Cloudflare
+
+* Ensure you have created [an account that includes your domain](https://support.cloudflare.com/hc/articles/201720164) and [changed your DNS nameservers](https://support.cloudflare.com/hc/articles/205195708) to Cloudflare.
+* Disable DNSSEC by:
+    * Removing the DS record at your current DNS host.
+    * [Disabling DNSSEC](https://support.cloudflare.com/hc/articles/360006660072) in the Cloudflare dashboard.
+* If initiating multiple transfers, notify your financial institution to prevent them from flagging these charges as fraudulent.
+* Renew your domain if it is within 15 days of expiration.
+* Unlock your domain at your current registrar.
+* Do not make any changes to the Registrant contact information. Updating the Registrant contact may result in your current registrar locking the domain for 60 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/_partials/_email-forward.md b/products/registrar/src/content/_partials/_email-forward.md
new file mode 100644
index 00000000000..d644e3737fa
--- /dev/null
+++ b/products/registrar/src/content/_partials/_email-forward.md
@@ -0,0 +1,5 @@
+<Aside type="note" header="Email forwarding">
+
+Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
+
+</Aside>
\ No newline at end of file
diff --git a/products/registrar/src/content/_partials/_restrictions.md b/products/registrar/src/content/_partials/_restrictions.md
new file mode 100644
index 00000000000..07e1a0f8e59
--- /dev/null
+++ b/products/registrar/src/content/_partials/_restrictions.md
@@ -0,0 +1,18 @@
+## Restrictions
+
+To transfer to a new registrar, your domain must meet a few requirements:
+
+* ICANN rules prohibit a domain from being transferred if it has been registered or previously transferred within the last 60 days or if the WHOIS Registrant contact information was modified in the last 60 days (even if redacted).
+* Your account at your current registrar must be active. If your domain has expired, you may be able to transfer the domain. If the domain is in the `RedemptionPeriod` you will likely need to restore the domain first before the transfer can proceed. 
+
+<Aside type="warning">
+
+The transfer of an expired domain may result in an additional year NOT being added during the transfer.
+
+</Aside>
+
+* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
+* Domains that have a status of `serverHold`, `serverTransferProhibited`, `pendingDelete`, `pendingTransfer`, or `RedemptionPeriod` may not be transferred.
+* Domains that have a status of `clientTransferProhibited` (Transfer Lock) will show as available for transfer. However, the Transfer Lock must be removed at your current registrar before the transfer can begin.
+
+If your domain is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
\ No newline at end of file
diff --git a/products/registrar/src/content/account-options/domain-management.md b/products/registrar/src/content/account-options/domain-management.md
new file mode 100644
index 00000000000..234cd8b78ed
--- /dev/null
+++ b/products/registrar/src/content/account-options/domain-management.md
@@ -0,0 +1,42 @@
+---
+order:
+pcx-content: reference
+---
+
+# Domain management
+
+You can manage your domain with Cloudflare Registrar in **Overview** on the dashboard.
+
+## Domain status
+
+When your domain is registered with Cloudflare, you can review your domain status in **Overview** > **Manage Domain** in the right-hand menu. Scroll down to **Manage domain** > **Registration** tab. Here, you can review the current expiration date and Auto-Renew status for your domain.
+
+## Editing WHOIS records
+
+Cloudflare redacts WHOIS information from your domain by default. However, we do store the authentic WHOIS record for your domain. You may edit the WHOIS contact data for any domain. To do that: 
+
+1. Make sure you are [logged in to the Cloudflare dashboard](https://dash.cloudflare.com/login) and have selected your account and domain.
+1. From **Overview**, scroll down to **Manage domain** in the right-hand menu > **Contacts**.
+1. Select **Edit** in any of the contacts you previously set up. This allows you to update the contact information for the selected domain only. It will not update the contact information for other domains within the account.
+
+## Default Contact Data
+
+The first time you transfer or register a new domain, a Default Contact is created. That contact information may be used for future transfers and registrations. The contact data may be updated at any time in the dashboard. Updating the Default Contact data will not update the contact information for any domains in the account. This Default Contact data is only used to prepopulate contact information for new registrations and transfers.
+
+## Automatic renewal of domain
+
+Cloudflare Registrar enrolls your domain to auto-renew by default. Unlike other registrars, your domain will only renew at the list price set by the registry. When a domain has the auto-renew setting turned on, Cloudflare will attempt to automatically renew the domain prior to expiration. 
+
+There is no guarantee that the renewal will succeed. Renewals may fail for various reasons, including billing failures and registry downtime. While we will make several attempts to renew, we strongly recommend you frequently review your account to ensure your domains have been renewed.
+
+If you decide you no longer need the domain, [disable auto-renew for your account](/account-options/renew-domains#set—up-automatic-renewals). Once disabled, your domain will not renew upon expiration.
+
+<Aside type="note" header="Note">
+
+The first auto-renew attempt will occur approximately 30 days prior to expiration. If you wish to disable auto-renew, do so at least 30 days prior.
+
+</Aside>
+
+You can continue to keep your domain registered with Cloudflare for the time remaining on the expiration date. If you decide you want to keep the domain, enable auto-renew at any time prior to your expiration.
+
+For more details on renewals, refer to [Domain renewal](/account-options/renew-domains).
\ No newline at end of file
diff --git a/products/registrar/src/content/account-options/enabling-dnssec.md b/products/registrar/src/content/account-options/enabling-dnssec.md
new file mode 100644
index 00000000000..a96667f9fc9
--- /dev/null
+++ b/products/registrar/src/content/account-options/enabling-dnssec.md
@@ -0,0 +1,30 @@
+---
+order:
+title: Enabling DNSSEC
+pcx-content: tutorial
+---
+
+# Domain Name System Security Extensions
+
+The domain name system (DNS) translates domain names into numeric Internet addresses. However, DNS is a fundamentally insecure protocol. It does not guarantee where DNS records come from and accepts any requests given to it.
+
+DNSSEC creates a secure layer to the domain name system by adding cryptographic signatures to DNS records. By doing so, your request can check the signature to verify that the record you need comes from the authoritative name server and was not altered along the way. [Read more about how DNSSEC works on cloudflare.com](https://www.cloudflare.com/dns/dnssec/how-dnssec-works/).
+
+## Enabling DNSSEC
+
+Cloudflare Registrar offers one-click DNSSEC activation for free to all customers. You will not need to set the DS record details manually. However, your domain must be using Cloudflare as the authoritative DNS provider.
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select the account and domain you want to configure.
+1. Navigate to **DNS**.
+1. Scroll down until you reach **DNSSEC**. Select **Enable DNSSEC**.
+1. You will be presented with DS record details specific to your site. You do not need to copy these or manually enter them when you are using Cloudflare Registrar. Instead, select **Confirm**.
+
+![Enable button image](../static/enable-button.png)
+
+Cloudflare will publish those DS details in the form of CDS and CDNSKEY records for a domain delegated to Cloudflare. The Cloudflare Registrar scans those records at regular intervals. When Cloudflare notices you have enabled DNSSEC, Cloudflare gathers those details and sends them to your domain’s registry.
+
+This process can take one to two days after you first enable DNSSEC.
+
+## Confirming DNSSEC
+
+When DNSSEC has been successfully applied to your domain, you will see a confirmed status in the DNSSEC card where you first selected **Enable**. You can also confirm this by reviewing the WHOIS information for your domain. Domains with DNSSEC will read `signedDelegation` in the DNSSEC field.
\ No newline at end of file
diff --git a/products/registrar/src/content/account-options/index.md b/products/registrar/src/content/account-options/index.md
new file mode 100644
index 00000000000..44cc8218331
--- /dev/null
+++ b/products/registrar/src/content/account-options/index.md
@@ -0,0 +1,8 @@
+---
+order: 3
+pcx-content: navigation
+---
+
+# Account options
+
+<DirectoryListing path="/account-options"/>
diff --git a/products/registrar/src/content/account-options/renew-domains.md b/products/registrar/src/content/account-options/renew-domains.md
new file mode 100644
index 00000000000..853c205cbf7
--- /dev/null
+++ b/products/registrar/src/content/account-options/renew-domains.md
@@ -0,0 +1,59 @@
+---
+order:
+pcx-content-type: tutorial
+title: Domain renewal
+---
+
+# Renew domains with Cloudflare Registrar
+
+Once you have registered a domain with Cloudflare Registrar, you can renew that domain from within the Cloudflare dashboard.
+
+## Set up automatic renewals
+
+If you want your domains to renew automatically, keep the default settings for your domain (**Auto Renew** should be set to **On**). To find this setting:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select the account and domain you want to renew.
+1. From **Overview**, scroll down to **Domain Registration** and select **Manage domain**.
+1. In **Registration**, make sure the toggle in **Auto Renew** is set to **On**.
+
+Cloudflare renews these domains automatically 30 days before their expiration date. You can also [manually renew](#renew-a-domain-manually) a domain at any time.
+
+If the renewal fails, you will receive an email notification and Cloudflare will try to renew the domain three additional times. If these attempts fail, you must manually renew your domain.
+
+<Aside type="note">
+
+If you want to delete your domain from Cloudflare, **disable** Auto-Renew first.
+
+</Aside>
+
+## Renew a domain manually
+
+You can renew a domain at any time. To renew a domain registered with Cloudflare:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select the account and domain you want to renew.
+1. From **Overview**, scroll down to **Domain Registration** and select **Manage domain**.
+1. In the **Registration** > **Domain Registration** card, select **Add years**.
+1. In **Renew for**, choose a number of years to renew your domain (up to 10 years).
+1. Select **Renew** > **Purchase**.
+
+Once Cloudflare validates your payment, your domain moves to a status of **Renewal Pending**. The status changes back to **Active** after the renewal is finished.
+
+## Renewal notifications
+
+Once a domain is registered, Registrar sends the following expiration notices to the email address associated with the domain:
+- A monthly email listing all domains set to renew automatically within the next 45 days.
+- A monthly email listing all domains expiring in the next 60-90 days.
+- A weekly email listing all domains expiring within the next month.
+- A daily email listing all domains expiring in seven days.
+- An email one day after a domain expires.
+- An email 20 days after the expiration date.
+
+<Aside type="note">
+
+If you do not renew your domain before the expiration date, your domain will enter a Redemption Grace Period (RGP) for 30 days. These domains are not deleted and you can restore them to your account, but restoration may require an additional fee. You cannot transfer domains during the RGP.
+
+All renewals are final and Cloudflare will not issue refunds.
+
+When renewing a domain, additional years are always added to the current expiration date regardless of when the renewal takes place.
+
+</Aside>
\ No newline at end of file
diff --git a/products/registrar/src/content/account-options/transfer-out-from-cloudflare.md b/products/registrar/src/content/account-options/transfer-out-from-cloudflare.md
new file mode 100644
index 00000000000..4d5ecfda1ff
--- /dev/null
+++ b/products/registrar/src/content/account-options/transfer-out-from-cloudflare.md
@@ -0,0 +1,44 @@
+---
+order:
+pcx-content: tutorial
+---
+
+# Transfer out from cloudflare
+
+Cloudflare Registrar makes it easy to transfer your domain to another registrar. Follow the instructions below to transfer your domain out from Cloudflare.
+
+<Aside type="warning">
+
+ICANN rules prohibit a domain from being transferred if: 
+* It has been transferred within the last 60 days;
+* It was registered within the last 60 days;
+* Or if the WHOIS registrant information has been modified in the last 60 days (even if redacted).
+
+</Aside>
+
+## Unlocking your domain at Cloudflare
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select the account and domain you want to transfer.
+1. In **Overview**, scroll down to **Domain Registration** and select **Manage domain**. 
+1. Select **Configuration** > in the **Transfer Out** card under **Domain Management** > select **Unlock**.
+
+  ![Domain registration dashboard screenshot](../static/start-transfer-out.png)
+
+1. Select **Confirm and Unlock** to confirm that you want to unlock your domain.
+1. Copy the auth code (also referred to as authentication code and authorization code) generated by Cloudflare, and use at your new registrar.
+
+  <div class="large-img">
+
+  ![Authorization code generation modal](../static/auth-generated.png)
+
+  </div>
+
+If you lose your auth code, return to **Overview** > **Manage domain** > **Configuration**. Select **Continue** next to the **Transfer Out** option to display your auth code again.
+
+## Transfer to a new registrar
+
+1. Go to your new registrar.
+1. You will be asked for the authorization code from Cloudflare (it might be called EPP in some systems). Input the code created for you from the Cloudflare dashboard.
+1. Your new registrar will send the transfer request to the registry for your domain. The registry will then send it to Cloudflare. After Cloudflare receives the message, you can manually approve the transfer to initiate it immediately.
+1. You will need to confirm the approval. You can also reject it at this stage. If you reject it, Cloudflare will reapply the registrar lock.
+1. If you do not manually approve the transfer, the transfer will auto-approve on the fifth day after receiving the request. In either case, when your transfer out completes Cloudflare will remove the domain from your account and you will not be charged for future renewals.
\ No newline at end of file
diff --git a/products/registrar/src/content/cloudflare-registrar/domain-management.md b/products/registrar/src/content/cloudflare-registrar/domain-management.md
deleted file mode 100644
index 93033a8ad16..00000000000
--- a/products/registrar/src/content/cloudflare-registrar/domain-management.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-order: 2
----
-
-# Domain management
-
-You can manage your domain with Cloudflare Registrar in the Zone Overview page of the dashboard.
-
---------
-
-## Domain status
-When your domain is registered with Cloudflare, Zone Overview will display a card that provides details about your registration. You can review your current expiration date and your autorenew status here.
-
---------
-
-## Editing WHOIS records
-Cloudflare redacts WHOIS information from your domain by default. However, we do store the authentic WHOIS record for your domain that is first set during the transfer flow. The contact information is shared across all domains in your Cloudflare account.
-
-You can edit the contact information for all domains in your account. To do so, navigate to the “Configurations” tab once you login to Cloudflare and before you select a zone. Under Preferences, select “Edit WHOIS” and you can modify the record. You can also reach this screen from the Domain Registration card in the dashboard Overview page of any domain registered with Cloudflare.
-
---------
-
-## Disabling autorenew
-Cloudflare Registrar enrolls your domain to AutoRenew by default. Unlike other registrars, your domain will only renew at the list price set by the registry.
-
-If you decide you no longer need the domain, you can disable AutoRenew for your account. Once disabled, your domain will not renew upon expiration.
-
-You can continue to keep your domain registered with Cloudflare for the time remaining on the expiration. If you decide you want to keep the domain, you can enable AutoRenew at any time prior to your expiration.
\ No newline at end of file
diff --git a/products/registrar/src/content/cloudflare-registrar/enabling-dnssec.md b/products/registrar/src/content/cloudflare-registrar/enabling-dnssec.md
deleted file mode 100644
index 83663165ffd..00000000000
--- a/products/registrar/src/content/cloudflare-registrar/enabling-dnssec.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-order: 3
----
-
-# Enabling DNSSEC
-
-The domain name system (DNS) translates domain names into numeric Internet addresses. However, DNS is a fundamentally insecure protocol. It does not guarantee where DNS records come from and accepts any requests given to it.
-
-DNSSEC creates a secure layer to the domain name system by adding cryptographic signatures to DNS records. By doing so, your request can check that signature to verify that the record you need comes from the authoritative name server and was not altered along the way. You can [read more about how DNSSEC works on cloudflare.com](https://www.cloudflare.com/dns/dnssec/how-dnssec-works/).
-
---------
-
-## Enabling DNSSEC
-Cloudflare Registrar offers one-click DNSSEC enablement for free to all customers. You will not need to set the DS record details manually. However, your domain must be using Cloudflare as the authoritative DNS provider.
-
-To start, navigate to the “DNS” tab in the Cloudflare dashboard for your site. Beneath the cards for DNS management is a card titled “DNSSEC”. Once there, click “Enable DNSSEC”. You will be presented with DS record details specific to your site. You do not need to copy these or manually enter them when you are using Cloudflare Registrar. Instead, click “Confirm”.
-
-![Enable button image](../static/enable-button.png)
-
-Cloudflare will publish those DS details, in the form of CDS and CDNSKEY records, for a domain delegated to Cloudflare. Our Registrar will scan those records at regular intervals and, when we notice you have enabled DNSSEC, gather those details and send them to your domain’s registry.
-
-This process can take one to two days after you first enable DNSSEC.
-
---------
-
-## Confirming DNSSEC
-When DNSSEC has been successfully applied to your domain, you will see a confirmed status in the DNSSEC card where you first clicked “Enable”. You can also confirm by reviewing the WHOIS information for your domain. Domains with DNSSEC will read “signedDelegation” in the DNSSEC field.
\ No newline at end of file
diff --git a/products/registrar/src/content/cloudflare-registrar/index.md b/products/registrar/src/content/cloudflare-registrar/index.md
deleted file mode 100644
index 0c0a3494dbc..00000000000
--- a/products/registrar/src/content/cloudflare-registrar/index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-order: 1
----
-
-# Cloudflare registrar
-
-Cloudflare Registrar will only ever charge you what we pay to the registry for your domain. No markup and no surprise fees.
-
-![Registrar Logo](../static/registrar-color-logo.png)
\ No newline at end of file
diff --git a/products/registrar/src/content/cloudflare-registrar/transfer-out-from-cloudflare.md b/products/registrar/src/content/cloudflare-registrar/transfer-out-from-cloudflare.md
deleted file mode 100644
index 7981a0e46c6..00000000000
--- a/products/registrar/src/content/cloudflare-registrar/transfer-out-from-cloudflare.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-order: 4
----
-
-# Transfer out from cloudflare
-
-Cloudflare Registrar makes it easy to transfer to another registrar. Follow the instructions below to transfer your domain out from Cloudflare.
-
---------
-
-## Restrictions
-ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS registrant information has been modified in the last 60 days (even if redacted).
-
---------
-
-## Unlocking your domain at Cloudflare
-To begin, navigate to the Domain Overview tab in the Cloudflare dashboard. In the card for “Domain Registration” you’ll find a link to Transfer Out. When you select that link, you will unlock the domain and be provided with an authorization code.
-
-![Domain registration dashboard screenshot](../static/start-transfer-out.png)
-
-We’ll ask you to confirm this action in the next screen before we unlock your domain.
-
-![Unlock domain modal](../static/confirm-unlock.png)
-
-Cloudflare will generate an auth code for your domain in the next screen. Copy that code to use at your new registrar.
-
-![Authorization code generation modal](../static/auth-generated.png)
-
-If you lose your auth code, you can return to the overview page and select “Continue” next to the “Transfer Out” to display your auth code again.
-
-![Domain registration renewal screenshot](../static/restart.png)
-
---------
-
-## Transfer to a new registrar
-At your new registrar, you’ll be asked for the authorization code from Cloudflare (it might be called EPP in some systems). Input the code from the Cloudflare dashboard. Your new registrar will send the transfer request to the registry for your domain. The registry will then send it to Cloudflare. When we receive the message, you can manually approve the transfer to initiate it immediately.
-
-![Domain Transfer in dashboard](../static/accept-reject.png)
-
-You will need to confirm the approval. You can also reject it at this stage; if you reject it, we will reapply the registrar lock
-
-![Domain Transfer confirmation modal](../static/confirm.png)
-
-If you do not manually approve the transfer, Cloudflare will process the transfer on the fifth day after receiving the request. In either case, when your transfer out completes we will remove your domain’s subscription so that you are not charged at your next renewal.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-registration/cloudflare-custom-domain-protection.md b/products/registrar/src/content/domain-registration/cloudflare-custom-domain-protection.md
deleted file mode 100644
index f4448db95c0..00000000000
--- a/products/registrar/src/content/domain-registration/cloudflare-custom-domain-protection.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-order: 4
----
-
-# Cloudflare custom domain protection
-
-Cloudflare offers [Custom Domain Protection](https://www.cloudflare.com/products/registrar/custom-domain-protection/) to customers with high-profile domains who need the highest level of security against domain hijacking.
-
---------
-
-## Custom domain protection features
-Custom Domain Protection offers additional safeguard features for registered domains, including:
-
-### Registry lock
-Cloudflare applies Registry Lock, when available, to all domains registered through Custom Domain Protection. Any changes to a domain requires Cloudflare to first unlock the domain at the registry level.
-
-### Out-of-band authentication
-All changes to domain ownership or nameserver information are verified and executed manually based on an authentication process defined by the customer.
-
-### No interface
-Custom Domain Protection does not offer an interface to remove the possibility of domain hijack through a compromised account.
-
-Custom Domain Protection is only available to customers with a Cloudflare Enterprise plan.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-registration/index.md b/products/registrar/src/content/domain-registration/index.md
deleted file mode 100644
index 6a26945b352..00000000000
--- a/products/registrar/src/content/domain-registration/index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 1
----
-
-# Domain registration
-
-![Domain Registration Overview](../static/domain-registry-process.png)
-
-When you register a domain, you become the owner, or registrant, for that domain for a set period of time. Now that you are the registrant, you can create an authoritative record that tells the world the nameservers for your domain. The domain name system, or DNS, uses those nameservers to direct traffic to the IP address of your server.
-
-When you put your site behind Cloudflare, you change your nameservers at your registry to ones we provide. Once we are responsible for your authoritative DNS, we can deliver the features that make your site faster and safer.
-
-Your registry keeps the authoritative record for your nameservers. Each top-level domain (TLD) has a single registry that is responsible for maintaining those records. For example, .com is a TLD. Verisign is the exclusive registry for .com. As the TLD’s registry, Verisign stores the contact information and the nameservers for every .com domain in the world. As the registrant for a domain, you can tell your domain’s registry which nameservers DNS should use.
-
-So where do registrars fit in this relationship? Domain registrars communicate your ownership, and subsequent changes, of a domain to the registry for that TLD. Registries trust registrars to only accept changes from the domain owner and to accurately convey that information so that the registry can update their record. While there is one registry for every TLD, hundreds of registrars are able to register a domain.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-registration/tlds-supported.md b/products/registrar/src/content/domain-registration/tlds-supported.md
deleted file mode 100644
index a65bd0be9c7..00000000000
--- a/products/registrar/src/content/domain-registration/tlds-supported.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-order: 2
----
-
-# TLDs supported
-
-Cloudflare supports over 200 top-level domains (TLDs). The [full list of supported TLDs can be found on our TLD policies page](https://www.cloudflare.com/tld-policies/).
-
-We cannot list the wholesale cost for most TLDs in our marketing materials due to commitments in our contracts with the registries. We can, however, give you the wholesale cost at checkout when you transfer your domain.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-registration/whois-redaction.md b/products/registrar/src/content/domain-registration/whois-redaction.md
deleted file mode 100644
index a5189be1f5e..00000000000
--- a/products/registrar/src/content/domain-registration/whois-redaction.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-order: 3
----
-
-# WHOIS redaction
-
-Cloudflare Registrar provides personal data redaction on WHOIS information for all registered domains.
-
---------
-
-## What is WHOIS?
-WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar’s WHOIS service to reveal the data behind a given domain.
-
-However, broadcasting the registrant contact information, via the WHOIS service, can invite mountains of spam to your personal addresses. Cloudflare Registrar will be offering personal data redaction on WHOIS, that meets current ICANN guidelines, for free.
-
---------
-
-## What is WHOIS redaction?
-WHOIS redaction removes all contact information categorized as personal data from the published WHOIS record for a domain (registrant name, email address, postal address). Fields will read “Data Redacted”. The nameserver, domain lock information, and date records for a domain are still available publicly.
-
-Cloudflare still maintains the authoritative, unredacted, record of your WHOIS data. You can modify this information at any time in the domain overview tab of the Cloudflare dashboard.
-
-Note: WHOIS redaction is not the same as WHOIS Privacy. WHOIS Privacy replaces your information with proxy contact information. Redaction removes it altogether.
-
---------
-
-## How can third parties reach registrants?
-As part of the ICANN guidelines, registrars must make available a method for third parties to reach the registrant without revealing the identity of that registrant. Cloudflare has made a [form available where third parties can submit a message for a given domain on Cloudflare Registrar](https://www.cloudflare.com/abuse/form). Cloudflare will forward the message to the registrant email on file for that domain.
-
---------
-
-## TLDs without WHOIS redaction
-Some registries do not allow domains to be registered with WHOIS Redaction or WHOIS Privacy. Many of these are country TLDs (ccTLDs) like .uk. Cloudflare does not yet support TLDs that prohibit WHOIS redaction, but we will in the near future.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-transfers/index.md b/products/registrar/src/content/domain-transfers/index.md
deleted file mode 100644
index 0e2705e2339..00000000000
--- a/products/registrar/src/content/domain-transfers/index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-order: 1
----
-
-# Domain transfers
-
-Cloudflare Registrar will only ever charge you what we pay to the registry for your domain. No markup and no surprise fees.
-
-You can follow instructions in this section to transfer your domain to Cloudflare.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-transfers/transfer-costs.md b/products/registrar/src/content/domain-transfers/transfer-costs.md
deleted file mode 100644
index 0ebb0e30c5a..00000000000
--- a/products/registrar/src/content/domain-transfers/transfer-costs.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-order: 3
----
-
-# Transfer costs
-
-ICANN requires that any transfer also extend the expiration date of your domain by at least one year. That’s one year from your current expiration date, not one year from the date of transfer. For example, if you transfer a domain on October 10, 2018, but it expires on March 10, 2019, your new expiration date will be March 10, 2020.
-
---------
-
-## Domain expiration
-Whenever a domain is first registered, the registrant purchases control of that domain for some number of years. For example, a domain registered on October 8, 2010 will have an expiration of October 8th on some year between 2011 and 2020.
-
-Transferring a domain adds time to the current expiration date. **Time purchased is never lost.** When you transfer your domain to Cloudflare, you are purchasing an additional year of registration on top of your current expiration.
-
---------
-
-## Transfer fees
-Transferring a domain adds at least one year to the registration and the registry bills for that year. For nearly all top-level domains (TLDs), the registry bills the same rate as a renewal or new registration. For example, Verisign charges $7.85 for one year purchased through new registrations, renewals, and transfers.
-
-ICANN fees also apply to transfers. For every year added to the expiration as part of a transfer, ICANN adds $0.18 to the total.
-
---------
-
-## When will I be billed?
-You will be billed when you input your authorization code and initiate the transfer. If your authorization code is incorrect, you can reenter the code.
-
---------
-
-## What am I paying for as part of the transfer?
-When you transfer a domain, you add one year to your expiration. If your domain does not expire until 2024, and your transfer adds time through 2025, the registries and ICANN still bill for the extension when the transfer occurs.
-
---------
-
-## Transfers within 45 Days of renewal of an expired domain
-When you transfer your domain to Cloudflare, we will automatically extend your registration by one year. However, in one specific circumstance your transfer could result in you keeping your original expiration date.
-
-When a domain expires the registration enters the auto-renew grace period. During that time, you can renew the domain at your registrar to avoid losing it. If your domain expires at your current registrar, you renew it, and then you transfer to Cloudflare within 45 days, the registry can restrict the addition of an extra year.
-
-Say you have example.com registered and it expires on December 10, 2018. You decide to renew it during the auto-renew grace period on December 20, 2018. That renewal extends the registration to December 20, 2019. You then transfer to Cloudflare on December 30, 2018. Since that transfer is within 45 days of the expiration, the registry may not add the year to your registration. When you transfer to Cloudflare or any registrar in this circumstance, your expiration can still remain December 20th, 2019.
-
-If a year is not added to your registration, you have effectively paid twice for the same added year. Per ICANN rules, you are entitled to request a refund at your previous registrar.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-transfers/transfer-faq.md b/products/registrar/src/content/domain-transfers/transfer-faq.md
deleted file mode 100644
index 1b835fdd8de..00000000000
--- a/products/registrar/src/content/domain-transfers/transfer-faq.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-order: 4
----
-
-# Transfer FAQ
-
---------
-
-## What happens to my name servers when I transfer my domain to Cloudflare?
-Cloudflare Registrar only supports transfers of domains that are active on Cloudflare. Active domains on Cloudflare use nameservers assigned by Cloudflare. When you transfer your registration, your nameservers will not be modified.
-
---------
-
-## How can I see the status of my domain transfer?
-Once you initiate a domain transfer, your losing registrar has 5 days to release the domain. In most cases, they will send you an email to confirm you want to transfer. If you actively acknowledge that email (through a link or the registrar UI) they can process it immediately.
-
-To see the progress of your transfer, select the “Domain Registration” tab in your account or “Transfer Domains” button, both in the Account home page. Once there, you will see a list of domain transfers that are in progress. To accelerate the process, be sure to check with your old registrar how you can approve the transfer out.
-
-Once successful, you will receive an email from Cloudflare and be able to manage the domain in the Overview tab for that site.
-
---------
-
-## What happens if I entered the wrong auth code?
-If you input the incorrect authentication code, please return to the Domain Registration page or the Overview page for your site. You can use the available input field to reenter your authentication code.
-
---------
-
-## Why did my transfer fail?
-Domain transfers sometimes fail. We’re here to help you address what failed so that you can complete the transfer to Cloudflare.
-
-First, please make sure that you entered the auth code for that domain. If you need to reenter it, you can do so from the transfer launch page or the overview page for that site.
-
-Second, you can reattempt the transfer from the transfer launch page.
-
-If you can’t seem to resolve the issue, please open a support ticket and we’ll help investigate.
-
---------
-
-## 60 day window requirement
-ICANN prohibits domain transfers within 60 days of a change to the WHOIS data or registrar of a domain. If you modified your contact information, transferred registrars, or registered your domain in the last 60 days, we will be unable to process your transfer immediately.
-
-You can continue to leave the domain “In Progress” and we will continue to attempt to process the transfer until the 60 day window passes.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-transfers/transfer-to-cloudflare.md b/products/registrar/src/content/domain-transfers/transfer-to-cloudflare.md
deleted file mode 100644
index 35d2653f4eb..00000000000
--- a/products/registrar/src/content/domain-transfers/transfer-to-cloudflare.md
+++ /dev/null
@@ -1,84 +0,0 @@
----
-order: 2
----
-
-# Transfer to Cloudflare
-
-Domain transfers tell your registry that a different registrar can now set those authoritative records for you. The relationship is based on trust. Registries only trust one registrar, at any given time, to make changes on your behalf.
-
-Transferring a domain to a new registrar informs the registry that they should instead trust that new registrar to modify information. The process requires some steps at both your new registrar and the one you are leaving. Each registrar handles transfers a bit differently, but in general they follow a pattern based on rules set by ICANN, the organization responsible for regulating domain registration.
-
---------
-
-## Unlock your domain
-Registrars include a lightweight safeguard to prevent unauthorized users from starting domain transfers: registrar lock. You might also see it written as domain lock. When enabled, the lock prevents any other registrar from attempting to initiate a transfer.
-
-Only the registrant can enable or disable this lock, typically through the administration interface of the registrar. To proceed with a transfer, you will need to remove this lock if it is enabled.
-
---------
-
-## Remove WHOIS privacy
-Certain registrars, including larger ones like GoDaddy, prohibit transfers while you have WHOIS privacy services enabled.
-
-### GoDaddy
-Customers must remove “Private Registration” prior to the transfer or GoDaddy can cancel the transfer.
-
-### NameCheap
-Customers must remove “WhoisGuard” from NameCheap prior to transferring the domain.
-
-Once your transfer to Cloudflare completes, we will redact your WHOIS information immediately.
-
---------
-
-## Initiate your transfer
-To initiate your transfer, go to the [Registrar section](https://dash.cloudflare.com/?to=/:account/domains/transfer) of your account.
-
-Cloudflare will display the zones available for transfer, those with transfers in progress, and sites unavailable for transfer.
-
-You’ll also be presented with the price for each transfer. When you transfer a domain, you are also required by ICANN to pay to extend its registration by one year from the expiration date. You can remove domains from your transfer by selecting the “x”.
-
-If you do not have a payment method on file, you will need to add one at this step before proceeding.
-
-![Cloudflare checkout screenshot](../static/checkout-page.png)
-
-Sites can be unavailable for a few reasons, including:
-
-* The site was registered in the last 60 days
-* Cloudflare does not yet support the TLD
-
-You will not be billed at this step. Cloudflare will only bill your card when you input the auth code and confirm the contact information at the conclusion of your transfer request.
-
---------
-
-## Input your authorization code
-In the next page, you’ll need to input the authorization code for each domain you are transferring. You will also need to unlock each domain so that Cloudflare can process your request. For more information about transferring out from your current registrar, see the Transfer Instructions section.
-
-![Authorization input screenshot](../static/input-field.png)
-
---------
-
-## Confirm or input your contact information
-In the final stage, you will need to input the contact information for your registration. Cloudflare Registrar will redact this information by default, but we are required to collect the authentic contact information for this registration.
-
-You can modify the contact information, if needed, in the Overview tab for that specific account. Once you have entered the contact information, you will need to agree to the domain registration terms of service by selecting the “Confirm transfer” button.
-
---------
-
-## Approve the transfer with your previous registrar
-Once you have requested your transfer, Cloudflare will begin processing your transfer. Your previous registrar will email you to confirm your request to transfer away. Most registrars will include a link to confirm the transfer request. If you click that link, you can accelerate the transfer operation. If you do not act on the email, the registrar can wait up to five days to process the transfer to Cloudflare.
-
---------
-
-## Transfer statuses
-You can check on the status of your transfer from the Overview page for that domain in the Cloudflare dashboard.
-
-### Transfer in progress
-Your request has been submitted by Cloudflare to your previous registrar. We are now waiting on them to confirm they have received the request.
-
-If this status persists more than one day, please ensure that the domain has been unlocked at your current registrar and any WHOIS privacy services have been removed.
-
-### Pending approval
-Your current registrar has received the transfer request. They can now wait up to five days to release the domain. If you want to move faster, you can manually approve the transfer for immediate release in the UI of most registrars.
-
-### Transfer rejected
-Your transfer has been rejected. This can occur if you cancelled the request, instead of approving it, at your current registrar. If you still wish to transfer, you can select “Retry” and initiate a new transfer request.
\ No newline at end of file
diff --git a/products/registrar/src/content/domain-transfers/troubleshoot-a-stalled-transfer.md b/products/registrar/src/content/domain-transfers/troubleshoot-a-stalled-transfer.md
deleted file mode 100644
index cf50cd27565..00000000000
--- a/products/registrar/src/content/domain-transfers/troubleshoot-a-stalled-transfer.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-order: 5
----
-
-# Troubleshoot a stalled transfer
-
-Your previous registrar has five days to release the domain after a successful transfer request. If your transfer has not completed within that timeframe, something has likely gone wrong. To resolve, we recommend you check the following settings and restart the transfer
-
- After five days, something has stopped the transfer. We recommend you check the following details and restart the transfer.
-
---------
-
-## Registrar lock reapplied
-You have reapplied registrar lock at your current registrar since requesting the transfer. You will need to remove it again to restart.
-
---------
-
-## Transfer rejected
-Your transfer has been rejected by your previous registrar. This can be caused if you actively rejected the transfer request in an email or your registrar’s UI, or if your registrar determines the domain is not eligible for transfer. You will need to restart the transfer and approve the request or contact your current registrar.
-
---------
-
-## Auth code invalid
-Your auth code has since changed or been deprecated and we cannot complete the transfer. Please confirm the code with your current registrar again.
-
---------
-
-## WHOIS Guard / privacy protection
-Some registrars, including GoDaddy and NameCheap, can prohibit transfer requests if you have WHOIS privacy services enabled. You will need to first disable those services at your current registrar.
-
---------
-
-## Restarting your transfer
-In the Cloudflare Overview page for your domain, you can find the details of your registration in the column on the right side of the page. In that card, `Domain Registration` select the button “Cancel and Retry”. Once you initiate the retry, you will need to reenter your auth code and confirm your WHOIS information.
-
-Most issues with a stalled transfer can be resolved by checking these details and restarting the transfer from the UI.
\ No newline at end of file
diff --git a/products/registrar/src/content/faq.md b/products/registrar/src/content/faq.md
new file mode 100644
index 00000000000..6d2c32fd89a
--- /dev/null
+++ b/products/registrar/src/content/faq.md
@@ -0,0 +1,81 @@
+---
+title: Frequently asked questions
+order: 4
+pcx-content-type: faq
+---
+
+# Frequently Asked Questions
+
+## After transferring my domain to Cloudflare, my domain’s expiration date changed. Why?
+
+ICANN requires that any transfer also extends the expiration date of your domain by at least one year — that is one year from your current expiration date, not one year from the date of transfer. For example, if you transfer a domain on October 10, 2020, but it expires on March 10, 2021, your new expiration date will be March 10, 2022.
+
+Whenever a domain is first registered, the registrant purchases control of that domain for some number of years — up to 10 years. For example, a domain registered on October 8, 2020 will have an expiration date of October 8th in some year between 2021 and 2030, depending on the amount of years originally purchased.
+
+Transferring a domain adds time to the current expiration date. Time purchased is never lost. When you transfer your domain to Cloudflare, you are purchasing an additional year of registration on top of your current expiration.
+
+## When will I be billed?
+
+You will be billed when you input your authorization code and initiate the transfer of your domain to Cloudflare. Make sure to copy / paste the code to avoid mistakes. The transfer will not initiate if the code is incorrect.
+
+## My domain’s registration wasn’t extended by one year after transferring to Cloudflare
+
+When you transfer your domain to Cloudflare, the registry will extend your registration by one year. However, in one specific circumstance your transfer could result in you keeping your original expiration date.
+
+When a domain expires, the registration enters the auto-renew grace period. During that time, you can renew the domain at your registrar to avoid losing it. If your domain expires at your current registrar, you renew it and then transfer to Cloudflare within 45 days, the registry can restrict the addition of an extra year.
+
+Say you have `example.com` registered and it expires on December 10, 2020. You decide to renew it during the auto-renew grace period on December 20, 2020. That renewal extends the registration to December 20, 2021. You then transfer to Cloudflare on December 30, 2020. Since that transfer is within 45 days of the expiration, the registry may not add the year to your registration. When you transfer to Cloudflare or any registrar in this circumstance, your expiration can still remain December 20th, 2021.
+
+If a year is not added to your registration, you have effectively paid twice for the same added year. Per ICANN rules, you are entitled to request a refund at your previous registrar.
+
+## What happens to my name servers when I transfer my domain to Cloudflare?
+
+Cloudflare Registrar only supports transfers of domains that are active on Cloudflare. Active domains on Cloudflare use nameservers assigned by Cloudflare. When you transfer your registration, your nameservers will not be modified.
+
+## How can I see the status of my domain transfer?
+
+Once you initiate a domain transfer, your previous registrar has five days to release the domain. In most cases, they will send you an email to confirm you want to transfer. If you actively acknowledge that email (through a link or the registrar's dashboard), they can process it immediately.
+
+To see the progress of your transfer, log into the Cloudflare dashboard and select your account. Then, select **Registrar** > **Transfer** to see a list of domain transfers that are in progress. To accelerate the process, be sure to check with your old registrar how you can approve the transfer out.
+
+Once successful, you will receive an email from Cloudflare and be able to manage the domain in the dashboard under **Overview** of that site.
+
+## What happens if I entered the wrong auth code?
+
+If you input the incorrect auth code (also referred to as authentication code and authorization code), return to the **Domain Registration** page or the **Overview** for your site. You can use the available input field to reenter your authentication code.
+
+## Why did my transfer fail?
+
+Domain transfers sometimes fail. Your account team can help you address what failed so that you can complete the transfer to Cloudflare.
+
+First, make sure that you entered the auth code for that domain. If you need to reenter it, you can do so from your **Account Home** > **Registrar** > **Transfer** page.
+
+Second, you can reattempt the transfer from the transfer launch page.
+
+If you cannot resolve the issue, open a support ticket or contact your account team.
+
+## Why am I not allowed to transfer my domain?
+
+ICANN prohibits domain transfers within 60 days of a change to the WHOIS data or registrar of a domain. If you modified your contact information, transferred registrars, or registered your domain in the last 60 days, Cloudflare will be unable to process your transfer immediately.
+
+You can leave the domain **In Progress** and Cloudflare will attempt to process the transfer until the 60-day window passes.
+
+## Why am I not able to start a transfer?
+
+If you have an <a href='https://support.cloudflare.com/hc/articles/203471284#h_1l0KGygoBX9QYjNrhAcHjg'>unverified email address</a>, you might experience issues when initiating a domain transfer.
+
+## Premium domains
+
+Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
+
+## What Happens When a Domain Expires?
+
+Cloudflare currently offers a 40 day grace period for most top-level domains (TLDs). During this period you may renew/extend the domain at any time from within the dashboard but no further auto-renew attempts will be made. For the first 30 days of the grace period, the domain will continue to resolve as normal. On the 30th day after the expiration date, the domain will be suspended and a parked suspension page will be displayed. You may still renew the domain at any time during this suspension period. On the 40th day, the domain will enter the Redemption Period and will no longer resolve to any web page. The redemption period lasts for 30 days.  During this time, it may be possible to restore and renew the domain. A restore fee may apply in addition to the renewal fee. Contact your account team for assistance. At the end of the 30 day redemption period, the domain will be placed in pending delete status for a period of five days, after which it will be released and made available for re-registration. The domain cannot be restored or renewed during this period.
+
+In summary, here is what will happen after a domain expires:
+
+* **Day 0:**	Expiration Date.
+* **Day 1 - 30:** Grace Period (domain resolves normally).
+* **Day 31 - 40:** Suspension Period (domains resolves to suspension page).
+* **Day 41 - 70:** Redemption Period.
+* **Day 71 - 75:** Pending Delete Period.
\ No newline at end of file
diff --git a/products/registrar/src/content/index.md b/products/registrar/src/content/index.md
index 696665b815a..f72fdf447b7 100644
--- a/products/registrar/src/content/index.md
+++ b/products/registrar/src/content/index.md
@@ -1,10 +1,16 @@
 ---
-title: Welcome
+title: Overview
 order: 0
+pcx-content: landing-page
 ---
 
-# Cloudflare registrar documentation
+# Cloudflare Registrar
 
-Cloudflare Registrar will only ever charge you what we pay to the registry for your domain. No markup. No surprise fees.
+![Registrar Logo](./static/registrar-color-logo.png)
 
-![Registrar Logo](./static/registrar-color-logo.png)
\ No newline at end of file
+Manage your domain with Cloudflare Registrar and add an additional layer of security to your DNS records for free. Cloudflare Registrar also offers redacted WHOIS information by default and will only charge you what is paid to the registry for your domain. No markup. No surprise fees.
+
+<ButtonGroup>
+  <Button type="primary" href="/why-choose-cloudflare">Learn more</Button>
+  <Button type="secondary" href="/setup-domain-transfers">Setup domain transfer</Button>
+</ButtonGroup>
\ No newline at end of file
diff --git a/products/registrar/src/content/setup-domain-transfers/index.md b/products/registrar/src/content/setup-domain-transfers/index.md
new file mode 100644
index 00000000000..b91c861480a
--- /dev/null
+++ b/products/registrar/src/content/setup-domain-transfers/index.md
@@ -0,0 +1,14 @@
+---
+order: 2
+pcx-content-type: concept
+---
+
+import BeforeYouBegin from "../_partials/_before-you-begin.md"
+
+# Transfer your domain to Cloudflare
+
+Domain transfers tell your registry that a different registrar can now set those authoritative records for you. The relationship is based on trust. Registries only trust one registrar at any given time to make changes on your behalf.
+
+Transferring a domain to a new registrar informs the registry that they should instead trust that new registrar to modify information. The process requires some action steps at your new and previous registrar. Each registrar handles transfers a bit differently, but in general, they follow a pattern based on rules set by ICANN, the organization responsible for regulating domain registration.
+
+<BeforeYouBegin/>
\ No newline at end of file
diff --git a/products/registrar/src/content/setup-domain-transfers/transfer-domain-to-cloudflare.md b/products/registrar/src/content/setup-domain-transfers/transfer-domain-to-cloudflare.md
new file mode 100644
index 00000000000..d266d0fa344
--- /dev/null
+++ b/products/registrar/src/content/setup-domain-transfers/transfer-domain-to-cloudflare.md
@@ -0,0 +1,120 @@
+---
+order:
+pcx-content-type: how-to
+---
+
+import BeforeYouBegin from "../_partials/_before-you-begin.md"
+import Restrictions from "../_partials/_restrictions.md"
+import EmailForward from "../_partials/_email-forward.md"
+
+# How to transfer your domain to Cloudflare
+
+This section contains generic details on how to transfer your domain to Cloudflare from most registrars.
+
+<BeforeYouBegin/>
+
+<Restrictions />
+
+<EmailForward/>
+
+---
+
+## Set up a domain transfer
+
+To begin, complete the following steps in your current registrar to transfer your domain to Cloudflare. Below, you will find links for detailed transfer instructions from some of the most popular registrars:
+
+* [Enom](http://enom.help/outgoing)
+* [GoDaddy](https://www.godaddy.com/help/transfer-my-domain-away-from-godaddy-3560)
+* [Namecheap](https://www.namecheap.com/support/knowledgebase/article.aspx/258/84/what-should-i-do-to-transfer-a-domain-from-namecheap/)
+* [Network Solutions](https://customerservice.networksolutions.com/prweb/PRAuth/webkm/help/article/KC-474/networksolutions)
+* [Ionos by 1&1](https://www.ionos.com/help/domains/domain-transfers/#acc4514)
+
+
+### 1. Login to your registrar account
+
+Log in to the registrar account where the domain is currently registered.
+
+### 2. Unlock the domain
+
+Registrars include a lightweight safeguard to prevent unauthorized users from starting domain transfers: registrar lock. You might also see it written as "domain lock." In WHOIS, it may appear as `clientTransferProhibited`. When enabled, the lock prevents any other registrar from attempting to initiate a transfer.
+
+Only the registrant can enable or disable this lock, typically through the administration interface of the registrar. To proceed with a transfer, remove this lock if it is enabled.
+
+### 3. Remove WHOIS privacy
+
+In most cases, domains may be transferred even if WHOIS privacy services have been enabled. However, some registrars may prohibit the transfer if the WHOIS privacy service has been enabled.
+
+
+### 4. Request an authorization code
+
+Your new registrar needs to confirm with your old registrar that the transfer flow is authorized. To do that, your old registrar will provide an authorization code to you. 
+
+<Aside type="note">
+
+This code is often referred to as an authorization code, auth code, authinfo code, or transfer code. You will need to input that code to complete your transfer to Cloudflare. Cloudflare will use it to confirm the transfer is authentic.
+
+</Aside>
+
+
+### 5. Initiate your transfer to Cloudflare
+
+Go to the **Account Home** > [**Registrar**](https://dash.cloudflare.com/?to=/:account/domains/transfer). Cloudflare will display the zones available for transfer.
+
+You will be presented with the price for each transfer. When you transfer a domain, you are required by ICANN to pay to extend its registration by one year from the expiration date. You can remove domains from your transfer by selecting **x**.
+
+If you do not have a payment method on file, add one at this step before proceeding.
+
+![Cloudflare checkout screenshot](../static/checkout-page.png)
+
+Sites can be unavailable for a few reasons, including:
+
+* The site was registered in the last 60 days.
+* Cloudflare does not yet support the TLD.
+* The domain is designated as a “premium” domain by the registry.
+* The domain has a status that does not allow for a transfer.
+
+You will not be billed at this step. Cloudflare will only bill your card when you input the auth code and confirm the contact information at the conclusion of your transfer request.
+
+<Aside type="note">
+
+If you have an <a href='https://support.cloudflare.com/hc/articles/203471284#h_1l0KGygoBX9QYjNrhAcHjg'>unverified account email address</a>, you will not be able to transfer domains. Verify your account email address before proceeding.
+
+</Aside>
+
+### 6. Input your authorization code
+
+In the next page, input the authorization code for each domain you are transferring. You also need to unlock each domain so that Cloudflare can process your request. For more information, refer to the instructions provided by your [current registrar on how to transfer your domain](/setup-domain-transfers/transfer-domain-to-cloudflare#set-up-a-domain-transfer).
+
+<div class="medium-img">
+
+![Authorization input screenshot](../static/input-field.png)
+
+</div>
+
+### 7. Confirm or input your contact information
+
+In the final stage of the transfer process, input the contact information for your registration. Cloudflare Registrar redacts this information by default but is required to collect the authentic contact information for this registration. It is important that you provide accurate WHOIS contact information. You may be required to verify the contact information. Failure to provide accurate information and/or failure to verify the information may result in suspension or deletion of your domain.
+
+You can modify the contact information, if needed: 
+
+1. From your **Account Home**, select **Registrar**. 
+1. Under the **Manage** tab, select **Edit** in the **Default Contact** card.
+1. Update your information.
+
+After entering the contact information, agree to the domain registration terms of service by selecting **Confirm transfer**.
+
+
+### 8. Approve the transfer with your previous registrar
+
+Once you have requested your transfer, Cloudflare will begin processing it. Your previous registrar will email you to confirm your request to transfer. Most registrars will include a link to confirm the transfer request. If you click that link, you can accelerate the transfer operation. If you do not act on the email, the registrar can wait up to five days to process the transfer to Cloudflare. You may also be able to approve the transfer from within your current registrar dashboard.
+
+
+## Transfer statuses
+
+You can check on the status of your transfer in **Account Home** > **Overview** > **Domain Registration** for your domain. Below, you can find a list of the possible transfer statuses.
+
+* **Transfer in progress**: Your request has been submitted by Cloudflare to your previous registrar. Cloudflare is now waiting on them to confirm they have received the request. If this status persists for more than a day (24 hours), ensure that the domain has been unlocked at your current registrar and any WHOIS privacy services have been removed.
+
+* **Pending approval**: Your current registrar has received the transfer request. They can now wait up to five days to release the domain. If you want to move faster, you can manually approve the transfer for immediate release in the dashboard of most registrars.
+
+* **Transfer rejected**: your transfer has been rejected. This can occur if you canceled the request at your current registrar instead of approving it. If you still wish to transfer, you can select **Retry** and initiate a new transfer request.
\ No newline at end of file
diff --git a/products/registrar/src/content/setup-domain-transfers/troubleshoot-a-stalled-transfer.md b/products/registrar/src/content/setup-domain-transfers/troubleshoot-a-stalled-transfer.md
new file mode 100644
index 00000000000..990d24b24dd
--- /dev/null
+++ b/products/registrar/src/content/setup-domain-transfers/troubleshoot-a-stalled-transfer.md
@@ -0,0 +1,61 @@
+---
+order:
+pcx-content-type: reference
+---
+
+# Troubleshoot a stalled transfer
+
+Your previous registrar has five days to release the domain after a successful transfer request. If your transfer has not been completed within that time frame, something has likely gone wrong. To resolve the issue, check the following settings and restart the transfer.
+
+Most issues with a stalled transfer can be solved by checking the following details and restarting the transfer from your Cloudflare dashboard.
+
+<details>
+<summary>Registrar lock reapplied</summary>
+<div>
+
+You have reapplied the registrar lock at your current registrar since requesting the transfer. You will need to remove it again to restart the transfer process.
+
+</div>
+</details>
+
+<details>
+<summary>Transfer rejected</summary>
+<div>
+
+Your transfer has been rejected by your previous registrar. There are several reasons for this to happen: 
+* You actively rejected the transfer request in the email you received from your registrar or on your registrar’s interface.
+* Your registrar determines the domain is not eligible for transfer.
+* Some registrars allow customers to enable a setting to reject all transfer requests.
+* In some instances, registrars may reject the transfer if they suspect malicious behavior.
+
+You will need to restart the transfer and approve the request or contact your current registrar to solve this issue.
+
+</div>
+</details>
+
+<details>
+<summary>Auth code invalid</summary>
+<div>
+
+Your auth code (also referred to as authentication code and authorization code) has since changed or been deprecated, and Cloudflare cannot complete the transfer. Confirm the code with your current registrar again. To avoid mistakes, copy and paste the auth code provided by your current registrar.
+
+</div>
+</details>
+
+<details>
+<summary>WHOIS Guard / privacy protection</summary>
+<div>
+
+Some registrars may prohibit transfer requests if you have WHOIS privacy services enabled. You need to first disable those services at your current registrar before you can proceed with the transfer process.
+
+</div>
+</details>
+
+<details>
+<summary>Restarting your transfer</summary>
+<div>
+
+In **Overview** for your domain, find the details of your registration in the menu on the right side of the page. Under **Domain Registration**, select **Cancel and Retry**. Once you initiate the retry, reenter your auth code and confirm your WHOIS information.
+
+</div>
+</details>
\ No newline at end of file
diff --git a/products/registrar/src/content/static/accept-reject.png b/products/registrar/src/content/static/accept-reject.png
index 8aa2e95e69b..ec3dbc0a01a 100644
Binary files a/products/registrar/src/content/static/accept-reject.png and b/products/registrar/src/content/static/accept-reject.png differ
diff --git a/products/registrar/src/content/static/auth-generated.png b/products/registrar/src/content/static/auth-generated.png
index 7e2094efb63..a5704ea3ec1 100644
Binary files a/products/registrar/src/content/static/auth-generated.png and b/products/registrar/src/content/static/auth-generated.png differ
diff --git a/products/registrar/src/content/static/confirm.png b/products/registrar/src/content/static/confirm.png
index affd779ed2a..1dd931e7fbe 100644
Binary files a/products/registrar/src/content/static/confirm.png and b/products/registrar/src/content/static/confirm.png differ
diff --git a/products/registrar/src/content/static/input-field.png b/products/registrar/src/content/static/input-field.png
index 86475dd0094..2137092a220 100644
Binary files a/products/registrar/src/content/static/input-field.png and b/products/registrar/src/content/static/input-field.png differ
diff --git a/products/registrar/src/content/static/start-transfer-out.png b/products/registrar/src/content/static/start-transfer-out.png
index 4180d12c939..f58cdb19ff4 100644
Binary files a/products/registrar/src/content/static/start-transfer-out.png and b/products/registrar/src/content/static/start-transfer-out.png differ
diff --git a/products/registrar/src/content/transfer-instructions/enom.md b/products/registrar/src/content/transfer-instructions/enom.md
deleted file mode 100644
index eb71550b500..00000000000
--- a/products/registrar/src/content/transfer-instructions/enom.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-order: 2
----
-
-# Enom
-
-You can follow the instructions below to transfer your domain from Enom to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to Enom
-Login to the Enom account where the domain is registered. Navigate to **My Domains** from **Domains** in the navigation bar.
-
---------
-
-## Step 2: Unlock the domain
-In the **Manage Domain** menu, select **General Settings**. The settings will include a row, “Registrar-Lock” with two options: Enable and Disable. Set the Registrar-Lock to Disable.
-
---------
-
-## Step 3: Request authorization code
-Below Registrar-Lock and Auto Renew, there will be a row for “Auth Info / EPP Key”. Select “Email Auth Info to Registrant”. Enom will email your authorization code to the registrant email address.
-
-If you do not receive the code, please check the registrant email address listed in the domain contact information for the given domain. It might be different than your Enom account email.
-
---------
-
-## Step 4: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 5: Approve the transfer
-Once Cloudflare processes your transfer, Enom will send an email to the domain’s registrant contact (the same address where the authorization code was emailed). The email will contain a link that you can click to immediately approve and process the transfer. If you do not click the link, the transfer will automatically approve within 5 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/transfer-instructions/generic.md b/products/registrar/src/content/transfer-instructions/generic.md
deleted file mode 100644
index 14abf5071f6..00000000000
--- a/products/registrar/src/content/transfer-instructions/generic.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-order: 3
----
-
-# Generic
-
-You can follow the instructions below to transfer your domain from any registrar to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to your Registrar account
-Login to the registrar account where the domain is currently registered.
-
---------
-
-## Step 2: Unlock the domain
-Registrars include a lightweight safeguard to prevent unauthorized users from starting domain transfers: registrar lock. You might also see it written as domain lock. When enabled, the lock prevents any other registrar from attempting to initiate a transfer.
-
-Only the registrant can enable or disable this lock, typically through the administration interface of the registrar. To proceed with a transfer, you will need to remove this lock if it is enabled.
-
---------
-
-## Step 3: Request authorization code
-Next, your new registrar needs to confirm with your old registrar that the transfer flow is authorized. To do that, your old registrar will provide an authorization code to you. You will need to input that code to complete your transfer to Cloudflare. Cloudflare will use it to confirm the transfer is authentic.
-
---------
-
-## Step 4: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 5: Approve the transfer
-Your previous registrar will email you to confirm your request to transfer away. Most registrars will include a link to confirm the transfer request. If you click that link, you can accelerate the transfer operation. If you do not act on the email, the registrar can wait up to five days to process the transfer to Cloudflare.
\ No newline at end of file
diff --git a/products/registrar/src/content/transfer-instructions/godaddy.md b/products/registrar/src/content/transfer-instructions/godaddy.md
deleted file mode 100644
index 1f07b9b8b75..00000000000
--- a/products/registrar/src/content/transfer-instructions/godaddy.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-order: 4
----
-
-# GoDaddy
-
-You can follow the instructions below to transfer your domain from GoDaddy to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to GoDaddy
-Login to the GoDaddy account where the domain is registered. Navigate to the **Domain Settings** page.
-
---------
-
-## Step 2: Unlock the domain and remove private registration
-In **Domain Settings** select the **Edit** link next to Domain lock under **Additional Settings**. Toggle the lock off. [GoDaddy’s domain unlocking instructions can be found at godaddy.com](https://www.godaddy.com/help/unlock-my-domain-410).
-
-Customers must also remove “Private Registration” prior to the transfer or GoDaddy can cancel the transfer.
-
---------
-
-## Step 3: Request authorization code
-While still in **Domain Settings**, also under *Additional Settings** you will need to select “Get Authorization Code”. GoDaddy will email the code to the address listed for the domain’s Administrator. [Godaddy’s Authorization code instructions can be found at godaddy.com](https://www.godaddy.com/help/get-an-authorization-code-to-transfer-my-domain-to-another-registrar-1685).
-
-It may take up to 24 hours for GoDaddy to email you the code. If you do not receive the code, please check the registrant email address listed in the domain contact information for the given domain. It might be different than your GoDaddy account email.
-
---------
-
-## Step 4: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 5: Approve the transfer
-Once Cloudflare processes your transfer, GoDaddy will list the domain as “Pending Transfers Out” in the GoDaddy dashboard under **Domain Manager**. You can accelerate the transfer by accepting the transfer in the dashboard. If you do not accept it, the transfer will automatically approve within 5 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/transfer-instructions/index.md b/products/registrar/src/content/transfer-instructions/index.md
deleted file mode 100644
index a6553be0ccc..00000000000
--- a/products/registrar/src/content/transfer-instructions/index.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-order: 1
----
-
-# Transfer instructions
-
-Transferring a domain to a new registrar informs the registry that they should instead trust that new registrar to modify information. The process requires some steps at both your new registrar and the one you are leaving. Each registrar handles transfers a bit differently, but in general they follow a pattern based on rules set by ICANN, the organization responsible for regulating domain registration.
-
-This section contains transfer instructions for some of the largest registrars as well as generic details.
-
-Before transferring a domain to Cloudflare, you need to set up Cloudflare on the domain. This involves [creating an account and adding your domain](https://support.cloudflare.com/hc/articles/201720164) and [changing your DNS nameservers](https://support.cloudflare.com/hc/articles/205195708).
diff --git a/products/registrar/src/content/transfer-instructions/namecheap.md b/products/registrar/src/content/transfer-instructions/namecheap.md
deleted file mode 100644
index 39840a8ca81..00000000000
--- a/products/registrar/src/content/transfer-instructions/namecheap.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-order: 5
----
-
-# Namecheap
-
-You can follow the instructions below to transfer your domain from NameCheap to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to Namecheap
-Login to the Namecheap account where the domain is registered. Navigate to the **Domain List** page and select “Manage”.
-
---------
-
-## Step 2: Unlock the domain and remove WhoisGuard
-Select the **Sharing & Transfer** tab. In that tab, you will find a card labeled “Transfer Out”. First, click “Unlock” next to “Domain Lock”.
-
-Customers must remove “WhoisGuard” from NameCheap prior to transferring the domain.
-
---------
-
-## Step 3: Request authorization code
-While still on the **Sharing & Transfer** tab, click the button “Auth Code” next to “Domain Lock”. Namecheap will email the code to the email on file for your account.
-
---------
-
-## Step 4: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 5: Approve the transfer
-Once Cloudflare processes your transfer, Namecheap will send an email to the domain’s registrant contact (the same address where the authorization code was emailed). To approve the transfer, do **not** take any action. The transfer will automatically approve within 5 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/transfer-instructions/network-solutions.md b/products/registrar/src/content/transfer-instructions/network-solutions.md
deleted file mode 100644
index 0997ef1317d..00000000000
--- a/products/registrar/src/content/transfer-instructions/network-solutions.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-order: 6
----
-
-# Network solutions
-
-You can follow the instructions below to transfer your domain from Network Solutions to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to Network Solutions
-Login to the Network Solutions account where the domain is registered. Navigate to the **Account Settings** page.
-
---------
-
-## Step 2: Unlock the domain and request authorization code
-In the **Details** section, select “Turn Off or Request Authorization Code” next to **Transfer Lock**. Once you hit “Continue”, you will need to acknowledge the Network Solutions’ transfer terms.
-
-After confirming the terms, you may be asked to complete survey questions. Once completed, click “Request Authorization Code”. You will need to select “Leave Domain Protect off” and then check the “Request Authorization Code” box. Once checked, click save.
-
-Network Solutions will email the code to the registrant contact email on file for your domain.
-
-If you do not receive the code, please check the registrant email address listed in the domain contact information for the given domain. It might be different than your GoDaddy account email.
-
---------
-
-## Step 3: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 4: Approve the transfer
-Once Cloudflare processes your transfer, Network Solutions will send an email to the domain’s registrant contact (the same address where the authorization code was emailed). The email will contain a link that you can click to immediately approve and process the transfer. If you do not click the link, the transfer will automatically approve within 5 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/transfer-instructions/oneandone.md b/products/registrar/src/content/transfer-instructions/oneandone.md
deleted file mode 100644
index c24d25afb36..00000000000
--- a/products/registrar/src/content/transfer-instructions/oneandone.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-order: 7
----
-
-# 1&1
-
-You can follow the instructions below to transfer your domain from 1&1 to Cloudflare.
-
---------
-
-## Restrictions
-To transfer to a new registrar, your domain must meet the following requirements.
-
-* ICANN rules prohibit a domain from being transferred if it has been transferred within the last 60 days or if the WHOIS contact information was modified in the last 60 days (even if redacted).
-* Your account at your current registrar must be active. If your domain has expired, you may have to pay a redemption fee to renew it before you can process a transfer.
-* Cloudflare does not currently support premium domains. Some registries designate a domain name as “premium” and charge higher wholesale rates for these domains.
-
-If it is listed as available for transfer in the Cloudflare dashboard, these restrictions have already been checked.
-
---------
-
-## Email forwarding
-Cloudflare Registrar does not currently support email forwarding. If you require email forwarding from your registrar, you will need to use a third-party forwarding service and configure your MX record in the Cloudflare DNS setting for the domain.
-
---------
-
-## Step 1: Login to 1&1
-Login to the 1&1 account where the domain is registered. Navigate to the **Manage domains** page and select the domain you plan to transfer.
-
---------
-
-## Step 2: Unlock the domain
-Select the **Registration & Transfer** tab. In the section “Domain transfer lock” toggle the button to remove the registrar lock.
-
---------
-
-## Step 3: Request authorization code
-Below the “Domain transfer lock” section will be a row listed as “Change provider”. Click “Show Authorization Code”. The 1&1 dashboard will launch a pop-up with the code.
-
---------
-
-## Step 4: Transfer to Cloudflare
-In the Cloudflare transfer screen, input the authorization code. Each domain will have a unique authorization code and you will need to enter each for every domain you want to transfer.
-
---------
-
-## Step 5: Approve the transfer
-Once Cloudflare processes your transfer, 1&1 will send an email to the domain’s registrant contact (the same address where the authorization code was emailed). The email will contain a link that you can click to immediately approve and process the transfer. If you do not click the link, the transfer will automatically approve within 5 days.
\ No newline at end of file
diff --git a/products/registrar/src/content/why-choose-cloudflare/custom-domain-protection.md b/products/registrar/src/content/why-choose-cloudflare/custom-domain-protection.md
new file mode 100644
index 00000000000..1201d9fdf98
--- /dev/null
+++ b/products/registrar/src/content/why-choose-cloudflare/custom-domain-protection.md
@@ -0,0 +1,14 @@
+---
+order:
+pcx-content: reference
+---
+
+# Cloudflare Custom Domain Protection
+
+Cloudflare offers [Custom Domain Protection](https://www.cloudflare.com/products/registrar/custom-domain-protection/) to customers with a Cloudflare Enterprise plan and high-profile domains who need the highest level of security against domain hijacking.
+
+Custom Domain Protection offers additional safeguard features for registered domains, including:
+
+* **Registry lock**: Cloudflare applies Registry Lock, when available, to all domains registered through Custom Domain Protection. Any changes to a domain requires Cloudflare to first unlock the domain at the registry level.
+* **Out-of-band authentication**: All changes to domain ownership or nameserver information are verified and executed manually based on an authentication process defined by the customer.
+* **No interface**: Custom Domain Protection does not offer an interface, to remove the possibility of domain hijack through a compromised account.
\ No newline at end of file
diff --git a/products/registrar/src/content/why-choose-cloudflare/index.md b/products/registrar/src/content/why-choose-cloudflare/index.md
new file mode 100644
index 00000000000..95122f3f439
--- /dev/null
+++ b/products/registrar/src/content/why-choose-cloudflare/index.md
@@ -0,0 +1,19 @@
+---
+order: 1
+title: Why choose Cloudflare
+pcx-content: concept
+---
+
+# Domain registration
+
+![Domain Registration Overview](../static/domain-registry-process.png)
+
+When you register a domain, you become the owner, or registrant, for that domain for a set period of time. Now that you are the registrant, you can create an authoritative record that tells the world the nameservers for your domain. The domain name system, or DNS, uses those nameservers to direct traffic to the IP address of your server.
+
+When you put your site behind Cloudflare, you change your nameservers at your registry to the ones Cloudflare provides. Once Cloudflare is responsible for your authoritative DNS, Cloudflare can deliver the features that make your site faster and safer.
+
+Your registry keeps the authoritative record for your nameservers. Each top-level domain (TLD) has a single registry that is responsible for maintaining those records. For example, `.com` is a TLD. Verisign is the exclusive registry for `.com`. As the TLD’s registry, Verisign stores the contact information and the nameservers for every `.com` domain in the world. As the registrant for a domain, you can tell your domain’s registry which nameservers a DNS resolver should use.
+
+Where do registrars fit in this relationship? Domain registrars communicate your ownership, and subsequent changes, of a domain to the registry for that TLD. Registries trust registrars to only accept changes from the domain owner and to accurately convey that information so that the registry can update their record. While there is one registry for every TLD, hundreds of registrars are able to register a domain.
+
+Beyond this, Cloudflare also offers you services such Domain Name System Security Extensions, custom domain protection, and WHOIS redaction.
\ No newline at end of file
diff --git a/products/registrar/src/content/why-choose-cloudflare/top-level-domains-supported.md b/products/registrar/src/content/why-choose-cloudflare/top-level-domains-supported.md
new file mode 100644
index 00000000000..e758c9dc205
--- /dev/null
+++ b/products/registrar/src/content/why-choose-cloudflare/top-level-domains-supported.md
@@ -0,0 +1,10 @@
+---
+order:
+pcx-content: reference
+---
+
+# Top Level Domains supported
+
+Cloudflare supports over 200 top-level domains (TLDs). The full list of supported TLDs [can be found on our TLD policies page](https://www.cloudflare.com/tld-policies/).
+
+Cloudflare cannot list the wholesale cost for most TLDs in our marketing materials due to commitments in our contracts with the registries. Cloudflare can, however, give you the wholesale cost at checkout when you transfer your domain.
\ No newline at end of file
diff --git a/products/registrar/src/content/why-choose-cloudflare/whois-redaction.md b/products/registrar/src/content/why-choose-cloudflare/whois-redaction.md
new file mode 100644
index 00000000000..e16148c0c11
--- /dev/null
+++ b/products/registrar/src/content/why-choose-cloudflare/whois-redaction.md
@@ -0,0 +1,45 @@
+---
+order:
+pcx-content: reference
+---
+
+# WHOIS redaction
+
+Cloudflare Registrar provides personal data redaction on WHOIS information, if permitted by the registry.
+
+WHOIS is a standard for publishing the contact and nameserver information for all registered domains. Each registrar maintains their own WHOIS service. Anyone can query the registrar’s WHOIS service to reveal the data behind a given domain.
+
+However, broadcasting the registrant contact information via the WHOIS service can cause spam mail to be delivered to your personal addresses. Cloudflare Registrar offers personal data redaction on WHOIS for free, that meets current ICANN guidelines.
+
+Cloudflare’s WHOIS service can be found at https://rdap.cloudflare.com/. Select **WHOIS** as the search type.
+
+## What is WHOIS redaction?
+
+WHOIS redaction removes most contact information categorized as personal data (registrant name, email address, postal address) from the published WHOIS record for a domain. Fields will read “Data Redacted”. The nameserver, domain lock information, and date records for a domain are still available publicly. The following fields will continue to show in WHOIS: 
+
+* Registrant State/Province 
+* Registrant Country.
+
+Cloudflare still maintains the authoritative, unredacted, record of your WHOIS data. You can modify this information at any time in. To access it:
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account and domain.
+1. Select **Registrar**.
+1. Under **Manage** > **Default Contact**, select **Edit** to update your information.
+
+<Aside type="note">
+
+WHOIS redaction is not the same as WHOIS privacy. WHOIS privacy replaces your information with proxy contact information, while redaction removes it altogether.
+
+</Aside>
+
+Some registries do not allow domains to be registered with WHOIS Redaction or WHOIS Privacy. Many of these are country TLDs (ccTLDs), like `.uk.` Cloudflare does not yet support TLDs that prohibit WHOIS redaction, but will in the near future.
+
+## What is RDAP?
+
+RDAP (Registration Data Access Protocol) is a new standard for querying domain contact and nameserver information for all registered domains. This new protocol offers some advantages over WHOIS, including standardized data access, support for internationalization, and secure access controls. RDAP is intended to eventually replace WHOIS. However, Cloudflare currently provides both WHOIS and RDAP search capability.
+
+Cloudflare’s RDAP service can be found at https://rdap.cloudflare.com/. Select **RDAP** as the search type.
+
+## How can third parties reach registrants?
+
+As part of the ICANN guidelines, registrars must make available a method for third parties to reach the registrant without revealing the identity of that registrant. Cloudflare has made a [form available where third parties can submit a message for a given domain on Cloudflare Registrar](https://www.cloudflare.com/abuse/form). Cloudflare will forward the message to the registrant email on file for that domain.
\ No newline at end of file
diff --git a/products/rules/docs-config.js b/products/rules/docs-config.js
index 5cb0afc022b..d727165c7cd 100644
--- a/products/rules/docs-config.js
+++ b/products/rules/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Create rules that adjust incoming HTTP requests at the edge.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/rules",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/rules/src/content/index.md b/products/rules/src/content/index.md
index 55999586d7d..0cca82a645e 100644
--- a/products/rules/src/content/index.md
+++ b/products/rules/src/content/index.md
@@ -3,13 +3,13 @@ pcx-content-type: landing-page
 order: 1
 ---
 
-# Welcome
+# Overview
 
-With Rules you can manage the following types of rules:
+With Rules, you can manage the following types of rules:
 
-- **Page Rules** - Allow you to control which Cloudflare settings trigger on a given URL. Learn about Page Rules in the [Support KB](https://support.cloudflare.com/hc/articles/218411427).
+* **Page Rules** — Allow you to control which Cloudflare settings trigger on a given URL. Learn about Page Rules in the [Support KB](https://support.cloudflare.com/hc/articles/218411427).
 
-- [**Transform Rules**](/transform) - Allow you to make adjustments to incoming requests at the edge before they go through any other Cloudflare products.
+* [**Transform Rules**](/transform) — Allow you to adjust the URI path, query string, and HTTP headers of incoming requests at the edge.
 
 <Aside type='note' header='Note'>
 
diff --git a/products/rules/src/content/static/transform/created-gb-rule.png b/products/rules/src/content/static/transform/created-gb-rule.png
index 11829218e6e..716521ee2be 100644
Binary files a/products/rules/src/content/static/transform/created-gb-rule.png and b/products/rules/src/content/static/transform/created-gb-rule.png differ
diff --git a/products/rules/src/content/static/transform/overview.png b/products/rules/src/content/static/transform/overview.png
index 9eeeced1688..314af6e943d 100644
Binary files a/products/rules/src/content/static/transform/overview.png and b/products/rules/src/content/static/transform/overview.png differ
diff --git a/products/rules/src/content/static/transform/transform-rules-tab.png b/products/rules/src/content/static/transform/transform-rules-tab.png
index 73c2d658c41..792eaedfc61 100644
Binary files a/products/rules/src/content/static/transform/transform-rules-tab.png and b/products/rules/src/content/static/transform/transform-rules-tab.png differ
diff --git a/products/rules/src/content/transform/api/header-modification-rule.md b/products/rules/src/content/transform/api/header-modification-rule.md
deleted file mode 100644
index 3fca61d7d4d..00000000000
--- a/products/rules/src/content/transform/api/header-modification-rule.md
+++ /dev/null
@@ -1,348 +0,0 @@
----
-title: Create a Request Header Modification Rule
-pcx-content-type: interim
-order: 2
----
-
-# Create an HTTP Request Header Modification Rule via API
-
-<Aside type="note">
-
-This feature is available in Beta.
-
-</Aside>
-
-Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api) to create HTTP Request Header Modification Rules via API. Define the header modification configuration in the `action_parameters` field. See [Common use cases](/transform/use-cases#http-request-header-modification-examples) for example rule definitions.
-
-When creating an HTTP Request Header Modification Rule via API, make sure you:
-
-* Set the rule action to `rewrite`
-* Define the [header modification parameters](#header-modification-parameters) in the `action_parameters` field according to the operation to perform (set or remove header)
-* Deploy the rule to the `http_request_late_transform` phase at the zone level
-
-## Create an HTTP Request Header Modification Rule
-
-Follow this workflow to create an HTTP Request Header Modification Rule for a given zone via API:
-
-1. Use the [List existing rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/view#list-existing-rulesets) method to check if there is already a ruleset for the `http_request_late_transform` phase at the zone level.
-
-1. If the phase ruleset does not exist, create it using the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) method with the zone-level endpoint. In the new ruleset properties, set the following values:
-
-    * **kind**: `zone`
-    * **phase**: `http_request_late_transform`
-
-1. Use the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method to add an HTTP Request Header Modification Rule to the list of ruleset rules (check the examples below). Alternatively, include the rule in the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) request mentioned in the previous step.
-
-### Examples
-
-<details>
-<summary>Example: Add an HTTP request header with a static value</summary>
-<div>
-
-The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — adding an HTTP request header with a static value — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
-
-```json
----
-header: Request
----
-curl -X PUT \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
--d '{
-  "rules": [
-    {
-      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-      "description": "My first HTTP Request Header Modification Rule",
-      "action": "rewrite",
-      "action_parameters": {
-        "headers": {
-          "X-Source": {
-            "operation": "set",
-            "value": "Cloudflare"
-          }
-        }
-      }
-    }
-  ]
-}'
-```
-
-The response contains the complete definition of the ruleset you updated.
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level Late Transform Ruleset",
-    "description": "Zone-level ruleset that will execute Late Transform Rules.",
-    "kind": "zone",
-    "version": "2",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "rewrite",
-        "action_parameters": {
-          "headers": {
-            "X-Source": {
-              "operation": "set",
-              "value": "Cloudflare"
-            }
-          }
-        },
-        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-        "description": "My first HTTP Request Header Modification Rule",
-        "last_updated": "2021-04-14T14:42:04.219025Z",
-        "ref": "{rule-ref}"
-      }
-    ],
-    "last_updated": "2021-04-14T14:42:04.219025Z",
-    "phase": "http_request_late_transform"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
-<details>
-<summary>Example: Add an HTTP request header with a dynamic value</summary>
-<div>
-
-The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — adding an HTTP request header with a dynamic value — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
-
-```json
----
-header: Request
----
-curl -X PUT \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
--d '{
-  "rules": [
-    {
-      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-      "description": "My first HTTP Request Header Modification Rule",
-      "action": "rewrite",
-      "action_parameters": {
-        "headers": {
-          "X-Bot-Score": {
-            "operation": "set",
-            "expression": "to_string(cf.bot_management.score)"
-          }
-        }
-      }
-    }
-  ]
-}'
-```
-
-The response contains the complete definition of the ruleset you updated.
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level Late Transform Ruleset",
-    "description": "Zone-level ruleset that will execute Late Transform Rules.",
-    "kind": "zone",
-    "version": "2",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "rewrite",
-        "action_parameters": {
-          "headers": {
-            "X-Bot-Score": {
-              "operation": "set",
-              "expression": "to_string(cf.bot_management.score)"
-            }
-          }
-        },
-        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-        "description": "My first HTTP Request Header Modification Rule",
-        "last_updated": "2021-04-14T14:42:04.219025Z",
-        "ref": "{rule-ref}"
-      }
-    ],
-    "last_updated": "2021-04-14T14:42:04.219025Z",
-    "phase": "http_request_late_transform"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
-<details>
-<summary>Example: Remove an HTTP request header</summary>
-<div>
-
-The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — removing an HTTP request header — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
-
-```json
----
-header: Request
----
-curl -X PUT \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
--d '{
-  "rules": [
-    {
-      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-      "description": "My first HTTP Request Header Modification Rule",
-      "action": "rewrite",
-      "action_parameters": {
-        "headers": {
-          "cf-connecting-ip": {
-            "operation": "remove"
-          }
-        }
-      }
-    }
-  ]
-}'
-```
-
-The response contains the complete definition of the ruleset you updated.
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level Late Transform Ruleset",
-    "description": "Zone-level ruleset that will execute Late Transform Rules.",
-    "kind": "zone",
-    "version": "2",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "rewrite",
-        "action_parameters": {
-          "headers": {
-            "cf-connecting-ip": {
-              "operation": "remove"
-            }
-          }
-        },
-        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
-        "description": "My first HTTP Request Header Modification Rule",
-        "last_updated": "2021-04-14T14:42:04.219025Z",
-        "ref": "{rule-ref}"
-      }
-    ],
-    "last_updated": "2021-04-14T14:42:04.219025Z",
-    "phase": "http_request_late_transform"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
----
-
-## Header modification parameters
-
-To set an HTTP request header, set the following parameters in the `action_parameters` field:
-
-* **operation**: `set`
-* Include one of the following parameters to define a static or dynamic value:
-    * **value**: Specifies a static value for the HTTP request header.
-    * **expression**: Specifies the expression that defines a value for the HTTP request header.
-
-To remove an HTTP request header, set the following parameter in the `action_parameters` field:
-
-* **operation**: `remove`
-
-### Static header value parameters
-
-The full syntax of the `action_parameters` field to define a static HTTP request header value is the following:
-
-```json
-"action_parameters": {
-  "headers": {
-    "<HEADER_NAME>": {
-      "operation": "set",
-      "value": "<URI_PATH_VALUE>"
-    }
-  }
-}
-```
-
-### Dynamic header value parameters
-
-The full syntax of the `action_parameters` field to define a dynamic HTTP request header value using an expression is the following:
-
-```json
-"action_parameters": {
-  "headers": {
-    "<HEADER_NAME>": { 
-      "operation": "set",
-      "expression": "<EXPRESSION>"
-    }
-  }
-}
-```
-
-<Aside type='note'>
-
-Check the [available fields and functions](/transform/create-header-modification-rule#available-fields-and-functions-for-setting-http-request-header-values) you can use in an expression during Beta.
-
-</Aside>
-
-### Header removal parameters
-
-The full syntax of the `action_parameters` field to remove an HTTP request header is the following:
-
-```json
-"action_parameters": {
-  "headers": {
-    "<HEADER_NAME>": { 
-      "operation": "remove"
-    }
-  }
-}
-```
-
-### Different header modifications in the same rule
-
-The same rule can modify different HTTP request headers using different operations (set or remove a header). For example, a single rule can set the value of a header and remove a different header. The syntax of such a rule could be the following:
-
-```json
-"action_parameters": {
-  "headers": {
-    "<HEADER_NAME_1>": { 
-      "operation": "set",
-      "value": "<HEADER_VALUE_1>"
-    }, 
-    "<HEADER_NAME_2>": {
-      "operation": "remove"
-    }
-  }
-}
-```
diff --git a/products/rules/src/content/transform/api/index.md b/products/rules/src/content/transform/api/index.md
deleted file mode 100644
index 8689f006e35..00000000000
--- a/products/rules/src/content/transform/api/index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Create rules via API
-pcx-content-type: navigation
-order: 4
----
-
-# Create Transform Rules via API
-
-Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api) to create Transform Rules via API.
-
-* [Create a URL Rewrite Rule via API](/transform/api/url-rewrite-rule)
-* [Create an HTTP Request Header Modification Rule via API](/transform/api/header-modification-rule)
diff --git a/products/rules/src/content/transform/api/url-rewrite-rule.md b/products/rules/src/content/transform/api/url-rewrite-rule.md
deleted file mode 100644
index 8709e6fa446..00000000000
--- a/products/rules/src/content/transform/api/url-rewrite-rule.md
+++ /dev/null
@@ -1,244 +0,0 @@
----
-title: Create a URL Rewrite Rule
-pcx-content-type: interim
-order: 1
----
-
-# Create a URL Rewrite Rule via API
-
-Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api) to create URL Rewrite Rules via API. Define the rewrite configuration in the `action_parameters` field. See [Common use cases](/transform/use-cases) for example rule definitions.
-
-When creating a URL Rewrite Rule via API, make sure you:
-
-* Set the rule action to `rewrite`
-* Define the [URL rewrite parameters](#url-rewrite-parameters) in the `action_parameters` field according to the type of URL rewrite (static or dynamic)
-* Deploy the rule to the `http_request_transform` phase at the zone level
-
-## Create a URL Rewrite Rule
-
-Follow this workflow to create a URL Rewrite Rule for a given zone via API:
-
-1. Use the [List existing rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/view#list-existing-rulesets) method to check if there is already a ruleset for the `http_request_transform` phase at the zone level.
-
-1. If the phase ruleset does not exist, create it using the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) method with the zone-level endpoint. In the new ruleset properties, set the following values:
-
-    * **kind**: `zone`
-    * **phase**: `http_request_transform`
-
-1. Use the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method to add a URL Rewrite Rule to the list of ruleset rules (check the examples below). Alternatively, include the rule in the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) request mentioned in the previous step.
-
-### Examples
-
-<details>
-<summary>Example: Add a rule that performs a static URL rewrite</summary>
-<div>
-
-The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single URL Rewrite Rule — performing a static rewrite of the URI path — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
-
-```json
----
-header: Request
----
-curl -X PUT \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
--d '{
-  "rules": [
-    {
-      "expression": "(http.request.uri.query contains \"eu\")",
-      "description": "My first static URL Rewrite Rule",
-      "action": "rewrite",
-      "action_parameters": {
-        "uri": {
-          "path": {
-            "value": "/emea.html"
-          }
-        }
-      }
-    }
-  ]
-}'
-```
-
-The response contains the complete definition of the ruleset you updated.
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level Transform Ruleset",
-    "description": "Zone-level ruleset that will execute Transform Rules.",
-    "kind": "zone",
-    "version": "2",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "rewrite",
-        "action_parameters": {
-          "uri": {
-            "path": {
-              "value": "/emea.html"
-            }
-          }
-        },
-        "expression": "(http.request.uri.query contains \"eu\")",
-        "description": "My first static URL Rewrite Rule",
-        "last_updated": "2021-04-14T14:42:04.219025Z",
-        "ref": "{rule-ref}"
-      }
-    ],
-    "last_updated": "2021-04-14T14:42:04.219025Z",
-    "phase": "http_request_transform"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
-<details>
-<summary>Example: Add a rule that performs a dynamic URL rewrite</summary>
-<div>
-
-The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single URL Rewrite Rule — performing a dynamic rewrite of the URI path — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
-
-```json
----
-header: Request
----
-curl -X PUT \
--H "X-Auth-Email: user@cloudflare.com" \
--H "X-Auth-Key: REDACTED" \
-"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
--d '{
-  "rules": [
-    {
-      "expression": "starts_with(http.request.uri.path, \"/news/2012/\")",
-      "description": "My first dynamic URL Rewrite Rule",
-      "action": "rewrite",
-      "action_parameters": {
-        "uri": {
-          "path": {
-            "expression": "concat(\"/archive\", http.request.uri.path)"
-          }
-        }
-      }
-    }
-  ]
-}'
-```
-
-The response contains the complete definition of the ruleset you updated.
-
-```json
----
-header: Response
----
-{
-  "result": {
-    "id": "{ruleset-id}",
-    "name": "Zone-level Transform Ruleset",
-    "description": "Zone-level ruleset that will execute Transform Rules.",
-    "kind": "zone",
-    "version": "2",
-    "rules": [
-      {
-        "id": "{rule-id}",
-        "version": "1",
-        "action": "rewrite",
-        "action_parameters": {
-          "uri": {
-            "path": {
-              "expression": "concat(\"/archive\", http.request.uri.path)"
-            }
-          }
-        },
-        "expression": "starts_with(http.request.uri.path, \"/news/2012/\")",
-        "description": "My first dynamic URL Rewrite Rule",
-        "last_updated": "2021-04-14T14:42:04.219025Z",
-        "ref": "{rule-ref}"
-      }
-    ],
-    "last_updated": "2021-04-14T14:42:04.219025Z",
-    "phase": "http_request_transform"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-</div>
-</details>
-
----
-
-## URL rewrite parameters
-
-Create a [static or dynamic URL rewrite](/transform#url-rewrite-rules) based on the parameter name provided in the `action_parameters` field:
-
-* Define the `value` parameter to specify a static URL rewrite.
-* Define the `expression` parameter to specify the expression that defines the dynamic URL rewrite to perform.
-
-### Static URL rewrite parameters
-
-The full syntax of the `action_parameters` field for a static URL Rewrite Rule that rewrites both the URI path and the query string is the following:
-
-```json
-"action_parameters": {
-  "uri": {
-    "path": { 
-      "value": "<URI_PATH_VALUE>"
-    }, 
-    "query": {
-      "value": "<QUERY_STRING_VALUE>"
-    }
-  }
-}
-```
-
-If you are only rewriting the URI path or the query string, omit the `query` or `path` parameter, respectively.
-
-### Dynamic URL rewrite parameters
-
-The full syntax of the `action_parameters` field for a dynamic URL Rewrite Rule that rewrites both the URI path and the query string is the following:
-
-```json
-"action_parameters": {
-  "uri": {
-    "path": { 
-      "expression": "<URI_PATH_EXPRESSION>"
-    }, 
-    "query": {
-      "expression": "<QUERY_STRING_EXPRESSION>"
-    }
-  }
-}
-```
-
-If you are only rewriting the URI path or the query string, omit the `query` or `path` parameter, respectively.
-
-### Different URL rewrite types in the same rule
-
-The same rule can have different types of URL rewrites for the URI path and the query string. For example, a single rule can perform a **dynamic** URL rewrite of the URI path and a **static** URL rewrite of the query string. The syntax of such a rule would be the following:
-
-```json
-"action_parameters": {
-  "uri": {
-    "path": { 
-      "expression": "<URI_PATH_EXPRESSION>"
-    }, 
-    "query": {
-      "value": "<QUERY_STRING_VALUE>"
-    }
-  }
-}
-```
diff --git a/products/rules/src/content/transform/create-header-modification-rule.md b/products/rules/src/content/transform/create-header-modification-rule.md
deleted file mode 100644
index 5367c220c69..00000000000
--- a/products/rules/src/content/transform/create-header-modification-rule.md
+++ /dev/null
@@ -1,114 +0,0 @@
----
-title: Create a Request Header Modification Rule
-pcx-content-type: interim
-order: 2
----
-
-# Create an HTTP Request Header Modification Rule in the dashboard
-
-<Aside type="note">
-
-This feature is available in Beta.
-
-</Aside>
-
-Create HTTP Request Header Modification Rules in the **Transform Rules** tab under Rules. See [Common use cases](/transform/use-cases#http-request-header-modification-examples) for example rule definitions.
-
-Do the following:
-
-1. Log in to the Cloudflare dashboard.
-
-1. Select the **Websites** tab and choose the site for which you want to create a new HTTP Request Header Modification Rule.
-
-1. Select **Rules** > **Transform Rules**.
-
-    ![Transform Rules tab](../static/transform/overview.png)
-
-1. Click **Create transform rule** > **Modify Header**.
-
-    ![Create HTTP Header Modification rule page](../static/transform/create-header-modification-rule.png)
-
-1. In the page that displays, enter a descriptive name for the URL Rewrite Rule in **Rule name**.
-
-1. Under **When incoming requests match**, define the [rule expression](https://developers.cloudflare.com/firewall/cf-dashboard/create-edit-delete-rules#expression-builder-and-editor).
-
-    <Aside type='note'>
-
-    Check the [available fields and functions](#available-fields-and-functions-for-setting-http-request-header-values) during Beta.
-
-    </Aside>
-
-1. For **Modify header**, select one of the following options:
-
-    * _Set static_ — Sets the value of an HTTP request header to a static string value. Overrides the value of an existing header with the same name or adds a new header if it does not exist.
-    * _Set dynamic_ — Sets the value of an HTTP request header according to the provided expression. Overrides the value of an existing header with the same name or adds a new header if it does not exist.
-    * _Remove_ — Removes the HTTP request header with the provided name, if it exists.
-
-1. Enter the name of the HTTP request header to modify in **Header name** and the static value or expression in **Value**, if you are setting the header value.
-
-1. To modify another HTTP request header in the same rule, click **+ Set new header**.
-
-    The following example includes the modification of three headers using the available actions:
-
-    ![HTTP request header modification examples](../static/transform/header-modification-example.png)
-
-    <Aside type='note'>
-
-    You can modify up to 10 HTTP request headers in a single rule.
-
-    </Aside>
-
-1. To save and deploy your rule, click **Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
-
-After creating a rule, you return to the **Transform Rules** dashboard interface.
-
-If you choose to deploy your new HTTP Request Header Modification Rule, the toggle switch associated with the rule will be _On_. If you save the rule as a draft, the toggle will be _Off_.
-
----
-
-## Additional information on Request Header Modification Rules
-
-This section contains reference information on HTTP Request Header Modification Rules.
-
-### Format of HTTP request header names and values
-
-The name of the HTTP request header you want to set or remove can only contain alphanumeric characters (`a`-`z` and `A`-`Z`) and the following special characters: `-` and `_`.
-
-The value of the HTTP request header you want to set can only contain alphanumeric characters and the following special characters: `_ :;.,\/"'?!(){}[]@<>=-`.
-
-### Available fields and functions for setting HTTP request header values
-
-During the Beta, the available fields when setting an HTTP request header value using an expression are the following:
-
-* `cf.bot_detection.js_check_score`
-* `cf.bot_management.*`
-* `cf.client.bot`
-* `cf.client_trust_score`
-* `cf.threat_score`
-* `cf.colo.id`
-* `cf.edge.server_port`
-* `cf.zone.name`
-* `cf.metal.id`
-* `cf.tls_client_auth.*`
-* `http.cookie`
-* `http.host`
-* `http.referer`
-* `http.request.headers`
-* `http.request.method`
-* `http.request.timestamp.sec`
-* `http.request.timestamp.msec`
-* `http.request.full_uri`
-* `http.request.uri`
-* `http.request.uri.*`
-* `http.request.version`
-* `raw.http.request.full_uri`
-* `raw.http.request.uri`
-* `http.user_agent`
-* `http.x_forwarded_for`
-* `ip.src`
-* `ip.geoip.*`
-* `ssl`
-
-Use the `to_string()` function to get the string representation of a non-string value like an Integer value. For example, `to_string(cf.bot_management.score)`.
-
-For more information on the available functions, check [Functions](https://developers.cloudflare.com/firewall/cf-firewall-language/functions) in the Firewall documentation.
diff --git a/products/rules/src/content/transform/create-url-rewrite-rule.md b/products/rules/src/content/transform/create-url-rewrite-rule.md
deleted file mode 100644
index 216721a03d2..00000000000
--- a/products/rules/src/content/transform/create-url-rewrite-rule.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Create a URL Rewrite Rule
-pcx-content-type: how-to
-order: 1
----
-
-# Create a URL Rewrite Rule in the dashboard
-
-Create URL Rewrite Rules in the **Transform Rules** tab under Rules. See [Common use cases](/transform/use-cases#url-rewrite-examples) for example rule definitions.
-
-Do the following:
-
-1. Log in to the Cloudflare dashboard.
-
-1. Select the **Websites** tab and choose the site for which you want to create a new URL Rewrite Rule.
-
-1. Select **Rules** > **Transform Rules**.
-
-    ![Transform Rules tab](../static/transform/overview.png)
-
-1. Click **Create transform rule** > **Rewrite URL**.
-
-    ![Create Transform Rule page](../static/transform/create-url-rewrite-rule.png)
-
-1. In the page that displays, enter a descriptive name for the rule in **Rule name**. The rule name in this example is _Welcome GB Users_.
-
-1. Under **When incoming requests match**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value**.
-
-    ![Selecting a field in the Expression Builder](../static/transform/expression-field.png)
-
-1. Select a comparison operator in the **Operator** drop-down list.
-
-    ![Selecting an operator in the Expression Builder](../static/transform/expression-operator.png)
-
-    The **Expression Editor** area displays a text-only version of your expression. For more information on the Expression Editor, see [Edit rule expressions](https://developers.cloudflare.com/firewall/cf-dashboard/expression-preview-editor) in the Firewall documentation.
-
-1. Specify the value to match. If the value is an enumeration, the **Value** control will be a drop-down list. Otherwise, it will be a text input. In this example the value _United Kingdom_ is set using the **Country** drop-down list.
-
-    ![Entering a field value in the Expression Builder](../static/transform/expression-value.png)
-
-1. Add any other filters to the rule expression. The example defines an additional filter for the _URI Path_, which must be equal to `/welcome.html`.
-
-1. To define the action for your URL Rewrite Rule, select one of the available options displayed as radio buttons and then a value from the drop-down list, depending on the action.
-
-    In this example, the _Static_ action tells Cloudflare to rewrite the original path to the provided path, `/welcome-gb.html`.
-
-    ![Static path rewrite for GB users](../static/transform/rewrite-path-static-gb.png)
-
-    If you do not want to change the value of a component of the original request (for example, the URL query string), choose _Preserve_ as the action for that component.
-
-1. To save and deploy your rule, click **Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
-
-After you choose an option, you return to the **Transform Rules** dashboard interface, which displays your new rule:
-
-![Rules List displaying the new GB rule](../static/transform/created-gb-rule.png)
-
-If you choose to deploy your new URL Rewrite Rule, the toggle switch associated with the rule will be _On_. If you save the rule as a draft, the toggle will be _Off_.
diff --git a/products/rules/src/content/transform/index.md b/products/rules/src/content/transform/index.md
index 266615cdaa2..6459c8d2eb6 100644
--- a/products/rules/src/content/transform/index.md
+++ b/products/rules/src/content/transform/index.md
@@ -6,78 +6,34 @@ order: 2
 
 # About Transform Rules
 
-Transform Rules allow you to make adjustments to incoming requests at the edge before they go through any other Cloudflare products.
+Transform Rules allow you to adjust the URI path, query string, and HTTP headers of incoming requests at the edge.
 
 There are two types of Transform Rules:
 
 * URL Rewrite Rules:
+
     * Rewrite the **path** of the URL of an HTTP request
     * Rewrite the **query string** of the URL of an HTTP request
+
 * HTTP Request Header Modification Rules:
+
     * Set the value of an **HTTP request header**
     * Remove an **HTTP request header**
 
 To configure Transform Rules in the dashboard, use the **Transform Rules** tab in Rules.
 
 <ButtonGroup>
-  <Button type="primary" href="/transform/create-url-rewrite-rule">Create a URL Rewrite Rule</Button>
-  <Button type="primary" href="/transform/create-header-modification-rule">Create a Header Modification Rule</Button>
-  <Button type="secondary" href="/transform/use-cases">Examples</Button>
+  <Button type="primary" href="/transform/url-rewrite/create-dashboard">Create a URL Rewrite Rule</Button>
+  <Button type="primary" href="/transform/request-header-modification/create-dashboard">Create a Request Header Modification Rule</Button>
 </ButtonGroup>
 
 ---
 
-## URL Rewrite Rules
-
-A URL Rewrite Rule can perform a **static rewrite** or a **dynamic rewrite**. Static rewrites replace a given part of a request URL (path or query string) with a static string. Dynamic rewrites support more advanced scenarios where you use an [expression](https://developers.cloudflare.com/firewall/cf-firewall-rules/fields-and-expressions) to define the resulting path or query string.
-
-To create a URL Rewrite Rule in the dashboard, see [Create a URL Rewrite Rule in the dashboard](/transform/create-url-rewrite-rule).
-
-To create a URL Rewrite Rule via API, see [Create a URL Rewrite Rule via API](/transform/api/url-rewrite-rule).
-
-### Rewrites and redirects 
-
-You can manipulate the URL of a request through different operations, namely through rewrites and redirects. 
-
-A **rewrite** is a server-side operation that occurs before a web server has fully processed a request. A rewrite is not visible to website visitors, since the URL displayed in the browser does not change. 
-
-A **redirect** is a client-side operation that occurs after the web server has loaded the initial URL. In this case, a website visitor can see the URL changing when the redirect occurs.
-
-You can configure URL Rewrite Rules in the dashboard to perform rewrites at the edge without reaching your web server. URL Rewrite Rules run in the `http_request_transform` phase of Cloudflare's request handling workflow. For more information on phases, check the [Ruleset Engine](https://developers.cloudflare.com/firewall/cf-rulesets) documentation.
-
-Check [Configuring URL forwarding or redirects with Cloudflare Page Rules](https://support.cloudflare.com/hc/articles/200172286) in the Support KB to learn more about configuring redirects.
-
----
-
-## HTTP Request Header Modification Rules
+## Transform Rules evaluation
 
-<Aside type="note">
+Transform Rules run in order. Rules that appear later in the list of Transform Rules can overwrite changes done by previous rules. You can define the rule order in the dashboard or via API.
 
-This feature is available in Beta.
-
-</Aside>
-
-You can manipulate the headers of incoming HTTP requests through HTTP Request Header Modification Rules. Through these rules you can:
-
-* Set the value of an HTTP request header to a literal string value, overwriting its previous value or adding a new header to the request.
-* Set the value of an HTTP request header according to an expression, overwriting its previous value or adding a new header to the request.
-* Remove an HTTP request header from the request (remove all headers with the provided name).
-
-<Aside type='warning' label='Limitations'>
-
-* You cannot modify or remove HTTP request headers whose name starts with `cf-` or `x-cf-` except for the `cf-connecting-ip` HTTP request header, which you can remove.
-
-* During Beta, you can only set the value of an HTTP request header using string values. You cannot use integer, IP, or boolean values such as `cf.bot_management.score`, `ip.src`, or `cf.bot_management.verified_bot`.
-
-</Aside>
-
-HTTP Request Header Modification Rules run in the `http_request_late_transform` phase of Cloudflare's request handling workflow. For more information on phases, see [Phases](https://developers.cloudflare.com/firewall/cf-rulesets#phases) in the Ruleset Engine documentation.
-
-To create an HTTP Request Header Modification Rule in the dashboard, see [Create an HTTP Request Header Modification Rule in the dashboard](/transform/create-header-modification-rule).
-
-To create an HTTP Request Header Modification Rule via API, see [Create an HTTP Request Header Modification Rule via API](/transform/api/header-modification-rule).
-
----
+All request fields are immutable while evaluating Transform Rules for a request. For example, if a URL Rewrite Rule #1 updates the URI path or the query string, URL Rewrite Rule #2 will not take these previous changes into consideration.
 
 ## Availability
 
@@ -89,31 +45,25 @@ This table outlines the Transform Rules features available with each customer pl
 
 Feature                                       | Free | Pro | Business | Enterprise
 ----------------------------------------------|------|-----|----------|-----------
-Active URL Rewrite Rules                      | 2    | 5   | 10       | 20
-Active HTTP Request Header Modification Rules | 2    | 5   | 10       | 20
+Active Transform Rules                        | 2    | 5   | 10       | 20
 Regular expression support                    | No   | No  | Yes      | Yes
 
 </TableWrap>
 
 A Cloudflare user must have the [Firewall role](https://support.cloudflare.com/hc/articles/205065067#12345682) or one of the Administrator roles to access Transform Rules.
 
-<Aside type='note' label='Note'>
-
-During Beta, each plan has separate quotas for URL Rewrite Rules and HTTP Request Header Modification Rules. After Beta, these quotas will be unified in a single Transform Rules quota per plan.
-
-</Aside>
-
 ---
 
 ## Get started
 
 To get started building your own Transform Rules, see:
 
-* [Create a URL Rewrite Rule](/transform/create-url-rewrite-rule)
-* [Create an HTTP Request Header Modification Rule](/transform/create-header-modification-rule)
+* [Create a URL Rewrite Rule in the dashboard](/transform/url-rewrite/create-dashboard)
+* [Create an HTTP Request Header Modification Rule in the dashboard](/transform/request-header-modification/create-dashboard)
 
-You can also [create Transform Rules via API](/transform/api).
+You can also create Transform Rules via API:
 
-For common Transform Rule scenarios, see [Common use cases](/transform/use-cases).
+* [Create a URL Rewrite Rule via API](/transform/url-rewrite/create-api)
+* [Create an HTTP Request Header Modification Rule via API](/transform/request-header-modification/create-api)
 
 Check [Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language) for more information on building expressions for Transform Rules, since the language is the same as the Firewall Rules language.
diff --git a/products/rules/src/content/transform/manage.md b/products/rules/src/content/transform/manage.md
index b8759d06194..c3fa0e34e0c 100644
--- a/products/rules/src/content/transform/manage.md
+++ b/products/rules/src/content/transform/manage.md
@@ -22,14 +22,14 @@ The **Transform Rules** dashboard interface lets you:
 
 In the **Transform Rules** tab you can:
 
-* [Create a URL Rewrite Rule](/transform/create-url-rewrite-rule)
-* [Create an HTTP Request Header Modification Rule](/transform/create-header-modification-rule)
+* [Create a URL Rewrite Rule](/transform/url-rewrite/create-dashboard)
+* [Create an HTTP Request Header Modification Rule](/transform/request-header-modification/create-dashboard)
 
 See each linked section for details on creating each rule type.
 
 ## Manage rules
 
-You can manage your existing Transform Rules at any time using the buttons located on the right of the rule you want to change, or by using the handle located on the left of the rule. 
+You can manage your existing Transform Rules at any time using the buttons located on the right of the rule you want to change, or by using the handle located on the left of the rule.
 
 ![Available rule operations in the Rules List](../static/transform/rule-operations.png)
 
diff --git a/products/rules/src/content/transform/request-header-modification/create-api.md b/products/rules/src/content/transform/request-header-modification/create-api.md
new file mode 100644
index 00000000000..4bd4ead55f6
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/create-api.md
@@ -0,0 +1,260 @@
+---
+title: Create a rule via API
+pcx-content-type: how-to
+type: overview
+order: 2
+---
+
+# Create an HTTP Request Header Modification Rule via API
+
+Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api) to create HTTP Request Header Modification Rules via API. Define the header modification configuration in the `action_parameters` field. See [Request header modification examples](/transform/request-header-modification/examples) for examples of rule definitions.
+
+When creating an HTTP Request Header Modification Rule via API, make sure you:
+
+* Set the rule action to `rewrite`
+* Define the [header modification parameters](/transform/request-header-modification/reference/parameters) in the `action_parameters` field according to the operation to perform (set or remove header)
+* Deploy the rule to the `http_request_late_transform` phase at the zone level
+
+---
+
+Follow this workflow to create an HTTP Request Header Modification Rule for a given zone via API:
+
+1. Use the [List existing rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/view#list-existing-rulesets) method to check if there is already a ruleset for the `http_request_late_transform` phase at the zone level.
+
+1. If the phase ruleset does not exist, create it using the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) method with the zone-level endpoint. In the new ruleset properties, set the following values:
+
+    * **kind**: `zone`
+    * **phase**: `http_request_late_transform`
+
+1. Use the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method to add an HTTP Request Header Modification Rule to the list of ruleset rules (check the examples below). Alternatively, include the rule in the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) request mentioned in the previous step.
+
+### Examples
+
+<details>
+<summary>Example: Add an HTTP request header with a static value</summary>
+<div>
+
+The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — adding an HTTP request header with a static value — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
+-d '{
+  "rules": [
+    {
+      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+      "description": "My first HTTP Request Header Modification Rule",
+      "action": "rewrite",
+      "action_parameters": {
+        "headers": {
+          "X-Source": {
+            "operation": "set",
+            "value": "Cloudflare"
+          }
+        }
+      }
+    }
+  ]
+}'
+```
+
+The response contains the complete definition of the ruleset you updated.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level Late Transform Ruleset",
+    "description": "Zone-level ruleset that will execute Late Transform Rules.",
+    "kind": "zone",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "action": "rewrite",
+        "action_parameters": {
+          "headers": {
+            "X-Source": {
+              "operation": "set",
+              "value": "Cloudflare"
+            }
+          }
+        },
+        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+        "description": "My first HTTP Request Header Modification Rule",
+        "last_updated": "2021-04-14T14:42:04.219025Z",
+        "ref": "{rule-ref}"
+      }
+    ],
+    "last_updated": "2021-04-14T14:42:04.219025Z",
+    "phase": "http_request_late_transform"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example: Add an HTTP request header with a dynamic value</summary>
+<div>
+
+The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — adding an HTTP request header with a dynamic value — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
+-d '{
+  "rules": [
+    {
+      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+      "description": "My first HTTP Request Header Modification Rule",
+      "action": "rewrite",
+      "action_parameters": {
+        "headers": {
+          "X-Bot-Score": {
+            "operation": "set",
+            "expression": "to_string(cf.bot_management.score)"
+          }
+        }
+      }
+    }
+  ]
+}'
+```
+
+The response contains the complete definition of the ruleset you updated.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level Late Transform Ruleset",
+    "description": "Zone-level ruleset that will execute Late Transform Rules.",
+    "kind": "zone",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "action": "rewrite",
+        "action_parameters": {
+          "headers": {
+            "X-Bot-Score": {
+              "operation": "set",
+              "expression": "to_string(cf.bot_management.score)"
+            }
+          }
+        },
+        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+        "description": "My first HTTP Request Header Modification Rule",
+        "last_updated": "2021-04-14T14:42:04.219025Z",
+        "ref": "{rule-ref}"
+      }
+    ],
+    "last_updated": "2021-04-14T14:42:04.219025Z",
+    "phase": "http_request_late_transform"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example: Remove an HTTP request header</summary>
+<div>
+
+The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single HTTP Request Header Modification Rule — removing an HTTP request header — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
+-d '{
+  "rules": [
+    {
+      "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+      "description": "My first HTTP Request Header Modification Rule",
+      "action": "rewrite",
+      "action_parameters": {
+        "headers": {
+          "cf-connecting-ip": {
+            "operation": "remove"
+          }
+        }
+      }
+    }
+  ]
+}'
+```
+
+The response contains the complete definition of the ruleset you updated.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level Late Transform Ruleset",
+    "description": "Zone-level ruleset that will execute Late Transform Rules.",
+    "kind": "zone",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "action": "rewrite",
+        "action_parameters": {
+          "headers": {
+            "cf-connecting-ip": {
+              "operation": "remove"
+            }
+          }
+        },
+        "expression": "(starts_with(http.request.uri.path, \"/en/\"))",
+        "description": "My first HTTP Request Header Modification Rule",
+        "last_updated": "2021-04-14T14:42:04.219025Z",
+        "ref": "{rule-ref}"
+      }
+    ],
+    "last_updated": "2021-04-14T14:42:04.219025Z",
+    "phase": "http_request_late_transform"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
diff --git a/products/rules/src/content/transform/request-header-modification/create-dashboard.md b/products/rules/src/content/transform/request-header-modification/create-dashboard.md
new file mode 100644
index 00000000000..640eefddf3a
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/create-dashboard.md
@@ -0,0 +1,59 @@
+---
+title: Create a rule in the dashboard
+pcx-content-type: how-to
+order: 1
+---
+
+# Create an HTTP Request Header Modification Rule in the dashboard
+
+Create HTTP Request Header Modification Rules in the **Transform Rules** tab under Rules. See [Request header modification examples](/transform/request-header-modification/examples) for examples of rule definitions.
+
+Do the following:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the **Websites** tab and choose the site for which you want to create a new HTTP Request Header Modification Rule.
+
+1. Select **Rules** > **Transform Rules**.
+
+    ![Transform Rules tab](../../static/transform/overview.png)
+
+1. Click **Create transform rule** > **Modify Header**.
+
+    ![Create HTTP Header Modification rule page](../../static/transform/create-header-modification-rule.png)
+
+1. Enter a descriptive name for the URL Rewrite Rule in **Rule name**.
+
+1. Under **When incoming requests match**, define the [rule expression](https://developers.cloudflare.com/firewall/cf-dashboard/create-edit-delete-rules#expression-builder-and-editor).
+
+    <Aside type='note'>
+
+    Check the [available fields and functions](/transform/request-header-modification/reference/fields-functions).
+
+    </Aside>
+
+1. For **Modify header**, select one of the following options:
+
+    * _Set static_ — Sets the value of an HTTP request header to a static string value. Overrides the value of an existing header with the same name or adds a new header if it does not exist.
+    * _Set dynamic_ — Sets the value of an HTTP request header according to the provided expression. Overrides the value of an existing header with the same name or adds a new header if it does not exist.
+    * _Remove_ — Removes the HTTP request header with the provided name, if it exists.
+
+1. Enter the name of the HTTP request header to modify in **Header name** and the static value or expression in **Value**, if you are setting the header value.
+
+1. To modify another HTTP request header in the same rule, click **+ Set new header**.
+
+    The following example includes the modification of three headers using the available actions:
+
+    ![HTTP request header modification examples](../../static/transform/header-modification-example.png)
+
+    <Aside type='note'>
+
+    You can modify up to 10 HTTP request headers in a single rule.
+
+    </Aside>
+
+1. To save and deploy your rule, click **Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
+
+After creating a rule, you return to the **Transform Rules** dashboard interface.
+
+If you choose to deploy your HTTP Request Header Modification Rule, the new rule will be enabled. If you save the rule as a draft, the new rule will be disabled.
diff --git a/products/rules/src/content/transform/request-header-modification/examples.md b/products/rules/src/content/transform/request-header-modification/examples.md
new file mode 100644
index 00000000000..60f12ac9dec
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/examples.md
@@ -0,0 +1,70 @@
+---
+pcx-content-type: configuration
+order: 4
+---
+
+# Request header modification examples
+
+The following examples illustrate how to perform header modifications with Transform Rules:
+
+* [Add an HTTP request header with a static value](#add-an-http-request-header-with-a-static-value)
+* [Add an HTTP request header with the current bot score](#add-an-http-request-header-with-the-current-bot-score)
+* [Remove an HTTP request header](#remove-an-http-request-header)
+
+## Add an HTTP request header with a static value
+
+The following HTTP Request Header Modification Rule adds a header named `X-Source` with a static value (`Cloudflare`) to the request:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+starts_with(http.request.uri.path, "/en/")
+```
+
+Selected operation under **Modify header**: _Set static_
+
+**Header name**: `X-Source`
+
+**Value**: `Cloudflare`
+
+</Example>
+
+## Add an HTTP request header with the current bot score
+
+The following HTTP Request Header Modification Rule adds a header named `X-Bot-Score` with the current bot score to the request:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+starts_with(http.request.uri.path, "/en/")
+```
+
+Selected operation under **Modify header**: _Set dynamic_
+
+**Header name**: `X-Bot-Score`
+
+**Value**: `to_string(cf.bot_management.score)`
+
+</Example>
+
+## Remove an HTTP request header
+
+The following HTTP Request Header Modification Rule removes the `cf-connecting-ip` header from the request:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+starts_with(http.request.uri.path, "/private/")
+```
+
+Selected operation under **Modify header**: _Remove_
+
+**Header name**: `cf-connecting-ip`
+
+</Example>
diff --git a/products/rules/src/content/transform/request-header-modification/index.md b/products/rules/src/content/transform/request-header-modification/index.md
new file mode 100644
index 00000000000..81df3d5ed03
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/index.md
@@ -0,0 +1,27 @@
+---
+title: Request Header Modification Rules
+pcx-content-type: concept
+order: 1
+---
+
+# HTTP Request Header Modification Rules
+
+You can manipulate the headers of incoming HTTP requests through HTTP Request Header Modification Rules. Through these rules you can:
+
+* Set the value of an HTTP request header to a literal string value, overwriting its previous value or adding a new header to the request.
+* Set the value of an HTTP request header according to an expression, overwriting its previous value or adding a new header to the request.
+* Remove an HTTP request header from the request (remove all headers with the provided name).
+
+<Aside type='warning' header='Important'>
+
+* You cannot modify or remove HTTP request headers whose name starts with `cf-` or `x-cf-` except for the `cf-connecting-ip` HTTP request header, which you can remove.
+
+* If you modify the value of an existing HTTP request header using an expression that evaluates to an empty string (`""`) or an undefined value, the HTTP request header is **removed**.
+
+* Currently, there is a limited number of HTTP request headers that you cannot modify. Cloudflare may remove restrictions for some of these HTTP request headers when presented with valid use cases. [Create a post in the community](https://community.cloudflare.com) for consideration.
+
+</Aside>
+
+To create an HTTP Request Header Modification Rule in the dashboard, see [Create an HTTP Request Header Modification Rule in the dashboard](/transform/request-header-modification/create-dashboard).
+
+To create an HTTP Request Header Modification Rule via API, see [Create an HTTP Request Header Modification Rule via API](/transform/request-header-modification/create-api).
diff --git a/products/rules/src/content/transform/request-header-modification/reference/fields-functions.md b/products/rules/src/content/transform/request-header-modification/reference/fields-functions.md
new file mode 100644
index 00000000000..e97ebcee7d9
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/reference/fields-functions.md
@@ -0,0 +1,54 @@
+---
+title: Available fields and functions
+pcx-content-type: reference
+order: 2
+---
+
+# Available fields and functions for HTTP request header modification
+
+The available fields when setting an HTTP request header value using an expression are the following:
+
+* `cf.bot_detection.js_check_score`
+* `cf.bot_management.*`
+* `cf.client.bot`
+* `cf.client_trust_score`
+* `cf.threat_score`
+* `cf.colo.id`
+* `cf.edge.server_ip`
+* `cf.edge.server_port`
+* `cf.edge.client_port`
+* `cf.zone.name`
+* `cf.metal.id`
+* `cf.tls_client_auth.*`
+* `http.cookie`
+* `http.host`
+* `http.referer`
+* `http.request.headers`
+* `http.request.method`
+* `http.request.timestamp.sec`
+* `http.request.timestamp.msec`
+* `http.request.full_uri`
+* `http.request.uri`
+* `http.request.uri.*`
+* `http.request.version`
+* `raw.http.request.full_uri`
+* `raw.http.request.uri`
+* `http.user_agent`
+* `http.x_forwarded_for`
+* `ip.src`
+* `ip.geoip.*`
+* `ssl`
+
+Use the `to_string()` function to get the string representation of a non-string value like an Integer value. For example, `to_string(cf.bot_management.score)`.
+
+See [Fields](https://developers.cloudflare.com/firewall/cf-firewall-language/fields) for reference information on these fields.
+
+<Aside type="warning" header="Important">
+
+To obtain the value of an HTTP request header using the [`http.request.headers`](https://developers.cloudflare.com/firewall/cf-firewall-language/fields#field-http-request-headers) field, specify the header name in **lowercase**.
+
+For example, to get the first value of the `Accept-Encoding` request header in an expression, use: `http.request.headers["accept-encoding"][0]`.
+
+</Aside>
+
+For information on the available functions, see [Functions](https://developers.cloudflare.com/firewall/cf-firewall-language/functions).
diff --git a/products/rules/src/content/transform/request-header-modification/reference/header-format.md b/products/rules/src/content/transform/request-header-modification/reference/header-format.md
new file mode 100644
index 00000000000..45c8a4b9b4d
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/reference/header-format.md
@@ -0,0 +1,17 @@
+---
+title: Format of header names and values
+pcx-content-type: reference
+order: 1
+---
+
+# Format of HTTP request header names and values
+
+The **name** of the HTTP request header you want to set or remove can only contain:
+
+* Alphanumeric characters: `a`-`z` and `A`-`Z`
+* The following special characters: `-` and `_`
+
+The **value** of the HTTP request header you want to set can only contain:
+
+* Alphanumeric characters: `a`-`z` and `A`-`Z`
+* The following special characters: ``_ :;.,\/"'?!(){}[]@<>=-+*#$&`|~^%``
diff --git a/products/rules/src/content/transform/request-header-modification/reference/index.md b/products/rules/src/content/transform/request-header-modification/reference/index.md
new file mode 100644
index 00000000000..8dd5a453cf7
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/reference/index.md
@@ -0,0 +1,11 @@
+---
+title: Reference
+pcx-content-type: navigation
+order: 5
+---
+
+# Request Header Modification Rules Reference
+
+This section contains reference information on HTTP Request Header Modification Rules.
+
+<DirectoryListing path="/transform/request-header-modification/reference"/>
diff --git a/products/rules/src/content/transform/request-header-modification/reference/parameters.md b/products/rules/src/content/transform/request-header-modification/reference/parameters.md
new file mode 100644
index 00000000000..fadead55187
--- /dev/null
+++ b/products/rules/src/content/transform/request-header-modification/reference/parameters.md
@@ -0,0 +1,87 @@
+---
+title: API parameter reference
+pcx-content-type: reference
+order: 3
+---
+
+# Request header modification API parameter reference
+
+To set an HTTP request header, set the following parameters in the `action_parameters` field:
+
+* **operation**: `set`
+* Include one of the following parameters to define a static or dynamic value:
+
+    * **value**: Specifies a static value for the HTTP request header.
+    * **expression**: Specifies the expression that defines a value for the HTTP request header.
+
+To remove an HTTP request header, set the following parameter in the `action_parameters` field:
+
+* **operation**: `remove`
+
+## Static header value parameters
+
+The full syntax of the `action_parameters` field to define a static HTTP request header value is the following:
+
+```json
+"action_parameters": {
+  "headers": {
+    "<HEADER_NAME>": {
+      "operation": "set",
+      "value": "<URI_PATH_VALUE>"
+    }
+  }
+}
+```
+
+## Dynamic header value parameters
+
+The full syntax of the `action_parameters` field to define a dynamic HTTP request header value using an expression is the following:
+
+```json
+"action_parameters": {
+  "headers": {
+    "<HEADER_NAME>": { 
+      "operation": "set",
+      "expression": "<EXPRESSION>"
+    }
+  }
+}
+```
+
+<Aside type='note'>
+
+Check the [available fields and functions](/transform/request-header-modification/reference/fields-functions) you can use in an expression.
+
+</Aside>
+
+## Header removal parameters
+
+The full syntax of the `action_parameters` field to remove an HTTP request header is the following:
+
+```json
+"action_parameters": {
+  "headers": {
+    "<HEADER_NAME>": { 
+      "operation": "remove"
+    }
+  }
+}
+```
+
+## Different header modifications in the same rule
+
+The same rule can modify different HTTP request headers using different operations (set or remove a header). For example, a single rule can set the value of a header and remove a different header. The syntax of such a rule could be the following:
+
+```json
+"action_parameters": {
+  "headers": {
+    "<HEADER_NAME_1>": { 
+      "operation": "set",
+      "value": "<HEADER_VALUE_1>"
+    }, 
+    "<HEADER_NAME_2>": {
+      "operation": "remove"
+    }
+  }
+}
+```
diff --git a/products/rules/src/content/transform/troubleshooting.md b/products/rules/src/content/transform/troubleshooting.md
new file mode 100644
index 00000000000..bd52494fdd9
--- /dev/null
+++ b/products/rules/src/content/transform/troubleshooting.md
@@ -0,0 +1,11 @@
+---
+title: Troubleshooting
+pcx-content-type: faq
+order: 6
+---
+
+# Troubleshoot Transform Rules
+
+After configuring a URL Rewrite Rule or an HTTP Request Header Modification Rule, you may get runtime errors related to the rule configuration.
+
+For more information on these errors, see [Troubleshooting Cloudflare 1XXX errors](https://support.cloudflare.com/hc/articles/360029779472).
\ No newline at end of file
diff --git a/products/rules/src/content/transform/url-rewrite/create-api.md b/products/rules/src/content/transform/url-rewrite/create-api.md
new file mode 100644
index 00000000000..384ffeedf7c
--- /dev/null
+++ b/products/rules/src/content/transform/url-rewrite/create-api.md
@@ -0,0 +1,181 @@
+---
+title: Create a rule via API
+pcx-content-type: how-to
+type: overview
+order: 2
+---
+
+# Create a URL Rewrite Rule via API
+
+Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api) to create URL Rewrite Rules via API. Define the rewrite configuration in the `action_parameters` field. See [URL rewrite examples](/transform/url-rewrite/examples) for examples of rule definitions.
+
+When creating a URL Rewrite Rule via API, make sure you:
+
+* Set the rule action to `rewrite`
+* Define the [URL rewrite parameters](/transform/url-rewrite/parameters) in the `action_parameters` field according to the type of URL rewrite (static or dynamic)
+* Deploy the rule to the `http_request_transform` phase at the zone level
+
+---
+
+Follow this workflow to create a URL Rewrite Rule for a given zone via API:
+
+1. Use the [List existing rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/view#list-existing-rulesets) method to check if there is already a ruleset for the `http_request_transform` phase at the zone level.
+
+1. If the phase ruleset does not exist, create it using the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) method with the zone-level endpoint. In the new ruleset properties, set the following values:
+
+    * **kind**: `zone`
+    * **phase**: `http_request_transform`
+
+1. Use the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method to add a URL Rewrite Rule to the list of ruleset rules (check the examples below). Alternatively, include the rule in the [Create ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/create) request mentioned in the previous step.
+
+### Examples
+
+<details>
+<summary>Example: Add a rule that performs a static URL rewrite</summary>
+<div>
+
+The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single URL Rewrite Rule — performing a static rewrite of the URI path — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
+-d '{
+  "rules": [
+    {
+      "expression": "(http.request.uri.query contains \"eu\")",
+      "description": "My first static URL Rewrite Rule",
+      "action": "rewrite",
+      "action_parameters": {
+        "uri": {
+          "path": {
+            "value": "/emea.html"
+          }
+        }
+      }
+    }
+  ]
+}'
+```
+
+The response contains the complete definition of the ruleset you updated.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level Transform Ruleset",
+    "description": "Zone-level ruleset that will execute Transform Rules.",
+    "kind": "zone",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "action": "rewrite",
+        "action_parameters": {
+          "uri": {
+            "path": {
+              "value": "/emea.html"
+            }
+          }
+        },
+        "expression": "(http.request.uri.query contains \"eu\")",
+        "description": "My first static URL Rewrite Rule",
+        "last_updated": "2021-04-14T14:42:04.219025Z",
+        "ref": "{rule-ref}"
+      }
+    ],
+    "last_updated": "2021-04-14T14:42:04.219025Z",
+    "phase": "http_request_transform"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
+
+<details>
+<summary>Example: Add a rule that performs a dynamic URL rewrite</summary>
+<div>
+
+The following example sets the rules of an existing phase ruleset (`{ruleset-id}`) to a single URL Rewrite Rule — performing a dynamic rewrite of the URI path — using the [Update ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update) method:
+
+```json
+---
+header: Request
+---
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zones/{zone-id}/rulesets/{ruleset-id}" \
+-d '{
+  "rules": [
+    {
+      "expression": "starts_with(http.request.uri.path, \"/news/2012/\")",
+      "description": "My first dynamic URL Rewrite Rule",
+      "action": "rewrite",
+      "action_parameters": {
+        "uri": {
+          "path": {
+            "expression": "concat(\"/archive\", http.request.uri.path)"
+          }
+        }
+      }
+    }
+  ]
+}'
+```
+
+The response contains the complete definition of the ruleset you updated.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{ruleset-id}",
+    "name": "Zone-level Transform Ruleset",
+    "description": "Zone-level ruleset that will execute Transform Rules.",
+    "kind": "zone",
+    "version": "2",
+    "rules": [
+      {
+        "id": "{rule-id}",
+        "version": "1",
+        "action": "rewrite",
+        "action_parameters": {
+          "uri": {
+            "path": {
+              "expression": "concat(\"/archive\", http.request.uri.path)"
+            }
+          }
+        },
+        "expression": "starts_with(http.request.uri.path, \"/news/2012/\")",
+        "description": "My first dynamic URL Rewrite Rule",
+        "last_updated": "2021-04-14T14:42:04.219025Z",
+        "ref": "{rule-ref}"
+      }
+    ],
+    "last_updated": "2021-04-14T14:42:04.219025Z",
+    "phase": "http_request_transform"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+</div>
+</details>
diff --git a/products/rules/src/content/transform/url-rewrite/create-dashboard.md b/products/rules/src/content/transform/url-rewrite/create-dashboard.md
new file mode 100644
index 00000000000..3a1d888c79a
--- /dev/null
+++ b/products/rules/src/content/transform/url-rewrite/create-dashboard.md
@@ -0,0 +1,57 @@
+---
+title: Create a rule in the dashboard
+pcx-content-type: how-to
+order: 1
+---
+
+# Create a URL Rewrite Rule in the dashboard
+
+Create URL Rewrite Rules in the **Transform Rules** tab under Rules. See [URL rewrite examples](/transform/url-rewrite/examples) for examples of rule definitions.
+
+Do the following:
+
+1. Log in to the Cloudflare dashboard.
+
+1. Select the **Websites** tab and choose the site for which you want to create a new URL Rewrite Rule.
+
+1. Select **Rules** > **Transform Rules**.
+
+    ![Transform Rules tab](../../static/transform/overview.png)
+
+1. Click **Create transform rule** > **Rewrite URL**.
+
+    ![Create Transform Rule page](../../static/transform/create-url-rewrite-rule.png)
+
+1. In the page that displays, enter a descriptive name for the rule in **Rule name**. The rule name in this example is _Welcome GB Users_.
+
+1. Under **When incoming requests match**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value**.
+
+    ![Selecting a field in the Expression Builder](../../static/transform/expression-field.png)
+
+1. Select a comparison operator in the **Operator** drop-down list.
+
+    ![Selecting an operator in the Expression Builder](../../static/transform/expression-operator.png)
+
+    The **Expression Editor** area displays a text-only version of your expression. For more information on the Expression Editor, see [Edit rule expressions](https://developers.cloudflare.com/firewall/cf-dashboard/expression-preview-editor) in the Firewall documentation.
+
+1. Specify the value to match. If the value is an enumeration, the **Value** control will be a drop-down list. Otherwise, it will be a text input. In this example the value _United Kingdom_ is set using the **Country** drop-down list.
+
+    ![Entering a field value in the Expression Builder](../../static/transform/expression-value.png)
+
+1. Add any other filters to the rule expression. The example defines an additional filter for the _URI Path_, which must be equal to `/welcome.html`.
+
+1. To define the action for your URL Rewrite Rule, select one of the available options displayed as radio buttons and then a value from the drop-down list, depending on the action.
+
+    In this example, the _Static_ action tells Cloudflare to rewrite the original path to the provided path, `/welcome-gb.html`.
+
+    ![Static path rewrite for GB users](../../static/transform/rewrite-path-static-gb.png)
+
+    If you do not want to change the value of a component of the original request (for example, the URL query string), choose _Preserve_ as the action for that component.
+
+1. To save and deploy your rule, click **Deploy**. If you are not ready to deploy your rule, click **Save as Draft**.
+
+After you choose an option, you return to the **Transform Rules** dashboard interface, which displays your new rule:
+
+![Rules List displaying the new GB rule](../../static/transform/created-gb-rule.png)
+
+If you choose to deploy your URL Rewrite Rule, the new rule will be enabled. If you save the rule as a draft, the new rule will be disabled.
diff --git a/products/rules/src/content/transform/url-rewrite/examples.md b/products/rules/src/content/transform/url-rewrite/examples.md
new file mode 100644
index 00000000000..20622a67507
--- /dev/null
+++ b/products/rules/src/content/transform/url-rewrite/examples.md
@@ -0,0 +1,175 @@
+---
+pcx-content-type: configuration
+order: 3
+---
+
+# URL rewrite examples
+
+The following examples illustrate how to perform URL rewrites with Transform Rules:
+
+* [Rewrite path of welcome page for visitors in specific countries](#rewrite-path-of-welcome-page-for-visitors-in-specific-countries)
+* [Rewrite URL query string of blog visitors](#rewrite-url-query-string-of-blog-visitors)
+* [Rewrite path of archived blog posts](#rewrite-path-of-archived-blog-posts)
+* [Rewrite path of moved section of a website](#rewrite-path-of-moved-section-of-a-website)
+* [Rewrite path with several URL segments to a different URL segment](#rewrite-path-with-several-url-segments-to-a-different-url-segment)
+* [Rewrite blog archive URLs to support a new URL format](#rewrite-blog-archive-urls-to-support-a-new-url-format)
+
+### Rewrite path of welcome page for visitors in specific countries
+
+To have a welcome page in two languages, create two URL Rewrite Rules with a static rewrite of the path component:
+
+**URL Rewrite Rule #1**
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+http.request.uri.path == "/welcome.html" && ip.geoip.country == "GB"
+```
+
+Text after **Path** > **Rewrite to...** > _Static_:
+
+```txt
+/welcome-gb.html
+```
+
+</Example>
+
+**URL Rewrite Rule #2**
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+http.request.uri.path == "/welcome.html" && ip.geoip.country == "PT"
+```
+
+Text after **Path** > **Rewrite to...** > _Static_:
+
+```txt
+/welcome-pt.html
+```
+
+</Example>
+
+### Rewrite URL query string of blog visitors
+
+To rewrite a request to the `/blog` path to `/blog?sort-by=date`, create a URL Rewrite Rule with the following settings:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+http.request.uri.path == "/blog"
+```
+
+Text after **Query** > **Rewrite to...** > _Static_: 
+
+```txt
+sort-by=date
+```
+
+</Example>
+
+Additionally, set the path rewrite action of the same rule to _Preserve_ so that the URL path does not change.
+
+![Rule configuration for query rewrite in the blog example](../../static/transform/use-case-blog.png)
+
+### Rewrite path of archived blog posts
+
+To rewrite all requests to `/news/2012/...` to `/archive/news/2012/...` you must add a reference to the content of the original URL. Create a new URL Rewrite Rule and define a dynamic URL path rewrite using an expression:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+starts_with(http.request.uri.path, "/news/2012/")
+```
+
+Text after **Path** > **Rewrite to...** > _Dynamic_:
+
+```txt
+concat("/archive", http.request.uri.path)
+```
+
+</Example>
+
+The filter uses the `starts_with()` function all paths starting with `/news/2012/`. The dynamic path rewrite uses the `concat()` function to concatenate a prefix to the original URL path of the HTTP request.
+
+### Rewrite path of moved section of a website
+
+To rewrite everything under `/blog/<x>` to `/marketing/<x>` you must modify the first component of the path (`/blog/`). Create a URL Rewrite Rule and use the `regex_replace()` function for this purpose:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+starts_with(http.request.uri.path, "/blog/")
+```
+
+Text after **Path** > **Rewrite to...** > _Dynamic_:
+
+```txt
+regex_replace(http.request.uri.path, "^/blog/", "/marketing/")
+```
+
+</Example>
+
+The `regex_replace()` function matches the path component on a regular expression (`^/blog/`) and then provides a replacement for that match (`/marketing/`).
+
+### Rewrite path with several URL segments to a different URL segment
+
+To rewrite paths like `/images/<folder1>/<folder2>/<filename>` — where `<folder1>`, `<folder2>`, and `<filename>` can vary — to `/img/<filename>`, create a URL Rewrite Rule with a dynamic rewrite of the path component:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+http.request.uri.path ~ "^/images/[^/]+/[^/]+/[^/]+$"
+```
+
+Text after **Path** > **Rewrite to...** > _Dynamic_:
+
+```txt
+regex_replace(http.request.uri.path, "^/images/[^/]+/[^/]+/(.+)$", "/img/${1}")
+```
+
+</Example>
+
+For example, this rule would rewrite the `/images/nature/animals/tiger.png` path to `/img/tiger.png`.
+
+### Rewrite blog archive URLs to support a new URL format
+
+To rewrite the URLs of a blog archive that follow the URL format `/posts/<YYYY>-<MM>-<DD>-<title>` to the new format `/posts/<YYYY>/<MM>/<DD>/<title>`, create the following URL Rewrite Rule:
+
+<Example>
+
+Text in **Expression Editor**:
+
+```txt
+http.request.uri.path ~ "^/posts/[0-9]+-[0-9]+-[0-9]+-.*"
+```
+
+Text after **Path** > **Rewrite to...** > _Dynamic_:
+
+```txt
+regex_replace(http.request.uri.path, "^/posts/([0-9]+)-([0-9]+)-([0-9]+)-(.*)$", "/posts/${1}/${2}/${3}/${4}")
+```
+
+</Example>
+
+The function `regex_replace()` also allows you to extract parts of the URL using regular expressions' capture groups. Create capture groups by putting part of the regular expression in parentheses. Then, reference a capture group using `${<num>}` in the replacement string, where `<num>` is the number of the capture group.
+
+<Aside type="warning" header="Notes">
+
+Use only the fields under [`http.request.uri`](https://developers.cloudflare.com/firewall/cf-firewall-language/fields#uri-argument-and-value-fields) and [`http.request.headers`](https://developers.cloudflare.com/firewall/cf-firewall-language/fields#http-header-fields) in rewrite expressions.
+
+The `concat()` and `regex_replace()` functions can appear only **once** in a rewrite expression. For more information on these functions, see [Transformation functions](https://developers.cloudflare.com/firewall/cf-firewall-language/functions#transformation-functions).
+
+</Aside>
diff --git a/products/rules/src/content/transform/url-rewrite/index.md b/products/rules/src/content/transform/url-rewrite/index.md
new file mode 100644
index 00000000000..d4792d0b810
--- /dev/null
+++ b/products/rules/src/content/transform/url-rewrite/index.md
@@ -0,0 +1,20 @@
+---
+pcx-content-type: concept
+order: 0
+---
+
+# URL Rewrite Rules
+
+A URL Rewrite Rule can perform a **static rewrite** or a **dynamic rewrite**. Static rewrites replace a given part of a request URL (path or query string) with a static string. Dynamic rewrites support more advanced scenarios where you use an [expression](https://developers.cloudflare.com/firewall/cf-firewall-rules/fields-and-expressions) to define the resulting path or query string.
+
+To create a URL Rewrite Rule in the dashboard, see [Create a URL Rewrite Rule in the dashboard](/transform/url-rewrite/create-dashboard).
+
+To create a URL Rewrite Rule via API, see [Create a URL Rewrite Rule via API](/transform/url-rewrite/create-api).
+
+## Rewrites and redirects
+
+You can manipulate the URL of a request through different operations, namely through rewrites and redirects:
+
+* A **rewrite** is a server-side operation that occurs before a web server has fully processed a request. A rewrite is not visible to website visitors, since the URL displayed in the browser does not change. Configure URL Rewrite Rules to perform rewrites at the edge without reaching your web server.
+
+* A **redirect** is a client-side operation that occurs after the web server has loaded the initial URL. In this case, a website visitor can see the URL changing when the redirect occurs. See [Configuring URL forwarding or redirects with Cloudflare Page Rules](https://support.cloudflare.com/hc/articles/200172286) in the Support KB to learn more about configuring redirects.
diff --git a/products/rules/src/content/transform/url-rewrite/parameters.md b/products/rules/src/content/transform/url-rewrite/parameters.md
new file mode 100644
index 00000000000..39fa776e786
--- /dev/null
+++ b/products/rules/src/content/transform/url-rewrite/parameters.md
@@ -0,0 +1,67 @@
+---
+title: API parameter reference
+pcx-content-type: reference
+order: 4
+---
+
+# URL rewrite API parameter reference
+
+Create a [static or dynamic URL rewrite](/transform/url-rewrite) based on the parameter name provided in the `action_parameters` field:
+
+* Define the `value` parameter to specify a static URL rewrite.
+* Define the `expression` parameter to specify the expression that defines the dynamic URL rewrite to perform.
+
+## Static URL rewrite parameters
+
+The full syntax of the `action_parameters` field for a static URL Rewrite Rule that rewrites both the URI path and the query string is the following:
+
+```json
+"action_parameters": {
+  "uri": {
+    "path": { 
+      "value": "<URI_PATH_VALUE>"
+    }, 
+    "query": {
+      "value": "<QUERY_STRING_VALUE>"
+    }
+  }
+}
+```
+
+If you are only rewriting the URI path or the query string, omit the `query` or `path` parameter, respectively.
+
+## Dynamic URL rewrite parameters
+
+The full syntax of the `action_parameters` field for a dynamic URL Rewrite Rule that rewrites both the URI path and the query string is the following:
+
+```json
+"action_parameters": {
+  "uri": {
+    "path": { 
+      "expression": "<URI_PATH_EXPRESSION>"
+    }, 
+    "query": {
+      "expression": "<QUERY_STRING_EXPRESSION>"
+    }
+  }
+}
+```
+
+If you are only rewriting the URI path or the query string, omit the `query` or `path` parameter, respectively.
+
+## Different URL rewrite types in the same rule
+
+The same rule can have different types of URL rewrites for the URI path and the query string. For example, a single rule can perform a **dynamic** URL rewrite of the URI path and a **static** URL rewrite of the query string. The syntax of such a rule would be the following:
+
+```json
+"action_parameters": {
+  "uri": {
+    "path": { 
+      "expression": "<URI_PATH_EXPRESSION>"
+    }, 
+    "query": {
+      "value": "<QUERY_STRING_VALUE>"
+    }
+  }
+}
+```
diff --git a/products/rules/src/content/transform/use-cases.md b/products/rules/src/content/transform/use-cases.md
deleted file mode 100644
index 70c883f5c93..00000000000
--- a/products/rules/src/content/transform/use-cases.md
+++ /dev/null
@@ -1,232 +0,0 @@
----
-pcx-content-type: configuration
-order: 5
----
-
-# Common use cases
-
-This page includes examples of URL Rewrite Rules and HTTP Request Header Modification Rules that address common use cases.
-
----
-
-## URL rewrite examples
-
-The following use cases illustrate how to perform URL rewrites with Transform Rules:
-
-* [Rewrite path of welcome page for visitors in specific countries](#rewrite-path-of-welcome-page-for-visitors-in-specific-countries)
-* [Rewrite URL query string of blog visitors](#rewrite-url-query-string-of-blog-visitors)
-* [Rewrite path of archived blog posts](#rewrite-path-of-archived-blog-posts)
-* [Rewrite path of moved section of a website](#rewrite-path-of-moved-section-of-a-website)
-* [Rewrite blog archive URLs to support a new URL format](#rewrite-blog-archive-urls-to-support-a-new-url-format)
-
-### Rewrite path of welcome page for visitors in specific countries
-
-To have a welcome page in two languages, create two URL Rewrite Rules with a static rewrite of the path component:
-
-**URL Rewrite Rule #1**
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-http.request.uri.path == "/welcome.html" && ip.geoip.country == "GB"
-```
-
-Text after **Path** > **Rewrite to...** > _Static_:
-
-```txt
-/welcome-gb.html
-```
-
-</Example>
-
-**URL Rewrite Rule #2**
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-http.request.uri.path == "/welcome.html" && ip.geoip.country == "PT"
-```
-
-Text after **Path** > **Rewrite to...** > _Static_:
-
-```txt
-/welcome-pt.html
-```
-
-</Example>
-
-### Rewrite URL query string of blog visitors
-
-To rewrite a request to the `/blog` path to `/blog?sort-by=date`, create a URL Rewrite Rule with the following settings:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-http.request.uri.path == "/blog"
-```
-
-Text after **Query** > **Rewrite to...** > _Static_: 
-
-```txt
-sort-by=date
-```
-
-</Example>
-
-Additionally, set the path rewrite action of the same rule to _Preserve_ so that the URL path doesn’t change.
-
-![Rule configuration for query rewrite in the blog example](../static/transform/use-case-blog.png)
-
-### Rewrite path of archived blog posts
-
-To rewrite all requests to `/news/2012/...` to `/archive/news/2012/...` you must add a reference to the content of the original URL. Create a new URL Rewrite Rule and define a dynamic URL path rewrite using an expression:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-starts_with(http.request.uri.path, "/news/2012/")
-```
-
-Text after **Path** > **Rewrite to...** > _Dynamic_:
-
-```txt
-concat("/archive", http.request.uri.path)
-```
-
-</Example>
-
-The filter uses the `starts_with()` function all paths starting with `/news/2012/`. The dynamic path rewrite uses the `concat()` function to concatenate a prefix to the original URL path of the HTTP request.
-
-### Rewrite path of moved section of a website
-
-To rewrite everything under `/blog/<x>` to `/marketing/<x>` you must modify the first component of the path (`/blog/`). Create a URL Rewrite Rule and use the `regex_replace()` function for this purpose:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-starts_with(http.request.uri.path, "/blog/")
-```
-
-Text after **Path** > **Rewrite to...** > _Dynamic_:
-
-```txt
-regex_replace(http.request.uri.path, "^/blog/", "/marketing/")
-```
-
-</Example>
-
-The `regex_replace()` function matches the path component on a regular expression (`^/blog/`) and then provides a replacement for that match (`/marketing/`).
-
-### Rewrite blog archive URLs to support a new URL format
-
-To rewrite the URLs of a blog archive that follow the URL format `/posts/<YYYY>-<MM>-<DD>-<title>` to the new format `/posts/<YYYY>/<MM>/<DD>/<title>`, create the following URL Rewrite Rule:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-http.request.uri.path ~ "^/posts/[0-9]+-[0-9]+-[0-9]+-.*"
-```
-
-Text after **Path** > **Rewrite to...** > _Dynamic_:
-
-```txt
-regex_replace(http.request.uri.path, "^/posts/([0-9]+)-([0-9]+)-([0-9]+)-(.*)$", "/posts/${1}/${2}/${3}/${4}")
-```
-
-</Example>
-
-The function `regex_replace()` also allows you to extract parts of the URL using regular expressions' capture groups. Create capture groups by putting part of the regular expression in parentheses. Then, reference a capture group using `${<num>}` in the replacement string, where `<num>` is the number of the capture group.
-
-<Aside type="warning" header="Notes">
-
-Use only the fields under [`http.request.uri`](https://developers.cloudflare.com/firewall/cf-firewall-language/fields#uri-argument-and-value-fields) and [`http.request.headers`](https://developers.cloudflare.com/firewall/cf-firewall-language/fields#http-header-fields) in rewrite expressions.
-
-The `concat()` and `regex_replace()` functions can appear only **once** in a rewrite expression. For more information on these functions, see [Transformation functions](https://developers.cloudflare.com/firewall/cf-firewall-language/functions#transformation-functions).
-
-</Aside>
-
----
-
-## HTTP request header modification examples
-
-<Aside type="note">
-
-HTTP Request Header Modification Rules are available in Beta.
-
-</Aside>
-
-The following examples illustrate how to perform header modifications with Transform Rules:
-
-* [Add an HTTP request header with a static value](#add-an-http-request-header-with-a-static-value)
-* [Add an HTTP request header with the current bot score](#add-an-http-request-header-with-the-current-bot-score)
-* [Remove an HTTP request header](#remove-an-http-request-header)
-
-### Add an HTTP request header with a static value
-
-The following HTTP Request Header Modification Rule adds a header named `X-Source` with a static value (`Cloudflare`) to the request:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-starts_with(http.request.uri.path, "/en/")
-```
-
-Selected operation under **Modify header**: _Set static_
-
-**Header name**: `X-Source`
-
-**Value**: `Cloudflare`
-
-</Example>
-
-### Add an HTTP request header with the current bot score
-
-The following HTTP Request Header Modification Rule adds a header named `X-Bot-Score` with the current bot score to the request:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-starts_with(http.request.uri.path, "/en/")
-```
-
-Selected operation under **Modify header**: _Set dynamic_
-
-**Header name**: `X-Bot-Score`
-
-**Value**: `to_string(cf.bot_management.score)`
-
-</Example>
-
-### Remove an HTTP request header
-
-The following HTTP Request Header Modification Rule removes the `cf-connecting-ip` header from the request:
-
-<Example>
-
-Text in **Expression Editor**:
-
-```txt
-starts_with(http.request.uri.path, "/private/")
-```
-
-Selected operation under **Modify header**: _Remove_
- 
-**Header name**: `cf-connecting-ip`
-
-</Example>
diff --git a/products/rules/wrangler.toml b/products/rules/wrangler.toml
index 733bd9e4077..2ad53c323d1 100644
--- a/products/rules/wrangler.toml
+++ b/products/rules/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/rules*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "16cfb397432a455b97736823f5656ac2" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/spectrum/docs-config.js b/products/spectrum/docs-config.js
index 9f9e476e620..f372e013798 100644
--- a/products/spectrum/docs-config.js
+++ b/products/spectrum/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "DDoS protection for everything.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/spectrum",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/spectrum/src/content/analytics.md b/products/spectrum/src/content/analytics.md
index 2866a657bff..2a66deb82b7 100644
--- a/products/spectrum/src/content/analytics.md
+++ b/products/spectrum/src/content/analytics.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Analytics
diff --git a/products/spectrum/src/content/byoip.md b/products/spectrum/src/content/byoip.md
index 6ac7d41449d..fcf0991f161 100644
--- a/products/spectrum/src/content/byoip.md
+++ b/products/spectrum/src/content/byoip.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: concept
+---
+
 # BYOIP
 
 When creating a Spectrum application, Cloudflare normally assigns an arbitrary IP from Cloudflare’s IP pool to your application. This may not always be what you want: you may want to be explicit in your network setup, or use your own IP addresses. BYOIP with Spectrum allows you to do just that.
diff --git a/products/spectrum/src/content/cname-origins.md b/products/spectrum/src/content/cname-origins.md
index 16d0a1c0319..e48d0c9d5ac 100644
--- a/products/spectrum/src/content/cname-origins.md
+++ b/products/spectrum/src/content/cname-origins.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: tutorial
+---
+
 # CNAME origins
 
 The API supports specifying an origin by hostname. This is useful for cases where you might setup Spectrum in front of a load balancer like an AWS ELB that offers a hostname instead of a static IP.
diff --git a/products/spectrum/src/content/configuration-options.md b/products/spectrum/src/content/configuration-options.md
index 329edcada69..bee305aef99 100644
--- a/products/spectrum/src/content/configuration-options.md
+++ b/products/spectrum/src/content/configuration-options.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Configuration options
diff --git a/products/spectrum/src/content/ftp.md b/products/spectrum/src/content/ftp.md
index ff55cdbd27f..2706ebb55fe 100644
--- a/products/spectrum/src/content/ftp.md
+++ b/products/spectrum/src/content/ftp.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: concept
+---
+
 # FTP
 
 Enabling Spectrum for FTP is not straightforward due to the implementation of the protocol. This guide gives an overview of the intricacies of FTP and under which circumstances you can enable Spectrum for your FTP service.
diff --git a/products/spectrum/src/content/getting-started.md b/products/spectrum/src/content/getting-started.md
index 46de6820f5b..66d1e15923b 100644
--- a/products/spectrum/src/content/getting-started.md
+++ b/products/spectrum/src/content/getting-started.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: tutorial
 ---
 
 # Getting started
diff --git a/products/spectrum/src/content/index.md b/products/spectrum/src/content/index.md
index cac40bc7013..72d02e12830 100644
--- a/products/spectrum/src/content/index.md
+++ b/products/spectrum/src/content/index.md
@@ -2,6 +2,7 @@
 title: Welcome
 order: 0
 type: overview
+pcx-content-type: landing-page 
 ---
 
 # Cloudflare Spectrum documentation
diff --git a/products/spectrum/src/content/load-balancer.md b/products/spectrum/src/content/load-balancer.md
index 453b0081425..36e6944d778 100644
--- a/products/spectrum/src/content/load-balancer.md
+++ b/products/spectrum/src/content/load-balancer.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: tutorial
 ---
 
 # Cloudflare Load Balancer
@@ -70,6 +71,12 @@ All steering modes are available for transport load balancing through Spectrum:
 
 --------------------------------
 
+## Load balancing rules
+
+At the moment, you cannot use [load balancing custom rules](https://developers.cloudflare.com/load-balancing/understand-basics/load-balancing-rules) with Cloudflare Spectrum.
+
+--------------------------------
+
 ## Example
 
 <Aside>
diff --git a/products/spectrum/src/content/logs.md b/products/spectrum/src/content/logs.md
index a103bdaf469..9b7f9ab755c 100644
--- a/products/spectrum/src/content/logs.md
+++ b/products/spectrum/src/content/logs.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: reference
+---
+
 # Event logs
 
 ## Overview
diff --git a/products/spectrum/src/content/proxy-protocol.md b/products/spectrum/src/content/proxy-protocol.md
index 72ace25fa71..363b01c8621 100644
--- a/products/spectrum/src/content/proxy-protocol.md
+++ b/products/spectrum/src/content/proxy-protocol.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: configuration
 ---
 
 # Proxy protocol
diff --git a/products/spectrum/src/content/settings-by-plan.md b/products/spectrum/src/content/settings-by-plan.md
index ecd95849cbe..6296f359045 100644
--- a/products/spectrum/src/content/settings-by-plan.md
+++ b/products/spectrum/src/content/settings-by-plan.md
@@ -1,5 +1,6 @@
 ---
 type: overview
+pcx-content-type: reference
 ---
 
 # Settings by plan
diff --git a/products/ssl/docs-config.js b/products/ssl/docs-config.js
index 75054a861e9..d569ebc78f6 100644
--- a/products/ssl/docs-config.js
+++ b/products/ssl/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Encrypting as much web traffic as possible to prevent data theft and other tampering is a critical step toward building a safer, better Internet. We’re proud to be the first Internet performance and security company to offer SSL protection free of charge.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/ssl",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/ssl/src/content/certificate-transparency-monitoring/index.md b/products/ssl/src/content/certificate-transparency-monitoring/index.md
deleted file mode 100644
index 06472cbf2eb..00000000000
--- a/products/ssl/src/content/certificate-transparency-monitoring/index.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-order: 2
-pcx-content-type: concept
----
-
-# Certificate transparency monitoring
-
-[Certificate Transparency Monitoring](https://blog.cloudflare.com/introducing-certificate-transparency-and-nimbus/) sends you emails when certificates are issued for your domain. This feature is in **public beta** and is opt-in (you are not automatically enrolled).
-
---------
-
-## Overview
-
-Every website must have a certificate to be trusted by major browsers. A certificate is a proof of identity — it says that you are who you say you are. These certificates help browsers like Google Chrome "know" that a connection is secure before presenting content. Certificates are recorded in public **CT logs**, such as Google’s Argon log and Cloudflare’s Nimbus log.
-
-If you enable Certificate Transparency (CT) Monitoring, Cloudflare will send you an email whenever your domain is recognized in a CT log. Usually, these certificates are legitimate and do not require further action. We send emails so you can double-check for yourself.
-
-In rare cases, you may believe a certificate is illegitimate. This is when you should [take action](#how-to-take-action).
-
---------
-
-## Opting in and out
-
-Alerts are turned off by default. If you want to receive alerts, go to [SSL/TLS](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates#ct-alerting-card) in the Cloudflare dashboard.
-
-Features vary by plan:
-- **Free** and **Pro** customers will see a toggle to turn **On** or **Off**. Emails will go to all Cloudflare account members.
-- **Business** and **Enterprise** customers will see an option to **add emails**. These addresses do not have to be tied to Cloudflare accounts. If you want to send emails to more than 10 people, consider setting up an email alias.
-
-To stop receiving alerts, switch the toggle to **Off** or remove your emails from the feature card.
-
-<Aside type="note" header="Note:">
-    CT monitoring does not detect phishing attempts. For example, for <code>cloudflare.com</code>, an alert would not trigger for a certificate issued for <code>cloudf1are.com</code> or <code>cloud-flare.com</code>.
-</Aside>
-
---------
-
-## Emails to be concerned about
-
-Most certificate alerts are routine. We send alerts whenever a certificate for your domain appears in a log. Certificates expire (and must be reissued), so it is completely normal to receive issuance emails. If your domain is listed in the email, along with reasonable ownership and certificate information, then **no action is required**.
-
-You *should* take action when something is clearly wrong, such as if you:
-- Do not recognize the certificate issuer
-- Have recently noticed problems with your website
-
---------
-
-## How to take action
-
-### Option 1: Contact certificate authorities
-
-Only Certificate Authorities can revoke malicious certificates. If you believe an illegitimate certificate was issued for your domain, contact the Certificate Authority listed as the **Issuer** in the email.
-
-- [DigiCert support](https://www.digicert.com/support/#Contact)
-
-- [GlobalSign support](https://support.globalsign.com/)
-
-- [GoDaddy support](https://www.godaddy.com/contact-us?sp_hp=B)
-
-- [IdenTrust support](https://www.identrust.com/support/support-team)
-
-- [Let’s Encrypt support](https://letsencrypt.org/contact/)
-
-- [Sectigo support](https://sectigo.com/support)
-
-### Option 2: Contact domain registrars
-
-Domain registrars may be able to **suspend** potentially malicious domains. If, for example, you notice that a malicious domain was registered through GoDaddy, contact GoDaddy’s support team to see if they can help you. Do the same for other registrars.
-
-### Option 3: Improvise
-
-There are other ways to combat malicious certificates. You can warn your visitors with an on-site notification, ask browser makers (Google for Chrome, etc.) to block these domains, or you can [contact us to help combat malicious certificates](https://support.cloudflare.com/hc/articles/200172476).
-
-If someone is attempting to impersonate you online, you should absolutely take action. This is usually difficult to recognize, so exercise caution. **Remember: the vast majority of certificates are not malicious. Only take action if you believe something is wrong.**
-
-## HTTP Public Key Pinning
-
-Certificate Transparency Monitoring addresses the same problems as HTTP Public Key Pinning (HPKP), but with [fewer technical issues](https://scotthelme.co.uk/im-giving-up-on-hpkp/).
-
-Cloudflare does not offer or support HPKP and advises against using it with Dedicated & Universal SSL.
\ No newline at end of file
diff --git a/products/ssl/src/content/client-certificates/configure-your-mobile-app-or-iot-device.md b/products/ssl/src/content/client-certificates/configure-your-mobile-app-or-iot-device.md
index 860caa41a65..3f34652ab5e 100644
--- a/products/ssl/src/content/client-certificates/configure-your-mobile-app-or-iot-device.md
+++ b/products/ssl/src/content/client-certificates/configure-your-mobile-app-or-iot-device.md
@@ -271,6 +271,76 @@ Verifying - Enter Export Password:
 
 In a real-world deployment, a bootstrap certificate should only be used in conjunction with users’ credentials to authenticate with an API endpoint that can return a unique user certificate. Corporate users will want to use mobile device management (MDM) to distribute certificates.
 
+### Embed the client certificate in an Android app
+
+The following is an example of how you may use a client certificate in an Android app to make HTTP calls. You need to add the following permission in ``AndroidManifest.xml`` to allow an Internet connection.
+```xml
+<uses-permission android:name="android.permission.INTERNET" />
+```
+For demonstration purposes, the certificate in this example is stored in ``app/src/main/res/raw/cert.pem`` and the private key is stored in ``app/src/main/res/raw/key.pem``. You may also store these files in other secure manners. 
+
+The following example uses an ``OkHttpClient``, but you may also use other clients such as ``HttpURLConnection`` in similar ways. The key is to use the ``SSLSocketFactory``.
+```java
+private OkHttpClient setUpClient() {
+    try {
+        final String SECRET = "secret"; // You may also store this String somewhere more secure.
+        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+
+        // Get private key
+        InputStream privateKeyInputStream = getResources().openRawResource(R.raw.key);
+        byte[] privateKeyByteArray = new byte[privateKeyInputStream.available()];
+        privateKeyInputStream.read(privateKeyByteArray);
+
+        String privateKeyContent = new String(privateKeyByteArray, Charset.defaultCharset())
+                .replace("-----BEGIN PRIVATE KEY-----", "")
+                .replaceAll(System.lineSeparator(), "")
+                .replace("-----END PRIVATE KEY-----", "");
+
+        byte[] rawPrivateKeyByteArray = Base64.getDecoder().decode(privateKeyContent);
+        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
+        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(rawPrivateKeyByteArray);
+
+        // Get certificate
+        InputStream certificateInputStream = getResources().openRawResource(R.raw.cert);
+        Certificate certificate = certificateFactory.generateCertificate(certificateInputStream);
+
+        // Set up KeyStore
+        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        keyStore.load(null, SECRET.toCharArray());
+        keyStore.setKeyEntry("client", keyFactory.generatePrivate(keySpec), SECRET.toCharArray(), new Certificate[]{certificate});
+        certificateInputStream.close();
+
+        // Set up Trust Managers
+        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        trustManagerFactory.init((KeyStore) null);
+        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
+
+        // Set up Key Managers
+        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        keyManagerFactory.init(keyStore, SECRET.toCharArray());
+        KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();
+
+        // Obtain SSL Socket Factory
+        SSLContext sslContext = SSLContext.getInstance("TLS");
+        sslContext.init(keyManagers, trustManagers, new SecureRandom());
+        SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
+
+        // Finally, return the client, which will then be used to make HTTP calls.
+        OkHttpClient client = new OkHttpClient.Builder()
+                .sslSocketFactory(sslSocketFactory)
+                .build();
+
+        return client;
+
+    } catch (CertificateException | IOException | NoSuchAlgorithmException | KeyStoreException | UnrecoverableKeyException | KeyManagementException | InvalidKeySpecException e) {
+        e.printStackTrace();
+        return null;
+    }
+}
+```
+
+The above function returns an ``OkHttpClient`` embedded with the client certificate. You can now use this client to make HTTP requests to your API endpoint protected with mTLS.
+
 --------
 
 ## Embed the client certificate on your IoT device
@@ -313,7 +383,7 @@ def main():
     print("Response status code: %d" % r.status_code)
 ```
 
-When the script attempts to connect to `https://shield.upinatoms.com/temps`, Cloudflare requests that a client certificate is sent, and the script sends the contents of `$CERT_FILE` and then, as required to complete the SSL/TLS handshake, demonstrates it has possession of `$KEY_FILE`.
+When the script attempts to connect to `https://shield.upinatoms.com/temps`, Cloudflare requests that a client certificate is sent, and the script sends the contents of `/etc/ssl/certs/sensor.pem` and then, as required to complete the SSL/TLS handshake, demonstrates it has possession of `/etc/ssl/private/sensor-key.pem`.
 
 Without the client certificate, the Cloudflare rejects the request:
 
diff --git a/products/ssl/src/content/client-certificates/create-a-client-certificate.md b/products/ssl/src/content/client-certificates/create-a-client-certificate.md
index d4cb6b90576..6cc46cc1e37 100644
--- a/products/ssl/src/content/client-certificates/create-a-client-certificate.md
+++ b/products/ssl/src/content/client-certificates/create-a-client-certificate.md
@@ -25,7 +25,7 @@ To create a client certificate in the Cloudflare dashboard, use the **SSL** app
 
   You can only use API Shield with a certificate authority (CA) that is fully managed by Cloudflare. Cloudflare generates a unique CA for each zone.
 
-  If you need to use a different CA, contact a Cloudflare customer success manager.
+  If you need to use certificates issued by another CA, use <a href="https://developers.cloudflare.com/cloudflare-one/identity/devices/mutual-tls-authentication?">Cloudflare Access</a> to upload your own CA.
 
   </Aside>
 
diff --git a/products/ssl/src/content/client-certificates/enable-mtls.md b/products/ssl/src/content/client-certificates/enable-mtls.md
index d9254d1a778..f6f42bac73c 100644
--- a/products/ssl/src/content/client-certificates/enable-mtls.md
+++ b/products/ssl/src/content/client-certificates/enable-mtls.md
@@ -1,5 +1,5 @@
 ---
-order: 3
+order: 4
 pcx-content-type: how-to
 ---
 
diff --git a/products/ssl/src/content/client-certificates/index.md b/products/ssl/src/content/client-certificates/index.md
index 93e3390e479..3090a851bca 100644
--- a/products/ssl/src/content/client-certificates/index.md
+++ b/products/ssl/src/content/client-certificates/index.md
@@ -1,5 +1,5 @@
 ---
-order: 1
+order: 3
 pcx-content-type: interim
 ---
 
diff --git a/products/ssl/src/content/client-certificates/revoke-client-certificate.md b/products/ssl/src/content/client-certificates/revoke-client-certificate.md
index 167313f05bf..aab6959b591 100644
--- a/products/ssl/src/content/client-certificates/revoke-client-certificate.md
+++ b/products/ssl/src/content/client-certificates/revoke-client-certificate.md
@@ -1,5 +1,5 @@
 ---
-order: 4
+order: 5
 pcx-content-type: how-to
 ---
 
diff --git a/products/ssl/src/content/client-certificates/troubleshooting.md b/products/ssl/src/content/client-certificates/troubleshooting.md
new file mode 100644
index 00000000000..ce733d713b1
--- /dev/null
+++ b/products/ssl/src/content/client-certificates/troubleshooting.md
@@ -0,0 +1,38 @@
+---
+order: 6
+pcx-content-type: faq
+---
+
+# Troubleshooting
+
+If your query returns an error even after configuring and embedding a client SSL certificate, check the following settings.
+
+--------
+
+## SSL/TLS handshake
+On your terminal, use the following command to check whether an SSL/TLS connection can be established successfully between the client and the API endpoint.
+```bash
+curl -v --cert /path/to/certificate.pem --key /path/to/key.pem  https://your-api-endpoint.com
+```
+If the SSL/TLS handshake cannot be completed, check whether the certificate and the private key are correct.
+
+--------
+
+## mTLS host enablement 
+On your dashboard, click **SSL/TLS** > **Client Certificates**. Check whether mTLS has been enabled for the correct host. The host should match the API endpoint that you want to protect. For example, if your API endpoint is ``api.trackers.ninja/time``, then you should add ``api.trackers.ninja`` under “Hosts”.
+    ![Client Certificates host enablement](../static/client-certificates-host-enablement.png)
+
+--------
+
+## mTLS rules
+To review mTLS rules:
+
+1. Click **Firewall** > **Firewall Rules**.
+1. On a specific rule, click **Edit**.
+1. On that rule, check whether:
+    - The Expression Preview is correct
+    - The hostname matches your API endpoint. For example, for the API endpoint ``api.trackers.ninja/time``, the rule should look like:
+        ```txt
+        (http.host in {"api.trackers.ninja"} and not cf.tls_client_auth.cert_verified) 
+        ```
+1. To edit the rule, either use the user interface or click **Edit expression**.
diff --git a/products/ssl/src/content/advanced-certificate-manager/index.md b/products/ssl/src/content/edge-certificates/advanced-certificate-manager.md
similarity index 100%
rename from products/ssl/src/content/advanced-certificate-manager/index.md
rename to products/ssl/src/content/edge-certificates/advanced-certificate-manager.md
diff --git a/products/ssl/src/content/edge-certificates/certificate-transparency-monitoring.md b/products/ssl/src/content/edge-certificates/certificate-transparency-monitoring.md
new file mode 100644
index 00000000000..0fff2ecd07f
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/certificate-transparency-monitoring.md
@@ -0,0 +1,86 @@
+---
+order: 2
+pcx-content-type: concept
+---
+
+# Certificate transparency monitoring
+
+[Certificate Transparency Monitoring](https://blog.cloudflare.com/introducing-certificate-transparency-and-nimbus/) sends you emails when certificates are issued for your domain. This feature is in **public beta** and is opt-in.
+
+<Aside type="note">
+
+If you use a shared certificate, you may receive notifications for domains or subdomains that do not belong to you.
+
+</Aside>
+
+--------
+
+## Overview
+
+Every website must have a certificate to be trusted by major browsers. A certificate is a proof of identity — it says that you are who you say you are. These certificates help browsers like Google Chrome "know" that a connection is secure before presenting content. Certificates are recorded in public **CT logs**, such as Google’s Argon log and Cloudflare’s Nimbus log.
+
+If you enable Certificate Transparency (CT) Monitoring, Cloudflare will send you an email whenever your domain is recognized in a CT log. Usually, these certificates are legitimate and do not require further action. We send emails so you can double-check for yourself. If you use a shared certificate, you may receive emails for domains or subdomains that do not belong to you.
+
+In rare cases, you may believe a certificate is illegitimate. This is when you should [take action](#how-to-take-action).
+
+--------
+
+## Opting in and out
+
+Alerts are turned off by default. If you want to receive alerts, go to [SSL/TLS](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates#ct-alerting-card) in the Cloudflare dashboard.
+
+Features vary by plan:
+- **Free** and **Pro** customers will see a toggle to turn **On** or **Off**. Emails will go to all Cloudflare account members.
+- **Business** and **Enterprise** customers will see an option to **add emails**. These addresses do not have to be tied to Cloudflare accounts. If you want to send emails to more than 10 people, consider setting up an email alias.
+
+To stop receiving alerts, switch the toggle to **Off** or remove your emails from the feature card.
+
+<Aside type="note" header="Note:">
+    CT monitoring does not detect phishing attempts. For example, for <code>cloudflare.com</code>, an alert would not trigger for a certificate issued for <code>cloudf1are.com</code> or <code>cloud-flare.com</code>.
+</Aside>
+
+--------
+
+## Emails to be concerned about
+
+Most certificate alerts are routine. We send alerts whenever a certificate for your domain appears in a log. Certificates expire (and must be reissued), so it is completely normal to receive issuance emails. If your domain is listed in the email, along with reasonable ownership and certificate information, then **no action is required**.
+
+You *should* take action when something is clearly wrong, such as if you:
+- Do not recognize the certificate issuer
+- Have recently noticed problems with your website
+
+--------
+
+## How to take action
+
+### Option 1: Contact certificate authorities
+
+Only Certificate Authorities can revoke malicious certificates. If you believe an illegitimate certificate was issued for your domain, contact the Certificate Authority listed as the **Issuer** in the email.
+
+- [DigiCert support](https://www.digicert.com/support/#Contact)
+
+- [GlobalSign support](https://support.globalsign.com/)
+
+- [GoDaddy support](https://www.godaddy.com/contact-us?sp_hp=B)
+
+- [IdenTrust support](https://www.identrust.com/support/support-team)
+
+- [Let’s Encrypt support](https://letsencrypt.org/contact/)
+
+- [Sectigo support](https://sectigo.com/support)
+
+### Option 2: Contact domain registrars
+
+Domain registrars may be able to **suspend** potentially malicious domains. If, for example, you notice that a malicious domain was registered through GoDaddy, contact GoDaddy’s support team to see if they can help you. Do the same for other registrars.
+
+### Option 3: Improvise
+
+There are other ways to combat malicious certificates. You can warn your visitors with an on-site notification, ask browser makers (Google for Chrome, etc.) to block these domains, or you can [contact us to help combat malicious certificates](https://support.cloudflare.com/hc/articles/200172476).
+
+If someone is attempting to impersonate you online, you should absolutely take action. This is usually difficult to recognize, so exercise caution. **Remember: the vast majority of certificates are not malicious. Only take action if you believe something is wrong.**
+
+## HTTP Public Key Pinning
+
+Certificate Transparency Monitoring addresses the same problems as HTTP Public Key Pinning (HPKP), but with [fewer technical issues](https://scotthelme.co.uk/im-giving-up-on-hpkp/).
+
+Cloudflare does not offer or support HPKP and advises against using it with Dedicated & Universal SSL.
\ No newline at end of file
diff --git a/products/ssl/src/content/custom-certificates/bundling-methodologies.md b/products/ssl/src/content/edge-certificates/custom-certificates/bundling-methodologies.md
similarity index 100%
rename from products/ssl/src/content/custom-certificates/bundling-methodologies.md
rename to products/ssl/src/content/edge-certificates/custom-certificates/bundling-methodologies.md
diff --git a/products/ssl/src/content/custom-certificates/index.md b/products/ssl/src/content/edge-certificates/custom-certificates/index.md
similarity index 100%
rename from products/ssl/src/content/custom-certificates/index.md
rename to products/ssl/src/content/edge-certificates/custom-certificates/index.md
diff --git a/products/ssl/src/content/custom-certificates/renewing.md b/products/ssl/src/content/edge-certificates/custom-certificates/renewing.md
similarity index 100%
rename from products/ssl/src/content/custom-certificates/renewing.md
rename to products/ssl/src/content/edge-certificates/custom-certificates/renewing.md
diff --git a/products/ssl/src/content/custom-certificates/uploading.md b/products/ssl/src/content/edge-certificates/custom-certificates/uploading.md
similarity index 100%
rename from products/ssl/src/content/custom-certificates/uploading.md
rename to products/ssl/src/content/edge-certificates/custom-certificates/uploading.md
diff --git a/products/ssl/src/content/edge-certificates/http-strict-transport-security.md b/products/ssl/src/content/edge-certificates/http-strict-transport-security.md
new file mode 100644
index 00000000000..78cdbe2f685
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/http-strict-transport-security.md
@@ -0,0 +1,118 @@
+---
+order: 3
+pcx-content-type: interim
+type: overview
+---
+
+# HTTP Strict Transport Security (HSTS)
+
+HSTS protects HTTPS web servers from downgrade attacks. These attacks redirect web browsers from an HTTPS web server to an attacker-controlled server, allowing bad actors to compromise user data and cookies.
+
+HSTS adds an HTTP header that directs [compliant web browsers](/ssl-tls/browser-compatibility) to:
+- Transform HTTP links to HTTPS links
+- Prevent users from bypassing SSL browser warnings 
+
+Before enabling HSTS, review the [requirements](#requirements).
+
+<Aside type="note">
+
+For more background information on HSTS, see the <a href="https://blog.cloudflare.com/enforce-web-policy-with-hypertext-strict-transport-security-hsts/">introductory blog post</a>.
+
+</Aside>
+
+---
+
+## Requirements
+
+In order for HSTS to work as expected, you need to:
+- Have enabled HTTPS before HSTS so browsers can accept your HSTS settings
+- Keep HTTPS enabled so visitors can access your site
+
+Once you enabled HSTS, avoid the following actions to ensure visitors can still access your site:
+- Changing your DNS records from [Proxied to DNS only](https://support.cloudflare.com/hc/articles/200169626)
+- [Pausing Cloudflare](https://support.cloudflare.com/hc/articles/203118044#h_8654c523-e31e-4f40-a3c7-0674336a2753) on your site
+- Pointing your nameservers away from Cloudflare
+- Redirecting HTTPS to HTTP
+- Disabling SSL (invalid or expired certificates or certificates with mismatched host names)
+
+<Aside type="warning">
+
+If you remove HTTPS before disabling HSTS or before waiting for the duration of the original <strong>Max Age Header</strong> specified in your Cloudflare HSTS configuration, your website becomes inaccessible to visitors for the duration of the Max Age Header or until you enable HTTPS.
+
+</Aside>
+
+## Enable HSTS
+
+To enable HSTS for your website:
+1. Log in to the Cloudflare dashboard and select your account.
+1. Select your website.
+1. Go to **SSL/TLS** > **Edge Certificates**.
+1. For **HTTP Strict Transport Security (HSTS)**, click **Enable HSTS**.
+1. Read the dialog and click **I understand**.
+1. Click **Next**.
+1. Configure the [HSTS settings](#configuration-settings).
+1. Click **Save**.
+
+    
+
+## Disable HSTS
+
+To disable HSTS on your website:
+1. Log in to the Cloudflare dashboard and select your account.
+1. Select your website.
+1. Go to **SSL/TLS** > **Edge Certificates**.
+1. For **HTTP Strict Transport Security (HSTS)**, click **Enable HSTS**.
+1. Set the **Max Age Header** to **0 (Disable)**.
+1. If you previously enabled the **No-Sniff** header and want to remove it, set it to **Off**.  
+1. Click **Save**.
+
+## Configuration settings
+
+<table style="width:100%">
+<thead>
+    <tr>
+        <th>Name</th>
+        <th>Required</th>
+        <th>Description</th>
+        <th>Options</th>
+    </tr>
+</thead>
+<tbody>
+    <tr>
+        <td>Enable HSTS (Strict-Transport-Security)</td>
+        <td>Yes</td>
+        <td>Serves HSTS headers to browsers for all HTTPS requests.</td>
+        <td>Off / On</td>
+    </tr>
+    <tr>
+        <td>Max Age Header (max-age)</td>
+        <td>Yes</td>
+        <td>Specifies duration for a browser HSTS policy and requires HTTPS on your website.</td>
+        <td>Disable, or a range from 1 to 12 months</td>
+    </tr>
+    <tr>
+        <td>Apply HSTS policy to subdomains (includeSubDomains)</td>
+        <td>No</td>
+        <td>Applies the HSTS policy from a parent domain to subdomains. Subdomains are inaccessible if they do not support HTTPS.</td>
+        <td>Off / On</td>
+    </tr>
+    <tr>
+        <td>Preload</td>
+        <td>No</td>
+        <td>Permits browsers to automatically preload HSTS configuration. Prevents an attacker from downgrading a first request form HTTPS to HTTP. Preload can make a website without HTTPS completely inaccessible.</td>
+        <td>Off / On</td>
+    </tr>
+    <tr>
+        <td>No-Sniff Header</td>
+        <td>No</td>
+        <td>Sends the <code>X-Content-Type-Options: nosniff</code> header to prevent Internet Explorer and Chrome from automatically detecting a content type other than those explicitly specified by the Content-Type header.</td>
+        <td>Off / On</td>
+    </tr>
+</tbody>
+</table>
+
+<Aside type='note'>
+
+Once HSTS <strong>Preload</strong> is configured, submit requests for addition to each browser’s preload list. Chrome, Firefox/Mozilla, and Safari use the Chrome preload list. A minimum <strong>Max Age Header</strong> of 12 months is required for inclusion in HSTS preload lists.
+
+</Aside>
diff --git a/products/ssl/src/content/edge-certificates/index.md b/products/ssl/src/content/edge-certificates/index.md
new file mode 100644
index 00000000000..5bf99e7c9d1
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/index.md
@@ -0,0 +1,10 @@
+---
+order: 2
+pcx-content-type: navigation
+---
+
+# Edge certificates
+
+Learn more about SSL/TLS protection options for your edge certificates:
+
+<DirectoryListing path="/edge-certificates"/>
\ No newline at end of file
diff --git a/products/ssl/src/content/universal-ssl/changing-dcv-method.md b/products/ssl/src/content/edge-certificates/universal-ssl/changing-dcv-method.md
similarity index 99%
rename from products/ssl/src/content/universal-ssl/changing-dcv-method.md
rename to products/ssl/src/content/edge-certificates/universal-ssl/changing-dcv-method.md
index a188fcbadd4..cc892167666 100644
--- a/products/ssl/src/content/universal-ssl/changing-dcv-method.md
+++ b/products/ssl/src/content/edge-certificates/universal-ssl/changing-dcv-method.md
@@ -1,9 +1,9 @@
 ---
-order: 1
+order: 2
 pcx-content-type: how-to
 ---
 
-# Changing DCV method
+# Change DCV method
 
 --------
 
diff --git a/products/ssl/src/content/edge-certificates/universal-ssl/disable-universal-ssl.md b/products/ssl/src/content/edge-certificates/universal-ssl/disable-universal-ssl.md
new file mode 100644
index 00000000000..002d4fe7aa6
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/universal-ssl/disable-universal-ssl.md
@@ -0,0 +1,35 @@
+---
+title: Disable Universal SSL
+order: 3
+pcx-content-type: how-to
+---
+
+# How do I disable Universal SSL?
+
+Some customers may need to manage their own SSL certificates or rely on specific Certificate Authorities.
+
+If you disable your domain's Universal SSL certificate, we remove that certificate from our network and will not order or renew any additional Universal SSL certificates.
+
+## Potential errors
+
+To avoid errors with your domain, either [upload a custom certificate](../../custom-certificates) or purchase [Advanced Certificate Manager](../../advanced-certificate-manager) before disabling Universal SSL.
+
+If you disable Universal SSL, you may experience errors with the following scenarios:
+- **Enabled features**:
+    - [HTTP Strict Transport Security (HSTS)](../../http-strict-transport-security)
+    - Always Use HTTPS
+    - [Opportunistic Encryption](https://support.cloudflare.com/hc/articles/227253688)
+- **Other setups**:
+    - [Page rules](https://support.cloudflare.com/hc/articles/218411427) that redirect traffic to HTTPS
+    - HTTP to HTTPS redirects at your origin web server
+
+## Disable Universal SSL
+
+To disable Universal SSL:
+1. Make sure you have [uploaded a custom certificate](../../custom-certificates) or purchased [Advanced Certificate Manager](../../advanced-certificate-manager) to protect your domain.
+1. Log in to the Cloudflare dashboard and select your account.
+1. Select your domain.
+1. Go to **SSL/TLS** > **Edge Certificates**.
+1. For **Disable Universal SSL**, select **Disable Universal SSL**.
+1. Read the warnings in the **Acknowledgement**.
+1. Select **I Understand** and click **Confirm**.
diff --git a/products/ssl/src/content/edge-certificates/universal-ssl/enable-universal-ssl.md b/products/ssl/src/content/edge-certificates/universal-ssl/enable-universal-ssl.md
new file mode 100644
index 00000000000..20b2c49e074
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/universal-ssl/enable-universal-ssl.md
@@ -0,0 +1,20 @@
+---
+order: 1
+pcx-content-type: how-to
+---
+
+# Enable Universal SSL
+
+## Authoritative (Full) domains
+
+For an authoritative or full domain — domains that changed their [domain nameservers](https://support.cloudflare.com/hc/articles/205195708) – Universal SSL requires two steps:
+1. Once you change your domain nameservers, your domain should receive its Universal SSL certificate within **24 hours**.
+1. Your SSL/TLS mode defaults to [Flexible](/origin-configuration/ssl-modes#flexible), which encrypts traffic between a site visitor and Cloudflare (but not Cloudflare and your origin server). To encrypt traffic between Cloudflare and your origin server, see [SSL modes](/origin-configuration/ssl-modes) and [Origin CA certificates](/origin-configuration/origin-ca).
+
+## Non-authoritative (Partial) domains
+
+For non-authoritative or partial domains (domains on a CNAME setup), Universal SSL will be:
+- Provisioned once the DNS record is [proxied through Cloudflare](https://support.cloudflare.com/hc/articles/360020348832#h_836723523521544131668686) (orange-clouded).
+- Validated:
+    - Immediately if you add [Domain Control Validation (DCV)](../changing-dcv-method) records to your authoritative DNS.
+    - After a brief period of downtime if you **do not** add DCV records (once your traffic is proxied).
\ No newline at end of file
diff --git a/products/ssl/src/content/edge-certificates/universal-ssl/index.md b/products/ssl/src/content/edge-certificates/universal-ssl/index.md
new file mode 100644
index 00000000000..33da9a32501
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/universal-ssl/index.md
@@ -0,0 +1,23 @@
+---
+order: 0
+pcx-content-type: concept
+---
+
+# Universal SSL
+
+Cloudflare issues — and renews — free, publicly trusted SSL certificates to all Cloudflare domains. 
+
+When you proxy your traffic through Cloudflare, this process happens **automatically and within 24 hours of domain activation**. Provisioning time depends on certain security checks and other requirements mandated by Certificate Authorities (CA).
+
+When you **do not proxy** your traffic through Cloudflare (a CNAME setup), you will need to perform the additional steps described in [Enable Universal SSL](enable-universal-ssl#non-authoritative-partial-domains).
+
+<ButtonGroup>
+    <Button type='primary' href='enable-universal-ssl'>Get started</Button>
+    <Button type='secondary' href="https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/">Learn more</Button>
+</ButtonGroup>
+
+<Aside type="note">
+
+For sites that require an SSL certificate prior to migrating traffic to Cloudflare, purchase <a href="../advanced-certificate-manager">Advanced Certificate Manager</a> or upload a <a href="../custom-certificates">Custom SSL certificate</a> before proxying traffic to Cloudflare.
+
+</Aside>
\ No newline at end of file
diff --git a/products/ssl/src/content/edge-certificates/universal-ssl/limitations.md b/products/ssl/src/content/edge-certificates/universal-ssl/limitations.md
new file mode 100644
index 00000000000..de44f1c8885
--- /dev/null
+++ b/products/ssl/src/content/edge-certificates/universal-ssl/limitations.md
@@ -0,0 +1,26 @@
+---
+title: Limitations
+order: 3
+pcx-content-type: reference
+---
+
+# Limitations for Universal SSL
+
+Universal SSL certificates are limited by the hostnames they cover and the browsers they support.
+
+## Hostname coverage
+
+### Full setup
+
+Universal SSL certificates only support SSL for the root or first-level subdomains such as `example.com` and `www.example.com`. To enable SSL support on second, third, and fourth-level subdomains such as `dev.www.example.com` or `app3.dev.www.example.com`, you can:
+
+- Purchase [Advanced Certificate Manager](../../advanced-certificate-manager)
+- Upgrade to a Business or Enterprise plan to [upload a Custom SSL certificate](../../custom-certificates)
+
+### CNAME setup
+
+On a CNAME setup zone, each subdomain has its own Universal SSL certificate and does not require additional features or purchases.
+
+## Browser support
+
+For more on browser support, see [Browser compatibility](/ssl-tls/browser-compatibility).
\ No newline at end of file
diff --git a/products/ssl/src/content/keyless-ssl/configuration.md b/products/ssl/src/content/keyless-ssl/configuration.md
index c4b8f0ccdbc..71fbff02e43 100644
--- a/products/ssl/src/content/keyless-ssl/configuration.md
+++ b/products/ssl/src/content/keyless-ssl/configuration.md
@@ -34,7 +34,7 @@ You need to create a public DNS record for your key server. If you are using Clo
 
 </Aside>
 
-1. Use `openssl rand 24 -hex` to generate a long, random hostname such as `11aa40b4a5db06d4889e48e2f738950ddfa50b7349d09b5f.example.com`
+1. Use `openssl rand -hex 24` to generate a long, random hostname such as `11aa40b4a5db06d4889e48e2f738950ddfa50b7349d09b5f.example.com`
 2. Add this record via your DNS provider’s interface as an ‘A’ record pointing to the IP address of your Keyless SSL server
 3. Use this hostname as the server hostname during initialization of your Keyless SSL server
 
@@ -113,4 +113,4 @@ If this command fails, try troubleshooting by [checking the logs](/keyless-ssl/t
 
 During TLS handshakes, Cloudflare’s keyless client will initiate connections to the key server hostname or IP address you specify during certificate upload. By default, the keyless client will use a destination TCP port of 2407, but this can be changed during certificate upload or by editing the certificate details after upload.
 
-Create firewall rules that allow your key server to accept connections from only Cloudflare. We publish our IPv4 and IPv6 addresses via our API.
\ No newline at end of file
+Create firewall rules that allow your key server to accept connections from only Cloudflare. We publish our IPv4 and IPv6 addresses via our API.
diff --git a/products/ssl/src/content/keyless-ssl/hardware-security-modules/azure-managed-hsm.md b/products/ssl/src/content/keyless-ssl/hardware-security-modules/azure-managed-hsm.md
index 7835b6e0ba8..5ddabcec6fa 100644
--- a/products/ssl/src/content/keyless-ssl/hardware-security-modules/azure-managed-hsm.md
+++ b/products/ssl/src/content/keyless-ssl/hardware-security-modules/azure-managed-hsm.md
@@ -47,7 +47,11 @@ brew install azure-cli
     $ az login
     $ az group create --name HSMgroup --location southcentralus
     ```
-    <Aside type="note" header="Note:">The public preview of Managed HSM is available in the following regions: East US 2, South Central US, North Europe, and West Europe</Aside>
+    <Aside type="note" header="Note:">
+    
+    For a list of supported regions, see the <a href="https://azure.microsoft.com/en-us/global-infrastructure/services/?products=key-vault">Microsoft documentation</a>.
+    
+    </Aside>
 
 1. [Create, provision, and activate](https://docs.microsoft.com/en-us/azure/key-vault/managed-hsm/quick-create-cli) the HSM.
 1. Add your private key to the `keyvault`, which returns the URI you need for **Step 4**:
diff --git a/products/ssl/src/content/keyless-ssl/hardware-security-modules/index.md b/products/ssl/src/content/keyless-ssl/hardware-security-modules/index.md
index ee91fbb8e7c..4bc533b6f8d 100644
--- a/products/ssl/src/content/keyless-ssl/hardware-security-modules/index.md
+++ b/products/ssl/src/content/keyless-ssl/hardware-security-modules/index.md
@@ -21,7 +21,7 @@ Moreover, many HSMs are also capable of generating keys, producing cryptographic
 
 The key server communicates with HSMs via PKCS#11, so any HSM supporting the standard can be used with Keyless SSL. We have verified interoperability with the following modules:
 
-* [Gemalto SafeNet Luna](https://safenet.gemalto.com/data-encryption/hardware-security-modules-hsms/fips-common-criteria-validations/)
+* [Gemalto SafeNet Luna](https://cpl.thalesgroup.com/compliance/fips-common-criteria-validations)
 * [SoftHSMv2](https://github.com/opendnssec/SoftHSMv2)
 * [Entrust nShield Connect](https://www.entrust.com/digital-security/hsm)
 * [YubiKey Neo](https://www.yubico.com/product/yubikey-neo/)
diff --git a/products/ssl/src/content/keyless-ssl/scaling-and-benchmarking.md b/products/ssl/src/content/keyless-ssl/scaling-and-benchmarking.md
index d1329559e8c..2725e30e00d 100644
--- a/products/ssl/src/content/keyless-ssl/scaling-and-benchmarking.md
+++ b/products/ssl/src/content/keyless-ssl/scaling-and-benchmarking.md
@@ -19,7 +19,7 @@ Key servers support both ECDSA and RSA keys, though signatures for RSA are an [o
 
 Because ECDSA signing can be broken down into two steps, where the first step of generating random values (to be used later with the private key and message to be signed) represents the majority of the computational cost, we pre-generate these random values to significantly reduce latency. ECDSA signing requests are computationally isolated from RSA signing requests using separate worker pools to keep them as fast as possible.
 
-Additional details can be found in the [gokeyless server readme file](https://github.com/cloudflare/gokeyless/blob/master/server/README.md) file.
+Additional details can be found in the [gokeyless server readme file](https://github.com/cloudflare/gokeyless#readme) file.
 
 --------
 
diff --git a/products/ssl/src/content/mutual-authentication/index.md b/products/ssl/src/content/mutual-authentication/index.md
index 78cae46942e..180afffd2f4 100644
--- a/products/ssl/src/content/mutual-authentication/index.md
+++ b/products/ssl/src/content/mutual-authentication/index.md
@@ -5,4 +5,4 @@ pcx-content-type: navigation
 
 # Mutual authentication
 
-See [Cloudflare Access — Mutual TLS](https://developers.cloudflare.com/access/service-auth/mtls/).
+See [Cloudflare Access — Mutual TLS](https://developers.cloudflare.com/cloudflare-one/identity/devices/mutual-tls-authentication).
diff --git a/products/ssl/src/content/notifications/index.md b/products/ssl/src/content/notifications/index.md
new file mode 100644
index 00000000000..564b6f3cf92
--- /dev/null
+++ b/products/ssl/src/content/notifications/index.md
@@ -0,0 +1,39 @@
+---
+order: 200
+pcx-content-type: reference
+---
+
+# Notifications
+
+In your [account notifications](https://dash.cloudflare.com/?to=/:account/notifications), set up alerts for the following SSL areas:
+- Universal SSL
+- Dedicated SSL
+- SSL for SaaS Custom Hostnames
+
+These alerts cover certificate validation status, issuance, deployment, renewal, and expiration notices.
+
+## Set up notifications
+
+To set up notifications:
+1. From your account homepage, click **Notifications**.
+1. Select **Add**.
+1. Select an alert type.
+1. Fill in the required information and select **Create**.
+
+To edit, delete, or disable notifications, you can also go to [account notifications](https://dash.cloudflare.com/?to=/:account/notifications).
+
+## Respond to notifications
+
+You may want to take different actions based on the type of notification.
+
+### Success notifications
+
+If you receive a success alert — such as successful validation or deployment — no additional action is required.
+
+### Failure notifications
+
+If you receive a failure alert — such as a failed validation or certificate deletion — refer to the alert itself for suggested fixes or additional information.
+
+### Miscellaneous notifications
+
+If you receive another type of alert — such as a certificate expiration notice — refer to the alert itself for suggested fixes or additional information.
diff --git a/products/ssl/src/content/origin-configuration/authenticated-origin-pull.md b/products/ssl/src/content/origin-configuration/authenticated-origin-pull.md
index bd8818f6f2d..9828eb312d7 100644
--- a/products/ssl/src/content/origin-configuration/authenticated-origin-pull.md
+++ b/products/ssl/src/content/origin-configuration/authenticated-origin-pull.md
@@ -5,9 +5,9 @@ pcx-content-type: interim
 
 # Authenticated origin pull
 
-Authenticated origin pulls add an extra layer of security to your domain.
+Authenticated origin pulls ensure requests to your origin server come from the Cloudflare network.
 
-This authentication becomes particularly important with the Cloudflare Web Application Firewall (WAF). Together with the WAF, you can make sure that **all traffic** is evaluated before reaching your origin server.
+This authentication becomes particularly important with the Cloudflare Web Application Firewall (WAF). Together with the WAF, you can make sure that **all traffic** is evaluated before receiving a response from your origin server.
 
 <ButtonGroup>
     <Button type="primary" href="#set-up-authenticated-origin-pulls">Get started</Button>
@@ -26,7 +26,7 @@ Authenticated Origin Pull is incompatible with Railgun.
 
 When visitors request content from your domain, Cloudflare first attempts to serve content from the cache. Failing that, Cloudflare sends a request — or an `origin pull` — back to your origin web server to get the content.
 
-Authenticated origin pulls make sure that all of these `origin pulls` come from Cloudflare. Put another way, authenticated origin pulls ensure that any HTTPS requests outside of Cloudflare are blocked from reaching your origin.
+Authenticated origin pulls make sure that all of these `origin pulls` come from Cloudflare. Put another way, authenticated origin pulls ensure that any HTTPS requests outside of Cloudflare will not receive a response from your origin.
 
 <Aside type='note' header='Note'>
 
@@ -60,14 +60,17 @@ Authenticated Origin Pull does not work in **SSL** mode _Off_ (not secure) or _F
 
 --------
 
-### Zone-Level — Cloudflare certificates
+### Zone-Level — Cloudflare certificate
+
+#### Certificate value
 
 Cloudflare uses the following CA to sign certificates for the Authenticated Origin Pull service:
 <details>
 <summary>Certificate value</summary>
 <div>
 
-`-----BEGIN CERTIFICATE-----
+```text
+-----BEGIN CERTIFICATE-----
 MIIGCjCCA/KgAwIBAgIIV5G6lVbCLmEwDQYJKoZIhvcNAQENBQAwgZAxCzAJBgNV
 BAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMRQwEgYDVQQLEwtPcmln
 aW4gUHVsbDEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZv
@@ -101,18 +104,50 @@ bA+JbyJeUMtU7KMsxvx82RmhqBEJJDBCJ3scVptvhDMRrtqDBW5JShxoAOcpFQGm
 iYWicn46nPDjgTU0bX1ZPpTpryXbvciVL5RkVBuyX2ntcOLDPlZWgxZCBp96x07F
 AnOzKgZk4RzZPNAxCXERVxajn/FLcOhglVAKo5H0ac+AitlQ0ip55D2/mf8o72tM
 fVQ6VpyjEXdiIXWUq/o=
------END CERTIFICATE-----`
+-----END CERTIFICATE-----
+```
 
 </div>
 </details>
 
+#### Setup instructions
+
 To enable Authenticated Origin Pull globally on a zone:
 
 1. Install the above certificate at the origin web server to authenticate all connections.
 1. For your [SSL/TLS encryption mode](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls), select **Full**.
-1. Configure the origin web server to accept client certificates.
+1. Configure your [origin web server](#server-installation-instructions) to accept client certificates:
+
+    <details>
+    <summary>Apache example</summary>
+    <div>
+
+    For this example, you would have saved the <a href="#certificate-value">certificate</a> to <code>/path/to/origin-pull-ca.pem</code>.
+
+    ```txt
+    SSLVerifyClient require
+    SSLVerifyDepth 1
+    SSLCACertificateFile /path/to/origin-pull-ca.pem
+    ```
+    </div>
+    </details>
+
+    <details>
+    <summary>NGINX example</summary>
+    <div>
+
+    For this example, you would have saved the <a href="#certificate-value">certificate</a> to <code>/etc/nginx/certs/cloudflare.crt</code>.
+
+    ```txt
+    ssl_client_certificate /etc/nginx/certs/cloudflare.crt;
+    ssl_verify_client on;
+    ```
+    </div>
+    
+    
+    </details>
 1. Enable **Authenticated Origin Pulls**:
-    - In the [dashboard](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin), go to **Authenticated Origin Pools** and select **On**.
+    - In the [dashboard](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin), go to **Authenticated Origin Pulls** and select **On**.
     - For the API, [change the TLS Client Auth setting](https://api.cloudflare.com/#zone-settings-change-tls-client-auth-setting):
 
         ```bash
@@ -201,7 +236,7 @@ To enable Authenticated Origin Pull globally on a zone:
     ```
 
 1. Enable **Authenticated Origin Pulls**:
-    - In the [dashboard](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin), go to **Authenticated Origin Pools** and select **On**.
+    - In the [dashboard](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin), go to **Authenticated Origin Pulls** and select **On**.
     - For the API, [set the enablement for a zone](https://api.cloudflare.com/#zone-level-authenticated-origin-pulls-set-enablement-for-zone):
 
         ```bash
diff --git a/products/ssl/src/content/origin-configuration/index.md b/products/ssl/src/content/origin-configuration/index.md
index cdd5ae555c3..88b6fa35465 100644
--- a/products/ssl/src/content/origin-configuration/index.md
+++ b/products/ssl/src/content/origin-configuration/index.md
@@ -1,9 +1,10 @@
 ---
+title: Origin server
 order: 7
 pcx-content-type: navigation
 ---
 
-# Origin configuration
+# Origin server
 
 Learn more about SSL/TLS protection options for your origin servers:
 
diff --git a/products/ssl/src/content/origin-configuration/origin-ca.md b/products/ssl/src/content/origin-configuration/origin-ca.md
index 196a18d8a17..708d656e0c0 100644
--- a/products/ssl/src/content/origin-configuration/origin-ca.md
+++ b/products/ssl/src/content/origin-configuration/origin-ca.md
@@ -1,27 +1,144 @@
 ---
+title: Origin CA certificates
 order: 3
-pcx-content-type: concept
+pcx-content-type: interim
 ---
 
-# Origin CA
+# Managing Cloudflare Origin CA certificates
 
-Cloudflare Origin Certificates are free SSL certificates issued by Cloudflare for installation on your origin server to facilitate end-to-end encryption for your visitors using HTTPS. Once deployed, they are [compatible with the Strict SSL mode](/origin-configuration/ssl-modes#strict).
+Use Origin Certificate Authority (CA) certificates to encrypt traffic between Cloudflare and your origin web server and reduce origin bandwidth consumption. Once deployed, these certificates are compatible with [Strict SSL mode](/origin-configuration/ssl-modes#strict).
 
-Some origin web servers require upload of the Cloudflare Origin CA root certificate. Click on a link below to download either an RSA and ECC version of the Cloudflare Origin CA root certificate:
+<Aside type="note">
+For more background information on Origin CA certificates, see the <a href="https://blog.cloudflare.com/cloudflare-ca-encryption-origin/">introductory blog post</a>.
+</Aside>
 
-- [Cloudflare Origin ECC PEM](../static/origin_ca_ecc_root.pem)
+---
+
+## Deploy an Origin CA certificate
+
+### 1. Create an Origin CA certificate
+
+To create an Origin CA certificate in the dashboard:
+1. Log in to the Cloudflare dashboard and select an account.
+1. Choose a domain.
+1. Go to **SSL/TLS** > **Origin Server**.
+1. Click **Create Certificate**.
+1. Choose either:
+    - **Generate private key and CSR with Cloudflare**: Private key type can be RSA or ECDSA.
+    - **Use my private key and CSR**: Paste the Certificate Signing Request into the text field.
+1. List the [hostnames (including wildcards)](#hostname-and-wildcard-coverage) the certificate should protect with SSL encryption. The zone root and first level wildcard hostname are included by default.
+1. Choose the [expiration date](#expiration).
+1. Click **Next**.
+1. Choose the **Key Format**:
+    - Servers using OpenSSL — like Apache and NGINX — generally expect PEM files (Base64-encoded ASCII), but also work with binary DER files.
+    - Servers using Windows and Apache Tomcat require PKCS#7 (a `.p7b` file).
+1. Copy the signed **Origin Certificate** and **Private Key** into separate files. For security reasons, you cannot see the **Private Key** after you exit this screen.
+1. Click **OK**. 
+
+<Aside type="note">For details about working with certificates programmatically, see <a href="#api-calls">API calls</a>.</Aside>
+
+### 2. Install Origin CA certificate on origin server
+
+To add an Origin CA certificate to your origin web server
+
+1. Upload the Origin CA certificate (created in [Step 1](#1-create-an-origin-ca-certificate)) to your origin web server.
+1. Update your web server configuration:
+    <details>
+    <summary>Configuration guides for popular servers</summary>
+    <div>
+    
+    - [Apache httpd](https://www.digicert.com/kb/csr-ssl-installation/apache-openssl.htm)
+    - [GoDaddy Hosting](https://www.digitalcandy.agency/website-tips/cloudflare-origin-ca-free-ssl-installation-on-godaddy/)
+    - [Microsoft IIS 7](https://www.digicert.com/csr-ssl-installation/iis-7.htm#ssl_certificate_install)
+    - [Microsoft IIS 8 and 8.5](https://www.digicert.com/csr-ssl-installation/iis-8-and-8.5.htm#ssl_certificate_install)
+    - [Microsoft IIS 10](https://www.digicert.com/kb/csr-creation-ssl-installation-iis-10.htm)
+    - [NGINX](https://www.digicert.com/kb/csr-ssl-installation/nginx-openssl.htm)
+    - [Apache Tomcat](https://www.digicert.com/csr-ssl-installation/tomcat-keytool.htm#ssl_certificate_install)
+    - [Amazon Web Services](https://www.digicert.com/ssl-certficate-installation-amazon-web-services.htm)
+    - [Apache cPanel](https://www.digicert.com/kb/ssl-certificate-installation-apache-cpanel.htm)
+    - [Ubuntu Server with Apache2](https://www.digicert.com/kb/csr-ssl-installation/ubuntu-server-with-apache2-openssl.htm#ssl_certificate_install)
+
+    If you do not see your server in the list above, search the [Digicert documentation](https://www.digicert.com/search-results) or contact your hosting provider, web admin, or server vendor.
+    </div>
+    </details>
+1. (required for some) Upload the [Cloudflare CA root certificate](#4-required-for-some-add-cloudflare-origin-ca-root-certificates) to your origin server.
+1. Enable SSL and port 443 at your origin web server.
+
+### 3. Change SSL/TLS mode
+
+After you have installed the Origin CA certificate on your origin web server, update the SSL/TLS encryption mode for your application.
+
+If all your origin hosts are protected by Origin CA certificates or publicly trusted certificates:
+1. Go to **SSL/TLS**.
+1. For **SSL/TLS encryption mode**, select **Full (strict)**.
+
+If you have origin hosts that are not protected by certificates, set the **SSL/TLS encryption** mode for a specific application to **Full (strict)** by using a [Page Rule](https://support.cloudflare.com/hc/articles/218411427).
+
+### 4. (required for some) Add Cloudflare Origin CA root certificates
+
+Some origin web servers require upload of the Cloudflare Origin CA root certificate. Click a link below to download either an RSA and ECC version of the Cloudflare Origin CA root certificate:
+
+- [Cloudflare Origin ECC PEM](../static/origin_ca_ecc_root.pem) (do not use with Apache cPanel)
 - [Cloudflare Origin RSA PEM](../static/origin_ca_rsa_root.pem)
 
-## Hostname/wildcard coverage
-Certificates may be generated with up to 100 individual Subject Alternative Names (SANs). A SAN can take the form of a fully-qualified domain name (`www.example.com`) or a wildcard (`*.example.com`); IP addresses are not permitted as SANs on Cloudflare Origin Certificates.
+## Revoke an Origin CA certificate
+
+If you misplace your key material or do not want a certificate to be trusted, you may want to revoke your certificate. You cannot undo this process.
+
+To prevent visitors from seeing warnings about an insecure certificate, you may want to set your [SSL/TLS encryption](/origin-configuration/ssl-modes) to **Full** or **Flexible** before revoking your certificate. Do this globally via the **SSL/TLS** app or for a specific hostname via a **Page Rule**.
+
+To revoke a certificate:
+1. Log in to the Cloudflare dashboard and select an account.
+1. Choose a domain.
+1. Go to **SSL/TLS** > **Origin Server**.
+1. In **Origin Certificates**, choose a certificate.
+1. Click **Revoke**.
+
+## Additional details
+
+### Hostname and wildcard coverage
+Certificates may be generated with up to 100 individual Subject Alternative Names (SANs). A SAN can take the form of a fully-qualified domain name (`www.example.com`) or a wildcard (`*.example.com`). You cannot use IP addresses as SANs on Cloudflare Origin CA certificates.
+
+Wildcards may only cover one level, but can be used multiple times on the same certificate for broader coverage (for example, `*.example.com` and `*.secure.example.com` may co-exist).
+
+### Expiration
+By default, newly generated certificates are valid for 15 years. If you wish to generate shorter-lived certificates (for example, as short as 7 days), use the [API](#api-calls).
 
-Wildcards may only cover one level, but can be used multiple times on the same certificate for broader coverage (e.g., `*.example.com` and `*.secure.example.com` may co-exist).
+## API calls
+To automate processes involving Origin CA certificates, use the following API calls.
 
-## Expiration
-By default, newly generated certificates are valid for 15 years. If you wish to generate shorter-lived certificates (e.g., as short as 7 days), you should use the API.
+<table style="width:100%">
+   <thead>
+        <tr>
+            <th>Operation</th>
+            <th>Method + URL stub</th>
+            <th>Notes</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#origin-ca-list-certificates'>List Certificates</a></td>
+            <td><code>GET&nbsp;certificates/:zone_id</code></td>
+            <td></td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#origin-ca-create-certificate'>Create Certificate</a></td>
+            <td><code>POST&nbsp;certificates/:zone_id</code></td>
+            <td>See the API documentation for a full list of optional parameters, but some are also described in the <a href="#additional-details">Details</a> section of this page.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#origin-ca-get-certificate'>Get Certificate</a></td>
+            <td><code>GET&nbsp;certificates/:certificate_id</code></td>
+            <td></td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#origin-ca-revoke-certificate'>Revoke Certificate</a></td>
+            <td><code>DELETE&nbsp;certificates/:certificate_id</code></td>
+            <td>Additional details and warnings in <a href="#revoke-an-origin-ca-certificate">Revoke an Origin CA certificate</a></td>
+        </tr>
+    </tbody>
+</table>
 
-## Revocation
-If you misplace your key material or wish to indicate that a certificate should otherwise no longer be trusted, you can click the “x” icon to the far-right of the Origin Certificate and click “OK”. This process cannot be undone.
+## Troubleshooting
 
-## Automated issuance
-Our API allows you to [automate the issuance of Origin Certificates](https://api.cloudflare.com/#origin-ca).In the future, an ACME endpoint will be provided.
+Site visitors may see untrusted certificate errors if you pause or disable Cloudflare on subdomains that use Origin CA certificates. These certificates only encrypt traffic between Cloudflare and your origin server, not traffic from client browsers to your origin.
\ No newline at end of file
diff --git a/products/ssl/src/content/ssl-for-saas/common-api-calls.md b/products/ssl/src/content/ssl-for-saas/common-api-calls.md
index 26f30758088..e036f121942 100644
--- a/products/ssl/src/content/ssl-for-saas/common-api-calls.md
+++ b/products/ssl/src/content/ssl-for-saas/common-api-calls.md
@@ -95,7 +95,7 @@ $ curl -sX GET https://api.cloudflare.com/client/v4/zones/{zone_id}/custom_hostn
 
 ## Fallback origin configuration
 
-The “fallback origin” of a zone is the origin hostname to which all custom hostnames requests are sent (unless the hostname is overriden with a *custom_origin_server*). All users may retrieve the fallback origin value, but setting it via API requires additional account permissions.
+The “fallback origin” of a zone is the origin hostname to which all custom hostnames requests are sent (unless the hostname is overridden with a *custom_origin_server*). All users may retrieve the fallback origin value, but setting it via API requires additional account permissions.
 
 ### 1. Error codes
 
diff --git a/products/ssl/src/content/ssl-for-saas/getting-started.md b/products/ssl/src/content/ssl-for-saas/getting-started.md
index d0458fc509e..28628c20111 100644
--- a/products/ssl/src/content/ssl-for-saas/getting-started.md
+++ b/products/ssl/src/content/ssl-for-saas/getting-started.md
@@ -8,32 +8,35 @@ pcx-content-type: tutorial
 --------
 
 ## Configure zone with proxy fallback origin
-The fallback origin is used to route the traffic of your Custom Hostnames.  The fallback record is the value of the DNS record you set up via step 2 below.
+The fallback origin is where the traffic of your Custom Hostnames will be routed to. The fallback record is the value of the DNS record you set up via step 2.
 
 1. Sign up your desired zone at [www.cloudflare.com](https://www.cloudflare.com) and select the Free plan.
-2. Add a DNS record pointing to the origin (fallback origin) for Cloudflare to send custom hostname traffic. This hostname is not provided to customers.  Name the hostname according to your naming convention.  For example: `proxy-fallback.saasprovider.com`.
-3. Set up an additional DNS CNAME record to serve as the CNAME target for your end customers.  CNAME this record to your fallback origin, and use a more user-friendly CNAME target for customers.  This record can optionally be a wildcard, e.g. `*.customers.saasprovider.com`.
-4. Upgrade your zone to an Enterprise plan.
-5. Retrieve your zone’s
-    * __[Global API Key](https://support.cloudflare.com/hc/articles/200167836#12345682)__, and
-    * __Zone ID__ (via the __Overview__ app of the Cloudflare dashboard). Alternatively, [retrieve a user’s zones and associated Zone IDs](https://api.cloudflare.com/#zone-list-zones) via the Cloudflare API.
-6. Set the fallback origin via API (change `proxy-fallback.saasprovider.com` to the fallback origin record you configured in Cloudflare DNS):
-
-```bash
-$ curl -XPUT
-"https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/custom_hostnames/fallback_origin"\
--H "X-Auth-Email: {email}" -H "X-Auth-Key: {key}"\
--H "Content-Type: application/json"\
--d '{"origin":"proxy-fallback.saasprovider.com"}'
-```
+1. Click **DNS**.
+1. Add a DNS record pointing to the origin IP address (fallback origin) for Cloudflare to send custom hostname traffic. This hostname is not provided to customers. Name the hostname according to your naming convention. For example: `proxy-fallback.saasprovider.com`.
+3. Set up an additional DNS CNAME record to serve as the CNAME target for your end customers. CNAME this record to your fallback origin and use a more user-friendly CNAME target for customers. This record can optionally be a wildcard, e.g. `*.customers.saasprovider.com`.
+![Add a CNAME record](..//static/ssl-for-saas-dns.png)
+4. Upgrade your zone to an Enterprise plan and contact your Customer Success Manager to enable **SSL for SaaS Certificates**.
+5. Set the **Fallback Origin** via either the dashboard or API.
+    * Via the dashboard: Go to **SSL/TLS** > **Custom Hostnames**, add your fallback origin defined in step 2 above, and click **Add**.
+    ![Add a fallback origin on dashboard](..//static/ssl-for-saas-add-fallback.png)
+
+    * Via API: Retrieve your [Global API Key and Zone ID](#api-key-and-zone-id). Then, set the fallback origin via API (change `proxy-fallback.saasprovider.com` to the fallback origin record you configured in Cloudflare DNS):
+
+        ```bash
+        $ curl -XPUT \
+        "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/custom_hostnames/fallback_origin"\
+        -H "X-Auth-Email: {email}" -H "X-Auth-Key: {key}"\
+        -H "Content-Type: application/json"\
+        -d '{"origin":"proxy-fallback.saasprovider.com"}'
+        ```
 
 --------
 
 ## Certificate Validation vs Hostname Verification
 Each Custom Hostname requires successful Certificate Validation and Hostname Verification.
 
-* __[Certificate Validation](https://developers.cloudflare.com/ssl/ssl-for-saas/certificate-validation-methods/)__: Upon successful validation, the certificates are deployed to Cloudflare’s edge network.
-* __[Hostname Verification](https://developers.cloudflare.com/ssl/ssl-for-saas/hostname-verification/)__: Upon successful validation, Cloudflare proxies traffic for this hostname.
+* [Certificate Validation](../certificate-validation-methods): Upon successful validation, the certificates are deployed to Cloudflare’s edge network.
+* [Hostname Verification](../hostname-verification/): Upon successful validation, Cloudflare proxies traffic for this hostname.
 
 [Create Custom Hostnames via the custom_hostnames API endpoint](https://api.cloudflare.com/#custom-hostname-for-a-zone-create-custom-hostname).
 
@@ -41,15 +44,15 @@ Each Custom Hostname requires successful Certificate Validation and Hostname Ver
 
 ## API key and zone ID
 
-Your API key can be found in the Cloudflare dashboard under ‘My Profile → Global API Key’.
+Your API key can be found in the Cloudflare dashboard under ‘My Profile → API Tokens → Global API Key’.
 
 ![Accessing an account’s Global API Key](..//static/accessing-global-api-key.png)
 
-The zone tag and API key can also be found in the ‘Overview’ tile of the UI:
+The zone tag and API key can also be found in the **Overview** tab of the dashboard:
 
 ![Obtaining a zone’s ID](..//static/obtaining-zone-id.png)
 
-Additionally you can retrieve a list of user’s zones and their associated IDs via an API call. List all zones for a user: https://api.cloudflare.com/#zone-list-zones.
+Additionally, you can retrieve a list of user’s zones and their associated IDs via an API call. List all zones for a user: https://api.cloudflare.com/#zone-list-zones.
 
 --------
 
@@ -57,15 +60,32 @@ Additionally you can retrieve a list of user’s zones and their associated IDs
 
 Once your account has been provisioned, you are ready to issue certificates. The call below will provision a request for certificates to be issued for `app.customer.com`, which represents your end customer.
 
-In this example, HTTP based validation is used ("method":"http") to issue this certificate. This requires HTTP traffic to be proxied through Cloudflare’s edge already, i.e., the CNAME from `app.customer.com` must be in place to your zone. If the CNAME is not yet in place, Cloudflare will ask its CA partner to retry until the request can be completed; see the [Validation Backoff Schedule](/ssl-for-saas/validation-backoff-schedule/) for specific timings.
+In this example, HTTP based validation is used ("method":"http") to issue this certificate. This requires HTTP traffic to be proxied through Cloudflare’s edge already, i.e., the CNAME from `app.customer.com` must be [in place for your zone](#setting-cname-at-customer-domain)). If the CNAME is not yet in place, Cloudflare will ask its CA partner to retry until the request can be completed; see the [Validation Backoff Schedule](/ssl-for-saas/validation-backoff-schedule/) for specific timings.
 
 ```bash
 $ curl -XPOST "https://api.cloudflare.com/client/v4/zones/:zone_id/custom_hostnames"\
        -H "X-Auth-Email: {email}" -H "X-Auth-Key: {key}"\
        -H "Content-Type: application/json"\
-       -d '{"hostname":"app.example.com", "ssl":{"method":"http","type":"dv"}}'
+       -d '{"hostname":"app.customer.com", "ssl":{"method":"http","type":"dv"}}'
 ```
 
 Note that it’s possible to serve these HTTP records from your own web servers, in advance of placing the CNAME. The payload returned includes the path where the CA will look for the challenge along with the body that should be returned.
 
+Alternatively, you may also issue certificates to custom hostnames via the dashboard: 
+1. Navigate to **SSL/TLS** > **Custom Hostnames** and click **Add Custom Hostname**.
+1. Add your customer's hostname `app.customer.com` and set the relevant options, including:
+    - Choosing the [Validation method](../certificate-validation-methods).
+    - Whether you want to **Enable wildcard**, which adds a `*.<custom-hostname>` SAN to the custom hostname certificate. For more details, see [Hostname priority](/ssl-tls/certificate-and-hostname-priority#hostname-priority).
+1. Click **Add Custom Hostname**.
+1. You will be brought back to the previous screen, which will show “Pending” before it changes to “Active” within 5 minutes. If you see an error stating “custom hostname does not CNAME to this zone”, you need to [set the DNS record at the customer's domain](#setting-cname-at-customer-domain).
+
 Once domain validation has been completed, the certificates will be issued and distributed to Cloudflare’s edge. With a CNAME in place, the entire process—from validation to issuance to edge deployment—completes in approximately 90 seconds.
+
+--------
+
+## Setting CNAME at customer domain
+Your customer needs to set up a CNAME record at their DNS provider, pointing to your CNAME target configured in [a previous step](#configure-zone-with-proxy-fallback-origin). For example:
+```txt
+app CNAME john.customers.saasprovider.com
+```
+This routes traffic from `app.customer.com` to your origin.
diff --git a/products/ssl/src/content/ssl-for-saas/hostname-verification.md b/products/ssl/src/content/ssl-for-saas/hostname-verification.md
index 66597d7dc3d..e3acda1d7bd 100644
--- a/products/ssl/src/content/ssl-for-saas/hostname-verification.md
+++ b/products/ssl/src/content/ssl-for-saas/hostname-verification.md
@@ -152,7 +152,7 @@ Various hostname verification errors include:
 </tr>
 <tr>
 <td style='width:50%; word-wrap:break-word; white-space:normal'>None of the A or AAAA records are owned by this account and the pre-generated ownership verification token was not found</td>
-<td>Account has apex proxying enabled but custom.</td>
+<td>Account has apex proxying enabled but the custom hostname failed the hostname validation check on the A record.</td>
 </tr>
 <tr>
 <td style='width:50%; word-wrap:break-word; white-space:normal'>This account and the pre-generated ownership verification token was not found</td>
diff --git a/products/ssl/src/content/ssl-for-saas/index.md b/products/ssl/src/content/ssl-for-saas/index.md
index d2f2d231da4..98b70277e05 100644
--- a/products/ssl/src/content/ssl-for-saas/index.md
+++ b/products/ssl/src/content/ssl-for-saas/index.md
@@ -5,8 +5,8 @@ pcx-content-type: landing-page
 
 # SSL for SaaS
 
-Cloudflare [SSL for SaaS](https://www.cloudflare.com/saas/) extends the security and performance benefits of Cloudflare’s network to your customers via their own custom or “vanity” domains.  Issuing certificates requires minimal interaction from your customer to add a CNAME from their custom hostname to your domain.
-Once the CNAME is added, a single API call to issue a SSL for SaaS certificate initiates domain validation with a Certificate Authority (CA) and issuance of two SSL certificates:
+Cloudflare [SSL for SaaS](https://www.cloudflare.com/saas/) extends the security and performance benefits of Cloudflare’s network to your customers via their own custom or “vanity” domains. For example, a customer may want to use their “vanity” domain `app.customer.com` to point to an application hosted on your Cloudflare zone `service.saas.com`. Issuing certificates requires minimal interaction from your customer to add a CNAME from their custom hostname to your domain.
+Once the CNAME is added, a single API call to issue an SSL for SaaS certificate initiates domain validation with a Certificate Authority (CA) and issuance of two SSL certificates:
 
 - an SHA-2/ECDSA
 - an SHA-2/RSA
diff --git a/products/ssl/src/content/ssl-for-saas/uploading-certificates.md b/products/ssl/src/content/ssl-for-saas/uploading-certificates.md
index e43781f260e..f1e50b13126 100644
--- a/products/ssl/src/content/ssl-for-saas/uploading-certificates.md
+++ b/products/ssl/src/content/ssl-for-saas/uploading-certificates.md
@@ -39,8 +39,8 @@ OeH8gMJ+FuwtXYEPa4hBf38M5eU5xWG7
 ```
 
 ```txt
-$ MYCERT="$(cat app_example_com.pem|perl -pe 's/\r?\n/\\n/'|sed -e 's/..$//')"
-$ MYKEY="$(cat app_example_com.key|perl -pe 's/\r?\n/\\n/'|sed -e's/..$//')"
+$ MYCERT="$(cat app_example_com.pem|perl -pe 's/\r?\n/\\n/')"
+$ MYKEY="$(cat app_example_com.key|perl -pe 's/\r?\n/\\n/')"
 ```
 
 ```bash
@@ -65,7 +65,7 @@ Note that the serial number returned is unique to the issuer, but not globally u
 
 ```bash
 $ curl -sX POST https://api.cloudflare.com/client/v4/zones/{zone_id}/custom_hostnames\
-    -H "X-Auth-Email: {email}" -H "X-Auth-Key: {key}"
+    -H "X-Auth-Email: {email}" -H "X-Auth-Key: {key}"\
     -H 'Content-Type: application/json' -d "$request_body"
 
 {
diff --git a/products/ssl/src/content/ssl-for-saas/versioning.md b/products/ssl/src/content/ssl-for-saas/versioning.md
index eb2a33b1437..0ca74376f55 100644
--- a/products/ssl/src/content/ssl-for-saas/versioning.md
+++ b/products/ssl/src/content/ssl-for-saas/versioning.md
@@ -18,11 +18,15 @@ SSL for SaaS v2 removes IP-based routing and its associated problems. Instead, t
 
 To ensure that your service is not disrupted, you need to perform an additional ownership check on every new Custom Hostname. There are three methods to verify ownership: TXT, HTTP, and CNAME. Use TXT and HTTP for pre-validation to validate the Custom Hostname before traffic is proxied by Cloudflare’s edge.
 
-### DNS TXT Record
+### Recommended validation methods
+
+Using a [TXT](#dns-txt-record) or [HTTP](#http-token) validation method helps you avoid downtime during your migration. If you choose to use [CNAME validation](#cname-validation), your domain might fall behind on its [backoff schedule](../validation-backoff-schedule).
+
+#### DNS TXT Record
 
 When creating a Custom Hostname with the TXT method through the [API](https://api.cloudflare.com/#custom-hostname-for-a-zone-create-custom-hostname), a TXT ownership_verification record is provided for your customer to add to their DNS for the ownership validation check. When the TXT record is added, the Custom Hostname will be marked as **Active** in the Cloudflare SSL/TLS app under the Custom Hostnames tab. 
 
-### HTTP Token
+#### HTTP Token
 
 When creating a Custom Hostname with the HTTP through the [API](https://api.cloudflare.com/#custom-hostname-for-a-zone-create-custom-hostname), an HTTP ownership_verification token is provided. HTTP verification is used mainly by organizations with a large deployed base of custom domains with HTTPS support. Serving the HTTP token from your origin web server allows hostname verification before proxying domain traffic through Cloudflare.
 
@@ -30,7 +34,11 @@ Cloudflare sends GET requests to the http_url using `User-Agent: Cloudflare Cust
 
 When the HTTP token is verified, the Custom Hostname will be marked as **Active** in the Cloudflare SSL/TLS app under the Custom Hostnames tab. 
 
-### CNAME Validation
+### Other validation methods
+
+Though you can use [CNAME validation](#cname-validation), we recommend you either use a [TXT](#dns-txt-record) or [HTTP](#http-token) validation method.
+
+#### CNAME Validation
 
 Custom Hostnames can also be validated once Cloudflare detects that the Custom Hostname is a CNAME record pointing to the fallback record configured for the SSL for SaaS domain. Though this is the simplest validation method, it increases the risk of errors. Since a CNAME record would also route traffic to Cloudflare’s edge, traffic may reach our edge before the Custom Hostname has completed validation or the SSL certificate has issued.
 
@@ -48,7 +56,33 @@ SSL for SaaS v2 is functionally equivalent to SSL for SaaS v1, but removes the r
 
 Once the migration has been started for your zone(s), Cloudflare will require every Custom Hostname to pass a hostname verification check. Existing Custom Hostnames that are proxying to Cloudflare with a DNS CNAME record will automatically re-validate and migrate to the new version with no downtime. Any Custom Hostnames created after the start of the migration will need to pass the hostname validation check using one of the validation methods mentioned above. 
 
-Your Cloudflare Account Team will work with you to schedule a migration window for each of your SSL for SaaS zones. After the migration has started and has had some time to progress, Cloudflare will generate a list of Custom Hostnames that failed to migrate and ask for your approval to complete the migration. When you give your approval, the migration will be complete, SSL for SaaS v1 will be disabled for the zone, and any Custom Hostname that has not completed hostname validation will no longer function.
+<Aside type='note'>
+
+You can revert the migration at any time.
+
+</Aside>
+
+### Before the migration
+
+Before your migration, you should:
+
+1. To test validation methods, set up a test zone and ask your Solutions Engineer (SE) to enable SSL for SaaS v2.
+1. Wait for your SE to run our pre-migration tool. This tool groups your hostnames into one of the following statuses:
+    - `test_pending`: In the process of being verified or was unable to be verified and re-queued for verification. A custom hostname will be re-queued 25 times before moving to the `test_failed` status.
+    - `test_active`: Passed CNAME verification
+    - `test_active_apex`: Passed Apex Proxy verification
+    - `test_blocked`: Hostname will be blocked during the migration because hostname belongs to a banned zone. Contact your CSM to verify banned custom hostnames and proceed with the migration.
+    - `test_failed`: Failed hostname verification 25 times
+1. Review the results of our pre-migration tool (run by your Solutions Engineer) using one of the following methods:
+    - Via the API: `https://api.cloudflare.com/client/v4/zones/{zone_tag}/custom_hostnames?hostname_status={status}`
+    - Via a CSV file (provided by your SE)
+    - Via the Cloudflare dashboard:
+    ![Review SSL migration status in the dashboard](..//static/ssl-migration-status.png)
+1. Approve the migration. Your Cloudflare account team will work with you to schedule a migration window for each of your SSL for SaaS zones.
+
+## During the migration
+
+After the migration has started and has had some time to progress, Cloudflare will generate a list of Custom Hostnames that failed to migrate and ask for your approval to complete the migration. When you give your approval, the migration will be complete, SSL for SaaS v1 will be disabled for the zone, and any Custom Hostname that has not completed hostname validation will no longer function.
 
 The migration timeline depends on the number of Custom Hostnames. For example, if a zone has fewer than 10,000 Custom Hostnames, the list can be generated around an hour after beginning the migration. If a zone has millions of Custom Hostnames, it may take up to 24 hours to identify instances that failed to successfully migrate. 
 
diff --git a/products/ssl/src/content/ssl-tls/certificate-and-hostname-priority.md b/products/ssl/src/content/ssl-tls/certificate-and-hostname-priority.md
index 6f8d170aab5..e388fe5de8b 100644
--- a/products/ssl/src/content/ssl-tls/certificate-and-hostname-priority.md
+++ b/products/ssl/src/content/ssl-tls/certificate-and-hostname-priority.md
@@ -19,8 +19,8 @@ For any given hostname, Cloudflare uses the following logical order to determine
 
 | Priority | Certificate Type|
 | --- | --- |
-| 1 | [Custom Legacy](/custom-certificates/)|
-| 2 | [Custom SNI-Only](/custom-certificates/)|
+| 1 | [Custom Legacy](/edge-certificates/custom-certificates/)|
+| 2 | [Custom SNI-Only](/edge-certificates/custom-certificates/)|
 | 3 | [Custom Hostname (SSL for SaaS)](/ssl-for-saas/)|
 | 4 | [Dedicated](https://support.cloudflare.com/hc/articles/228009108) or Advanced|
 | 5 | [Universal](/universal-ssl/)|
diff --git a/products/ssl/src/content/ssl-tls/cipher-suites.md b/products/ssl/src/content/ssl-tls/cipher-suites.md
index 17694c5a7d9..6bd9e0368a4 100644
--- a/products/ssl/src/content/ssl-tls/cipher-suites.md
+++ b/products/ssl/src/content/ssl-tls/cipher-suites.md
@@ -41,13 +41,13 @@ AEAD-CHACHA20-POLY1305-SHA256 [^1]|❌|❌|❌|✅
 
 ## Restricting at edge
 
-With [Advanced Certificate Manager (ACM)](../../advanced-certificate-manager), you can restrict connections to specific cipher suites.
+With [Advanced Certificate Manager (ACM)](/edge-certificates/advanced-certificate-manager), you can restrict connections to specific cipher suites.
 
 Restrict these connections at the following levels:
 - [Zone](https://api.cloudflare.com/#zone-settings-change-ciphers-setting)
 - [Hostname](https://api.cloudflare.com/#custom-hostname-for-a-zone-create-custom-hostname)
 
-For more guidance on using ACM, see [Common API Calls](../../advanced-certificate-manager#common-api-commands).
+For more guidance on using ACM, see [Common API Calls](/edge-certificates/advanced-certificate-manager#common-api-commands).
 
 --------
 
diff --git a/products/ssl/src/content/ssl-tls/protocols.md b/products/ssl/src/content/ssl-tls/protocols.md
index 421c5a8f79c..a206c562e9f 100644
--- a/products/ssl/src/content/ssl-tls/protocols.md
+++ b/products/ssl/src/content/ssl-tls/protocols.md
@@ -10,4 +10,4 @@ Cloudflare supports the following TLS protocols:
 * TLS 1.0
 * TLS 1.1
 * TLS 1.2
-* TLS 1.3
\ No newline at end of file
+* TLS 1.3 ([recommended](https://www.cloudflare.com/learning/ssl/why-use-tls-1.3/))
\ No newline at end of file
diff --git a/products/ssl/src/content/static/client-certificates-host-enablement.png b/products/ssl/src/content/static/client-certificates-host-enablement.png
new file mode 100644
index 00000000000..e1816496dc1
Binary files /dev/null and b/products/ssl/src/content/static/client-certificates-host-enablement.png differ
diff --git a/products/ssl/src/content/static/obtaining-zone-id.png b/products/ssl/src/content/static/obtaining-zone-id.png
index 033829abaac..738356c553d 100644
Binary files a/products/ssl/src/content/static/obtaining-zone-id.png and b/products/ssl/src/content/static/obtaining-zone-id.png differ
diff --git a/products/ssl/src/content/static/ssl-for-saas-add-fallback.png b/products/ssl/src/content/static/ssl-for-saas-add-fallback.png
new file mode 100644
index 00000000000..2867c14acc0
Binary files /dev/null and b/products/ssl/src/content/static/ssl-for-saas-add-fallback.png differ
diff --git a/products/ssl/src/content/static/ssl-for-saas-custom-hostname.png b/products/ssl/src/content/static/ssl-for-saas-custom-hostname.png
new file mode 100644
index 00000000000..3cd2ac561ba
Binary files /dev/null and b/products/ssl/src/content/static/ssl-for-saas-custom-hostname.png differ
diff --git a/products/ssl/src/content/static/ssl-for-saas-dns.png b/products/ssl/src/content/static/ssl-for-saas-dns.png
new file mode 100644
index 00000000000..71d8ccd21c9
Binary files /dev/null and b/products/ssl/src/content/static/ssl-for-saas-dns.png differ
diff --git a/products/ssl/src/content/static/ssl-migration-status.png b/products/ssl/src/content/static/ssl-migration-status.png
new file mode 100644
index 00000000000..fab1fe047b8
Binary files /dev/null and b/products/ssl/src/content/static/ssl-migration-status.png differ
diff --git a/products/ssl/src/content/universal-ssl/index.md b/products/ssl/src/content/universal-ssl/index.md
deleted file mode 100644
index 4da51fea1c4..00000000000
--- a/products/ssl/src/content/universal-ssl/index.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-order: 10
-pcx-content-type: concept
----
-
-# Universal SSL
-
-Universal SSL automatically issues—and renews—free, publicly trusted SSL certificates for all Cloudflare domains.
-
-Each zone that signs up must complete domain control validation (DCV), as specified in [_Validating_](/universal-ssl/validating).
diff --git a/products/ssl/src/content/universal-ssl/validating.md b/products/ssl/src/content/universal-ssl/validating.md
deleted file mode 100644
index 61b8fd6e441..00000000000
--- a/products/ssl/src/content/universal-ssl/validating.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-order: 2
-pcx-content-type: reference
----
-
-# Validating
-
-## Authoritative zones
-
-DCV is automatically handled for authoritative (“full”) zones by adding the requisite DNS challenge records to the zone.
-
-## Non-Authoritative zones
-
-Non-authoritative (“partial”) zones must manually add DNS CNAME records as provided in the Cloudflare Dashboard.
\ No newline at end of file
diff --git a/products/stream/docs-config.js b/products/stream/docs-config.js
index 57862245ac0..bb09b6e93dd 100644
--- a/products/stream/docs-config.js
+++ b/products/stream/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Store, encode, deliver, and play videos on your sites and applications.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/stream",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/stream/src/content/faq/index.md b/products/stream/src/content/faq/index.md
index 145218dee8f..62d1f87e457 100644
--- a/products/stream/src/content/faq/index.md
+++ b/products/stream/src/content/faq/index.md
@@ -1,8 +1,10 @@
 ---
+title: FAQ
 order: 6
+pcx-content-type: faq
 ---
 
-# FAQ
+# Frequently asked questions about Cloudflare Stream
 
 ## What formats and quality levels are delivered through Cloudflare Stream?
 
@@ -10,13 +12,19 @@ Cloudflare decides on which bitrate, resolution and codec is best for you. We de
 
 ## Can I download original video files from Stream?
 
-Video cannot be downloaded from Cloudflare Stream.
+You cannot download the *exact* input file that you uploaded. However, depending on your use case, you can use the [Downloadable Videos](https://developers.cloudflare.com/stream/viewing-videos/download-videos) feature to get encoded MP4s for use cases like offline viewing.
 
 ## Is there a limit to the amount of videos I can upload?
 
 - By default, a video upload can be at most 30 GB.
 
-- By default, 120 videos can be in the `inprogress`, `queued` or `downloading` state at once. If videos are in `error`, `ready` or `pendingupload` states, they don't count towards this limit.
+- By default, you can have up to 120 videos in the `inprogress`, `queued` or `downloading` state at the same time. Videos in the `error`, `ready` or `pendingupload` state do not count toward this limit. If you need the concurrency limit raised, please [contact Cloudflare support](https://support.cloudflare.com/hc/articles/200172476) explaining your use case and why you would like the limit raised.
+
+<Aside type="note">
+
+The limit to the number of videos only applies to videos being uploaded to Cloudflare Stream. This limit is not related to the number of end users streaming videos.
+
+</Aside>
 
 - An account cannot upload videos if the total video duration exceeds the video storage capacity purchased.
 
@@ -48,11 +56,11 @@ The Stream player can be successfully embedded on the following platforms:
 
 Browser         | Version
 ----------------|-----------------------------------
-Chrome          | Supported since Chrome version 30+
-Firefox         | Supported since Firefox version 42+
-Internet Explorer | Supported since IE 11 (Windows 8+ only)
-Safari          | Supported since Safari version 8+
-Opera           | Supported since Opera version 15+
+Chrome          | Supported since Chrome version 88+
+Firefox         | Supported since Firefox version 87+
+Edge            | Supported since Edge 89+
+Safari          | Supported since Safari version 14+
+Opera           | Supported since Opera version 75+
 
 </TableWrap>
 
@@ -60,11 +68,10 @@ Opera           | Supported since Opera version 15+
 
 Mobile Platform   | Version
 ------------------|-----------------------------------------------------------------------------------
-Chrome on Android | Supported on Chrome and Firefox for Android 4.0+ and all browsers for Android 4.1+
-UC Browser on Android | Supported on version 11.8+
-Samsung Internet | Supported on 5+
-Safari on iOS    | Supported on iOS 8+. Speed selector supported when not in fullscreen.
-Windows           | Supported on Windows Phone 8+
+Chrome on Android | Supported on Chrome 90
+UC Browser on Android | Supported on version 12.12+
+Samsung Internet | Supported on 13+
+Safari on iOS    | Supported on iOS 13.4+. Speed selector supported when not in fullscreen.
 
 </TableWrap>
 
diff --git a/products/stream/src/content/getting-analytics/fetching-bulk-analytics.md b/products/stream/src/content/getting-analytics/fetching-bulk-analytics.md
index 98ffd3e5ff8..87be68d67bd 100644
--- a/products/stream/src/content/getting-analytics/fetching-bulk-analytics.md
+++ b/products/stream/src/content/getting-analytics/fetching-bulk-analytics.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: reference
+---
+
 # Fetching bulk analytics
 
 Stream has a GraphQL analytics API that can be used to get bulk analytics for all videos in your account with one HTTP request.
diff --git a/products/stream/src/content/getting-analytics/fetching-per-video-analytics.md b/products/stream/src/content/getting-analytics/fetching-per-video-analytics.md
index dbbfb097de5..cbb28620ae1 100644
--- a/products/stream/src/content/getting-analytics/fetching-per-video-analytics.md
+++ b/products/stream/src/content/getting-analytics/fetching-per-video-analytics.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Fetching per-video analytics
diff --git a/products/stream/src/content/getting-analytics/index.md b/products/stream/src/content/getting-analytics/index.md
index f1fa00aebaa..32e46e639c6 100644
--- a/products/stream/src/content/getting-analytics/index.md
+++ b/products/stream/src/content/getting-analytics/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: navigation
 ---
 
 # Getting analytics
diff --git a/products/stream/src/content/index.md b/products/stream/src/content/index.md
index 05864adeb8f..ac1b60adff2 100644
--- a/products/stream/src/content/index.md
+++ b/products/stream/src/content/index.md
@@ -1,6 +1,7 @@
 ---
 order: 0
 title: Getting started
+pcx-content-type: interim
 ---
 
 # Cloudflare Stream
@@ -140,4 +141,4 @@ https://github.com/cloudflare/cloudflare-docs-engine/issues/281
  - [Securing your Stream](/viewing-videos/securing-your-stream)
  - [Displaying thumbnails to your video](/viewing-videos/securing-your-stream)
  - [Programmatically controlling the video player](/viewing-videos/using-the-player-api)
- - [Uploading without a API token](/uploading-videos/direct-creator-uploads)
+ - [Uploading without a API token](/uploading-videos/direct-creator-uploads)
\ No newline at end of file
diff --git a/products/stream/src/content/stream-connect.md b/products/stream/src/content/stream-connect.md
new file mode 100644
index 00000000000..3c107754d86
--- /dev/null
+++ b/products/stream/src/content/stream-connect.md
@@ -0,0 +1,234 @@
+---
+order: 5
+---
+# Stream Connect (Beta)
+
+<Aside>
+
+Note: Stream Connect is currently in closed beta and will be available to all users in coming weeks. [Request an invite](https://docs.google.com/forms/d/1rpRFKDTZTnh0LxysM2_Rky5pYt_rs9pUdSoJr_Ix2pk/edit).
+
+</Aside>
+
+Stream Connect allows you to retransmit your RTMPS feed to one or more outputs that support RTMP or RTMPS. To learn more about the vision and benefits, checkout the [Stream Connect blog post](https://blog.cloudflare.com/restream-with-stream-connect/). 
+
+Stream Connect does not output HLS/DASH at the moment. This will be supported at a later date.
+
+## Quick Start
+
+There are four steps to start using Stream Connect
+
+1. Create a live input that you will transmit to. Upon creating an input, you will receive an RTMPS URL and stream key to use in step 3.
+2. Add an output to the live input
+3. Configure your streaming software with the RTMP endpoint and stream key from Step 1
+4. Start streaming! Stream Connect will automatically ingest the video and push it to the configured outputs
+
+You can do steps 1 and 2 using the API or the [Stream Connect UI](https://dash.cloudflare.com/?to=/:account/stream/inputs)
+
+### Create a live input
+
+Create a live input to get an RTMPS URL to transmit live video to Cloudflare.
+
+#### cURL example
+```bash
+curl -X POST \
+-H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs \
+--data '{"meta": {"name":"test stream 1"}}'
+```
+
+##### Example response
+
+```bash
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": {
+    "uid": "66be4bf738797e01e1fca35a7bdecdcd",
+    "meta": {
+      "name": "test stream 1"
+    },
+    "created": "2014-01-02T02:20:00Z",
+    "modified": "2014-01-02T02:20:00Z",
+    "rtmps": {
+      "url": "rtmps://live.cloudflare.com:443/live/",
+      "streamKey": "<redacted>"
+    }
+  }
+}
+```
+
+### Add an output
+
+Add an Output to start retransmitting live video. You can add or remove Outputs at anytime during a broadcast to start and stop retransmitting.
+
+#### cURL example
+```bash
+curl -X POST \
+--data '{"url": "rtmp://a.rtmp.youtube.com/live2","streamKey": "<redacted>"}' \
+-H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs/$INPUT_UID/outputs
+```
+
+##### Example response
+
+```bash
+{
+  "result": {
+    "uid": "6f8339ed45fe87daa8e7f0fe4e4ef776",
+    "url": "rtmp://a.rtmp.youtube.com/live2",
+    "streamKey": "<redacted>"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+### Start streaming
+
+Use the URL and streamKey returned from input creation in your streaming software.
+
+<Aside type="warning" header="Handling reconnections">
+Make sure the streaming software you are using to push RTMP feeds automatically reconnects if the connection breaks. Some apps like OBS reconnect automatically. Other apps like FFmpeg require custom configuration.
+</Aside>
+
+## Limits
+
+Some limits apply to the Stream Connect Beta:
+
+- Up to 1000 live inputs per-account can be created
+- Up to 50 outputs may be configured per live input
+- A maximum recommended bitrate of 12000 kbps
+
+These limits can be configured. Please reply to your beta invite email for more information.
+
+### Get details on a live input
+
+#### cURL example
+
+```bash
+curl -H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs/$INPUT_UID
+```
+
+##### Example response
+
+```bash
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": {
+    "uid": "66be4bf738797e01e1fca35a7bdecdcd",
+    "meta": {
+      "name": "test stream 1"
+    },
+    "created": "2014-01-02T02:20:00Z",
+    "modified": "2014-01-02T02:20:00Z",
+    "rtmps": {
+      "url": "rtmps://live.cloudflare.com:443/live/",
+      "streamKey": "<redacted>"
+    }
+  }
+}
+```
+
+### List live inputs
+
+#### cURL example
+
+```bash
+curl -H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs
+```
+
+##### Example response
+
+```bash
+{
+  "result": [
+    {
+      "id": "01ad856eb76821fe32749626a4b39edf",
+      "created": "2021-04-23T18:57:51.425387Z",
+      "modified": "2021-04-23T18:57:51.425387Z",
+      "meta": {}
+    },
+    {
+      "id": "45a52d7847c95e8cd3de797f5da77afe",
+      "created": "2021-04-23T19:02:22.828507Z",
+      "modified": "2021-04-23T19:02:22.828507Z",
+      "meta": {}
+    },
+    {
+      "id": "e952c51fdcea70847e728f6145727bb6",
+      "created": "2021-05-05T15:02:12.175868Z",
+      "modified": "2021-05-05T15:02:12.175868Z",
+      "meta": {}
+    },
+    {
+      "id": "66be4bf738797e01e1fca35a7bdecdcd",
+      "created": "2021-05-05T20:46:37.056086Z",
+      "modified": "2021-05-05T20:46:37.056086Z",
+      "meta": {}
+    }
+  ],
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+### List outputs for an input
+
+#### cURL example
+
+```bash
+curl -H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs/$INPUT_UID/outputs
+```
+
+##### Example response
+```bash
+{
+  "result": [
+    {
+      "uid": "6f8339ed45fe87daa8e7f0fe4e4ef776",
+      "url": "rtmp://a.rtmp.youtube.com/live2",
+      "streamKey": "<redacted>"
+    },
+    {
+      "uid": "baea4d9c515887b80289d5c33cf01145",
+      "url": "rtmp://a.rtmp.youtube.com/live2",
+      "streamKey": "<redacted>"
+    }
+  ],
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+### Delete an output
+
+Note that if the associated live input is already retransmitting to this output when delete is called, that output will be disconnected within 30 seconds.
+
+#### cURL example
+
+```bash
+curl -X DELETE \
+-H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs/$INPUT_UID/outputs/$OUTPUT_UID
+```
+
+### Delete a live input 
+
+Note that if an input is already receiving data to retransmit, the connection will be cut within 30 seconds.
+
+#### cURL example
+
+```bash
+curl -X DELETE \
+-H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/live_inputs/$INPUT_UID
+```
diff --git a/products/stream/src/content/uploading-videos/adding-captions.md b/products/stream/src/content/uploading-videos/adding-captions.md
index 27c4e2adea8..62ea5cc84ee 100644
--- a/products/stream/src/content/uploading-videos/adding-captions.md
+++ b/products/stream/src/content/uploading-videos/adding-captions.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: interim
 ---
 
 # Adding captions
@@ -119,7 +120,7 @@ deleted.
 - Videos may include several language captions, but each language must be unique.
   For example, a video may have English, French, and German captions associated
   with it, but it cannot have two French captions.
-- Each caption file is limited to 10 MB in size. Please contact [support](support@cloudflare.com)
+- Each caption file is limited to 10 MB in size. Please [contact support](https://support.cloudflare.com/hc/articles/200172476)
   if you need to upload a larger file.
 
 ## Most common language codes
diff --git a/products/stream/src/content/uploading-videos/applying-watermarks.md b/products/stream/src/content/uploading-videos/applying-watermarks.md
index ec13bc4c072..deb2f075599 100644
--- a/products/stream/src/content/uploading-videos/applying-watermarks.md
+++ b/products/stream/src/content/uploading-videos/applying-watermarks.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: how-to
 ---
 
 # Applying watermarks
diff --git a/products/stream/src/content/uploading-videos/direct-creator-uploads.md b/products/stream/src/content/uploading-videos/direct-creator-uploads.md
index bd110a57576..823e2aa96e9 100644
--- a/products/stream/src/content/uploading-videos/direct-creator-uploads.md
+++ b/products/stream/src/content/uploading-videos/direct-creator-uploads.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: interim
 ---
 
 # Direct creator uploads
@@ -25,7 +26,7 @@ body of the `POST` request:
   - `maxDurationSeconds` <Type>integer</Type> <PropMeta>required</PropMeta>
     - Enforces the maximum duration in seconds for a video the user uploads.  For direct uploads, Stream requires videos are at least 1 second in length, and restricts to a maximum of 6 hours.  Therefore, this field must be greater than 1 and less than 21,600.
 
-  - `expiry` <Type>string (date)</Type> <PropMeta>default: now + 6 hours</PropMeta>
+  - `expiry` <Type>string (date)</Type> <PropMeta>default: now + 30 minutes</PropMeta>
     - Optional string field that enforces the time after which the unique one-time upload URL is invalid.  The time value must be formatted in RFC3339 layout and will be interpreted against UTC time zone.  If an expiry is set, it must be no less than two minutes in the future, and not more than 6 hours in the future.  If an expiry is not set, the upload URL will expire 30 minutes after it's creation.
 
 </Definitions>
@@ -37,7 +38,7 @@ Additionally, you can control security features through these fields:
   - `requireSignedURLs` <Type>boolean</Type> <PropMeta>default: false</PropMeta>
     - Limits the permission to view the video to only [signed URLs](/viewing-videos/securing-your-stream).
 
-  - `allowedOrigins` <Type>array of strings</Type> <PropMeta>default: _empty_</PropMeta>  
+  - `allowedOrigins` <Type>array of strings</Type> <PropMeta>default: _empty_</PropMeta>
     - Limit the domains this video can be embedded on. Learn more about [allowed origins](/viewing-videos/securing-your-stream).
 
   - `thumbnailTimestampPct` <Type>float</Type> <PropMeta>default: 0</PropMeta>
@@ -51,7 +52,7 @@ Additionally, you can control security features through these fields:
 
 </Definitions>
 
-## Using Basic Uploads 
+## Using Basic Uploads
 
 If the uploads from your creators are under 200MB, you can use basic uploads. For videos over 200 MB, use TUS uploads (described later in this article.)
 
@@ -176,15 +177,14 @@ size, the user will receive a `4xx` response.
 
 </Example>
 
-## Using tus (recommended for videos over 200MB) 
+## Using tus (recommended for videos over 200MB)
 
-tus is a protocol that supports resumable uploads and works best for larger files. 
+tus is a protocol that supports resumable uploads and works best for larger files.
 
-Typically, tus uploads require the authentication information to be sent with every request. This is not ideal for direct creators uploads because it exposes your API key (or token) to the end user. 
+Typically, tus uploads require the authentication information to be sent with every request. This is not ideal for direct creators uploads because it exposes your API key (or token) to the end user.
 
 To get around this, you can request a one-time tokenized URL by making a POST request to the `/stream?direct_user=true` end point:
 
-
 ```
 curl -H "Authorization: bearer $TOKEN" -X POST -H 'Tus-Resumable: 1.0.0' -H 'Upload-Length: $VIDEO_LENGTH' 'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream?direct_user=true'
 ```
@@ -193,7 +193,7 @@ The response will contain a `Location` header which provides the one-time URL th
 
 Here is a demo Cloudflare Worker script which returns the one-time upload URL:
 
-```
+```js
 addEventListener('fetch', event => {
   event.respondWith(handleRequest(event.request))
 })
@@ -203,7 +203,7 @@ addEventListener('fetch', event => {
  * @param {Request} request
  */
 async function handleRequest(request) {
-  const init = {
+  const response = await fetch("https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream?direct_user=true", {
     method: 'POST',
     headers: {
       'Authorization': 'bearer $TOKEN',
@@ -211,35 +211,36 @@ async function handleRequest(request) {
       'Upload-Length': request.headers.get('Upload-Length'),
       'Upload-Metadata': request.headers.get('Upload-Metadata')
     },
-  }
-  const response = await fetch("https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream?direct_user=true", init)
-  const results = await gatherResponse(response)
-  return new Response(null, {headers: {'Access-Control-Expose-Headers':'Location','Access-Control-Allow-Headers':'*','Access-Control-Allow-Origin':'*','location':results}})
-
-}
+  })
 
-async function gatherResponse(response) {
-  const { headers } = response
-  return await headers.get('location')
+  const destination = response.headers.get('Location')
 
+  return new Response(null, {
+    headers: {
+      'Access-Control-Expose-Headers': 'Location',
+      'Access-Control-Allow-Headers': '*',
+      'Access-Control-Allow-Origin':'*',
+      'Location': destination
+    }
+  })
 }
 ```
 
-Once you have the tokenized URL, you can pass it to the tus client to begin the upload. For details on using a tus client, refer to the [Resumable uploads with tus ](https://developers.cloudflare.com/stream/uploading-videos/upload-video-file#resumable-uploads-with-tus-for-large-files) article. 
+Once you have the tokenized URL, you can pass it to the tus client to begin the upload. For details on using a tus client, refer to the [Resumable uploads with tus ](https://developers.cloudflare.com/stream/uploading-videos/upload-video-file#resumable-uploads-with-tus-for-large-files) article.
 
-To test your end point which returns the tokenized URL, visit the [tus codepen demo](https://codepen.io/cfzf/pen/wvGMRXe) and paste your end point URL in the "Upload endpoint" field. 
+To test your end point which returns the tokenized URL, visit the [tus codepen demo](https://codepen.io/cfzf/pen/wvGMRXe) and paste your end point URL in the "Upload endpoint" field.
 
 ### Upload-Metadata header syntax
 
 You can apply the same constraints as Direct Creator Upload via basic upload when using tus. To do so, you must pass the expiry and maxDurationSeconds as part of the `Upload-Metadata` request header as part of the first request (made by the Worker in the example above.) The `Upload-Metadata` values are ignored from subsequent requests that do the actual file upload.
 
-Upload-Metadata header should contain key-value pairs. The keys are text and the values should be base64. Separate the key and values by a space, *not* an equal sign. To join multiple key-value pairs, include a comma with no additional spaces. 
+Upload-Metadata header should contain key-value pairs. The keys are text and the values should be base64. Separate the key and values by a space, *not* an equal sign. To join multiple key-value pairs, include a comma with no additional spaces.
 
 In the example below, the `Upload-Metadata` header is instructing Stream to only accept uploads with max video duration of 10 minutes and to make this video private:
 
 ```'Upload-Metadata: maxDurationSeconds NjAw,requiresignedurls'```
 
-*NjAw* is the base64 encoded value for "600" (or 10 minutes). 
+*NjAw* is the base64 encoded value for "600" (or 10 minutes).
 
 ## Tracking user upload progress
 
diff --git a/products/stream/src/content/uploading-videos/index.md b/products/stream/src/content/uploading-videos/index.md
index d35cb1299f7..eb4d30287c1 100644
--- a/products/stream/src/content/uploading-videos/index.md
+++ b/products/stream/src/content/uploading-videos/index.md
@@ -1,7 +1,9 @@
 ---
+title: Upload videos
 order: 1
+pcx-content-type: navigation
 ---
 
-# Uploading videos
+# Upload videos
 
 <DirectoryListing path="/uploading-videos"/>
diff --git a/products/stream/src/content/uploading-videos/player-api.md b/products/stream/src/content/uploading-videos/player-api.md
index ce451ef9ef0..fe1b2af4b9c 100644
--- a/products/stream/src/content/uploading-videos/player-api.md
+++ b/products/stream/src/content/uploading-videos/player-api.md
@@ -72,7 +72,7 @@ Multiple attributes can be used together, added one after each other like this:
 
 <Definitions>
 
-- `play()` <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ Promise">Promise</TypeLink>
+- `play()` <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise">Promise</TypeLink>
 
   - Start video playback.
 
diff --git a/products/stream/src/content/uploading-videos/searching.md b/products/stream/src/content/uploading-videos/searching.md
index b7a9f049f4a..0b5e25090bc 100644
--- a/products/stream/src/content/uploading-videos/searching.md
+++ b/products/stream/src/content/uploading-videos/searching.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: how-to
+---
+
 # Searching over videos
 
 You can search for videos by name through the Stream API by adding a `search` query parameter to the [list media files](https://api.cloudflare.com/#stream-videos-list-videos) endpoint.
diff --git a/products/stream/src/content/uploading-videos/upload-via-link.md b/products/stream/src/content/uploading-videos/upload-via-link.md
index f055b8d5e2f..ffa73b0e6ed 100644
--- a/products/stream/src/content/uploading-videos/upload-via-link.md
+++ b/products/stream/src/content/uploading-videos/upload-via-link.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Upload via link
diff --git a/products/stream/src/content/uploading-videos/upload-video-file.md b/products/stream/src/content/uploading-videos/upload-video-file.md
index 7ba967ba20a..9ce57ab2a12 100644
--- a/products/stream/src/content/uploading-videos/upload-video-file.md
+++ b/products/stream/src/content/uploading-videos/upload-video-file.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Upload video file
@@ -38,7 +39,8 @@ Note that cURL `-F` flag automatically configures the content-type header and ma
 Important: Cloudflare Stream requires a minimum chunk size of 5,242,880 bytes when using TUS, unless the entire file is less than this amount.
 
 We recommend increasing the chunk size to 52,428,800 bytes for better performance when the client connection is expected to be reliable.
-
+	
+Maximum chunk size can be 209,715,200 bytes.
 </Aside>
 
 <Aside>
@@ -69,7 +71,7 @@ Setting arbitrary metadata values in the `Upload-Metadata` header sets values th
 
 - `allowedorigins`
 
-  - A comma separated strings containing the domains. This will set the [allowed origins setting](/viewing-your-videos/securing-your-stream) for the video.
+  - An array of strings listing origins allowed to display the video. This will set the [allowed origins setting](../../viewing-videos/securing-your-stream#security-considerations) for the video.
 
 - `thumbnailtimestamppct`
 
diff --git a/products/stream/src/content/uploading-videos/using-webhooks.md b/products/stream/src/content/uploading-videos/using-webhooks.md
index 2c2c8a6e6d2..ab5a8fcc80a 100644
--- a/products/stream/src/content/uploading-videos/using-webhooks.md
+++ b/products/stream/src/content/uploading-videos/using-webhooks.md
@@ -1,5 +1,6 @@
 ---
 order: 6
+pcx-content-type: how-to
 ---
 
 # Using webhooks
diff --git a/products/stream/src/content/uploading-videos/ways-to-upload.md b/products/stream/src/content/uploading-videos/ways-to-upload.md
index ec51dc139c8..c4b1ff6464d 100644
--- a/products/stream/src/content/uploading-videos/ways-to-upload.md
+++ b/products/stream/src/content/uploading-videos/ways-to-upload.md
@@ -1,6 +1,7 @@
 ---
 order: 0
 type: overview
+pcx-content-type: reference
 ---
 
 # Ways to upload
@@ -11,9 +12,9 @@ Stream provides four ways to upload videos to cover a diverse set of use cases.
 
 | Upload method | When to use |
 |------------------|-------------|
-| [Stream Dashboard](https://dash.cloudflare.com?to=/:account/stream) | Quick, one time uploads where automation is not required |
+| [Stream Dashboard](https://dash.cloudflare.com?to=/:account/stream) | Quick, one-time uploads where automation is not required |
 | [Copy via link](/uploading-videos/upload-via-link) | The video library is stored in a cloud storage bucket |
-| [Direct creator uploads](/uploading-videos/direct-creator-uploads) | The end user is uploading videos but does not have access to your API tokens, for example if you have your users uploading content to your website or mobile app |
+| [Direct creator uploads](/uploading-videos/direct-creator-uploads) | The end user is uploading videos but does not have access to your API tokens, such as if you have your users uploading content to your website or mobile app |
 | [Upload video file](/uploading-videos/upload-video-file) | When the video file is stored on a computer with access to your API tokens |
 
 </TableWrap>
\ No newline at end of file
diff --git a/products/stream/src/content/viewing-videos/displaying-thumbnails.md b/products/stream/src/content/viewing-videos/displaying-thumbnails.md
index 284fef92565..4342a0821fc 100644
--- a/products/stream/src/content/viewing-videos/displaying-thumbnails.md
+++ b/products/stream/src/content/viewing-videos/displaying-thumbnails.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: how-to
 ---
 
 # Displaying thumbnails
@@ -18,7 +19,7 @@ https://videodelivery.net/5d5bc37ffcf54c9b82e996823bffbb81/thumbnails/thumbnail.
 
 </Example>
 
-Using the `poster` query parameter in the embed URL, you can set a thumbnail to any time in your video. If [signed URLs](/security/signed-urls/)  are required, you must use signed URL instead of video IDs.
+Using the `poster` query parameter in the embed URL, you can set a thumbnail to any time in your video. If [signed URLs](/security/signed-urls/) are required, you must use signed URL instead of video IDs.
 
 ```html
 <iframe
diff --git a/products/stream/src/content/viewing-videos/download-videos.md b/products/stream/src/content/viewing-videos/download-videos.md
index 2ffc07c403f..c7d18daa515 100644
--- a/products/stream/src/content/viewing-videos/download-videos.md
+++ b/products/stream/src/content/viewing-videos/download-videos.md
@@ -5,7 +5,7 @@ order: 5
 
 <Aside>
 
-Note: MP4 downloads are currently in beta and will be available to all users in coming weeks.
+Note: MP4 downloads are currently in open beta and available to all Stream customers
 
 </Aside>
 
@@ -93,7 +93,7 @@ If your video is public, the mp4 will also be publicly accessible. If your video
 
 Download links will not work for videos which already require signed URLs if the `downloadable` flag is not present in the token.
 
-For more details about using signed URLs with videos, please see [the documentation](../securing-your-stream).
+For more details about using signed URLs with videos, please see [the documentation](/viewing-videos/securing-your-stream).
 
 ### Example token payload
 
@@ -121,4 +121,4 @@ highlight: [6]
       }
     ]
   }
-```
\ No newline at end of file
+```
diff --git a/products/stream/src/content/viewing-videos/index.md b/products/stream/src/content/viewing-videos/index.md
index 9788b1e45a4..26c6150bdce 100644
--- a/products/stream/src/content/viewing-videos/index.md
+++ b/products/stream/src/content/viewing-videos/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: navigation
 ---
 
 # Viewing videos
diff --git a/products/stream/src/content/viewing-videos/securing-your-stream.md b/products/stream/src/content/viewing-videos/securing-your-stream.md
index e22596e9100..96af9393afa 100644
--- a/products/stream/src/content/viewing-videos/securing-your-stream.md
+++ b/products/stream/src/content/viewing-videos/securing-your-stream.md
@@ -1,259 +1,196 @@
 ---
 order: 3
+pcx-content-type: how-to
 ---
 
 # Securing your Stream
 
 ## Signed URLs / Tokens
 
-By default, videos on Cloudflare Stream can be viewed by anyone anytime until you delete the video. Users can view the source of the embed code in their browser and get a URL to the video that could be shared with others. To prevent this, use signed URLs.
+By default, videos on  Stream can be viewed by anyone with just a video id. If you want to make your video private by default and only give access to certain users, you can use the signed URL feature. When you mark a video to require signed URL, it can no longer be accessed publicly with only the video id. Instead, the user will need a signed url token to watch or download the video.
 
-Signed URLs are controlled by you and can be set to expire after a set time period. This allows you to control the time window you allow your users to watch videos. [Other viewing constraints can also be applied.](#signing-unique-tokens)
+Here are some common use cases for using signed URLs:
 
-To implement signed URLs
+* Restricting access so only logged in members can watch a particular video
+* Let users watch your video for a limited time period (ie. 24 hours)
+* Restricting access based on geolocation 
 
-1. Create a key
-1. Make a video require signed URLS
-1. Sign tokens to use in embed code
+### Making a video require signed URLs
 
-These steps are detailed below.
+Since video ids are effectively public within signed URLs, you will need to turn on `requireSignedURLs` on for your videos. This option will prevent any public links, such as `watch.cloudflarestream.com/$VIDEOID`, from working.
 
-You can [revoke a key](#revoking-keys) anytime for any reason.
+Restricting viewing can be done by updating the video's metadata.
 
-### Creating a signing key
+```bash
+curl -X POST -H "Authorization: Bearer $TOKEN" "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/$VIDEOID" -H "Content-Type: application/json" -d "{\"uid\": \"$VIDEOID\", \"requireSignedURLs\": true }"
+```
 
-Upon creation you will get a RSA private key in PEM and JWK formats. Keys are created, used and deleted independently of videos. Every key can sign any of your videos.
+Response:
+```json
+---
+highlight: [8]
+---
 
-```javascript
-// curl -X POST -H "Authorization: Bearer $TOKEN"  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/keys"
 
 {
   "result": {
-    "id": "$KEYID",
-    "pem": "$PRIVATE_KEY_IN_PEM_FORMAT",
-    "jwk": "$PRIVATE-KEY-IN-JWK-FORMAT",
-    "created": "$TIMESTAMP"
+    "uid": "$VIDEOID",
+    ...
+    "requireSignedURLS": true
   },
   "success": true,
   "errors": [],
   "messages": []
 }
+
 ```
 
-The `pem` and `jwk` fields are base64-encoded, you must decode them before using them.
+## Two Ways to Generate Signed Tokens
 
-### Making a video require signed URLs
+You can program your app to generate token in two ways:
 
-Since video ids are effectively public within signed URLs, you will need to turn on `requireSignedURLs` on for your videos. This option will prevent any public links, such as `watch.cloudflarestream.com/$VIDEOID`, from working.
+* **Using the /token endpoint to generate signed tokens:** The simplest way to create a signed url token is by calling the /token endpoint. This is recommended for testing purposes or if you are generating less than 10,000 tokens per day.
 
-Restricting viewing can be done by updating the video's metadata.
+* **Using an open-source library:** If you have tens of thousands of daily users and need to generate a high-volume of tokens without calling the /token endpoint *each time*, you can create tokens yourself. This way, you do not need to call a Stream endpoint each time you need to generate a token.
 
-```javascript
+## Option 1: Using the /token endpoint
+
+You can call the `/token` endpoint for any video that is marked private to get a signed url token which expires in one hour:
+
+```bash
+curl \
+-H "Authorization: Bearer $TOKEN" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/$VIDEOID/token
+```
 
-// curl -X POST -H "Authorization: Bearer $TOKEN"  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/$VIDEOID" -H "Content-Type: application/json" -d "{\"uid\": \"$VIDEOID\", \"requireSignedURLs\": true }"
+You will see a response similar to this if the request succeeds:
 
+```json
 {
   "result": {
-    "uid": "$VIDEOID",
-    ...
-    "requireSignedURLS": true
+    "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNkYzkzNTk4MmY4MDc1ZjJlZjk2MTA2ZDg1ZmNkODM4In0.eyJraWQiOiJjZGM5MzU5ODJmODA3NWYyZWY5NjEwNmQ4NWZjZDgzOCIsImV4cCI6IjE2MjE4ODk2NTciLCJuYmYiOiIxNjIxODgyNDU3In0.iHGMvwOh2-SuqUG7kp2GeLXyKvMavP-I2rYCni9odNwms7imW429bM2tKs3G9INms8gSc7fzm8hNEYWOhGHWRBaaCs3U9H4DRWaFOvn0sJWLBitGuF_YaZM5O6fqJPTAwhgFKdikyk9zVzHrIJ0PfBL0NsTgwDxLkJjEAEULQJpiQU1DNm0w5ctasdbw77YtDwdZ01g924Dm6jIsWolW0Ic0AevCLyVdg501Ki9hSF7kYST0egcll47jmoMMni7ujQCJI1XEAOas32DdjnMvU8vXrYbaHk1m1oXlm319rDYghOHed9kr293KM7ivtZNlhYceSzOpyAmqNFS7mearyQ"
   },
   "success": true,
   "errors": [],
   "messages": []
 }
-
 ```
 
-### Signing unique tokens
-
-After creating a key, you can use it to sign unique signed tokens. These tokens can be used in place of video ids in the stream embed code.
+To render the video, insert the `token` value in place of the `video id`:
 
-For security reasons, the key signing a token to view a video **must** be associated with the same account the video was uploaded to. For example, if you have a key owned by account A attempting to sign a token for a video owned by account B, that token will not be accepted.
+```HTML
 
-You can sign to assert these optional constraints on the token:
+<iframe src="https://iframe.videodelivery.net/eyJhbGciOiJSUzI1NiIsImtpZCI6ImNkYzkzNTk4MmY4MDc1ZjJlZjk2MTA2ZDg1ZmNkODM4In0.eyJraWQiOiJjZGM5MzU5ODJmODA3NWYyZWY5NjEwNmQ4NWZjZDgzOCIsImV4cCI6IjE2MjE4ODk2NTciLCJuYmYiOiIxNjIxODgyNDU3In0.iHGMvwOh2-SuqUG7kp2GeLXyKvMavP-I2rYCni9odNwms7imW429bM2tKs3G9INms8gSc7fzm8hNEYWOhGHWRBaaCs3U9H4DRWaFOvn0sJWLBitGuF_YaZM5O6fqJPTAwhgFKdikyk9zVzHrIJ0PfBL0NsTgwDxLkJjEAEULQJpiQU1DNm0w5ctasdbw77YtDwdZ01g924Dm6jIsWolW0Ic0AevCLyVdg501Ki9hSF7kYST0egcll47jmoMMni7ujQCJI1XEAOas32DdjnMvU8vXrYbaHk1m1oXlm319rDYghOHed9kr293KM7ivtZNlhYceSzOpyAmqNFS7mearyQ" style="border: none;" height="720" width="1280" allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;" allowfullscreen="true"></iframe>
 
-- `exp` - expiration; a unix epoch timestamp **after** which the token will not be accepted.
-- `nbf` - notBefore; a unix epoch timestamp **before** which the token will not be accepted.
-- `downloadable` - a boolean, mp4 downloads requiring signed URLs will not accept this token unless this value is true. For more details, see the [download documentation](../download-videos)
-- `accessRules` - Video Access Control; these allow making the token conditionally accepted on a variety of factors. For more details, see [their documentation](#video-access-control)
+```
 
-### Playback using signed tokens
+If you are using your own player, replace the video id in the manifest url with the `token` value:
 
-Replace the video ID with the signed token to use it.
+`https://videodelivery.net/eyJhbGciOiJSUzI1NiIsImtpZCI6ImNkYzkzNTk4MmY4MDc1ZjJlZjk2MTA2ZDg1ZmNkODM4In0.eyJraWQiOiJjZGM5MzU5ODJmODA3NWYyZWY5NjEwNmQ4NWZjZDgzOCIsImV4cCI6IjE2MjE4ODk2NTciLCJuYmYiOiIxNjIxODgyNDU3In0.iHGMvwOh2-SuqUG7kp2GeLXyKvMavP-I2rYCni9odNwms7imW429bM2tKs3G9INms8gSc7fzm8hNEYWOhGHWRBaaCs3U9H4DRWaFOvn0sJWLBitGuF_YaZM5O6fqJPTAwhgFKdikyk9zVzHrIJ0PfBL0NsTgwDxLkJjEAEULQJpiQU1DNm0w5ctasdbw77YtDwdZ01g924Dm6jIsWolW0Ic0AevCLyVdg501Ki9hSF7kYST0egcll47jmoMMni7ujQCJI1XEAOas32DdjnMvU8vXrYbaHk1m1oXlm319rDYghOHed9kr293KM7ivtZNlhYceSzOpyAmqNFS7mearyQ/manifest/video.m3u8`
 
-```html
-<iframe
-  src="https://iframe.videodelivery.net/$SIGNEDTOKEN"
-  style="border: none;"
-  height="720"
-  width="1280"
-  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
-  allowfullscreen="true"
-></iframe>
-```
+### Customizing default restrictions
 
-#### Get started with a signing utility
+If you call the `/token` endpoint without any body, it will return a token that expires in one hour. Let's say you want to let a user watch a particular video for the next 12 hours. Here's how you'd do it with a Cloudflare Worker:
 
-*Using this signing utility in production is not recommended.*
+```JavaScript
+addEventListener('fetch', event => {
+    event.respondWith(handleRequest(event))
+})
 
-We offer a utility at `https://util.cloudflarestream.com/sign` to generate tokens when getting familiar with signed URLs.
+async function handleRequest(request) {
 
-- `exp` - If not set, defaults to one hour after issuing.
-- `nbf` - If not set, defaults to one hour before issuing.
+    var signed_url_restrictions = {
+        //limit viewing for the next 12 hours
+        exp: Math.floor(Date.now() / 1000) + (12*60*60) 
+    };
 
-```sh
-curl -X POST "https://util.cloudflarestream.com/sign/$VIDEOID" -d "{\"id\": \"$KEYID\", \"pem\": \"$PRIVATE_KEY_IN_PEM_FORMAT\",\"nbf\":1537453165,\"exp\":1537460365}"
+    const init = {
+    method: 'POST',
+    headers: {
+              "X-Auth-Email": "{ACCOUNT_EMAIL}",
+              "X-Auth-Key": "{ACCOUNT_KEY}",
+              "content-type": "application/json;charset=UTF-8"
+    },
+    body: JSON.stringify(signed_url_restrictions)
+  }
+  const signedurl_service_response = await fetch("https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/stream/{VIDEO_ID}/token", init)
+  return new Response(JSON.stringify(await signedurl_service_response.json()), {status: 200})
+}
 ```
 
-This endpoint accepts JSON bodies with the output from [Creating a signing key](#creating-a-signing-key) or any object with `pem` and `kid` attributes. To add a constraint, include it as a property of the body.
+The returned token will expire after 12 hours. 
 
-#### Signing tokens in production
+Let's take this a step further and add 2 additional restrictions:
 
-Other offline signing examples are included [below](#other-offline-signing-examples)
+* Allow the signed URL token to be used for MP4 downloads (assuming the video has downloads enabled)
+* Block users from US and Mexico from viewing or downloading the video
 
-This is an example of signing a token in nodejs using the `jsonwebtoken` package.
+To achieve this, we can specify additional restrictions in the `signed_url_restrictions` object in our sample code:
 
-```javascript
-var jwt = require('jsonwebtoken');
+```JavaScript
 
-var token = jwt.sign(
+addEventListener('fetch', event => {
+    event.respondWith(handleRequest(event))
+})
 
-  { kid: "$KEYID",
-    sub: "$VIDEOID",
-  },
-  Buffer.from("$PRIVATE_KEY_IN_PEM_FORMAT",'base64'),
-  {
-    expiresIn: '1h', // or preferred expiry time. Note that this should be longer than the duration of the video
-    algorithm: 'RS256',
-  }
-);
+async function handleRequest(request) {
 
+    var signed_url_restrictions = {
+        //limit viewing for the next 2 hours
+        exp: Math.floor(Date.now() / 1000) + (12*60*60),
+        downloadable: true,
+        accessRules:[{"type":"ip.geoip.country","country":["US","MX"],"action":"block"}]
+    };
 
-// you can now use the token instead of the video id when viewing videos
-console.log(token)
+    const init = {
+    method: 'POST',
+    headers: {
+              "X-Auth-Email": "{ACCOUNT_EMAIL}",
+              "X-Auth-Key": "{ACCOUNT_KEY}",
+              "content-type": "application/json;charset=UTF-8"
+    },
+    body: JSON.stringify(signed_url_restrictions)
+  }
+  const signedurl_service_response = await fetch("https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/stream/{VIDEO_ID}/token", init)
+  return new Response(JSON.stringify(await signedurl_service_response.json()), {status: 200})
+}
 ```
 
-#### Debugging signed tokens
-
-If your token is not behaving as expected when tested against our server, some information is surfaced which is a good place to start.
+## Option 2: Generating signed tokens without calling the `/token` endpoint 
 
-For requests rejected using signed tokens, the response body typically includes the reason for the rejection.
+If you are generating a high-volume of tokens, it is best to generate new tokens without needing to call the Stream API each time. 
 
-To view these failures, the network view in your browser's developer tools will work. Select a 401 or 403 response from `videodelivery.net` and check the `Response`. You could also open the URL in your browser or `curl` it.
+### Step 1: Call the `/stream/key` endpoint *once* to obtain a key
 
-For example, the message for a rule blocking a view will look like:
-
-		401 unauthorized blocked by rule on 'ip.src'
-
-A malformed token will contain the top-level field that is malformed:
-
-		401 unauthorized malformed token: check fields ["accessRules"]
-
-#### Revoking keys
-
-You can create up to 1,000 keys and rotate them at your convenience.
-Once revoked all tokens created with that key will be invalidated.
+```bash
+curl -X POST -H "Authorization: Bearer $TOKEN"  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/keys
+```
 
-```javascript
-// curl -X DELETE -H "Authorization: Bearer $TOKEN"  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/keys/$KEYID"
+The response will return `pem` and `jwk` values.
 
+```json
 {
-  "result": "Revoked",
+  "result": {
+    "id": "8f926b2b01f383510025a78a4dcbf6a",
+    "pem": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemtHbXhCekFGMnBIMURiWmgyVGoyS3ZudlBVTkZmUWtNeXNCbzJlZzVqemRKTmRhCmtwMEphUHhoNkZxOTYveTBVd0lBNjdYeFdHb3kxcW1CRGhpdTVqekdtYW13NVgrYkR3TEdTVldGMEx3QnloMDYKN01Rb0xySHA3MDEycXBVNCtLODUyT1hMRVVlWVBrOHYzRlpTQ2VnMVdLRW5URC9oSmhVUTFsTmNKTWN3MXZUbQpHa2o0empBUTRBSFAvdHFERHFaZ3lMc1Vma2NsRDY3SVRkZktVZGtFU3lvVDVTcnFibHNFelBYcm9qaFlLWGk3CjFjak1yVDlFS0JCenhZSVEyOVRaZitnZU5ya0t4a2xMZTJzTUFML0VWZkFjdGkrc2ZqMkkyeEZKZmQ4aklmL2UKdHBCSVJZVDEza2FLdHUyYmk0R2IrV1BLK0toQjdTNnFGODlmTHdJREFRQUJBb0lCQUYzeXFuNytwNEtpM3ZmcgpTZmN4ZmRVV0xGYTEraEZyWk1mSHlaWEFJSnB1MDc0eHQ2ZzdqbXM3Tm0rTFVhSDV0N3R0bUxURTZacy91RXR0CjV3SmdQTjVUaFpTOXBmMUxPL3BBNWNmR2hFN1pMQ2wvV2ZVNXZpSFMyVDh1dGlRcUYwcXpLZkxCYk5kQW1MaWQKQWl4blJ6UUxDSzJIcmlvOW1KVHJtSUUvZENPdG80RUhYdHpZWjByOVordHRxMkZrd3pzZUdaK0tvd09JaWtvTgp2NWFOMVpmRGhEVG0wdG1Vd0tLbjBWcmZqalhRdFdjbFYxTWdRejhwM2xScWhISmJSK29PL1NMSXZqUE16dGxOCm5GV1ZEdTRmRHZsSjMyazJzSllNL2tRVUltT3V5alY3RTBBcm5vR2lBREdGZXFxK1UwajluNUFpNTJ6aTBmNloKdFdvwdju39xOFJWQkwxL2tvWFVmYk00S04ydVFadUdjaUdGNjlCRDJ1S3o1eGdvTwowVTBZNmlFNG9Cek5GUW5hWS9kayt5U1dsQWp2MkgraFBrTGpvZlRGSGlNTmUycUVNaUFaeTZ5cmRkSDY4VjdIClRNRllUQlZQaHIxT0dxZlRmc00vRktmZVhWY1FvMTI1RjBJQm5iWjNSYzRua1pNS0hzczUyWE1DZ1lFQTFQRVkKbGIybDU4blVianRZOFl6Uk1vQVo5aHJXMlhwM3JaZjE0Q0VUQ1dsVXFZdCtRN0NyN3dMQUVjbjdrbFk1RGF3QgpuTXJsZXl3S0crTUEvU0hlN3dQQkpNeDlVUGV4Q3YyRW8xT1loMTk3SGQzSk9zUythWWljemJsYmJqU0RqWXVjCkdSNzIrb1FlMzJjTXhjczJNRlBWcHVibjhjalBQbnZKd0k5aUpGVUNnWUVBMjM3UmNKSEdCTjVFM2FXLzd3ekcKbVBuUm1JSUczeW9UU0U3OFBtbHo2bXE5eTVvcSs5aFpaNE1Fdy9RbWFPMDF5U0xRdEY4QmY2TFN2RFh4QWtkdwpWMm5ra0svWWNhWDd3RHo0eWxwS0cxWTg3TzIwWWtkUXlxdjMybG1lN1JuVDhwcVBDQTRUWDloOWFVaXh6THNoCkplcGkvZFhRWFBWeFoxYXV4YldGL3VzQ2dZRUFxWnhVVWNsYVlYS2dzeUN3YXM0WVAxcEwwM3h6VDR5OTBOYXUKY05USFhnSzQvY2J2VHFsbGVaNCtNSzBxcGRmcDM5cjIrZFdlemVvNUx4YzBUV3Z5TDMxVkZhT1AyYk5CSUpqbwpVbE9ldFkwMitvWVM1NjJZWVdVQVNOandXNnFXY21NV2RlZjFIM3VuUDVqTVVxdlhRTTAxNjVnV2ZiN09YRjJyClNLYXNySFVDZ1lCYmRvL1orN1M3dEZSaDZlamJib2h3WGNDRVd4eXhXT2ZMcHdXNXdXT3dlWWZwWTh4cm5pNzQKdGRObHRoRXM4SHhTaTJudEh3TklLSEVlYmJ4eUh1UG5pQjhaWHBwNEJRNTYxczhjR1Z1ZSszbmVFUzBOTDcxZApQL1ZxUWpySFJrd3V5ckRFV2VCeEhUL0FvVEtEeSt3OTQ2SFM5V1dPTGJvbXQrd3g0NytNdWc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=",
+    "jwk": "eyJ1c2UiOiJzaWciLCJrdHkiOiJSU0EiLCJraWQiOiI4ZjkyNmIyYjAxZjM4MzUxNzAwMjVhNzhhNGRjYmY2YSIsImFsZyI6IlJTMjU2IiwibiI6InprR214QnpBRjJwSDFEYlpoMlRqMkt2bnZQVU5GZlFrTXlzQm8yZWc1anpkSk5kYWtwMEphUHhoNkZxOTZfeTBVd0lBNjdYeFdHb3kxcW1CRGhpdTVqekdtYW13NVgtYkR3TEdTVldGMEx3QnloMDY3TVFvTHJIcDcwMTJxcFU0LUs4NTJPWExFVWVZUGs4djNGWlNDZWcxV0tFblREX2hKaFVRMWxOY0pNY3cxdlRtR2tqNHpqQVE0QUhQX3RxRERxWmd5THNVZmtjbEQ2N0lUZGZLVWRrRVN5b1Q1U3JxYmxzRXpQWHJvamhZS1hpNzFjak1yVDlFS0JCenhZSVEyOVRaZi1nZU5ya0t4a2xMZTJzTUFMX0VWZkFjdGktc2ZqMkkyeEZKZmQ4aklmX2V0cEJJUllUMTNrYUt0dTJiaTRHYi1XUEstS2hCN1M2cUY4OWZMdyIsImUiOiJBUUFCIiwiZCI6IlhmS3FmdjZuZ3FMZTktdEo5ekY5MVJZc1ZyWDZFV3RreDhmSmxjQWdtbTdUdmpHM3FEdU9henMyYjR0Um9mbTN1MjJZdE1UcG16LTRTMjNuQW1BODNsT0ZsTDJsX1VzNy1rRGx4OGFFVHRrc0tYOVo5VG0tSWRMWlB5NjJKQ29YU3JNcDhzRnMxMENZdUowQ0xHZEhOQXNJcllldUtqMllsT3VZZ1Q5MEk2MmpnUWRlM05oblN2MW42MjJyWVdURE94NFpuNHFqQTRpS1NnMl9sbzNWbDhPRU5PYlMyWlRBb3FmUld0LU9OZEMxWnlWWFV5QkRQeW5lVkdxRWNsdEg2Zzc5SXNpLU04ek8yVTJjVlpVTzdoOE8tVW5mYVRhd2xnei1SQlFpWTY3S05Yc1RRQ3VlZ2FJQU1ZVjZxcjVUU1Ai2odx5iT0xSX3BtMWFpdktyUSIsInAiOiI5X1o5ZUpGTWI5X3E4UlZCTDFfa29YVWZiTTRLTjJ1UVp1R2NpR0Y2OUJEMnVLejV4Z29PMFUwWTZpRTRvQnpORlFuYVlfZGsteVNXbEFqdjJILWhQa0xqb2ZURkhpTU5lMnFFTWlBWnk2eXJkZEg2OFY3SFRNRllUQlZQaHIxT0dxZlRmc01fRktmZVhWY1FvMTI1RjBJQm5iWjNSYzRua1pNS0hzczUyWE0iLCJxIjoiMVBFWWxiMmw1OG5VYmp0WThZelJNb0FaOWhyVzJYcDNyWmYxNENFVENXbFVxWXQtUTdDcjd3TEFFY243a2xZNURhd0JuTXJsZXl3S0ctTUFfU0hlN3dQQkpNeDlVUGV4Q3YyRW8xT1loMTk3SGQzSk9zUy1hWWljemJsYmJqU0RqWXVjR1I3Mi1vUWUzMmNNeGNzMk1GUFZwdWJuOGNqUFBudkp3STlpSkZVIiwiZHAiOiIyMzdSY0pIR0JONUUzYVdfN3d6R21QblJtSUlHM3lvVFNFNzhQbWx6Nm1xOXk1b3EtOWhaWjRNRXdfUW1hTzAxeVNMUXRGOEJmNkxTdkRYeEFrZHdWMm5ra0tfWWNhWDd3RHo0eWxwS0cxWTg3TzIwWWtkUXlxdjMybG1lN1JuVDhwcVBDQTRUWDloOWFVaXh6THNoSmVwaV9kWFFYUFZ4WjFhdXhiV0ZfdXMiLCJkcSI6InFaeFVVY2xhWVhLZ3N5Q3dhczRZUDFwTDAzeHpUNHk5ME5hdWNOVEhYZ0s0X2NidlRxbGxlWjQtTUswcXBkZnAzOXIyLWRXZXplbzVMeGMwVFd2eUwzMVZGYU9QMmJOQklKam9VbE9ldFkwMi1vWVM1NjJZWVdVQVNOandXNnFXY21NV2RlZjFIM3VuUDVqTVVxdlhRTTAxNjVnV2ZiN09YRjJyU0thc3JIVSIsInFpIjoiVzNhUDJmdTB1N1JVWWVubzIyNkljRjNBaEZzY3NWam55NmNGdWNGanNIbUg2V1BNYTU0dS1MWFRaYllSTFBCOFVvdHA3UjhEU0NoeEhtMjhjaDdqNTRnZkdWNmFlQVVPZXRiUEhCbGJudnQ1M2hFdERTLTlYVF8xYWtJNngwWk1Mc3F3eEZuZ2NSMF93S0V5Zzh2c1BlT2gwdlZsamkyNkpyZnNNZU9fakxvIn0=",
+    "created": "2021-06-15T21:06:54.763937286Z"
+  },
   "success": true,
   "errors": [],
   "messages": []
 }
 ```
+ 
+ Save these values as they won't be shown again. You will use these values later to generate the tokens. The pem and jwk fields are base64-encoded, you must decode them before using them (an example of this is shown in step 2). 
+ 
+ ### Step 2: Generate tokens using the key
+ 
+Once you generate the key in step 1, you can use the `pem` or `jwk` values to generate self-signing URLs on your own. Using this method, you do not need to call the Stream API each time you are creating a new token.
 
-#### Other offline signing examples
-
-##### Sign in go using go-jose
-
-Use: `go run sign.go`
-
-```go
-
-package main
-
-import (
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/pem"
-	"fmt"
-	"os"
-	"time"
-
-	jose "gopkg.in/square/go-jose.v2"
-	jwt "gopkg.in/square/go-jose.v2/jwt"
-)
-
-type claims struct {
-	KeyID     string          `json:"kid,omitempty"`
-	VideoID   string          `json:"sub,omitempty"`
-	Expiry    jwt.NumericDate `json:"exp,omitempty"`
-	NotBefore jwt.NumericDate `json:"nbf,omitempty"`
-}
-
-const videoID = "$VIDEOID"
-const keyID = "$KEYID"
-const privateKey = "$PRIVATE_KEY_IN_PEM_FORMAT"
-const expiresIn = time.Hour
-
-func main() {
-	// Decode privateKey
-	keyBytes, err := base64.StdEncoding.DecodeString(privateKey)
-	if err != nil {
-		fmt.Printf("failed to generate key: %s\n", err)
-		os.Exit(1)
-	}
-	block, _ := pem.Decode(keyBytes)
-	if err != nil {
-		fmt.Printf("failed to decode pem: %s\n", err)
-		os.Exit(1)
-	}
-	rsaPrivateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	if err != nil {
-		fmt.Printf("failed to parse key: %s\n", err)
-		os.Exit(1)
-	}
-
-	// Prepare to sign
-	var options jose.SignerOptions
-	options.WithType("JWT").WithHeader("kid", keyID)
-	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: rsaPrivateKey},
-		&options)
-	if err != nil {
-		fmt.Printf("failed to initialize signer: %s\n", err)
-		os.Exit(1)
-	}
-
-	// Sign a JWT
-	builder := jwt.Signed(signer)
-	builder = builder.Claims(claims{
-		KeyID:   keyID,
-		VideoID: videoID,
-		Expiry:  *jwt.NewNumericDate(time.Now().Add(expiresIn)),
-	})
-	token, err := builder.CompactSerialize()
-	if err != nil {
-		fmt.Printf("failed to get token: %s\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Println(token)
-}
-
-
-```
-
-##### Sign with Cloudflare Workers
-
-The following code snippet does not include the function `addEventListener` on `fetch`. The goal of that snippet is to give you a function that return the JWT.
-To be noted, the code snippet contain an `accessRules` that allow only UK user to watch the video.
-
-```javascript
+Here's an example Cloudflare Worker script which generates tokens that expire in 60 minutes and only work for users accessing the video from UK. In lines 2 and 3, you will configure the `id` and `jwk` values from step 1:
 
+```JavaScript
 // Global variables
 const jwkKey = '{PRIVATE-KEY-IN-JWK-FORMAT}'
 const keyID = '$KEYID'
@@ -326,122 +263,61 @@ function objectToBase64url(payload) {
 }
 ```
 
-## Security considerations
+### Step 3: Rendering the video 
 
-### Limiting where videos can be embedded
+If you are using the Stream Player, insert the token returned by the Worker in Step 2 in place of the video id:
 
-By default, Stream embed codes can be used on any domain. If needed, you can limit the domains a video can be embedded on from the Stream dashboard.
+```HTML
 
-In the dashboard, you will see a text box by each video labeled `Enter allowed origin domains separated by commas`. If you click on it, you can list the domains that the Stream embed code should be able to be used on.
-
-  * `*.badtortilla.com` covers a.badtortilla.com, a.b.badtortilla.com and badtortilla.com
-  * `example.com` does not cover www.example.com or any subdomain of example.com
-  * `localhost` covers localhost at any port
-  * There's no path support - `example.com` covers example.com/*
-
-You can also control embed limitation programmatically using the Stream API. `uid` in the example below refers to the video id.
-
-```sh
-curl -X POST \
--H "Authorization: Bearer $TOKEN" \
--d "{\"uid\": \"$VIDEOID\", \"allowedOrigins\": [\"example.com\"]}" \
-https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/$VIDEOID
+<iframe src="https://iframe.videodelivery.net/eyJhbGciOiJSUzI1NiIsImtpZCI6ImNkYzkzNTk4MmY4MDc1ZjJlZjk2MTA2ZDg1ZmNkODM4In0.eyJraWQiOiJjZGM5MzU5ODJmODA3NWYyZWY5NjEwNmQ4NWZjZDgzOCIsImV4cCI6IjE2MjE4ODk2NTciLCJuYmYiOiIxNjIxODgyNDU3In0.iHGMvwOh2-SuqUG7kp2GeLXyKvMavP-I2rYCni9odNwms7imW429bM2tKs3G9INms8gSc7fzm8hNEYWOhGHWRBaaCs3U9H4DRWaFOvn0sJWLBitGuF_YaZM5O6fqJPTAwhgFKdikyk9zVzHrIJ0PfBL0NsTgwDxLkJjEAEULQJpiQU1DNm0w5ctasdbw77YtDwdZ01g924Dm6jIsWolW0Ic0AevCLyVdg501Ki9hSF7kYST0egcll47jmoMMni7ujQCJI1XEAOas32DdjnMvU8vXrYbaHk1m1oXlm319rDYghOHed9kr293KM7ivtZNlhYceSzOpyAmqNFS7mearyQ" style="border: none;" height="720" width="1280" allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;" allowfullscreen="true"></iframe>
 
 ```
 
-### Signed URLs
-
-Combining signed URLs with embedding restrictions allows you to strongly control how your videos are viewed. This lets you serve only trusted users while preventing the signed URL from being hosted on an unknown site.
-
-To do so
-
-1. Sign a token and use it in an embed code on your site
-1. Make the video private
-1. Restrict the viewing domains to your site
-
-### Content Security Policy (CSP) considerations
-
-Content Security Policy (CSP) is a layer of security that helps to detect and prevent certain types of cross site scripting and data injection attacks. Most common way servers set CSP information is through headers at your origin server.
-
-If you are using CSP, you will need to add all subdomains of `cloudflarestream.com` and `videodelivery.net` to your CSP policy in order for Stream to work.
-
-    Content-Security-Policy: default-src 'self' *.cloudflarestream.com *.videodelivery.net
-
-If CSP is misconfigured your videos might not play or you might see an error similar to the one below in your browser's JavaScript console.
-
-    Refused to load the script 'https://embed.cloudflarestream.com/embed/r4xu.fla9.latest.js' because it violates the following Content Security Policy directive: ...
+If you are using your own player, replace the video id in the manifest url with the `token` value:
 
-Read more about Content Security Policy at [Mozilla Developer Network](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
+`https://videodelivery.net/eyJhbGciOiJSUzI1NiIsImtpZCI6ImNkYzkzNTk4MmY4MDc1ZjJlZjk2MTA2ZDg1ZmNkODM4In0.eyJraWQiOiJjZGM5MzU5ODJmODA3NWYyZWY5NjEwNmQ4NWZjZDgzOCIsImV4cCI6IjE2MjE4ODk2NTciLCJuYmYiOiIxNjIxODgyNDU3In0.iHGMvwOh2-SuqUG7kp2GeLXyKvMavP-I2rYCni9odNwms7imW429bM2tKs3G9INms8gSc7fzm8hNEYWOhGHWRBaaCs3U9H4DRWaFOvn0sJWLBitGuF_YaZM5O6fqJPTAwhgFKdikyk9zVzHrIJ0PfBL0NsTgwDxLkJjEAEULQJpiQU1DNm0w5ctasdbw77YtDwdZ01g924Dm6jIsWolW0Ic0AevCLyVdg501Ki9hSF7kYST0egcll47jmoMMni7ujQCJI1XEAOas32DdjnMvU8vXrYbaHk1m1oXlm319rDYghOHed9kr293KM7ivtZNlhYceSzOpyAmqNFS7mearyQ/manifest/video.m3u8`
 
-## Video access control
+### Revoking keys
 
-Video Access Control allow you to define Rules to have finer-grained control over your content than signed URL tokens alone. They are primarily aimed at making tokens conditionally valid based on user information. Access Rules are specified on token payloads as the `accessRules` property containing an array of `Rule` objects.
-
-If you're not already familiar with signed URLs, <a href="#signed-urls--tokens">start here.</a>
-
-### Rules
-
-A Rule has two components. The `action` is taken if the conditions associated with the `type` matches. Each `type` has an associated field that should be filled, see the <a href="#schema">schema</a> or <a href="#examples">examples</a> for details.
-
-These Rule types are available
-
-- `any` - Match all requests. May be used as a wildcard to apply a default action after other rules.
-- `ip.src` - Match specific IPv4 or IPV6 addresses or CIDRs.
-- `ip.geoip.country` - Match specific 2-letter country codes in [ISO 3166-1 Alpha 2](https://www.iso.org/obp/ui/#search) format.
-
-These Rule actions are available
-
-- `allow` - View is considered valid.
-- `block` - View is considered invalid and a 401 or 403 is returned.
-
-Access Rules are evaluated first-to-last. If a Rule matches, the associated `action` is applied and no further rules are evaluated.
-
-### Schema
+You can create up to 1,000 keys and rotate them at your convenience.
+Once revoked all tokens created with that key will be invalidated.
 
-A valid Rule object conforms to this type signature:
+```javascript
+// curl -X DELETE -H "Authorization: Bearer $TOKEN"  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/keys/$KEYID"
 
-```
 {
-	action: "allow" | "block";
-	type: "any";
-} | {
-	action: "allow" | "block";
-	type: "ip.src";
-	ip: (IPv4CidrRange | IPv6CidrRange | IPv4 | IPv6)[];
-} | {
-	action: "allow" | "block";
-	type: "ip.geoip.country";
-	country: string[];
+  "result": "Revoked",
+  "success": true,
+  "errors": [],
+  "messages": []
 }
 ```
+## Supported Restrictions
 
-In the future, Rule types or actions may be added. If you have other types of rules or actions you need for your video application, please contact Cloudflare support.
+<TableWrap>
 
-#### Examples
+| Property Name | Description |
+|------------------|-------------|
+| exp | Expiration. A unix epoch timestamp after which the token will stop working. Cannot be greater than 24 hours in the future from when the token is signed|
+| nbf | *Not Before* value. A unix epoch timestamp before which the token will not work |
+| downloadable | if true, the token can be used to download the mp4 (assuming the video has downloads enabled) |
+| accessRules | An array that specifies one or more ip and geo restrictions. accessRules are evaluated first-to-last. If a Rule matches, the associated action is applied and no further rules are evaluated. A token may have at most 5 members in the accessRules array. |
+</TableWrap>
 
-##### Allow only views from specific CIDRs
+### accessRules Schema
 
-```
-...
-"accessRules": [
-	{
-		"type": "ip.src",
-		"action": "allow",
-		"ip": ["93.184.216.0/24", "2400:cb00::/32"],
-	},
-	{
-		"type": "any",
-		"action": "block",
-	}
-]
-```
+Each accessRule must include 2 required properties:
+
+* `type`: supported values are `any`, `ip.src` and `ip.geoip.country`
+* `action`: support values are `allow` and `block`
 
-The first rule is an IP rule matching on CIDRs, `93.184.216.0/24` and `2400:cb00::/32`. When that rule matches, the `allow` action will abort rule evaluation and consider the view valid.
+Depending on the rule type, accessRules support 2 additional properties:
 
-If the first rule doesn't match, the second rule of `any` will match all remaining requests and block those views.
+* `country`: an array of 2-letter country codes in [ISO 3166-1 Alpha 2](https://www.iso.org/obp/ui/#search) format.
+* `ip`: an array of ip ranges. It is recommended to include both IPv4 and IPv6 variants in a rule if possible. Having only a single variant in a rule means that rule will ignore the other variant. For example, an IPv4-based rule will never be applicable to a viewer connecting from an IPv6 address. CIDRs should be preferred over specific IP addresses. Some devices, such as mobile, may change their IP over the course of a view. Video Access Control are evaluated continuously while a video is being viewed. As a result, overly strict IP rules may disrupt playback.
 
-##### Block views from a specific country
 
+***Example 1: Block views from a specific country***
 ```
 ...
 "accessRules": [
@@ -453,14 +329,11 @@ If the first rule doesn't match, the second rule of `any` will match all remaini
 ]
 ```
 
-The first rule matches on country, `US`, `DE`, and `MX` here. When that rule matches, the `block` action will have the token considered invalid.
+The first rule matches on country, US, DE, and MX here. When that rule matches, the block action will have the token considered invalid. If the first rule doesn't match, there are no further rules to evaluate. The behavior in this situation is to consider the token valid.
 
-If the first rule doesn't match, there are no further rules to evaluate. The behavior in this situation is to consider the token valid.
+***Example 2: Allow only views from specific country or IPs***
 
-##### Allow only views from specific country or IPs
-
-```
-...
+```...
 "accessRules": [
 	{
 		"type": "ip.geoip.country",
@@ -477,26 +350,38 @@ If the first rule doesn't match, there are no further rules to evaluate. The beh
 		"action": "block",
 	},
 ]
-```
+````
 
-The first rule matches on country, `US` and `MX` here. When that rule matches, the `allow` action will have the token considered valid. If it doesn't match we continue evaluating rules
+The first rule matches on country, US and MX here. When that rule matches, the allow action will have the token considered valid. If it doesn't match we continue evaluating rules
 
-The second rule is an IP rule matching on CIDRs, `93.184.216.0/24` and `2400:cb00::/32`. When that rule matches, the `allow` action will consider the rule valid.
+The second rule is an IP rule matching on CIDRs, 93.184.216.0/24 and 2400:cb00::/32. When that rule matches, the allow action will consider the rule valid.
 
-If the first two rules don't match, the final rule of `any` will match all remaining requests and block those views.
+If the first two rules don't match, the final rule of any will match all remaining requests and block those views.
 
-### Usage Notes
+## Security considerations
+
+### Hotlinking Protection
 
-#### Maximum Rule Count
+By default, Stream embed codes can be used on any domain. If needed, you can limit the domains a video can be embedded on from the Stream dashboard.
+
+In the dashboard, you will see a text box by each video labeled `Enter allowed origin domains separated by commas`. If you click on it, you can list the domains that the Stream embed code should be able to be used on.
+
+  * `*.badtortilla.com` covers a.badtortilla.com, a.b.badtortilla.com and badtortilla.com
+  * `example.com` does not cover www.example.com or any subdomain of example.com
+  * `localhost` requires a port if it is not being served over https on port 80 or over https on port 443
+  * There's no path support - `example.com` covers example.com/*
 
-A token may have at most 5 members in the `accessRules` array.
+You can also control embed limitation programmatically using the Stream API. `uid` in the example below refers to the video id.
 
-Note that most Rule types take arrays as arguments. For example, a rule of type `ip.src` can specify multiple IP addresses or CIDRs.
+```sh
+curl -X POST \
+-H "Authorization: Bearer $TOKEN" \
+-d "{\"uid\": \"$VIDEOID\", \"allowedOrigins\": [\"example.com\"]}" \
+https://api.cloudflare.com/client/v4/accounts/$ACCOUNT/stream/$VIDEOID
 
-If you require more than 5 rules, please contact Cloudflare support.
+```
 
-#### ip.src
+### Signed URLs
 
-It is recommended to include both IPv4 and IPv6 variants in a rule if possible. Having only a single variant in a rule means that rule will ignore the other variant. For example, an IPv4-based rule will never be applicable to a viewer connecting from an IPv6 address.
+Combining signed URLs with embedding restrictions allows you to strongly control how your videos are viewed. This lets you serve only trusted users while preventing the signed URL from being hosted on an unknown site.
 
-CIDRs should be preferred over specific IP addresses. Some devices, such as mobile, may change their IP over the course of a view. Video Access Control are evaluated continuously while a video is being viewed. As a result, overly strict IP rules may disrupt playback.
diff --git a/products/stream/src/content/viewing-videos/using-own-player.md b/products/stream/src/content/viewing-videos/using-own-player.md
index 002adfb6346..c0ca3385f54 100644
--- a/products/stream/src/content/viewing-videos/using-own-player.md
+++ b/products/stream/src/content/viewing-videos/using-own-player.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: reference
 ---
 
 # Using own player
@@ -64,6 +65,44 @@ This removes all video representations with a bitrate less than 1.8Mbps from the
 
 In this case, a customer is expressing their preference to have their content display at a higher minimum quality.
 
+### Using Stream videos as a cover background
+
+If you need complete control over the video element's CSS you can use a third party player like **hls.js** and the manifest with a video element.
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1.0"
+    />
+    <style>
+      body,
+      html {
+        height: 100%;
+        margin: 0;
+      }
+
+      #cover-video {
+        object-fit: cover;
+        width: 100%;
+        height: 100%;
+      }
+    </style>
+  </head>
+  <body>
+    <script src="https://unpkg.com/hls.js/dist/hls.min.js"></script>
+    <video autoplay muted loop id="cover-video"></video>
+    <script>
+      var hls = new Hls();
+      hls.loadSource("https://videodelivery.net/5d5bc37ffcf54c9b82e996823bffbb81/manifest/video.m3u8");
+      hls.attachMedia(document.getElementById("cover-video"));
+    </script>
+  </body>
+</html>
+```
+
 ## Limitations
 
 - [Analytics](/getting-analytics/) are not collected by third-party players, information such as minutes viewed and number of views will not be available on the Stream dashboard.
diff --git a/products/stream/src/content/viewing-videos/using-the-player-api.md b/products/stream/src/content/viewing-videos/using-the-player-api.md
index e4bd172c9dc..873cc20e8b1 100644
--- a/products/stream/src/content/viewing-videos/using-the-player-api.md
+++ b/products/stream/src/content/viewing-videos/using-the-player-api.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: reference
 ---
 
 # Using the player API
@@ -40,7 +41,7 @@ The SDK provides an API for programmatically controlling the player and listenin
 
 <Definitions>
 
-- `play()` <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ Promise">Promise</TypeLink>
+- `play()` <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise">Promise</TypeLink>
 
   - Start video playback.
 
diff --git a/products/stream/src/content/viewing-videos/using-the-stream-player.md b/products/stream/src/content/viewing-videos/using-the-stream-player.md
index 3099df9176d..6843c674872 100644
--- a/products/stream/src/content/viewing-videos/using-the-stream-player.md
+++ b/products/stream/src/content/viewing-videos/using-the-stream-player.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: reference
 ---
 
 # Using the Stream player
@@ -62,7 +63,7 @@ Player options are configured with querystring parameters in the iframe's `src`
 
 - `autoplay` <PropMeta>default: `false`</PropMeta>
 
-  - Tells the browser to immediately start downloading the video and play it as soon as it can. Note that mobile browsers generally do not support this attribute, the user must tap the screen to begin video playback. Please consider mobile users or users with Internet usage limits as some users don't have unlimited Internet access before using this attribute.
+  - If the autoplay flag is included as a querystring parameter, the player will attempt to autoplay the video. If you don't want the video to autoplay, don't include the autoplay flag at all (instead of setting it to `autoplay=false`.) Note that mobile browsers generally do not support this attribute, the user must tap the screen to begin video playback. Please consider mobile users or users with Internet usage limits as some users don't have unlimited Internet access before using this attribute.
 
     <Aside>
 
@@ -106,8 +107,14 @@ Player options are configured with querystring parameters in the iframe's `src`
 
   - A URL for an image to be shown before the video is started or while the video is downloading. If this attribute isn't specified, a thumbnail image of the video is shown.
 
+    <Aside type="note">
+
+      **Note:** Like all query string parameters, this value _must_ be URI encoded. For example, the thumbnail at `https://videodelivery.net/5d5bc37ffcf54c9b82e996823bffbb81/thumbnails/thumbnail.jpg?time=68s&height=270` can be encoded using JavaScript's `encodeURIComponent()` function to `https%3A%2F%2Fvideodelivery.net%2F5d5bc37ffcf54c9b82e996823bffbb81%2Fthumbnails%2Fthumbnail.jpg%3Ftime%3D68s%26height%3D270`.
+
+    </Aside>
+
 - `src`
 
   - The video id from the video you've uploaded to Cloudflare Stream should be included here.
 
-</Definitions>
\ No newline at end of file
+</Definitions>
diff --git a/products/tenant/docs-config.js b/products/tenant/docs-config.js
index 27169971c0f..08a1a45ea29 100644
--- a/products/tenant/docs-config.js
+++ b/products/tenant/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "With Cloudflare’s new provisioning APIs, you can provision and manage Cloudflare accounts and services for your team or your customers. A new set of APIs built into our Client v4 API library make a streamlined onboarding and setup experience",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/tenant",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/tenant/src/content/getting-started.md b/products/tenant/src/content/getting-started.md
index dd7e53b76b3..b175d070019 100644
--- a/products/tenant/src/content/getting-started.md
+++ b/products/tenant/src/content/getting-started.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: interim
 ---
 
 # Getting started
diff --git a/products/tenant/src/content/index.md b/products/tenant/src/content/index.md
index 1550848488d..cc5b94ef94b 100644
--- a/products/tenant/src/content/index.md
+++ b/products/tenant/src/content/index.md
@@ -1,6 +1,7 @@
 ---
-title: Welcome
+title: Overview
 order: 0
+pcx-content-type: landing-page
 ---
 
 # Cloudflare Tenant docs
diff --git a/products/tenant/src/content/tutorial/enabling-services.md b/products/tenant/src/content/tutorial/enabling-services.md
index c6dd4e34f33..8dee2ac4aba 100644
--- a/products/tenant/src/content/tutorial/enabling-services.md
+++ b/products/tenant/src/content/tutorial/enabling-services.md
@@ -1,6 +1,7 @@
 ---
 title: "3: Enabling services"
 order: 2
+pcx-content-type: tutorial
 ---
 
 # Step 3: Enabling services
diff --git a/products/tenant/src/content/tutorial/index.md b/products/tenant/src/content/tutorial/index.md
index be00674e6e1..d3f07c8d178 100644
--- a/products/tenant/src/content/tutorial/index.md
+++ b/products/tenant/src/content/tutorial/index.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: navigation
 ---
 
 # Tutorial
diff --git a/products/tenant/src/content/tutorial/provisioning-resources.md b/products/tenant/src/content/tutorial/provisioning-resources.md
index dc26b11512f..7242fddedf5 100644
--- a/products/tenant/src/content/tutorial/provisioning-resources.md
+++ b/products/tenant/src/content/tutorial/provisioning-resources.md
@@ -1,6 +1,7 @@
 ---
 title: "1: Provisioning resources"
 order: 0
+pcx-content-type: tutorial
 ---
 
 # Step 1: Provisioning resources
diff --git a/products/tenant/src/content/tutorial/service-configuration.md b/products/tenant/src/content/tutorial/service-configuration.md
index 7919c93ebc6..2d97767106c 100644
--- a/products/tenant/src/content/tutorial/service-configuration.md
+++ b/products/tenant/src/content/tutorial/service-configuration.md
@@ -1,6 +1,7 @@
 ---
 title: "4: Service configuration"
 weight: 40
+pcx-content-type: reference
 ---
 
 # Step 4: Service configuration
diff --git a/products/tenant/src/content/tutorial/user-access.md b/products/tenant/src/content/tutorial/user-access.md
index 7e3f25b2f34..30747ee97b9 100644
--- a/products/tenant/src/content/tutorial/user-access.md
+++ b/products/tenant/src/content/tutorial/user-access.md
@@ -1,6 +1,7 @@
 ---
 title: "2: User access"
 order: 1
+pcx-content-type: tutorial
 ---
 
 # Step 2: User access
diff --git a/products/terraform/docs-config.js b/products/terraform/docs-config.js
index 33e5961875c..998352fbcaa 100644
--- a/products/terraform/docs-config.js
+++ b/products/terraform/docs-config.js
@@ -36,6 +36,6 @@ module.exports = {
     description: "With Cloudflare’s Terraform provider, you can manage your edge using the same familiar tools you use to automate the rest of your infrastructure. Define and store configuration in source code repositories like GitHub, track and version changes over time, and roll back when needed—all without needing to learn the Cloudflare APIs",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/terraform",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/terraform/src/content/advanced-topics/importing-cloudflare-resources.md b/products/terraform/src/content/advanced-topics/importing-cloudflare-resources.md
index fafea148932..b6d0a2f54f6 100644
--- a/products/terraform/src/content/advanced-topics/importing-cloudflare-resources.md
+++ b/products/terraform/src/content/advanced-topics/importing-cloudflare-resources.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: tutorial
+---
+
 # Importing Cloudflare resources
 
 An important point to understand about Terraform is that it is only able to manage configuration that it created, or was explicitly told about after the fact. The reason for this limitation is that Terraform expects to be authoritative for the resources its manages. It relies on 2 types of files to understand what resources it controls, and what state they are in. This is how it determines when and how to make changes.
diff --git a/products/terraform/src/content/advanced-topics/index.md b/products/terraform/src/content/advanced-topics/index.md
index 49a3ef410ff..39108e59d2c 100644
--- a/products/terraform/src/content/advanced-topics/index.md
+++ b/products/terraform/src/content/advanced-topics/index.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: navigation
 ---
 
 # Advanced topics
diff --git a/products/terraform/src/content/advanced-topics/provider-customization.md b/products/terraform/src/content/advanced-topics/provider-customization.md
index cd70360fda6..d96d1dae682 100644
--- a/products/terraform/src/content/advanced-topics/provider-customization.md
+++ b/products/terraform/src/content/advanced-topics/provider-customization.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: best-practices
+---
+
 # Provider customization
 
 Terraform communicates with cloud and edge provider APIs such as Cloudflare through modules known as "providers". These providers are [installed automatically](/tutorial/hello-world/#2-initializing-terraform-and-the-cloudflare-provider) when you run `terraform init` in a directory that has a `.tf` file containing a provider. Typically, the only required parameters to the provider are what's required to authenticate. In many cases, however, it may make sense to customize the provider to your needs. Below we examine some of the [optional settings](https://www.terraform.io/docs/providers/cloudflare/#argument-reference) that can be passed to the Cloudflare Provider.
diff --git a/products/terraform/src/content/index.md b/products/terraform/src/content/index.md
index aa6c0090030..6c29854a9f1 100644
--- a/products/terraform/src/content/index.md
+++ b/products/terraform/src/content/index.md
@@ -1,12 +1,12 @@
 ---
-title: Welcome
+title: Overview
 order: 0
-type: overview
+pcx-content-type: landing-page
 ---
 
 <ContentColumn>
 
-# Cloudflare Terraform documentation
+# Cloudflare Terraform
 
 Configure Cloudflare using HashiCorp's “Infrastructure as Code” tool, Terraform.
 
diff --git a/products/terraform/src/content/installing.md b/products/terraform/src/content/installing.md
index 80a38472ee7..40d454c434e 100644
--- a/products/terraform/src/content/installing.md
+++ b/products/terraform/src/content/installing.md
@@ -1,6 +1,7 @@
 ---
 title: Installing
 order: 1
+pcx-content-type: how-to
 ---
 
 # Installing Terraform
diff --git a/products/terraform/src/content/tutorial/hello-world.md b/products/terraform/src/content/tutorial/hello-world.md
index 8346ba7da20..c7c5057d37c 100644
--- a/products/terraform/src/content/tutorial/hello-world.md
+++ b/products/terraform/src/content/tutorial/hello-world.md
@@ -1,23 +1,33 @@
 ---
 title: 1 – Hello World
 order: 1
+pcx-content-type: tutorial
 ---
 
 # Hello World
 
 Let’s say you have a web server for your domain that’s accessible on 203.0.113.10. You just signed up your domain, example.com, on Cloudflare and want to manage everything in Terraform.
 
-This tutorial step shows you how to get started. Before you do so, make sure you’ve [installed Terraform](/installing).
+This tutorial step shows you how to get started. Before you do so, make sure you’ve [installed Terraform](/installing). You will need to [create an API Token](https://developers.cloudflare.com/api/tokens/create) with permissions to edit resources for this tutorial.
 
 ## 1. Defining your first Terraform config file
 
 First we’ll create a initial Terraform config file. Any files ending in `.tf` will be processed by Terraform. As you configuration gets more complex you’ll want to split the config into separate files and modules, but for now we’ll proceed with a single file:
 
-```sh
+```bash
 $ cat > cloudflare.tf <<'EOF'
+terraform { 
+  required_providers {
+    cloudflare = {
+      source = "cloudflare/cloudflare"
+      version = "~> 2.0"
+    }
+  }
+}
+
 provider "cloudflare" {
-  email   = "you@example.com"
-  api_key = "your-api-key"
+      email = "you@example.com"
+      api_token = "your-api-token"
 }
 
 variable "zone_id" {
diff --git a/products/terraform/src/content/tutorial/index.md b/products/terraform/src/content/tutorial/index.md
index 6d7a4b16cc0..82801c6ac1d 100644
--- a/products/terraform/src/content/tutorial/index.md
+++ b/products/terraform/src/content/tutorial/index.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: navigation
 ---
 
 # Tutorial
diff --git a/products/terraform/src/content/tutorial/load-balance.md b/products/terraform/src/content/tutorial/load-balance.md
index 0748e6f4e15..16801439cea 100644
--- a/products/terraform/src/content/tutorial/load-balance.md
+++ b/products/terraform/src/content/tutorial/load-balance.md
@@ -1,6 +1,7 @@
 ---
 title: 5 – Sharing the load
 order: 5
+pcx-content-type: tutorial
 ---
 
 # Sharing the load
diff --git a/products/terraform/src/content/tutorial/page-rules.md b/products/terraform/src/content/tutorial/page-rules.md
index a86a94fd970..3febde663e2 100644
--- a/products/terraform/src/content/tutorial/page-rules.md
+++ b/products/terraform/src/content/tutorial/page-rules.md
@@ -1,6 +1,7 @@
 ---
 title: 6 – Making some exceptions
 order: 6
+pcx-content-type: tutorial
 ---
 
 # Making some exceptions
diff --git a/products/terraform/src/content/tutorial/rate-limit.md b/products/terraform/src/content/tutorial/rate-limit.md
index 7cc8cb30afb..9784af07a29 100644
--- a/products/terraform/src/content/tutorial/rate-limit.md
+++ b/products/terraform/src/content/tutorial/rate-limit.md
@@ -1,6 +1,7 @@
 ---
 title: 4 – Woah, slow down there
 order: 4
+pcx-content-type: tutorial
 ---
 
 # Woah, slow down there
diff --git a/products/terraform/src/content/tutorial/roll-back.md b/products/terraform/src/content/tutorial/roll-back.md
index b9e1c78f60c..1fa069de722 100644
--- a/products/terraform/src/content/tutorial/roll-back.md
+++ b/products/terraform/src/content/tutorial/roll-back.md
@@ -1,6 +1,7 @@
 ---
 title: 7 – On final thought...
 order: 7
+pcx-content-type: tutorial
 ---
 
 # On final thought, let’s roll some of that back
diff --git a/products/terraform/src/content/tutorial/source-control.md b/products/terraform/src/content/tutorial/source-control.md
index ba5da7e5f3c..b40c6de53ef 100644
--- a/products/terraform/src/content/tutorial/source-control.md
+++ b/products/terraform/src/content/tutorial/source-control.md
@@ -1,6 +1,7 @@
 ---
 title: 2 – Tracking your history
 order: 2
+pcx-content-type: tutorial
 ---
 
 # Tracking your history
@@ -8,7 +9,7 @@ order: 2
 In the [first step](/tutorial/hello-world) of the tutorial, you created and applied some basic Cloudflare configuration. Terraform was able to apply this configuration to your account because you provided your email address and API token at the top of the `cloudflare.tf` file:
 
 ```sh
-$ head -n4 cloudflare.tf
+$ head -n13 cloudflare.tf | tail -n4
 provider "cloudflare" {
   email = "you@example.com"
   api_token = "your-api-token"
@@ -25,7 +26,7 @@ As a good security practice we need to remove your Cloudflare credentials from a
 $ sed -ie 's/^.*email =.*$/  # email pulled from $CLOUDFLARE_EMAIL/' cloudflare.tf
 $ sed -ie 's/^.*api_token =.*$/  # token pulled from $CLOUDFLARE_API_TOKEN/' cloudflare.tf
 
-$ head -n4 cloudflare.tf
+$ head -n13 cloudflare.tf | tail -n4
 provider "cloudflare" {
   # email pulled from $CLOUDFLARE_EMAIL
   # token pulled from $CLOUDFLARE_API_TOKEN
@@ -88,7 +89,7 @@ $ git commit -m "Step 2 - Initial commit with webserver definition."
  create mode 100644 cloudflare.tf
 ```
 
-An astute reader may have noticed that we did _not_ commit the `.terraform` directory nor did we commit the `terraform.tfstate` file. The former was not committed because this repository may be used on a different architecture, and the plugins contained in this directory are built for the system on which `terraform init` was run. The latter was not committed as i) it may eventually contain sensitive strings and ii) it is not a good way to keep state in sync, as explained in Hashicorp's documentaion on [Remote State](https://www.terraform.io/docs/language/state/remote.html).
+An astute reader may have noticed that we did _not_ commit the `.terraform` directory nor did we commit the `terraform.tfstate` file. The former was not committed because this repository may be used on a different architecture, and the plugins contained in this directory are built for the system on which `terraform init` was run. The latter was not committed as i) it may eventually contain sensitive strings and ii) it is not a good way to keep state in sync, as explained in Hashicorp's documentation on [Remote State](https://www.terraform.io/docs/language/state/remote.html).
 
 To prevent git from bugging us about these files, let's add them to a new .gitignore file, commit it, and push everything to GitHub:
 
diff --git a/products/terraform/src/content/tutorial/zone-settings.md b/products/terraform/src/content/tutorial/zone-settings.md
index 3018502293f..b0f0d55efe7 100644
--- a/products/terraform/src/content/tutorial/zone-settings.md
+++ b/products/terraform/src/content/tutorial/zone-settings.md
@@ -1,6 +1,7 @@
 ---
 title: 3 – HTTPS all the things
 order: 3
+pcx-content-type: tutorial
 ---
 
 # HTTPS all the things
@@ -20,7 +21,7 @@ Switched to a new branch 'step3-https'
 $ cat >> cloudflare.tf <<'EOF'
 
 resource "cloudflare_zone_settings_override" "example-com-settings" {
-  name = var.domain
+  name = var.zone_id
 
   settings {
     tls_1_3                  = "on"
diff --git a/products/time-services/docs-config.js b/products/time-services/docs-config.js
index ed08d87a091..49f0694d295 100644
--- a/products/time-services/docs-config.js
+++ b/products/time-services/docs-config.js
@@ -24,6 +24,6 @@ module.exports = {
     description: "Cloudflare’s suite of time services: NTP, NTS, and Roughtime.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/time-services",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/waf/docs-config.js b/products/waf/docs-config.js
index 69e8cf186c0..e76077bc47b 100644
--- a/products/waf/docs-config.js
+++ b/products/waf/docs-config.js
@@ -24,6 +24,6 @@ module.exports = {
     description: "Protect against web application vulnerabilities with Cloudflare’s Web Application Firewall (WAF).",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/waf",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/waf/src/content/about.md b/products/waf/src/content/about.md
index 50c1351e3c4..9aa8d728b79 100644
--- a/products/waf/src/content/about.md
+++ b/products/waf/src/content/about.md
@@ -6,15 +6,23 @@ order: 1
 
 # About Cloudflare Web Application Firewall
 
-<Aside type='warning' header='Important'>
+<Aside type='note'>
 
 The Cloudflare WAF announced in March 2021 is available for selected customers on our paid plans.
 
 </Aside>
 
-The Cloudflare Web Application Firewall (WAF) checks incoming web requests and filters undesired traffic based on sets of rules called rulesets. The matching engine that powers the WAF rules supports the wirefilter syntax, the same syntax used for specifying Firewall Rules.
+The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on sets of rules called rulesets. The matching engine that powers the WAF rules supports the wirefilter syntax, the same syntax used for specifying Firewall Rules.
 
-The WAF includes [several Managed Rulesets](/managed-rulesets), provided by Cloudflare, that you can enable and configure. 
+## What is a Web Application Firewall?
+
+A Web Application Firewall or WAF creates a shield between a web app and the Internet. This shield can help mitigate many common attacks. For a more thorough definition, refer to [Web Application Firewall explained](https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/) in the Learning Center.
+
+---
+
+## Managed Rulesets
+
+The Cloudflare WAF includes [several Managed Rulesets](/managed-rulesets), provided by Cloudflare, that you can enable and configure.
 
 When you enable these Managed Rulesets, you get immediate protection from a broad set of security rules that are regularly updated. Each of these rules has a default action that varies according to the severity of the rule.
 
@@ -22,14 +30,16 @@ You can override the default action or disable one or more rules included in Man
 
 You can define a configuration that affects an entire Managed Ruleset, or configure the action and status of one or more rules in the ruleset. Rules have associated **tags** that allow you to search for a specific group of rules and configure them in bulk.
 
-Additionally, you can create custom rulesets with your own WAF rules that you can later enable or deploy.
+## Custom rulesets
 
-<Aside type='warning' header='Important'>
+<Aside type='warning'>
 
 Currently, you can only create and deploy custom rulesets via API.
 
 </Aside>
 
+You can [create custom rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets/create-custom-ruleset) with your own WAF rules that you can later [deploy to a phase entry point](/managed-rulesets/deploy-api#deploying-custom-rulesets).
+
 ## Available phases
 
 The Web Application Firewall provides the following [phases](https://developers.cloudflare.com/firewall/cf-rulesets#phases) where you can deploy WAF rules:
@@ -62,21 +72,21 @@ To deploy your own WAF rules, create a custom ruleset and add any custom rules t
 
 You can **create** and **deploy** custom rulesets to the `http_request_firewall_custom` phase at the **account** level (the phase `kind` is `root`).
 
-<Aside type='warning' header='Warning'>
+<Aside type='warning'>
 
 Currently, creating and deploying custom rulesets is only available via API.
 
 </Aside>
 
-To learn more about phases, see [Phases](https://developers.cloudflare.com/firewall/cf-rulesets#phases) in the Ruleset Engine documentation.
+To learn more about phases, refer to [Phases](https://developers.cloudflare.com/firewall/cf-rulesets#phases) in the Ruleset Engine documentation.
 
+---
 
 ## Get started
 
-To configure Managed Rulesets using the Cloudflare dashboard, check [Deploy Managed Rulesets for a zone in the dashboard](/managed-rulesets/deploy-zone-dashboard). 
+To configure Managed Rulesets using the Cloudflare dashboard, refer to [Deploy Managed Rulesets for a zone in the dashboard](/managed-rulesets/deploy-zone-dashboard).
 
 You can also use the Rulesets API to deploy rulesets to the available phases:
 
-* Deploy Managed Rulesets to the `http_request_firewall_managed` phase. See [Work with Managed Rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets).
-* Create and deploy custom rulesets to the `http_request_firewall_custom` phase. See [Work with custom rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets).
-
+* Deploy Managed Rulesets to the `http_request_firewall_managed` phase — refer to [Work with Managed Rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets).
+* Create and deploy custom rulesets to the `http_request_firewall_custom` phase — refer to [Work with custom rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets).
diff --git a/products/waf/src/content/change-log/2021-06-01.md b/products/waf/src/content/change-log/2021-06-01.md
new file mode 100644
index 00000000000..0480758894c
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-06-01.md
@@ -0,0 +1,149 @@
+---
+type: table
+order: 940
+---
+
+# 2021-06-01
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+      <tr>
+            <td>
+                Wordpress
+            </td>
+            <td>
+                WP0025D
+            </td>
+            <td>
+                Improve Rule Performance
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Wordpress
+            </td>
+            <td>
+                WP0026
+            </td>
+            <td>
+                Improve Rule Coverage
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+            <tr>
+            <td>
+                Wordpress
+            </td>
+            <td>
+                WP0023
+            </td>
+            <td>
+                Improve Rule Performance - Supersedes 100245
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+      <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100245
+            </td>
+            <td>
+                Remove 100245 (Wordpress - Broken Access Control - Update Script) - Superseded by WP0023
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+      <tr>
+            <td>
+                Drupal
+            </td>
+            <td>
+                D0000
+            </td>
+            <td>
+                Improve Rule Coverage
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+      <tr>
+            <td>
+                PHP
+            </td>
+            <td>
+                PHP100012
+            </td>
+            <td>
+                Improve Rule Coverage
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100222
+            </td>
+            <td>
+                Improve Rule Coverage
+            </td>
+            <td>
+                Disabled
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+      </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-06-07.md b/products/waf/src/content/change-log/2021-06-07.md
new file mode 100644
index 00000000000..6a2d378346d
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-06-07.md
@@ -0,0 +1,47 @@
+---
+type: table
+order: 939
+---
+
+# 2021-06-07
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+      <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100195
+            </td>
+            <td>
+                Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2021-31166 
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+      </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-06-14.md b/products/waf/src/content/change-log/2021-06-14.md
new file mode 100644
index 00000000000..9ce491a68f1
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-06-14.md
@@ -0,0 +1,81 @@
+---
+type: table
+order: 938
+---
+
+# 2021-06-14
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+      <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100139A
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Disabled
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+      <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100139B
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+      <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100139C
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+      </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-06-21.md b/products/waf/src/content/change-log/2021-06-21.md
new file mode 100644
index 00000000000..6c2355d9c85
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-06-21.md
@@ -0,0 +1,64 @@
+---
+type: table
+order: 937
+---
+
+# 2021-06-21
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100196
+            </td>
+            <td>
+                CVE-2021-21985 VSphere Virtual SAN Health Check 
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                100136A
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-07-01---emergency-release.md b/products/waf/src/content/change-log/2021-07-01---emergency-release.md
new file mode 100644
index 00000000000..98a7dc6037a
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-07-01---emergency-release.md
@@ -0,0 +1,65 @@
+---
+title: "2021-07-01 – Emergency"
+type: table
+order: 936
+---
+
+# 2021-07-01 – Emergency Release
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                Cloudflare Specials
+            </td>
+            <td>
+                100197
+            </td>
+            <td>
+                Block ReGeorg webshell
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Cloudflare Specials
+            </td>
+            <td>
+                100197B
+            </td>
+            <td>
+                Block ReGeorg webshell
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-07-19.md b/products/waf/src/content/change-log/2021-07-19.md
new file mode 100644
index 00000000000..414e71177dc
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-07-19.md
@@ -0,0 +1,98 @@
+---
+type: table
+order: 935
+---
+
+# 2021-07-19
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                OWASP XSS (URI)
+            </td>
+            <td>
+                uri-973346
+            </td>
+            <td>
+                Improve Rule Performance
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+        <tr>
+            <td>
+                OWASP XSS (URI)
+            </td>
+            <td>
+                uri-973322
+            </td>
+            <td>
+                Improve Rule performance 
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+        <tr>
+            <td>
+                OWASP XSS
+            </td>
+            <td>
+                973346
+            </td>
+            <td>
+                Improve Rule performance 
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+        <tr>
+            <td>
+                OWASP XSS
+            </td>
+            <td>
+                973322
+            </td>
+            <td>
+                Improve Rule performance 
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-07-26.md b/products/waf/src/content/change-log/2021-07-26.md
new file mode 100644
index 00000000000..4f1d474eeb6
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-07-26.md
@@ -0,0 +1,113 @@
+---
+type: table
+order: 934
+---
+
+# 2021-07-26
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule ID
+            </th>
+            <th>
+                Legacy Rule ID
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                OWASP XSS (URI)
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                uri-973345
+            </td>
+            <td>
+                Improve rule performance
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+        <tr>
+            <td>
+                OWASP XSS
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                973345
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Scoring Based
+            </td>
+            <td>
+                Scoring Based
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                100009
+            </td>
+            <td>
+                Improve rule performance 
+            </td>
+            <td>
+                Block
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                ...54622f7d
+            </td>
+            <td>
+                100200
+            </td>
+            <td>
+                Anomaly Header: Content-Type - Missing
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-08-16.md b/products/waf/src/content/change-log/2021-08-16.md
new file mode 100644
index 00000000000..892bf379520
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-08-16.md
@@ -0,0 +1,73 @@
+---
+type: table
+order: 933
+---
+
+# 2021-08-16
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule ID
+            </th>
+            <th>
+                Legacy Rule ID
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                ...603649a2
+            </td>
+            <td>
+                100210
+            </td>
+            <td>
+                Laravel - Code Injection - CVE-2021-3129
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Block
+            </td>
+        </tr>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                ...fe8ceb2f
+            </td>
+            <td>
+                100045A
+            </td>
+            <td>
+                Anomaly:URL:Query String - Multiple Slashes, Relative Paths, CR, LF or NULL 
+            </td>
+            <td>
+                N/A
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/2021-08-23.md b/products/waf/src/content/change-log/2021-08-23.md
new file mode 100644
index 00000000000..39d73978d81
--- /dev/null
+++ b/products/waf/src/content/change-log/2021-08-23.md
@@ -0,0 +1,53 @@
+---
+type: table
+order: 932
+---
+
+# 2021-08-23
+
+<TableWrap><table style="width: 100%">
+    <thead>
+        <tr>
+            <th>
+                Ruleset
+            </th>
+            <th>
+                Rule ID
+            </th>
+            <th>
+                Legacy Rule ID
+            </th>
+            <th>
+                Description
+            </th>
+            <th>
+                Previous Action
+            </th>
+            <th>
+                New Action
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>
+                Specials
+            </td>
+            <td>
+                ...090d53ee
+            </td>
+            <td>
+                100045
+            </td>
+            <td>
+                Anomaly:URL:Path - Multiple Slashes, Relative Paths, CR, LF or NULL
+            </td>
+            <td>
+                Disabled
+            </td>
+            <td>
+                Disabled
+            </td>
+        </tr>
+    </tbody>
+</table></TableWrap>
diff --git a/products/waf/src/content/change-log/scheduled-changes.md b/products/waf/src/content/change-log/scheduled-changes.md
index a5d20e34607..2c67b1f2de7 100644
--- a/products/waf/src/content/change-log/scheduled-changes.md
+++ b/products/waf/src/content/change-log/scheduled-changes.md
@@ -16,7 +16,10 @@ order: 1
                 Ruleset
             </th>
             <th>
-                Rule
+                Rule ID
+            </th>
+            <th>
+                Legacy Rule ID
             </th>
             <th>
                 Description
@@ -32,42 +35,22 @@ order: 1
     <tbody>
         <tr>
             <td>
-                2021-05-17
+                2021-08-23
             </td>
             <td>
-                2021-05-24
+                2021-08-31
             </td>
             <td>
-                Wordpress
+                Specials
             </td>
             <td>
-                WP0025D
+                …6aa0bef8
             </td>
             <td>
-                Improve Rule Performance
+                100201
             </td>
             <td>
-                Block
-            </td>
-            <td>
-                Block
-            </td>
-        </tr>
-        <tr>
-            <td>
-                2021-05-17
-            </td>
-            <td>
-                2021-05-24
-            </td>
-            <td>
-                Wordpress
-            </td>
-            <td>
-                WP0023
-            </td>
-            <td>
-                Improve Rule Performance
+                Improve rule performance
             </td>
             <td>
                 Block
@@ -78,42 +61,22 @@ order: 1
         </tr>
         <tr>
             <td>
-                2021-05-17
-            </td>
-            <td>
-                2021-05-24
-            </td>
-            <td>
-                Wordpress
-            </td>
-            <td>
-                WP0026
+                2021-08-23
             </td>
             <td>
-                Improve Rule Coverage
+                2021-08-31
             </td>
             <td>
-                Block
+                Specials
             </td>
             <td>
-                Block
+                 …c12cf9c8
             </td>
-        </tr>
-        <tr>
             <td>
-                2021-05-17
+                100202
             </td>
             <td>
-                2021-05-24
-            </td>
-            <td>
-                Drupal
-            </td>
-            <td>
-                D0000
-            </td>
-            <td>
-                Improve Rule Coverage
+                Improve rule performance
             </td>
             <td>
                 Block
@@ -124,19 +87,22 @@ order: 1
         </tr>
         <tr>
             <td>
-                2021-05-17
+                2021-08-23
             </td>
             <td>
-                2021-05-24
+                2021-08-31
             </td>
             <td>
-                PHP
+                Specials
             </td>
             <td>
-                PHP100011
+                 …f6cbb163
             </td>
             <td>
-                Improve Rule Coverage
+                100203
+            </td>
+            <td>
+                Improve rule performance
             </td>
             <td>
                 Block
@@ -147,19 +113,22 @@ order: 1
         </tr>
         <tr>
             <td>
-                2021-05-17
+                2021-08-23
+            </td>
+            <td>
+                2021-08-31
             </td>
             <td>
-                2021-05-24
+                Specials
             </td>
             <td>
-                PHP
+                 …047f06b4
             </td>
             <td>
-                PHP100012
+                100204
             </td>
             <td>
-                Improve Rule Coverage
+                Improve rule performance
             </td>
             <td>
                 Block
diff --git a/products/waf/src/content/ddos-l7-mitigation/configure-api.md b/products/waf/src/content/ddos-l7-mitigation/configure-api.md
new file mode 100644
index 00000000000..6da36594757
--- /dev/null
+++ b/products/waf/src/content/ddos-l7-mitigation/configure-api.md
@@ -0,0 +1,115 @@
+---
+title: Configure the Managed Ruleset via API
+pcx-content-type: concept
+order: 2
+---
+
+# Configure the HTTP DDoS Managed Ruleset via API
+
+Configure the Cloudflare HTTP DDoS Managed Ruleset by defining overrides using the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api).
+
+Each zone has the Cloudflare HTTP DDoS Managed Ruleset enabled by default. This means that you do not need to deploy the Managed Ruleset to the `ddos_l7` phase ruleset explicitly. You only have to create a rule in the phase ruleset to deploy the Managed Ruleset if you need to configure overrides.
+
+## Configure an override for the HTTP DDoS Managed Ruleset
+
+You can define overrides at the ruleset, tag, and rule level for all Managed Rulesets.
+
+When configuring the Cloudflare HTTP DDoS Managed Ruleset, use overrides to define a different **action** or **sensitivity level** from the default values. For more information on these rule parameters and the allowed values, see [Managed Ruleset override parameters](/ddos-l7-mitigation/override-parameters).
+
+<Aside type='warning' header='Important'>
+
+The Cloudflare HTTP DDoS Managed Ruleset is always enabled — you cannot disable its rules using an override with `"enabled": false`. Additionally, you must set the override `"expression"` field to `"true"`.
+
+</Aside>
+
+## Example
+
+The following `PUT` example creates a new phase ruleset (or updates the existing one) for the `ddos_l7` phase at the account level. The request includes several overrides to adjust the default behavior of the HTTP DDoS Managed Ruleset. These overrides are the following:
+
+* All rules of the Managed Ruleset will use the `challenge` action and have a sensitivity level of `medium`.
+* All rules tagged with the category `{category-name}` will have a sensitivity level of `low`.
+* The rule with ID `{rule-id}` will use the `block` action.
+
+```json
+curl -X PUT \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED"
+"https://api.cloudflare.com/client/v4/accounts/{account-id}/rulesets/phases/ddos_l7/entrypoint" \
+-d '{
+  "description": "Execute Cloudflare HTTP DDoS Managed Ruleset on my account-level phase ruleset",
+  "rules": [
+    {
+      "action": "execute",
+      "action_parameters": {
+        "id": "{managed-ruleset-id}",
+        "overrides": {
+          "sensitivity_level": "medium",
+          "action": "challenge",
+          "categories": [
+            {
+              "category": "{tag-name}",
+              "sensitivity_level": "low"
+            }
+          ],
+          "rules": [
+            {
+              "id": "{rule-id}",
+              "action": "block"
+            }
+          ]
+        }
+      },
+      "expression": "true",
+    }
+  ]
+}'
+```
+
+The response returns the created (or updated) phase ruleset.
+
+```json
+{
+  "result": {
+    "id": "{root-ruleset-id}",
+    "name": "default",
+    "description": "Execute Cloudflare HTTP DDoS Managed Ruleset on my account-level phase ruleset",
+    "kind": "root",
+    "version": "1",
+    "rules": [
+      {
+        "id": "{overridden-rule-id}",
+        "version": "1",
+        "action": "execute",
+        "action_parameters": {
+          "id": "{managed-ruleset-id}",
+          "version": "latest",
+          "overrides": {
+            "action": "challenge",
+            "categories": [
+              {
+                "category": "{category-name}",
+                "sensitivity_level": "low"
+              }
+            ],
+            "rules": [
+              {
+                "id": "{rule-id}",
+                "action": "block"
+              }
+            ],
+            "sensitivity_level": "medium"
+          }
+        },
+        "expression": "true",
+        "last_updated": "2021-06-16T04:14:47.977741Z",
+        "ref": "{overridden-rule-ref}",
+        "enabled": true
+      }
+    ],
+    "last_updated": "2021-06-16T04:14:47.977741Z",
+    "phase": "ddos_l7"
+  }
+}
+```
+
+For more information on defining overrides for Managed Rulesets using the Rulesets API, check [Override a Managed Ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets/override-managed-ruleset).
diff --git a/products/waf/src/content/ddos-l7-mitigation/configure-dashboard.md b/products/waf/src/content/ddos-l7-mitigation/configure-dashboard.md
new file mode 100644
index 00000000000..69264b1d6d7
--- /dev/null
+++ b/products/waf/src/content/ddos-l7-mitigation/configure-dashboard.md
@@ -0,0 +1,44 @@
+---
+title: Configure the Managed Ruleset in the dashboard
+pcx-content-type: how-to
+order: 1
+---
+
+# Configure the HTTP DDoS Managed Ruleset in the dashboard
+
+You can customize the **action** and **sensitivity** of the rules in the Cloudflare HTTP DDoS Managed Ruleset in the following ways:
+
+* [Configure all the rules in the ruleset](#configure-all-the-rules-in-the-ruleset)
+* [Configure one or more rules](#configure-one-or-more-rules)
+
+Tag and rule configurations have greater priority than ruleset configurations.
+
+For more information on the available parameters and allowed values, refer to [Managed Ruleset parameters](/ddos-l7-mitigation/override-parameters).
+
+## Configure all the rules in the ruleset
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and website.
+1. Go to **Firewall** > **DDoS**.
+1. Next to **HTTP DDoS attack protection**, click **Configure**.
+1. In **Ruleset configuration**, select the action and sensitivity values for all the rules in the HTTP DDoS Managed Ruleset.
+
+    ![Configure HTTP DDoS Managed Ruleset](../images/ddos/ddos-configure-ruleset.png)
+
+1. Click **Save**.
+
+## Configure one or more rules
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and website.
+1. Go to **Firewall** > **DDoS**.
+1. Next to **HTTP DDoS attack protection**, click **Configure**.
+1. In **Rule configuration**, click **Browse rules**.
+1. Search for the rules you wish to configure using the available filters. You can search for tags.
+
+    ![Configure rules in Managed Ruleset](../images/ddos/ddos-configure-rules.png)
+
+1. To configure a single rule, select the desired value for a field in the displayed dropdowns next to the rule.
+
+    To configure more than one rule, select the rules using the row checkboxes and update the fields for the selected rules using the dropdowns displayed before the table. You can also configure all the rules with a given tag. For more information, refer to [Configure rules in bulk in a Managed Ruleset](https://developers.cloudflare.com/waf/managed-rulesets/deploy-zone-dashboard#configure-rules-in-bulk-in-a-managed-ruleset).
+
+1. Click **Next**.
+1. Click **Save**.
diff --git a/products/waf/src/content/ddos-l7-mitigation/index.md b/products/waf/src/content/ddos-l7-mitigation/index.md
new file mode 100644
index 00000000000..b1003e59e4a
--- /dev/null
+++ b/products/waf/src/content/ddos-l7-mitigation/index.md
@@ -0,0 +1,50 @@
+---
+pcx-content-type: concept
+order: 4
+---
+
+# DDoS L7 Attack Mitigation
+
+Cloudflare provides protection against DDoS L7 attacks through several mitigation systems and rules. The HTTP DDoS Managed Ruleset contains a subset of these rules. This Managed Ruleset is enabled by default for all customers, regardless of their Cloudflare plan, and provides protection against a broad range of DDoS attack vectors.
+
+---
+
+## The Cloudflare HTTP DDoS Managed Ruleset
+
+The Cloudflare HTTP DDoS Managed Ruleset is a set of pre-configured rules used to match known DDoS attack vectors at the application layer on the edge, like the following:
+
+* Requests causing large amounts of origin errors
+* Excessive traffic hitting origin
+* Excessive traffic hitting cache
+* Abuse of search features and authentication endpoints
+* Other attack vectors
+
+Cloudflare updates the list of rules in the Managed Ruleset on a regular basis.
+
+The Cloudflare HTTP DDoS Managed Ruleset provides users with increased observability into layer 7 DDoS attacks mitigated by Cloudflare, informing users of ongoing or past attacks. The Firewall dashboard, available at **Firewall** > **Overview**, will display additional information on the types of layer 7 DDoS attacks detected for a specific zone.
+
+### Ruleset configuration
+
+You can adjust the behavior of the rules in the Managed Ruleset by modifying the following parameters:
+
+* The performed **action** when an attack is detected
+* The **sensitivity** of attack detection mechanisms
+
+**Note:** Certain actions or sensitivity levels may not be available to all Cloudflare plans.
+
+To adjust rule behavior, do one of the following:
+
+* [Configure the Cloudflare HTTP DDoS Managed Ruleset in the dashboard](/ddos-l7-mitigation/configure-dashboard).
+* [Configure HTTP DDoS Managed Ruleset overrides via API](/ddos-l7-mitigation/configure-api).
+
+For more information on the available configuration parameters, see [Managed Ruleset parameters](/ddos-l7-mitigation/override-parameters).
+
+<Aside type='note' header='Note'>
+
+The Cloudflare HTTP DDoS Managed Ruleset is always enabled — you can only customize its behavior.
+
+</Aside>
+
+## Availability
+
+The Cloudflare HTTP DDoS feature is available to all customers.
diff --git a/products/waf/src/content/ddos-l7-mitigation/override-parameters.md b/products/waf/src/content/ddos-l7-mitigation/override-parameters.md
new file mode 100644
index 00000000000..28e404eb4e0
--- /dev/null
+++ b/products/waf/src/content/ddos-l7-mitigation/override-parameters.md
@@ -0,0 +1,73 @@
+---
+title: Managed Ruleset parameters
+pcx-content-type: reference
+order: 3
+---
+
+# HTTP DDoS Managed Ruleset parameters
+
+Configure the Cloudflare HTTP DDoS Managed Ruleset to change the action applied to a given attack or modify the sensitivity level of the detection mechanism. You can [configure the Managed Ruleset in the Cloudflare dashboard](/ddos-l7-mitigation/configure-dashboard) or [define overrides via Rulesets API](/ddos-l7-mitigation/configure-api).
+
+The available parameters are the following:
+
+* [Action](#action)
+* [Sensitivity](#sensitivity)
+
+## Action
+
+API property name: `"action"`.
+
+The action that the WAF will perform for requests that match specific rules of Cloudflare's DDoS mitigation services. The available actions are:
+
+<Definitions>
+
+- **Log**
+    - API value: `"log"`.
+    - Only available on Enterprise plans. Logs requests that match the expression of a rule detecting layer 7 DDoS attacks. Recommended for validating a rule before committing to a more severe action.
+
+- **Block**
+    - API value: `"block"`.
+    - Blocks HTTP requests that match the rule expression.
+
+- **Challenge (CAPTCHA)**
+    - API value: `"challenge"`.
+    - Presents a CAPTCHA challenge to the clients making HTTP requests that match a rule expression.
+
+- **Force Connection Close**
+    - API value: _N/A_ (internal rule action that you cannot use in overrides).
+    - Closes ongoing HTTP connections. This action does not block a request, but it forces the client to reconnect.
+    - The performed action depends on the HTTP version:
+
+      - HTTP/1: set the [`Connection` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection#directives) to `close`.
+      - HTTP/2: send a [`GOAWAY` frame](https://datatracker.ietf.org/doc/html/rfc7540#section-6.8) to the client.
+
+- **DDoS Dynamic**
+    - API value: _N/A_ (internal rule action that you cannot use in overrides).
+    - Performs a specific action according to a set of internal guidelines defined by Cloudflare. The executed action can be one of the above or an undisclosed mitigation action.
+
+</Definitions>
+
+<Aside type='warning' header='Important'>
+
+You cannot configure the rule action to _Log_ for rules with the `gatebot` tag or any rule whose `id` starts with `GB`.
+
+However, you can use the _Log_ action in the global ruleset configuration. In this case, any rule with the `gatebot` tag or whose `id` starts with `GB` will ignore the ruleset configuration and use the default action as defined in the Managed Ruleset.
+
+</Aside>
+
+## Sensitivity
+
+API property name: `"sensitivity_level"`.
+
+Defines how sensitive a rule is. Affects the thresholds used to determine if an attack should be mitigated. A higher sensitivity level means having a lower threshold, while a lower sensitivity level means having a higher threshold.
+
+The available sensitivity levels are:
+
+UI value          | API value
+------------------|----------
+_High_            | `"default"`
+_Medium_          | `"medium"`
+_Low_             | `"low"`
+_Essentially Off_ | `"eoff"`
+
+You cannot increase the sensitivity level beyond _High_ (`"default"`).
diff --git a/products/waf/src/content/exposed-credentials-check/configure-api.md b/products/waf/src/content/exposed-credentials-check/configure-api.md
index ec83298da1e..20f17606583 100644
--- a/products/waf/src/content/exposed-credentials-check/configure-api.md
+++ b/products/waf/src/content/exposed-credentials-check/configure-api.md
@@ -27,8 +27,7 @@ To deploy the Managed Ruleset for a given zone, do the following:
 
 For more information on deploying a Managed Ruleset, check [Deploy a Managed Ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets/deploy-managed-ruleset).
 
-
-## Configure an override for the Exposed Credentials Check Managed Ruleset
+### Configure an override for the Exposed Credentials Check Managed Ruleset
 
 An override allows you to define an action or status different from the default values as configured by Cloudflare. You can define overrides at the ruleset, tag, and rule level for all Managed Rulesets, including the Exposed Credentials Check Managed Ruleset.
 
@@ -36,7 +35,13 @@ For more information on defining overrides for Managed Rulesets using the Rulese
 
 ## Create a custom rule checking for exposed credentials
 
-You can create rules that check for exposed credentials using the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api).
+<Aside type="note">
+
+This feature is only available to customers on an Enterprise plan.
+
+</Aside>
+
+You can create rules that check for exposed credentials using the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api). Include these rules in a custom ruleset, which you must create at the account level, and then deploy the custom ruleset to a phase.
 
 A rule with exposed credentials check has a match when both the rule expression and the result from the exposed credentials check are true.
 
@@ -54,9 +59,9 @@ These options have additional requirements:
 
 </Aside>
 
-You can use the `exposed_credential_check` field in rules with one of the following actions: `rewrite`, `log`, `block`, `challenge`, or `js_challenge`. 
+You can use the `exposed_credential_check` field in rules with one of the following actions: `rewrite`, `log`, `block`, `challenge`, or `js_challenge`.
 
-To create and deploy a custom ruleset, follow the workflow described in [Work with custom rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets). 
+To create and deploy a custom ruleset, follow the workflow described in [Work with custom rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets).
 
 ### Example
 
@@ -81,7 +86,7 @@ curl -X POST \
       }
     }
   ],
-  "phase": "http_request_firewall_managed"
+  "phase": "http_request_firewall_custom"
 }
 ```
 
@@ -94,7 +99,7 @@ The response returns the created ruleset. Note the presence of the `exposed_cred
     "name": "Custom Ruleset 1",
     "description": "This ruleset includes a rule checking for exposed credentials.",
     "kind": "custom",
-    "version": "3",
+    "version": "1",
     "rules": [
       {
         "id": "{custom-rule-id}",
@@ -109,11 +114,16 @@ The response returns the created ruleset. Note the presence of the `exposed_cred
         "ref": "{custom-rule-ref}",
         "enabled": true
       }
-    ]
-  }
+    ],
+    "last_updated": "2021-03-19T10:48:04.057775Z",
+    "phase": "http_request_firewall_custom"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
 }
 ```
 
 The example above uses the `url_decode()` function because fields in the request body (available in `http.request.body.form`) are URL-encoded when the content type is `application/x-www-form-urlencoded`.
 
-See [Deploy a custom ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets/deploy-custom-ruleset/) for more information on deploying custom rulesets using the Rulesets API.
+After creating a custom ruleset, deploy it to a phase so that it can execute. Refer to [Deploy a custom ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rulesets/deploy-custom-ruleset) for more information.
diff --git a/products/waf/src/content/exposed-credentials-check/index.md b/products/waf/src/content/exposed-credentials-check/index.md
index 8256082e0f9..ed2efa605e7 100644
--- a/products/waf/src/content/exposed-credentials-check/index.md
+++ b/products/waf/src/content/exposed-credentials-check/index.md
@@ -5,16 +5,16 @@ order: 3
 
 # Automated exposed credentials check (Beta)
 
-<Aside type='warning'>
+<Aside type='note'>
 
-This feature is only available for selected customers on an Enterprise plan.
+This feature is available to all paid plans.
 
 </Aside>
 
 Many web applications have suffered credential stuffing attacks in the recent past. In these attacks there is a massive number of login attempts using username/password pairs from databases of exposed credentials.
 
 Cloudflare offers you automated checks for exposed credentials using Cloudflare Web Application Firewall (WAF).
- 
+
 The WAF provides two mechanisms for this check:
 
 * The **Exposed Credentials Check Managed Ruleset**, which contains predefined rules for popular CMS applications. By enabling this ruleset for a given zone, you immediately enable checks for exposed credentials for these well-known applications.
@@ -66,7 +66,6 @@ The Managed Ruleset contains an additional rule that blocks HTTP requests alread
 
 You can turn the Managed Ruleset on/off and customize the action performed by each rule when there is a match. Check [Configure exposed credentials check in the dashboard](/exposed-credentials-check/configure-dashboard) for more information.
 
-
 ## Exposed credentials checks in custom rules
 
 <Aside type='warning'>
@@ -89,4 +88,4 @@ Rules that check for exposed credentials run before Rate Limiting Rules.
 
 ## Availability
 
-Exposed credentials checking is available in Beta to customers on an Enterprise plan, where it is enabled by default.
+Exposed credentials checking is available in Beta to all paid plans.
diff --git a/products/waf/src/content/exposed-credentials-check/test-configuration.md b/products/waf/src/content/exposed-credentials-check/test-configuration.md
index 60b3b14caff..a1bf7c4c70a 100644
--- a/products/waf/src/content/exposed-credentials-check/test-configuration.md
+++ b/products/waf/src/content/exposed-credentials-check/test-configuration.md
@@ -1,5 +1,4 @@
 ---
-title: Test your configuration
 pcx-content-type: reference
 order: 4
 ---
diff --git a/products/waf/src/content/images/ddos/ddos-configure-rules.png b/products/waf/src/content/images/ddos/ddos-configure-rules.png
new file mode 100644
index 00000000000..ffa03fba9a1
Binary files /dev/null and b/products/waf/src/content/images/ddos/ddos-configure-rules.png differ
diff --git a/products/waf/src/content/images/ddos/ddos-configure-ruleset.png b/products/waf/src/content/images/ddos/ddos-configure-ruleset.png
new file mode 100644
index 00000000000..ace74b10728
Binary files /dev/null and b/products/waf/src/content/images/ddos/ddos-configure-ruleset.png differ
diff --git a/products/waf/src/content/images/waf-apply-changes-modal.png b/products/waf/src/content/images/waf-apply-changes-modal.png
deleted file mode 100644
index f616cfa4b4b..00000000000
Binary files a/products/waf/src/content/images/waf-apply-changes-modal.png and /dev/null differ
diff --git a/products/waf/src/content/managed-rulesets/deploy-api.md b/products/waf/src/content/managed-rulesets/deploy-api.md
index cce357a20c3..b353eb68364 100644
--- a/products/waf/src/content/managed-rulesets/deploy-api.md
+++ b/products/waf/src/content/managed-rulesets/deploy-api.md
@@ -9,23 +9,35 @@ Use the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/ru
 
 ## Deploying Managed Rulesets
 
-You can deploy Managed Rulesets to the `http_request_firewall_managed` phase supported by the Cloudflare WAF, both at the account level and at the zone level. You can also define overrides to customize the behavior of the rules included in a Managed Ruleset.
+You can deploy WAF Managed Rulesets to the `http_request_firewall_managed` phase, both at the account level and at the zone level.
 
-<Aside type='warning' header='Important'>
+Other Managed Rulesets, like DDoS Managed Rulesets, must be deployed to a different phase. Check the specific Managed Ruleset documentation for details.
+
+You can define overrides to customize the behavior of the rules included in a Managed Ruleset.
 
-There are a few requirements when deploying Managed Rulesets to the `http_request_firewall_managed` phase at the **zone** level:
+**Note:** There are a few requirements when deploying WAF Managed Rulesets to the `http_request_firewall_managed` phase at the **zone** level:
 
 * The zone-level phase can only have two `execute` rules deploying Managed Rulesets: one rule for deploying the OWASP Managed Ruleset and another rule for deploying the Cloudflare Managed Rules.
 
 * You must set the `expression` field to `true` in these two rules, which means that they apply to all zone requests.
 
-</Aside>
-
 To learn more about deploying Managed Rulesets and configuring overrides using the Rulesets API, see [Work with Managed Rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets).
 
+<Aside type="warning" header="Important">
+
+Currently, each Managed Ruleset will execute **at most once per request**. Configuring a second rule that executes the same Managed Ruleset will have no effect.
+
+For example, consider two account-level rules with different expressions that execute the same Managed Ruleset. If the two rules match for the same request, the Managed Ruleset will not be executed for the second rule.
+
+As another example, consider an account-level rule that executes a Managed Ruleset and a zone-level rule that executes the same Managed Ruleset. If both rules match for the same request, the Managed Ruleset is only executed when the account-level rule is evaluated.
+
+ This behavior will change in the future so that you can execute each Managed Ruleset multiple times per request.
+
+</Aside>
+
 ## Deploying custom rulesets
 
-You can create custom rulesets in the `http_request_firewall_custom` phase at the account level. After creating a custom ruleset, you can deploy it to a phase at the account level by creating an `execute` rule in the phase.
+You can create custom rulesets in the `http_request_firewall_custom` phase at the account level. After creating a custom ruleset, you can deploy it to a phase at the account level by adding a rule to the phase entry point that executes the custom ruleset.
 
 <Aside type='warning' header='Important'>
 
diff --git a/products/waf/src/content/managed-rulesets/deploy-zone-dashboard.md b/products/waf/src/content/managed-rulesets/deploy-zone-dashboard.md
index 7bddf6937e1..16b5311c926 100644
--- a/products/waf/src/content/managed-rulesets/deploy-zone-dashboard.md
+++ b/products/waf/src/content/managed-rulesets/deploy-zone-dashboard.md
@@ -10,27 +10,37 @@ You can enable and configure Managed Rulesets for a zone in the **Managed Rules*
 
 ![Managed Rules tab of Firewall app](../images/waf-managed-rules-tab.png)
 
-<Aside type='note' header='Note'>
+## Enable or disable a Managed Ruleset
 
-When you enable a Managed Ruleset in the **Managed Rules** tab under Firewall, you are deploying that Managed Ruleset to the zone-level `http_request_firewall_managed` phase.
+When you enable a Managed Ruleset in the **Managed Rules** tab under Firewall, you are deploying that Managed Ruleset to the zone-level `http_request_firewall_managed` phase entry point ruleset.
 
-</Aside>
+<Aside type="note">
 
-## Enable or disable a Managed Ruleset
+You many not be able to configure the status of certain Managed Rulesets.
+
+</Aside>
 
-In the Web Application Firewall (WAF) interface, click the on/off toggle on the right of a Managed Ruleset to enable or disable all the rules in that ruleset.
+In the Web Application Firewall (WAF) interface, click the toggle on the right of a Managed Ruleset to enable or disable all the rules in that ruleset.
 
 ## Configure a Managed Ruleset
 
-### Configure an action for all the rules
+<Aside type="note">
 
-To configure an action for all the rules in a Managed Ruleset:
+Some Managed Rulesets may not allow custom configuration, depending on your Cloudflare plan.
 
-1. Open the **Firewall Rules** tab of the **Firewall** tile.
+</Aside>
+
+### Configure field values for all the rules
+
+To configure rule field values for all the rules in a Managed Ruleset:
+
+1. Navigate to **Firewall** > **Managed Rules**.
 
 1. On the right of the Managed Ruleset you want to configure, click **Configure**.
 
-1. Select the action to perform for all the rules in the ruleset from the **Ruleset Action** drop-down list.
+1. Under **Ruleset configuration**, set one or more rule fields from the available values in the drop-down lists.
+
+    For example, select the action to perform for all the rules in the ruleset from the **Ruleset Action** drop-down list.
 
     ![Configure Managed Ruleset](../images/waf-configure-ruleset.png)
 
@@ -64,7 +74,9 @@ Do the following:
 
 1. Find the rule you want to configure in the results list.
 
-1. In the result line for the rule you want to change, select the action for the rule in the **Action** dropdown, or change the status of the rule using the toggle available on the right.
+1. In the result line for the rule you want to change, select the desired value for a field in the displayed drop-down lists. For example, select the rule action in the **Action** dropdown.
+
+    In some Managed Rulesets, you can also change the status of a rule using the toggle available on the right.
 
     ![Browse rules in Managed Ruleset](../images/waf-browse-rules.png)
 
@@ -88,7 +100,7 @@ Do the following:
 
     Alternatively, click a tag name under the search input to filter the rules with that tag, and then click the checkboxes for the rules you want to configure.
 
-1. To change the action or the status for the selected rules, select one of the options in the **Set action** and **Set status** drop-down lists, displayed in the top right corner of the table.
+1. Update one or more fields for the selected rules using the drop-down lists displayed in the top right corner of the table.
 
     ![Configure Managed Ruleset rules in bulk](../images/waf-modify-selected-rules.png)
 
@@ -96,9 +108,7 @@ Do the following:
 
     <Aside type='note' header='Note'>
 
-    If you selected a tag, you get a dialog asking you if any new rules with the selected tag should be configured with the action and status you selected.
-
-    ![Modal asking whether to apply changes to new rules in selected tag or not](../images/waf-apply-changes-modal.png)
+    If you selected a tag, you get a dialog asking you if any new rules with the selected tag should be configured with the field values you selected.
 
     Select **Do not apply to new rules** to apply your configurations to the selected rules only.
 
@@ -107,3 +117,11 @@ Do the following:
     </Aside>
 
 1. Click **Save**.
+
+## Phases of deployed Managed Rulesets
+
+When you enable a Managed Ruleset under **Web Application Firewall (WAF)**, you are deploying that Managed Ruleset to the zone-level `http_request_firewall_managed` phase.
+
+Other Managed Rulesets, like DDoS Managed Rulesets, are deployed to a different phase. Check the specific Managed Ruleset documentation for details.
+
+For more information on phases, see [Phases](https://developers.cloudflare.com/firewall/cf-rulesets#phases).
diff --git a/products/waf/src/content/managed-rulesets/index.md b/products/waf/src/content/managed-rulesets/index.md
index db429c33912..11a6e66a86e 100644
--- a/products/waf/src/content/managed-rulesets/index.md
+++ b/products/waf/src/content/managed-rulesets/index.md
@@ -31,6 +31,10 @@ Cloudflare provides the following Managed Rulesets in the WAF:
       <td style='width:30%; word-wrap:break-word; white-space:normal'>Cloudflare Data Loss Prevention (Beta)</td>
       <td>Created by Cloudflare to address common data loss threats. These rules run on the response phase and monitor download of files or specific sensitive data — for example, financial and personally identifiable information.</td>
     </tr>
+    <tr>
+      <td style='width:30%; word-wrap:break-word; white-space:normal'><a href='/ddos-l7-mitigation#the-cloudflare-http-ddos-managed-ruleset'>Cloudflare HTTP DDoS Managed Ruleset (Beta)</a></td>
+      <td>Created by Cloudflare to give users more control over how and when Cloudflare's automated mitigation systems will handle layer 7 DDoS attacks. The rules in this Managed Ruleset are always enabled. However, you can define overrides to modify the rule actions and the sensitivity of the various rules.</td>
+    </tr>
   </tbody>
 </table></TableWrap>
 
diff --git a/products/waf/src/content/managed-rulesets/payload-logging/command-line/index.md b/products/waf/src/content/managed-rulesets/payload-logging/command-line/index.md
index 5aaf2fd0c7b..83cf4684a77 100644
--- a/products/waf/src/content/managed-rulesets/payload-logging/command-line/index.md
+++ b/products/waf/src/content/managed-rulesets/payload-logging/command-line/index.md
@@ -1,6 +1,6 @@
 ---
 pcx-content-type: navigation
-order: 3
+order: 4
 ---
 
 # Command-line operations
diff --git a/products/waf/src/content/managed-rulesets/payload-logging/configure-api.md b/products/waf/src/content/managed-rulesets/payload-logging/configure-api.md
new file mode 100644
index 00000000000..ef3abcc1dfa
--- /dev/null
+++ b/products/waf/src/content/managed-rulesets/payload-logging/configure-api.md
@@ -0,0 +1,128 @@
+---
+title: Configure payload logging via API
+pcx-content-type: how-to
+order: 3
+---
+
+# Configure payload logging for a Managed Ruleset via API
+
+You can use the [Rulesets API](https://api.cloudflare.com/) to configure payload logging for a Managed Ruleset.
+
+## Configure and enable payload logging
+
+To configure:
+
+1. Use the [Update rule in ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update-rule) API method to update the rule that executes the Managed Ruleset.
+
+1. In the configuration of the rule that executes the Managed Ruleset, include a `matched_data` object in `action_parameters` to configure payload logging.
+
+    The `matched_data` object has the following structure:
+
+    ```json
+    ---
+    highlight: [3,4,5]
+    ---
+    "action_parameters": {
+      // ...
+      "matched_data": {
+        "public_key": "<PUBLIC_KEY_VALUE>"
+      }
+    }
+    ```
+
+    Replace `<PUBLIC_KEY_VALUE>` with the public key you want to use for payload logging.
+
+You can generate a public key [in the command line](/managed-rulesets/payload-logging/command-line/generate-key-pair) or [in the Cloudflare dashboard](/managed-rulesets/payload-logging/configure).
+
+### Example
+
+The following example updates rule `{rule-id-1}` that executes the Cloudflare Managed Ruleset for zone `{zone-id}`, configuring payload logging with the provided public key.
+
+```json
+---
+header: Request
+highlight: [9,10,11]
+---
+curl -X PATCH \
+-H "X-Auth-Email: user@cloudflare.com" \
+-H "X-Auth-Key: REDACTED" \
+"https://api.cloudflare.com/client/v4/zone/{zone-id}/rulesets/{ruleset-id}/rules/{rule-id-1}" \
+-d '{
+  "action": "execute",
+  "action_parameters": {
+    "id": "{cloudflare-managed-ruleset-id}",
+    "matched_data": {
+      "public_key": "{your-public-key}"
+    }
+  },
+  "expression": "true",
+  "description": "Executes the Cloudflare Managed Ruleset"
+}'
+```
+
+The response includes the complete ruleset after updating the rule.
+
+```json
+---
+header: Response
+---
+{
+  "result": {
+    "id": "{zone-level-phase-ruleset-id}",
+    "name": "Zone-level Ruleset 1",
+    "description": "",
+    "kind": "zone",
+    "version": "3",
+    "rules": [
+      {
+        "id": "{rule-id-1}",
+        "version": "1",
+        "action": "execute",
+        "action_parameters": {
+          "id": "{cloudflare-managed-ruleset-id}",
+          "version": "latest",
+          "matched_data": {
+            "public_key": "{your-public-key}"
+          }
+        },
+        "expression": "true",
+        "description": "Executes the Cloudflare Managed Ruleset",
+        "last_updated": "2021-06-28T18:08:14.003361Z",
+        "ref": "{ruleset-ref-1}",
+        "enabled": true
+      },
+      // ...
+    ],
+    "last_updated": "2021-06-28T18:08:14.003361Z",
+    "phase": "http_request_firewall_managed"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+For more information on deploying Managed Rulesets via API, see [Deploy a Managed Ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets/deploy-managed-ruleset) in the Ruleset Engine documentation.
+
+---
+
+## Disable payload logging
+
+To disable payload logging for a Managed Ruleset:
+
+1. Use the [Update rule in ruleset](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api/update-rule) API method to update the rule that executes the Managed Ruleset.
+
+1. Modify the rule definition so that there is no `matched_data` object in `action_parameters`.
+
+The following example rule executes a Managed Ruleset with payload logging disabled:
+
+```json
+{
+  "action": "execute",
+  "action_parameters": {
+    "id": "{managed-ruleset-id}"
+  },
+  "expression": "true",
+  "description": ""
+}
+```
diff --git a/products/waf/src/content/managed-rulesets/payload-logging/configure.md b/products/waf/src/content/managed-rulesets/payload-logging/configure.md
index 583c3d4516a..22fc97cac10 100644
--- a/products/waf/src/content/managed-rulesets/payload-logging/configure.md
+++ b/products/waf/src/content/managed-rulesets/payload-logging/configure.md
@@ -1,10 +1,10 @@
 ---
-title: Configure payload logging
+title: Configure payload logging in the dashboard
 pcx-content-type: how-to
 order: 1
 ---
 
-# Configure payload logging in the dashboard
+# Configure payload logging for a Managed Ruleset in the dashboard
 
 Configure payload logging for a ruleset in the ruleset configuration page.
 
diff --git a/products/waf/src/content/managed-rulesets/payload-logging/index.md b/products/waf/src/content/managed-rulesets/payload-logging/index.md
index e0905dcfb80..10a0c22a163 100644
--- a/products/waf/src/content/managed-rulesets/payload-logging/index.md
+++ b/products/waf/src/content/managed-rulesets/payload-logging/index.md
@@ -11,14 +11,14 @@ This feature is only available for customers on an Enterprise plan.
 
 </Aside>
 
-The WAF allows you to log the request information that triggered a specific rule. This information is known as the payload. Payload logging is especially useful when diagnosing the behavior of WAF rules. Since the values that triggered a rule may contain sensitive data, they are encrypted with a customer-provided public key so that only you can examine them later.
+The WAF allows you to log the request information that triggered a specific rule of a Managed Ruleset. This information is known as the payload. Payload logging is especially useful when diagnosing the behavior of WAF rules. Since the values that triggered a rule may contain sensitive data, they are encrypted with a customer-provided public key so that only you can examine them later.
 
-Each ruleset has its own payload logging configuration. To enable the feature, configure a public key to encrypt the logged payload by doing one of the following:
+Each Managed Ruleset has its own payload logging configuration. To enable the feature, configure a public key to encrypt the logged payload by doing one of the following:
 
 * Generate a key pair directly in the dashboard (Cloudflare will **only** save the generated public key)
 * Enter your own public key
 
-Once enabled, the WAF saves the payload of any rule matches for the ruleset configured with payload logging, encrypting the payload with your public key.
+Once enabled, the WAF saves the payload of any rule matches for the Managed Ruleset configured with payload logging, encrypting the payload with your public key.
 
 To view the content of the payload in clear text, do one of the following:
 
diff --git a/products/waf/src/content/managed-rulesets/payload-logging/view.md b/products/waf/src/content/managed-rulesets/payload-logging/view.md
index c9e8dc08c12..75813d4006d 100644
--- a/products/waf/src/content/managed-rulesets/payload-logging/view.md
+++ b/products/waf/src/content/managed-rulesets/payload-logging/view.md
@@ -9,7 +9,7 @@ View the content of the matched rule payload in the dashboard by entering your p
 
 1. Open **Firewall** > **Overview**.
 
-1. Under **Activity log**, expand the details of an event triggered by a rule whose ruleset has payload logging enabled.
+1. Under **Activity log**, expand the details of an event triggered by a rule whose Managed Ruleset has payload logging enabled.
 
 1. Under **Payload match**, select **Decrypt payload log**.
 
diff --git a/products/waf/src/content/managed-rulesets/waf-exceptions/define-api.md b/products/waf/src/content/managed-rulesets/waf-exceptions/define-api.md
new file mode 100644
index 00000000000..19fba6d0d00
--- /dev/null
+++ b/products/waf/src/content/managed-rulesets/waf-exceptions/define-api.md
@@ -0,0 +1,78 @@
+---
+pcx-content-type: configuration
+order: 2
+---
+
+# Define WAF exceptions via API
+
+To define a WAF exception via API, create a rule with `skip` action in a [phase entry point ruleset](https://developers.cloudflare.com/firewall/cf-rulesets#phases) of the `http_request_firewall_managed` phase. You can define WAF exceptions at the account level and at the zone level.
+
+To configure the WAF exception, define the `action_parameters` object according to the [exception type](/managed-rulesets/waf-exceptions#types-of-waf-exceptions).
+
+Refer to [Add rules to phase entry point rulesets](https://developers.cloudflare.com/firewall/cf-rulesets/add-rule-phase-rulesets) for more information on adding rules using the [Rulesets API](https://developers.cloudflare.com/firewall/cf-rulesets/rulesets-api).
+
+<Aside type="note" header="Rule execution order">
+
+Rules with `skip` action only apply to rules with `execute` action listed **after** them. If you add a rule with `skip` action at the end of the rules list of a phase entry point ruleset, nothing will be skipped.
+
+</Aside>
+
+## Skip all remaining rules
+
+To skip all the remaining rules in the entry point ruleset, create a rule with `skip` action and include `"ruleset": "current"` in the `action_parameters` object.
+
+Example of rule definition:
+
+```json
+{
+  "expression": "<RULE_EXPRESSION>",
+  "action": "skip",
+  "action_parameters": {
+    "ruleset": "current"
+  }
+}
+```
+
+Skipping all remaining rules only affects the rules in the current context (account or zone). For example, adding a rule with `skip` action to the account-level phase entry point ruleset has no impact on the rules defined in the zone-level phase entry point ruleset — these zone-level rules will still be evaluated.
+
+## Skip one or more WAF Managed Rulesets
+
+To skip one or more WAF Managed Rulesets, create a rule with `skip` action containing a `rulesets` field in the `action_parameters` object. The `rulesets` field must contain a list of WAF Managed Ruleset IDs you wish to skip.
+
+Example of rule definition:
+
+```json
+{
+  "expression": "<RULE_EXPRESSION>",
+  "action": "skip",
+  "action_parameters": {
+    "rulesets": [
+      "{waf-managed-ruleset-id-1}",
+      "{waf-managed-ruleset-id-2}"
+    ]
+  }
+}
+```
+
+The Managed Rulesets to skip must belong to the `http_request_firewall_managed` phase.
+
+## Skip one or more rules of WAF Managed Rulesets
+
+To skip one or more rules of WAF Managed Rulesets, create a rule with `skip` action containing a `rules` object in the `action_parameters` object. The `rules` object must contain one or more Managed Ruleset IDs as keys, and a list of rules to skip in those Managed Rulesets as the value of each key.
+
+The following example defines a rule with `skip` action that will skip rules `A` and `B` of WAF Managed Ruleset `1`, and rule `X` of WAF Managed Ruleset `2`:
+
+```json
+{
+  "expression": "<RULE_EXPRESSION>",
+  "action": "skip",
+  "action_parameters": {
+    "rules": {
+      "{waf-managed-ruleset-id-1}": ["{rule-id-A}", "{rule-id-B}"],
+      "{waf-managed-ruleset-id-2}": ["{rule-id-X}"]
+    }
+  }
+}
+```
+
+The rules in the `rules` object must belong to the specified WAF Managed Rulesets, otherwise you will get an error.
diff --git a/products/waf/src/content/managed-rulesets/waf-exceptions/index.md b/products/waf/src/content/managed-rulesets/waf-exceptions/index.md
new file mode 100644
index 00000000000..93384735a78
--- /dev/null
+++ b/products/waf/src/content/managed-rulesets/waf-exceptions/index.md
@@ -0,0 +1,34 @@
+---
+pcx-content-type: concept
+order: 24
+---
+
+# Defining WAF exceptions
+
+Define WAF exceptions to skip the execution of WAF Managed Rulesets or some of their rules. The WAF exception configuration includes an expression that defines the skip conditions, and the rules or rulesets to skip under those conditions.
+
+WAF exceptions have priority over [overrides](https://developers.cloudflare.com/firewall/cf-rulesets/managed-rulesets/override-managed-ruleset).
+
+You can [define WAF exceptions via API](/managed-rulesets/waf-exceptions/define-api).
+
+---
+
+## Types of WAF exceptions
+
+WAF exceptions can have one of the following behaviors (from highest to lowest priority):
+
+* Skip all remaining rules (belonging to WAF Managed Rulesets).
+* Skip one or more specific WAF Managed Rulesets.
+* Skip one or more specific rules of WAF Managed Rulesets.
+
+You define WAF exceptions in a given context — zone level or account level — and they apply only to that context. For example, if you define a WAF exception that skips all remaining rules at the account level, the WAF rules at the zone level will still be evaluated.
+
+Define the exception expression using the [Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language). If there is a match for the expressions of several WAF exceptions, the WAF will consider the exception with the highest priority.
+
+## Additional notes
+
+If you define a WAF exception that skips all remaining rules, the expressions of those rules are not evaluated.
+
+If you define a WAF exception that skips a rule of a Managed Ruleset, the expression of the rule that executes the Managed Ruleset is evaluated and the Managed Ruleset rules are executed except for that specific rule, which is bypassed.
+
+Currently, WAF exceptions are not logged in Firewall Events.
diff --git a/products/waiting-room/docs-config.js b/products/waiting-room/docs-config.js
index 1966bdc26d9..42cbc0737ab 100644
--- a/products/waiting-room/docs-config.js
+++ b/products/waiting-room/docs-config.js
@@ -20,6 +20,6 @@ module.exports = {
     description: "Cloudflare Waiting Rooms redirect visitors to virtual waiting rooms when they are trying to access web pages that have high volumes of traffic.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/waiting-room",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/waiting-room/src/content/about/index.md b/products/waiting-room/src/content/about/index.md
index a88e1c8a58c..6518f416db9 100644
--- a/products/waiting-room/src/content/about/index.md
+++ b/products/waiting-room/src/content/about/index.md
@@ -1,29 +1,53 @@
 ---
+title: About
 order: 1
 pcx-content-type: concept
 ---
 
 # About Cloudflare Waiting Room
 
-Cloudflare Waiting Rooms redirect visitors to virtual waiting rooms when they are trying to access web pages that have high volumes of traffic.
+Cloudflare Waiting Room protects websites from surges in legitimate traffic that may otherwise bring an application down.
 
-When the amount of traffic to a host/path combination on your site exceeds a user-defined threshold, all subsequent requests are queued in a Waiting Room. A [cookie](/about/waiting-room-cookie) is used to manage the dynamic outflow of requests from the Waiting Room to the origin website in First In First Out (FIFO) order.
+## Benefits
 
-The main advantage of Waiting Room is to protect websites from surges in legitimate traffic that may otherwise bring an application down.
+Cloudflare Waiting Room benefits **your origin server** by preventing surges in legitimate traffic that may overload your origin.
 
-Furthermore, Cloudflare Waiting Room improves customer experience and confidence in your website:
+Waiting Rooms also benefit **your visitors** by:
+- Keeping your application online and preventing them from reaching error pages.
+- Showing estimated wait times that are continuously updated.
+- Opening up new spots more quickly by tracking dynamic inflow and [outflow](/reference/configuration-settings#session-duration).
+- Remembering each visitor's status to prevent someone from losing their place in line or having to re-queue if they leave your site.
+- Appearing in your own [branding and style](../how-to/customize-waiting-room), which enhances trust and lets you provide additional information as needed.
 
-* Instead of seeing error pages, site visitors see a page informing them that they are in a Waiting Room.
-* You can customize the Waiting Room to use your own website branding and style, enhancing visitors' trust.
-* The Waiting Room page provides an estimate of when site visitors will be allowed to access the application. The Waiting Room browser page refreshes to update the estimated time.
-* Once a site visitor reaches the application from the Waiting Room, they are given known-user status for an amount of time that you can configure during setup: during this period, visitors can leave the site and re-enter without needing to queue again.
+## How it works
 
-Cloudflare Waiting Room is straightforward to set up. You only need to configure 5 settings, and Cloudflare provides editable template content for your waiting room page.
+Once you have [created and activated a waiting room](/get-started) for a specific application page:
 
-You can set up, manage, and monitor your waiting rooms in the **Traffic** app on the Cloudflare dashboard, or the Waiting Room API.
+- If a page is not experiencing heavy traffic, a visitor accesses the page directly.
+- If page traffic crosses a [user-defined threshold](/reference/configuration-settings#session-duration), a visitor enters a virtual waiting room until it's their turn to access the page:
+    - Each user receives a [cookie](/reference/waiting-room-cookie) to manage the dynamic outflow of requests from the waiting room to the origin website in First In First Out (FIFO) order.
+    - While in the waiting room, the user's browser automatically refreshes every 20 seconds to give them updated information about their estimated wait time.
+    - When a user exits the waiting room and reaches your application, they can leave and re-enter without waiting for the length of time specified by the [session duration](/reference/configuration-settings#session-duration).
+    - Because waiting rooms support dynamic inflow and [outflow](/reference/configuration-settings#session-duration), new spots appear more quickly and estimated wait times are lower and more accurate.
+
+![Waiting room process flow](../static/waiting-room-process-flow.png)
+
+## Availability
+
+The following customers have access to Cloudflare Waiting Room:
+- Those qualified under [Project Fair Shot](https://www.cloudflare.com/fair-shot/)
+- Business customers
+
+Access to certain features depends on a customer's [plan type](plans).
 
 ## Prerequisites
 
-* Cloudflare’s CDN is required to use the Waiting Room feature.
-* Configure a [proxied DNS record or a proxied load balancer](/load-balancing/understand-basics/proxy-modes/) for the waiting room’s hostname: a DNS record is not auto-configured after a waiting room is created.
-* Visitors must enable cookies. Refer to [_Waiting room cookie_](/about/waiting-room-cookie) for information on how cookies are used in Cloudflare Waiting Rooms.
+* Cloudflare’s CDN is required to use the waiting room feature.
+* Configure a [proxied DNS record](https://support.cloudflare.com/hc/articles/360019093151) or a [proxied load balancer](https://developers.cloudflare.com/load-balancing/understand-basics/proxy-modes/) for the waiting room’s hostname. A DNS record is not auto-configured after a waiting room is created.
+* Visitors must enable cookies. Refer to [Waiting room cookie](/reference/waiting-room-cookie) for information on how cookies are used in Cloudflare Waiting Rooms.
+
+## Get started
+
+To learn how to use Cloudflare Waiting Rooms, check out:
+- The [setup guide](../get-started)
+- Various [how-to guides](../how-to)
diff --git a/products/waiting-room/src/content/about/waiting-room-cookie.md b/products/waiting-room/src/content/about/waiting-room-cookie.md
deleted file mode 100644
index 980005ef73f..00000000000
--- a/products/waiting-room/src/content/about/waiting-room-cookie.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-pcx-content-type: reference
----
-
-# Cloudflare Waiting Room cookie
-
-<Aside type='warning' header='Important'>
-
-Cloudflare Waiting Room requires the `__cfwaitingroom` cookie; a host and path combination served by a Waiting Room cannot be visited using a browser that does not accept cookies.
-</Aside>
-
-The `__cfwaitingroom` cookie is used only when a visitor requests access to a host and path combination that has an enabled associated Waiting Room. When the waiting room is suspended, traffic goes to the origin and the `__cfwaitingroom` cookie is not created. The `__cfwaitingroom` cookie is encrypted, and cookies copied to another device won't work.
-
-## Cookie expiration time
-
-* While a visitor stays in a waiting room, the `__cfwaitingroom` cookie is set to expire in 24 hours.
-* When the visitor accesses the application, the `__cfwaitingroom` cookie expires after an interval (`session_duration`) configured in [waiting room settings](/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings).
-
-## Cookie function
-
-The `__cfwaitingroom` cookie is used for the following functions:
-
-* To keep track of a user's position in the waiting room queue, to serve the visitors in the correct order.
-* To monitor the amount of time that visitors stay in the application, and track when they leave, so that an accurate entry time is available to visitors queueing in the waiting room.
-* To provide known-user functionality: If a visitor leaves the application, the cookie allows re-entry within a specified amount of time (`session_duration`) without going back in the waiting room.
-For example, if a visitor wishes to make a purchase at example.com, they queue in a waiting room before entering the online store app. However, if the visitor leaves the store app but forgets to add a note to the order or request a receipt, they can re-enter the application without re-entering the waiting room, if the cookie has not expired.
diff --git a/products/waiting-room/src/content/get-started/index.md b/products/waiting-room/src/content/get-started/index.md
new file mode 100644
index 00000000000..9e950cd102d
--- /dev/null
+++ b/products/waiting-room/src/content/get-started/index.md
@@ -0,0 +1,83 @@
+---
+title: Get started
+order: 2
+pcx-content-type: tutorial
+---
+
+# Get started with Cloudflare Waiting Room
+
+---
+
+## Before you begin
+
+Before you start this tutorial, make sure you have:
+- Completed the [prerequisites](/about#prerequisites).
+- Reviewed your [rate limiting rules](https://developers.cloudflare.com/firewall/cf-rulesets/custom-rules/rate-limiting) to make sure they allow at least one request every 20 seconds (required for automatic page refreshes).
+
+---
+
+## Step 1 — Plan out your waiting room
+
+Before you create your waiting room, think about how you want it to appear and operate.
+
+### Location
+
+Which page will you cover with a waiting room? You can only have one waiting room per page, so you need to identify the high-traffic areas of your website.
+
+Specify the URL for your page by setting the `hostname` and `path` in your [configuration settings](/reference/configuration-settings).
+
+### Access method
+
+You can direct visitors to your high-traffic page:
+- Directly (via URL)
+- Indirectly (via a [Page Rule redirect](https://support.cloudflare.com/hc/articles/200172286))
+
+### Queue method
+
+When you [activate your waiting room](#step-3--activate-your-waiting-room), choose whether:
+- [**All visitors**](#queue-all-visitors) to be queued, in preparation for a product release or other time-based event
+- Only [**some visitors**](#queue-some-visitors) to be queued, as traffic reaches the thresholds defined in `Total active users` and `New users per minute`
+
+### Appearance (optional)
+
+Some customers can [customize the design](/how-to/customize-waiting-room) of their waiting room by editing the page HTML and CSS.
+
+If you have this ability, think about how you want the page to appear.
+
+## Step 2 — Create your waiting room
+
+Create your waiting room by:
+- Using the [dashboard](/how-to/create-via-dashboard).
+- Using the [API](/how-to/create-via-api).
+
+## Step 3 — Activate your waiting room
+
+Depending on your [queue method](#queue-method), you may deploy your waiting room differently.
+
+### Queue some visitors
+
+To queue visitors only when necessary:
+
+1. Go to **Traffic** > **Waiting Rooms**.
+1. On a waiting room, set **Enabled** to **On**. 
+1. Your waiting room will begin queueing visitors once it reaches the traffic thresholds defined in [`Total active users`](/reference/configuration-settings) and [`New users per minute`](/reference/configuration-settings).
+
+### Queue all visitors
+
+To queue all visitors prior to a time-based offering:
+
+1. Go to **Traffic** > **Waiting Rooms**.
+1. On a waiting room:
+    1. Set **Enabled** to **On**.
+    1. Set **Queue All** to **On**. 
+1. Your waiting room will begin queueing all visitors and will not allow any visitors to the path protected by your waiting room. On hover, the waiting room will show the estimated number of users in the queue.
+1. To begin allowing visitors to the path protected by your waiting room, set **Queue All** to **Off**.
+
+For more details on waiting room activation (including API parameters), see [Control waiting room traffic](/how-to/control-waiting-room).
+
+## Step 4 — Next steps
+
+After you have created and deployed your first waiting room, you might also want to:
+- [Test your waiting room](/how-to/test-waiting-room) before it goes live.
+- [Monitor your traffic](/how-to/monitor-waiting-room) in real time.
+- [Troubleshoot](/troubleshooting) potential issues.
diff --git a/products/waiting-room/src/content/how-to/control-waiting-room.md b/products/waiting-room/src/content/how-to/control-waiting-room.md
index b4104367e1d..03be98a2f85 100644
--- a/products/waiting-room/src/content/how-to/control-waiting-room.md
+++ b/products/waiting-room/src/content/how-to/control-waiting-room.md
@@ -4,9 +4,9 @@ order: 3
 pcx-content-type: configuration
 ---
 
-# Control Waiting Room traffic
+# Control waiting room traffic
 
-You can suspend or enable your waiting rooms, and force all traffic to a waiting room using the [user interface](/how-to/waiting-room-dashboard) or the [API](/how-to/use-waiting-room-api).
+You can suspend or enable your waiting rooms, and force all traffic to a waiting room using the [user interface](/how-to/create-via-dashboard) or the [API](/reference/waiting-room-api).
 
 Open the **Waiting Rooms** dashboard to view the list of your waiting rooms.
 
diff --git a/products/waiting-room/src/content/how-to/create-via-api.md b/products/waiting-room/src/content/how-to/create-via-api.md
new file mode 100644
index 00000000000..a6001749e14
--- /dev/null
+++ b/products/waiting-room/src/content/how-to/create-via-api.md
@@ -0,0 +1,178 @@
+---
+title: Create via API
+order: 1
+pcx-content-type: how-to
+---
+
+# Create a waiting room via the API
+
+<Aside>For additional context on creating a waiting room, see <a href="/get-started">Get started</a>.</Aside>
+
+Create a waiting room by appending the following endpoint in the [Waiting Room API](https://api.cloudflare.com/#waiting-room-create-waiting-room) to the Cloudflare API base URL.
+
+```shell
+POST zones/{zone_identifier}/waiting_rooms
+```
+
+The Cloudflare API base URL is:
+
+```shell
+https://api.cloudflare.com/client/v4
+```
+
+For authentication instructions, see [_Getting Started: Requests_](https://api.cloudflare.com/#getting-started-requests) in the Cloudflare API documentation.
+
+For help with endpoints and pagination, see [_Getting Started: Endpoints_](https://api.cloudflare.com/#getting-started-endpoints).
+
+Configure your waiting room with the following required parameters in the `data` field:
+
+* `name` - A unique name for the waiting room. Use only alphanumeric characters, hyphens, and underscores.
+* `host` - Host name for which you want to configure a waiting room.
+* `total_active_users` - The total number of active user sessions on the route at a point in time.
+* `new_users_per_minute` - The number of new users gaining entry into the route every minute.
+
+The following parameters are optional:
+
+* `path` - The path within the host for which you want to configure a waiting room. The waiting room will be enabled for all subpaths as well.
+* `description` - A description of the the waiting room.
+* `session_duration` - Lifetime of a cookie (in minutes) set by Cloudflare for users who get access to the route.
+* `custom_page_html` - HTML code to customize the appearance of your waiting room. Cloudflare provides a sample HTML template that enables the display of estimated wait time on the waiting room page. The default waiting room is  used if `custom_page_html` is not specified. See [_Waiting Room API properties_](https://api.cloudflare.com/#waiting-room-properties).
+
+
+## Example
+
+The following example API request configures a waiting room.
+
+```shell
+curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms" \
+     -H "X-Auth-Email: user@example.com" \
+     -H "X-Auth-Key: xxxxxxxx" \
+     -H "Content-Type: application/json" \
+     --data '{"name":"shop_waiting_room",
+              "description":"Waiting room for webshop",
+              "host":"shop.example.com",
+              "path":"/shop",
+              "new_users_per_minute":200,
+              "total_active_users":300,
+              "session_duration":1
+              }'
+```
+
+The response for the request above is:
+
+```shell
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": [
+    {
+      "id": "1111111111111111111111",
+      "created_on": "2014-01-01T05:20:00.12345Z",
+      "modified_on": "2014-01-01T05:20:00.12345Z",
+      "name": "shop_waiting_room",
+      "description": "Waiting room for webshop",
+      "host": "shop.example.com",
+      "path": "/shop",
+      "new_users_per_minute": 200,
+      "total_active_users": 300,
+      "session_duration": 1
+    }
+  ]
+}
+```
+
+## Customize a waiting room web page
+
+You can use the Waiting Room API to customize the web page served to visitors when they are placed in a virtual waiting room.
+
+In the following PATCH request, the `custom_page_html` field contains the HTML code for the [customized waiting room](/how-to/customize-waiting-room):
+
+```shell
+curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms/{waiting-room-id}"
+     -H "X-Auth-Email: user@example.com"
+     -H "X-Auth-Key: xxxxxxxx"
+     -H "Content-Type: application/json"
+     --data '{"custom_page_html":"<p>Include custom HTML here</p>"}'
+```
+
+```shell
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": [
+    {
+      "id": "1111111111111111111111",
+      "name": "webshop-waiting-room",
+      "description": "Waiting room for webshop",
+      "host": "example.com",
+      "path": "/shop",
+      "suspended": false,
+      "queue_all": false,
+      "new_users_per_minute": 200,
+      "total_active_users": 300,
+      "session_duration": 1,
+      "custom_page_html": "<p>Include custom HTML here</p>",
+      "created_on": "2014-01-01T05:20:00.12345Z",
+      "modified_on": "2014-01-01T05:20:00.12345Z"
+    }
+  ]
+}
+```
+
+### Preview the HTML code for a customized waiting room
+
+Before making an API request to configure a waiting room web page with customized HTML, you can preview your custom HTML by uploading it to a preview endpoint:
+
+```shell
+POST https://api.cloudflare.com/client/v4/zones/<zone_id>/waiting_rooms/preview
+```
+
+In the request body, include the customized HTML content in the `custom_html` field:
+
+```shell
+{
+    "custom_html": "<p>Include custom HTML here</p>"
+}
+```
+
+Note that you pass HTML content to the preview endpoint in the `custom_html` field, but when you are using the API to configure a waiting room, you pass the HTML content in the `custom_page_html` field.
+
+Example request:
+
+```shell
+curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms/preview"
+     -H "X-Auth-Email: user@example.com"
+     -H "X-Auth-Key: xxxxxxxx"
+     -H "Content-Type: application/json"
+     --data '{"custom_html":"<p>Include custom HTML here</p>"}'
+```
+
+The preview endpoint returns a temporary URL in the response body where you can preview your custom page:
+
+```shell
+{
+  "result": {
+    "preview_url": "https://waitingrooms.dev/preview/111111111111"
+  },
+  "success": true,
+  "errors": [],
+  "messages": []
+}
+```
+
+You do not have to have a Cloudflare account to access the preview link, so you can validate the waiting room webpage on multiple devices.
+
+### Preview the default or current waiting room web page
+
+After [generating a preview URL](https://api.cloudflare.com/#waiting-room-create-a-custom-waiting-room-page-preview), use the following endpoint to generate a link to preview the currently configured web page for a waiting room, or the default page if no custom page is configured.
+
+```shell
+GET https://waitingrooms.dev/preview/{preview-id}
+```
+
+The link in the response displays the content of the `custom_page_html` field, rendered with [mustache](https://mustache.github.io).
+
+Use the optional `force_queue` query parameter to preview the waiting room web page when all traffic is force-queued.
+
diff --git a/products/waiting-room/src/content/how-to/create-via-dashboard.md b/products/waiting-room/src/content/how-to/create-via-dashboard.md
new file mode 100644
index 00000000000..6516b010f9b
--- /dev/null
+++ b/products/waiting-room/src/content/how-to/create-via-dashboard.md
@@ -0,0 +1,18 @@
+---
+title: Create via dashboard
+order: 0
+pcx-content-type: how-to
+---
+
+# Create a waiting room from the dashboard
+
+<Aside>For additional context on creating a waiting room, see <a href="/get-started">Get started</a>.</Aside>
+
+1. Within your application, go to **Traffic** > **Waiting Rooms**.
+1. Click **Create**.
+1. Customize the [settings](/reference/configuration-settings) for your waiting room. For additional guidance see [Best practices](/reference/best-practices).
+1. Click **Next**.
+1. If you can [customize your waiting room](/how-to/customize-waiting-room), update the HTML and CSS as needed.
+1. Click **Next**.
+1. Review your settings before saving. If you customized your waiting room, make sure to [preview the result](/how-to/customize-waiting-room#preview-waiting-room).
+1. Click **Save**. Your new waiting room will be enabled by default.
\ No newline at end of file
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-api.md b/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-api.md
deleted file mode 100644
index f4e70d4e9c0..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-api.md
+++ /dev/null
@@ -1,174 +0,0 @@
----
-order: 1
-pcx-content-type: tutorial
----
-
-# Create a Waiting Room via the API
-
-Create a waiting room by appending the following endpoint in the [Waiting Room API](https://api.cloudflare.com/#waiting-room-create-waiting-room) to the Cloudflare API base URL.
-
-```shell
-POST zones/{zone_identifier}/waiting_rooms
-```
-
-The Cloudflare API base URL is:
-
-```shell
-https://api.cloudflare.com/client/v4
-```
-
-For authentication instructions, see [_Getting Started: Requests_](https://api.cloudflare.com/#getting-started-requests) in the Cloudflare API documentation.
-
-For help with endpoints and pagination, see [_Getting Started: Endpoints_](https://api.cloudflare.com/#getting-started-endpoints).
-
-Configure your waiting room with the following required parameters in the `data` field:
-
-* `name` - A unique name for the waiting room. Use only alphanumeric characters, hyphens, and underscores.
-* `host` - Host name for which you want to configure a waiting room.
-* `total_active_users` - The total number of active user sessions on the route at a point in time.
-* `new_users_per_minute` - The number of new users gaining entry into the route every minute.
-
-The following parameters are optional:
-
-* `path` - The path within the host for which you want to configure a waiting room. The waiting room will be enabled for all subpaths as well.
-* `description` - A description of the the waiting room.
-* `session_duration` - Lifetime of a cookie (in minutes) set by Cloudflare for users who get access to the route.
-* `custom_page_html` - HTML code to customize the appearance of your waiting room. Cloudflare provides a sample HTML template that enables the display of estimated wait time on the waiting room page. The default waiting room is  used if `custom_page_html` is not specified. See [_Waiting Room API properties_](https://api.cloudflare.com/#waiting-room-properties).
-
-
-## Example
-
-The following example API request configures a waiting room with the same settings as the example shown in [_Create a waiting room using the Cloudflare dashboard_](/how-to/create-waiting-room/create-waiting-room-dashboard).
-
-```shell
-curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms" \
-     -H "X-Auth-Email: user@example.com" \
-     -H "X-Auth-Key: xxxxxxxx" \
-     -H "Content-Type: application/json" \
-     --data '{"name":"shop_waiting_room",
-              "description":"Waiting room for webshop",
-              "host":"shop.example.com",
-              "path":"/shop",
-              "new_users_per_minute":200,
-              "total_active_users":300,
-              "session_duration":1
-              }'
-```
-
-The response for the request above is:
-
-```shell
-{
-  "success": true,
-  "errors": [],
-  "messages": [],
-  "result": [
-    {
-      "id": "1111111111111111111111",
-      "created_on": "2014-01-01T05:20:00.12345Z",
-      "modified_on": "2014-01-01T05:20:00.12345Z",
-      "name": "shop_waiting_room",
-      "description": "Waiting room for webshop",
-      "host": "shop.example.com",
-      "path": "/shop",
-      "new_users_per_minute": 200,
-      "total_active_users": 300,
-      "session_duration": 1
-    }
-  ]
-}
-```
-
-## Customize a Waiting Room web page using the Waiting Room API
-
-You can use the Waiting Room API to customize the web page served to visitors when they are placed in a virtual waiting room.
-
-In the following PATCH request, the `custom_page_html` field contains the HTML code for the [customized waiting room](../create-waiting-room-dashboard/customize-waiting-room#custom-waiting-room):
-
-```shell
-curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms/{waiting-room-id}"
-     -H "X-Auth-Email: user@example.com"
-     -H "X-Auth-Key: xxxxxxxx"
-     -H "Content-Type: application/json"
-     --data '{"custom_page_html":"<p>Include custom HTML here</p>"}'
-```
-
-```shell
-{
-  "success": true,
-  "errors": [],
-  "messages": [],
-  "result": [
-    {
-      "id": "1111111111111111111111",
-      "name": "webshop-waiting-room",
-      "description": "Waiting room for webshop",
-      "host": "example.com",
-      "path": "/shop",
-      "suspended": false,
-      "queue_all": false,
-      "new_users_per_minute": 200,
-      "total_active_users": 300,
-      "session_duration": 1,
-      "custom_page_html": "<p>Include custom HTML here</p>",
-      "created_on": "2014-01-01T05:20:00.12345Z",
-      "modified_on": "2014-01-01T05:20:00.12345Z"
-    }
-  ]
-}
-```
-
-### Preview the HTML code for a customized waiting room
-
-Before making an API request to configure a waiting room web page with customized HTML, you can preview your custom HTML by uploading it to a preview endpoint:
-
-```shell
-POST https://api.cloudflare.com/client/v4/zones/<zone_id>/waiting_rooms/preview
-```
-
-In the request body, include the customized HTML content in the `custom_html` field:
-
-```shell
-{
-    "custom_html": "<p>Include custom HTML here</p>"
-}
-```
-
-Note that you pass HTML content to the preview endpoint in the `custom_html` field, but when you are using the API to configure a waiting room, you pass the HTML content in the `custom_page_html` field.
-
-Example request:
-
-```shell
-curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone-id}/waiting_rooms/preview"
-     -H "X-Auth-Email: user@example.com"
-     -H "X-Auth-Key: xxxxxxxx"
-     -H "Content-Type: application/json"
-     --data '{"custom_html":"<p>Include custom HTML here</p>"}'
-```
-
-The preview endpoint returns a temporary URL in the response body where you can preview your custom page:
-
-```shell
-{
-  "result": {
-    "preview_url": "https://waitingrooms.dev/preview/111111111111"
-  },
-  "success": true,
-  "errors": [],
-  "messages": []
-}
-```
-
-You do not have to have a Cloudflare account to access the preview link, so you can validate the waiting room webpage on multiple devices.
-
-### Preview the default or current waiting room web page
-
-After [generating a preview URL](https://api.cloudflare.com/#waiting-room-create-a-custom-waiting-room-page-preview), use the following endpoint to generate a link to preview the currently configured web page for a waiting room, or the default page if no custom page is configured.
-
-```shell
-GET https://waitingrooms.dev/preview/{preview-id}
-```
-
-The link in the response displays the content of the `custom_page_html` field, rendered with [mustache](https://mustache.github.io).
-
-Use the optional `force_queue` query parameter to preview the waiting room web page when all traffic is force-queued.
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings.md b/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings.md
deleted file mode 100644
index ce6e1230071..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-order: 0
-pcx-content-type: configuration
----
-
-# Configure settings from the Cloudflare dashboard
-
-To configure settings for a waiting room, select the **Settings** tab in the **Create Waiting Room** page.
-
-![Waiting Rooms Settings](../../../static/wr-create-waiting-room-settings.png)
-
-The table below describes the **Settings** fields that you can configure in the dashboard, and indicates the equivalent Waiting Room API parameter for each setting.
-
-<table style="width:100%">
-  <thead>
-    <tr>
-      <td colspan="2" style="width:40%"><strong>Settings</strong></td>
-      <td colspan="2" style="width:60%"><strong>Notes</strong></td>
-    </tr>
-    <tr>
-      <td style="width:20%"><strong>Dashboard Setting</strong></td>
-      <td style="width:20%"><strong>API parameter</strong></td>
-      <td style="width:20%"><strong>Required or optional</strong></td>
-      <td style="width:40%"><strong>Description</strong></td>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td>Name</td>
-      <td><code>name</code></td>
-      <td>Required</td>
-      <td>Unique waiting room name.</td>
-    </tr>
-    <tr>
-      <td>Hostname</td>
-      <td><code>host</code></td>
-      <td>Required</td>
-      <td>Host name for which the waiting room will be applied (no wildcards).Do not include http:// or https://.</td>
-    </tr>
-    <tr>
-      <td>Path</td>
-      <td><code>path</code></td>
-      <td>Optional</td>
-      <td>Specific path within the host where the waiting room will be applied. The waiting room will be enabled for all subpaths. Wildcards and query parameters are not supported.</td>
-    </tr>
-    <tr>
-      <td>Total active users</td>
-      <td><code>total_active_users</code></td>
-      <td>Required</td>
-      <td>The maximum number of active sessions allowed in <code>host/path</code> at a given time. The maximum recommended value is 80% to 85% of the traffic capacity that your origin can handle.</td>
-    </tr>
-    <tr>
-      <td>New users per minute</td>
-      <td><code>new_users_per_minute</code></td>
-      <td>Required</td>
-      <td>Amount of new users per minute that can be allowed into <code>host/path</code>: less than or equal to target concurrent users.</td>
-    </tr>
-    <tr>
-      <td>Session duration</td>
-      <td><code>session_duration</code></td>
-      <td>Optional</td>
-      <td>The amount of time in minutes that a user who left <code>host/path</code> can come directly back without having to go into the Waiting Room.</td>
-    </tr>
-    <tr>
-      <td>Description</td>
-      <td><code>description</code></td>
-      <td>Optional</td>
-      <td>Description of the Waiting Room.</td>
-    </tr>
-  </tbody>
-</table>
-
-<Aside type='note' header='Note'>
-
-You can configure only one Waiting Room per `host/path` combination.
-</Aside>
-
-## Next steps
-
-Click **Next** or the **Customization** tab to modify the waiting room page design.
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/customize-waiting-room.md b/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/customize-waiting-room.md
deleted file mode 100644
index 1890748cbea..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/customize-waiting-room.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-order: 1
-pcx-content-type: how-to
----
-
-# Customize a Waiting Room
-
-To design and preview the appearance of a waiting room, select the **Customization** tab in the **Create Waiting Room** page.
-
-Cloudflare offers options to customize the appearance of your waiting room:
-* [Default waiting room](#default-waiting-room): An unbranded waiting room that displays an estimated waiting time to visitors.
-* [Custom waiting room](#custom-waiting-room): Edit template text or create your own HTML code:
-  * You can edit the HTML content in a text box within the **Customization** page.
-  * Alternatively, you can import a HTML file.
-
-## Default waiting room
-To choose the default, unbranded waiting room, click **Default Waiting Room**.
-
-![Choose default waiting room](../../../static/default-form.png)
-
-## Custom waiting room
-
-To customize a waiting room, click **Custom Waiting Room**. A text box containing editable template text displays.
-
-![Choose custom waiting room](../../../static/custom-form.png)
-
-You can edit the HTML code directly in the text box.
-
-* Click **Download Template** to download a HTML file containing the default template content to your computer.
-* Click **Download** to download a HTML file containing the text box content to your computer.
-* Click **Copy** to copy the text from the text box to your clipboard, then paste it into an editor of your choice.
-
-The template text contains [code to display the wait time](#display-wait-time). If you want to display the estimated wait time to visitors, do not delete this content.
-
-### Upload a Waiting Room HTML file
-
-1. Click **Import** to upload a HTML file from your computer.
-1. Select the file in the dialog and click **Open**.
-
-Make further edits in the text box. Include the [code to display the wait time](#display-wait-time) to display the estimated queue time on the waiting room page or create your own custom page using [available variables](#available-variables).
-
-### Display wait time
-
-The following content in the `<main>` section of the template HTML code displays the wait time:
-
-```html
-     <h2 id="time-remaining">
-        <noscript>
-          {{#waitTimeKnown}}Your estimated wait time is {{waitTime}}
-          minutes...{{/waitTimeKnown}} {{^waitTimeKnown}}Your estimated wait
-          time is unavailable.{{/waitTimeKnown}}
-        </noscript>
-     </h2>
-```
-
-The following script within the `<body>` section after `<main>` fetches the wait time:
-
-```html
-   <script type="text/javascript">
-      var remainingEl = document.getElementById('time-remaining');
-      var waitTime = {{waitTime}};
-      var waitTimeKnown = {{waitTimeKnown}};
-
-      var remainingString = 'Your estimated wait time is ';
-
-      if (!waitTimeKnown) {
-        remainingString += 'unavailable.'
-      } else {
-        if (waitTime === 1) {
-          remainingString += waitTime + ' minute...';
-        } else {
-          remainingString += waitTime + ' minutes...';
-        }
-      }
-
-      remainingEl.innerText = remainingString;
-    </script>
-```
-
-### Available variables
-
-When you create a waiting room with custom HTML, you can use the following variables:
-- **waitTime**: An `integer` showing the user's estimated wait time in minutes.
-- **waitTimeFormatted**: An English `string` showing a user's estimated wait time:
-  - If `waitTime` is between 0 and 59, string will be `X minutes`
-  - If `waitTime` is between 60 - 119, string will be `More than 1 hour`
-  - If `waitTime` is more than 1440, string will be `More than a day`
-- **waitTimeKnown**: A `boolean` value. Not available when the queue is full or **queue all** is enabled.
-- **queueIsFull**: A `boolean` value. Changes to `True` when the queue is longer than 24 hours.
-
-
-## Preview waiting room
-
-Click **Preview Waiting Room** to preview the waiting room.
-* Choose **Queueing** to display the waiting room appearance when it is enabled on the dashboard and **Queue all** is disabled.
-* Choose **Queue All** to display the waiting room appearance when it is enabled on the dashboard and **Queue all** is enabled. When **Queue all** is enabled for a waiting room, the estimated wait time is not displayed.
-
-## Next steps
-
-Click **Next** or the **Review** tab to review and save your waiting room.
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/index.md b/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/index.md
deleted file mode 100644
index 5d93b0e5aba..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Create a Waiting Room in the dashboard
-order: 0
-pcx-content-type: how-to
----
-
-# Create a Waiting Room via the Cloudflare dashboard
-
-1. Click the [Waiting Rooms](/how-to/waiting-room-dashboard) tab in the **Traffic** app.
-
-
-
-![Waiting Rooms User Interface](../../../static/wr-dashboard.png)
-
-2. To create a new Waiting Room, click **Create**.
-The **Create Waiting Room** page displays.
-
-
-![Create Waiting Room page](../../../static/wr-create-waiting-room-page.png)
-
-There are three tabs in the **Create Waiting Room** page.
-
-1. Click the [Settings](/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings/) tab to configure the settings for the waiting room.
-1. Select the [Customization](/how-to/create-waiting-room/create-waiting-room-dashboard/customize-waiting-room/) tab to modify and preview the waiting room appearance.
-Cloudflare provides an editable template for a default waiting room page. Alternatively, you can upload your own HTML file.
-1. [Review](/how-to/create-waiting-room/create-waiting-room-dashboard/review-waiting-room/): Review the settings for your waiting room and preview the waiting room webpage.
-
-![Review waiting room](../../../static/wr-dashboard-edit-review.png)
-
-4. Click **Save** to save your Waiting Room.
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/review-waiting-room.md b/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/review-waiting-room.md
deleted file mode 100644
index 8b30815da7b..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/create-waiting-room-dashboard/review-waiting-room.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-order: 3
-pcx-content-type: how-to
----
-
-# Review and save a Waiting Room
-
-Select the **Review** tab in the **Create Waiting Room** page to review the settings for your waiting room, preview how the Waiting Room will appear to visitors, and save your waiting room.
-
-![Waiting Room Review](../../../static/wr-dashboard-edit-review.png)
-
-To modify settings or edit the waiting room HTML, click **Settings** or **Customization**.
-
-Click **Save** to save your waiting room configuration.
-The list of waiting rooms displays in the **Waiting Rooms** dashboard.
diff --git a/products/waiting-room/src/content/how-to/create-waiting-room/index.md b/products/waiting-room/src/content/how-to/create-waiting-room/index.md
deleted file mode 100644
index 79fea3d3275..00000000000
--- a/products/waiting-room/src/content/how-to/create-waiting-room/index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-title: Create a Waiting Room
-order: 1
-pcx-content-type: navigation
----
-
-# Create a Cloudflare Waiting Room
-
-You can create a waiting room using the [Waiting Room API](/how-to/create-waiting-room/create-waiting-room-api/) or the **Traffic** App in the [Cloudflare dashboard](/how-to/create-waiting-room/create-waiting-room-dashboard/).
diff --git a/products/waiting-room/src/content/how-to/customize-waiting-room.md b/products/waiting-room/src/content/how-to/customize-waiting-room.md
new file mode 100644
index 00000000000..2a6e3c3f562
--- /dev/null
+++ b/products/waiting-room/src/content/how-to/customize-waiting-room.md
@@ -0,0 +1,125 @@
+---
+order: 1
+pcx-content-type: how-to
+---
+
+# Customize a waiting room
+
+To design and preview the appearance of a waiting room, select the **Customization** tab in the **Create Waiting Room** page.
+
+Cloudflare offers options to customize the appearance of your waiting room:
+* [Default waiting room](#default-waiting-room): An unbranded waiting room that displays an estimated waiting time to visitors.
+* [Custom waiting room](#custom-waiting-room): Edit template text or create your own HTML code:
+  - Customize both HTML or CSS content, including fonts, colors, static images, additional languages and more.
+  - Edit content directly in the dashboard or import relevant files.
+* [Support mobile app traffic](/how-to/mobile-traffic): Toggle to also enable a JSON response with a user's status in the waiting room.
+
+## Default waiting room
+
+To choose the default, unbranded waiting room:
+
+1. Select a waiting room.
+1. Go to the **Customization** step.
+1. Click **Default Waiting Room**.
+
+## Custom waiting room
+
+<Aside type="note">
+
+Only certain customers can customize their waiting rooms. For more details, see our <a href="/plans">Plans</a> page.
+
+</Aside>
+
+To customize a waiting room:
+
+1. Select a waiting room.
+1. Go to the **Customization** step.
+1. Click **Custom Waiting Room**.
+
+You can edit the HTML code directly in the text box:
+
+* Click **Download Template** to download a HTML file containing the default template content to your computer.
+* Click **Download** to download a HTML file containing the text box content to your computer.
+* Click **Copy** to copy the text from the text box to your clipboard, then paste it into an editor of your choice.
+
+The template text contains [code to display the wait time](#display-wait-time). If you want to display the estimated wait time to visitors, do not delete this content.
+
+### Upload an HTML file
+
+1. Click **Import** to upload a HTML file from your computer.
+1. Select the file in the dialog and click **Open**.
+
+Make further edits in the text box. Include the [code to display the wait time](#display-wait-time) to display the estimated queue time on the waiting room page or create your own custom page using [available variables](#available-variables).
+
+### Display wait time
+
+The following content in the `<main>` section of the template HTML code displays the wait time:
+
+```html
+     <h2 id="time-remaining">
+        <noscript>
+          {{#waitTimeKnown}}Your estimated wait time is
+          {{waitTimeFormatted}}...{{/waitTimeKnown}}
+          {{^waitTimeKnown}}{{#queueIsFull}}The estimated wait time is
+          greater than a day. You will automatically be placed in the
+          queue once space is available.{{/queueIsFull}}
+          {{^queueIsFull}}Your estimated wait time is
+          unavailable.{{/queueIsFull}}{{/waitTimeKnown}}
+        </noscript>
+     </h2>
+```
+
+The following script within the `<body>` section after `<main>` fetches the wait time:
+
+```html
+   <script type="text/javascript">
+      var remainingEl = document.getElementById('time-remaining');
+      var waitTime = {{waitTime}};
+      var waitTimeKnown = {{waitTimeKnown}};
+
+      var remainingString = 'Your estimated wait time is ';
+
+      if (!waitTimeKnown) {
+        remainingString += 'unavailable.'
+      } else {
+        if (waitTime === 1) {
+          remainingString += waitTime + ' minute...';
+        } else {
+          remainingString += waitTime + ' minutes...';
+        }
+      }
+
+      remainingEl.innerText = remainingString;
+    </script>
+```
+
+### Available variables
+
+When you create a waiting room with custom HTML, you can use the following variables:
+- **waitTime**: An `integer` showing the user's estimated wait time in minutes.
+- **waitTimeFormatted**: An English `string` showing a user's estimated wait time:
+  - If `waitTime` is between 0 and 59, string will be `X minutes`
+  - If `waitTime` is between 60 - 119, string will be `More than 1 hour`
+  - If `waitTime` is more than 1440, string will be `More than a day`
+- **waitTimeKnown**: A `boolean` value. Not available when the queue is full or **queue all** is enabled.
+- **queueIsFull**: A `boolean` value. Changes to `True` when the queue is longer than 24 hours.
+
+### Multiple-language support
+
+Customize your waiting room to display in any language supported by the UTF-8 character set. Additionally, all [variables](#available-variables) support internationalization except for **waitTimeFormatted** (English only).
+
+## Preview waiting room
+
+To preview the appearance of a waiting room:
+
+1. In your application, go to **Traffic** > **Waiting Rooms**.
+1. Either [create a waiting room](../create-via-dashboard) or [edit an existing one](../edit-delete-waiting-room).
+1. Go to the **Review** step.
+1. Click **Preview Waiting Room**:
+
+  * Choose **Queueing** to display the waiting room appearance when it is enabled on the dashboard and **Queue all** is not enabled.
+  * Choose **Queue All** to display the waiting room appearance when it is enabled on the dashboard and **Queue all** is enabled. When **Queue all** is enabled for a waiting room, the estimated wait time is not displayed.
+
+## Troubleshooting
+
+If you see something unexpected when previewing your waiting room, review your custom code for proper syntax. Often, you might forget to close each tag with its appropriate closing tag (the tag name with a `/`).
diff --git a/products/waiting-room/src/content/how-to/edit-delete-waiting-room.md b/products/waiting-room/src/content/how-to/edit-delete-waiting-room.md
index a9c864b359f..ceb7e4a78ec 100644
--- a/products/waiting-room/src/content/how-to/edit-delete-waiting-room.md
+++ b/products/waiting-room/src/content/how-to/edit-delete-waiting-room.md
@@ -3,53 +3,36 @@ order: 4
 pcx-content-type: how-to
 ---
 
-# Update and delete Waiting Rooms
+# Edit and delete waiting rooms
 
-You can manage your waiting rooms using the [Waiting Rooms dashboard](/how-to/waiting-room-dashboard) or the API.
+You can manage your waiting rooms using the [Waiting Rooms dashboard](/how-to/waiting-room-dashboard) or the [API](/reference/waiting-room-api).
 
-## Edit a waiting room in the Cloudflare dashboard
+<Aside type="note">
 
-1. Open the **Waiting Rooms** dashboard.
-A list of your waiting rooms displays.
+For details about updating an active waiting room, see <a href="/reference/best-practices">Best practices</a>.
 
+</Aside>
 
-![Waiting Rooms User Interface](../static/wr-dashboard.png)
+## Using the dashboard
 
-2. Click **Edit** in the waiting room that you want to edit.
-The **Edit Waiting Room** page displays.
-1. Click on the **Settings** tab in the **Edit Waiting Room** page.
-A list of the settings for your waiting room displays.
+### Edit a waiting room
 
+1. In your application, go to **Traffic** > **Waiting Rooms**.
+1. On a record, click **Edit**.
+1. Click **Settings**.
+1. Edit the settings. For a description of settings, refer to [Configuration settings](/reference/configuration-settings/).
+1. Click **Next**. If you have access to [customized templates](../customize-waiting-room), you could also adjust the template.
+9. Once you get to **Review**, click **Save**.
 
-![Edit settings on Create Waiting Room page](../static/wr-dashboard-edit-settings.png)
+### Delete a waiting room
 
-4. Edit the settings. Refer to [_Configure Settings_](/how-to/create-waiting-room/create-waiting-room-dashboard/configure-settings/) for a description of waiting room settings.
-1. Click **Next** or **Customization**.
-The **Customization** tab in the **Edit Waiting Room** page displays.
+1. In your application, go to **Traffic** > **Waiting Rooms**.
+1. On a record, click **Delete**.
+1. Select **Delete** again.
 
+## Using the API
 
-![Customize the Waiting Room web page](../static/wr-dashboard-edit-customization.png)
-
-
-6. Edit the text in the textbox or upload a HTML file to customize the appearance of the waiting room. Refer to [Customize a waiting room](/how-to/create-waiting-room/create-waiting-room-dashboard/customize-waiting-room/) for more information.
-1. Click **Next** or **Review**.
-The **Review** tab in the **Edit Waiting Room** page displays.
-
-
-![Review the Waiting Room settings and web page](../static/wr-dashboard-edit-review.png)
-
-
-8. [Review](/how-to/create-waiting-room/create-waiting-room-dashboard/review-waiting-room/) the settings for your Waiting Room, and preview how the Waiting Room will appear to visitors.
-9. Click **Save** to save the changes to your Waiting Room.
-
-## Delete a waiting room in the Cloudflare dashboard
-
-1. Open the **Waiting Rooms** dashboard.
-A list of your waiting rooms displays.
-1. To delete a waiting room, click **Delete** in your list of waiting rooms.
-Click **Delete** in the dialog to confirm.
-
-## Edit a waiting room using the Cloudflare Waiting Room API
+### Edit a waiting room
 
 [Replace](https://api.cloudflare.com#waiting-room-update-waiting-room) a configured waiting room by appending the following endpoint to the Cloudflare API base URL.
 
@@ -65,7 +48,7 @@ PATCH zones/{zone_identifier}/waiting_rooms/{identifier}
 
 You only need to include the parameters that you want to update in the `data` field of the PATCH request.
 
-## Delete a waiting room using the Cloudflare Waiting Room API
+### Delete a waiting room
 
 Delete a waiting room by appending the following endpoint in the [Waiting Room API](https://api.cloudflare.com#waiting-room-delete-waiting-room) to the Cloudflare API base URL.
 
diff --git a/products/waiting-room/src/content/how-to/index.md b/products/waiting-room/src/content/how-to/index.md
index 98f058f0ce9..6aa0ee6ad94 100644
--- a/products/waiting-room/src/content/how-to/index.md
+++ b/products/waiting-room/src/content/how-to/index.md
@@ -1,38 +1,11 @@
 ---
-title: Set up Waiting Rooms
+title: How to
 order: 2
-pcx-content-type: interim
+pcx-content-type: navigation
 ---
 
-# Set up a Cloudflare Waiting Room
+# Common tasks
 
-## Before you begin
+When working with Cloudflare Waiting Rooms, you can perform the following actions:
 
-Before you begin to work with waiting rooms, review the [prerequisites](/about#prerequisites) and [entitlements](/about#entitlements).
-
-Before configuring a waiting room, consider the following:
-
-* How you want the waiting room to operate
-* The appearance of the waiting room
-
-### Waiting room operation
-
-First, decide which routes must be served by a waiting room. Routes are pages or applications in your website. You can link a route with only one waiting room, so you need to identify the high-traffic areas of your website. These routes are represented by the following parameters in Cloudflare Waiting Rooms:
-
-* _Hostname_ - The hostname or subdomain in your zone.
-* _Path_ (optional) - The path where you want to enable the waiting room.
-
-Next, determine the maximum amount of traffic that you want to allow into these routes at any given time. You will use these specifications to set the following parameters for your waiting room:
-
-* _Total active users_ - The total number of active user sessions allowed on the route at a point in time. Cloudflare recommends setting `Total active users` no higher than 80% to 85% of the traffic capacity that your origin can handle.
-* _New users per minute_ - The number of new users admitted into the route every minute.
-* _Session duration_ (optional) - Lifetime of a cookie set for users who get access to the route.
-
-### What your waiting room will look like
-
-Consider the appearance of your waiting room. This is what the visitor will see when queuing to access a route.
-Cloudflare provides a template waiting room page to get you started, but you can edit this or upload your own HTML file. In the waiting room template, Cloudflare provides code that presents visitors with an estimated entry time to the route: including this in your waiting room page improves customer experience.
-
-## Get started
-
-You can [create](/how-to/create-waiting-room/), [edit](/how-to/edit-delete-waiting-room), [delete](/how-to/edit-delete-waiting-room#delete-a-waiting-room-in-the-cloudflare-dashboard), [manage](/how-to/control-waiting-room), and [monitor](/how-to/monitor-waiting-room) Cloudflare Waiting Rooms using the **Traffic** app on the [Cloudflare dashboard](/how-to/waiting-room-dashboard) or with the [Waiting Room API](/how-to/use-waiting-room-api).
+<DirectoryListing path="/how-to"/>
\ No newline at end of file
diff --git a/products/waiting-room/src/content/how-to/mobile-traffic.md b/products/waiting-room/src/content/how-to/mobile-traffic.md
new file mode 100644
index 00000000000..504347fbf3b
--- /dev/null
+++ b/products/waiting-room/src/content/how-to/mobile-traffic.md
@@ -0,0 +1,84 @@
+---
+order: 8
+pcx-content-type: how-to
+---
+
+# Support mobile app traffic
+
+If you need to manage mobile app traffic, Cloudflare provides a JSON-friendly waiting room that sits in front of your API endpoints:
+1. When a user [is queued](/about#how-it-works), we return our own [JSON response](#integrate-waiting-room-variables).
+1. When a user leaves the waiting room, we forward their request to your origin server and return your default JSON.
+
+Since the format of the waiting room response is controlled by an HTTP header (`Accept: application/json` or `Accept: text/html`), a single waiting room can handle both mobile and web traffic.
+
+<Aside type="note">
+
+Only certain customers can support mobile traffic with their waiting rooms. For more details, see our <a href="/plans">Plans</a> page.
+
+</Aside>
+
+---
+
+## Before you begin
+
+This tutorial assumes you have previously [planned out](/get-started) and [created](/how-to/create-via-dashboard) a waiting room.
+
+---
+
+## Step 1 — Prepare your mobile app
+
+### Integrate waiting room variables
+
+To utilize a waiting room, you need to create a new template in your mobile app to receive the JSON response.
+
+Use the following variables to display information about a waiting room:
+
+- `inWaitingRoom`: Boolean indicating if the user is in the Waiting Room (always true).
+- `waitTime`: Integer indicating the current estimated time in minutes the user will wait in the Waiting Room. Only valid if `waitTimeKnown` is true.
+- `waitTimeKnown`: Boolean indicating if `waitTime` is accurate. If false, `waitTime` is not available.
+- `waitTimeFormatted`: String displaying the `waitTime` for users, formatted in English. If `waitTimeKnown` is false, `waitTimeFormatted` will display "unavailable".
+- `queueIsFull`: Boolean indicating if the Waiting Room's queue is currently full and not accepting new users at the moment.
+- `queueAll`: Boolean indicating if all users will be queued in the Waiting Room and no one will be let into the origin website.
+- `lastUpdated`: String displaying the timestamp as an ISO 8601 string of the user's last attempt to leave the waiting room and access the origin website. The user is able to make another attempt after `refreshIntervalSeconds` past this time. If the user makes a request too soon, it will be ignored and `lastUpdated` will not change.
+- `refreshIntervalSeconds`: Integer indicating the number of seconds after `lastUpdated` until the user can attempt to leave the waiting room and access the origin website.
+
+### Allow cookies
+
+Since a waiting room [requires cookies](/reference/waiting-room-cookie), your mobile app will need to support cookies. For ease of use, consider using a cookie manager like [CookieJar](https://pkg.go.dev/net/http#CookieJar).
+
+## Step 2 — Enable JSON response
+
+To receive a JSON response, you first need to enable that option on your waiting room:
+
+- **Via the dashboard**: When [customizing a waiting room](/how-to/customize-waiting-room), toggle **JSON Response** to **On**.
+- **Via the API**: When [creating a waiting room](https://api.cloudflare.com/#waiting-room-create-waiting-room), set `json_response_enabled` to `true`.
+
+## Step 3 — Get JSON data
+
+To get the JSON data associated with a waiting room, make a request to that endpoint with the header `Accept: application/json`.
+
+```
+---
+header: Request
+---
+curl -X GET "https://example.com/waitingroom" \
+    -H "Accept: application/json"
+```
+
+```json
+---
+header: Response
+---
+{
+    "cfWaitingRoom": {
+        "inWaitingRoom": true,
+        "waitTime": 5,
+        "waitTimeKnown": true,
+        "waitTimeFormatted": "5 minutes",
+        "queueIsFull": false,
+        "queueAll": false,
+        "lastUpdated": "2021-08-03T23:46:00.000Z",
+        "refreshIntervalSeconds": 20
+    }
+}
+```
\ No newline at end of file
diff --git a/products/waiting-room/src/content/how-to/monitor-waiting-room.md b/products/waiting-room/src/content/how-to/monitor-waiting-room.md
index d26aa297e67..0d7b03a41f4 100644
--- a/products/waiting-room/src/content/how-to/monitor-waiting-room.md
+++ b/products/waiting-room/src/content/how-to/monitor-waiting-room.md
@@ -3,11 +3,13 @@ order: 2
 pcx-content-type: how-to
 ---
 
-# Monitor Waiting Room status
+# Monitor waiting room status
 
-You can monitor the status of your waiting rooms using the [user interface](/how-to/waiting-room-dashboard) or the API.
+You can monitor the status of your waiting rooms using the [dashboard](#status-in-the-dashboard) or the [API](#status-in-the-api).
 
-## Monitor waiting room status in the Waiting Rooms dashboard
+<Aside>Future work will create a separate area of application analytics for Cloudflare Waiting Rooms.</Aside>
+
+## Status in the dashboard
 
 Open the **Waiting Rooms** dashboard to view the list of your waiting rooms.
 
@@ -15,12 +17,19 @@ Open the **Waiting Rooms** dashboard to view the list of your waiting rooms.
 
 The **Status** column displays the current state of the waiting room:
 
-* **Not Queueing**: The waiting room is activated, but traffic has not reached the threshold to divert visitors to the waiting room.
-* **Queueing**: Traffic is exceeding the configured threshold and visitors are diverted to the waiting room.
+* **Not Queueing**: 
+  - Waiting room enabled, but has not reached traffic threshold to send visitors to waiting room.
+  - Shows estimated number of users in the application.
+* **Queueing**: 
+  - Waiting room enabled and sending visitors to waiting room.
+  - Shows estimated number of users in the queue.
+  - On hover, shows maximum wait time expected for users.
 * **Disabled**: The waiting room is suspended.
-* **Queue All**: All traffic is forced to queue in the waiting room.
+* **Queue All**: 
+  - Forces all traffic to queue in the waiting room.
+  - On hover, shows estimated number of users in the queue.
 
-## Monitor your waiting rooms using the Waiting Rooms API
+## Status in the API
 
 [Check whether traffic is queueing in a configured waiting room](https://api.cloudflare.com/#waiting-room-get-waiting-room-status) by appending the following endpoint to the Cloudflare API base URL:
 
@@ -29,7 +38,7 @@ GET zones/{zone_identifier}/waiting_rooms/{identifier}/status
 ```
 
 The response is:
-*  `queueing` if visitors are currently queueing in the waiting room
+*  `queueing` if visitors are currently queueing in the waiting room.
 *  `not_queueing` if the room is empty or if the waiting room is suspended.
 
 To check whether a configured waiting room is suspended or whether the traffic is force-queued to the waiting room, append the following endpoint to the Cloudflare API base URL.
@@ -68,3 +77,11 @@ The value of `suspended` indicates whether a waiting room is activated or suspen
 The value of  `queue_all` indicates whether all traffic is forced to queue in the waiting room:
 * `false`: Visitors are diverted to the waiting room only if traffic exceeds the configured threshold.
 * `true`: All traffic is forced to queue in the waiting room, and no traffic passes from the waiting room to the origin.
+
+## Queueing activation
+
+Waiting rooms queue traffic at the data-center level to increase scalability, letting each data center make decisions independently.
+
+Because of this design, a waiting room might queue traffic from a specific data centers before the waiting room reaches its limit of `new_users_per_minute`. 
+
+To stop a waiting room from active queueing, increase the minimum values for `new_users_per_minute` and `total_active_users`.
diff --git a/products/waiting-room/src/content/how-to/test-waiting-room.md b/products/waiting-room/src/content/how-to/test-waiting-room.md
new file mode 100644
index 00000000000..dbdc905153b
--- /dev/null
+++ b/products/waiting-room/src/content/how-to/test-waiting-room.md
@@ -0,0 +1,114 @@
+---
+order: 5
+pcx-content-type: tutorial
+---
+
+# Test a waiting room
+
+Follow this tutorial to ensure your Waiting Room queues and admits users as expected.
+
+<Aside type="warning" header="Warning:">
+This tutorial uses an open-sourced load testing tool that is not created or supported by Cloudflare.
+</Aside>
+
+---
+
+## Before you begin
+
+Before you start this tutorial, ensure you have:
+- Fulfilled all the [prerequisites](../../about#prerequisites)
+- Previously [created a waiting room](/get-started)
+- Updated the [sample script](#1-download-sample-script) to ensure your waiting room captures when a "simulated user" enters and is released from your waiting room (if you [customized the design](/how-to/customize-waiting-room) of your waiting room)
+
+---
+
+## 1. Download sample script
+
+First, download the [sample script](https://github.com/kcantrel/test-cf-waitingroom/blob/master/simulate_requests) from GitHub.
+
+This script simulates users entering a waiting room. It divides traffic into two phases (`Phase 1` and `Phase 2`) so you can test wait times as load increases and then decreases.
+
+## 2. Run sample script
+
+Once you have downloaded the script, run it with the following command-line arguments:
+-  `-n <num_secs_p1>`: Number of seconds to send requests during phase 1
+- `-m <num_secs_p2>`: Number of seconds to send requests during phase 2, which is fixed at 1 request per second
+- `-s <sleep_time_p1>`: Amount of time to sleep between requests during phase 1 (fractional time accepted, such as `.3`)
+- `-o <results>`: File to store the per-session statistics
+- `URL`: Endpoint protected by a Cloudflare Waiting Room
+
+<details>
+  <summary>Example script run</summary>
+  <div>
+    <strong>Function</strong>
+
+    simulate_requests -s .1 -n 60 -m 60 -o results https://example.com/tickets/1234/
+
+<strong>Output</strong>
+
+    Sending 600 requests to https://example.com/tickets/1234/ at a rate of 10.00 per second. Or 600 per minute.
+
+    Wed 10 Mar 2021 10:48:59 AM CST
+    ...................................................................................................................a.aa.aa.a..
+    Wed 10 Mar 2021 10:50:00 AM CST
+
+    Now doing 1 request per second for 60 seconds.
+    babdacdbeacbc.abbedcbacbddaccdaeebbcabedccaebddbcacedb.cadcedbacabcbeacbbabdcdbaaebddcbcabeeadbcbacadedabbaacd.dabecbabbdecbdaegehgjkfjifggfihjhghhfhifkfj.gjighhgfiihgdihkffiejgjjigggjkijkk
+    Wed 10 Mar 2021 10:51:01 AM CST
+
+    Waiting for jobs to finish
+    hgiibjjjjcjhjgbgiggikihhjcihhhhlkkknmjjmmjnnonokklmmklnmonmlonoompollplommpmmpolpoqmponngoonqjimqmgjmmnkmogmqoiqpoqolmmqonghpppjpiopoopqomkqnnqgnmqnnppopnqrpptqtrrrrpsrqtrusrtsvusvsrrvstttrvsvsvussrtuwtvrtsvtrvsqunrmtrrrsqnqptvsuqturwsvstnmwuwtusvsvwsouspqtuuvsvrvwtwssvqtuuuwspvoxyzyyvwvzwxyxyyAzyyzABxBBzyxyxxBBACzzyxAvwsyzxztzvuvtCACyvxstuutvCw
+    Wed 10 Mar 2021 10:54:22 AM CST
+
+</div>
+</details>
+
+As the script runs, it will output characters with each character representing:
+- A user session that advanced past the waiting room
+- The amount of time the user spent in the waiting room:
+  - 0 seconds: `.`
+  - 10 seconds: `a`
+  - 20 seconds: `b`
+  - 30 seconds: `c`<br/>
+    ...
+  - 260 seconds: `A`
+  - 270 seconds: `B`<br/>
+    ...
+  - 530 seconds: `0`
+  - 540 seconds: `1`<br/>
+    ...
+  - Greater than 620 seconds: `!`
+
+## 3. Analyze results
+
+Once the script finishes running, it creates a CSV file with the following fields:
+
+<details>
+  <summary>Fields in CSV file</summary>
+  <div>
+    <ul>
+        <li><strong>job</strong>: The fixed string will either be <strong>main</strong> for phase 1 or <strong>post</strong> for phase 2</li>
+       <li><strong>status</strong>: Status of the last response of the session:</li>
+       <ul>
+            <li>0: curl command received an HTTP status code of <code>200</code></li>
+            <li>1: curl command did not receive any HTTP status codes, which typically means the curl command itself failed</li>
+            <li>2: curl command received an HTTP status code of something other than <code>200</code></li>
+        </ul>
+        <li><strong>wait_time</strong>: Number of seconds the user waited in the waiting room</li>
+       <li><strong>wr_cnt_before</strong>: Number of users in the waiting room when the session first started</li>
+       <li><strong>wr_cnt_after</strong>: Number of users in the waiting room when the session made it past the waiting room</li>
+       <li><strong>start_time</strong>: Time when the session first started (in UNIX epoch seconds)</li>
+       <li><strong>end_time</strong>: Time when the session made it past the waiting room (in UNIX epoch seconds)</li>
+    </ul>
+</div>
+</details>
+
+To visualize your results, open your CSV file within a spreadsheet application. For example, here is a basic chart that shows the amount of time a user waited verses the time they first tried to get to the web service:
+
+![Visualize waiting room test data by using a graphing tool](../static/test-waiting-room.png)
+
+In this example, you can clearly see when the script entered the second phase — with a reduced rate of new users per second — leading to decreased wait times.
+
+## 4. Adjust waiting room (optional)
+
+Based on the results of your test, you may want to adjust [the settings](/reference/configuration-settings) of your waiting room.
diff --git a/products/waiting-room/src/content/how-to/use-waiting-room-api.md b/products/waiting-room/src/content/how-to/use-waiting-room-api.md
deleted file mode 100644
index a7d817a640e..00000000000
--- a/products/waiting-room/src/content/how-to/use-waiting-room-api.md
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Waiting Room API
-order: 5
-pcx-content-type: reference
----
-
-# Use the Cloudflare Waiting Room API
-
-[Cloudflare Waiting Rooms](/about) redirect visitors to virtual waiting rooms when they are trying to access web pages that have high volumes of traffic.
-
-The [Cloudflare Waiting Room API](https://api.cloudflare.com/#waiting_rooms) provides an interface for programmatically managing waiting rooms.
-
-## Request URL format
-
-To invoke a [Cloudflare Waiting Room API](https://api.cloudflare.com/#waiting-room-properties) operation, append the endpoint to the Cloudflare API base URL:
-
-```shell
-https://api.cloudflare.com/client/v4
-```
-
-For authentication instructions, see [_Getting Started: Requests_](https://api.cloudflare.com/#getting-started-requests) in the Cloudflare API documentation.
-
-For help with endpoints and pagination, see [_Getting Started: Endpoints_](https://api.cloudflare.com/#getting-started-endpoints).
-
-## Manage Your Waiting Rooms
-
-<table style="width:100%">
-   <thead>
-        <tr>
-            <th>Operation</th>
-            <th>Method + URL stub</th>
-            <th>Notes</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-list-waiting_rooms'>List Waiting Rooms</a></td>
-            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms</code></td>
-            <td>List all waiting rooms for a zone.</td>
-        </tr>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-create-waiting-room'>Create Waiting Room</a></td>
-            <td><code>POST&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms</code></td>
-            <td>Create a waiting room.</td>
-        </tr>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-waiting-room-details'>Waiting Room Details</a></td>
-            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
-            <td>Fetch a waiting room.</td>
-        </tr>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-update-waiting-room'>Update Waiting Room</a></td>
-            <td><code>PUT&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
-            <td>Update a waiting room.</td>
-        </tr>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-delete-waiting-room'>Delete Waiting Room</a></td>
-            <td><code>DELETE&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
-            <td>Delete a waiting room.</td>
-        </tr>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-patch-waiting-room'>Patch Waiting Room</a></td>
-            <td><code>PATCH&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
-            <td>Patch a configured waiting room.</td>
-        </tr>
-   </tbody>
-</table>
-
-## Fetch the current status of a Waiting Room
-
-<table style="width:100%">
-    <thead>
-        <tr>
-            <th>Operation</th>
-            <th>Method + URL stub</th>
-            <th>Notes</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td><a href='https://api.cloudflare.com/#waiting-room-get-waiting-room-status'>Get the current status of a waiting room</a></td>
-            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}/status</code></td>
-            <td>
-                <ul>
-                <li>Returns <code>queueing</code> if the queue is activated (clients are put in the waiting room).</li>
-                <li>Returns <code>not_queueing</code> if the queue is not activated or if the waiting room is suspended.</li>
-                </ul>
-            </td>
-        </tr>
-    </tbody>
-</table>
diff --git a/products/waiting-room/src/content/how-to/waiting-room-dashboard.md b/products/waiting-room/src/content/how-to/waiting-room-dashboard.md
index 9ba6a4c3503..e2efb3894c6 100644
--- a/products/waiting-room/src/content/how-to/waiting-room-dashboard.md
+++ b/products/waiting-room/src/content/how-to/waiting-room-dashboard.md
@@ -3,18 +3,15 @@ order: 0
 pcx-content-type: how-to
 ---
 
-# Access Waiting Rooms via the dashboard
+# Access waiting rooms
 
-Use Cloudflare Waiting Room to create a holding area where users can queue to access a high-traffic area of your enterprise website. For an introduction, see [_About Waiting Room_](/about/).
+Use Cloudflare Waiting Room to create a holding area where users can queue to access a high-traffic area of your enterprise website. For an introduction, see [About Waiting Room](/about/).
 
 To access **Waiting Rooms** on the Cloudflare dashboard:
 
-1. Log in to the **Cloudflare** dashboard.
-1. Select the enterprise zone for which you want to manage the Waiting Rooms.
-1. Click the **Traffic** app.
-1. Click the **Waiting Rooms** tab.
-The **Waiting Rooms** card displays.
+1. Log in to the Cloudflare dashboard and select your application.
+1. Click the **Traffic** > **Waiting Rooms**.
 
 ![Waiting Rooms User Interface](../static/wr-dashboard.png)
 
-Use the dashboard to  [create](/how-to/create-waiting-room/), [edit](/how-to/edit-delete-waiting-room/), [delete](/how-to/edit-delete-waiting-room/), [control](/how-to/control-waiting-room), and [monitor](/how-to/monitor-waiting-room) waiting rooms.
+Use the dashboard to [create, edit, update, and delete](/how-to) waiting rooms.
diff --git a/products/waiting-room/src/content/index.md b/products/waiting-room/src/content/index.md
index 090e3e8523b..c37f2ad84f2 100644
--- a/products/waiting-room/src/content/index.md
+++ b/products/waiting-room/src/content/index.md
@@ -1,5 +1,5 @@
 ---
-title: Welcome
+title: Overview
 order: 0
 pcx-content-type: landing-page
 ---
@@ -7,3 +7,8 @@ pcx-content-type: landing-page
 # Cloudflare Waiting Room docs
 
 Cloudflare Waiting Room queues site visitors when a website experiences unmanageable surges in legitimate traffic.
+
+<ButtonGroup>
+  <Button type="primary" href="/get-started">Get started</Button>
+  <Button type="secondary" href="/about">Learn more</Button>
+</ButtonGroup>
diff --git a/products/waiting-room/src/content/plans/index.md b/products/waiting-room/src/content/plans/index.md
new file mode 100644
index 00000000000..c7f21899e1e
--- /dev/null
+++ b/products/waiting-room/src/content/plans/index.md
@@ -0,0 +1,57 @@
+---
+title: Plans
+order: 1
+pcx-content-type: reference
+type: overview
+---
+
+# Features by plan type
+
+The features available for a waiting room depend on your plan type.
+
+<table style="width:100%">
+   <thead>
+        <tr>
+            <th>Feature</th>
+            <th>Business</th>
+            <th>Enterprise (default)</th>
+            <th>Enterprise (with purchase)</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>Number of waiting rooms</td>
+            <td>One</td>
+            <td>One</td>
+            <td>Custom</td>
+        </tr>
+        <tr>
+            <td><a href='/how-to/customize-waiting-room'>Customized templates</a></td>
+            <td>No</td>
+            <td>No</td>
+            <td>Yes</td>
+        </tr>
+         <tr>
+            <td><a href='/about'>Queueing method</a></td>
+            <td>First In First Out (FIFO)</td>
+            <td>First In First Out (FIFO)</td>
+            <td>First In First Out (FIFO)</td>
+        </tr>
+        <tr>
+            <td><a href='/reference/configuration-settings'>Disable session renewal</a></td>
+            <td>No</td>
+            <td>No</td>
+            <td>Yes</td>
+        </tr>
+        <tr>
+            <td><a href='/how-to/mobile-traffic'>Mobile app traffic</a></td>
+            <td>No</td>
+            <td>No</td>
+            <td>Yes</td>
+        </tr>
+   </tbody>
+</table>
+
+## How do I get started?
+
+To get started with Waiting Room, review our [setup guide](/get-started).
\ No newline at end of file
diff --git a/products/waiting-room/src/content/reference/best-practices.md b/products/waiting-room/src/content/reference/best-practices.md
new file mode 100644
index 00000000000..6e66c692270
--- /dev/null
+++ b/products/waiting-room/src/content/reference/best-practices.md
@@ -0,0 +1,29 @@
+---
+title: Best practices
+order: 3
+pcx-content-type: best-practices
+---
+
+# Best practices for waiting rooms
+
+Follow these best practices to avoid potential issues and improve the visitor experience.
+
+## Total active users
+
+When specifying the **Total active users** in your [configuration settings](/reference/configuration-settings), set the value to `75%` of your origin's traffic capacity.
+
+## Page path
+
+When setting the waiting room **Path** in your [configuration settings](/reference/configuration-settings), pay attention to potential subpaths. Waiting rooms are enabled on all subpaths, meaning you might be sending more traffic to your waiting room than anticipated.
+
+Additionally, if you have multiple waiting rooms, the waiting room with the most specific subpath takes precedence.
+
+## Update during active queueing
+
+### Waiting room template
+
+If you want to provide your users with updated information or expectations when they are queueing, we recommend that you update your [waiting room template](/how-to/customize-waiting-room). All changes will be visible to your users in close to real time.
+
+### Configuration settings
+
+When users are actively queueing, only make changes to your [configuration settings](/reference/configuration-settings) when necessary. These changes may impact the estimated wait time shown to end users, which might lead to user confusion.
\ No newline at end of file
diff --git a/products/waiting-room/src/content/reference/configuration-settings.md b/products/waiting-room/src/content/reference/configuration-settings.md
new file mode 100644
index 00000000000..7cd4443091d
--- /dev/null
+++ b/products/waiting-room/src/content/reference/configuration-settings.md
@@ -0,0 +1,113 @@
+---
+order: 1
+pcx-content-type: reference
+type: overview
+---
+
+# Configuration settings
+
+You can customize a variety of options for your waiting rooms.
+
+<ButtonGroup>
+  <Button type="primary" href="#dashboard-settings">Dashboard settings</Button>
+  <Button type="secondary" href="#additional-details">Additional details</Button>
+</ButtonGroup>
+
+## Dashboard settings
+
+<table style="width:100%">
+  <thead>
+    <tr>
+      <td colspan="2" style="width:30%"><strong>Settings</strong></td>
+      <td colspan="2" style="width:70%"><strong>Notes</strong></td>
+    </tr>
+    <tr>
+      <td style="width:15%"><strong>Dashboard Setting</strong></td>
+      <td style="width:15%"><strong>API parameter</strong></td>
+      <td style="width:15%"><strong>Required?</strong></td>
+      <td style="width:30%"><strong>Description</strong></td>
+      <td style="width:25%"><strong>Best practices</strong></td>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Name</td>
+      <td><code>name</code></td>
+      <td>Yes</td>
+      <td>Unique waiting room name.</td>
+      <td></td>
+    </tr>
+    <tr>
+      <td>Hostname</td>
+      <td><code>host</code></td>
+      <td>Yes</td>
+      <td>Host name for which the waiting room will be applied (no wildcards).</td>
+      <td>Do not include <code>http://</code> or <code>https://</code>.</td>
+    </tr>
+    <tr>
+      <td>Path</td>
+      <td><code>path</code></td>
+      <td>No</td>
+      <td>Case-sensitive path of the waiting room. The waiting room will be enabled for all subpaths. Wildcards and query parameters are not supported.</td>
+      <td>If your server does not allow letter casing, use numbers in your <code>path</code> or redirect traffic with a Page Rule.</td>
+    </tr>
+    <tr>
+      <td>Total active users</td>
+      <td><code>total_active_users</code></td>
+      <td>Yes</td>
+      <td>The maximum number of active sessions allowed in <code>host/path</code> at a given time (must be greater than 200).</td>
+      <td>Set to 75% of origin traffic capacity and adjust as needed. Adjustments may affect estimated wait time shown to end users.</td>
+    </tr>
+    <tr>
+      <td>New users per minute</td>
+      <td><code>new_users_per_minute</code></td>
+      <td>Yes</td>
+      <td>A <a href="#new-users-per-minute">threshold</a> of users per minute that can be allowed into <code>host/path</code>, greater than 200 and less than or equal to <strong>total active users</strong>.</td>
+      <td>Set to 100% of peak traffic to ensure users are only queued when necessary</td>
+    </tr>
+    <tr>
+      <td>Session duration</td>
+      <td><code>session_duration</code></td>
+      <td>No</td>
+      <td>The amount of time in minutes (between 1 and 30) that a user who left <code>host/path</code> can come <a href="#session-duration">directly back</a> without having to go into the waiting room. Defaults to 5 minutes.</td>
+      <td></td>
+    </tr>
+    <tr>
+      <td>Description</td>
+      <td><code>description</code></td>
+      <td>No</td>
+      <td>Description of the waiting room.</td>
+      <td></td>
+    </tr>
+     <tr>
+      <td>Disable session renewal</td>
+      <td><code>disable_session_renewal</code></td>
+      <td>No</td>
+      <td>Available via API only (and only to Enterprise customers with purchase). If true, users only have <code>session duration</code> minutes to browse your site. If false, a user's session cookie is renewed on every request.</td>
+      <td></td>
+    </tr>
+  </tbody>
+</table>
+
+<Aside type='note' header='Note'>
+
+You can configure only one waiting room per `host/path` combination.
+</Aside>
+
+## Additional details
+
+### New users per minute
+
+When you configure `new users per minute`, this value **is not** the number of users added per minute.
+
+Instead, it is the threshold of users allowed per minute (less than or equal to the number of `total active users`). You should set this value at 100% of your expected peak traffic to ensure users are only queued when necessary.
+
+### Session duration
+
+Session duration improves user experience in two ways.
+
+First, it prevents visitors from having to pass through a waiting room twice for the same transaction. For example, a visitor might want to make a purchase at `example.com`. There's a lot of traffic at `example.com`, so they queue in the waiting room before entering the online store. After a period of time, they leave the waiting room and enter the online store. They make a purchase and leave the online store.
+
+However, they forgot to add a note to the order or request a receipt. As long as their [session cookie](/reference/waiting-room-cookie) is still valid (for the length of time specified by the `session duration`), they can re-enter your application without having to re-queue in the waiting room.
+
+Second, session duration lets your waiting room create a dynamic outflow from your application (in addition to dynamic inflow). A user's session cookie expires after a period of inactivity, meaning that new spots can open up as soon as space becomes available and estimated wait times are lower and more accurate.
diff --git a/products/waiting-room/src/content/reference/index.md b/products/waiting-room/src/content/reference/index.md
new file mode 100644
index 00000000000..db178241a82
--- /dev/null
+++ b/products/waiting-room/src/content/reference/index.md
@@ -0,0 +1,10 @@
+---
+order: 6
+pcx-content-type: navigation
+---
+
+# Reference
+
+Use the following reference information when setting up and deploying your waiting rooms:
+
+<DirectoryListing path="/reference"/>
\ No newline at end of file
diff --git a/products/waiting-room/src/content/reference/waiting-room-api.md b/products/waiting-room/src/content/reference/waiting-room-api.md
new file mode 100644
index 00000000000..d70d1da10e0
--- /dev/null
+++ b/products/waiting-room/src/content/reference/waiting-room-api.md
@@ -0,0 +1,91 @@
+---
+title: Common API calls
+order: 5
+pcx-content-type: reference
+---
+
+# Use the Cloudflare Waiting Room API
+
+Cloudflare Waiting Rooms redirect visitors to virtual waiting rooms when they are trying to access web pages that have high volumes of traffic.
+
+The [Cloudflare Waiting Room API](https://api.cloudflare.com/#waiting_rooms) provides an interface for programmatically managing waiting rooms.
+
+## Request URL format
+
+To invoke a [Cloudflare Waiting Room API](https://api.cloudflare.com/#waiting-room-properties) operation, append the endpoint to the Cloudflare API base URL:
+
+```shell
+https://api.cloudflare.com/client/v4
+```
+
+For authentication instructions, see [_Getting Started: Requests_](https://api.cloudflare.com/#getting-started-requests) in the Cloudflare API documentation.
+
+For help with endpoints and pagination, see [_Getting Started: Endpoints_](https://api.cloudflare.com/#getting-started-endpoints).
+
+## Manage your waiting room
+
+<table style="width:100%">
+   <thead>
+        <tr>
+            <th>Operation</th>
+            <th>Method + URL stub</th>
+            <th>Notes</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-list-waiting_rooms'>List Waiting Rooms</a></td>
+            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms</code></td>
+            <td>List all waiting rooms for a zone.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-create-waiting-room'>Create Waiting Room</a></td>
+            <td><code>POST&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms</code></td>
+            <td>Create a waiting room.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-waiting-room-details'>Waiting Room Details</a></td>
+            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
+            <td>Fetch a waiting room.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-update-waiting-room'>Update Waiting Room</a></td>
+            <td><code>PUT&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
+            <td>Update a waiting room.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-delete-waiting-room'>Delete Waiting Room</a></td>
+            <td><code>DELETE&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
+            <td>Delete a waiting room.</td>
+        </tr>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-patch-waiting-room'>Patch Waiting Room</a></td>
+            <td><code>PATCH&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}</code></td>
+            <td>Patch a configured waiting room.</td>
+        </tr>
+   </tbody>
+</table>
+
+## Fetch the current status of a waiting room
+
+<table style="width:100%">
+    <thead>
+        <tr>
+            <th>Operation</th>
+            <th>Method + URL stub</th>
+            <th>Notes</th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td><a href='https://api.cloudflare.com/#waiting-room-get-waiting-room-status'>Get the current status of a waiting room</a></td>
+            <td><code>GET&nbsp;zones/{'{:zone_identifier}'}/waiting_rooms/{'{:identifier}'}/status</code></td>
+            <td>
+                <ul>
+                <li>Returns <code>queueing</code> if the queue is activated (clients are put in the waiting room).</li>
+                <li>Returns <code>not_queueing</code> if the queue is not activated or if the waiting room is suspended.</li>
+                </ul>
+            </td>
+        </tr>
+    </tbody>
+</table>
diff --git a/products/waiting-room/src/content/reference/waiting-room-cookie.md b/products/waiting-room/src/content/reference/waiting-room-cookie.md
new file mode 100644
index 00000000000..7bb117e2734
--- /dev/null
+++ b/products/waiting-room/src/content/reference/waiting-room-cookie.md
@@ -0,0 +1,41 @@
+---
+title: Waiting Room cookie
+pcx-content-type: reference
+---
+
+# Cloudflare Waiting Room cookie
+
+A waiting room only uses the `__cfwaitingroom` cookie when a visitor requests access to a host and path combination with an enabled and associated waiting room. When the waiting room is suspended, traffic goes to the origin and the `__cfwaitingroom` cookie is not created. The `__cfwaitingroom` cookie is encrypted and cookies copied to another device will not work.
+
+<Aside type='warning' header='Important:'>
+
+Cloudflare Waiting Room requires the `__cfwaitingroom` cookie. When a waiting room is actively queueing, users cannot visit that host and path combination without enabling cookies.
+
+</Aside>
+
+## Cookie expiration time
+
+* While a visitor stays in a waiting room, the `__cfwaitingroom` cookie is set to expire in 24 hours.
+* When the visitor accesses the application, the `__cfwaitingroom` cookie expires after an interval (specified by [session_duration](/reference/configuration-settings#session-duration)).
+
+## Cookie function
+
+The `__cfwaitingroom` cookie is used to:
+
+* Track a user's position in the waiting room queue and serve them in the correct order.
+* Monitor each visitor's duration in the application to provide an [accurate entry time](#estimated-wait-time) to visitors queueing in the waiting room.
+* To allow re-entry for a period of time (specified by [session_duration](/reference/configuration-settings#session-duration)) without going back in the waiting room.
+
+## Estimated wait time
+
+When a visitor first enters the host and path combination for your waiting room, they receive the `__cfwaitingroom` cookie. That cookie contains a unique group ID, which corresponds to the minute your visitor entered the waiting room. Using this value, we can see how many visitors are in front of a specific group.
+
+Each cookie also contains a value for `acceptedAt`, which corresponds to the minute your visitor entered your application. This value lets us know how many visitors per minute are leaving the waiting room to enter your application.
+
+```txt
+visitorsAhead ÷ activeUsersToWebApplication = estimatedWaitTime
+```
+
+We combine these pieces of information to calculate estimated wait time for each group of visitors.
+
+For more details about the technical implementation of Cloudflare Waiting Room, see the [blog post](https://blog.cloudflare.com/building-waiting-room-on-workers-and-durable-objects/).
\ No newline at end of file
diff --git a/products/waiting-room/src/content/static/custom-form.png b/products/waiting-room/src/content/static/custom-form.png
deleted file mode 100644
index ea73679d53b..00000000000
Binary files a/products/waiting-room/src/content/static/custom-form.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/default-form.png b/products/waiting-room/src/content/static/default-form.png
deleted file mode 100644
index 318491e1cab..00000000000
Binary files a/products/waiting-room/src/content/static/default-form.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/test-waiting-room.png b/products/waiting-room/src/content/static/test-waiting-room.png
new file mode 100644
index 00000000000..0ec80bd87c6
Binary files /dev/null and b/products/waiting-room/src/content/static/test-waiting-room.png differ
diff --git a/products/waiting-room/src/content/static/waiting-room-process-flow.png b/products/waiting-room/src/content/static/waiting-room-process-flow.png
new file mode 100644
index 00000000000..55077a86c5f
Binary files /dev/null and b/products/waiting-room/src/content/static/waiting-room-process-flow.png differ
diff --git a/products/waiting-room/src/content/static/wr-create-waiting-room-page.png b/products/waiting-room/src/content/static/wr-create-waiting-room-page.png
deleted file mode 100644
index 1e66147f42c..00000000000
Binary files a/products/waiting-room/src/content/static/wr-create-waiting-room-page.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-create-waiting-room-settings.png b/products/waiting-room/src/content/static/wr-create-waiting-room-settings.png
deleted file mode 100644
index d923c811f8c..00000000000
Binary files a/products/waiting-room/src/content/static/wr-create-waiting-room-settings.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-create-waiting-room.png b/products/waiting-room/src/content/static/wr-create-waiting-room.png
deleted file mode 100644
index 81e8ce62eca..00000000000
Binary files a/products/waiting-room/src/content/static/wr-create-waiting-room.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-dashboard-create-review.png b/products/waiting-room/src/content/static/wr-dashboard-create-review.png
deleted file mode 100644
index e6fd61dec3c..00000000000
Binary files a/products/waiting-room/src/content/static/wr-dashboard-create-review.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-dashboard-create-settings.png b/products/waiting-room/src/content/static/wr-dashboard-create-settings.png
deleted file mode 100644
index 51b708e64ed..00000000000
Binary files a/products/waiting-room/src/content/static/wr-dashboard-create-settings.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-dashboard-edit-customization.png b/products/waiting-room/src/content/static/wr-dashboard-edit-customization.png
deleted file mode 100644
index a09a8da4fe9..00000000000
Binary files a/products/waiting-room/src/content/static/wr-dashboard-edit-customization.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-dashboard-edit-review.png b/products/waiting-room/src/content/static/wr-dashboard-edit-review.png
deleted file mode 100644
index 325b452e402..00000000000
Binary files a/products/waiting-room/src/content/static/wr-dashboard-edit-review.png and /dev/null differ
diff --git a/products/waiting-room/src/content/static/wr-dashboard-edit-settings.png b/products/waiting-room/src/content/static/wr-dashboard-edit-settings.png
deleted file mode 100644
index a0de1b237b4..00000000000
Binary files a/products/waiting-room/src/content/static/wr-dashboard-edit-settings.png and /dev/null differ
diff --git a/products/waiting-room/src/content/troubleshooting/index.md b/products/waiting-room/src/content/troubleshooting/index.md
new file mode 100644
index 00000000000..76255070551
--- /dev/null
+++ b/products/waiting-room/src/content/troubleshooting/index.md
@@ -0,0 +1,9 @@
+---
+title: Troubleshooting
+order: 10
+pcx-content-type: faq
+---
+
+# Frequently asked questions about Cloudflare Waiting Room
+
+For a list of frequently asked questions about Cloudflare Waiting Room, see the [Waiting Room FAQs](https://support.cloudflare.com/hc/articles/360061431012).
\ No newline at end of file
diff --git a/products/waiting-room/wrangler.toml b/products/waiting-room/wrangler.toml
index df6b240b9cf..1c03a64952a 100644
--- a/products/waiting-room/wrangler.toml
+++ b/products/waiting-room/wrangler.toml
@@ -8,6 +8,9 @@ workers_dev = false
 account_id = "b54f07a6c269ecca2fa60f1ae4920c99"
 zone_id = "351cf9fc660523187714fa772ad5ca49"
 route = "https://developers.cloudflare.com/waiting-room*"
+kv_namespaces = [
+    { binding = "REDIRECTS", id = "c74b5be2ce9b4bcdb7aa3fac3dbcac1b" }
+]
 
 [site]
 bucket = ".docs/public/"
diff --git a/products/warp-client/docs-config.js b/products/warp-client/docs-config.js
index 37647eb6571..e87d3c28a44 100644
--- a/products/warp-client/docs-config.js
+++ b/products/warp-client/docs-config.js
@@ -24,6 +24,6 @@ module.exports = {
     description: "The Cloudflare WARP client allows individuals or organizations to have a faster, more secure and private experience online.",
     author: "@cloudflare",
     url: "https://developers.cloudflare.com/warp-client",
-    image: "data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII="
+    image: "https://www.cloudflare.com/img/cf-twitter-card.png"
   }
 }
diff --git a/products/warp-client/src/content/index.md b/products/warp-client/src/content/index.md
index 205b15b4a09..9a84931aaa6 100644
--- a/products/warp-client/src/content/index.md
+++ b/products/warp-client/src/content/index.md
@@ -1,17 +1,25 @@
 ---
-title: Home
+title: Overview
 order: 0
 ---
 
-# Cloudflare WARP client documentation
-
-The Cloudflare WARP client allows individuals or organizations to have a faster, more secure and private experience online. Cloudflare WARP for Teams allows organizations to keep their employees and data safe no matter where their device is.
+# Cloudflare WARP client
 
 <Aside>
+
 For more information on how to use WARP to enhance your Teams experience, please check out the <a href="https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp">Cloudflare for Teams documentation</a>.
+
 </Aside>
 
-Cloudflare WARP supports the following services depending on how you configure it:
+The Cloudflare WARP client allows individuals and organizations to have a faster, more secure and more private experience online. Choose the mode that best fits your needs, and make your Internet safer today:
+
+* **1.1.1.1**
+* **1.1.1.1 with WARP**
+* **WARP via Local Proxy**
+* **WARP+**
+* **WARP Unilimited**
+
+Scroll down for a description of each mode.
 
 ## 1.1.1.1
 
@@ -19,22 +27,38 @@ Cloudflare WARP supports the following services depending on how you configure i
 
  Read more about 1.1.1.1 on our blog post [Announcing 1.1.1.1: the fastest, privacy-first consumer DNS service](https://blog.cloudflare.com/announcing-1111/) and [Introducing 1.1.1.1 for Families](https://blog.cloudflare.com/introducing-1-1-1-1-for-families/)
 
-## WARP
+## 1.1.1.1 with WARP
+
+<Aside type='note'>
+ 
+ WARP does not provide anonymity. It is not designed to prevent servers you communicate with from identifying you, or to allow you to pretend to be accessing the Internet in a different country than you are currently in.
 
-The WARP application uses [BoringTun](https://blog.cloudflare.com/boringtun-userspace-wireguard-rust/) to encrypt all of the traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing. If the site you are visiting is already a Cloudflare customer, the content is immediately sent down to your device. If they aren't on our network, we use our global network of data centers to devise the shortest path to whomever you are talking to.
+</Aside>
+
+The WARP application uses [BoringTun](https://blog.cloudflare.com/boringtun-userspace-wireguard-rust/) to encrypt all of the traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you are doing. If the site you are visiting is already a Cloudflare customer, the content is immediately sent down to your device. If they are not on our network, we use our global network of data centers to devise the shortest path to whomever you are talking to.
 
  Read more about WARP in our blog post [Introducing WARP: Fixing Mobile Internet Performance and Security](https://blog.cloudflare.com/1111-warp-better-vpn/)
 
-  <Aside>
+## WARP via Local Proxy
+
+<Aside>
  
- **WARP** does not provide anonymity. It is not designed to prevent servers you communicate with from identifying you, or to allow you to pretend to be accessing the Internet in a different country than you are currently in.
+ Currently available on desktop clients only.
+
+</Aside>
+
+When WARP is configured as a local proxy, only the applications that you configure to use the proxy (HTTPS or SOCKS5) will have their traffic sent through WARP. This allows you to pick and choose which traffic is encrypted (for instance, your web browser or a specific app), and everything else will be left open over the Internet.
+
+Because this feature restricts WARP to just applications configured to use the local proxy, leaving all other traffic unencrypted over the Internet by default, we have hidden it in the Advanced menu. To turn it on:
 
- </Aside>
+1. Navigate to **Preferences** > **Advanced** and click **Configure Proxy**.
+1. On the dialog that opens, check the box and configure the port you want to listen on.
+1. This will enable the **WARP via Local Proxy** option in the WARP Settings menu.
 
 ## WARP+
 
-While WARP is able to take advantage of the many Cloudflare data centers around the world to give you a more private and robust connection, WARP+ improves on that with intelligent routing. Leveraging the same technology that powers [Argo Smart Routing](https://www.cloudflare.com/products/argo-smart-routing/), WARP+ will route your traffic around congested internet route and improve overall end to end performance.
+While WARP is able to take advantage of the many Cloudflare data centers around the world to give you a more private and robust connection, WARP+ improves on that with intelligent routing. Leveraging the same technology that powers [Argo Smart Routing](https://www.cloudflare.com/products/argo-smart-routing/), WARP+ will route your traffic around congested Internet route and improve overall end to end performance.
  
 ## WARP Unlimited
 
-WARP Unlimited is our monthly subscription offering for WARP+. For the time being, WARP Unlimited can only be purchased via your iOS and Android device.
\ No newline at end of file
+WARP Unlimited is our monthly subscription offering for WARP+. For the time being, WARP Unlimited can only be purchased via your iOS and Android device.
diff --git a/products/warp-client/src/content/known-issues-and-faq/index.md b/products/warp-client/src/content/known-issues-and-faq/index.md
index 3f26ce08d0d..d0b6849e27a 100644
--- a/products/warp-client/src/content/known-issues-and-faq/index.md
+++ b/products/warp-client/src/content/known-issues-and-faq/index.md
@@ -29,3 +29,7 @@ Sites inside Cloudflare network are able to see this information. If a site is s
 ### My throughput has dropped while using WARP
 
 Cloudflare WARP is in part powered by 1.1.1.1, the world's fastest DNS resolver. When visiting sites or going to a new location on the Internet, you should see blazing fast DNS lookups. WARP however is built to trade some throughput for enhanced privacy by encrypting all traffic both to and from your device. While this isn't noticeable at most mobile speeds, on desktop systems in countries where high speed broadband is available, you may notice a drop. We think the tradeoff is worth it though and continue to work on improving performance all over the system.
+
+### WARP Performance FAQ
+
+Cloudflare WARP and the 1.1.1.1 w/ WARP Application go through performance testing that includes battery, network and CPU on a regular basis. In addition, both applications are used by millions of users worldwide that help us stay on top of issues across a wide variety of devices, networks, sites and applications.
diff --git a/products/warp-client/src/content/overview.md b/products/warp-client/src/content/overview.md
deleted file mode 100644
index e23346d09e3..00000000000
--- a/products/warp-client/src/content/overview.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-title: Overview
-order: 1
----
-
-Cloudflare WARP supports the following services depending on how you configure it.
-
-### WARP Modes
-
-* **1.1.1.1** is the fastest and most private DNS directory you can configure for all your devices. It also allows you to add security to your internet connection, because it gives you the option to send your DNS requests over DNS-over-HTTPS or DNS-over-TLS. This will ensure nobody will be able to eavesdrop on you.
-
- Read more about 1.1.1.1 on our blog post [Announcing 1.1.1.1: the fastest, privacy-first consumer DNS service](https://blog.cloudflare.com/announcing-1111/) and [Introducing 1.1.1.1 for Families](https://blog.cloudflare.com/introducing-1-1-1-1-for-families/)
-
-* **WARP.** The WARP application uses [BoringTun](https://blog.cloudflare.com/boringtun-userspace-wireguard-rust/) to encrypt all of the traffic from your device and send it directly to Cloudflare’s edge, ensuring that no one in between is snooping on what you're doing. If the site you are visiting is already a Cloudflare customer, the content is immediately sent down to your device. If they aren't on our network, we use our global network of data centers to devise the shortest path to whomever you are talking to.
-
- Read more about WARP in our blog post [Introducing WARP: Fixing Mobile Internet Performance and Security](https://blog.cloudflare.com/1111-warp-better-vpn/)
-
-  <Aside>
- 
- **WARP** does not provide anonymity. It is not designed to prevent servers you communicate with from identifying you, or to allow you to pretend to be accessing the Internet in a different country than you are currently in.
-
- </Aside>
-
-* **WARP+.** While WARP is able to take advantage of the many Cloudflare data centers around the world to give you a more private and robust connection, WARP+ improves on that with intelligent routing. Leveraging the same technology that powers [Argo Smart Routing](https://www.cloudflare.com/products/argo-smart-routing/), WARP+ will route your traffic around congested internet route and improve overall end to end performance.
- 
- **WARP Unlimited** is our monthly subscription offering for WARP+. For the time being, WARP Unlimited can only be purchased via your iOS and Android device.
diff --git a/products/warp-client/src/content/setting-up/linux.md b/products/warp-client/src/content/setting-up/linux.md
index b47b17a9ef9..58e7289de65 100644
--- a/products/warp-client/src/content/setting-up/linux.md
+++ b/products/warp-client/src/content/setting-up/linux.md
@@ -6,7 +6,7 @@ order: 6
 # Linux desktop client
 
 ## Steps to install
-1. Find the [setup repository](https://pkg.cloudflare.com/).
+1. Find the [setup repository](https://pkg.cloudflareclient.com/).
 1. Install the `cloudflare-warp` package depending on your distro:
     1. **apt-based OS** (e.g., Ubuntu) `sudo apt install cloudflare-warp`
     2. **yum-based OS** (e.g., CentOS or RHEL) `sudo yum install cloudflare-warp`
@@ -21,6 +21,10 @@ To connect for the very first time you must call `register` first:
 1. Connect `warp-cli connect`
 1. Run `curl https://www.cloudflare.com/cdn-cgi/trace/` and verify that `warp=on`
 
+### Always stay connected
+If you want to always stay connected to WARP you must call `enable-always-on`. This is the cli equivalent to switching the toggle switch to the on position in our GUI apps.
+1. Run `warp-cli enable-always-on`
+
 ### Switching modes
 You can use `warp-cli set-mode --help` to get a list of the modes to switch between. For instance:
 
@@ -28,7 +32,7 @@ You can use `warp-cli set-mode --help` to get a list of the modes to switch betw
 - WARP with DoH `warp-cli set-mode warp+doh`
 
 ### Using 1.1.1.1 for Families
-The Linux client supports all 1.1.1.1 for Familes modes wither either WARP on or in pure DNS only mode
+The Linux client supports all 1.1.1.1 for Families modes with either WARP on or in pure DNS only mode
 - Families off `warp-cli set-families-mode off`
 - Malware protection `warp-cli set-families-mode malware`
 - Malware + Adult Content `warp-cli set-families-mode full`
diff --git a/products/warp-client/src/content/setting-up/requirements.md b/products/warp-client/src/content/setting-up/requirements.md
index 1896b215996..a7ef065f565 100644
--- a/products/warp-client/src/content/setting-up/requirements.md
+++ b/products/warp-client/src/content/setting-up/requirements.md
@@ -38,7 +38,7 @@ __[Download Cloudflare_WARP_Release-x64.msi](https://www.cloudflarewarp.com/Clou
   <tbody>
     <tr>
       <td><strong>OS Ver</strong></td>
-      <td>High Sierra+</td>
+      <td>High Sierra+ (10.13+)</td>
     </tr>
     <tr>
       <td><strong>OS Type</strong></td>
@@ -87,7 +87,7 @@ __[Download Cloudflare_WARP.zip](https://www.cloudflarewarp.com/Cloudflare_WARP.
   </tbody>
 </table>
 
-__[cloudflare-warp package repository](https://pkg.cloudflare.com/)__
+__[cloudflare-warp package repository](https://pkg.cloudflareclient.com/)__
 
 ## iOS
 <table>
diff --git a/products/warp-client/src/content/static/1.1.1.1.png b/products/warp-client/src/content/static/1.1.1.1.png
new file mode 100644
index 00000000000..eed7cb08b74
Binary files /dev/null and b/products/warp-client/src/content/static/1.1.1.1.png differ
diff --git a/products/workers/src/content/_partials/_tutorials-before-you-start.md b/products/workers/src/content/_partials/_tutorials-before-you-start.md
index 07b9cc5a5f9..2883834d8ed 100644
--- a/products/workers/src/content/_partials/_tutorials-before-you-start.md
+++ b/products/workers/src/content/_partials/_tutorials-before-you-start.md
@@ -1,3 +1,3 @@
 ## Before you start
 
-All of the tutorials assume you’ve already gone through [Getting started](/get-started/guide), which gets you set up with a Cloudflare Workers account, and the Workers CLI tool, [Wrangler](https://github.com/cloudflare/wrangler).
+All of the tutorials assume you have already completed the [Get started guide](/get-started/guide), which gets you set up with a Cloudflare Workers account, and the Workers CLI tool, [Wrangler](https://github.com/cloudflare/wrangler).
diff --git a/products/workers/src/content/cli-wrangler/authentication.md b/products/workers/src/content/cli-wrangler/authentication.md
index 66ab14af069..e12eb04690d 100644
--- a/products/workers/src/content/cli-wrangler/authentication.md
+++ b/products/workers/src/content/cli-wrangler/authentication.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Authentication
diff --git a/products/workers/src/content/cli-wrangler/commands.md b/products/workers/src/content/cli-wrangler/commands.md
index 16aa65e02ef..90e8e9b0284 100644
--- a/products/workers/src/content/cli-wrangler/commands.md
+++ b/products/workers/src/content/cli-wrangler/commands.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: configuration
 ---
 
 # Commands
@@ -140,6 +141,8 @@ To use this command, the following fields are required in your `wrangler.toml`:
 
 From here, you have two options, you can choose to publish to your own domain or you can choose to publish to [&lt;your-worker&gt;.&lt;your-subdomain&gt;.workers.dev](https://workers.dev).
 
+When you publish changes to an existing Worker script, all new requests will automatically route to the updated version of the Worker without downtime. Any inflight requests will continue running on the previous version until completion. Once all inflight requests have finished complete, the previous Worker version will be purged and will no longer handle requests.
+
 ### Publishing to workers.dev
 
 If you want to publish to [workers.dev](https://workers.dev), you will first need to have a subdomain registered. You can register a subdomain by executing the [subdomain](#subdomain) command.
@@ -184,7 +187,7 @@ If you would like to be able to publish your code to multiple places, please see
 
 ## dev
 
-`wrangler dev` starts a server on `localhost` that executes your Worker on incoming HTTP requests. It can forward the requests to Cloudflare's servers, one of your zones, or any host you specify. This is a great way to easily test your Worker while developing.
+`wrangler dev` is a command that establishes a connection between `localhost` and an edge server that operates your Worker in development. A cloudflared tunnel forwards all requests to the edge server, which continuously updates as your Worker code changes. This allows full access to Workers KV, Durable Objects, etc. This is a great way to easily test your Worker while developing.
 
 ```sh
 $ wrangler dev [--env $ENVIRONMENT_NAME] [--ip <ip>] [--port <port>] [--host <host>] [--local-protocol <http|https>] [--upstream-protocol <http|https>]
@@ -238,30 +241,35 @@ If you are using [kv_namespaces](/cli-wrangler/configuration#kv_namespaces) with
 Starts a log tailing session for a deployed Worker.
 
 ```sh
-$ wrangler tail [--format $FORMAT] [--port $PORT] [--metrics-port $PORT]
+$ wrangler tail [--format $FORMAT] [--status $STATUS] [OPTIONS]
 ```
 
 <Definitions>
 
 - `--format $FORMAT` <Type>json|pretty</Type>
-  - The format of the log entries
-
-- `--port $PORT` <Type>int</Type>
-  - The port for your local log server
-
-- `--metrics-port $PORT` <Type>int</Type>
-  - The port for serving [metrics information](https://developers.cloudflare.com/argo-tunnel/reference/arguments/#metrics) about the tunnel
+  - The format of the log entries.
+- `--status $STATUS`
+  - Filter by invocation status [possible values: ok, error, canceled]
+- `--header $HEADER`
+  - Filter by HTTP header
+- `--method $METHOD`
+  - Filter by HTTP method
+- `--sampling-rate $RATE` 
+  - Adds a percentage of requests to log sampling rate
+- `--search $SEARCH`
+  - Filter by a text match in `console.log` messages
 
 </Definitions>
 
 After starting `wrangler tail` in a directory with a project, you will receive a live feed of console and exception logs for each request your Worker receives.
 
-Like all Wrangler commands, run `wrangler tail` from your Worker’s root directory (i.e. the directory with your `wrangler.toml`).
+Like all Wrangler commands, run `wrangler tail` from your Worker’s root directory (i.e., the directory with your `wrangler.toml`).
 
-### Dependencies
+<Aside type="warning" header="Legacy issues with existing cloudflared configuration">
 
-Wrangler tail uses cloudflared under the hood. If you are already using cloudflared, be sure you have installed the latest version. Otherwise, follow the [getting started guide](https://developers.cloudflare.com/argo-tunnel/quickstart/) for Argo Tunnel.
-`wrangler tail` will register a tailing session for your Worker, and start a server on `localhost` with a [tunnel](https://developers.cloudflare.com/argo-tunnel/quickstart/) that listens for incoming log requests from your Worker.
+`wrangler tail` versions older than version 1.19.0 use `cloudflared` to run. Cloudflare recommends [updating to the latest wrangler version](/cli-wrangler/install-update#update) to avoid any issues.
+
+</Aside>
 
 --------------------------------
 
diff --git a/products/workers/src/content/cli-wrangler/configuration.md b/products/workers/src/content/cli-wrangler/configuration.md
index 3cc1b66b570..0df49b7c32d 100644
--- a/products/workers/src/content/cli-wrangler/configuration.md
+++ b/products/workers/src/content/cli-wrangler/configuration.md
@@ -1,40 +1,88 @@
 ---
 order: 3
+pcx-content-type: configuration
 ---
 
 # Configuration
 
 ## Background
 
-Your project will need some configuration before you can publish your worker. These values are stored in a `wrangler.toml` file. You will need to manually edit this file to add these values before you can publish.
+Your project will need some configuration before you can publish your Worker. Configuration is done through changes to keys and values stored in a `wrangler.toml` file located in the root of your project directory. You must manually edit this file to edit your keys and values before you can publish.
 
 ---
 
 ## Environments
 
-Top level configuration: the configuration values you specify at the top of your `wrangler.toml` will be applied to all environments if not otherwise specified in the environment.
+The top-level configuration is the collection of values you specify at the top of your `wrangler.toml` file. These values will be inherited by all environments, unless otherwise defined in the environment.
 
-Environment configuration <PropMeta>(optional)</PropMeta>: the configuration values you specify under an `[env.name]` in your `wrangler.toml`
+The layout of a top-level configuration in a `wrangler.toml` file is displayed below:
 
-Environments is a feature that allows you to deploy the same project to multiple places under multiple names. These environments are utilized with the `--env` or `-e` flag on the commands that are deploying live Worker scripts:
+```toml
+---
+your-worker.toml
+---
+name = "your-worker"
+type = "javascript"
+account_id = "your-account-id"
+
+# This field specifies that the Worker
+# will be deployed to a *.workers.dev domain
+workers_dev = true
+
+# -- OR --
+
+# These fields specify that the Worker
+# will deploy to a custom domain
+zone_id = "your-zone-id"
+routes = ["example.com/*"]
+```
+
+Environment configuration <PropMeta>(optional)</PropMeta>: the configuration values you specify under an `[env.name]` in your `wrangler.toml` file.
+
+Environments allow you to deploy the same project to multiple places under multiple names. These environments are utilized with the `--env` or `-e` flag on the [commands](/cli-wrangler/commands) that are deploying live Worker scripts:
 
 - `build`
+- `dev`
 - `preview`
 - `publish`
+- `secret`
+
+Some environment properties can be [_inherited_](#keys) from the top-level configuration, but if new values are configured in an environment, they will always override those at the top level.
+
+An example of an `[env.name]` configuration looks like this:
+
+```toml
+---
+your-worker.toml
+---
+name = "your-worker"
+type = "javascript"
+account_id = "your-account-id"
+
+[env.helloworld]
+# These new values will override the top level configuration.
+name = "your-worker-helloworld"
+account_id = "your-other-account-id"
 
-Some environment properties can be [_inherited_](#keys) from the top level configuration, but values in an environment will always override those at the top level.
+# Any additional keys, like environment variables, will be placed here.
+vars = { FOO = "some value", BAR = "some other string" }
+kv_namespaces = [
+  { binding = "FOO", id = "1a2b3c4d5e", preview_id = "6e7f8g9h10i" }
+]
+```
+To deploy this example Worker to the `helloworld` environment, you would run `wrangler publish --env helloworld`.
 
 ---
 
 ## Keys
 
-Keys to configure per project in your `wrangler.toml`.
+There are three types of keys in a `wrangler.toml` file:
 
-**Top level only**: required to be configured at the top level of your wrangler.toml only; multiple environments on the same project must share this property
+* Top level only keys are required to be configured at the top level of your `wrangler.toml` file only; multiple environments on the same project must share this key's value.
 
-**Inherited**: Can be configured at the top level and/or environment. If the property is defined _only_ at the top level, the environment will use the property value from the top level. If the property is defined in the environment, the environment value will override the top level value.
+* Inherited keys can be configured at the top level and/or environment. If the key is defined only at the top level, the environment will use the key's value from the top level. If the key is defined in the environment, the environment value will override the top-level value.
 
-**Not inherited**: Must be defined for every environment individually.
+* Non-inherited keys must be defined for every environment individually.
 
 <Definitions>
 
@@ -48,7 +96,7 @@ Keys to configure per project in your `wrangler.toml`.
 
 <Aside>
 
-  **Note:** We will continue to support `rust` and `webpack` project types, but we recommend using the `javascript` project type and specifying a custom [`build`](#build) section.
+  **Note:** Cloudflare will continue to support `rust` and `webpack` project types, but recommends using the `javascript` project type and specifying a custom [`build`](#build) section.
 
 </Aside>
 
@@ -58,11 +106,11 @@ Keys to configure per project in your `wrangler.toml`.
 
 - `zone_id` <Type>inherited</Type> <PropMeta>optional</PropMeta>
 
-  - This is the ID of the "zone" or domain you want to run your script on. It can also be specified through the `CF_ZONE_ID` environment variable. This key is optional if you are using only a [workers.dev](https://workers.dev) subdomain.
+  - This is the ID of the zone or domain you want to run your script on. It can also be specified through the `CF_ZONE_ID` environment variable. This key is optional if you are using only a `*.workers.dev` subdomain.
 
 - `workers_dev` <Type>inherited</Type> <PropMeta>optional</PropMeta>
 
-  - This is a boolean flag that specifies if your worker will be deployed to your [workers.dev](https://workers.dev) subdomain. If omitted defaults to false.
+  - This is a boolean flag that specifies if your Worker will be deployed to your [workers.dev](https://workers.dev) subdomain. If omitted, it defaults to false.
 
 - `route` <Type>not inherited</Type> <PropMeta>optional</PropMeta>
 
@@ -70,11 +118,11 @@ Keys to configure per project in your `wrangler.toml`.
 
 - `routes` <Type>not inherited</Type> <PropMeta>optional</PropMeta>
 
-  - A list of routes you’d like to use your worker on. These follow exactly the same rules a `route`, but you can specify a list of them.<br />`routes = ["http://example.com/hello", "http://example.com/goodbye"]`. A `route` OR `routes` key is only required if you are not using a [workers.dev](https://workers.dev) subdomain.
+  - A list of routes you would like to use your Worker on. These follow exactly the same rules a `route`, but you can specify a list of them.<br />`routes = ["http://example.com/hello", "http://example.com/goodbye"]`. A `route` OR `routes` key is only required if you are not using a `*.workers.dev` subdomain.
 
 - `webpack_config` <Type>inherited</Type> <PropMeta>optional</PropMeta>
 
-  - This is the path to a custom webpack configuration file for your worker. You must specify this field to use a custom webpack configuration, otherwise Wrangler will use a default configuration for you. Visit the [Wrangler webpack page](/cli-wrangler/webpack) for more information.
+  - This is the path to a custom webpack configuration file for your Worker. You must specify this field to use a custom webpack configuration, otherwise Wrangler will use a default configuration for you. Visit the [Wrangler webpack page](/cli-wrangler/webpack) for more information.
 
 - `vars` <Type>not inherited</Type> <PropMeta>optional</PropMeta>
 
@@ -86,56 +134,63 @@ Keys to configure per project in your `wrangler.toml`.
 
 - `site` <Type>inherited</Type> <PropMeta>optional</PropMeta>
 
-  - Determines the local folder to upload and serve from a Worker
+  - Determines the local folder to upload and serve from a Worker.
 
 - `dev` <Type>not inherited</Type> <PropMeta>optional</PropMeta>
 
-  - Arguments for `wrangler dev`, configure local server
+  - Arguments for `wrangler dev` that configure local server.
 
 - `triggers` <Type>inherited</Type> <PropMeta>optional</PropMeta>
 
-  - Configures cron triggers for executing a Worker on a schedule
+  - Configures cron triggers for running a Worker on a schedule.
 
-- `usage_model` <Type>top level</Type> <PropMeta>optional</PropMeta>
+- `usage_model` <Type>inherited</Type> <PropMeta>optional</PropMeta>
   - Specifies the [Usage Model](/platform/pricing#usage-models) for your Worker. There are two options - [`bundled`](/platform/limits#bundled-usage-model) and [`unbound`](/platform/limits#unbound-usage-model). For newly created Workers, if the Usage Model is omitted it will be set to the [default Usage Model set on the account](https://dash.cloudflare.com/?account=workers/default-usage-model). For existing Workers, if the Usage Model is omitted, it will be set to the Usage Model configured in the dashboard for that Worker.
 
-- `build` <Type>inherited</Type> <PropMeta>optional</PropMeta>
+- `build` <Type>top level</Type> <PropMeta>optional</PropMeta>
 
-  - Allows configuring a custom build step to be run by wrangler when building your worker. See the [custom builds documentation](#build) for more details.
+  - Configures a custom build step to be run by Wrangler when building your Worker. Refer to the [custom builds documentation](#build) for more details.
 
 
 </Definitions>
 
 ### vars
 
-Values to use in your Worker script as text environment variables.
+The `vars` key defines a table of [environment variables](/platform/environment-variables) provided to your Worker script. All values are plaintext values.
 
 Usage:
 
 ```toml
-vars = { FOO = "some value", BAR = "some other string" }
+[vars]
+FOO = "some value"
+BAR = "some other string"
 ```
+The table keys are available to your script as global variables, which will contain their associated values.
 
-<Definitions>
-
-- `FOO`
+```js
+// Worker code:
+console.log(FOO);
+//=> "some value"
 
-  - The variable to access in your Worker script
+console.log(BAR);
+//=> "some other string"
+```
 
-- `"some value"`
-  - The string value the variable resolves to
+Alternatively, you can define `vars` using an inline table format. This style should not include any new lines to be considered a valid TOML configuration:
 
-</Definitions>
+```toml
+vars = { FOO = "some value", BAR = "some other string" }
+```
 
 <Aside>
 
-**Note:** Using secrets should be handled using [wrangler secret](/cli-wrangler/commands#secret). The `vars` definition in your `wrangler.toml` must not contain newlines in order to be valid TOML.
+**Note:** Using secrets should be handled using [wrangler secret](/cli-wrangler/commands#secret).
 
 </Aside>
 
 ### kv_namespaces
 
-KV namespaces bind to your Worker and may be referenced in your script.
+`kv_namespaces` defines a list of KV namespace bindings for your Worker.
 
 Usage:
 
@@ -145,33 +200,57 @@ kv_namespaces = [
   { binding = "BAR", id = "068c101e168d03c65bddf4ba75150fb0", preview_id = "fb69528dbc7336525313f2e8c3b17db0" }
 ]
 ```
+Alternatively, you can define `kv namespaces` like so:
+
+```toml
+[[kv_namespaces]]
+binding = "FOO"
+preview_id = "abc456"
+id = "abc123"
+
+[[kv_namespaces]]
+binding = "BAR"
+preview_id = "xyz456"
+id = "xyz123"
+```
+Much like environment variables and secrets, the `binding` names are available to your Worker as global variables.
+
+```js
+// Worker script:
+
+let value = await FOO.get("keyname");
+//=> gets the value for "keyname" from
+//=> the FOO variable, which points to
+//=> the "0f2ac...e279" KV namespace
+```
 
 <Definitions>
 
 - `binding` <PropMeta>required</PropMeta>
 
-  - After you’ve created a namespace, you must bind it to your Worker so it is accessible from within the Worker script via a variable name you specify.
+  - The name of the global variable your code will reference. It will be provided as a [KV runtime instance](/runtime-apis/kv).
 
 - `id` <PropMeta>required</PropMeta>
 
-  - The ID of the namespace you wish to bind to the Worker’s global scope when it is deployed. Required for `wrangler publish`.
+  - The ID of the KV namespace that your `binding` should represent. Required for `wrangler publish`.
 
 - `preview_id` <PropMeta>required</PropMeta>
-  - The ID of the namespace you wish to bind to the Worker’s global scope when it is previewed . Required for `wrangler dev` and `wrangler preview`.
+
+  - The ID of the KV namespace that your `binding` should represent during `wrangler dev` or `wrangler preview`. Required for `wrangler dev` and `wrangler preview`.
 
 </Definitions>
 
 <Aside>
 
-**Note:** Creating your KV Namespaces can be handled using Wrangler’s [KV Commands](/cli-wrangler/commands#kv).
+**Note:** Creating your KV namespaces can be handled using Wrangler’s [KV Commands](/cli-wrangler/commands#kv).
 
-You can also define your `kv_namespaces` using [alternative TOML syntax](https://github.com/toml-lang/toml#user-content-table).
+You can also define your `kv_namespaces` using [alternative TOML syntax](https://github.com/toml-lang/toml/blob/master/toml.md#user-content-table).
 
 </Aside>
 
 ### site
 
-A Workers Site generated with [`wrangler generate --site`](/cli-wrangler/commands#generate) or [`wrangler init --site`](/cli-wrangler/commands#init).
+A [Workers Site](/platform/sites) generated with [`wrangler generate --site`](/cli-wrangler/commands#generate) or [`wrangler init --site`](/cli-wrangler/commands#init).
 
 Usage:
 
@@ -185,41 +264,31 @@ entry-point = "workers-site"
 
 - `bucket` <PropMeta>required</PropMeta>
 
-  - The directory containing your static assets, path relative to your `wrangler.toml`. Example: `bucket = "./public"`
+  - The directory containing your static assets. It must be a path relative to your `wrangler.toml` file. Example: `bucket = "./public"`
 
 - `entry-point` <PropMeta>optional</PropMeta>
 
-  - The location of your Worker script, default is `workers-site`. Example: `entry-point = "./workers-site"`
+  - The location of your Worker script. The default location is `workers-site`. Example: `entry-point = "./workers-site"`
 
 - `include` <PropMeta>optional</PropMeta>
 
-  - A list of gitignore-style patterns for files or directories in `bucket` you exclusively want to upload. Example: `include = ["upload_dir"]`
+  - An exclusive list of `.gitignore`-style patterns that match file or directory names from your `bucket` location. Only matched items will be uploaded. Example: `include = ["upload_dir"]`
 
 - `exclude` <PropMeta>optional</PropMeta>
-  - A list of gitignore-style patterns for files or directories in `bucket` you want to exclude from uploads. Example: `exclude = ["ignore_dir"]`
 
-</Definitions>
+  - A list of `.gitignore`-style patterns that match files or directories in your `bucket` that should be excluded from uploads. Example: `exclude = ["ignore_dir"]`
 
-To learn more about the optional `include` and `exclude` fields, visit [Ignoring Subsets of Static Assets](#ignoring-subsets-of-static-assets).
+</Definitions>
 
-You can also define your `site` using [alternative TOML syntax](https://github.com/toml-lang/toml#user-content-inline-table).
+You can also define your `site` using [alternative TOML syntax](https://github.com/toml-lang/toml/blob/master/toml.md#user-content-inline-table).
 
 #### Storage Limits
 
-For very exceptionally large pages, Workers Sites might not work for you. There is a 25MB limit per page or file. Additionally, Wrangler will create an asset manifest for your files that will count towards your script’s size limit. If you have too many files, you may not be able to use Workers Sites.
-
-#### Ignoring Subsets of Static Assets
-
-Workers Sites require [Wrangler](https://github.com/cloudflare/wrangler) — make sure to be on the [latest version](/cli-wrangler/install-update#update) — and the Workers [Bundled plan](https://workers.cloudflare.com/sites#plans).
-
-There are cases where users may not want to upload certain static assets to their Workers Sites.
-In this case, Workers Sites can also be configured to ignore certain files or directories using logic
-similar to [Cargo’s optional include and exclude fields](https://doc.rust-lang.org/cargo/reference/manifest.html#the-exclude-and-include-fields-optional).
-This means that we use gitignore semantics when declaring which directory entries to include or ignore in uploads.
+For exceptionally large pages, Workers Sites may not be ideal. There is a 25MB limit per page or file. Additionally, Wrangler will create an asset manifest for your files that will count towards your script’s size limit. If you have too many files, you may not be able to use Workers Sites.
 
 #### Exclusively including files/directories
 
-If you want to include only a certain set of files or directories in your `bucket`, you can add an `include` field to your
+If you want to include only a certain set of files or directories in your `bucket`, add an `include` field to your
 `[site]` section of `wrangler.toml`:
 
 ```toml
@@ -233,7 +302,7 @@ Wrangler will only upload files or directories matching the patterns in the `inc
 
 #### Excluding files/directories
 
-If you want to exclude files or directories in your `bucket`, you can add an `exclude` field to your
+If you want to exclude files or directories in your `bucket`, add an `exclude` field to your
 `[site]` section of `wrangler.toml`:
 
 ```toml
@@ -263,9 +332,9 @@ You can learn more about the standard patterns used for include and exclude in t
 
 #### Customizing your Sites Build
 
-Workers Sites projects use webpack by default. You can [bring your own webpack config](/cli-wrangler/webpack#using-with-workers-sites), however it is important to be cognizant of your `entry` and `context` settings.
+Workers Sites projects use webpack by default. Though you can [bring your own webpack config](/cli-wrangler/webpack#using-with-workers-sites), be aware of your `entry` and `context` settings.
 
-You can also use the `[build]` section with Workers Sites, as long as your build step will resolve dependencies in `node_modules`. See the [custom builds](configuration#build) section for more information.
+You can also use the `[build]` section with Workers Sites, as long as your build step will resolve dependencies in `node_modules`. See the [custom builds](#build) section for more information.
 
 ### triggers
 
@@ -278,12 +347,16 @@ Usage:
 crons = ["0 0 * JAN-JUN FRI", "0 0 LW JUL-DEC *"]
 ```
 
+<Definitions>
+
 - `crons` <PropMeta>optional</PropMeta>
   - A set of cron expressions, where each expression is a separate schedule to run the Worker on.
 
+</Definitions>
+
 ### dev
 
-Arguments for `wrangler dev` can be configured here so you don't have to repeatedly pass them.
+Arguments for `wrangler dev` can be configured here so you do not have to repeatedly pass them.
 
 Usage:
 
@@ -297,18 +370,19 @@ local_protocol = "https"
 
 - `ip` <PropMeta>optional</PropMeta>
 
-  - Ip for local `wrangler dev` server to listen on, defaults to 127.0.0.1
+  - The IP address for the local `wrangler dev` server to listen on, defaults to `127.0.0.1`.
 
 - `port` <PropMeta>optional</PropMeta>
 
-  - Port for local `wrangler dev` server to listen on, defaults to 8787
+  - Port for local `wrangler dev` server to listen on, defaults to `8787`.
 
 - `local_protocol` <PropMeta>optional</PropMeta>
 
-  - Protocol that local `wrangler dev` server listen to requests on, defaults to http
+  - Protocol that local `wrangler dev` server listen to requests on, defaults to `http`.
 
 - `upstream_protocol` <PropMeta>optional</PropMeta>
-  - Protocol that `wrangler dev` forwards requests on, defaults to https
+
+  - Protocol that `wrangler dev` forwards requests on, defaults to `https`.
 
 </Definitions>
 
@@ -318,10 +392,10 @@ Customize the command used to build your project. There are two configurations b
 
 #### Service Workers
 
-This section is for customizing Workers with the `service-worker` format. If you're not familar, these are Workers that use `addEventListener` and look like the following:
+This section is for customizing Workers with the `service-worker` format. These Workers use `addEventListener` and look like the following:
 
 ```js
-addEventListener('fetch', function (event) {
+addEventListener('fetch', event => {
   event.respondWith(new Response("I'm a service Worker!"))
 })
 ```
@@ -330,27 +404,37 @@ Usage:
 
 ```toml
 [build]
-upload.format = "service-worker"
 command = "npm install && npm run build"
-```
 
-<Definitions>
+[build.upload]
+format = "service-worker"
+```
 
-- `upload.format` <PropMeta>required</PropMeta>
+##### `[build]`
 
-  - The format of the Worker script, must be "service-worker"
+<Definitions>
 
 - `command` <PropMeta>optional</PropMeta>
 
-  - The command to build your project which is executed in the shell of your machine: `sh` for Linux and MacOS, and `cmd` for Windows. You can also use shell operators such as `&&` and `|`
+  - The command used to build your Worker. On Linux and macOS, the command is executed in the `sh` shell and the `cmd` shell for Windows. The `&&` and `||` shell operators may be used.
 
 - `cwd` <PropMeta>optional</PropMeta>
 
-  - The working directory for commands, defaults to the project root directory
+  - The working directory for commands, defaults to the project root directory.
 
 - `watch_dir` <PropMeta>optional</PropMeta>
 
-  - The directory to watch for changes while using `wrangler dev`, defaults to "src" relative to the project root directory
+  - The directory to watch for changes while using `wrangler dev`, defaults to the `src` relative to the project root directory.
+
+</Definitions>
+
+##### `[build.upload]`
+
+<Definitions>
+
+  - `format` <PropMeta>required</PropMeta>
+
+    - The format of the Worker script, must be `"service-worker"`.
 
 </Definitions>
 
@@ -362,24 +446,21 @@ command = "npm install && npm run build"
 
 #### Modules
 
-Cloudflare Workers now supports uploading scripts as a collection of modules, instead of a single file. Scripts uploaded in this fashion are written a bit differently -- they `export` their event handlers instead of registering them using the global `addEventListener('fetch', handler...)`. Modules also receive bindings (like KV Namespaces, Config Vargs, and Secrets) as arguments to their handlers, rather than global variables. Uploaded modules can `import` (for ES Modules) or `require()` (for CommonJS modules) other uploaded modules.
+Workers now supports the ES Modules syntax. This format allows you to export a collection of files and/or modules, unlike the Service Worker format which required a single file to be uploaded.
 
-<Aside>
+Module Workers `export` their event handlers instead of using `addEventListener` calls.
 
-  **Note:** You currently need to opt-in to the [Durable Objects](/learning/using-durable-objects)
-  open beta to be able to use the `modules` format. This restriction will be removed as modules are
-  better supported in the Workers Dashboard.
+Modules receive all bindings (KV Namespaces, Environment Variables, and Secrets) as arguments to the exported handlers. Previously, with the Service Worker format, these bindings were available as global variables.
 
-</Aside>
+An uploaded module may `import` other uploaded ES Modules. If using the CommonJS format, you may `require` other uploaded CommonJS modules.
 
 ```js
 import html from './index.html'
 
 export default {
-  // request is almost the same as `event.request` from the service worker format, except for:
-  // * waitUntil() and passThroughOnException() are accessible from ctx instead
-  // * request.cf is currently not available
-  // env is where bindings like KV namespaces, Durable Object namespaces, Config variables, and Secrets
+  // * request is the same as `event.request` from the service worker format
+  // * waitUntil() and passThroughOnException() are accessible from `ctx` instead of `event` from the service worker format
+  // * env is where bindings like KV namespaces, Durable Object namespaces, Config variables, and Secrets
   // are exposed, instead of them being placed in global scope.
   async fetch(request, env, ctx) {
     const headers = { 'Content-Type': 'text/html;charset=UTF-8' }
@@ -388,9 +469,9 @@ export default {
 }
 ```
 
-In the future, Modules will become the default format for writing Workers scripts. Until then, we are still working on "full" support, so consider this as a beta feature.
+Modules support in Cloudflare Workers is currently in beta.
 
-To create a Workers project using wrangler and Modules, you'll need to add a `[build]` section:
+To create a Workers project using Wrangler and Modules, add a `[build]` section:
 
 ```toml
 [build]
@@ -407,15 +488,15 @@ main = "./worker.mjs"
 
 - `command` <PropMeta>optional</PropMeta>
 
-  - The command to build your project which is executed in the shell of your machine: `sh` for Linux and MacOS, and `cmd` for Windows. You can also use shell operators such as `&&` and `||`
+  - The command used to build your Worker. On Linux and macOS system, the command is executed in the `sh` shell and the `cmd` shell for Windows. The `&&` and `||` shell operators may be used.
 
 - `cwd` <PropMeta>optional</PropMeta>
 
-  - The working directory for commands, defaults to the project root directory
+  - The working directory for commands, defaults to the project root directory.
 
 - `watch_dir` <PropMeta>optional</PropMeta>
 
-  - The directory to watch for changes while using `wrangler dev`, defaults to "src" relative to the project root directory
+  - The directory to watch for changes while using `wrangler dev`, defaults to the `src` relative to the project root directory.
 
 </Definitions>
 
@@ -425,11 +506,11 @@ main = "./worker.mjs"
 
 - `format` <PropMeta>required</PropMeta>
 
-  - The format of the Workers script, must be `"modules"`
+  - The format of the Workers script, must be `"modules"`.
 
 - `dir` <PropMeta>optional</PropMeta>
 
-  - The directory you wish to upload your modules from, defaults to "dist" relative to the project root directory
+  - The directory you wish to upload your modules from, defaults to the `dist` relative to the project root directory.
 
 - `main` <PropMeta>required</PropMeta>
 
@@ -444,7 +525,7 @@ main = "./worker.mjs"
 - `rules` <PropMeta>optional</PropMeta>
 
   - An ordered list of rules that define which modules to import, and what type to import them as.
-    You'll need to specify rules to use Text, Data, and CompiledWasm modules, or when you wish to
+    You will need to specify rules to use Text, Data, and CompiledWasm modules, or when you wish to
     have a `.js` file be treated as an `ESModule` instead of `CommonJS`.
 
   - Defaults:
@@ -454,7 +535,7 @@ main = "./worker.mjs"
     format = "modules"
     main = "./worker.mjs"
 
-    # You don't need to include these default rules in your `wrangler.toml`, they are implicit.
+    # You do not need to include these default rules in your `wrangler.toml`, they are implicit.
     # The default rules are treated as the last two rules in the list.
 
     [[build.upload.rules]]
@@ -500,7 +581,7 @@ main = "./worker.mjs"
 
 ## Example
 
-To illustrate how these levels are applied, here is a wrangler.toml using multiple environments:
+To illustrate how these levels are applied, here is a `wrangler.toml` file using multiple environments:
 
 ```toml
 ---
@@ -520,7 +601,8 @@ kv_namespaces = [
 
 [build]
 command = "webpack"
-upload.format = "service-worker"
+[build.upload]
+format = "service-worker"
 
 [site]
 bucket = "./public"
@@ -549,9 +631,3 @@ kv_namespaces = [
   { binding = "BAR", id = "0d8c101e168d03c65bddf4ba75150f33" }
 ]
 ```
-
-<Aside>
-
-**Note:** Global user was configured with the `wrangler login`, `wrangler config`, or environment variables.
-
-</Aside>
diff --git a/products/workers/src/content/cli-wrangler/index.md b/products/workers/src/content/cli-wrangler/index.md
index d5ed02cbb7c..20d5dd6b41b 100644
--- a/products/workers/src/content/cli-wrangler/index.md
+++ b/products/workers/src/content/cli-wrangler/index.md
@@ -1,6 +1,7 @@
 ---
 title: CLI (Wrangler)
 order: 7
+pcx-content-type: navigation
 ---
 
 # Command-line (Wrangler)
diff --git a/products/workers/src/content/cli-wrangler/install-update.md b/products/workers/src/content/cli-wrangler/install-update.md
index bf11e74289b..dacc70fbd5f 100644
--- a/products/workers/src/content/cli-wrangler/install-update.md
+++ b/products/workers/src/content/cli-wrangler/install-update.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # Install / Update
@@ -26,7 +27,7 @@ Wrangler can be installed both through [npm](https://www.npmjs.com/get-npm) and
 
 ### Using `npm`
 
-1. If you don’t already have npm on your machine, install it using [npm’s instructions](https://www.npmjs.com/get-npm) — we recommend using a Node version manager like [`nvm`](https://github.com/nvm-sh/nvm#installing-and-updating).
+1. If you don’t already have npm on your machine, install it using [npm’s instructions](https://www.npmjs.com/get-npm) — we recommend using a Node version manager like [`nvm`](https://github.com/nvm-sh/nvm#installing-and-updating) or [Volta](https://volta.sh/).
 
     If you have already installed npm with a package manager, it is possible you will run into an `EACCES` error while installing wrangler. This is related to how many system packagers install npm. You can either uninstall npm and reinstall using the npm recommended install method (a version manager), or use one of our other install methods.
 
@@ -47,6 +48,8 @@ Wrangler can be installed both through [npm](https://www.npmjs.com/get-npm) and
     ```
 
     Additional installation methods are available [on the Rust site](https://forge.rust-lang.org/other-installation-methods.html).
+    
+    Windows users will need to install Perl as a dependency for `openssl-sys`. We recommmend [Strawberry Perl](https://www.perl.org/get.html).
 
 2. Install `wrangler`:
 
@@ -73,7 +76,7 @@ To update [Wrangler](https://github.com/cloudflare/wrangler), follow the below i
 **Updating Wrangler with NPM:**
 
 ```sh
-$ npm uninstall -g @cloudflare/wrangler && npm install -g @cloudflare/wrangler
+$ npm update -g @cloudflare/wrangler
 ```
 
 **Updating Wrangler with Cargo:**
diff --git a/products/workers/src/content/cli-wrangler/webpack.md b/products/workers/src/content/cli-wrangler/webpack.md
index c6089ade2cc..5222cf69a8d 100644
--- a/products/workers/src/content/cli-wrangler/webpack.md
+++ b/products/workers/src/content/cli-wrangler/webpack.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: configuration
 ---
 
 # Webpack
@@ -9,7 +10,7 @@ Out of the box, Wrangler allows you to develop modern ES6 applications with supp
 
 <Aside>
 
-Wrangler's built-in webpack build only supports webpack 4. If you want to use webpack 5, or another bundler like ESBuild or Rollup, you'll want to setup [custom builds](configuration#build) in your `wrangler.toml`.
+Wrangler's built-in webpack build only supports webpack 4. If you want to use webpack 5, or another bundler like ESBuild or Rollup, you'll want to setup [custom builds](/cli-wrangler/configuration#build) in your `wrangler.toml`.
 
 </Aside>
 
diff --git a/products/workers/src/content/components/content-table.js b/products/workers/src/content/components/content-table.js
index cdc588a3648..9efd7e7f456 100644
--- a/products/workers/src/content/components/content-table.js
+++ b/products/workers/src/content/components/content-table.js
@@ -23,7 +23,7 @@ const DocsTutorials = () => {
             frontmatter {
               title
               updated
-              type
+              content_type
               url
             }
             headings(depth: h1) {
@@ -45,7 +45,7 @@ const DocsTutorials = () => {
       title: getPageTitle(page),
       url: page.frontmatter.url || page.fields.slug,
       updated: page.frontmatter.updated,
-      type: page.frontmatter.type,
+      content_type: page.frontmatter.content_type,
       wordCount: page.wordCount.words,
       new: (+new Date() - +new Date(page.frontmatter.updated)) < tenDaysInMS
     }))
@@ -98,7 +98,7 @@ const DocsTutorials = () => {
                 </React.Fragment>
               )} minPeriod={60} />
             </div>
-            <div className="DocsTutorials--column" data-column="type">{tutorial.type}</div>
+            <div className="DocsTutorials--column" data-column="type">{tutorial.content_type}</div>
             <div className="DocsTutorials--column" data-column="length">
               <div className="DocsTutorials--length-bar">
                 <div className="DocsTutorials--length-bar-inner" style={{ width: tutorial.length }}></div>
diff --git a/products/workers/src/content/examples/ab-testing.md b/products/workers/src/content/examples/ab-testing.md
index 0f490ad4623..09ba01407db 100644
--- a/products/workers/src/content/examples/ab-testing.md
+++ b/products/workers/src/content/examples/ab-testing.md
@@ -3,8 +3,8 @@ order: 1000
 type: example
 summary: Set up an A/B test by controlling what response is served based on cookies.
 tags:
-  - JAMstack
   - Originless
+pcx-content-type: configuration
 ---
 
 # A/B testing
diff --git a/products/workers/src/content/examples/accessing-the-cloudflare-object.md b/products/workers/src/content/examples/accessing-the-cloudflare-object.md
index 3ad51b00688..4afb744ed05 100644
--- a/products/workers/src/content/examples/accessing-the-cloudflare-object.md
+++ b/products/workers/src/content/examples/accessing-the-cloudflare-object.md
@@ -4,12 +4,11 @@ type: example
 summary: Access custom Cloudflare properties and control how Cloudflare features are applied to every request.
 demo: https://accessing-the-cloudflare-object.workers-sites-examples.workers.dev
 tags:
-  - API
-  - JSON
   - Originless
+pcx-content-type: configuration
 ---
 
-# Accessing the Cloudflare object
+# Accessing the `cf` object
 
 <ContentColumn>
   <p>{props.frontmatter.summary}</p>
diff --git a/products/workers/src/content/examples/aggregate-requests.md b/products/workers/src/content/examples/aggregate-requests.md
index 41da46a13e1..b5638742594 100644
--- a/products/workers/src/content/examples/aggregate-requests.md
+++ b/products/workers/src/content/examples/aggregate-requests.md
@@ -3,8 +3,8 @@ order: 1000
 type: example
 summary: Send two GET request to two urls and aggregates the responses into one response.
 tags:
-  - JSON
-  - HTML
+  - Originless
+pcx-content-type: configuration
 ---
 
 # Aggregate requests
@@ -36,13 +36,13 @@ async function gatherResponse(response) {
     return JSON.stringify(await response.json())
   }
   else if (contentType.includes("application/text")) {
-    return await response.text()
+    return response.text()
   }
   else if (contentType.includes("text/html")) {
-    return await response.text()
+    return response.text()
   }
   else {
-    return await response.text()
+    return response.text()
   }
 }
 
diff --git a/products/workers/src/content/examples/alter-headers.md b/products/workers/src/content/examples/alter-headers.md
index 3d72ec91700..b884de14ff2 100644
--- a/products/workers/src/content/examples/alter-headers.md
+++ b/products/workers/src/content/examples/alter-headers.md
@@ -3,7 +3,9 @@ order: 1000
 type: example
 summary: Change the headers sent in a request or returned in a response.
 tags:
-  - Security
+  - Headers
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Alter headers
@@ -13,22 +15,28 @@ tags:
 </ContentColumn>
 
 ```js
-async function handleRequest(request) {
-  // Make the headers mutable by re-constructing the Request.
-  request = new Request(request)
-  request.headers.set("x-my-header", "custom value")
-  const URL = "https://examples.cloudflareworkers.com/demos/static/html"
-
-  // URL is set up to respond with dummy HTML
-  let response = await fetch(URL, request)
-
-  // Make the headers mutable by re-constructing the Response.
-  response = new Response(response.body, response)
-  response.headers.set("x-my-header", "custom value")
-  return response
-}
-
-addEventListener("fetch", event => {
+addEventListener('fetch', event => {
   event.respondWith(handleRequest(event.request))
 })
+
+async function handleRequest(request) {
+  const response = await fetch(request)
+  
+  // Clone the response so that it's no longer immutable
+  const newResponse = new Response(response.body, response)
+  
+  // Add a custom header with a value
+  newResponse.headers.append("x-workers-hello", "Hello from Cloudflare Workers")
+  
+  // Delete headers
+  newResponse.headers.delete("x-header-to-delete")
+  newResponse.headers.delete("x-header2-to-delete")
+  
+  // Adjust the value for an existing header
+  newResponse.headers.set("x-header-to-change", "NewValue")
+  
+  return newResponse
+}
 ```
+
+You can also use the [`custom-headers-example` template](https://github.com/signalnerve/custom-headers-example) to deploy this code to your custom domain.
diff --git a/products/workers/src/content/examples/auth-with-headers.md b/products/workers/src/content/examples/auth-with-headers.md
index 5af73ba49a8..3c2d3a76b12 100644
--- a/products/workers/src/content/examples/auth-with-headers.md
+++ b/products/workers/src/content/examples/auth-with-headers.md
@@ -3,7 +3,9 @@ order: 1000
 type: example
 summary: Allow or deny a request based on a known pre-shared key in a header. This is not meant to replace the WebCrypto API.
 tags:
-  - Security
+  - Authentication
+  - WebCrypto
+pcx-content-type: configuration
 ---
 
 # Auth with headers
diff --git a/products/workers/src/content/examples/basic-auth.md b/products/workers/src/content/examples/basic-auth.md
new file mode 100644
index 00000000000..19ccd08a6ae
--- /dev/null
+++ b/products/workers/src/content/examples/basic-auth.md
@@ -0,0 +1,172 @@
+---
+order: 1000
+type: example
+summary: Shows how to restrict access using the HTTP "Basic" schema.
+tags:
+  - Security
+  - Originless
+  - Authentication
+pcx-content-type: configuration
+---
+
+# HTTP "Basic" Authentication
+
+<ContentColumn>
+  <p>{props.frontmatter.summary}</p>
+</ContentColumn>
+
+```js
+/**
+ * Shows how to restrict access using the HTTP "Basic" schema.
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication
+ * @see https://tools.ietf.org/html/rfc7617
+ *
+ * A user-id containing a colon (":") character is invalid, as the
+ * first colon in a user-pass string separates user and password.
+ */
+const BASIC_USER = 'admin'
+const BASIC_PASS = 'admin'
+
+/**
+ * Receives a HTTP request and replies with a response.
+ * @param {Request} request
+ * @returns {Promise<Response>}
+ */
+async function handleRequest(request) {
+  const { protocol, pathname } = new URL(request.url)
+
+  // In the case of a "Basic" authentication, the exchange 
+  // MUST happen over an HTTPS (TLS) connection to be secure.
+  if ('https:' !== protocol || 'https' !== request.headers.get('x-forwarded-proto')) {
+    throw new BadRequestException('Please use a HTTPS connection.')
+  }
+
+  switch (pathname) {
+    case '/':
+      return new Response('Anyone can access the homepage.')
+
+    case '/logout':
+      // Invalidate the "Authorization" header by returning a HTTP 401.
+      // We do not send a "WWW-Authenticate" header, as this would trigger
+      // a popup in the browser, immediately asking for credentials again.
+      return new Response('Logged out.', { status: 401 })
+
+    case '/admin': {
+      // The "Authorization" header is sent when authenticated.
+      if (request.headers.has('Authorization')) {
+        // Throws exception when authorization fails.
+        const { user, pass } = basicAuthentication(request)
+        verifyCredentials(user, pass)
+
+        // Only returns this response when no exception is thrown.
+        return new Response('You have private access.', {
+          status: 200,
+          headers: {
+            'Cache-Control': 'no-store'
+          }
+        })
+      }
+
+      // Not authenticated.
+      return new Response('You need to login.', {
+        status: 401,
+        headers: {
+          // Prompts the user for credentials.
+          'WWW-Authenticate': 'Basic realm="my scope", charset="UTF-8"'
+        }
+      })
+    }
+
+    case '/favicon.ico':
+    case '/robots.txt':
+      return new Response(null, { status: 204 })
+  }
+
+  return new Response('Not Found.', { status: 404 })
+}
+
+/**
+ * Throws exception on verification failure.
+ * @param {string} user
+ * @param {string} pass
+ * @throws {UnauthorizedException}
+ */
+function verifyCredentials(user, pass) {
+  if (BASIC_USER !== user) {
+    throw new UnauthorizedException('Invalid username.')
+  }
+
+  if (BASIC_PASS !== pass) {
+    throw new UnauthorizedException('Invalid password.')
+  }
+}
+
+/**
+ * Parse HTTP Basic Authorization value.
+ * @param {Request} request
+ * @throws {BadRequestException}
+ * @returns {{ user: string, pass: string }}
+ */
+function basicAuthentication(request) {
+  const Authorization = request.headers.get('Authorization')
+
+  const [scheme, encoded] = Authorization.split(' ')
+
+  // The Authorization header must start with "Basic", followed by a space.
+  if (!encoded || scheme !== 'Basic') {
+    throw new BadRequestException('Malformed authorization header.')
+  }
+
+  // Decodes the base64 value and performs unicode normalization.
+  // @see https://datatracker.ietf.org/doc/html/rfc7613#section-3.3.2 (and #section-4.2.2)
+  // @see https://dev.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
+  const decoded = atob(encoded).normalize()
+  
+  // The username & password are split by the first colon.
+  //=> example: "username:password"
+  const index = decoded.indexOf(':')
+
+  // The user & password are split by the first colon and MUST NOT contain control characters.
+  // @see https://tools.ietf.org/html/rfc5234#appendix-B.1 (=> "CTL = %x00-1F / %x7F")
+  if (index === -1 || /[\0-\x1F\x7F]/.test(decoded)) {
+    throw new BadRequestException('Invalid authorization value.')
+  }
+  
+  return { 
+    user: decoded.substring(0, index),
+    pass: decoded.substring(index + 1),
+  }
+}
+
+function UnauthorizedException(reason) {
+  this.status = 401
+  this.statusText = 'Unauthorized'
+  this.reason = reason
+}
+
+function BadRequestException(reason) {
+  this.status = 400
+  this.statusText = 'Bad Request'
+  this.reason = reason
+}
+
+addEventListener('fetch', event => {
+  event.respondWith(
+    handleRequest(event.request).catch(err => {
+      const message = err.reason || err.stack || 'Unknown Error'
+
+      return new Response(message, {
+        status: err.status || 500,
+        statusText: err.statusText || null,
+        headers: {
+          'Content-Type': 'text/plain;charset=UTF-8',
+          // Disables caching by default.
+          'Cache-Control': 'no-store',
+          // Returns the "Content-Length" header for HTTP HEAD requests.
+          'Content-Length': message.length,
+        }
+      })
+    })
+  )
+})
+```
diff --git a/products/workers/src/content/examples/block-on-tls.md b/products/workers/src/content/examples/block-on-tls.md
index 87d763ce41d..750056fdc74 100644
--- a/products/workers/src/content/examples/block-on-tls.md
+++ b/products/workers/src/content/examples/block-on-tls.md
@@ -3,8 +3,9 @@ order: 1000
 type: example
 summary: Inspects the incoming request's TLS version and blocks if under TLSv1.2.
 tags:
-  - Originless
   - Security
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Block on TLS
diff --git a/products/workers/src/content/examples/bulk-origin-proxy.md b/products/workers/src/content/examples/bulk-origin-proxy.md
index 40d3e14df54..ff648ecc228 100644
--- a/products/workers/src/content/examples/bulk-origin-proxy.md
+++ b/products/workers/src/content/examples/bulk-origin-proxy.md
@@ -3,10 +3,11 @@ order: 1000
 type: example
 summary: Resolve requests to your domain to a set of proxy third-party origin URLs.
 tags:
-  - Proxy
+  - Middleware
+pcx-content-type: configuration
 ---
 
-# Bulk origin proxy
+# Bulk origin override
 
 <ContentColumn>
   <p>{props.frontmatter.summary}</p>
@@ -22,18 +23,18 @@ const ORIGINS = {
   "google.yourdomain.com": "www.google.com",
 }
 
-async function handleRequest(request) {
+function handleRequest(request) {
   const url = new URL(request.url)
   // Check if incoming hostname is a key in the ORIGINS object
   if (url.hostname in ORIGINS) {
     const target = ORIGINS[url.hostname]
     url.hostname = target
     // If it is, proxy request to that third party origin
-    return await fetch(url.toString(), request)
+    return fetch(url.toString(), request)
   }
 
   // Otherwise, process request as normal
-  return await fetch(request)
+  return fetch(request)
 }
 
 addEventListener("fetch", event => {
diff --git a/products/workers/src/content/examples/bulk-redirects.md b/products/workers/src/content/examples/bulk-redirects.md
index 825487bb152..92273dd0f6b 100644
--- a/products/workers/src/content/examples/bulk-redirects.md
+++ b/products/workers/src/content/examples/bulk-redirects.md
@@ -3,8 +3,8 @@ order: 1000
 type: example
 summary: Redirect requests to certain URLs based on a mapped object to the request's URL.
 tags:
-  - Security
-  - Proxy
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Bulk redirects
diff --git a/products/workers/src/content/examples/cache-api.md b/products/workers/src/content/examples/cache-api.md
index 6f1b9803a5b..fa6f23258b6 100644
--- a/products/workers/src/content/examples/cache-api.md
+++ b/products/workers/src/content/examples/cache-api.md
@@ -3,9 +3,10 @@ order: 1000
 type: example
 summary: Use the Cache API to store responses in Cloudflare's cache.
 tags:
-  - API
+  - Cache API
   - Middleware
   - Caching
+pcx-content-type: configuration
 ---
 
 # Using the Cache API
diff --git a/products/workers/src/content/examples/cache-post-request.md b/products/workers/src/content/examples/cache-post-request.md
index 6eb03cc9402..ceebbd3bb1e 100644
--- a/products/workers/src/content/examples/cache-post-request.md
+++ b/products/workers/src/content/examples/cache-post-request.md
@@ -5,6 +5,8 @@ summary: Cache POST requests using the Cache API.
 tags:
   - Middleware
   - Caching
+  - Cache API
+pcx-content-type: configuration
 ---
 
 # Cache POST requests
diff --git a/products/workers/src/content/examples/cache-using-fetch.md b/products/workers/src/content/examples/cache-using-fetch.md
index 2e3a0229b63..68406b47d00 100644
--- a/products/workers/src/content/examples/cache-using-fetch.md
+++ b/products/workers/src/content/examples/cache-using-fetch.md
@@ -3,8 +3,10 @@ order: 1000
 type: example
 summary: Determine how to cache a resource by setting TTLs, custom cache keys, and cache headers in a fetch request.
 tags:
-  - API
-  - JAMstack
+  - Caching
+  - Cache API
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Cache using fetch
diff --git a/products/workers/src/content/examples/conditional-response.md b/products/workers/src/content/examples/conditional-response.md
index e3a87c79b5f..3893054e20a 100644
--- a/products/workers/src/content/examples/conditional-response.md
+++ b/products/workers/src/content/examples/conditional-response.md
@@ -3,8 +3,8 @@ order: 1000
 type: example
 summary: Return a response based on the incoming request's URL, HTTP method, User Agent, IP address, ASN or device type.
 tags:
-  - Security
-  - Originless
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Conditional response
diff --git a/products/workers/src/content/examples/cors-header-proxy.md b/products/workers/src/content/examples/cors-header-proxy.md
index e4d56597b9a..c1929ddc6b6 100644
--- a/products/workers/src/content/examples/cors-header-proxy.md
+++ b/products/workers/src/content/examples/cors-header-proxy.md
@@ -3,9 +3,9 @@ order: 1000
 type: example
 summary: Add the necessary CORS headers to a third party API response.
 tags:
-  - Originless
   - Security
-  - API
+  - Headers
+pcx-content-type: configuration
 ---
 
 # CORS header proxy
@@ -33,7 +33,7 @@ const API_URL = "https://examples.cloudflareworkers.com/demos/demoapi"
 const PROXY_ENDPOINT = "/corsproxy/"
 
 // The rest of this snippet for the demo page
-async function rawHtmlResponse(html) {
+function rawHtmlResponse(html) {
   return new Response(html, {
     headers: {
       "content-type": "text/html;charset=UTF-8",
@@ -57,26 +57,25 @@ const DEMO_PAGE = `
     <code id="proxypreflight">Waiting</code>
     <script>
     let reqs = {};
-    reqs.noproxy = async () => {
-      let response = await fetch("${API_URL}")
-      return await response.json()
+    reqs.noproxy = () => {
+      return fetch("${API_URL}").then(r => r.json())
     }
     reqs.proxy = async () => {
-      let response = await fetch(window.location.origin + "${PROXY_ENDPOINT}?apiurl=${API_URL}")
-      return await response.json()
+      let href = "${PROXY_ENDPOINT}?apiurl=${API_URL}"
+      return fetch(window.location.origin + href).then(r => r.json())
     }
     reqs.proxypreflight = async () => {
-      const reqBody = {
-        msg: "Hello world!"
-      }
-      let response = await fetch(window.location.origin + "${PROXY_ENDPOINT}?apiurl=${API_URL}", {
+      let href = "${PROXY_ENDPOINT}?apiurl=${API_URL}"
+      let response = await fetch(window.location.origin + href, {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
         },
-        body: JSON.stringify(reqBody),
+        body: JSON.stringify({
+          msg: "Hello world!"
+        })
       })
-      return await response.json()
+      return response.json()
     }
     (async () => {
       for (const [reqName, req] of Object.entries(reqs)) {
diff --git a/products/workers/src/content/examples/country-code-redirect.md b/products/workers/src/content/examples/country-code-redirect.md
index b80e33051d6..c4b6ac444c8 100644
--- a/products/workers/src/content/examples/country-code-redirect.md
+++ b/products/workers/src/content/examples/country-code-redirect.md
@@ -3,8 +3,8 @@ order: 1000
 type: example
 summary: Redirect a response based on the country code in the header of a visitor.
 tags:
-  - Security
   - Originless
+pcx-content-type: configuration
 ---
 
 # Country code redirect
@@ -14,11 +14,20 @@ tags:
 </ContentColumn>
 
 ```js
+/**
+ * A map of the URLs to redirect to
+ * @param {Object} countryMap
+ */
+const countryMap = {
+  US: "https://example.com/us",
+  EU: "https://eu.example.com/",
+}
+
 /**
  * Returns a redirect determined by the country code
  * @param {Request} request
  */
-async function redirect(request) {
+function redirect(request) {
   // Use the cf object to obtain the country of the request
   // more on the cf object: https://developers.cloudflare.com/workers/runtime-apis/request#incomingrequestcfproperties
   const country = request.cf.country
@@ -26,26 +35,12 @@ async function redirect(request) {
   if (country != null && country in countryMap) {
     const url = countryMap[country]
     return Response.redirect(url)
+  } else {
+    return fetch(request)
   }
-  else {
-    return await fetch(request)
-  }
-}
-
-/**
- * A map of the URLs to redirect to
- * @param {Object} countryMap
- */
-const countryMap = {
-  US: "https://example.com/us",
-  EU: "https://eu.example.com/",
-}
-
-async function handleRequest(request) {
-  return redirect(request)
 }
 
 addEventListener("fetch", event => {
-  event.respondWith(handleRequest(event.request))
+  event.respondWith(redirect(event.request))
 })
 ```
diff --git a/products/workers/src/content/examples/cron-trigger.md b/products/workers/src/content/examples/cron-trigger.md
new file mode 100644
index 00000000000..1814bb9ba60
--- /dev/null
+++ b/products/workers/src/content/examples/cron-trigger.md
@@ -0,0 +1,45 @@
+---
+order: 1000
+type: example
+summary: Set a Cron Trigger for your Worker.
+tags:
+  - Middleware
+pcx-content-type: configuration
+---
+
+# Cron Triggers
+
+<ContentColumn>
+  <p>{props.frontmatter.summary}</p>
+</ContentColumn>
+
+```js
+addEventListener('scheduled', event => {
+    event.waitUntil(triggerEvent(event.scheduledTime))
+})
+
+async function triggerEvent(scheduledTime) {
+    // Fetch some data
+    // Update API
+    console.log("cron processed")
+}
+```
+
+## Setting Cron Triggers in Wrangler
+If you are deploying with Wrangler, set the cron syntax (once per hour as shown below) by adding this to your `wrangler.toml` file:
+
+```toml
+name = "worker"
+
+# ...
+
+[triggers]
+crons = ["0 * * * *"] 
+```
+
+You also can set a different Cron Trigger for each environment in your `wrangler.toml`. You need to put the `[triggers]` table under your chosen environment. For example:
+
+```toml
+[env.dev.triggers]
+crons = ["0 * * * *"]
+```
diff --git a/products/workers/src/content/examples/data-loss-prevention.md b/products/workers/src/content/examples/data-loss-prevention.md
index 48a63a9962f..48f320f4998 100644
--- a/products/workers/src/content/examples/data-loss-prevention.md
+++ b/products/workers/src/content/examples/data-loss-prevention.md
@@ -4,6 +4,7 @@ type: example
 summary: Protect sensitive data to prevent data loss, and send alerts to a webhooks server in the event of a data breach.
 tags:
   - Security
+pcx-content-type: configuration
 ---
 
 # Data loss prevention
@@ -19,22 +20,19 @@ const SOME_HOOK_SERVER = "https://webhook.flow-wolf.io/hook"
 /**
  * Alert a data breach by posting to a webhook server
  */
-async function postDataBreach(request) {
-  const trueClientIp = request.headers.get("cf-connecting-ip")
-  const epoch = new Date().getTime()
-  const body = {
-    ip: trueClientIp,
-    time: epoch,
-    request: request
-  }
-  const init = {
-    body: JSON.stringify(body),
+function postDataBreach(request) {
+  return fetch(SOME_HOOK_SERVER, {
     method: "POST",
+    body: JSON.stringify(body),
     headers: {
       "content-type": "application/json;charset=UTF-8"
     },
-  }
-  return await fetch(SOME_HOOK_SERVER, init)
+    body: JSON.stringify({
+      ip: request.headers.get("cf-connecting-ip"),
+      time: Date.now(),
+      request: request
+    })
+  })
 }
 
 /**
diff --git a/products/workers/src/content/examples/debugging-logs.md b/products/workers/src/content/examples/debugging-logs.md
index 2ee880862ba..3b3e8a291b1 100644
--- a/products/workers/src/content/examples/debugging-logs.md
+++ b/products/workers/src/content/examples/debugging-logs.md
@@ -3,10 +3,9 @@ order: 1000
 type: example
 summary: Send debugging information in an errored response to a logging service.
 tags:
-  - API
-  - JSON
-  - Middleware
-  - Originless
+  - Debugging
+  - Logging
+pcx-content-type: configuration
 ---
 
 # Debugging logs
diff --git a/products/workers/src/content/examples/extract-cookie-value.md b/products/workers/src/content/examples/extract-cookie-value.md
index 57b734c41e2..17aac81b3e8 100644
--- a/products/workers/src/content/examples/extract-cookie-value.md
+++ b/products/workers/src/content/examples/extract-cookie-value.md
@@ -3,48 +3,32 @@ order: 1000
 type: example
 summary: Given the cookie name, get the value of a cookie. You can also use cookies for A/B testing.
 tags:
-  - Security
-  - JAMstack
-  - Originless
+  - Headers
+pcx-content-type: configuration
 ---
 
-# Extract cookie value
+# Cookie parsing
 
 <ContentColumn>
   <p>{props.frontmatter.summary}</p>
 </ContentColumn>
 
 ```js
-const COOKIE_NAME = "__uid"
+import { parse } from "cookie"
+// OR
+import { parse } from "worktop/cookie"
 
-/**
- * Gets the cookie with the name from the request headers
- * @param {Request} request incoming Request
- * @param {string} name of the cookie to get
- */
-function getCookie(request, name) {
-  let result = ""
-  const cookieString = request.headers.get("Cookie")
-  if (cookieString) {
-    const cookies = cookieString.split(";")
-    cookies.forEach(cookie => {
-      const cookiePair = cookie.split("=", 2)
-      const cookieName = cookiePair[0].trim()
-      if (cookieName === name) {
-        const cookieVal = cookiePair[1]
-        result = cookieVal
-      }
-    })
-  }
-  return result
-}
+// The name of the cookie
+const COOKIE_NAME = "__uid"
 
 function handleRequest(request) {
-  const cookie = getCookie(request, COOKIE_NAME)
-  if (cookie) {
+  const cookie = parse(request.headers.get("Cookie") || "")
+
+  if (cookie[COOKIE_NAME] != null) {
     // Respond with the cookie value
-    return new Response(cookie)
+    return new Response(cookie[COOKIE_NAME])
   }
+
   return new Response("No cookie with name: " + COOKIE_NAME)
 }
 
@@ -52,3 +36,9 @@ addEventListener("fetch", event => {
   event.respondWith(handleRequest(event.request))
 })
 ```
+
+<Aside type="note" header="External Dependencies">
+
+This example is set up to depend on [`cookie@0.4.1`](https://www.npmjs.com/package/cookie/v/0.4.1) or [`worktop@0.7.1`](https://www.npmjs.com/package/worktop/v/0.7.1). You may pick either package, as they both work the same way.
+
+</Aside>
diff --git a/products/workers/src/content/examples/fetch-html.md b/products/workers/src/content/examples/fetch-html.md
index 5259887b8fc..93c6a71d84b 100644
--- a/products/workers/src/content/examples/fetch-html.md
+++ b/products/workers/src/content/examples/fetch-html.md
@@ -3,8 +3,8 @@ order: 2
 type: example
 summary: Send a request to a remote server, read HTML from the response, and serve that HTML.
 tags:
-  - JSON
-  - API
+  - Originless
+pcx-content-type: configuration
 ---
 
 # Fetch HTML
@@ -33,13 +33,13 @@ async function gatherResponse(response) {
     return JSON.stringify(await response.json())
   }
   else if (contentType.includes("application/text")) {
-    return await response.text()
+    return response.text()
   }
   else if (contentType.includes("text/html")) {
-    return await response.text()
+    return response.text()
   }
   else {
-    return await response.text()
+    return response.text()
   }
 }
 
diff --git a/products/workers/src/content/examples/fetch-json.md b/products/workers/src/content/examples/fetch-json.md
index a48a82a72f9..4a427edecc6 100644
--- a/products/workers/src/content/examples/fetch-json.md
+++ b/products/workers/src/content/examples/fetch-json.md
@@ -3,8 +3,8 @@ order: 3
 type: example
 summary: Send a GET request and read in JSON from the response. Use to fetch external data.
 tags:
-  - JSON
-  - API
+  - Originless
+pcx-content-type: configuration
 ---
 
 # Fetch JSON
@@ -35,13 +35,13 @@ async function gatherResponse(response) {
     return JSON.stringify(await response.json())
   }
   else if (contentType.includes("application/text")) {
-    return await response.text()
+    return response.text()
   }
   else if (contentType.includes("text/html")) {
-    return await response.text()
+    return response.text()
   }
   else {
-    return await response.text()
+    return response.text()
   }
 }
 
diff --git a/products/workers/src/content/examples/geolocation-app-weather.md b/products/workers/src/content/examples/geolocation-app-weather.md
index c69bdb29ed4..745d52282f7 100644
--- a/products/workers/src/content/examples/geolocation-app-weather.md
+++ b/products/workers/src/content/examples/geolocation-app-weather.md
@@ -3,8 +3,9 @@ order: 1000
 type: example
 summary: Fetch weather data from an API using the user's geolocation data.
 tags:
-  - HTML
+  - Originless
   - Geolocation
+pcx-content-type: configuration
 ---
 
 # Geolocation: Weather App
diff --git a/products/workers/src/content/examples/geolocation-custom-styling.md b/products/workers/src/content/examples/geolocation-custom-styling.md
index 81d7965c0db..4bcdb81a387 100644
--- a/products/workers/src/content/examples/geolocation-custom-styling.md
+++ b/products/workers/src/content/examples/geolocation-custom-styling.md
@@ -3,8 +3,9 @@ order: 1000
 type: example
 summary: Personalize website styling based on localized user time.
 tags:
-  - HTML
+  - Originless
   - Geolocation
+pcx-content-type: configuration
 ---
 
 # Geolocation: Custom Styling
diff --git a/products/workers/src/content/examples/geolocation-hello-world.md b/products/workers/src/content/examples/geolocation-hello-world.md
index a7a33433f46..16009441537 100644
--- a/products/workers/src/content/examples/geolocation-hello-world.md
+++ b/products/workers/src/content/examples/geolocation-hello-world.md
@@ -3,8 +3,9 @@ order: 1000
 type: example
 summary: Get all geolocation data fields and display them in HTML.
 tags:
-  - HTML
+  - Originless
   - Geolocation
+pcx-content-type: configuration
 ---
 
 # Geolocation: Hello World
diff --git a/products/workers/src/content/examples/hot-link-protection.md b/products/workers/src/content/examples/hot-link-protection.md
index 3038ffa4746..cf4d5e8d315 100644
--- a/products/workers/src/content/examples/hot-link-protection.md
+++ b/products/workers/src/content/examples/hot-link-protection.md
@@ -4,7 +4,8 @@ type: example
 summary: Block other websites from linking to your content. This is useful for protecting images.
 tags:
   - Security
-  - JAMstack
+  - Headers
+pcx-content-type: configuration
 ---
 
 # Hot-link protection
diff --git a/products/workers/src/content/examples/http2-server-push.md b/products/workers/src/content/examples/http2-server-push.md
index aaf6daf46c5..c237b99c0ab 100644
--- a/products/workers/src/content/examples/http2-server-push.md
+++ b/products/workers/src/content/examples/http2-server-push.md
@@ -3,9 +3,9 @@ order: 1000
 type: example
 summary: Push static assets to a client's browser without waiting for HTML to render.
 tags:
-  - Originless
-  - JAMstack
-  - HTML
+  - Middleware
+  - Headers
+pcx-content-type: configuration
 ---
 
 # HTTP2 server push
diff --git a/products/workers/src/content/examples/index.md b/products/workers/src/content/examples/index.md
index 7072287ce25..ff8abc12fb8 100644
--- a/products/workers/src/content/examples/index.md
+++ b/products/workers/src/content/examples/index.md
@@ -2,6 +2,7 @@
 type: overview
 hideChildren: true
 order: 2
+pcx-content-type: navigation
 ---
 
 import DocsCodeExamplesOverview from "../../components/docs-code-examples-overview"
diff --git a/products/workers/src/content/examples/logging-headers.md b/products/workers/src/content/examples/logging-headers.md
index 3ab80fbc232..7ccbfded23f 100644
--- a/products/workers/src/content/examples/logging-headers.md
+++ b/products/workers/src/content/examples/logging-headers.md
@@ -3,11 +3,11 @@ order: 1000
 type: example
 summary: Examine the contents of a Headers object by logging to console with a Map.
 tags:
-  - Middleware
-  - Originless
+  - Debugging
+pcx-content-type: configuration
 ---
 
-# Logging headers
+# Logging headers to console
 
 <ContentColumn>
   <p>{props.frontmatter.summary}</p>
@@ -87,7 +87,7 @@ This works because:
 
 The Map trick works great for simple calls to `console.log()`, but if we need to actually stringify our headers, we quickly find out that stringifying a Map yields nothing more than `[object Map]`, which isn’t very helpful.
 
-The JSON stringifier can’t help us, either: even though our Map stores its data in an enumerable property, that property is [Symbol](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol)-keyed, and `JSON.stringify()` [ignores Symbol-keyed properties](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#Description) — we end up with an empty `{}` again.
+The JSON stringifier can’t help us, either: even though our Map stores its data in an enumerable property, that property is [Symbol](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol)-keyed, and `JSON.stringify()` [ignores Symbol-keyed properties](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol#symbols_and_json.stringify) — we end up with an empty `{}` again.
 
 Instead, we can take advantage of the iterability of the Headers object in a new way by applying the [spread operator](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_operator) (`...`) to it.
 
diff --git a/products/workers/src/content/examples/modify-request-property.md b/products/workers/src/content/examples/modify-request-property.md
index 3c568b25213..d011189e89b 100644
--- a/products/workers/src/content/examples/modify-request-property.md
+++ b/products/workers/src/content/examples/modify-request-property.md
@@ -3,9 +3,9 @@ order: 1000
 type: example
 summary: Create a modified request with edited properties based off of an incoming request.
 tags:
-  - Originless
-  - API
-  - JSON
+  - Middleware
+  - Headers
+pcx-content-type: configuration
 ---
 
 # Modify request property
diff --git a/products/workers/src/content/examples/modify-response.md b/products/workers/src/content/examples/modify-response.md
index 8c108fef451..2b359d3f076 100644
--- a/products/workers/src/content/examples/modify-response.md
+++ b/products/workers/src/content/examples/modify-response.md
@@ -3,9 +3,9 @@ order: 1000
 type: example
 summary: Fetch and modify response properties which are immutable by creating a copy first.
 tags:
-  - Originless
-  - API
-  - JSON
+  - Middleware
+  - Headers
+pcx-content-type: configuration
 ---
 
 # Modify response
diff --git a/products/workers/src/content/examples/post-json.md b/products/workers/src/content/examples/post-json.md
index dbdd427fa06..411deaf5109 100644
--- a/products/workers/src/content/examples/post-json.md
+++ b/products/workers/src/content/examples/post-json.md
@@ -4,8 +4,7 @@ type: example
 summary: Send a POST request with JSON data. Use to share data with external servers.
 tags:
   - Originless
-  - JSON
-  - API
+pcx-content-type: configuration
 ---
 
 # Post JSON
@@ -41,13 +40,13 @@ async function gatherResponse(response) {
     return JSON.stringify(await response.json())
   }
   else if (contentType.includes("application/text")) {
-    return await response.text()
+    return response.text()
   }
   else if (contentType.includes("text/html")) {
-    return await response.text()
+    return response.text()
   }
   else {
-    return await response.text()
+    return response.text()
   }
 }
 
diff --git a/products/workers/src/content/examples/read-post.md b/products/workers/src/content/examples/read-post.md
index 8f47ebab125..bf17743a0cf 100644
--- a/products/workers/src/content/examples/read-post.md
+++ b/products/workers/src/content/examples/read-post.md
@@ -3,9 +3,9 @@ order: 1000
 type: example
 summary: Serve an HTML form, then read POST requests. Use also to read JSON or POST data from an incoming request.
 tags:
-  - HTML
   - JSON
   - Originless
+pcx-content-type: configuration
 ---
 
 # Read POST
@@ -42,10 +42,10 @@ async function readRequestBody(request) {
     return JSON.stringify(await request.json())
   }
   else if (contentType.includes("application/text")) {
-    return await request.text()
+    return request.text()
   }
   else if (contentType.includes("text/html")) {
-    return await request.text()
+    return request.text()
   }
   else if (contentType.includes("form")) {
     const formData = await request.formData()
diff --git a/products/workers/src/content/examples/redirect.md b/products/workers/src/content/examples/redirect.md
index d48ce238be9..b7dd3ad3aae 100644
--- a/products/workers/src/content/examples/redirect.md
+++ b/products/workers/src/content/examples/redirect.md
@@ -3,8 +3,8 @@ order: 5
 type: example
 summary: Redirect requests from one URL to another, or from one set of URLs to another set.
 tags:
-  - Originless
-  - Proxy
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Redirect
diff --git a/products/workers/src/content/examples/respond-with-another-site.md b/products/workers/src/content/examples/respond-with-another-site.md
index 5332c570719..66b428d74f4 100644
--- a/products/workers/src/content/examples/respond-with-another-site.md
+++ b/products/workers/src/content/examples/respond-with-another-site.md
@@ -4,7 +4,8 @@ type: example
 summary: Respond to the Worker request with the response from another website (example.com in this example).
 demo: https://respond-with-another-site.workers-sites-examples.workers.dev
 tags:
-  - Proxy
+  - Middleware
+pcx-content-type: configuration
 ---
 
 # Respond with another site
diff --git a/products/workers/src/content/examples/return-html.md b/products/workers/src/content/examples/return-html.md
index 151526374cf..8e942f610f1 100644
--- a/products/workers/src/content/examples/return-html.md
+++ b/products/workers/src/content/examples/return-html.md
@@ -4,12 +4,11 @@ type: example
 summary: Deliver an HTML page from an HTML string directly inside the Worker script.
 demo: https://returning-html.workers-sites-examples.workers.dev
 tags:
-  - HTML
-  - JAMstack
   - Originless
+pcx-content-type: configuration
 ---
 
-# Return HTML
+# Return small HTML page
 
 <ContentColumn>
   <p>{props.frontmatter.summary}</p>
diff --git a/products/workers/src/content/examples/return-json.md b/products/workers/src/content/examples/return-json.md
index 66db7b7b29c..658514f545d 100644
--- a/products/workers/src/content/examples/return-json.md
+++ b/products/workers/src/content/examples/return-json.md
@@ -5,8 +5,8 @@ summary: Return JSON directly from a Worker script, useful for building APIs and
 demo: https://returning-json.workers-sites-examples.workers.dev
 tags:
   - JSON
-  - API
   - Originless
+pcx-content-type: configuration
 ---
 
 # Return JSON
diff --git a/products/workers/src/content/examples/rewrite-links.md b/products/workers/src/content/examples/rewrite-links.md
index da4f6d84dc2..dc12f0189a3 100644
--- a/products/workers/src/content/examples/rewrite-links.md
+++ b/products/workers/src/content/examples/rewrite-links.md
@@ -3,9 +3,8 @@ order: 1000
 type: example
 summary: Rewrite URL links in HTML using the HTMLRewriter. This is useful for JAMstack websites.
 tags:
-  - HTML
-  - JAMstack
   - HTMLRewriter
+pcx-content-type: configuration
 ---
 
 # Rewrite links
@@ -20,7 +19,15 @@ const NEW_URL = "mynewdomain.com"
 
 async function handleRequest(req) {
   const res = await fetch(req)
-  return rewriter.transform(res)
+  const contentType = res.headers.get("Content-Type")
+  
+  // If the response is HTML, it can be transformed with
+  // HTMLRewriter -- otherwise, it should pass through
+  if (contentType.startsWith("text/html")) {
+    return rewriter.transform(res)
+  } else {
+    return res
+  }
 }
 
 class AttributeRewriter {
diff --git a/products/workers/src/content/examples/security-headers.md b/products/workers/src/content/examples/security-headers.md
new file mode 100644
index 00000000000..1b8cbb243cc
--- /dev/null
+++ b/products/workers/src/content/examples/security-headers.md
@@ -0,0 +1,90 @@
+---
+order: 1000
+type: example
+summary: Set common security headers (X-XSS-Protection, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy, Strict-Transport-Security, Content-Security-Policy).
+tags:
+  - Security
+  - Middleware
+pcx-content-type: configuration
+---
+
+# Set security headers
+
+<ContentColumn>
+  <p>{props.frontmatter.summary}</p>
+</ContentColumn>
+
+```js
+const DEFAULT_SECURITY_HEADERS = {
+    /*
+    Secure your application with Content-Security-Policy headers.
+    To avoid introducing breaking changes, these headers are not automatically set. 
+    Read more here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+    */
+    /*
+    You can also set Strict-Transport-Security headers. 
+    These are not automatically set because your website might get added to Chrome's HSTS preload list.
+    Here's the code if you want to apply it:
+    "Strict-Transport-Security" : "max-age=63072000; includeSubDomains; preload",
+    */
+    /*
+    X-XSS-Protection header prevents a page from loading if an XSS attack is detected. 
+    Read more here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+    */
+    "X-XSS-Protection": "1; mode=block",
+    /*
+    X-Frame-Options header prevents click-jacking attacks. 
+    Read more here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+    */
+    "X-Frame-Options": "DENY",
+    /*
+    X-Content-Type-Options header prevents MIME-sniffing. 
+    Read more here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+    */
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "strict-origin-when-cross-origin",
+    'Cross-Origin-Embedder-Policy': 'require-corp; report-to="default";',
+    'Cross-Origin-Opener-Policy': 'same-site; report-to="default";',
+    "Cross-Origin-Resource-Policy": "same-site",
+}
+const BLOCKED_HEADERS = [
+    "Public-Key-Pins",
+    "X-Powered-By",
+    "X-AspNet-Version",
+]
+addEventListener('fetch', event => {
+    event.respondWith(addHeaders(event.request))
+})
+async function addHeaders(req) {
+    let response = await fetch(req)
+    let newHeaders = new Headers(response.headers)
+
+    const tlsVersion = req.cf.tlsVersion
+    // This sets the headers for HTML responses: 
+    if (newHeaders.has("Content-Type") && !newHeaders.get("Content-Type").includes("text/html")) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: newHeaders
+        })
+    }
+
+    Object.keys(DEFAULT_SECURITY_HEADERS).map(function (name) {
+        newHeaders.set(name, DEFAULT_SECURITY_HEADERS[name]);
+    })
+
+    BLOCKED_HEADERS.forEach(function (name) {
+        newHeaders.delete(name)
+    })
+
+    if (tlsVersion != "TLSv1.2" && tlsVersion != "TLSv1.3") {
+        return new Response("You need to use TLS version 1.2 or higher.", { status: 400 })
+    } else {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: newHeaders
+        })
+    }
+}
+```
diff --git a/products/workers/src/content/examples/signing-requests.md b/products/workers/src/content/examples/signing-requests.md
index 076246d66dc..f7967590953 100644
--- a/products/workers/src/content/examples/signing-requests.md
+++ b/products/workers/src/content/examples/signing-requests.md
@@ -4,6 +4,8 @@ type: example
 summary: Sign and verify a request using the HMAC and SHA-256 algorithms or return a 403.
 tags:
   - Security
+  - WebCrypto
+pcx-content-type: configuration
 ---
 
 # Sign requests
diff --git a/products/workers/src/content/get-started/guide.md b/products/workers/src/content/get-started/guide.md
index e217a3af42a..995790986d7 100644
--- a/products/workers/src/content/get-started/guide.md
+++ b/products/workers/src/content/get-started/guide.md
@@ -1,41 +1,49 @@
 ---
 order: 0
 title: "Guide"
+pcx-content-type: how-to
 ---
 
-# Getting Started Guide
+# Get started guide
 
-Cloudflare Workers is a **serverless application platform** running on Cloudflare’s global cloud network in over 200 cities around the world, offering both [free and paid plans](/platform/pricing).
+Cloudflare Workers is a serverless application platform running on Cloudflare’s global [cloud network](https://www.cloudflare.com/learning/serverless/glossary/what-is-edge-computing/) in over 200 cities around the world, offering both [free and paid plans](/platform/pricing).
 
 Learn more about [how Workers works](/learning/how-workers-works).
 
-<Aside header="Try the Playground">
+<Aside type ="note" header="Try the Playground">
 
-The quickest way to experiment with Cloudflare Workers is in the [Playground](https://cloudflareworkers.com/#36ebe026bf3510a2e5acace89c09829f:about:blank). It doesn’t require _any_ setup. It’s just a simple, instant way to preview and test a Workers script directly in the browser against any site.
+The quickest way to experiment with Cloudflare Workers is in the [Playground](https://cloudflareworkers.com/#36ebe026bf3510a2e5acace89c09829f:about:blank). The Playground does not require any setup. It is a simple, instant way to preview and test a Workers script directly in the browser against any site.
 
 </Aside>
 
+This guide will instruct you through setting up a Cloudflare account to deploying your first Worker script.
+
 --------------------------------
 
 ## 1. Sign up for a Workers account
 
-Before you can start [publishing](/cli-wrangler/commands#publish) your Workers on your own domain or a free workers.dev subdomain, you’ll need to sign up for a Cloudflare Workers account.
+Before you can start [publishing](/cli-wrangler/commands#publish) your Workers on your own domain or a free `*.workers.dev` subdomain, you must sign up for a Cloudflare Workers account.
 
 <p><Button type="primary" href="https://dash.cloudflare.com/sign-up/workers">Sign up</Button></p>
 
-The signup process will guide you through choosing a workers.dev subdomain and verifying your email address, both of which are required to publish.
+The signup process will guide you through choosing a `*.workers.dev` subdomain and verifying your email address, both of which are required to publish.
 
 --------------------------------
 
 ## 2. Install the Workers CLI
 
-Installing `wrangler`, the Workers CLI, gives you the freedom to [generate](/cli-wrangler/commands#generate), [configure](/cli-wrangler/commands#configure), [build](/cli-wrangler/commands#build), [preview](/cli-wrangler/commands#preview), and [publish](/cli-wrangler/commands#publish) your Workers projects from the comfort of your dev environment.
+Installing `wrangler`, the Workers CLI, gives you the freedom to [`generate`](/cli-wrangler/commands#generate), [`configure`](/cli-wrangler/commands#configure), [`build`](/cli-wrangler/commands#build), [`preview`](/cli-wrangler/commands#preview), and [`publish`](/cli-wrangler/commands#publish) your Workers projects from the comfort of your development environment.
 
-To install [`wrangler`](https://github.com/cloudflare/wrangler), ensure you have [`npm` installed](https://www.npmjs.com/get-npm), then run:
+To install [`wrangler`](https://github.com/cloudflare/wrangler), ensure you have [`npm` installed](https://www.npmjs.com/get-npm), preferably using a Node version manager like [Volta](https://volta.sh/) or [nvm](https://github.com/nvm-sh/nvm) to avoid permission issues, then run:
 
 ```sh
 $ npm install -g @cloudflare/wrangler
 ```
+or install with yarn:
+
+```sh
+$ yarn global add @cloudflare/wrangler
+```
 
 Then run `wrangler --version` to confirm that the installation was successful:
 
@@ -48,30 +56,32 @@ $ wrangler --version
 
 ## 3. Configure the Workers CLI
 
-Now that Wrangler is installed, you'll need to give it an API Token for your Cloudflare account.
+With installation complete, `wrangler` will need access to a Cloudflare API token to manage Workers resources on your behalf.
 
-Run the command `wrangler login` and Wrangler will ask to automatically open your web browser to log into your Cloudflare account. If you are in an environment that doesn't have a GUI, you can copy and paste the url into a browser and log in.
+Run the command `wrangler login`, which will automate this process.
 
-```bash
+Wrangler will attempt to automatically open your web browser to complete the login process to your Cloudflare account. If you have issues completing this step or you do not have access to a browser GUI, you can copy and paste the URL generated by `wrangler login` in your terminal into a browser and log in.
+
+```sh
 $ wrangler login
 Allow Wrangler to open a page in your browser? [y/n]
 y
 💁  Opened a link in your default browser: https://dash.cloudflare.com/wrangler?key=girjeanvioajsdn...
 ```
 
-Open the browser, log into your account, and click the `Authorize Wrangler` button. This will send an API Token to Wrangler so it can deploy your scripts to Cloudflare.
+Open the browser, log into your account, and select **Authorize Wrangler**. This will send an API Token to Wrangler so it can deploy your scripts to Cloudflare.
 
 --------------------------------
 
 ## 4. Generate a new project
 
-Wrangler’s [`generate` subcommand](/cli-wrangler/commands#generate) will create a new project from a “starter” template—just a GitHub repo. With no [template argument](/cli-wrangler/commands#generate), Wrangler generates projects from the [default starter](https://github.com/cloudflare/worker-template). Let’s generate a new project, called `my-worker`:
+Wrangler’s `generate` [command](/cli-wrangler/commands#generate) will create a new project. By default, the [default starter](https://github.com/cloudflare/worker-template) template will be used to generate a new project. To provide a custom template, you may provide the [template argument](/cli-wrangler/commands#generate) with a URL to your desired repository. For example, to create a Worker from the default template called `my-worker`, run:
 
 ```sh
 ~/ $ wrangler generate my-worker
 ```
 
-Wrangler will create a directory called `my-worker` and populate it with the contents of the starter template, in this case the default, and will automatically configure the `wrangler.toml` file in the project’s root with the `name = "my-worker"`.
+Wrangler will create a directory called `my-worker` and populate it with the contents of the starter template, in this case the default template. Wrangler will automatically configure the `wrangler.toml` file in the project’s root with the `name = "my-worker"`.
 
 ```sh
 ~/ $ cd my-worker
@@ -88,30 +98,30 @@ route = ""
 zone_id = ""
 ```
 
-Visit the [Quick Starts](/get-started/quickstarts) page to see a complete list of our recommended starter templates.
+Refer to the [Quick Starts](/get-started/quickstarts) page to see a complete list of starter templates.
 
-For example, to build a Workers project in TypeScript, you would instead run:
+For example, to build a Workers project in TypeScript, run:
 
 ```sh
 ~/ $ wrangler generate my-typescript-worker https://github.com/EverlastingBugstopper/worker-typescript-template
 ```
 
-To start a project from your own code—rather than a starter—use [`wrangler init`](/cli-wrangler/commands#init).
+To start a project from your own code — rather than a starter — use [`wrangler init`](/cli-wrangler/commands#init).
 
 --------------------------------
 
 ## 5. Write code
 
-With your new project generated, you’re ready to write your own code.
+With your new project generated, you can begin to write your code.
 
 ### 5a. Understanding Hello World
 
-At its heart, a Workers app consists of two parts:
+Fundamentally, a Workers application consists of two parts:
 
 1. An [event listener](/runtime-apis/add-event-listener) that listens for [`FetchEvents`](/runtime-apis/fetch-event), and
 2. An event handler that returns a [Response](/runtime-apis/response) object which is passed to the event’s `.respondWith()` method.
 
-When a request is received on one of Cloudflare’s edge servers for a URL matching a Workers script, it passes the request in to the Workers runtime, which in turn [emits a “fetch”](/learning/fetch-event-lifecycle) event in the [isolate](/learning/how-workers-works#isolates) where the script is running.
+When a request is received on one of Cloudflare’s edge servers for a URL matching a Workers script, it passes the request to the Workers runtime. This [dispatches a `FetchEvent`](/learning/fetch-event-lifecycle) in the [isolate](/learning/how-workers-works#isolates) where the script is running.
 
 ```js
 ---
@@ -128,11 +138,11 @@ async function handleRequest(request) {
 }
 ```
 
-Let’s break this down:
+Below is an example of the request response workflow:
 
-1. An event listener for the `FetchEvent` tells the script to listen for any request coming to your Worker. The event handler is passed the `event` object, which includes `event.request`, a [`Request`](/runtime-apis/request) object which is a representation of the HTTP request that triggered the FetchEvent.
+1. An event listener for the `FetchEvent` tells the script to listen for any request coming to your Worker. The event handler is passed the `event` object, which includes `event.request`, a [`Request`](/runtime-apis/request) object which is a representation of the HTTP request that triggered the `FetchEvent`.
 
-2. The call to [`.respondWith()`](/runtime-apis/fetch-event#methods) lets us intercept the request in order to send back a custom response (in this case, the plain text “Hello worker!”).
+2. The call to [`.respondWith()`](/runtime-apis/fetch-event#methods) lets the Workers runtime intercept the request in order to send back a custom response (in this example, the plain text “Hello worker!”).
 
     - The `FetchEvent` handler typically culminates in a call to the method `.respondWith()` with either a [`Response`](/runtime-apis/response) or `Promise<Response>` that determines the response.
 
@@ -142,11 +152,11 @@ Learn more about [the `FetchEvent` lifecycle](/learning/fetch-event-lifecycle).
 
 ### 5b. Routing and filtering requests
 
-Now that we have a very basic script running on all requests, the next thing you’ll commonly want to be able to do is generate a dynamic response based on the requests the Worker script is receiving. This is often referred to as routing or filtering.
+After writing a basic script for all requests, the next step is generating a dynamic response based on the requests the Worker script is receiving. This is often referred to as routing.
 
-#### Option 1: Manually filter requests
+#### Option 1: Manually route requests
 
-You can use standard JavaScript branching logic, such as `if`/`else` or `switch` statements, to conditionally return different responses or execute different handlers based on the request:
+Use standard JavaScript branching logic, such as `if`/`else` or `switch` statements, to conditionally return different responses or execute different handlers based on the request:
 
 ```js
 ---
@@ -168,19 +178,19 @@ async function handleRequest(request) {
 }
 ```
 
-It’s very common to filter requests based on:
+It is common to route requests based on:
 
 - `request.method` — e.g. `GET` or `POST`.
 - `request.url` — e.g. filter based on query parameters or the pathname.
 - `request.headers` — filter based on specific headers.
 
-See a list of [all properties of a `Request` object](/runtime-apis/request#properties).
+Refer to a full list of [all properties of a `Request` object](/runtime-apis/request#properties).
 
-In addition to standard request properties, the Workers platform populates the request with a [`cf` object](/runtime-apis/request#incomingrequestcfproperties), containing many useful properties, e.g. the `region` or `timezone`.
+In addition to standard request properties, the Workers platform populates the request with a [`cf` object](/runtime-apis/request#incomingrequestcfproperties), containing many useful properties, for example, the `region` or `timezone`.
 
 #### Option 2: Use a template for routing on URL
 
-For more complex routing, it can be helpful to use a library. The [Workers router starter](https://github.com/cloudflare/worker-template-router) template provides an API similar to ExpressJS for handling requests based on HTTP methods and paths:
+For more complex routing, it is recommended to use a library. The [Workers router starter](https://github.com/cloudflare/worker-template-router) template provides an API similar to ExpressJS for handling requests based on HTTP methods and paths:
 
 ```sh
 ~/ $ wrangler generate my-worker-with-router https://github.com/cloudflare/worker-template-router
@@ -190,21 +200,21 @@ This starter is used in the tutorial for [building a Slack Bot](/tutorials/build
 
 ### 5c. Make use of runtime APIs
 
-The example outlined in this guide is just a starting point. There are many Workers [runtime APIs](/runtime-apis) available to manipulate requests and generate responses. For example, you can use the [HTMLRewriter API](/runtime-apis/html-rewriter) to parse and transform HTML on the fly, use the [Cache API](/runtime-apis/cache) to retrieve data from and put data into [the Cloudflare cache](/learning/how-the-cache-works), compute a custom response right from the edge, redirect the request to another service, and so much more.
+The example outlined in this guide is a starting point. There are many Workers [runtime APIs](/runtime-apis) available to manipulate requests and generate responses. For example, you can use the [HTMLRewriter API](/runtime-apis/html-rewriter) to parse and dynamically transform HTML, use the [Cache API](/runtime-apis/cache) to retrieve data from and put data into [the Cloudflare cache](/learning/how-the-cache-works), compute a custom response right from the edge, redirect the request to another service, and more.
 
-For inspiration, visit [Built with Workers](https://workers.cloudflare.com/built-with) for a showcase of projects.
+For inspiration, refer to [Built with Workers](https://workers.cloudflare.com/built-with) for a showcase of projects.
 
 --------------------------------
 
 ## 6. Preview your project
 
-In order to preview our Worker, we're going to need to configure our project by adding our `Account ID` to our project's `wrangler.toml`.
+In order to preview your Worker, you need to configure your project by adding your `Account ID` to your project's `wrangler.toml` file.
 
 Run the command `wrangler whoami` and copy your `Account ID`.
 
 ```bash
 $ wrangler whoami
-👋  You are logged in with an API Token, associated with the email '<Your Email>'!
+👋  You are logged in with an API Token, associated with the email '<Your Email>'.
 
 +----------------------------------+----------------------------------+
 | Account Name                     | Account ID                       |
@@ -213,7 +223,7 @@ $ wrangler whoami
 +----------------------------------+----------------------------------+
 ```
 
-Then, open up your project's `wrangler.toml` and paste it in as the value for the `account_id` field.
+Open your project's `wrangler.toml` file and paste it in as the value for the `account_id` field.
 
 ```toml
 ---
@@ -224,7 +234,7 @@ name = "my-worker"
 account_id = "$yourAccountId"
 ```
 
-Once you've done that, you’re ready to preview your code. Run the `wrangler dev` command:
+Once you have filled in your `account_id`, you are ready to preview your code. Run the `wrangler dev` command:
 
 ```sh
 ~/my-worker $ wrangler dev
@@ -232,7 +242,7 @@ Once you've done that, you’re ready to preview your code. Run the `wrangler de
 👂  Listening on http://127.0.0.1:8787
 ```
 
-This command will build your project, run it locally, and return a url for you to visit to preview the worker.
+This command will build your project, run it locally, and return a URL for you to visit to preview the Worker.
 
 <Aside header="A note about building">
 
@@ -244,9 +254,9 @@ Running `wrangler dev` and `wrangler publish` both run `wrangler build` beforeha
 
 ## 7. Configure your project for deployment
 
-To configure your project, we need to fill in a few missing fields in the `wrangler.toml` file in the root of the generated project. This file contains the information Wrangler needs to connect to the Cloudflare Workers API and publish your code.
+To configure your project, fill in the missing fields in the `wrangler.toml` file in the root directory of your generated project. This file contains the information Wrangler needs to connect to the Cloudflare Workers API and publish your code.
 
-You should have already filled in the `account_id` field in the last step. If you didn't, you can get your `Account ID` by running `wrangler whoami`.
+You should have already filled in the `account_id` field in the previous step. If not, run the command `wrangler whoami` and copy your `Account ID`.
 
 ```bash
 $ wrangler whoami
@@ -259,7 +269,7 @@ $ wrangler whoami
 +----------------------------------+----------------------------------+
 ```
 
-Then, paste it into your `wrangler.toml` as the value for the `account_id` field.
+Then, open up your project's `wrangler.toml` file and paste it in as the value for the `account_id` field.
 
 ```toml
 ---
@@ -270,7 +280,7 @@ name = "my-worker"
 account_id = "$yourAccountId"
 ```
 
-Let’s also configure the `type` to `"webpack"`, to tell Wrangler to use [Webpack](/cli-wrangler/webpack) to package your project for deployment. (Learn more about [`type` configuration](/cli-wrangler/configuration).)
+After you have filled in your `account_id`, configure the `type` to `"webpack"` in your `wrangler.toml` file to tell Wrangler to use [Webpack](/cli-wrangler/webpack) to package your project for deployment. To learn more about `type` configuration, refer to the [`type` configuration](/cli-wrangler/configuration) page.
 
 ```toml
 ---
@@ -278,24 +288,27 @@ filename: wrangler.toml
 highlight: [3]
 ---
 name = "my-worker"
+workers_dev = true
 account_id = "$yourAccountId"
 type = "webpack"
 ```
 
-By default, this project will deploy to your workers.dev subdomain. When deploying to a workers.dev subdomain, the **name** field will be used as the secondary subdomain for the deployed script, e.g. `my-worker.my-subdomain.workers.dev`.
+By default, this project will deploy to your `*.workers.dev` subdomain because the `workers_dev` value is set to `true`. When deploying to a `*.workers.dev` subdomain, the `name` field will be used as the secondary subdomain for the deployed script (e.g., `my-worker.my-subdomain.workers.dev`).
 
 #### (Optional) Configure for deploying to a registered domain
 
-To publish your application on a domain you own, and not a workers.dev subdomain, you can add a `route` key to your `wrangler.toml`.
+To publish your application on a zone you own, and not a `*.workers.dev` subdomain, you can add a `route` key to your `wrangler.toml` file.
 
 You can get your `zone_id` with the following steps:
 
-1. [**Log in** to your Cloudflare account](https://dash.cloudflare.com/login) and select the desired domain.
-2. Select the **Overview** tab on the navigation bar.
-3. Scroll down until you see both **Zone ID** on the right.
+1. [**Log in** to your Cloudflare account](https://dash.cloudflare.com/login) and select the desired zone.
+2. If not already there, navigate to **Overview** in the dashboard.
+3. Scroll down until you see **Zone ID** on the right.
 4. Click **Click to copy** below the input.
 
-Wrangler’s [environments feature](/platform/environments) allows us to specify multiple different deploy targets for our application. Let's add a `production` environment, passing in a `zone_id` and `route`:
+Wrangler’s environments feature allows you to deploy the same project to multiple places under multiple names. For a complete guide on how to configure environments, refer to the [environments page](/platform/environments).
+
+To add a `production` environment, pass in a `zone_id` and `route`:
 
 ```toml
 ---
@@ -315,17 +328,21 @@ zone_id = "$yourZoneId"
 route = "example.com/*"
 ```
 
-The `route` key here is a [route pattern](/platform/routes), which e.g., can contain wildcards.
+The `route` key here is a [route pattern](/platform/routes), which can contain wildcards.
+
+If your route is configured to a hostname, you will need to add a DNS record to Cloudflare to ensure that the hostname can be resolved externally. If your Worker acts as your origin (i.e., the request terminates in a Worker), you must add a DNS record. 
+
+You may enter a placeholder `AAAA` record pointing to `100::`, which must be proxied through Cloudflare (orange-cloud in the DNS settings). This value specifically is the [reserved IPv6 discard prefix](https://tools.ietf.org/html/rfc6666) but is not the only value allowed. For example, you may also use an `A` record pointed to `192.0.2.1` or a `CNAME` pointed to any resolvable target. 
 
-If your route is configured to a hostname, you will need to add a DNS record to Cloudflare to ensure that the hostname can be resolved externally. If your Worker acts as your origin (the response comes directly from a Worker), you should enter a placeholder (dummy) AAAA record pointing to `100::`, which is the [reserved IPv6 discard prefix](https://tools.ietf.org/html/rfc6666).
+Whichever method you choose, your record must be proxied through Cloudflare (orange-clouded) and resolve successfully. 
 
 --------------------------------
 
 ## 8. Publish your project
 
-With our project configured, it’s time to publish it.
+With your project configured, you can now publish your Worker.
 
-To deploy to our workers.dev subdomain, we can run:
+To deploy to your `*.workers.dev` subdomain, run:
 
 ```sh
 ---
@@ -334,15 +351,15 @@ header: Publish to workers.dev
 ~/my-worker $ wrangler publish
 ```
 
-<Aside>
+<Aside type="note">
 
-__Note:__ When pushing to workers.dev project for the first time, you may initially see **523 errors** while DNS is propagating. It should work after a minute or so.
+__Note:__ When pushing to your `*.workers.dev`subdomain for the first time, you may initially see [523 errors](https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#523error) while DNS is propagating. It should work after a minute or so.
 
 </Aside>
 
 #### (Optional) Publish your project to a registered domain
 
-To deploy to our production environment we set in our `wrangler.toml` in the optional configuration step, we can pass the `--env` flag to the command:
+To deploy the production environment set in your `wrangler.toml` file in the [optional configuration step](/get-started/guide#optional-configure-for-deploying-to-a-registered-domain), pass the `--env` flag to the command:
 
 ```sh
 ---
@@ -351,12 +368,12 @@ header: Publish to example.com
 ~/my-worker $ wrangler publish --env production
 ```
 
-For more information on environments, check out the [Wrangler documentation](/cli-wrangler/configuration#environments).
+For more information on environments, refer to the [Wrangler documentation](/cli-wrangler/configuration#environments).
 
-You can also configure a GitHub repo to automatically deploy every time you `git push`. You can do this by either using the [Workers GitHub action](https://github.com/marketplace/actions/deploy-to-cloudflare-workers-with-wrangler), or by writing your own GitHub action and manually configuring the necessary [GitHub secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets).
+You can also configure a GitHub repository to automatically deploy every time you `git push`. You can do this by either using the [Workers GitHub action](https://github.com/marketplace/actions/deploy-to-cloudflare-workers-with-wrangler), or by writing your own GitHub action and manually configuring the necessary [GitHub secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets).
 
 --------------------------------
 
-## Where to go next
+## Next steps
 
-This is just the beginning of what you can do with Cloudflare Workers. To dive deeper into building meaty projects, check out our [Tutorials](/tutorials).
+This is just the beginning of what you can do with Cloudflare Workers. To do more with Workers, refer to the [Tutorials](/tutorials) section.
diff --git a/products/workers/src/content/get-started/index.md b/products/workers/src/content/get-started/index.md
index 112b5e5a878..ac479a2f041 100644
--- a/products/workers/src/content/get-started/index.md
+++ b/products/workers/src/content/get-started/index.md
@@ -1,7 +1,8 @@
 ---
 order: 1
+pcx-content-type: navigation
 ---
 
 # Get Started
 
-<DirectoryListing path="/get-started"/>
\ No newline at end of file
+<DirectoryListing path="/get-started"/>
diff --git a/products/workers/src/content/get-started/quickstarts.md b/products/workers/src/content/get-started/quickstarts.md
index 3599f163ea0..a0c0d08a9b2 100644
--- a/products/workers/src/content/get-started/quickstarts.md
+++ b/products/workers/src/content/get-started/quickstarts.md
@@ -1,6 +1,7 @@
 ---
 type: overview
 order: 2
+pcx-content-type: getting-started
 ---
 
 import WorkerStarter from "../../components/worker-starter"
@@ -55,6 +56,12 @@ $ wrangler generate <new-project-name> <github-repo-url>
   repo="cloudflare/worker-template-router"
 />
 
+<WorkerStarter
+  title="Sunder Starter (Typescript)"
+  description="A complete starter template using Sunder, TypeScript, esbuild, Jest, and Sass. Uses Worker Sites for static assets."
+  repo="gzuidhof/sunder-worker-template"
+/>
+
 --------------------------------
 
 ## Frameworks
@@ -111,6 +118,12 @@ $ wrangler generate <new-project-name> <github-repo-url>
   repo="cloudflare/workers-aws-template"
 />
 
+<WorkerStarter
+  title="Edge-side rendering - Vitedge"
+  description="Use Vite to render pages at the edge with great DX. Includes i18n, markdown support and more."
+  repo="frandiox/vitessedge-template"
+/>
+
 --------------------------------
 
 ## Other languages
diff --git a/products/workers/src/content/index.md b/products/workers/src/content/index.md
index f1b6e434f44..a73575fa097 100644
--- a/products/workers/src/content/index.md
+++ b/products/workers/src/content/index.md
@@ -1,14 +1,15 @@
 ---
-title: Welcome
+title: Overview
 order: 0
 type: overview
+pcx-content-type: landing-page
 ---
 
 <ContentColumn>
 
 # Cloudflare Workers documentation
 
-Cloudflare Workers provides a serverless execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure.
+Cloudflare Workers provides a [serverless](https://www.cloudflare.com/learning/serverless/what-is-serverless/) execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure.
 
 <ButtonGroup>
   <Button type="primary" href="/get-started/guide">Get started</Button>
@@ -19,11 +20,16 @@ Cloudflare Workers provides a serverless execution environment that allows you t
 
 ## Installing the Workers CLI
 
-To install [`wrangler`](https://github.com/cloudflare/wrangler), the Workers CLI, ensure you have [`npm` installed](https://www.npmjs.com/get-npm), preferably using a Node version manager like [`nvm`](https://github.com/nvm-sh/nvm#installing-and-updating). Then, run:
+To install [`wrangler`](https://github.com/cloudflare/wrangler), ensure you have [`npm` installed](https://www.npmjs.com/get-npm), preferably using a Node version manager like [Volta](https://volta.sh/) or [nvm](https://github.com/nvm-sh/nvm) to avoid permission issues, then run:
 
 ```sh
 $ npm install -g @cloudflare/wrangler
 ```
+or install with yarn:
+
+```sh
+$ yarn global add @cloudflare/wrangler
+```
 
 Read more about [installing `wrangler`](/cli-wrangler/install-update).
 
@@ -31,7 +37,7 @@ Read more about [installing `wrangler`](/cli-wrangler/install-update).
 
 ## Playground
 
-View this __Hello World__ example in the Workers playground:
+View this Hello World example in the Workers playground:
 
 ```javascript
 addEventListener("fetch", event => {
@@ -60,11 +66,11 @@ async function handleRequest(request) {
 --------------------------------
 
 ## Community
-[Explore third-party packages](https://workers.cloudflare.com/works) that work on Workers, submitted by our users!
+[Explore third-party packages](https://workers.cloudflare.com/works) that work on Workers, submitted by Cloudflare users.
 
-[Connect with the Workers community on Discord](https://discord.gg/cloudflaredev) to ask questions, show off what you’re building, and discuss the platform with other developers. 
+[Connect with the Workers community on Discord](https://discord.gg/cloudflaredev) to ask questions, show off what you are building, and discuss the platform with other developers. 
 
-[Follow @CloudflareDev on Twitter](https://twitter.com/cloudflaredev) to learn about product announcements, new tutorials, and what's new in Cloudflare Workers.
+[Follow @CloudflareDev on Twitter](https://twitter.com/cloudflaredev) to learn about product announcements, new tutorials, and what is new in Cloudflare Workers.
 
 --------------------------------
 
diff --git a/products/workers/src/content/learning/debugging-workers.md b/products/workers/src/content/learning/debugging-workers.md
index 219c421ce9d..aca6642c94a 100644
--- a/products/workers/src/content/learning/debugging-workers.md
+++ b/products/workers/src/content/learning/debugging-workers.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: concept
 ---
 
 # Debugging Workers
@@ -54,122 +55,9 @@ Inserting `console.log` lines throughout your code can help you understand the s
 
 You can customize how `wrangler dev` works to fit your needs: see [the docs](/cli-wrangler/commands#dev-alpha) for available configuration options.
 
---------------------------------
-
-## Accessing production logs with `wrangler tail`
-
-With your Workers application deployed, you may want to inspect incoming traffic. This can be useful for situations where a user is running into issues or errors that you can’t reproduce. `wrangler tail` allows developers to “tail” their Workers application’s logs, giving you real-time access to information about incoming requests.
-
-To get started, run `wrangler tail` in your Workers project directory. This will log any incoming requests to your application available in your local terminal.
-
-The output of each `wrangler tail` log is a structured JSON object:
-
-```json
-{
-  "outcome": "ok",
-  "scriptName": null,
-  "exceptions": [],
-  "logs": [],
-  "eventTimestamp": 1590680082349,
-  "event": {
-    "request": {
-      "url": "https://www.bytesized.xyz/",
-      "method": "GET",
-      "headers": {},
-      "cf": {}
-    }
-  }
-}
-```
-
-By piping the output to tools like [`jq`](https://stedolan.github.io/jq/), you can query and manipulate the requests to look for specific information:
-
-```sh
-$ wrangler tail | jq .event.request.url
-"https://www.bytesized.xyz/"
-"https://www.bytesized.xyz/component---src-pages-index-js-a77e385e3bde5b78dbf6.js"
-"https://www.bytesized.xyz/page-data/app-data.json"
-```
-
-You can customize how `wrangler tail` works to fit your needs: see [the docs](/cli-wrangler/commands#tail) for available configuration options.
-
---------------------------------
-
-## Identifying and handling errors and exceptions
-
-### Error pages generated by Workers
-
-When a Worker running in production has an error that prevents it from returning a response, the client will receive an error page with an error code, defined as follows:
-
-<TableWrap>
-
-| Error code | Meaning                                                                          |
-| ---------- | ---------------------------------------------------------------------------------|
-| 1101       | Worker threw a JavaScript exception.                                             |
-| 1102       | Worker exceeded [CPU time limit](/platform/limits).                              |
-| 1015       | Your client IP is being rate limited.                                            |
-| 1027       | Worker exceeded free tier [daily request limit](/platform/limits#daily-request). |
-
-</TableWrap>
-
-Other 11xx errors generally indicate a problem with the Workers runtime itself — please check our [status page](https://www.cloudflarestatus.com) if you see one.
-
-### Identifying error: Workers Metrics
-
-Additionally, you can find out whether your application is experiencing any downtime, or returning any errors by navigating to Workers Metrics in the dashboard.
+<Aside type="warning">
 
-<!-- TODO: include screenshots -->
+There is a bug associated with `wrangler dev` documented in the [Known issues section](/platform/known-issues#wrangler-dev). 
 
-### Debugging exceptions
+</Aside>
 
-Once you’ve identified your Workers application is returning exceptions, you can use `wrangler tail` to inspect, and fix the exceptions.
-
-<!-- TODO: include example -->
-
-Exceptions will show up under the `exceptions` field in the JSON returned by `wrangler tail`. Once you’ve identified the exception that is causing errors, you may redeploy your code with a fix, and continue trailing the logs to confirm that it is indeed fixed.
-
-### Setup a logging service
-
-A Worker can make HTTP requests to any HTTP service on the public internet. You can use a service like [Sentry](https://sentry.io) to collect error logs from your Worker, by making an HTTP request to the service to report the error. Refer to your service’s API documentation for details on what kind of request to make.
-
-When logging using this strategy, remember that outstanding asynchronous tasks are canceled as soon as a Worker finishes sending its main response body to the client. To ensure that a logging subrequest completes, you can pass the request promise to [`event.waitUntil()`](https://developer.mozilla.org/en-US/docs/Web/API/ExtendableEvent/waitUntil). For example:
-
-```js
-addEventListener("fetch", event => {
-  event.respondWith(handleEvent(event))
-}
-
-async function handleEvent(event) {
-  // ...
-
-  // Without event.waitUntil(), our fetch() to our logging service may
-  // or may not complete.
-  event.waitUntil(postLog(stack))
-  return fetch(event.request)
-}
-
-function postLog(data) {
-  return fetch("https://log-service.example.com/", {
-    method: "POST",
-    body: data,
-  })
-}
-```
-
-### Go to Origin on Error
-
-By using `event.passThroughOnException`, your Workers application will pass requests to your origin if it throws an exception. This allows you to add logging, tracking, or other features with Workers, without degrading your website’s functionality.
-
-```js
-addEventListener("fetch", event => {
-  event.passThroughOnException()
-
-  event.respondWith(handleRequest(event.request))
-})
-
-async function handleRequest(request) {
-  // An error here will return the origin response, as if the Worker wasn’t present.
-  // ...
-  return fetch(request)
-}
-```
diff --git a/products/workers/src/content/learning/fetch-event-lifecycle.md b/products/workers/src/content/learning/fetch-event-lifecycle.md
index 0e348797d8f..a4b16bf6871 100644
--- a/products/workers/src/content/learning/fetch-event-lifecycle.md
+++ b/products/workers/src/content/learning/fetch-event-lifecycle.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # FetchEvent Lifecycle
diff --git a/products/workers/src/content/learning/how-kv-works.md b/products/workers/src/content/learning/how-kv-works.md
index 86bb58d12b3..249cc7ddcc8 100644
--- a/products/workers/src/content/learning/how-kv-works.md
+++ b/products/workers/src/content/learning/how-kv-works.md
@@ -1,5 +1,6 @@
 ---
-order: 5
+order: 6
+pcx-content-type: concept
 ---
 
 # How KV works
diff --git a/products/workers/src/content/learning/how-the-cache-works.md b/products/workers/src/content/learning/how-the-cache-works.md
index 9321ba9851d..f82e4630e46 100644
--- a/products/workers/src/content/learning/how-the-cache-works.md
+++ b/products/workers/src/content/learning/how-the-cache-works.md
@@ -1,5 +1,6 @@
 ---
-order: 6
+order: 7
+pcx-content-type: concept
 ---
 
 # How the Cache works
@@ -53,7 +54,8 @@ The Cache API can be thought of as an ephemeral key-value store, whereby the `Re
 There are two types of cache namespaces available to the Cloudflare Cache:
 
 - __`caches.default`__ – You can access the default cache (the same cache shared with `fetch` requests) by accessing `caches.default`. This is useful when needing to override content that is already cached, after receiving the response.
-- __New namespaces__ – When writing new content to the cache, for example after running a more compute heavy operation such as parsing HTML, or running a computation, you can use `caches.open(CACHE_NAME)` to store them locally in the colo, and readily access them on the following request, rather having to rerun the same operation.
+- __New namespaces__ – You can access a namespaced cache (separate from the cache shared with `fetch` requests) using `let cache = await caches.open(CACHE_NAME)`. This can be useful when writing new content to the cache, for example after running a more compute heavy operation such as parsing HTML or running a computation, to store them locally in the colo and readily access them on the following request, rather having to rerun the same operation. Note that [`caches.open`](https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage/open) is an async function, unlike `caches.default`.
+
 
 When to use the Cache API:
 
diff --git a/products/workers/src/content/learning/how-workers-works.md b/products/workers/src/content/learning/how-workers-works.md
index 4ce163c3cf4..8d25ccb2f76 100644
--- a/products/workers/src/content/learning/how-workers-works.md
+++ b/products/workers/src/content/learning/how-workers-works.md
@@ -1,5 +1,6 @@
 ---
-order: 4
+order: 5
+pcx-content-type: concept
 ---
 
 import NetworkMap from "../../components/network-map"
@@ -7,9 +8,9 @@ import ArchitectureDiagram from "../../components/architecture-diagram"
 
 # How Workers works
 
-Though Cloudflare Workers behave similar to JavaScript in the browser or in Node.js, there are a few subtle differences in how you have to think about your code. Under the hood, the Workers runtime uses the [V8 engine](https://v8.dev) - the same engine used by Chromium and Node.js. The Workers runtime also implements many of the standard [APIs](/runtime-apis) available in most modern browsers.
+Though Cloudflare Workers behave similar to [JavaScript](https://www.cloudflare.com/learning/serverless/serverless-javascript/) in the browser or in Node.js, there are a few subtle differences in how you have to think about your code. Under the hood, the Workers runtime uses the [V8 engine](https://www.cloudflare.com/learning/serverless/glossary/what-is-chrome-v8/) - the same engine used by Chromium and Node.js. The Workers runtime also implements many of the standard [APIs](/runtime-apis) available in most modern browsers.
 
-The differences between JavaScript written for the browser or Node.js happen at runtime. Rather than running on an individual's machine (e.g a browser application or on a centralized server), Workers functions run on [Cloudflare's Edge Network](https://www.cloudflare.com/network) - a growing global network of thousands of machines distributed across hundreds of locations.
+The differences between JavaScript written for the browser or Node.js happen at runtime. Rather than running on an individual's machine (e.g. [a browser application or on a centralized server](https://www.cloudflare.com/learning/serverless/glossary/client-side-vs-server-side/)), Workers functions run on [Cloudflare's Edge Network](https://www.cloudflare.com/network) - a growing global network of thousands of machines distributed across hundreds of locations.
 
 <figure><NetworkMap/></figure>
 
@@ -19,13 +20,13 @@ We'll start with the three largest differences: Isolates, Compute per Request, a
 
 ## Isolates
 
-V8 orchestrates isolates: lightweight contexts that group variables with the code allowed to mutate them. You could even consider an isolate a "sandbox" for your function to run in.
+[V8](https://v8.dev) orchestrates isolates: lightweight contexts that group variables with the code allowed to mutate them. You could even consider an isolate a "sandbox" for your function to run in.
 
 A single runtime can run hundreds or thousands of isolates, seamlessly switching between them. Each isolate's memory is completely isolated, so each piece of code is protected from other untrusted or user-written code on the runtime. Isolates are also designed to start very quickly. Instead of creating a virtual machine for each function, an isolate is created within an existing environment. This model eliminates the cold starts of the virtual machine model.
 
 <figure><ArchitectureDiagram/></figure>
 
-Unlike other serverless providers which use containerized processes each running an instance of a language runtime, Workers pays the overhead of a JavaScript runtime once on the start of an edge container. Workers processes are able to run essentially limitless scripts with almost no individual overhead by creating an isolate for each Workers function call. Any given isolate can start around a hundred times faster than a Node process on a container or virtual machine. Notably, on startup isolates consume an order of magnitude less memory.
+Unlike other serverless providers which use [containerized processes](https://www.cloudflare.com/learning/serverless/serverless-vs-containers/) each running an instance of a language runtime, Workers pays the overhead of a JavaScript runtime once on the start of an edge container. Workers processes are able to run essentially limitless scripts with almost no individual overhead by creating an isolate for each Workers function call. Any given isolate can start around a hundred times faster than a Node process on a container or virtual machine. Notably, on startup isolates consume an order of magnitude less memory.
 
 A given isolate has its own scope, but isolates are not necessarily long-lived. An isolate may be spun down and evicted for a number of reasons:
 
diff --git a/products/workers/src/content/learning/index.md b/products/workers/src/content/learning/index.md
index fd76786d843..5fe1e73e343 100644
--- a/products/workers/src/content/learning/index.md
+++ b/products/workers/src/content/learning/index.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: navigation
 ---
 
 # Learning
diff --git a/products/workers/src/content/learning/integrations.md b/products/workers/src/content/learning/integrations.md
index ff6a75fd225..5b7129a241b 100644
--- a/products/workers/src/content/learning/integrations.md
+++ b/products/workers/src/content/learning/integrations.md
@@ -1,5 +1,6 @@
 ---
-order: 12
+order: 13
+pcx-content-type: concept
 ---
 
 # Integrations
diff --git a/products/workers/src/content/learning/logging-workers.md b/products/workers/src/content/learning/logging-workers.md
new file mode 100644
index 00000000000..de118d62d57
--- /dev/null
+++ b/products/workers/src/content/learning/logging-workers.md
@@ -0,0 +1,175 @@
+---
+order: 4
+pcx-content-type: concept
+---
+
+# Logging from Workers
+
+You can access logs and exceptions for your Workers using the dashboard or [`wrangler tail`](/cli-wrangler/commands#tail).
+
+The Workers platform captures all `console.log`'s and uncaught exceptions, in addition to information about the event itself. All of this can be viewed with either `wrangler tail` or on the dashboard through your **Account Home** > **Workers** > your **Workers script** > **Logs**.
+
+## Adding custom logs
+
+Any `console.log` statements within your Worker will appear within `wrangler tail` and the dashboard output. The following example demonstrates a custom `console.log` within a Worker request handler.
+
+```js
+addEventListener('fetch', event => {
+  event.respondWith(handleRequest(event.request))
+})
+
+/**
+ * Respond with hello worker text
+ * @param {Request} request
+ */
+async function handleRequest(request) {
+  const { cf } = request
+  const { city, country } = cf
+
+  console.log(`Request came from city: ${city} in country: ${country}`);
+
+  return new Response('Hello worker!', {
+    headers: { 'content-type': 'text/plain' },
+  })
+}
+```
+
+After you deploy the above code, run `wrangler tail` in your terminal, and then access your Worker. Your terminal will display:
+
+```sh
+☁  logging-example [master] ⚡  wrangler tail --format=pretty
+[2021-08-18 17:06:55] [LAX] [Ok] GET https://logging-example.jkup.workers.dev/
+ | [Info] Request came from city: Pacifica in country: US
+[2021-08-18 17:06:56] [LAX] [Ok] GET https://logging-example.jkup.workers.dev/favicon.ico
+ | [Info] Request came from city: Pacifica in country: US
+```
+
+## View logs using `wrangler tail`
+
+With your Workers application deployed, you may want to inspect incoming traffic. This may be useful in situations where a user is running into production issues that they cannot easily reproduce. In these instances, `wrangler tail` allows developers to “tail” their Workers application’s logs, giving real-time insight into their application's incoming requests.
+
+To get started, run `wrangler tail` in your Workers project directory. This will log any incoming requests to your application available in your local terminal.
+
+The output of each `wrangler tail` log is a structured JSON object:
+
+```json
+{
+  "outcome": "ok",
+  "scriptName": null,
+  "exceptions": [],
+  "logs": [],
+  "eventTimestamp": 1590680082349,
+  "event": {
+    "request": {
+      "url": "https://www.bytesized.xyz/",
+      "method": "GET",
+      "headers": {},
+      "cf": {}
+    }
+  }
+}
+```
+
+By piping the output to tools like [`jq`](https://stedolan.github.io/jq/), you can query and manipulate the requests to look for specific information:
+
+```sh
+$ wrangler tail | jq .event.request.url
+"https://www.bytesized.xyz/"
+"https://www.bytesized.xyz/component---src-pages-index-js-a77e385e3bde5b78dbf6.js"
+"https://www.bytesized.xyz/page-data/app-data.json"
+```
+
+You can customize how `wrangler tail` works to fit your needs: refer to [the `wrangler tail` documentation](/cli-wrangler/commands#tail) for available configuration options.
+
+## View logs from the dashboard
+
+You can review the production logs associated with any Worker by [logging into the Cloudflare dashboard](https://dash.cloudflare.com?to=/:account/workers/overview). From your **Account Home** > go to *Workers** > select your **Worker script** > and select **Logs**. Logging is available for all customers, including those on the free plan.
+
+![Cloudflare dashboard showing Workers logs](./media/workers-logging-dashboard.png)
+
+A few things worth mentioning:
+
+- Workers logs are not stored. You can start and stop the stream at any time to view them, but they do not persist.
+- Logs will not display if the Worker's requests per second are over 200 for the last 5 minutes.
+- Logs from any [Durable Objects](/learning/using-durable-objects) your Worker is using will show up in the dashboard.
+- A maximum of 10 clients can view a Worker's logs at one time. This can be a combination of either dashboard sessions or `wrangler tail` calls.
+
+--------------------------------
+
+## Identifying and handling errors and exceptions
+
+### Error pages generated by Workers
+
+When a Worker running in production has an error that prevents it from returning a response, the client will receive an error page with an error code, defined as follows:
+
+<TableWrap>
+
+| Error code | Meaning                                                                                                  |
+| ---------- | ---------------------------------------------------------------------------------------------------------|
+| 1101       | Worker threw a JavaScript exception.                                                                     |
+| 1102       | Worker exceeded [CPU time limit](/platform/limits).                                                      |
+| 1015       | Your client IP is being rate limited.                                                                    |
+| 1027       | Worker exceeded free tier [daily request limit](/platform/limits#daily-request).                         |
+| 1042       | Worker tried to fetch from another Worker on the same zone, which is [unsupported](/runtime-apis/fetch). |
+
+</TableWrap>
+
+Other `11xx` errors generally indicate a problem with the Workers runtime itself. Refer to the [status page](https://www.cloudflarestatus.com) if you are experiencing an error.
+
+### Identifying errors: Workers Metrics
+
+You can find out whether your application is experiencing any downtime, or returning any errors by navigating from **Account Home** > to **Workers** > your **Worker script** > **Metrics** in the dashboard.
+
+<!-- TODO: include screenshots -->
+
+### Debugging exceptions
+
+After you have identified your Workers application is returning exceptions, use `wrangler tail` to inspect and fix the exceptions.
+
+<!-- TODO: include example -->
+
+Exceptions will show up under the `exceptions` field in the JSON returned by `wrangler tail`. After you have identified the exception that is causing errors, redeploy your code with a fix, and continue tailing the logs to confirm that it is fixed.
+
+### Set up a logging service
+
+A Worker can make HTTP requests to any HTTP service on the public Internet. You can use a service like [Sentry](https://sentry.io) to collect error logs from your Worker, by making an HTTP request to the service to report the error. Refer to your service’s API documentation for details on what kind of request to make.
+
+When using an external logging strategy, remember that outstanding asynchronous tasks are canceled as soon as a Worker finishes sending its main response body to the client. To ensure that a logging subrequest completes, pass the request promise to [`event.waitUntil()`](https://developer.mozilla.org/en-US/docs/Web/API/ExtendableEvent/waitUntil). For example:
+
+```js
+addEventListener("fetch", event => {
+  event.respondWith(handleEvent(event))
+})
+
+async function handleEvent(event) {
+  // ...
+
+  // Without event.waitUntil(), the `postLog` function may or may not complete.
+  event.waitUntil(postLog(stack))
+  return fetch(event.request)
+}
+
+function postLog(data) {
+  return fetch("https://log-service.example.com/", {
+    method: "POST",
+    body: data,
+  })
+}
+```
+
+### Go to origin on error
+
+By using [`event.passThroughOnException`](/runtime-apis/fetch-event#methods), a Workers application will forward requests to your origin if an exception is thrown during the Worker's execution. This allows you to add logging, tracking, or other features with Workers, without degrading your application's functionality.
+
+```js
+addEventListener("fetch", event => {
+  event.passThroughOnException()
+  event.respondWith(handleRequest(event.request))
+})
+
+async function handleRequest(request) {
+  // An error here will return the origin response, as if the Worker wasn’t present.
+  // ...
+  return fetch(request)
+}
+```
diff --git a/products/workers/src/content/learning/media/workers-logging-dashboard.png b/products/workers/src/content/learning/media/workers-logging-dashboard.png
new file mode 100644
index 00000000000..152b15c1024
Binary files /dev/null and b/products/workers/src/content/learning/media/workers-logging-dashboard.png differ
diff --git a/products/workers/src/content/learning/metrics-and-analytics.md b/products/workers/src/content/learning/metrics-and-analytics.md
index 75b717a7a54..938459b2aec 100644
--- a/products/workers/src/content/learning/metrics-and-analytics.md
+++ b/products/workers/src/content/learning/metrics-and-analytics.md
@@ -1,5 +1,6 @@
 ---
-order: 11
+order: 12
+pcx-content-type: concept
 ---
 
 # Metrics and analytics
diff --git a/products/workers/src/content/learning/playground.md b/products/workers/src/content/learning/playground.md
index b4657492834..e4c24fc6407 100644
--- a/products/workers/src/content/learning/playground.md
+++ b/products/workers/src/content/learning/playground.md
@@ -1,10 +1,11 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # Playground
 
-The quickest way to experiment with Cloudflare Workers is in the [Playground](https://cloudflareworkers.com/#36ebe026bf3510a2e5acace89c09829f:about:blank). It doesn’t require _any_ setup. It’s just a simple, instant way to preview and test a Workers script directly in the browser against any site.
+The quickest way to experiment with Cloudflare Workers is in the [Playground](https://cloudflareworkers.com/#36ebe026bf3510a2e5acace89c09829f:about:blank). It doesn’t require _any_ setup. It’s just a simple sandbox which gives an instant way to preview and test a Workers script directly in the browser against any site.
 
 <p><Button type="primary" href="https://cloudflareworkers.com/#36ebe026bf3510a2e5acace89c09829f:about:blank">Launch playground</Button></p>
 
@@ -24,17 +25,15 @@ async function handleRequest(request) {
 }
 ```
 
-It’s essentially the simplest Worker script you can write.
+This is the least complex Worker you can write. When the Worker receives a request, the `fetch` event is dispatched. [RespondWith](/learning/fetch-event-lifecycle#respondwith) intercepts the event, promising to return the result of the `handleRequest` function to the client. Finally, `handleRequest` is actually called, and it returns a text [response](/runtime-apis/response) of `"Hello world"` which bubbles up and is delivered back to the client.
 
-Essentially what’s going on here is that when the Worker receives a request, `handleRequest` is called, and it responds with a text [response](/runtime-apis/response) of `"Hello world"`.
-
-Check out the reference for [addEventListener](/runtime-apis/add-event-listener) and [FetchEvent](/runtime-apis/fetch-event) to learn more.
+Check out the reference for [addEventListener](/runtime-apis/add-event-listener), [FetchEvent](/runtime-apis/fetch-event) and [FetchEvent lifecycle](/learning/fetch-event-lifecycle) to learn more.
 
 --------------------------------
 
 ## Beyond hello world
 
-To get familiar with Workers, we recommend playing around in the Playground, borrowing bits from [Examples](/examples) section of the documentation. This will give you a taste of what Workers can do. It’s pretty amazing.
+To get familiar with Workers, we recommend playing around in the Playground, borrowing bits from [Examples](/examples) section of the documentation. This will give you a taste of what Workers can do. It’s pretty [amazing](https://www.cloudflare.com/learning/serverless/why-use-serverless/).
 
 --------------------------------
 
diff --git a/products/workers/src/content/learning/security-model/index.md b/products/workers/src/content/learning/security-model/index.md
index d094662d27f..279d3db0825 100644
--- a/products/workers/src/content/learning/security-model/index.md
+++ b/products/workers/src/content/learning/security-model/index.md
@@ -1,5 +1,6 @@
 ---
-order: 10
+order: 11
+pcx-content-type: concept
 ---
 
 # Security model
diff --git a/products/workers/src/content/learning/using-durable-objects.md b/products/workers/src/content/learning/using-durable-objects.md
index e08ca239fe3..5b1d63ccd69 100644
--- a/products/workers/src/content/learning/using-durable-objects.md
+++ b/products/workers/src/content/learning/using-durable-objects.md
@@ -1,5 +1,6 @@
 ---
-order: 8
+order: 9
+pcx-content-type: concept
 ---
 
 # Using Durable Objects
@@ -161,7 +162,7 @@ As part of Durable Objects, we've made it possible for Workers to act as WebSock
 
 While technically any Worker can speak WebSocket in this way, WebSockets are most useful when combined with Durable Objects. When a client connects to your application using a WebSocket, you need a way for server-generated events to be sent back to the existing socket connection. Without Durable Objects, there's no way to send an event to the specific Worker holding a WebSocket. With Durable Objects, you can forward the WebSocket to an Object. Messages can then be addressed to that Object by its unique ID, and the Object can then forward those messages down the WebSocket to the client.
 
-For more information, see the [documentation of WebSockets in Workers](using-websockets). For an example of WebSockets in action within Durable Objects, see [our heavily commented example chat application](https://github.com/cloudflare/workers-chat-demo).
+For more information, see the [documentation of WebSockets in Workers](/learning/using-websockets). For an example of WebSockets in action within Durable Objects, see [our heavily commented example chat application](https://github.com/cloudflare/workers-chat-demo).
 
 ## Instantiating and communicating with a Durable Object
 
@@ -229,7 +230,7 @@ In the above example, we used a string-derived object ID by calling the `idFromN
 
 <Aside type="warning" header="Custom Wrangler installation instructions">
 
-At the time of writing, Durable Object support in Wrangler is not yet available in a full release build, so you need to install a release candidate instead. See the [release notes](https://github.com/cloudflare/wrangler/releases/tag/v1.15.0-custom-builds-rc.2) for installation instructions and more information.
+You must use [Wrangler version 1.17 or greater](https://developers.cloudflare.com/workers/cli-wrangler/install-update) in order to manage Durable Objects.
 
 </Aside>
 
@@ -239,9 +240,10 @@ The easiest way to upload Workers that implement or bind to Durable Objects is t
 $ wrangler generate <worker-name> https://github.com/cloudflare/durable-objects-template
 ```
 
-This will create a directory for your project with basic configuration and a single JavaScript source file already set up. If you want to be able to bundle external dependencies with your code using Rollup or Webpack, or to use CommonJS modules rather than ES modules, you may want to try one of our other starter templates instead:
+This will create a directory for your project with basic configuration and a single JavaScript source file already set up. If you want to use TypeScript, or be able to bundle external dependencies with your code using Rollup or Webpack, or to use CommonJS modules rather than ES modules, you may want to try one of the other starter templates instead:
 
 * [Durable Objects Rollup ES Modules template](https://github.com/cloudflare/durable-objects-rollup-esm)
+* [Durable Objects TypeScript Rollup ES Modules template](https://github.com/cloudflare/durable-objects-typescript-rollup-esm)
 * [Durable Objects Webpack CommonJS template](https://github.com/cloudflare/durable-objects-webpack-commonjs)
 
 The following sections will cover how to customize the configuration, but if you'd like you can immediately publish the generated project using this command:
@@ -284,7 +286,7 @@ $ wrangler publish --new-class DurableObjectExample
 
 Note that after you've run `--new-class` for a given class name once, you do not need to include the migration on subsequent uploads of the Worker. You'd just run `wrangler publish` with no additional flags.
 
-If you want to delete the Durable Objects associated with an exported class, you can use `--delete-class`:
+If you want to delete the Durable Objects associated with an exported class, remove the corresponding binding from wrangler.toml, then use `--delete-class`:
 
 ```sh
 $ wrangler publish --delete-class DurableObjectExample
@@ -333,7 +335,9 @@ There is currently no support for generating a list of all existing objects, nor
 
 ### Development tools
 
-[Wrangler tail](/cli-wrangler/commands#tail) and [Wrangler dev](/cli-wrangler/commands#dev) do not currently work with Durable Objects.
+[Wrangler dev](/cli-wrangler/commands#dev) does not currently work with Durable Objects.
+
+[Wrangler tail](/cli-wrangler/commands#tail) does work, but note that logs from requests that are upgraded to WebSockets are delayed until the WebSocket is closed.
 
 The Workers dashboard does not yet support viewing or editing Workers that use modules syntax. It also does not yet display any information about your Durable Objects or allow you to create client bindings to Durable Objects in your Workers.
 
@@ -351,14 +355,14 @@ While Durable Objects already perform well for many kinds of tasks, we have lots
 
 ## Example - Counter
 
-We've included complete example code for both the Worker and the Durable Object for a basic counter below.
+We've included complete example code for both the Worker and the Durable Object for a basic counter below. [See here](https://github.com/cloudflare/durable-objects-template) for the full code template.
 
 ```js
 // Worker
 
 export default {
-    async fetch(request, env) {
-        return await handleRequest(request, env);
+    fetch(request, env) {
+        return handleRequest(request, env);
     }
 }
 
@@ -431,3 +435,17 @@ export class Counter {
 ## Configuration Script
 
 While using Wrangler is strongly recommended, if you would really rather not use it for some reason we've included a [shell script](/publish-durable-object.sh) to automate the curl commands involved in uploading a Worker that implements and uses Durable Objects.
+
+## Troubleshooting
+
+### Debugging 
+`wrangler dev` does not currently support Durable Objects.
+
+To help with debugging, you may use [`wrangler tail`](/cli-wrangler/commands#tail) to troubleshoot your Durable Object script. `wrangler tail` displays a live feed of console and exception logs for each request your Worker receives. After doing a `wrangler publish`, you can use `wrangler tail` in the root directory of your Worker project and visit your Worker URL to see console and error logs in your terminal.
+
+### Common errors
+#### Error: `No event handlers were registered. This script does nothing.`
+In your `wrangler.toml` file, make sure the `dir` and `main` entries point to the correct file containing your Worker script, and that the file extension is `.mjs` instead of `.js` if using ES Modules Syntax.
+
+#### Error when deleting migration
+When deleting a migration using `wrangler --delete-class <ClassName>`, you may encounter this error: `"Cannot apply --delete-class migration to class <ClassName> without also removing the binding that references it"`. You should remove the corresponding binding under `[durable_objects]` in `wrangler.toml` before attempting to apply `--delete-class` again.
diff --git a/products/workers/src/content/learning/using-streams.md b/products/workers/src/content/learning/using-streams.md
index fe3c8776d16..53a403b4f22 100644
--- a/products/workers/src/content/learning/using-streams.md
+++ b/products/workers/src/content/learning/using-streams.md
@@ -1,5 +1,6 @@
 ---
-order: 7
+order: 8
+pcx-content-type: concept
 ---
 
 # Using Streams
diff --git a/products/workers/src/content/learning/using-websockets.md b/products/workers/src/content/learning/using-websockets.md
index 61ca76352c9..ec1f0bc0b1f 100644
--- a/products/workers/src/content/learning/using-websockets.md
+++ b/products/workers/src/content/learning/using-websockets.md
@@ -1,5 +1,6 @@
 ---
-order: 9
+order: 10
+pcx-content-type: concept
 ---
 
 # Using WebSockets
@@ -90,7 +91,7 @@ async function handleRequest(request) {
 }
 ```
 
-WebSockets emit a number of [Events](/workers/runtime-apis/websockets#events) that can be connected to using `addEventListener`. In the below example, we hook into the `message` event and emit a `console.log` with the data from it:
+WebSockets emit a number of [Events](/runtime-apis/websockets#events) that can be connected to using `addEventListener`. In the below example, we hook into the `message` event and emit a `console.log` with the data from it:
 
 ```js
 async function handleRequest(request) {
@@ -114,7 +115,7 @@ async function handleRequest(request) {
 }
 ```
 
-## Writing a WebSocket Client
+### Connecting to the WebSocket server from a client
 
 Writing WebSocket clients that communicate with your Workers function is a two-step process: first, create the WebSocket instance, and then attach event listeners to it, just like we did on the server:
 
@@ -140,6 +141,42 @@ websocket.close()
 
 For an example of this in practice, see the [`websocket-template`](https://github.com/cloudflare/websocket-template) that we provide to get started with WebSockets.
 
+## Writing a WebSocket client
+
+A Worker can also establish a WebSocket connection to a remote server. 
+
+We do not currently support the client implementation described above within a Worker. Instead, WebSockets are established by making a fetch request to a URL with the upgrade header set.
+
+```js
+async function websocket(url) {
+  // Make a fetch request including `Upgrade: websocket` header.
+  // The Workers Runtime will automatically handle other requirements
+  // of the WebSocket protocol, like the Sec-WebSocket-Key header.
+  let resp = await fetch(url, {
+    headers: {
+      "Upgrade": "websocket"
+    }
+  });
+
+  // If the WebSocket handshake completed successfully, then the
+  // response has a `webSocket` property.
+  let ws = resp.webSocket;
+  if (!ws) {
+    throw new Error("server didn't accept WebSocket");
+  }
+
+  // Call accept() to indicate that you'll be handling the socket here
+  // in JavaScript, as opposed to returning it on to a client.
+  ws.accept();
+
+  // Now you can send and receive messages like before.
+  ws.send("hello");
+  ws.addEventListener("message", msg => {
+    console.log(msg.data);
+  });
+}
+```
+
 ## Durable Objects and WebSocket state
 
 If your application needs to coordinate among multiple WebSocket connections, such as a chat room or game match, you'll need to create a _Durable Object_ so clients send messages to a single-point-of-coordination. Durable Objects are a coordinated state tool for Cloudflare Workers, which are often used in parallel with WebSockets to persist state over multiple clients and connections. Check out our [Durable Objects](/learning/using-durable-objects) learning page to get started.
diff --git a/products/workers/src/content/platform/add-route-modal.png b/products/workers/src/content/platform/add-route-modal.png
new file mode 100644
index 00000000000..daac3209b19
Binary files /dev/null and b/products/workers/src/content/platform/add-route-modal.png differ
diff --git a/products/workers/src/content/platform/changelog.md b/products/workers/src/content/platform/changelog.md
new file mode 100644
index 00000000000..1e7f3d0c95c
--- /dev/null
+++ b/products/workers/src/content/platform/changelog.md
@@ -0,0 +1,277 @@
+# Changelog
+
+## 7/13/2021
+
+- The preview service now prints a warning in the devtools console when a script uses Response/Request.clone() but does not read one of the cloned bodies. Such a situation forces the runtime to buffer the entire message body in memory, which reduces performance. [Find an example here](https://cloudflareworkers.com/#823fbe463bfafd5a06bcfeabbdf5eeae:https://tutorial.cloudflareworkers.com).
+
+## 7/1/2021
+
+- Fixed bug where registering the same exact event listener method twice on the same event type threw an internal error.
+- Add support for the `.forEach()` method for `Headers`, `URLSearchParameters`, and `FormData`.
+
+## 6/27/2021
+
+- WebCrypto: Implemented non-standard Ed25519 operation (algorithm NODE-ED25519, curve name NODE-ED25519). The Ed25519 implementation differs from NodeJS’s in that raw import/export of private keys is disallowed, per parity with ECDSA/ECDH.
+
+## 6/17/2021
+
+Changes this week:
+- Updated V8 from 9.1 to 9.2.
+- `wrangler tail` now works on Durable Objects. Note that logs from long-lived WebSockets will not be visible until the WebSocket is closed.
+
+## 6/11/2021
+
+Changes this week:
+
+- Turn on V8 Sparkplug compiler.
+- Durable Object instances that are finishing up existing requests after their code is updated will be disconnected from the persistent storage API, to maintain the invariant that only a single instance ever has access to persistent storage for a given Durable Object.
+
+## 6/4/2021
+
+Changes this week:
+- WebCrypto: We now support the “raw” import/export format for ECDSA/ECDH public keys.
+- `request.cf` is no longer missing when writing Workers using modules syntax.
+
+## 5/14/2021
+
+Changes this week:
+- Improve error messages coming from the WebCrypto API.
+- Updated V8: 9.0 → 9.1
+
+Changes in an earlier release:
+- WebCrypto: Implement JWK export for RSA, ECDSA, & ECDH.
+- WebCrypto: Add support for RSA-OAEP
+- WebCrypto: HKDF implemented.
+- Fix recently-introduced backwards clock jumps in Durable Objects.
+- `WebCrypto.generateKey()`, when asked to generate a key pair with algorithm RSA-PSS, would instead return a key pair using algorithm RSASSA-PKCS1-v1\_5. Although the key structure is the same, the signature algorithms differ, and therefore, signatures generated using the key would not be accepted by a correct implementation of RSA-PSS, and vice versa. Since this would be a pretty obvious problem, but no one ever reported it to us, we guess that currently, no one is using this functionality on Workers.
+
+## 4/29/2021
+
+Changes this week:
+- WebCrypto: Implemented `wrapKey()` / `unwrapKey()` for AES algorithms.
+- The arguments to `WebSocket.close()` are now optional, as the standard says they should be.
+
+## 4/23/2021
+
+Changes this week:
+- In the WebCrypto API, encrypt and decrypt operations are now supported for the “AES-CTR” encryption algorithm.
+- For Durable Objects, CPU time limits are now enforced on the object level rather than the request level. Each time a new request arrives, the time limit is “topped up” to 500ms. After the (free) beta period ends and Durable Objects becomes generally available, we will increase this to 30 seconds.
+- When a Durable Object exceeds its CPU time limit, the entire object will be discarded and recreated. Previously, we allowed subrequest requests to continue using the same object, but this was dangerous because hitting the CPU time limit can leave the object in an inconsistent state.
+- Long running Durable Objects are given more subrequest quota as additional WebSocket messages are sent to them, to avoid the problem of a long-running Object being unable to make any more subrequests after it has been held open by a particular WebSocket for a while.
+- When a Durable Object’s code is updated, or when its isolate is reset due to exceeding the memory limit, all stubs pointing to the object will become invalidated and have to be recreated. This is consistent with what happens when the CPU time is exceeded, or when stubs become disconnected due to random network errors. This behavior is useful, as apps can now assume that two messages sent to the same stub will be delivered to exactly the same live instance (if they are delivered at all). Apps which do not care about this property should recreate their stubs for every request; there is no performance penalty from doing so.
+- When a Durable Object’s isolate exceeds its memory limit, an exception with an explanatory message will now be thrown to the caller, instead of “internal error”.
+- When a Durable Object exceeds its CPU time limit, an exception with an explanatory message will now be thrown to the caller, instead of “internal error”.
+- `wrangler tail` now reports CPU-time-exceeded exceptions with an explanatory message instead of “internal error”.
+
+## 4/19/2021
+
+Changes since the last post on 3/26:
+- Cron Triggers now have a 15 minute wall time limit, in addition to the existing CPU time limit. (Previously, there was no limit, so a cron trigger that spent all its time waiting for I/O could hang forever.)
+- Our WebCrypto implementation now supports importing and exporting HMAC and AES keys in JWK format.
+- Our WebCrypto implementation now supports AES key generation for CTR, CBC, and KW modes. AES-CTR encrypt/decrypt and AES-KW key wrapping/unwrapping support will land in a later release.
+- Fixed bug where `crypto.subtle.encrypt()` on zero-length inputs would sometimes throw an exception.
+- Errors on script upload will now be properly reported for module-based scripts, instead of appearing as a ReferenceError.
+- WebCrypto: Key derivation for ECDH.
+- WebCrypto: Support ECDH key generation & import.
+- WebCrypto: Support ECDSA key generation.
+- Fixed bug where `crypto.subtle.encrypt()` on zero-length inputs would sometimes throw an exception.
+- Improved exception messages thrown by the WebCrypto API somewhat.
+- `waitUntil` is now supported for module Workers. An additional argument called ‘ctx’ is passed after ‘env’, and `waitUntil` is a method on ‘ctx’.
+- `passThroughOnException` is now available under the ctx argument to module handlers
+- Reliability improvements for Durable Objects
+- Reliability improvements for Durable Objects persistent storage API
+- `ScheduledEvent.cron` is now set to the original cron string that the event was scheduled for.
+
+## 3/26/2021
+
+Changes this week:
+- Existing WebSocket connections to Durable Objects will now be forcibly disconnected on code updates, in order to force clients to connect to the instance running the new code.
+
+## 3/11/2021
+
+New this week:
+- When the Workers Runtime itself reloads due to us deploying a new version or config change, we now preload high-traffic Workers in the new instance of the runtime before traffic cuts over. This ensures that users do not observe cold starts for these Workers due to the upgrade, and also fixes a low rate of spurious 503 errors that we had previously been seeing due to overload during such reloads.
+
+(It looks like no release notes were posted the last few weeks, but there were no new user-visible changes to report.)
+## 2/11/2021
+
+Changes this week:
+- In the preview mode of the dashboard, a Worker that fails during startup will now return a 500 response, rather than getting the default passthrough behavior, which was making it harder to notice when a Worker was failing.
+- A Durable Object’s ID is now provided to it in its constructor. It can be accessed off of the `state` provided as the constructor’s first argument, as in `state.id`.
+
+## 2/5/2021
+
+New this week:
+- V8 has been updated from 8.8 to 8.9.
+- During a `fetch()`, if the destination server commits certain HTTP protocol errors, such as returning invalid (unparseable) headers, we now throw an exception whose description explains the problem, rather than an “internal error”.
+
+New last week (forgot to post):
+- Added support for `waitUntil()` in Durable Objects. It is a method on the state object passed to the Durable Object class’s constructor.
+
+## 1/22/2021
+
+New in the past week:
+- Fixed a bug which caused scripts with WebAssembly modules to hang when using devtools in the preview service.
+
+## 1/14/2021
+
+Changes this week:
+- Implemented File and Blob APIs, which can be used when constructing FormData in outgoing requests. Unfortunately, FormData from incoming requests at this time will still use strings even when file metadata was present, in order to avoid breaking existing deployed Workers. We will find a way to fix that in the future.
+
+## 1/7/2021
+
+Changes this week:
+- No user-visible changes.
+
+Changes in the prior release:
+- Fixed delivery of WebSocket “error” events.
+- Fixed a rare bug where a WritableStream could be garbage collected while it still had writes queued, causing those writes to be lost.
+
+## 12/10/2020
+
+Changes this week:
+- Major V8 update: 8.7.220.29 -> 8.8.278.8
+
+## 9/19/2019
+
+Changes this week:
+- Unannounced new feature. (Stay tuned.)
+- Enforced new limit on concurrent subrequests (see below).
+- Stability improvements.
+
+**Concurrent Subrequest Limit**
+
+As of this release, we impose a limit on the number of outgoing HTTP requests that a Worker can make simultaneously. **For each incoming request**, a Worker can make up to 6 concurrent outgoing `fetch()` requests.
+
+If a Worker’s request handler attempts to call `fetch()` more than six times (on behalf of a single incoming request) without waiting for previous fetches to complete, then fetches after the sixth will be delayed until previous fetches have finished. A Worker is still allowed to make up to 50 total subrequests per incoming request, as before; the new limit is only on how many can execute simultaneously.
+
+**Automatic deadlock avoidance**
+
+Our implementation automatically detects if delaying a fetch would cause the Worker to deadlock, and prevents the deadlock by cancelling the least-recently-used request. For example, imagine a Worker that starts 10 requests and waits to receive all the responses *without reading the response bodies*. A fetch is not considered complete until the response body is fully-consumed (e.g. by calling `response.text()` or `response.json()`, or by reading from `response.body`). Therefore, in this scenario, the first six requests will run and their response objects would be returned, but the remaining four requests would not start until the earlier responses are consumed. If the Worker fails to actually read the earlier response bodies and is still waiting for the last four requests, then the Workers Runtime will automatically cancel the first four requests so that the remaining ones can complete. If the Worker later goes back and tries to read the response bodies, exceptions will be thrown.
+
+**Most Workers are Not Affected**
+
+The vast majority of Workers make fewer than six outgoing requests per incoming request. Such Workers are totally unaffected by this change.
+
+Of Workers that do make more than six outgoing requests concurrently for a single incoming request, the vast majority either read the response bodies immediately upon each response returning, or never read the response bodies at all. In either case, these Workers will still work as intended – although they may be a little slower due to outgoing requests after the sixth being delayed.
+
+A very small number of deployed Workers (about 20 total) make more than 6 requests concurrently, wait for all responses to return, and then go back to read the response bodies later. For all known Workers that do this, we have temporarily grandfathered your zone into the old behavior, so that your Workers will continue to operate. However, we will be communicating with customers one-by-one to request that you update your code to proactively read request bodies, so that it works correctly under the new limit.
+
+**Why did we do this?**
+
+Cloudflare communicates with origin servers using HTTP/1.1, not HTTP/2. Under HTTP/1.1, each concurrent request requires a separate connection. So, Workers that make many requests concurrently could force the creation of an excessive number of connections to origin servers. In some cases, this caused resource exhaustion problems either at the origin server or within our own stack.
+
+On investigating the use cases for such Workers, every case we looked at turned out to be a mistake or otherwise unnecessary. Often, developers were making requests and receiving responses, but they only cared about the response status and headers but not the body. So, they threw away the response objects without reading the body, essentially leaking connections. In some other cases, developers had simply accidentally written code that made excessive requests in a loop for no good reason at all. Both of these cases should now cause no problems under the new behavior.
+
+We chose the limit of 6 concurrent connections based on the fact that Chrome enforces the same limit on web sites in the browser.
+
+## 12/4/2020
+
+Changes this week:
+- Durable Objects storage API now supports listing keys by prefix.
+- Improved error message when a single request performs more than 1000 KV operations to make clear that a per-request limit was reached, not a global rate limit.
+- `wrangler dev` previews should now honor non-default resource limits, e.g. longer CPU limits for those in the Workers Unbound beta.
+- Fixed off-by-one line numbers in Worker exceptions.
+- Exceptions thrown in a Durable Object’s `fetch()` method are now tunneled to its caller.
+- Fixed a bug where a large Durable Object response body could cause the Durable Object to become unresponsive.
+
+## 11/13/2020
+
+Changes over the past week:
+- `ReadableStream.cancel()` and `ReadableStream.getReader().cancel()` now take an optional, instead of a mandatory, argument, to conform with the Streams spec.
+- Fixed an error that occurred when a WASM module declared that it wanted to grow larger than 128MB. Instead, the actual memory usage of the module is monitored and an error is thrown if it exceeds 128MB used.
+
+## 11/5/2020
+
+Changes this week:
+- Major V8 update: 8.6 -> 8.7
+- Limit the maximum number of Durable Objects keys that can be changed in a single transaction to 128.
+
+## 10/5/2020
+
+We had our usual weekly release last week, but:
+- No user-visible changes.
+
+## 9/24/2020
+
+Changes this week:
+- Internal changes to support upcoming features.
+
+Also, a change from the 2020-09-08 release that it seems we forgot to post:
+- V8 major update: 8.5 -> 8.6
+
+## 8/3/2020
+
+Changes last week:
+- Fixed a regression which could cause `HTMLRewriter.transform()` to throw spurious “The parser has stopped.” errors.
+- Upgraded V8 from 8.4 to 8.5.
+
+## 7/9/2020
+
+Changes this week:
+- Fixed a regression in HTMLRewriter: [https://github.com/cloudflare/lol-html/issues/50](<https://github.com/cloudflare/lol-html/issues/50>)
+- Common HTTP method names passed to `fetch()` or `new Request()` are now case-insensitive as required by the Fetch API spec.
+
+Changes last week (… forgot to post):
+- `setTimeout`/`setInterval` can now take additional arguments which will be passed on to the callback, as required by the spec. (Few people use this feature today because it’s usually much easier to use lambda captures.)
+
+Changes the week before last (… also… forgot to post… we really need to code up a bot for this):
+- The HTMLRewriter now supports the `:nth-child` , `:first-child` , `:nth-of-type` , and `:first-of-type` selectors.
+
+## 5/15/2020
+
+Changes this week:
+- Implemented API for yet-to-be-announced new feature.
+
+## 4/20/2020
+
+Looks like we forgot to post release notes for a couple weeks. Releases still are happening weekly as always, but the “post to the community” step is insufficiently automated…
+4/2 release:
+- Fixed a source of long garbage collection paused in memory limit enforcement.
+
+4/9 release:
+- No publicly-visible changes.
+
+4/16 release:
+- In preview, we now log a warning when attempting to construct a `Request` or `Response` whose body is of type `FormData` but with the `Content-Type` header overridden. Such bodies would not be parseable by the receiver.
+
+## 3/26/2020
+
+New this week:
+- Certain “internal errors” that could be thrown when using the Cache API are now reported with human-friendly error messages. For example, `caches.default.match("not a URL")` now throws a TypeError.
+
+## 2/28/2020
+
+New from the past two weeks:
+- Fixed a bug in the preview service where the CPU time limiter was overly lenient for the first several requests handled by a newly-started worker. The same bug actually exists in production as well, but we are much more cautious about fixing it there, since doing so might break live sites. If you find your worker now exceeds CPU time limits in preview, then it is likely exceeding time limits in production as well, but only appearing to work because the limits are too lenient for the first few requests. Such Workers will eventually fail in production, too (and always have), so it is best to fix the problem in preview before deploying.
+- Major V8 update: 8.0 -> 8.1
+- Minor bug fixes.
+
+## 2/13/2020
+
+Changes over the last couple weeks:
+- Fixed a bug where if two differently-named scripts within the same account had identical content and were deployed to the same zone, they would be treated as the “same Worker”, meaning they would share the same isolate and global variables. This only applied between Workers on the same zone, so was not a security threat, but it caused confusion. Now, two differently-named Worker scripts will never be considered the same Worker even if they have identical content.
+- Performance and stability improvements.
+
+## 1/24/2020
+
+It has been a while since we posted release notes, partly due to the holidays. Here is what is new over the past month:
+- Performance and stability improvements.
+- A rare source of `daemonDown` errors when processing bursty traffic over HTTP/2 has been eliminated.
+- Updated V8 7.9 -> 8.0.
+
+## 12/12/2019
+
+New this week:
+- We now pass correct line and column numbers more often when reporting exceptions to the V8 inspector. There remain some cases where the reported line and column numbers will be wrong.
+- Fixed a significant source of daemonDown (1105) errors.
+
+## 12/6/2019
+
+Runtime release notes covering the past few weeks:
+- Increased total per-request `Cache.put()` limit to 5GiB.
+- Increased individual `Cache.put()` limits to the lesser of 5GiB or the zone’s normal cache limits ([https://support.cloudflare.com/hc/en-us/articles/200172516-Understanding-Cloudflare-s-CDN](<https://support.cloudflare.com/hc/en-us/articles/200172516-Understanding-Cloudflare-s-CDN>)).
+- Added a helpful error message explaining AES decryption failures.
+- Some overload errors were erroneously being reported as daemonDown (1105) errors. They have been changed to exceededCpu (1102) errors, which better describes their cause.
+- More “internal errors” were converted to useful user-facing errors.
+- Stability improvements and bug fixes.
diff --git a/products/workers/src/content/platform/cron-triggers/index.md b/products/workers/src/content/platform/cron-triggers/index.md
index c2ace5b113b..5bd54c6132e 100644
--- a/products/workers/src/content/platform/cron-triggers/index.md
+++ b/products/workers/src/content/platform/cron-triggers/index.md
@@ -1,5 +1,6 @@
 ---
-order: 10
+order: 9
+pcx-content-type: concept
 ---
 
 # Cron Triggers
@@ -65,9 +66,15 @@ Here are some common time intervals that may be useful for setting up your Cron
 
 </Definitions>
 
+<Aside type="note" header="Testing Cron Triggers and potential delays">
+
+A recommended way for testing your Cron Trigger is to first deploy it to a test domain. Adding a new Cron Trigger, updating an old Cron Trigger, or deleting a Cron Trigger may take minutes for changes to propagate to the edge.
+
+</Aside>
+
 ## Viewing past events
 
-Users can view the execution history of their Cron Triggers on the Past Events section of the [Workers Triggers tab](https://dash.cloudflare.com/?to=/:account/workers) or through Cloudflare's [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api).
+Users can review the execution history of their Cron Triggers on the Past Events section of the [Workers Triggers tab](https://dash.cloudflare.com/?to=/:account/workers) or through Cloudflare's [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api).
 
 ![workers-past-events](./media/workers-past-events.png)
 
diff --git a/products/workers/src/content/platform/deploy-button.md b/products/workers/src/content/platform/deploy-button.md
index 746a19f7e35..e8fd0c31798 100644
--- a/products/workers/src/content/platform/deploy-button.md
+++ b/products/workers/src/content/platform/deploy-button.md
@@ -1,12 +1,13 @@
 ---
-order: 7
+order: 8
+pcx-content-type: concept
 ---
 
 # Deploy button
 
 ## Background
 
-Deploy buttons let you deploy projects to the Workers platform in under five minutes. The deploy buttons use a Worker to deploy to the platform using the [Workers GitHub Action](https://github.com/marketplace/actions/github-action-for-cloudflare-workers). You can also make your own deploy buttons for your projects to make sharing your work easier.
+Deploy buttons let you deploy projects to the Workers platform in under five minutes. The deploy buttons use a Worker to deploy to the platform using the [Workers GitHub Action](https://github.com/marketplace/actions/deploy-to-cloudflare-workers-with-wrangler). You can also make your own deploy buttons for your projects to make sharing your work easier.
 
 Try the deploy button below to deploy a GraphQL server:
 
@@ -26,14 +27,15 @@ on:
   push:
   pull_request:
   repository_dispatch:
-deploy:
-  runs-on: ubuntu-latest
-  timeout-minutes: 60
-  needs: test
-  steps:
-    - uses: actions/checkout@v2
-    - name: Publish
-      uses: cloudflare/wrangler-action@1.3.0
+jobs:
+    deploy:
+      runs-on: ubuntu-latest
+      timeout-minutes: 60
+      needs: test
+      steps:
+        - uses: actions/checkout@v2
+        - name: Publish
+          uses: cloudflare/wrangler-action@1.3.0
 ```
 
 2. **Add support for `CF_API_TOKEN` and `CF_ACCOUNT_ID` in your workflow**:
diff --git a/products/workers/src/content/platform/env_variables_dash.png b/products/workers/src/content/platform/env_variables_dash.png
new file mode 100644
index 00000000000..de54d5afe8f
Binary files /dev/null and b/products/workers/src/content/platform/env_variables_dash.png differ
diff --git a/products/workers/src/content/platform/environment-variables.md b/products/workers/src/content/platform/environment-variables.md
new file mode 100644
index 00000000000..44356d757aa
--- /dev/null
+++ b/products/workers/src/content/platform/environment-variables.md
@@ -0,0 +1,146 @@
+---
+order: 7
+pcx-content-type: concept
+---
+
+# Environment variables
+
+In the Workers platform, environment variables, secrets, and KV namespaces are known as bindings. Regardless of type, bindings are always available as global variables within your Worker script.
+
+## Environment variables via wrangler
+
+### Adding environment variables via wrangler
+
+Environment variables are defined via the `[vars]` configuration in your `wranger.toml` file and are always plaintext values.
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "my-worker-dev"
+type = "javascript"
+
+account_id = "<YOUR ACCOUNTID>"
+workers_dev = true
+
+# Define top-level environment variables
+# under the `[vars]` block using
+# the `key = "value"` format
+[vars]
+API_TOKEN = "example_dev_token"
+STRIPE_TOKEN = "pk_xyz1234_test"
+
+# Override values for `--env production` usage
+[env.production]
+name = "my-worker-production"
+[env.production.vars]
+API_TOKEN = "example_production_token"
+STRIPE_TOKEN = "pk_xyz1234"
+```
+
+These environment variables can then be accessed within your Worker script as global variables. They will be plaintext strings.
+
+```js
+// Worker code:
+console.log(API_TOKEN);
+//=> (default) "example_dev_token"
+//=> (env.production) "example_production_token"
+
+console.log(STRIPE_TOKEN);
+//=> (default) "pk_xyz1234_test"
+//=> (env.production) "pk_xyz1234"
+```
+
+### Adding secrets via wrangler
+
+Secrets are defined by running [`wrangler secret put <NAME>`](/cli-wrangler/commands#secret) in your terminal, where `<NAME>` is the name of your binding. You may assign environment-specific secrets by re-running the command `wrangler secret put <NAME> -e` or `wrangler secret put <NAME> --env`. Keep a list of the secrets used in your code in your `wrangler.toml` file, like the example under `[secrets]`:
+
+    ```toml
+    ---
+    filename: wrangler.toml
+    ---
+    name = "my-worker-dev"
+    type = "javascript"
+
+    account_id = "<YOUR ACCOUNTID>"
+    workers_dev = true
+
+    # [secrets]
+    # SPARKPOST_KEY
+    # GTOKEN_PRIVKEY
+    # GTOKEN_KID
+    ```
+
+<Aside type="warning">
+
+\* __Warning:__ Do not use plaintext environment variables to store sensitive information. Use [`wrangler secret put`](/cli-wrangler/commands#secret) instead.
+
+</Aside>
+
+### Adding KV namespaces via wrangler
+
+KV namespaces are defined via the [`kv_namespaces`](/cli-wrangler/configuration#kv_namespaces) configuration in your `wrangler.toml` and are always provided as [KV runtime instances](/runtime-apis/kv).
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "my-worker-dev"
+type = "javascript"
+
+account_id = "<YOUR ACCOUNTID>"
+workers_dev = true
+
+[[kv_namespaces]]
+binding = "Customers"
+preview_id = "<PREVIEW KV NAMESPACEID>"
+id = "<DEV KV NAMESPACEID>"
+
+[env.production]
+name = "my-worker-production"
+[[kv_namespaces]]
+binding = "Customers"
+id = "<PRODUCTION KV NAMESPACEID>"
+```
+
+## Environment variables via the dashboard
+
+### Adding environment variables via the dashboard
+
+Add environment variables by logging into [Cloudflare dashboard](https://dash.cloudflare.com/) > **Account Home** > **Workers** and select your **Workers script**. 
+
+To add environment variables, such as `vars` and `secret`:
+
+1. Go to your **Workers script** > **Settings** > **Add variable** under **Environment Variables**.
+2. Input a **Variable name** and its **value**, which will be made available to your Worker. 
+3. If your variable is a secret, select  **Encrypt** to protect its value. This will prevent the value from being visible via `wrangler` and the dashboard. 
+3. (Optional) To add multiple environment variables, select **Add variable**. 
+5. Select **Save** to implement your changes.
+
+![env variables dash](env_variables_dash.png)
+
+<Aside type="warning" header="Plaintext strings and secrets">
+
+Do not select **Encrypt** when adding environment variables if your variable is not a secret. Skip step 3 if your variable's value is a plaintext string and does not need to be encrypted. 
+
+</Aside>
+
+### Adding KV namespace bindings via the dashboard
+
+To add KV namespace bindings:
+
+1. Go to your **Workers script** > **Settings** > **Add binding** under **KV Namespace Bindings**.
+2. Choose a **Variable name**. This will be the way the variable name will be referenced in your Worker script. 
+3. Next, select a **KV namespace** from the dropdown. 
+4. Select **Add binding** to add multiple bindings. 
+5. When you are finished, select **Save** to implement your changes.
+
+![kv namespace bindings](kv_namespace_bindings.png)
+
+Your completed Workers dashboard, with environment variables and KV namespace bindings added, will look like the following example reference. 
+
+![env vars secret](envvarssecret-detail-page.jpeg)
+
+## Comparing secrets and environment variables
+
+Secrets are environment variables. The difference is secret values are not visible within `wrangler` or dashboard interfaces after you define them. This means that sensitive data, including passwords or API tokens, should always be encrypted to prevent data leaks. To your Worker, there is no difference between an environment variable and a secret. The secret's value is passed through as defined. 
diff --git a/products/workers/src/content/platform/environments.md b/products/workers/src/content/platform/environments.md
index 3f1747aa1d6..278b5ed703a 100644
--- a/products/workers/src/content/platform/environments.md
+++ b/products/workers/src/content/platform/environments.md
@@ -1,40 +1,96 @@
 ---
 order: 6
+pcx-content-type: concept
 ---
 
 # Environments
 
 <Aside>
 
-__Note__: You can only interact with environments using [wrangler](/cli-wrangler).
+__Note__: You can only use environments with [wrangler](/cli-wrangler).
 
 </Aside>
 
 ## Background
 
-Environments is a feature that allows you to deploy the same project to multiple places under multiple names. These environments are utilized with the `--env` or `-e` flag on `wrangler build`, `wrangler preview`, and `wrangler publish`.
+Environments are different contexts that your code runs in. The Workers platform allows you to create and manage different environments. Through environments, you can deploy the same project to multiple places under multiple names.
+
+These environments are utilized with the `--env` or `-e` flag on `wrangler build`, `wrangler dev`, `wrangler preview`, `wrangler publish`, and `wrangler secret`.
 
 --------------------------------
 
 ## Usage
 
-The most common use case for environments is deploying to a staging subdomain before your production environment. `wrangler publish` will look at your top level configuration, and you can specify other environments beneath it. For details on what keys are inherited see [`wrangler.toml` configuration](/cli-wrangler/configuration#keys).
+You will likely use environments to deploy Workers to a staging subdomain before your production environment. `wrangler publish` will determine its destination by the top-level configuration in your `wrangler.toml` [file](/cli-wrangler/commands#generate). You can create other environments beneath the top-level configuration in the `wrangler.toml` file by adding an [`[env.name]` configuration](https://developers.cloudflare.com/workers/cli-wrangler/configuration#environments) and specifying additional keys and values. For details on what keys are inherited by environments from the top-level configuration, see [`wrangler.toml` configuration](/cli-wrangler/configuration#keys).
+
+The layout of a top-level configuration in a `wrangler.toml` file is displayed below:
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "your-worker"
+type = "javascript"
+account_id = "your-account-id"
+
+# This field specifies that the Worker
+# will be deployed to a *.workers.dev domain
+workers_dev = true
+
+# -- OR --
+
+# These fields specify that the Worker
+# will deploy to a custom domain
+zone_id = "your-zone-id"
+routes = ["example.com/*"]
+```
 
 ### Naming
 
-You cannot specify multiple environments with the same name. If this were allowed, publishing each environment would overwrite your previously deployed worker, and the behavior would not be clear.
+You cannot specify multiple environments with the same name. If this were allowed, publishing each environment would overwrite your previously deployed Worker and the behavior would not be clear.
+
+For this reason, Wrangler appends the environment name to the top-level name to publish a Worker script. For example, a Worker project named `my-worker` with an environment `[env.dev]` would become `my-worker-dev`.
+
+The layout of an example `[env.dev]` environment is displayed below:
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "your-worker"
+type = "javascript"
+account_id = "your-account-id"
+
+[env.dev]
+name = "your-worker-dev"
+route = "your-custom-route"
+```
+
+The layout of an example `[env.dev]` environment is displayed below:
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "your-worker"
+type = "javascript"
+account_id = "your-account-id"
 
-For this reason wrangler **appends the environment name to the top-level name to publish a Worker script**. For example, a Worker project named `my-worker` with an environment `[env.dev]` would become `my-worker-dev`.
+[env.dev]
+name = "your-worker-dev"
+route = "your-custom-route"
+```
 
 --------------------------------
 
 ## Examples
 
-### Top level configuration
+### Top-level configuration
 
-#### Routes
+#### Publishing to a custom domain
 
-This `wrangler.toml` has no environments defined and will publish `my-worker` to `example.com/*`
+This `wrangler.toml` file has no environments defined and will publish `my-worker` to `example.com/*`.
+The `workers_dev` key is missing from this example, but because a route is specified, the inferred value of `workers_dev` is `false`.
 
 ```toml
 ---
@@ -43,19 +99,26 @@ filename: wrangler.toml
 type = "webpack"
 name = "my-worker"
 account_id = "12345678901234567890"
+
+# These fields specify that the Worker
+# will deploy to a custom domain
 zone_id = "09876543210987654321"
 route = "example.com/*"
 ```
 
+To deploy this Worker, run the `wrangler publish` command in your terminal:
+
 ```sh
 ~/my-worker $ wrangler publish
 ✨  Built successfully, built project size is 523 bytes.
 ✨  Successfully published your script to example.com/*
 ```
 
-#### workers.dev
+#### Publishing to *.workers.dev
 
-This `wrangler.toml` has no environments defined and will publish `my-worker` to `my-worker.<your-subdomain>.workers.dev`
+Your `*.workers.dev` subdomain allows you to deploy Workers scripts [without attaching a custom domain as a Cloudflare zone](https://blog.cloudflare.com/announcing-workers-dev/). To claim a `*.workers.dev` subdomain, such as `my-subdomain.workers.dev`, select the **Workers** icon on your account home, or **Workers** then **Manage Workers** on your zone's dashboard, and begin setup on the right side of the Workers dashboard under **Your subdomain**.
+
+This `wrangler.toml` file has no environments defined and will publish `my-worker` to `my-worker.<your-subdomain>.workers.dev`:
 
 ```toml
 ---
@@ -66,10 +129,14 @@ name = "my-worker"
 account_id = "12345678901234567890"
 
 # this field specifies that the worker
-# should be deployed to workers.dev
+# should be deployed to *.workers.dev
 workers_dev = true
 ```
 
+This example will publish to your `*.workers.dev` subdomain because `workers_dev` has been set to `true`.
+
+Run `wrangler publish` as normal to deploy your Worker script:
+
 ```sh
 ~/my-worker $ wrangler publish
 ✨  Built successfully, built project size is 523 bytes.
@@ -78,7 +145,11 @@ workers_dev = true
 
 ### Introducing environments
 
-This `wrangler.toml` adds two environments to the base case. Note that you must provide a route/routes key for each environment if you are deploying to a custom domain.
+Environments enable you to write and deploy projects to multiple places.
+
+You can define an environment by specifying an `[env.name]` block with its own values in your `wrangler.toml` file. Values within this block may override top-level configuration values with the same key.
+
+The `wrangler.toml` file below adds two environments, `[env.staging]` and `[env.production]`, to the `wrangler.toml` file. If you are deploying to a custom domain, you must provide a [`route` or `routes` key](/cli-wrangler/configuration#keys) for each environment if you are deploying to a custom domain.
 
 ```toml
 ---
@@ -127,7 +198,7 @@ With this configuration, Wrangler will behave in the following manner:
 ✨  Successfully published your script to example.com/*
 ```
 
-Once a text variable is uploaded via [wrangler](/cli-wrangler) or in the UI, the string is exposed on the global namespace as type [`String`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String).
+Any defined [environment variables](/platform/environment-variables) (the [`vars`](/cli-wrangler/configuration#vars) key) are exposed as global variables to your Worker.
 
 With this configuration, the `ENVIRONMENT` variable can be used to call specific code depending on the given environment:
 
@@ -141,7 +212,7 @@ if (ENVIRONMENT === "staging") {
 
 ### Staging Environment with workers.dev
 
-In order to deploy your code to workers.dev, you must include `workers_dev = true` in the desired environment. Your `wrangler.toml` may look like this:
+In order to deploy your code to your `*.workers.dev` subdomain, include `workers_dev = true` in the desired environment. Your `wrangler.toml` file may look like this:
 
 ```toml
 ---
@@ -171,9 +242,9 @@ With this configuration, Wrangler will behave in the following manner:
 ✨  Successfully published your script to https://my-worker-staging.<your-subdomain>.workers.dev
 ```
 
-### workers.dev as a first class target
+### workers.dev as a first-class target
 
-If you only want to deploy to workers.dev you can configure Wrangler like so:
+If you want to connect multiple environments to your `*.workers.dev` subdomain, you must assign a different `name` per environment. This allows your Worker to be uploaded as different scripts, each given its own set of [environment variables](/platform/environment-variables), secrets, and KV namespaces. Configure your `wrangler.toml` file like the example below:
 
 ```toml
 ---
@@ -191,7 +262,7 @@ name = "my-worker"
 name = "my-worker-staging"
 ```
 
-With this configuration, Wrangler will behave in the following manner:
+With this configuration, deploy each environment by attaching a `--env` or `-e` flag and the name of the environment like the examples below:
 
 ```sh
 ~/my-worker $ wrangler publish
@@ -235,54 +306,17 @@ webpack_config = "webpack.config.js"
 name = "my-worker-staging"
 ```
 
-Your default `wrangler build`, `wrangler preview`, and `wrangler publish` commands will all build with `webpack.dev.js`, as will `wrangler build -e staging`, `wrangler preview -e staging`, and `wrangler publish -e staging`.
+Your default `wrangler build`, `wrangler preview`, and `wrangler publish` commands will all build with `webpack.dev.js`. Any commands tied to the staging environment will also use this configuration; for example, `wrangler build -e staging`, `wrangler preview -e staging`, and `wrangler publish -e staging`.
 
 The build commands `wrangler build -e production`, `wrangler preview -e production`, and `wrangler publish -e production` would all use your `webpack.config.js` file.
 
 --------------------------------
 
-## Environment variables
-
-You can specify different KV namespaces, secrets, and text variables for different environments.
-
-```toml
----
-filename: wrangler.toml
----
-name = "my-worker"
-type = "webpack"
-account_id = "12345678901234567890"
-workers_dev = true
-kv_namespaces = [
-  { binding = "KV", id = "06779da6940b431db6e566b4846d64db" }
-]
-
-[env.production]
-kv_namespaces = [
-  { binding = "KV", id = "bd46d6484b665e6bd134b0496ad97760" }
-]
-vars = {FOO = "some text"} # Creates & Sets Environment Variable FOO to "some text"
-```
-
-<Aside type="warning">
-
-\* __Warning:__ We do not recommend using text variables to store secrets. If possible use the [`wrangler secret put`](/cli-wrangler/commands#secret) command instead.
-
-</Aside>
-
-<Aside>
-
-__Note:__ Secret variables can only be assigned to specific environments by passing the `-e/--env <environment_name>` flag while using the [`wrangler secret put`](/cli-wrangler/commands#secret) command.
-
-</Aside>
-
---------------------------------
-
 ## Invalid configurations
 
 ### Multiple types
 
-You cannot specify a type for each environment, type must be specified at the top level of your `wrangler.toml`.
+You cannot specify multiple `type` values. The `type` must be specified at the top level of your `wrangler.toml` file.
 
 ```toml
 ---
@@ -299,11 +333,11 @@ workers_dev = true
 type = "rust"
 ```
 
-Wrangler will not error with this configuration, it will build with the `webpack` type.
+With this configuration, no errors will be thrown. However, only `type = "webpack"` will be used, even in an `--env production` setting.
 
 ### Same name for multiple environments
 
-You cannot specify multiple environments with the same name. If this were allowed, publishing each environment would overwrite your previously deployed worker, and the behavior would not be clear.
+You cannot specify multiple environments with the same name. If this were allowed, publishing each environment would overwrite your previously deployed Worker, and the behavior would not be clear.
 
 ```toml
 ---
@@ -345,7 +379,7 @@ workers_dev = true
 route = "staging.example.com/*"
 ```
 
-Wrangler will fail to publish to an environment where `route` is defined alongside `workers_dev = true`.
+Wrangler will fail to deploy when both  `workers_dev = true` and `route` (or `routes`) are defined. If you are trying to deploy to a `*.workers.dev` domain, remove the `route` or `routes` value.
 
 ```sh
 ~/my-worker $ wrangler publish
diff --git a/products/workers/src/content/platform/envvarssecret-detail-page.jpeg b/products/workers/src/content/platform/envvarssecret-detail-page.jpeg
new file mode 100644
index 00000000000..8fe52a55b94
Binary files /dev/null and b/products/workers/src/content/platform/envvarssecret-detail-page.jpeg differ
diff --git a/products/workers/src/content/platform/index.md b/products/workers/src/content/platform/index.md
index 4710b1b6620..ca12947909a 100644
--- a/products/workers/src/content/platform/index.md
+++ b/products/workers/src/content/platform/index.md
@@ -1,5 +1,6 @@
 ---
 order: 5
+pcx-content-type: navigation
 ---
 
 # Platform
diff --git a/products/workers/src/content/platform/known-issues.md b/products/workers/src/content/platform/known-issues.md
new file mode 100644
index 00000000000..a300e119a28
--- /dev/null
+++ b/products/workers/src/content/platform/known-issues.md
@@ -0,0 +1,38 @@
+---
+order: 5
+pcx-content-type: concept
+---
+
+# Known issues
+
+Below are some known bugs and issues to be aware of when using Cloudflare Workers.
+
+## Route specificity 
+
+- When defining route specificity, a trailing `/*` in your pattern may not act as expected.
+
+Consider two different Workers, each deployed to the same zone. Worker A is assigned the `example.com/images/*` route and Worker B is given the `example.com/images*` route pattern. With these in place, here are how the following URLs will be resolved:
+
+```
+// (A) example.com/images/*
+// (B) example.com/images*
+
+"example.com/images" 
+// -> B
+"example.com/images123" 
+// -> B
+"example.com/images/hello"
+// -> B
+```
+
+You will notice that all examples trigger Worker B. This includes the final example, which exemplifies the unexpected behavior.
+
+## wrangler dev
+
+- When running `wrangler dev`, all outgoing requests are given the `cf-workers-preview-token` header, which Cloudflare recognizes as a preview request. This applies to the entire Cloudflare network, so making HTTP requests to other Cloudflare zones is currently discarded for security reasons. To enable a workaround, insert the following code into your Worker script:
+
+```js
+const request = new Request(url, incomingRequest)
+request.headers.delete('cf-workers-preview-token')
+return await fetch(request)
+```
\ No newline at end of file
diff --git a/products/workers/src/content/platform/kv_namespace_bindings.png b/products/workers/src/content/platform/kv_namespace_bindings.png
new file mode 100644
index 00000000000..e58d61bea38
Binary files /dev/null and b/products/workers/src/content/platform/kv_namespace_bindings.png differ
diff --git a/products/workers/src/content/platform/languages.md b/products/workers/src/content/platform/languages.md
index 58dbb109b08..1c0430a258a 100644
--- a/products/workers/src/content/platform/languages.md
+++ b/products/workers/src/content/platform/languages.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: concept
 ---
 
 # Languages
diff --git a/products/workers/src/content/platform/limits.md b/products/workers/src/content/platform/limits.md
index d553ea4a68c..46a8c358267 100644
--- a/products/workers/src/content/platform/limits.md
+++ b/products/workers/src/content/platform/limits.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: concept
 ---
 
 # Limits
@@ -21,6 +22,31 @@ order: 2
 
 </TableWrap>
 
+## Request limits
+
+URLs have a limit of 16KB.
+
+Request headers observe a total limit of 32KB, but each header is limited to 16KB. 
+
+Cloudflare has network-wide limits on the request body size. This limit is tied to your Cloudflare Account's plan, which is separate from your Workers plan. When the request body size of your POST/PUT/PATCH requests exceed your plan's limit, the request is rejected with a `(403) Request entity too large` error.
+
+Cloudflare Enterprise customers may contact [Cloudflare Support](https://support.cloudflare.com/hc/articles/200172476) to request a limit beyond 500MB.
+
+<TableWrap>
+
+| Cloudflare Plan | Maximum body size |
+| --------------- | ----------------- |
+| Free            | 100MB             |
+| Pro             | 100MB             |
+| Business        | 200MB             |
+| Enterprise      | 500MB             |
+
+</TableWrap>
+
+## Response limits
+
+Cloudflare does not enforce response limits, but cache limits for [Cloudflare's CDN are observed](https://support.cloudflare.com/hc/articles/200172516#h_51422705-42d0-450d-8eb1-5321dcadb5bc). Maximum file size is 512MB for Free, Pro, and Business customers and 5GB for Enterprise customers.
+
 ## Worker limits
 
 <TableWrap>
@@ -80,11 +106,11 @@ The following limits apply regardless of the plan used.
 
 <TableWrap>
 
-| Feature                       | Free   | Bundled |
-| ----------------------------- | ------ | ------- |
-| [Max object size](#cache-api) | 512 MB | 512 MB  |
-| [Calls/request](#cache-api)   | 50     | 50      |
-| [Storage limit](#cache-api)   | 5 GB   | 5 GB    |
+| Feature                               | Free   | Bundled |
+| ------------------------------------- | ------ | ------- |
+| [Max object size](#cache-api)         | 512 MB | 512 MB  |
+| [Calls/request](#cache-api)           | 50     | 50      |
+| [Storage/request](#cache-api)         | 5 GB   | 5 GB    |
 
 </TableWrap>
 
@@ -142,13 +168,15 @@ Routes in fail closed mode will display a Cloudflare 1027 error page to visitors
 
 Only one Workers instance runs on each of the many global Cloudflare edge servers. Each Workers instance can consume up to 128MB of memory. Use [global variables](/runtime-apis/web-standards) to persist data between requests on individual nodes; note however, that nodes are occasionally evicted from memory.
 
+If a Worker processes a request that pushes the Worker over the 128MB limit, the Cloudflare Workers runtime may cancel one or more requests. To view these errors, as well as CPU limit overages, go to [**Workers**](https://dash.cloudflare.com/?to=/:account/workers) on the Cloudflare dashboard > **Manage Workers** > select the Worker you would like to investigate > scroll down to **Invocation Statuses** and examine *Exceeded Resources*. 
+
 Use the [TransformStream API](/runtime-apis/streams/transformstream) to stream responses if you are concerned about memory usage. This avoids loading an entire response into memory.
 
 ---
 
 ## CPU runtime
 
-Most Workers requests consume less than a millisecond. It’s rare to find a normally operating Workers script that exceeds the CPU time limit. A Worker may consume up to 10ms on the free plan and 50ms on the Bundled tier. The 10ms allowance on the free plan is enough execution time for most use cases including application hosting.
+Most Workers requests consume less than a millisecond. It is rare to find a normally operating Workers script that exceeds the CPU time limit. A Worker may consume up to 10ms on the free plan and up to 50ms for Bundled Workers on the Paid Plan. The Paid Plan also offers up to a 30 second [duration](/platform/limits#duration) for increased compute time. The 10ms allowance on the free plan is enough execution time for most use cases including application hosting.
 
 There is no limit on the real runtime for a Workers script. As long as the client that sent the request remains connected, the Workers script can continue processing, making subrequests, and setting timeouts on behalf of that request. When the client disconnects, all tasks associated with that client request are canceled. You can use [`event.waitUntil()`](/runtime-apis/fetch-event) to delay cancellation for another 30 seconds or until the promise passed to `waitUntil()` completes.
 
@@ -156,9 +184,9 @@ There is no limit on the real runtime for a Workers script. As long as the clien
 
 ## Duration
 
-Duration is the measurement of wall-clock time. This is measured in Gigabytes per second (GB-s). When a Worker is executed, it is allocated 128mb of [memory](/platform/limits#memory). As the Worker continues to execute that memory remains allocated, even during network IO requests.
+Duration is the measurement of wall-clock time. This is measured in Gigabyte-seconds (GB-s). When a Worker is executed, it is allocated 128mb of [memory](/platform/limits#memory). As the Worker continues to execute that memory remains allocated, even during network IO requests.
 
-For example, when a Worker executes via a [scheduled event](/runtime-apis/scheduledevent), it executes for 4 seconds, including network-bound IO time: `4s x 0.125GB (or 128Mb) = .5 GB-s`.
+For example, when a Worker executes via a [scheduled event](/runtime-apis/scheduled-event), it executes for four seconds, including network-bound IO time: `4s x 0.125GB (or 128Mb) = .5 GB-s`.
 
 Duration is most applicable to Unbound Workers on the [Paid plan](/platform/pricing#paid-plan).
 
@@ -217,9 +245,7 @@ Each environment variable has a size limitation of 5 KB.
 
 ### Script size
 
-<!-- TODO(soon): Broken link to Bindings API documentation. -->
-
-A Workers script plus any [Asset Bindings](/platform/scripts#resource-bindings) can be up to 1MB in size after compression.
+A Workers script can be up to 1MB in size after compression.
 
 ### Number of scripts
 
@@ -264,6 +290,8 @@ Workers KV is an eventually consistent system, meaning that reads will sometimes
 
 </Aside>
 
+---
+
 ## Durable Objects
 
 <Aside type="warning" header="Beta">
diff --git a/products/workers/src/content/platform/pricing.md b/products/workers/src/content/platform/pricing.md
index c4bbf373862..3154d8debc1 100644
--- a/products/workers/src/content/platform/pricing.md
+++ b/products/workers/src/content/platform/pricing.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: concept
 ---
 
 # Pricing
diff --git a/products/workers/src/content/platform/routes.md b/products/workers/src/content/platform/routes.md
index c9dd9db5837..8960d158d05 100644
--- a/products/workers/src/content/platform/routes.md
+++ b/products/workers/src/content/platform/routes.md
@@ -1,5 +1,6 @@
 ---
 order: 4
+pcx-content-type: concept
 ---
 
 # Routes
@@ -8,16 +9,13 @@ order: 4
 
 Routes allow users to map a URL pattern to a Worker script to enable Workers to run on custom domains.
 
-## Custom zones
+## Custom routes
 
 For zones proxied on Cloudflare\*, route patterns decide what (if any) script is matched based on the URL of that request. Requests are routed through a Workers script when the URL matches a route pattern assigned to that script.
 
 Route patterns can be added with the Cloudflare API or on the [Workers tab](https://dash.cloudflare.com/?zone=workers) in the Cloudflare dashboard (after selecting a zone).
 
-<!-- TODO: add image -->
-<!--
-![Workers Route Modal](https://web.archive.org/web/20200817183804im_/https://developers.cloudflare.com/workers/about/media/add-route-modal.png)
--->
+![Workers Route Modal](./add-route-modal.png)
 
 Cloudflare Site routes are comprised of:
 
@@ -29,6 +27,12 @@ The Routes REST API documentation can be found [in the Workers API docs](https:/
 
 \* _A zone that you have registered with some registrar (not workers.dev) and setup Cloudflare to serve as [a reverse proxy](https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/)._
 
+## Routes with *.workers.dev
+
+Cloudflare Workers accounts come with a `*.workers.dev` subdomain that is configurable from the Workers dashboard sidebar. Your `*.workers.dev` subdomain allows you to deploy Workers scripts [without attaching a custom domain as a Cloudflare zone](https://blog.cloudflare.com/announcing-workers-dev/).
+
+To claim a `*.workers.dev` subdomain, such as `my-subdomain.workers.dev`, select the **Workers** icon on your account home, or **Workers** then **Manage Workers** on your zone's dashboard, and begin setup on the right side of the Workers dashboard under **Your subdomain**. The `name` field in your Worker configuration is used as the secondary subdomain for the deployed script, (e.g., `my-worker.my-subdomain.workers.dev.`).
+
 ### Matching Behavior
 
 Route patterns look like this:
@@ -52,13 +56,13 @@ While they look similar to a [regex](https://en.wikipedia.org/wiki/Regular_expre
 
 - Route patterns may not contain infix wildcards or query parameters, e.g. neither `example.com/*.jpg` nor `example.com/?foo=*` are valid route patterns.
 
-- When more than one route pattern could match a request URL, the most specific route pattern wins. For example, the pattern `www.example.com/*` would take precedence over `*.example.com/*` when matching a request for `https://www.example.com/`.
+- When more than one route pattern could match a request URL, the most specific route pattern wins. For example, the pattern `www.example.com/*` would take precedence over `*.example.com/*` when matching a request for `https://www.example.com/`. The pattern `example.com/hello/*` would take precedence over `example.com/*` when matching a request for `example.com/hello/world`.
 
 - Route pattern matching considers the entire request URL, including the query parameter string. Since route patterns may not contain query parameters, the only way to have a route pattern match URLs with query parameters is to terminate it with a wildcard, `*`.
 
 - Route patterns are case sensitive, e.g. `example.com/Images/*` and `example.com/images/*` are two distinct routes.
 
-A route can be specified without being associated with a worker; this will act to negate any less specific patterns. For example, consider this pair of route patterns, one with a Workers script and one without:
+A route can be specified without being associated with a Worker; this will act to negate any less specific patterns. For example, consider this pair of route patterns, one with a Workers script and one without:
 
 ```txt
 *example.com/images/cat.png -> <no script>
@@ -101,7 +105,11 @@ If a route pattern path ends with `*`, then it matches all suffixes of that path
 
 - `https://example.com/path*` matches `https://example.com/path` _and_ `https://example.com/path2` _and_ `https://example.com/path/readme.txt`
 
-- `https://example.com/path/*` matches `https://example.com/path/readme.txt` but _not_ `https://example.com/path2`.
+<Aside type="warning">
+
+There is a well-known bug associated with path matching concerning wildcards and forward slashes that is documented in the [Known issues section.](/platform/known-issues)
+
+</Aside>
 
 #### Subdomains must have a DNS Record
 
diff --git a/products/workers/src/content/platform/scripts.md b/products/workers/src/content/platform/scripts.md
deleted file mode 100644
index c2b511e9fe5..00000000000
--- a/products/workers/src/content/platform/scripts.md
+++ /dev/null
@@ -1,84 +0,0 @@
----
-order: 5
----
-
-# Scripts
-
-Scripts are where the Workers code itself is stored and uploaded to the edge.
-
-## Script object specification
-
-<Definitions>
-
-- `id`
-  - The name of the script. Script names must:
-
-    - start with a letter,
-    - end with a letter or digit,
-    - include only letters, digits, underscore, and hyphen,
-    - and be 63 or fewer characters.
-
-- `etag`
-  - Hashed script content; can be used in an If-None-Match header on update.
-
-- `script`
-  - Raw script content, as a string.
-
-- `size`
-  - [Size of script](/platform/limits) in bytes.
-
-- `modified_on`
-  - ISO_8601 timestamp of when the script was last modified.
-
-</Definitions>
-
-## Resource Bindings
-
-Resource bindings allow you to attach resources, such as secrets, or KV namespaces to your Worker script. If you are including Resources in your Worker, you need to specify their Bindings as a part of your upload. This API uses a multipart form, rather than straight bytes, to send its data.
-
-All bindings have the following properties:
-
-<Definitions>
-
-- `name`
-  - The name of the binding, which will be exposed as the name a global variable within the script.
-
-- `type`
-  - The type of binding, can be one of:
-
-    - `kv_namespace`
-    - `secret`
-    - `wasm_module`
-    - `plain_text`
-
-</Definitions>
-
-### KV namespace bindings
-
-If your Worker uses a [KV namespace](/learning/how-kv-works), you will want to add a `kv_namespace` binding object to the `"bindings"` array in `metadata.json`.
-
-KV bindings must include a `namespace_id`. The `namespace_id` value should correspond to the identifier associated with the namespace you want to use.
-
-### WebAssembly module bindings
-
-If your Worker uses a [WebAssembly Module](https://github.com/cloudflare/rustwasm-worker-template), you will want to add a `wasm_module` binding object to the `bindings` array in `metadata.json`.
-
-You will also need to add your WebAssembly module as a file part to your request, and name it the same as the `part` field in the binding.
-
-### Secret bindings
-
-If your Worker script uses [secrets](reference/apis/environment-variables#secrets), add a corresponding `secret_text` binding to the `bindings` array in `metadata.json`.
-
-Secret bindings must include a `text` property. The `text` value includes text, such as an API key you want to store.
-
-Secrets are persisted between deploys of a Worker. You only need to include secrets in API calls when you are adding or changing the secret’s content.*
-
-## Plain text bindings
-
-If your Worker uses plain text environment variables, you will want to add a `plain_text` binding object for each one to the `bindings` array in `metadata.json`.
-
-Plain text bindings must include a `text` property. The `text` value includes text, such as an API key you want to store.
-
-## See also
-
-- [Workers Scripts API](https://api.cloudflare.com/#worker-script-properties)
diff --git a/products/workers/src/content/platform/sites/configuration.md b/products/workers/src/content/platform/sites/configuration.md
index bf4b2bf5030..73454b0b751 100644
--- a/products/workers/src/content/platform/sites/configuration.md
+++ b/products/workers/src/content/platform/sites/configuration.md
@@ -1,5 +1,6 @@
 ---
 order: 3
+pcx-content-type: configuration
 ---
 
 # Configuration
diff --git a/products/workers/src/content/platform/sites/index.md b/products/workers/src/content/platform/sites/index.md
index 5fb5254971e..8d7bdfcd5c4 100644
--- a/products/workers/src/content/platform/sites/index.md
+++ b/products/workers/src/content/platform/sites/index.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: navigation
+---
+
 # Workers Sites
 
 Workers Sites enables developers to deploy __static applications__ directly to Workers.
diff --git a/products/workers/src/content/platform/sites/start-from-existing.md b/products/workers/src/content/platform/sites/start-from-existing.md
index 4c7d44b4722..8a5ed17b8a9 100644
--- a/products/workers/src/content/platform/sites/start-from-existing.md
+++ b/products/workers/src/content/platform/sites/start-from-existing.md
@@ -1,5 +1,6 @@
 ---
 order: 0
+pcx-content-type: how-to
 ---
 
 # Start from existing
@@ -12,7 +13,7 @@ To deploy a pre-existing static site project, you’ll need to start with a pre-
 - [Gatsby](https://www.gatsbyjs.org/docs/quick-start/), requires Node
 - [Jekyll](https://jekyllrb.com/docs/), requires Ruby
 - [Eleventy](https://www.11ty.io/#quick-start), requires Node
-- [WordPress](https://wordpress.org) (see our tutorial on [deploying static WordPress sites with Workers](/tutorials/hosting-static-wordpress-sites))
+- [WordPress](https://wordpress.org) (refer to the tutorial on [deploying static WordPress sites with Workers](/tutorials/deploy-a-static-wordpress-site))
 
 Once you have a site generated, follow these steps:
 
@@ -66,4 +67,4 @@ Once you have a site generated, follow these steps:
 
   ```sh
   $ wrangler publish
-  ```
\ No newline at end of file
+  ```
diff --git a/products/workers/src/content/platform/sites/start-from-scratch.md b/products/workers/src/content/platform/sites/start-from-scratch.md
index c19726ba782..8e1f1a99612 100644
--- a/products/workers/src/content/platform/sites/start-from-scratch.md
+++ b/products/workers/src/content/platform/sites/start-from-scratch.md
@@ -1,5 +1,6 @@
 ---
 order: 1
+pcx-content-type: how-to
 ---
 
 # Start from scratch
diff --git a/products/workers/src/content/platform/sites/start-from-worker.md b/products/workers/src/content/platform/sites/start-from-worker.md
index fa433108b83..a62b14a2e54 100644
--- a/products/workers/src/content/platform/sites/start-from-worker.md
+++ b/products/workers/src/content/platform/sites/start-from-worker.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: how-to
 ---
 
 # Start from worker
diff --git a/products/workers/src/content/runtime-apis/add-event-listener.md b/products/workers/src/content/runtime-apis/add-event-listener.md
index 3e3bc440cce..e0f774434e3 100644
--- a/products/workers/src/content/runtime-apis/add-event-listener.md
+++ b/products/workers/src/content/runtime-apis/add-event-listener.md
@@ -1,5 +1,6 @@
 ---
 order: 2
+pcx-content-type: configuration
 ---
 
 # addEventListener
@@ -46,7 +47,7 @@ This function defines triggers for a Worker script to execute. There are current
 
 ```js
 addEventListener("fetch", event => {
-  return event.respondWith(
+  event.respondWith(
     new Response("Hello world")
   )
 })
diff --git a/products/workers/src/content/runtime-apis/cache.md b/products/workers/src/content/runtime-apis/cache.md
index fbf966f1f1d..c400fc750b0 100644
--- a/products/workers/src/content/runtime-apis/cache.md
+++ b/products/workers/src/content/runtime-apis/cache.md
@@ -1,12 +1,16 @@
+---
+pcx-content-type: configuration
+---
+
 # Cache
 
 ## Background
 
-The Cache API allows fine grained control of reading and writing from cache, and deciding exactly when to fetch data from your origin.
+The [Cache API](https://developer.mozilla.org/en-US/docs/Web/API/Cache) allows fine grained control of reading and writing from the [Cloudflare edge network](https://www.cloudflare.com/network/) cache.
 
-For each individual zone, the Cloudflare Workers runtime exposes a single global cache object: `caches.default`. Though this cache object persists on all of Cloudflare’s data centers, objects are not replicated to any other data centers.
+The Cache API is available globally but the contents of the cache do not replicate outside of the originating data center. A `GET /users` response can be cached in the originating data center, but will not exist in another data center unless it has been explicitly created. 
 
-The Service Workers Cache API is currently unimplemented in the Cloudflare Workers Preview. Cache API operations in the preview will have no impact. You must deploy the Worker on a zone to test cache operations.
+However, any Cache API operations in the Cloudflare Workers dashboard editor, [Playground](/learning/playground) previews, and any `*.workers.dev` deployments will have no impact. Only Workers deployed to custom domains have access to functional `Cache` operations. 
 
 <Aside>
 
@@ -16,13 +20,22 @@ __Note:__ This individualized zone cache object differs from Cloudflare’s Glob
 
 --------------------------------
 
-## Constructor
+## Accessing Cache 
+
+The `caches.default` API is strongly influenced by the web browsers’ Cache API, but there are some important differences. For instance, Cloudflare Workers runtime exposes a single global cache object.
+
+```js
+let cache = caches.default;
+await cache.match(request);
+```
+
+You may create and manage additional Cache instances via the [`caches.open`](https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage/open) method.
 
 ```js
-let cache = caches.default
+let myCache = await caches.open('custom:cache');
+await myCache.match(request);
 ```
 
-This API is strongly influenced by the web browsers’ Cache API, but there are some important differences. For instance, Cloudflare Workers runtime exposes a single global cache object.
 
 --------------------------------
 
@@ -126,7 +139,7 @@ Our implementation of the Cache API respects the following HTTP headers on the r
 <Definitions>
 
 - `Range`
-    - Results in a `206` response if a matching response is found. Your Cloudflare cache always respects range requests, even if an `Accept-Ranges` header is on the response.
+    - Results in a `206` response if a matching response with a Content-Length header is found. Your Cloudflare cache always respects range requests, even if an `Accept-Ranges` header is on the response.
 
 - `If-Modified-Since`
     - Results in a `304` response if a matching response is found with a `Last-Modified` header with a value after the time specified in `If-Modified-Since`.
diff --git a/products/workers/src/content/runtime-apis/durable-objects.md b/products/workers/src/content/runtime-apis/durable-objects.md
index 8dc503d396e..ad167ee3459 100644
--- a/products/workers/src/content/runtime-apis/durable-objects.md
+++ b/products/workers/src/content/runtime-apis/durable-objects.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Durable Objects
 
 <Aside type="warning" header="Beta">
@@ -60,7 +64,7 @@ Each method is implicitly wrapped inside a transaction, such that its results ar
 
   - Retrieves the value associated with the given key. The type of the returned value will be whatever was previously written for the key, or undefined if the key does not exist.
 
-- <Code>get(keys<ParamType>Array&lt;String></ParamType>)</Code> <Type>Promise&lt;Map&lt;string, any>></Type>
+- <Code>get(keys<ParamType>Array&lt;string></ParamType>)</Code> <Type>Promise&lt;Map&lt;string, any>></Type>
 
   - Retrieves the values associated with each of the provided keys. The type of each returned value in the [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) will be whatever was previously written for the corresponding key. Any keys that do not exist will be omitted from the result Map. Supports up to 128 keys at a time.
 
@@ -76,13 +80,13 @@ Each method is implicitly wrapped inside a transaction, such that its results ar
 
   - Deletes the key and associated value. Returns true if the key existed or false if it didn't.
 
-- <Code>delete(keys<ParamType>Array&lt;String></ParamType>)</Code> <Type>Promise&lt;number></Type>
+- <Code>delete(keys<ParamType>Array&lt;string></ParamType>)</Code> <Type>Promise&lt;number></Type>
 
   - Deletes the provided keys and their associated values. Returns a count of the number of key-value pairs deleted.
 
 - <Code>list()</Code> <Type>Promise&lt;Map&lt;string, any>></Type>
 
-  - Returns all keys and values associated with the current Durable Object in ascending lexicographic sorted order. The type of each returned value in the [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) will be whatever was previously written for the corresponding key. Be aware of how much data may be stored in your actor before calling this version of `list` without options, because it will all be loaded into the Durable Object's memory, potentially hitting its [limit](/platform/limits). If that is a concern, pass options to `list` as documented below.
+  - Returns all keys and values associated with the current Durable Object in ascending lexicographic sorted order. The type of each returned value in the [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) will be whatever was previously written for the corresponding key. Be aware of how much data may be stored in your Durable Object before calling this version of `list` without options, because it will all be loaded into the Durable Object's memory, potentially hitting its [limit](/platform/limits). If that is a concern, pass options to `list` as documented below.
 
 - <Code>list(options<ParamType>Object</ParamType>)</Code> <Type>Promise&lt;Map&lt;string, any>></Type>
 
@@ -140,12 +144,6 @@ The `fetch()` method of a Durable Object namespace is called by the system when
 
 The method takes a [`Request`](/runtime-apis/request) as the parameter, and returns a [`Response`](/runtime-apis/response) (or a `Promise` for a `Response`).
 
-<Aside>
-
-  `request.cf` is currently not available within a Durable Object's `fetch()` handler.
-
-</Aside>
-
 If the method fails with an uncaught exception, the exception will be thrown into the calling worker that made the `fetch()` request.
 
 --------------------------------
diff --git a/products/workers/src/content/runtime-apis/encoding.md b/products/workers/src/content/runtime-apis/encoding.md
index 8f2979f8689..ed906373247 100644
--- a/products/workers/src/content/runtime-apis/encoding.md
+++ b/products/workers/src/content/runtime-apis/encoding.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Encoding
 
 ## TextEncoder
@@ -27,7 +31,7 @@ let encoder = new TextEncoder()
 
 <Definitions>
 
-- <Code>encode(input<TypeLink href="https://developer.mozilla.org/en-US/docs/Web/API/USVString">USVString</TypeLink>)</Code> <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Typed_arrays/Uint8Array">Uint8Array</TypeLink>
+- <Code>encode(input<TypeLink href="https://developer.mozilla.org/en-US/docs/Web/API/USVString">USVString</TypeLink>)</Code> <TypeLink href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array">Uint8Array</TypeLink>
 
   - Encodes a string input.
 
diff --git a/products/workers/src/content/runtime-apis/fetch-event.md b/products/workers/src/content/runtime-apis/fetch-event.md
index d6f0c05911b..11a5d09b84d 100644
--- a/products/workers/src/content/runtime-apis/fetch-event.md
+++ b/products/workers/src/content/runtime-apis/fetch-event.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # FetchEvent
 
 ## Background
diff --git a/products/workers/src/content/runtime-apis/fetch.md b/products/workers/src/content/runtime-apis/fetch.md
index 453620af4e2..ecfda2ae7c5 100644
--- a/products/workers/src/content/runtime-apis/fetch.md
+++ b/products/workers/src/content/runtime-apis/fetch.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Fetch
 
 The [Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) provides an interface for asynchronously fetching resources via HTTP requests inside of a Worker.
@@ -10,6 +14,12 @@ __Note:__ Asynchronous tasks such as `fetch` are not executed at the top level i
 
 </Aside>
 
+<Aside type="warning" header="Warning">
+
+It is not currently possible to send fetch requests to other Workers (Worker to Worker) within the same zone. The origin server, if any, will receive the request instead. However, sending requests to Workers within other zones is possible and will work as normal. 
+
+</Aside>
+
 --------------------------------
 
 ## Constructor
diff --git a/products/workers/src/content/runtime-apis/headers.md b/products/workers/src/content/runtime-apis/headers.md
new file mode 100644
index 00000000000..7c6760e1040
--- /dev/null
+++ b/products/workers/src/content/runtime-apis/headers.md
@@ -0,0 +1,60 @@
+---
+pcx-content-type: configuration
+---
+
+# Headers
+
+## Background
+
+All HTTP request and response headers are available through the [Headers API](https://developer.mozilla.org/en-US/docs/Web/API/Headers).
+
+When a header name possesses multiple values, those values will be concatenated as a single, comma-delimited string value. This means that `Headers.get` will always return a string or a `null` value. This applies to all header names except for `Set-Cookie`, which requires `Headers.getAll`. This is documented below in [Differences](#differences). 
+
+```js
+let headers = new Headers;
+
+headers.get('x-foo'); //=> null
+
+headers.set('x-foo', '123');
+headers.get('x-foo'); //=> "123"
+
+headers.set('x-foo', 'hello');
+headers.get('x-foo'); //=> "hello"
+
+headers.append('x-foo', 'world');
+headers.get('x-foo'); //=> "hello, world"
+```
+
+## Differences
+
+* Despite the fact that the `Headers.getAll` method has been made obsolete, Cloudflare still offers this method but only for use with the `Set-Cookie` header. This is because cookies will often contain date strings, which include commas. This can make parsing multiple values in a `Set-Cookie` header more difficult. Any attempts to use `Headers.getAll` with other header names will throw an error. A brief history `Headers.getAll` is available in this [GitHub issue](https://github.com/whatwg/fetch/issues/973). 
+
+* In Cloudflare Workers, the `Headers.get` method returns a [`USVString`](https://developer.mozilla.org/en-US/docs/Web/API/USVString) instead of a [`ByteString`](https://developer.mozilla.org/en-US/docs/Web/API/ByteString), which is specified by the spec. For most scenarios, this should have no noticeable effect. To compare the differences between these two string classes, please refer to this [Playground example](https://cloudflareworkers.com/#97c644202d0ef43fd73acb6b045529e8:https://tutorial.cloudflareworkers.com).
+
+## Cloudflare headers
+
+Cloudflare sets a number of its own custom headers on incoming requests and outgoing responses. While some may be used for its own tracking and bookkeeping, many of these can be useful to your own applications – or Workers – too.
+
+### Request headers
+
+* `CF-Connecting-IP`: In same-zone Worker subrequests, the value of `CF-Connecting-IP` reflects the value of `x-real-ip` (the client’s IP). `x-real-ip` can be altered by the user in their Worker script.
+
+    In cross-zone subrequests from one Cloudflare customer zone to another Cloudflare customer zone, the `CF-Connecting-IP` value will be set to the Worker client IP address `'2a06:98c0:3600::103'` for security reasons. 
+
+    For Worker subrequests destined for a non-Cloudflare customer zone, the `CF-Connecting-IP` and `x-real-ip` headers will both reflect the client's IP address, with only the `x-real-ip` header able to be altered.
+
+    When no Worker subrequest is triggered, `cf-connecting-ip` reflects the client's IP address and the `x-real-ip` header is stripped.
+
+* `CF-Worker`: Added to all Worker subrequests sent via `fetch()`. Set to the name of the zone which owns the Worker making the subrequest. For example, a Worker script on route for `foo.example.com/*` from `example.com` will have all subrequests with the header:
+
+    `CF-Worker`: `example.com`
+
+    The intended purpose of this header is to provide a means for recipients (e.g., origins, load balancers, other Workers) to recognize, filter, and route traffic generated by Workers on specific zones.
+
+    <Aside type="note">
+
+    When configuring Cloudflare Firewall Rules, do not match on this header. Firewall Rules are applied before Cloudflare adds the `CF-Worker` header. Instead, use the `cf.worker.upstream_zone`(https://tinyurl.com/2wx4senh) dynamic field, which contains the same value and exists for the same purpose.
+
+    </Aside>
+
+* `CF-EW-Via`: Used for loop detection, similar to the `CDN-Loop` [header](https://blog.cloudflare.com/preventing-request-loops-using-cdn-loop/).
diff --git a/products/workers/src/content/runtime-apis/html-rewriter.md b/products/workers/src/content/runtime-apis/html-rewriter.md
index 3e98ac52466..cf9c81f0289 100644
--- a/products/workers/src/content/runtime-apis/html-rewriter.md
+++ b/products/workers/src/content/runtime-apis/html-rewriter.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # HTMLRewriter
 
 ## Background
@@ -177,11 +181,11 @@ The `element` argument, used only in element handlers, is a representation of a
 
   - Replaces content of the element.
 
-- <Code>remove(content<ParamType>Content</ParamType>, contentOptions<ParamType>ContentOptions</ParamType><PropMeta>optional</PropMeta>)</Code> <Type>Element</Type>
+- <Code>remove()</Code> <Type>Element</Type>
 
   - Removes the element with all its content.
 
-- <Code>removeAndKeepContent(content<ParamType>Content</ParamType>, contentOptions<ParamType>ContentOptions</ParamType><PropMeta>optional</PropMeta>)</Code> <Type>Element</Type>
+- <Code>removeAndKeepContent()</Code> <Type>Element</Type>
 
   - Removes the start tag and end tag of the element, but keeps its inner content intact.
 
@@ -430,4 +434,4 @@ async function handle(request) {
 
 - [Introducing `HTMLRewriter`](https://blog.cloudflare.com/introducing-htmlrewriter/)
 - [Tutorial: Localize a Website](/tutorials/localize-a-website)
-- [Example: rewrite links](/examples/rewrite-links)
\ No newline at end of file
+- [Example: rewrite links](/examples/rewrite-links)
diff --git a/products/workers/src/content/runtime-apis/index.md b/products/workers/src/content/runtime-apis/index.md
index 573393b46ed..a5dc9ff2d60 100644
--- a/products/workers/src/content/runtime-apis/index.md
+++ b/products/workers/src/content/runtime-apis/index.md
@@ -1,5 +1,6 @@
 ---
 order: 6
+pcx-content-type: navigation
 ---
 
 # Runtime APIs
diff --git a/products/workers/src/content/runtime-apis/kv.md b/products/workers/src/content/runtime-apis/kv.md
index adda7293a4d..62563a2e9e4 100644
--- a/products/workers/src/content/runtime-apis/kv.md
+++ b/products/workers/src/content/runtime-apis/kv.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # KV
 
 ## Background
@@ -6,28 +10,10 @@ Workers KV is a global, low-latency, key-value data store. It supports exception
 
 Learn more about [How KV works](/learning/how-kv-works).
 
-To use Workers KV you must create a KV namespace and bind it to your worker. See the [instructions for Wrangler KV commands](/cli-wrangler/commands#kv) or the KV page of the [Workers dashboard](https://dash.cloudflare.com/?to=/:account/workers/kv/namespaces)
+To use Workers KV you must create a KV namespace and add a [binding](/runtime-apis/kv#kv-bindings) to your Worker. See the [instructions for Wrangler KV commands](/cli-wrangler/commands#kv) or the KV page of the [Workers dashboard](https://dash.cloudflare.com/?to=/:account/workers/kv/namespaces)
 
 --------------------------------
 
-## Using KV with Durable Objects
-
-The docs below assume you're using the original service worker syntax, where binding a KV namespace makes it available as a global variable with the name you chose, e.g. `NAMESPACE`. Durable Objects use modules syntax, so instead of a global variable, bindings are available as properties of the `env` parameter [passed to the constructor](/runtime-apis/durable-objects#durable-object-class-definition). A typical example might look like:
-
-```js
-export class DurableObject {
-  constructor(state, env) {
-    this.state = state
-    this.env = env
-  }
-
-  async fetch(request) {
-    const valueFromKV = await this.env.NAMESPACE.get('someKey')
-    return new Response(valueFromKV)
-  }
-}
-```
-
 ## Methods
 
 ### Writing key-value pairs
@@ -43,7 +29,7 @@ await NAMESPACE.put(key, value)
 <Definitions>
 
   - `key` <Type>string</Type>
-    - The key to associate with the value
+    - The key to associate with the value. A key cannot be empty, `.` or `..`. All other keys are valid.
 
   - `value` <Type>string</Type> | <Type>ReadableStream</Type> | <Type>ArrayBuffer</Type>
     -  The value to store. The type is inferred.
@@ -59,7 +45,7 @@ Wrangler](/cli-wrangler/commands#kvkey).
 
 Finally, you can [write data via the API](https://api.cloudflare.com/#workers-kv-namespace-write-key-value-pair).
 
-Due to the eventually consistent nature of Workers KV, concurrent writes from different edge locations can end up up overwriting one another. It’s a common pattern to write data via Wrangler or the API but read the data from within a worker, avoiding this issue by issuing all writes from the same location.
+Due to the eventually consistent nature of Workers KV, concurrent writes from different edge locations can end up overwriting one another. It’s a common pattern to write data via Wrangler or the API but read the data from within a worker, avoiding this issue by issuing all writes from the same location.
 
 Writes are immediately visible to other requests in the same edge location, but can take up to 60 seconds to be visible in other parts of the world. See [How KV works](/learning/how-kv-works) for more on this topic.
 
@@ -130,7 +116,7 @@ addEventListener("fetch", event => {
 })
 
 async function handleRequest(request) {
-  const value = await FIRST_KV_NAMESPACE.get("first-key")
+  const value = await NAMESPACE.get("first-key")
   if (value === null) {
     return new Response("Value not found", {status: 404})
   }
@@ -278,6 +264,65 @@ const cursor = value.cursor
 
 const next_value = await NAMESPACE.list({"cursor": cursor})
 ```
+## KV bindings
+
+### Referencing KV from Workers 
+
+A KV namespace is a key-value database that is replicated to Cloudflare's edge. To connect to a KV namespace from within a Worker, you must define a binding that points to the namespace's ID.
+
+The name of your binding **does not** need to match the KV namespace's name. Instead, the binding should be a valid JavaScript identifier because it will exist as a global variable within your Worker.
+
+This is not the case with modules, see [next section](/runtime-apis/kv#referencing-kv-from-durable-objects-and-workers-using-modules-syntax).
+
+When you create a namespace (see note below), it will have a name you choose (e.g. "My tasks"), and an assigned ID (e.g. "06779da6940b431db6e566b4846d64db")
+
+For your Worker to execute properly, we need to define the binding (called `TODO` below). In the `kv_namespaces` portion of your `wrangler.toml` file, add:
+
+```toml
+name = "worker"
+
+# ...
+
+kv_namespaces = [ 
+  { binding = "TODO", id = "06779da6940b431db6e566b4846d64db" }
+]
+```
+
+With this, the deployed Worker will have a `TODO` global variable; any reads, writes, or deletes on `TODO` will map to the KV namespace with an ID of "06779da6940b431db6e566b4846d64db" – which you called "My Tasks" earlier.
+
+```js
+addEventListener('fetch', async event => {
+  // Get the value for the "to-do:123" key
+  // NOTE: Relies on the `TODO` KV binding that maps to the "My Tasks" namespace!
+  let value = await TODO.get('to-do:123');
+
+  // Return the value, as is, for the Response
+  event.respondWith(new Response(value));
+});
+```
+<Aside>
+  
+You can create a namespace <a href="https://developers.cloudflare.com/workers/cli-wrangler/commands#getting-started">using Wrangler</a> or in the <a href="https://dash.cloudflare.com/">Workers dashboard</a> on the KV page. For the dashboard, you can bind the namespace to your Worker by clicking "Settings" and adding a binding under "KV Namespace Bindings".
+
+</Aside>
+
+### Referencing KV from Durable Objects and Workers using Modules Syntax
+
+The docs above assume you're using the original service worker syntax, where binding a KV namespace makes it available as a global variable with the name you chose, e.g. `NAMESPACE`. Durable Objects use modules syntax, so instead of a global variable, bindings are available as properties of the `env` parameter [passed to the constructor](/runtime-apis/durable-objects#durable-object-class-definition). A typical example might look like:
+
+```js
+export class DurableObject {
+  constructor(state, env) {
+    this.state = state
+    this.env = env
+  }
+
+  async fetch(request) {
+    const valueFromKV = await this.env.NAMESPACE.get('someKey')
+    return new Response(valueFromKV)
+  }
+}
+```
 
 ## See Also
 
diff --git a/products/workers/src/content/runtime-apis/request.md b/products/workers/src/content/runtime-apis/request.md
index bcdec967cce..dda794d7ad4 100644
--- a/products/workers/src/content/runtime-apis/request.md
+++ b/products/workers/src/content/runtime-apis/request.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Request
 
 The `Request` interface represents an HTTP request, and is part of the Fetch API.
@@ -259,6 +263,12 @@ All plans have access to:
 
 </Definitions>
 
+<Aside>
+
+The `request.cf` object is not available in the Cloudflare Workers dashboard or Playground preview editor.
+
+</Aside>
+
 --------------------------------
 
 ## Methods
@@ -339,6 +349,6 @@ listener will never be registered.
 
 ## See also
 
-- [Examples: Modify request property](examples/modify-request-property)
+- [Examples: Modify request property](/examples/modify-request-property)
 - [Examples: Accessing the `cf` object](/examples/accessing-the-cloudflare-object)
 - [Reference: `Response`](/runtime-apis/response)
diff --git a/products/workers/src/content/runtime-apis/response.md b/products/workers/src/content/runtime-apis/response.md
index c5439143e37..0bcb2806c38 100644
--- a/products/workers/src/content/runtime-apis/response.md
+++ b/products/workers/src/content/runtime-apis/response.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Response
 
 ## Constructor
@@ -65,7 +69,7 @@ Valid options for the `options` object include:
 
 <!-- What type is this? WebSocket? -->
 - `webSocket`
-  - This is present in successful WebSocket handshake responses. For example, if a client sends a WebSocket upgrade request to an origin and a worker intercepts the request and then forwards it to the origin and the origin replies with a successful WebSocket upgrade response, the worker sees `response.webSocket`. This establishes a WebSocket connection proxied through a worker. Note that you cannot intercept data flowing over a WebSocket connection.
+  - This is present in successful WebSocket handshake responses. For example, if a client sends a WebSocket upgrade request to an origin and a worker intercepts the request and then forwards it to the origin and the origin replies with a successful WebSocket upgrade response, the Worker sees `response.webSocket`. This establishes a WebSocket connection proxied through a Worker. Note that you cannot intercept data flowing over a WebSocket connection.
 
 </Definitions>
 
@@ -85,7 +89,7 @@ Valid options for the `options` object include:
 
 ### Additional instance methods
 
-`Response` implements the [`Body`](https://developer.mozilla.org/en-US/docs/Web/API/Body) mixin of the [Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API), and therefore `Response` instances additionally have the following methods available:
+`Response` implements the [`Body`](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#body) mixin of the [Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API), and therefore `Response` instances additionally have the following methods available:
 
 <Definitions>
 
@@ -109,7 +113,7 @@ Valid options for the `options` object include:
 
 --------------------------------
 
-## See also
+## Additional information
 
 - [Examples: Modify response](/examples/modify-response)
 - [Examples: Conditional response](/examples/conditional-response)
diff --git a/products/workers/src/content/runtime-apis/scheduled-event.md b/products/workers/src/content/runtime-apis/scheduled-event.md
index 34b2bc4fe89..78e100bb597 100644
--- a/products/workers/src/content/runtime-apis/scheduled-event.md
+++ b/products/workers/src/content/runtime-apis/scheduled-event.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # ScheduledEvent
 
 ## Background
diff --git a/products/workers/src/content/runtime-apis/streams/index.md b/products/workers/src/content/runtime-apis/streams/index.md
index cb8b6a0c28c..5194da6d3e8 100644
--- a/products/workers/src/content/runtime-apis/streams/index.md
+++ b/products/workers/src/content/runtime-apis/streams/index.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: navigation
+---
+
 # Streams
 
 <DirectoryListing path="/runtime-apis/streams"/>
diff --git a/products/workers/src/content/runtime-apis/streams/readablestream.md b/products/workers/src/content/runtime-apis/streams/readablestream.md
index 42ff565ea50..95943308005 100644
--- a/products/workers/src/content/runtime-apis/streams/readablestream.md
+++ b/products/workers/src/content/runtime-apis/streams/readablestream.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # ReadableStream
 
 ## Background
diff --git a/products/workers/src/content/runtime-apis/streams/readablestreambyobreader.md b/products/workers/src/content/runtime-apis/streams/readablestreambyobreader.md
index 0f5aedd41c8..8443305da16 100644
--- a/products/workers/src/content/runtime-apis/streams/readablestreambyobreader.md
+++ b/products/workers/src/content/runtime-apis/streams/readablestreambyobreader.md
@@ -1,5 +1,6 @@
 ---
 title: ReadableStream BYOBReader
+pcx-content-type: configuration
 ---
 <!-- The space in the title was introduced to create a pleasing line-break in the title in the sidebar. -->
 
diff --git a/products/workers/src/content/runtime-apis/streams/readablestreamdefaultreader.md b/products/workers/src/content/runtime-apis/streams/readablestreamdefaultreader.md
index 75f7ea86564..f5eece87228 100644
--- a/products/workers/src/content/runtime-apis/streams/readablestreamdefaultreader.md
+++ b/products/workers/src/content/runtime-apis/streams/readablestreamdefaultreader.md
@@ -1,5 +1,6 @@
 ---
 title: ReadableStream DefaultReader
+pcx-content-type: configuration
 ---
 <!-- The space in the title was introduced to create a pleasing line-break in the title in the sidebar. -->
 
diff --git a/products/workers/src/content/runtime-apis/streams/transformstream.md b/products/workers/src/content/runtime-apis/streams/transformstream.md
index 49670bd455d..c02bb1db416 100644
--- a/products/workers/src/content/runtime-apis/streams/transformstream.md
+++ b/products/workers/src/content/runtime-apis/streams/transformstream.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # TransformStream
 
 ## Background
diff --git a/products/workers/src/content/runtime-apis/streams/writablestream.md b/products/workers/src/content/runtime-apis/streams/writablestream.md
index 196ef987add..16114e3c353 100644
--- a/products/workers/src/content/runtime-apis/streams/writablestream.md
+++ b/products/workers/src/content/runtime-apis/streams/writablestream.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # WritableStream
 
 ## Background
diff --git a/products/workers/src/content/runtime-apis/streams/writablestreamdefaultwriter.md b/products/workers/src/content/runtime-apis/streams/writablestreamdefaultwriter.md
index f6df043dcd7..766dbe96faa 100644
--- a/products/workers/src/content/runtime-apis/streams/writablestreamdefaultwriter.md
+++ b/products/workers/src/content/runtime-apis/streams/writablestreamdefaultwriter.md
@@ -1,5 +1,6 @@
 ---
 title: WritableStream DefaultWriter
+pcx-content-type: configuration
 ---
 <!-- The space in the title was introduced to create a pleasing line-break in the title in the sidebar. -->
 
diff --git a/products/workers/src/content/runtime-apis/web-crypto.md b/products/workers/src/content/runtime-apis/web-crypto.md
index 3dad519fc29..387e3305158 100644
--- a/products/workers/src/content/runtime-apis/web-crypto.md
+++ b/products/workers/src/content/runtime-apis/web-crypto.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # Web Crypto
 
 ## Background
@@ -267,30 +271,46 @@ These methods are all accessed via `crypto.subtle`, which is also [documented in
 
 ### Supported algorithms
 
-Workers implements a subset of the most common cryptographic algorithms, as shown in the following table. We are happy to add support for more algorithms — [let us know about your use case](https://community.cloudflare.com/c/developers/workers).
+Workers implements all operation of the [WebCrypto standard](https://www.w3.org/TR/WebCryptoAPI), as shown in the following table.
+We are happy to add support for more algorithms — [let us know about your use case](https://community.cloudflare.com/c/developers/workers).
+
+A checkmark (✓) indicates that this feature is believed to be fully supported according to the spec.
+[//]: #  An x (✘) indicates that this feature is part of the specification but not implemented.
+[//]: #  If a feature only implements the operation partially, details are listed.
 
 <TableWrap>
 
-| Algorithm                                 | sign()<br/>verify() | encrypt()<br/>decrypt() | digest() | deriveBits()<br/>deriveKey() | generateKey() | wrapKey()<br/>unwrapKey() | exportKey() |
-| :---------------------------------------- | :------------------ | :---------------------- | :------- | :--------------------------- | :------------ | :------------------------ | ----------- |
-| RSASSA-PKCS1-v1_5                         | ✓                   |                         |          |                              | ✓             |                           | ✓           |
-| RSA-PSS                                   | ✓                   |                         |          |                              | ✓             |                           | ✓           |
-| ECDSA                                     | ✓                   |                         |          |                              |               |                           | ✓           |
-| HMAC                                      | ✓                   |                         |          |                              | ✓             |                           |             |
-| AES-CBC                                   |                     | ✓                       |          |                              |               | ✓                         |             |
-| AES-GCM                                   |                     | ✓                       |          |                              | ✓             | ✓                         |             |
-| SHA-1                                     |                     |                         | ✓        |                              |               |                           |             |
-| SHA-256                                   |                     |                         | ✓        |                              |               |                           |             |
-| SHA-384                                   |                     |                         | ✓        |                              |               |                           |             |
-| SHA-512                                   |                     |                         | ✓        |                              |               |                           |             |
-| MD5<sup><a href="#footnote-1">1</a></sup> |                     |                         | ✓        |                              |               |                           |             |
-| PBKDF2                                    |                     |                         |          | ✓                            |               |                           |             |
+| Algorithm                                         | sign()<br/>verify()  | encrypt()<br/>decrypt()   | digest() | deriveBits()<br/>deriveKey() | generateKey() | wrapKey()<br/>unwrapKey() | exportKey() | importKey() |
+| :------------------------------------------------ | :------------------- | :------------------------ | :------- | :--------------------------- | :------------ | :------------------------ | :---------- | :---------- |
+| RSASSA PKCS1 v1.5                                 | ✓                    |                           |          |                              | ✓             |                           | ✓           | ✓           |
+| RSA PSS                                           | ✓                    |                           |          |                              | ✓             |                           | ✓           | ✓           |
+| RSA OAEP                                          |                      | ✓                         |          |                              | ✓             | ✓                         | ✓           | ✓           |
+| ECDSA                                             | ✓                    |                           |          |                              | ✓             |                           | ✓           | ✓           |
+| ECDH                                              |                      |                           |          | ✓                            | ✓             |                           | ✓           | ✓           |
+| NODE ED25519<sup><a href="#footnote 1">1</a></sup>| ✓                    |                           |          |                              | ✓             |                           | ✓           | ✓           |
+| AES CTR                                           |                      | ✓                         |          |                              | ✓             | ✓                         | ✓           | ✓           |
+| AES CBC                                           |                      | ✓                         |          |                              | ✓             | ✓                         | ✓           | ✓           |
+| AES GCM                                           |                      | ✓                         |          |                              | ✓             | ✓                         | ✓           | ✓           |
+| AES KW                                            |                      |                           |          |                              | ✓             | ✓                         | ✓           | ✓           |
+| HMAC                                              | ✓                    |                           |          |                              | ✓             |                           | ✓           | ✓           |
+| SHA 1                                             |                      |                           | ✓        |                              |               |                           |             |             |
+| SHA 256                                           |                      |                           | ✓        |                              |               |                           |             |             |
+| SHA 384                                           |                      |                           | ✓        |                              |               |                           |             |             |
+| SHA 512                                           |                      |                           | ✓        |                              |               |                           |             |             |
+| MD5<sup><a href="#footnote 2">2</a></sup>         |                      |                           | ✓        |                              |               |                           |             |             |
+| HKDF                                              |                      |                           |          | ✓                            |               |                           |             | ✓           |
+| PBKDF2                                            |                      |                           |          | ✓                            |               |                           |             | ✓           |
 
 </TableWrap>
 
 __Footnotes:__
 
-1. <a name="footnote-1"></a> MD5 is not part of the WebCrypto standard, but is supported in Cloudflare Workers for interacting with legacy systems that require MD5. MD5 is considered a weak algorithm. Do not rely upon MD5 for security.
+1. <a name="footnote-1"></a> Non-standard EdDSA is supported for the Ed25519 curve. Since this algorithm is non-standard, a few things to keep in mind while using it:
+* Use <Code>NODE-ED25519</Code> as the algorithm and namedCurve parameters.
+* Unlike NodeJS, we will not support "raw" import of private keys.
+* Since this algorithm is non-standard, the implementation may change over time. While we cannot guarantee it at this time, we will strive to maintain backward compatabilityand compatability with NodeJS's behavior.
+Any notable compatability notes will be communicated in release notes and via this developer document.
+2. <a name="footnote-2"></a> MD5 is not part of the WebCrypto standard, but is supported in Cloudflare Workers for interacting with legacy systems that require MD5. MD5 is considered a weak algorithm. Do not rely upon MD5 for security.
 
 --------------------------------
 
@@ -298,4 +318,4 @@ __Footnotes:__
 
 - [SubtleCrypto documentation on MDN.](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto)
 - [SubtleCrypto documentation as part of the W3C Web Crypto API specification.](https://www.w3.org/TR/WebCryptoAPI/#subtlecrypto-interface)
-- [Example: signing requests](/examples/signing-requests)
\ No newline at end of file
+- [Example: signing requests](/examples/signing-requests)
diff --git a/products/workers/src/content/runtime-apis/web-standards.md b/products/workers/src/content/runtime-apis/web-standards.md
index 4eb21a4148a..ef5b71638a2 100644
--- a/products/workers/src/content/runtime-apis/web-standards.md
+++ b/products/workers/src/content/runtime-apis/web-standards.md
@@ -1,6 +1,7 @@
 ---
 title: Web standards
 order: 0
+pcx-content-type: configuration
 ---
 
 # JavaScript and web standards
diff --git a/products/workers/src/content/runtime-apis/websockets.md b/products/workers/src/content/runtime-apis/websockets.md
index d8e670b3354..4e14f1acb28 100644
--- a/products/workers/src/content/runtime-apis/websockets.md
+++ b/products/workers/src/content/runtime-apis/websockets.md
@@ -1,3 +1,7 @@
+---
+pcx-content-type: configuration
+---
+
 # WebSockets
 
 ## Background
@@ -100,10 +104,6 @@ An event indicating there was an error with the WebSocket.
 
 An event indicating a new message received from the client, including the data passed by the client.
 
-- `open`
-
-An event indicating the WebSocket has successfully opened.
-
 ## Types
 
 ### Message
diff --git a/products/workers/src/content/tutorials/authorize-users-with-auth0/index.md b/products/workers/src/content/tutorials/authorize-users-with-auth0/index.md
index 7076194c721..b8efae1055b 100644
--- a/products/workers/src/content/tutorials/authorize-users-with-auth0/index.md
+++ b/products/workers/src/content/tutorials/authorize-users-with-auth0/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-07-25
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/build-a-jamstack-app/index.md b/products/workers/src/content/tutorials/build-a-jamstack-app/index.md
index 708f3954a52..e56befd8fe6 100644
--- a/products/workers/src/content/tutorials/build-a-jamstack-app/index.md
+++ b/products/workers/src/content/tutorials/build-a-jamstack-app/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-03-09
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md
index fe9ae4ba070..207c98e28ee 100644
--- a/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md
+++ b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-03-09
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
@@ -50,8 +51,8 @@ addEventListener("fetch", event => {
  * Fetch and log a request
  * @param {Request} request
  */
-async function handleRequest(request) {
-  return new Response("Hello worker!", { status: 200 })
+function handleRequest(request) {
+  return new Response("Hello worker!")
 }
 ```
 
@@ -74,9 +75,9 @@ Currently, our Workers function receives requests, and returns a simple response
 filename: "index.js"
 highlight: [2, 3, 4]
 ---
-async function handleRequest(request) {
+function handleRequest(request) {
   if (request.method === "POST") {
-    return new Response("Hello worker!", { status: 200 })
+    return new Response("Hello worker!")
   }
 }
 ```
@@ -88,9 +89,9 @@ Currently, if an incoming request isn’t a `POST`, we return `undefined`. Since
 filename: "index.js"
 highlight: [5]
 ---
-async function handleRequest(request) {
+function handleRequest(request) {
   if (request.method === "POST") {
-    return new Response("Hello worker!", { status: 200 })
+    return new Response("Hello worker!")
   }
   return new Response("Expected POST", { status: 405 })
 }
@@ -103,8 +104,9 @@ With the basic flow of `handleRequest` established, it’s time to think about h
 filename: "index.js"
 highlight: [1, 2, 3]
 ---
-const generate = async request => {
-  return new Response("Hello worker!", { status: 200 })
+async function generate(request) {
+  // TODO: Include QR code generation
+  return new Response("Hello worker!")
 }
 
 async function handleRequest(request) {
@@ -112,17 +114,17 @@ async function handleRequest(request) {
 }
 ```
 
-With the `generate` function filled out, we can `await` the generation to finish in `handleRequest`, and return it to the client:
+With the `generate` function filled out, we can call it within `handleRequest` and return its result directly to the client:
 
 ```js
 ---
 filename: "index.js"
 highlight: [4]
 ---
-async function handleRequest(request) {
+function handleRequest(request) {
   // ...
   if (request.method === "POST") {
-    return await generate(request)
+    return generate(request)
   // ...
 }
 ```
@@ -159,7 +161,7 @@ highlight: [1, 2, 3, 4, 5, 6]
 ---
 const qr = require("qr-image")
 
-const generate = async request => {
+async function generate(request) {
   const { text } = await request.json()
   const qr_png = qr.imageSync(text || "https://workers.dev")
 }
@@ -172,7 +174,7 @@ By default, the QR code is generated as a PNG. Construct a new instance of `Resp
 filename: "index.js"
 highlight: [3, 5]
 ---
-const generate = async request => {
+async function generate(request) {
   const { text } = await request.json()
   const headers = { "Content-Type": "image/png" }
   const qr_png = qr.imageSync(text || "https://workers.dev")
@@ -206,11 +208,15 @@ const landing = `
 </script>
 `
 
-async function handleRequest(request) {
+function handleRequest(request) {
   if (request.method === "POST") {
-    return await generate(request)
+    return generate(request)
   }
-  return new Response(landing, { headers: { "Content-Type": "text/html" } })
+  return new Response(landing, {
+    headers: {
+      "Content-Type": "text/html"
+    }
+  })
 }
 ```
 
@@ -224,7 +230,7 @@ filename: "index.js"
 ---
 const qr = require("qr-image")
 
-const generate = async request => {
+async function generate(request) {
   const { text } = await request.json()
   const headers = { "Content-Type": "image/png" }
   const qr_png = qr.imageSync(text || "https://workers.dev")
@@ -248,11 +254,15 @@ const landing = `
 </script>
 `
 
-async function handleRequest(request) {
+function handleRequest(request) {
   if (request.method === "POST") {
-    return await generate(request)
+    return generate(request)
   }
-  return new Response(landing, { headers: { "Content-Type": "text/html" } })
+  return new Response(landing, {
+    headers: {
+      "Content-Type": "text/html"
+    }
+  })
 }
 
 addEventListener("fetch", event => {
diff --git a/products/workers/src/content/tutorials/build-a-serverless-api/index.md b/products/workers/src/content/tutorials/build-a-serverless-api/index.md
new file mode 100644
index 00000000000..a7339264def
--- /dev/null
+++ b/products/workers/src/content/tutorials/build-a-serverless-api/index.md
@@ -0,0 +1,9 @@
+---
+updated: 2021-06-03
+difficulty: Intermediate
+content_type: "🎥 Video"
+url: "https://egghead.io/courses/build-a-serverless-api-with-cloudflare-workers-d67ca551?af=a54gwi"
+pcx-content-type: tutorial
+---
+
+# Build a Serverless API with Cloudflare Workers
diff --git a/products/workers/src/content/tutorials/build-a-slackbot/index.md b/products/workers/src/content/tutorials/build-a-slackbot/index.md
index 5d25f4029da..8f9fb4cb5a2 100644
--- a/products/workers/src/content/tutorials/build-a-slackbot/index.md
+++ b/products/workers/src/content/tutorials/build-a-slackbot/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-03-10
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
@@ -632,7 +633,7 @@ The constant `SLACK_WEBHOOK_URL` represents the Slack Webhook URL that you creat
 ---
 header: Set the SLACK_WEBHOOK_URL secret
 ---
-$ wrangler secret create SLACK_WEBHOOK_URL
+$ wrangler secret put SLACK_WEBHOOK_URL
 Enter the secret text you’d like assigned to the variable name on the script named slack-bot-ENVIRONMENT_NAME: https://hooks.slack.com/services/abc123
 ```
 
diff --git a/products/workers/src/content/tutorials/configure-your-cdn/index.md b/products/workers/src/content/tutorials/configure-your-cdn/index.md
index eae3bd403f2..625bce189bb 100644
--- a/products/workers/src/content/tutorials/configure-your-cdn/index.md
+++ b/products/workers/src/content/tutorials/configure-your-cdn/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-04-15
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/deploy-a-react-app-with-create-react-app/index.md b/products/workers/src/content/tutorials/deploy-a-react-app-with-create-react-app/index.md
index 81378de208e..f4bd48dfb33 100644
--- a/products/workers/src/content/tutorials/deploy-a-react-app-with-create-react-app/index.md
+++ b/products/workers/src/content/tutorials/deploy-a-react-app-with-create-react-app/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-06-01
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
@@ -50,6 +51,17 @@ $ wrangler init --site
 
 The `init --site` command will provide the scaffolding necessary to deploy your React application. For the majority of static sites, you shouldn’t need to change the Workers script: by default, the script will look at an incoming request, and will serve a corresponding asset from [Workers KV](https://www.cloudflare.com/products/workers-kv/) based on that route. For instance, if my static site is deployed at `mystaticsite.com`, requesting `mystaticsite.com/about.html` will look for a file in KV called `about.html`, and serve it back to the client. In addition, if the asset being returned from KV is cacheable, it will automatically be cached with Cloudflare’s CDN, making subsequent requests even faster.
 
+To serve a single page application, update `workers-site/index.js` with the following code to so that all html requests are pointed at your root `index.html` file.
+
+```js
+import { getAssetFromKV, serveSinglePageApp } from '@cloudflare/kv-asset-handler';
+
+async function handleEvent(event) {
+   ...
+   const asset = await getAssetFromKV(event, { mapRequestToAsset: serveSinglePageApp });
+}
+```
+
 ## Configure and publish
 
 To prepare your application for deployment, open up the newly-created `wrangler.toml` file, which represents the configuration for your Workers application. Using the [“Configuring your project” section of Getting started](/get-started/guide#6d-configuring-your-project) as a guide, populate `wrangler.toml` with your account ID, which will allow you to deploy your React application to your Cloudflare account.
diff --git a/products/workers/src/content/tutorials/deploy-a-static-wordpress-site/index.md b/products/workers/src/content/tutorials/deploy-a-static-wordpress-site/index.md
index 4537b4ed40c..a49c1932370 100644
--- a/products/workers/src/content/tutorials/deploy-a-static-wordpress-site/index.md
+++ b/products/workers/src/content/tutorials/deploy-a-static-wordpress-site/index.md
@@ -1,13 +1,20 @@
 ---
 updated: 2020-07-25
 difficulty: Intermediate
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
 
 # Deploy a static WordPress site
 
+<Aside type="warning" header="Warning">
+
+As of August 2020, the WP2Static plugin is closed for downloads on WordPress.org but is still available [on GitHub](https://github.com/leonstafford/wp2static).
+
+</Aside>
+
 <TutorialsBeforeYouStart/>
 
 ## Overview
diff --git a/products/workers/src/content/tutorials/github-sms-notifications-using-twilio/index.md b/products/workers/src/content/tutorials/github-sms-notifications-using-twilio/index.md
index 8099d11699c..f39d49db713 100644
--- a/products/workers/src/content/tutorials/github-sms-notifications-using-twilio/index.md
+++ b/products/workers/src/content/tutorials/github-sms-notifications-using-twilio/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-08-25
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-details.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-details.png
new file mode 100644
index 00000000000..f2334e5dbb2
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-details.png differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-key.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-key.png
new file mode 100644
index 00000000000..a6e474a6494
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/api-key.png differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/columns.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/columns.png
new file mode 100644
index 00000000000..184e5121a7b
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/columns.png differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/example.gif b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/example.gif
new file mode 100644
index 00000000000..2173bd65fb6
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/example.gif differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/form-submissions.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/form-submissions.png
new file mode 100644
index 00000000000..976105d1262
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/form-submissions.png differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/index.md b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/index.md
new file mode 100644
index 00000000000..f7c10dff496
--- /dev/null
+++ b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/index.md
@@ -0,0 +1,336 @@
+---
+updated: 2021-06-17
+difficulty: Beginner
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
+---
+
+import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
+
+# Handle form submissions with Airtable
+
+<TutorialsBeforeYouStart/>
+
+## Overview
+
+Cloudflare Workers excels as a performant serverless functions platform. This makes it a great fit for handling form submissions from your front-end applications, particularly when you need to send those submissions to an external API or database.
+
+In this tutorial, we'll use Workers and [Airtable](https://airtable.com) to persist form submissions from a front-end user interface. Airtable is a great, free-to-use spreadsheet solution that has an approachable API for developers. Workers will handle incoming form submissions, and use Airtable's [REST API](https://airtable.com/api) to asynchronously persist the data in an Airtable "base" (Airtable's term for a spreadsheet) for later reference.
+
+![Example GIF of complete Airtable and serverless function integration](./example.gif)
+
+[The source for this project can be found on GitHub](https://github.com/cloudflare/workers-airtable-form)—note that this codebase includes both a front-end component (built with [React](https://reactjs.org) and [Tailwind CSS](https://tailwindcss.com)), as well as a serverless function for handling the interaction with Airtable. 
+
+**[The front-end portion of this site](https://airtable-form-example.pages.dev) does not require any specific React experience.** It uses a basic HTML5 form, showing that you can use Workers to handle any kind of form, whether entirely in HTML, or client-side, JS-heavy forms, such as with React or other front-end frameworks.
+
+## Create a form
+
+To recap the basics of HTML5 forms, a `form` element generally contains an `action` attribute, which indicates the URL that the form will submit to. For instance, the below `form` will submit data to the path `/new_submission`:
+
+```html
+<form action="/new_submission">
+  <input type="text" name="first_name" id="first_name"></input>
+  <button type="submit">Submit</button>
+</form>
+```
+
+<Aside>
+
+If you're unfamiliar with HTML5 forms, the Mozilla Developer Network's ["Web Forms - Working with user data"](https://developer.mozilla.org/en-US/docs/Learn/Forms) is a great beginner's guide.
+
+</Aside>
+
+To pass data _inside_ of the form, you can use `input` tags. `input` tags have a `type`, which specifies how the `input` should render, and what kind of data it contains. When an `input` has a `name` attribute, the `form` will submit that data to the provided `action` URL, matching that `name` attribute. 
+
+<Aside>
+
+The `id` attribute, while not required for the `input` to be submitted as part of the `form`, [may be required to ensure accessibility](https://developer.mozilla.org/en-US/docs/Learn/Accessibility/HTML#meaningful_text_labels). If the `input` element is nested inside the `label`, the `id` is not required. If the `input` element is not nested inside the `label`, the `id` on the `input` is required along with the `for` (or `htmlFor` in React) property to ensure differently abled readers will get built-in accessibility features.
+
+Additionally, the `id` attribute is often set alongside the `name` attribute to enable styling via CSS.
+
+</Aside>
+
+For example, if I fill in the `first_name` `input` with the text "Kristian", submitting the `form` via the "Submit" `button` will submit data to the URL `/new_submission` with the data `first_name=Hello`.
+
+The `form` used in the example front-end UI builds on these basics, adding some CSS classes via Tailwind CSS, and adding the fields needed for a "Contact"-style form: "First name", "Last name", "Email", "Phone", "Subject", and "Message".
+
+![The completed form in the front-end user interface](./ui.png)
+
+The code for this form can be [found on GitHub](https://github.com/cloudflare/workers-airtable-form/blob/main/frontend/src/Form.js). Of particular note is the `form` action, which has a placeholder for our serverless function URL, and the `method` attribute, which tells the form to submit using an [HTTP POST](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/POST). 
+
+Some sample code is provided as an example below, including the first `input`, to show that the `name` is set to the value `first_name`, as well as the standard `button` with `type="submit"`:
+
+```html
+<form action="SERVERLESS_FN_URL" method="POST" class="...">
+  <div>
+    <label for="first_name" class="...">
+      First name
+    </label>
+    <div class="...">
+      <input
+        type="text"
+        name="first_name"
+        id="first_name"
+        autocomplete="given-name"
+        placeholder="Ellen"
+        required
+        class="..."
+      />
+    </div>
+  </div>
+
+  <!-- Rest of form -->
+
+  <button type="submit" class="...">
+    Submit
+  </button>
+</form>
+```
+
+If you'd like to follow along with this example, you can directly copy the `form` code from the [`Form` component](https://github.com/cloudflare/workers-airtable-form/blob/main/frontend/src/Form.js) into your own project, or use the codebase and plug in your own serverless function, following the next section in the tutorial. 
+
+## Create a serverless function
+
+In order to handle the form submission, we'll create and deploy a Workers serverless function that parses the incoming form data, and prepares it for submission to Airtable.
+
+To begin, use `wrangler` to generate a new function, called `airtable-form-handler`, and navigate to it in our terminal:
+
+```sh
+---
+header: Generating a new Workers function
+---
+$ wrangler generate airtable-form-handler
+$ cd airtable-form-handler
+```
+
+<Aside>
+
+If you've chosen to work with the [sample codebase on GitHub](https://github.com/cloudflare/workers-airtable-form), you can find a sample function in the `worker` directory.
+
+</Aside>
+
+In `wrangler.toml`, add your Cloudflare account ID:
+
+<Aside>
+
+[Check out our Quick Start guide](https://developers.cloudflare.com/workers/get-started/guide#7-configure-your-project-for-deployment) if you're unsure where to find your Cloudflare Account ID.
+
+</Aside>
+
+```toml
+---
+filename: wrangler.toml
+highlight: [4]
+---
+name = "airtable-form-handler"
+type = "javascript"
+
+account_id = "yourAccountId"
+```
+
+## Configure an Airtable base
+
+When our serverless function is completed, it will send data up to an Airtable base via Airtable's REST API.
+
+If you don't have an Airtable account, create one (the free plan is fine). In Airtable's dashboard, create a new base, choosing to "Start from scratch":
+
+![Creating a new base in Airtable's user interface](./new-base.png)
+
+Once you've created a new base, you can set it up for use with the front-end form. Delete the existing columns, and create six columns, with the following "field types":
+
+| Field name   | Airtable field type |
+| ------------ | ------------------- |
+| First Name   | "Single line text"  |
+| Last Name    | "Single line text"  |
+| Email        | "Email"             |
+| Phone Number | "Phone number"      |
+| Subject      | "Single line text"  |
+| Message      | "Long text"         |
+
+The completed fields should look like the below screenshot in the Airtable UI. Note that the field names are case-sensitive: if you change them to anything else, you'll need to exactly match your new field names in the API request we make to Airtable later in the tutorial.
+
+![An example of the configured Airtable column headers in a table](./columns.png)
+
+Finally, give your base's _table_ a name. Right-click the table name at the top left of the screen (it will likely have a name like "Table 1"), and give it a more descriptive name, like "Form Submissions".
+
+![Renaming the Airtable table inside of the user interface](./form-submissions.png)
+
+With our new Airtable base set up, we can grab the values from Airtable's UI that we need to make API requests.
+
+Visit [Airtable's API page](https://airtable.com/api), and select your new base. In the API documentation page, find your **Airtable base ID** (the highlighted text in the below screenshot). You can also check the "show API key" checkbox in the top right of the window, to easily access your Airtable API key from the same page.
+
+![The Airtable API documentation for a base, with the Airtable Base ID and a toggle for showing your Airtable API key highlighted](./api-details.png)
+
+Further down the page, you'll begin to see example requests, showing you how to authenticate with the Airtable API externally, by providing an `Authorization` header in the format `Bearer $API_KEY`. The key after `Bearer` is your Airtable API key—make sure to keep it a secret!
+
+![An example request in Airtable's API documentation, with the Airtable API key highlighted](./api-key.png)
+
+To make this API key available in your codebase, you can use the `wrangler secret` command. The `secret` command encrypts and stores environment variables for use in your function, without revealing them to users. 
+
+Run `wrangler secret put`, passing `AIRTABLE_API_KEY` as the name of your secret:
+
+```sh
+---
+header: Setting the AIRTABLE_API_KEY secret with Wrangler
+---
+$ wrangler secret put AIRTABLE_API_KEY
+Enter the secret text you would like assigned to the variable AIRTABLE_API_KEY on the script named airtable-form-handler:
+******
+🌀  Creating the secret for script name airtable-form-handler
+✨  Success! Uploaded secret AIRTABLE_API_KEY.
+```
+
+
+Before we continue, let's review the keys that we should have from Airtable:
+
+1. _Airtable Table Name:_ the name for your table, e.g. "Form Submissions".
+2. _Airtable Base ID:_ the alphanumeric base ID found at the top of your base's API page.
+3. _Airtable API Key:_ the private API key found in example API requests on the Airtable API documentation page.
+
+## Submit data to Airtable
+
+With our Airtable base set up, and the keys and IDs we need to communicate with the API at the ready, it's time to set up our Workers function, and persist data from our form into Airtable.
+
+In `index.js`, begin by setting up a simple Workers handler that can respond to requests. When the URL requested has a pathname of `/submit`, we'll handle a new form submission, otherwise, we'll redirect to `FORM_URL`, a constant representing your front-end form URL (for example, [airtable-form-example.pages.dev](https://airtable-form-example.pages.dev)):
+
+```js
+---
+filename: index.js
+---
+addEventListener('fetch', event => {
+  event.respondWith(handleRequest(event.request))
+})
+
+const FORM_URL = "https://airtable-form-example.pages.dev"
+
+async function handleRequest(request) {
+  const url = new URL(request.url)
+
+  if (url.pathname === "/submit") {
+    return submitHandler(request)
+  }
+
+  return new Response.redirect(FORM_URL)
+}
+```
+
+The `submitHandler` has two functions—first, it will parse the form data coming from our HTML5 form. Once the data is parsed, we'll use the Airtable API to persist a new _row_ (a new form submission) to our table:
+
+```js
+---
+filename: index.js
+---
+const submitHandler = async request => {
+  if (request.method !== "POST") {
+    return new Response("Method Not Allowed", {
+      status: 405
+    })
+  }
+
+  const body = await request.formData();
+
+  const {
+    first_name,
+    last_name,
+    email,
+    phone,
+    subject,
+    message
+  } = Object.fromEntries(body)
+
+  // The keys in "fields" are case-sensitive, and
+  // should exactly match the field names you set up 
+  // in your Airtable table, such as "First Name". 
+  const reqBody = {
+    fields: {
+      "First Name": first_name,
+      "Last Name": last_name,
+      "Email": email,
+      "Phone Number": phone,
+      "Subject": subject,
+      "Message": message
+    }
+  }
+
+  await createAirtableRecord(reqBody)
+  return Response.redirect(FORM_URL)
+}
+```
+
+While the majority of this function is concerned with parsing the request _body_ (the data being sent as part of the request), there are two important things to note. First, if the HTTP method sent to this function _isn't_ `POST`, we'll return a new response with the status code of [`405 Method Not Allowed`](https://httpstatuses.com/405). 
+
+The variable `reqBody` represents a collection of _fields_, which are key-value pairs for each column in our Airtable table. By formatting `reqBody` as an object with a collection of fields, we're creating a new record in our table with a value for each field.
+
+After we call `createAirtableRecord` (the function we'll define next), we'll redirect the client back to our `FORM_URL`. This function can be changed: for instance, to redirect to a "Thank You" page, or something similar.
+
+The `createAirtableRecord` function accepts a `body` parameter, which conforms to the Airtable API's required format—namely, a JavaScript object containing key-value pairs under `fields`, representing a single record to be created on our table:
+
+```js
+---
+filename: index.js
+---
+const createAirtableRecord = body => {
+  return fetch(`https://api.airtable.com/v0/${AIRTABLE_BASE_ID}/${encodeURIComponent(AIRTABLE_TABLE_NAME)}`, {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: {
+      Authorization: `Bearer ${AIRTABLE_API_KEY}`,
+      'Content-type': `application/json`
+    }
+  })
+}
+```
+
+To make an authenticated request to Airtable, we need to provide three constants that represent data about our Airtable account, base, and table name. We've already set `AIRTABLE_API_KEY` using `wrangler secret`, since it's a value that should be encrypted. The _Airtable base ID_ and _table name_ are values that can be publicly shared in places like GitHub. We can use Wrangler's `vars` feature to pass public environment variables from `wrangler.toml`. Add a `vars` table at the end of your `wrangler.toml` file, as seen below:
+
+```toml
+---
+filename: wrangler.toml
+highlight: [7]
+---
+name = "workers-airtable-form"
+type = "javascript"
+
+account_id = "yourAccountId"
+workers_dev = true
+
+[vars]
+AIRTABLE_BASE_ID = "exampleBaseId"
+AIRTABLE_TABLE_NAME = "Form Submissions"
+```
+
+With all these fields submitted, it's time to deploy your Workers serverless function, and get your form communicating with it. First, publish your function:
+
+```sh
+---
+header: Publishing the serverless function
+---
+$ wrangler publish
+✨  Built successfully, built project size is 10 KiB.
+✨  Successfully published your script to
+ https://workers-airtable-form.cloudflare.workers.dev
+```
+
+You'll notice that your function is deployed to a unique URL—for instance, `https://workers-airtable-form.cloudflare.workers.dev`. This represents the first part of your front-end form's `action` attribute—the second part is the _path_ for our form handler, which is `/submit`. In your front-end UI, configure your `form` tag as seen below:
+
+```html
+<form action="https://workers-airtable-form.cloudflare.workers.dev/submit" method="POST" class="...">
+<!-- The rest of your HTML form -->
+```
+
+Once you've deployed your new form (we recommend [Cloudflare Pages](https://pages.dev) for that), you should be able to submit a new form submission, and see the value show up immediately in Airtable:
+
+![Example GIF of complete Airtable and serverless function integration](./example.gif)
+
+## Conclusion
+
+With that, you've created a Workers serverless function that can accept form submissions, and persist them to Airtable. Along the way, we've learned how to parse form data, set up environment variables, and use the `fetch` API to make requests to external services outside of our Workers function.
+
+You can find the source for this project—both the front-end UI, as well as the serverless function that communicates with Airtable—[on GitHub](https://github.com/cloudflare/workers-airtable-form).
+
+See what else you can build with Workers with some of our other resources below!
+
+- [Build a Slackbot](https://developers.cloudflare.com/workers/tutorials/build-a-slackbot)
+- [Build a To-Do List Jamstack App](https://developers.cloudflare.com/workers/tutorials/build-a-jamstack-app)
+- [Build a blog using Nuxt.js and Sanity.io on Cloudflare Pages](https://developers.cloudflare.com/pages/tutorials/build-a-blog-using-nuxt-and-sanity)
+- [James Quick's video on building a Cloudflare Workers + Airtable integration](https://www.youtube.com/watch?v=tFQ2kbiu1K4)
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/new-base.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/new-base.png
new file mode 100644
index 00000000000..1bb871c0171
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/new-base.png differ
diff --git a/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/ui.png b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/ui.png
new file mode 100644
index 00000000000..1bcaf613a42
Binary files /dev/null and b/products/workers/src/content/tutorials/handle-form-submissions-with-airtable/ui.png differ
diff --git a/products/workers/src/content/tutorials/hello-world-rust/index.md b/products/workers/src/content/tutorials/hello-world-rust/index.md
index ad998892f1e..7be47253ed1 100644
--- a/products/workers/src/content/tutorials/hello-world-rust/index.md
+++ b/products/workers/src/content/tutorials/hello-world-rust/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-06-29
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
@@ -104,13 +105,15 @@ addEventListener('fetch', (event) => {
   event.respondWith(handleRequest(event.request))
 })
 
+const { parse } = wasm_bindgen;
+const instance =  wasm_bindgen(wasm);
+
 /**
  * Fetch and log a request
  * @param {Request} request
  */
 async function handleRequest(request) {
-  const { parse } = wasm_bindgen
-  await wasm_bindgen(wasm)
+  await instance;
   const output = parse()
   let res = new Response(output, { status: 200 })
   res.headers.set('Content-type', 'text/html')
diff --git a/products/workers/src/content/tutorials/index.md b/products/workers/src/content/tutorials/index.md
index 3cabc22f516..6f671c502f0 100644
--- a/products/workers/src/content/tutorials/index.md
+++ b/products/workers/src/content/tutorials/index.md
@@ -2,6 +2,7 @@
 type: overview
 hideChildren: true
 order: 3
+pcx-content-type: navigation
 ---
 
 import DocsTutorials from "../components/content-table"
diff --git a/products/workers/src/content/tutorials/introduction-to-cloudflare-workers/index.md b/products/workers/src/content/tutorials/introduction-to-cloudflare-workers/index.md
index 39649e38bbd..0f90bbac7de 100644
--- a/products/workers/src/content/tutorials/introduction-to-cloudflare-workers/index.md
+++ b/products/workers/src/content/tutorials/introduction-to-cloudflare-workers/index.md
@@ -1,8 +1,9 @@
 ---
 updated: 2021-01-25
 difficulty: Beginner
-type: "🎥 Video"
+content_type: "🎥 Video"
 url: "https://egghead.io/playlists/introduction-to-cloudflare-workers-5aa3?af=a54gwi"
+pcx-content-type: tutorial
 ---
 
 # Introduction to Cloudflare Workers
diff --git a/products/workers/src/content/tutorials/localize-a-website/index.md b/products/workers/src/content/tutorials/localize-a-website/index.md
index 76302d1491a..dcf92881e62 100644
--- a/products/workers/src/content/tutorials/localize-a-website/index.md
+++ b/products/workers/src/content/tutorials/localize-a-website/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-08-03
 difficulty: Intermediate
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/manage-projects-with-lerna/index.md b/products/workers/src/content/tutorials/manage-projects-with-lerna/index.md
index c51c5c34896..6a32ff96cf6 100644
--- a/products/workers/src/content/tutorials/manage-projects-with-lerna/index.md
+++ b/products/workers/src/content/tutorials/manage-projects-with-lerna/index.md
@@ -1,7 +1,8 @@
 ---
 updated: 2020-08-13
 difficulty: Beginner
-type: "📝 Tutorial"
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
 ---
 
 import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
diff --git a/products/workers/src/content/tutorials/postgres/example.gif b/products/workers/src/content/tutorials/postgres/example.gif
new file mode 100644
index 00000000000..a77ab8ee3ea
Binary files /dev/null and b/products/workers/src/content/tutorials/postgres/example.gif differ
diff --git a/products/workers/src/content/tutorials/postgres/index.md b/products/workers/src/content/tutorials/postgres/index.md
new file mode 100644
index 00000000000..f80ecced848
--- /dev/null
+++ b/products/workers/src/content/tutorials/postgres/index.md
@@ -0,0 +1,384 @@
+---
+updated: 2021-06-10
+difficulty: Intermediate
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
+---
+
+# Build data-driven applications with Workers and PostgreSQL
+
+## Overview
+
+Many applications for the web are built using industry standards like [PostgreSQL](https://postgresql.org), an open-source SQL database. Instead of directly connecting their user interface to that database, it is common for developers to use a backend server to format and proxy API requests to that database. Rather than building a back-end server for this task, you will make use of Cloudflare Workers and recent improvements to the PostgreSQL developer experience—namely, [PostgREST](https://postgrest.org): a REST API built specifically for PostgreSQL. By doing this, you will handle API requests to your database without needing to maintain another piece of infrastructure.
+
+In this tutorial, you will explore how to integrate with PostgREST and PostgreSQL using Workers.
+
+![Example GIF](./example.gif)
+
+## Prerequisites
+
+To effectively learn from this tutorial, you should have an instance of PostgreSQL configured. In addition, you will need to install PostgREST, a separate service that provides REST API access to your Postgres database.
+
+If you want a quick way to get up and running with these tools, refer to [postgres-postgrest-cloudflared-example](https://github.com/signalnerve/postgres-postgrest-cloudflared-example/), an example project that uses `docker-compose` to set up a PostgreSQL database, PostgREST, and `cloudflared`, which exposes the PostgREST endpoint to the Internet for use in your Workers function.
+
+In order to continue with the tutorial, ensure that you have a publicly accessible URL for your PostgREST endpoint.
+
+## Create a Workers function
+
+Begin by creating a new Workers function, running `wrangler generate`:
+
+```sh
+---
+header: Create a Workers function
+---
+$ wrangler generate postgrest-example
+$ cd postgrest-example
+```
+
+Inside of your Workers function, configure `wrangler.toml` with your account ID. Change the `type` value to "webpack" to use `webpack` for bundling the Workers function:
+
+```toml
+---
+filename: wrangler.toml
+highlight: [2, 3, 4]
+---
+name = "postgrest-worker-example"
+type = "webpack"
+
+account_id = "yourAccountId"
+```
+
+## Build an API using postgrest-js
+
+PostgREST provides a consistent REST API structure for use in your applications. Each _table_ in your PostgreSQL database has a separate path as `/:table_name`. Query parameters are used to do lookups in your database—for instance, to find all users with an ID of `1`, you make a `GET` request to `/users?id=eq.1`.
+
+The URL structure makes it great for exploration, but in an application, it would be better to have something easier to use. [postgrest-js](https://github.com/supabase/postgrest-js/) is an open-source package that wraps PostgREST in an expressive JavaScript API. You will use it in your project to build a few endpoints to work with your PostgreSQL database in a Workers function.
+
+Begin by installing `postgrest-js`:
+
+```sh
+---
+header: Installing postgrest-js
+---
+$ npm install @supabase/postgrest-js
+```
+
+Before beginning to work with `postgrest-js` in your application, you need to quickly patch `cross-fetch`, the internal tool that `postgrest-js` uses for making HTTP requests, with Workers' built-in `fetch` API. Do this by creating a custom Webpack config, and updating `wrangler.toml` to use it. Create `webpack.config.js` with the below configuration:
+
+```js
+---
+filename: webpack.config.js
+---
+module.exports = {
+  target: "webworker",
+  entry: "./index.js",
+  externals: [
+    { 'cross-fetch': 'fetch' }
+  ]
+}
+```
+
+In `wrangler.toml`, define the `webpack_config` key, and use your new file as the value:
+
+```toml
+---
+filename: wrangler.toml
+highlight: [3]
+---
+name = "postgrest-worker-example"
+type = "webpack"
+webpack_config = "webpack.config.js"
+
+account_id = "yourAccountId"
+```
+
+With the Webpack build configured, `postgrest-js` is ready to be used inside of your new Workers function. In `index.js`, import the package, and set up a new instance of `PostgrestClient`. Note that the `POSTGREST_ENDPOINT` is a placeholder for the publicly accessible PostgREST endpoint mentioned earlier in this tutorial:
+
+```js
+---
+filename: index.js
+highlight: [1, 2]
+---
+import { PostgrestClient } from '@supabase/postgrest-js'
+const client = new PostgrestClient(POSTGREST_ENDPOINT)
+
+addEventListener('fetch', event => {
+// ... Rest of code
+```
+
+With a new client set up, you will make your first request from inside the Workers function to your PostgREST endpoint. To do this, you will _select_ data from a table inside of your database, using the `from` and `select` functions in `postgrest-js`. The below example uses the `users` table, and selects everything inside of it, though if you are bringing your own PostgreSQL setup to this tutorial, adjust the code accordingly. Replace the default code in `handleRequest` with the below code:
+
+```js
+---
+filename: index.js
+---
+// ... Rest of code
+
+async function handleRequest(request) {
+  const { data, error } = await client
+    .from('users')
+    .select()
+  
+  if (error) throw error
+
+  return new Response(JSON.stringify(data), {
+    headers: {
+      'Content-type': 'application/json'
+    }
+  })
+}
+```
+
+This code is identical to making a `GET` request to `/users` on your PostgREST endpoint. In this example, the function returns the `data` object back from `postgrest-js` to the client, as JSON.
+
+To publish this function, run `wrangler publish`:
+
+```sh
+---
+header: Publish the Workers function
+---
+$ wrangler publish
+✨  Built successfully, built project size is 3 KiB.
+✨  Successfully published your script to
+ https://postgrest-worker-example.signalnerve.workers.dev
+```
+
+To correctly configure the function, set a `POSTGREST_ENDPOINT` "secret", which tells Workers where to actually route requests to. `wrangler secret` is a command that sets an encrypted value, or a "secret", that is only available inside of the Workers function:
+
+```sh
+$ wrangler secret put POSTGREST_ENDPOINT
+Enter the secret text you'd like assigned to the variable POSTGREST_ENDPOINT on the script named postgrest-worker-example:
+**************
+🌀  Creating the secret for script name postgrest-worker-example
+✨  Success! Uploaded secret POSTGREST_ENDPOINT.
+```
+
+Visit the Workers function in browser (such as `https://postgrest-worker-example.signalnerve.workers.dev`). It returns a simple JSON array of your PostgreSQL data:
+
+```json
+---
+header: JSON array returning from PostgREST in a Workers function
+---
+[{"id":1,"name":"Kristian"}]
+```
+
+### Adding a router
+
+To increase the functionality of this project, you can add a router to handle multiple potential paths in the application. The application will have one path which returns _all_ users, a path that returns a single user _based on ID_, and a path that accepts data and creates a user. The URL structure will look like this:
+
+| Route            | Action                    |
+| ---------------- | ------------------------- |
+| `GET /users`     | Get all users             |
+| `GET /users/:id` | Get one user, based on ID |
+| `POST /users`    | Create a new user         |
+
+To build this, you will integrate [`itty-router`](https://github.com/kwhitley/itty-router), a small router built in JavaScript, into the project. Begin by installing the package:
+
+```sh
+---
+header: Install itty-router
+---
+$ npm install itty-router
+```
+
+With `itty-router` installed, import the package into `index.js`, and instantiate a new router at the top of your serverless function:
+
+```js
+---
+filename: index.js
+highlight: [2, 5]
+---
+import { PostgrestClient } from '@supabase/postgrest-js'
+import { Router } from 'itty-router'
+
+const client = new PostgrestClient(POSTGREST_ENDPOINT)
+const router = Router()
+```
+
+As with most routers, `itty-router` works by adding routes to your `router`, based on the HTTP method clients will access them by. In this case, the router will have three routes—`GET /users`, `GET /users/:id`, and `POST /users`. To begin using the `router`, take the current code, which retrieves all the users in your database, and port it into a `GET /users` route. The updated code is below, but with a modified JSON response, which returns an object with a `users` array:
+
+```js
+---
+filename: index.js
+---
+router.get('/users', async () => {
+  const { data, error } = await client.from('users').select()
+  if (error) throw error
+
+  return new Response(JSON.stringify({ users: data }), {
+    headers: { 'content-type': 'application/json' },
+  })
+})
+```
+
+With the first route configured, the Workers function needs to pass requests off to the `router`. To do this, remove the `handleRequest` function, and call `router.handle` in the `fetch` event listener directly:
+
+```js
+---
+filename: index.js
+highlight: [4, 11, 12, 13, 14]
+---
+const router = Router()
+
+addEventListener('fetch', event => {
+  event.respondWith(router.handle(event.request))
+})
+
+router.get("/users", () => {
+  // PostgREST code
+})
+
+// Delete the below function in your code entirely
+async function handleRequest(request) {
+  // Old PostgREST code
+}
+```
+
+Deploy the new version of the function with `wrangler publish`. The previous code now runs at `/users`, and returns a JSON array of users:
+
+```json
+---
+header: Updated JSON object returning users in a Workers function
+---
+{"users":[{"id":1,"name":"Kristian"}]}
+```
+
+Notice that the original path at `/`, or _the root_, now has nothing configured. A client visiting this URL causes the function to throw an exception. To fix this, use `itty-router`'s `all` method, which acts as a catch-all for any routes not explicitly handled by other route handlers. Return a new `404 Not Found` response for any route not recognized:
+
+```js
+---
+filename: index.js
+highlight: [5]
+---
+router.get('/users', async () => {
+  // Existing code
+})
+
+router.all('*', () => new Response("Not Found", { status: 404 }))
+```
+
+The second planned route is `GET /users/:id`, which returns a single user based on their ID. Configure another route, which uses _parameters_ to capture part of the URL, and make it available as part of the route handler as an object `params`:
+
+
+```js
+---
+filename: index.js
+---
+router.get('/users/:id', async ({ params } => {
+  const { id } = params
+  console.log(id) // e.g. 5, if requested URL is /users/5
+})
+```
+
+With the ID captured as the variable `id`, `postgrest-js` can select from the `users` table again, but with an added _filter_ that requires any returned users have a matching ID. This limits the response to a single user, such as a user with an ID of 1. There are a number of filters available for use in `postgrest-js`, such as `gt` (greater than), `lt` (less than), and `eq` (equal), which can filter existing data:
+
+```js
+---
+filename: index.js
+highlight: [3, 4, 5, 6]
+---
+router.get('/users/:id', async ({ params }) => {
+  const { id } = params
+  const { data, error } = await client
+    .from('users')
+    .select()
+    .eq('id', id)
+})
+```
+
+By implementing this, you will get a JSON array of users back, but since it will be filtering based on ID, it can either be an empty array (when no user is found), or an array with a single item (a user was found). Complete the route handler by returning a JSON object with a key `user`, which is either `null`, or the object returned from PostgREST for the found user:
+
+```js
+---
+filename: index.js
+highlight: [8, 9, 10, 11, 12, 13, 14, 15]
+---
+router.get('/users/:id', async ({ params }) => {
+  const { id } = params
+  const { data, error } = await client
+    .from('users')
+    .select()
+    .eq('id', id)
+
+  if (error) throw error
+
+  const user = data.length ? data[0] : null
+
+  return new Response(JSON.stringify({ user }), {
+    headers: { 'content-type': 'application/json' },
+    status: user ? 200 : 404
+  })
+})
+```
+
+Deploy the function again with `wrangler publish` to allow looking up users based on their ID, such as `/users/1`. If there is a user in the database with that given ID, you will get a JSON response (with a status of `200 OK`) containing the user data, otherwise the JSON response will be a `null` value (with a status of `404 Not Found`):
+
+```json
+---
+header: JSON object for a found user based on ID
+---
+{"user":{"id":1,"name":"Kristian"}}
+```
+
+```json
+---
+header: Empty JSON object when no user is found
+---
+{"user":null}
+```
+
+### Creating new users
+
+To complete the function, create a third endpoint, which creates users from your Workers + PostgREST API. The route will accept `POST` requests to `/users`, with a JSON payload containing the data to save in your database. For example, if the `users` table contains a `name` value, sending a JSON payload to the PostgREST API with the format `{"name":"Kristian"}` will create a new user with a name of "Kristian".
+
+In the Workers function, implement this by setting up a new `post` handler, and parsing the request _body_ (the data being sent as part of the request) as JSON inside of that handler:
+
+```js
+---
+filename: index.js
+---
+router.post('/users', async request => {
+  const userData = await request.json()
+})
+```
+
+With that data available as `userData`, use the `insert` function to create a new user in your database. `postgrest-js` returns the new user back from PostgREST, which can be returned as the JSON response back to the client:
+
+```js
+---
+filename: index.js
+highlight: [3, 4, 5, 6, 7, 8, 9, 10, 11]
+---
+router.post('/users', async request => {
+  const userData = await request.json()
+  const { data: user, error } = await client
+    .from('users')
+    .insert([userData])
+
+  if (error) throw error
+
+  return new Response(JSON.stringify({ user }), {
+    headers: { 'content-type': 'application/json' },
+  })
+})
+```
+
+Deploy the updated function using `wrangler publish`. To test this new endpoint, use `cURL`, a command-line tool for making requests. Copy the below command, replacing the base part of the URL with your unique Workers.dev deployment. This command sends JSON data to your new endpoint as a `POST` request, which is parsed by the Workers function, and used to create a new user in your database. The response back should be the new user you have created:
+
+```sh
+---
+header: Creating a new user using cURL
+---
+$ curl https://postgrest-worker-example.signalnerve.workers.dev/users -X POST -H "Content-type: application/json" -d '{"name": "Dog"}'
+{"user":{"id":2,"name":"Dog"}}
+```
+
+## Conclusion
+
+In this tutorial, you have used PostgREST, `postgrest-js`, and Cloudflare Workers to build a serverless API for your PostgreSQL database. This architecture provides an infinitely-scaling and secure approach to interfacing between your databases and your front-end applications, while still retaining the control and flexibility of avoiding lock-in to Database-as-a-Service tools and other complicated SDKs for data management.
+
+If you found this tutorial useful, refer to some of our other Cloudflare Workers tutorials below. 
+
+- [Authorize users with Auth0](/tutorials/authorize-users-with-auth0)
+- [Build a Slackbot](/tutorials/build-a-slackbot)
+- [GitHub SMS notifications using Twilio](/tutorials/github-sms-notifications-using-twilio)
diff --git a/products/workers/src/content/tutorials/workers-kv-from-rust/index.md b/products/workers/src/content/tutorials/workers-kv-from-rust/index.md
new file mode 100644
index 00000000000..f6bea3cbbdc
--- /dev/null
+++ b/products/workers/src/content/tutorials/workers-kv-from-rust/index.md
@@ -0,0 +1,446 @@
+---
+updated: 2021-07-28
+difficulty: Intermediate
+content_type: "📝 Tutorial"
+pcx-content-type: tutorial
+---
+
+# Use Workers KV directly from Rust
+
+In this tutorial, you will learn how to read and write to Workers KV directly from Rust, by using `wasm_bindgen` and a simple custom wrapper around the JS Workers KV API.
+
+import TutorialsBeforeYouStart from "../../_partials/_tutorials-before-you-start.md"
+
+<TutorialsBeforeYouStart/>
+
+## Basic Project Scaffolding
+
+To get started, run the following `wrangler` command to generate a basic project using the [rustwasm-worker template](https://github.com/cloudflare/rustwasm-worker-template/). After running the `wrangler generate` command, `cd` into the new project, and use the current state of the git repository as the initial commit by running the `git add` and `git commit` commands in your terminal:
+
+```sh
+$ wrangler generate workers-kv-from-rust https://github.com/cloudflare/rustwasm-worker-template/
+$ cd workers-kv-from-rust
+$ git add -A
+$ git commit -m 'Initial commit'
+```
+
+## Create and bind a KV namespace
+
+To be able to access Workers KV, define a binding for a particular KV namespace in the `wrangler.toml` file generated in your new project's directory. If you do not have an existing namespace, create one using `wrangler`. For example, a namespace called `KV_FROM_RUST` would be created by running:
+
+```sh
+$ wrangler kv:namespace create "KV_FROM_RUST"
+🌀  Creating namespace with title "workers-kv-from-rust-KV_FROM_RUST"
+✨  Success!
+Add the following to your configuration file:
+kv_namespaces = [
+	 { binding = "KV_FROM_RUST", id = "6257d3ebe5d948cda9e59aae1f9a7f1a" }
+]
+```
+
+Create a preview ID to use the namespace with `wrangler preview`:
+
+```sh
+wrangler kv:namespace create "KV_FROM_RUST" --preview
+🌀  Creating namespace with title "workers-kv-from-rust-KV_FROM_RUST_preview"
+✨  Success!
+Add the following to your configuration file in your kv_namespaces array:
+{ binding = "KV_FROM_RUST", preview_id = "5c0f32f95cb94819b8c553b470791efd", id = "6257d3ebe5d948cda9e59aae1f9a7f1a" }
+```
+
+Add this binding to the `wrangler.toml` file:
+
+```toml
+---
+filename: wrangler.toml
+---
+name = "workers-kv-from-rust"
+type = "rust"
+
+account_id = ""
+workers_dev = true
+route = ""
+zone_id = ""
+
+kv_namespaces = [
+  { binding = "KV_FROM_RUST", preview_id = "5c0f32f95cb94819b8c553b470791efd", id = "6257d3ebe5d948cda9e59aae1f9a7f1a" }
+]
+```
+
+## Pass the KV namespace object to Rust
+
+You can now access this KV namespace as the variable `KV_FROM_RUST` in JS. To read or write from the namespace in Rust, you need to pass the whole object to the Rust handler function:
+
+```js
+---
+filename: worker/worker.js
+---
+addEventListener('fetch', event => {
+  event.respondWith(handleRequest(event.request))
+})
+
+const { handle } = wasm_bindgen;
+const instance =  wasm_bindgen(wasm);
+
+/**
+ * Fetch and log a request
+ * @param {Request} request
+ */
+async function handleRequest(request) {
+  await instance;
+
+  return await handle(KV_FROM_RUST, request);
+}
+```
+
+Note that the signature of your Rust handler differs from the template, which merely returns a `String` from Rust and keeps the request and response handling purely on the JavaScript side. This tutorial will try to do as much as possible in Rust and pass the request directly to the wasm handler, which will then construct and return a response. To do this, declare `web-sys` as one of your Rust dependencies and explicitly enable the `Request`, `Response` and `ResponseInit` features (the `Url` and `UrlSearchParams` features will be used later in this tutorial):
+
+```toml
+---
+filename: Cargo.toml
+---
+[dependencies.web-sys]
+version = "0.3"
+features = [
+    'Request',
+    'Response',
+    'ResponseInit',
+    'Url',
+    'UrlSearchParams',
+]
+```
+
+You can now use `Request` and `Response` in Rust to create a very simple handler that completely ignores the request and always responds with a `200 OK` status:
+
+```rust
+---
+filename: src/lib.rs
+---
+extern crate cfg_if;
+extern crate wasm_bindgen;
+
+mod utils;
+
+use cfg_if::cfg_if;
+use wasm_bindgen::{JsCast, prelude::*};
+use web_sys::{Request, Response, ResponseInit};
+
+cfg_if! {
+    // When the `wee_alloc` feature is enabled, use `wee_alloc` as the global
+    // allocator.
+    if #[cfg(feature = "wee_alloc")] {
+        extern crate wee_alloc;
+        #[global_allocator]
+        static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;
+    }
+}
+
+#[wasm_bindgen]
+pub fn handle(kv: JsValue, req: JsValue) -> Result<Response, JsValue> {
+    let req: Request = req.dyn_into()?;
+    let mut init = ResponseInit::new();
+    init.status(200);
+    Response::new_with_opt_str_and_init(None, &init)
+}
+```
+
+## Bind to KV using `wasm_bindgen`
+
+You are now ready to create a type binding using `wasm_bindgen` to access the KV object. Since the KV API returns JavaScript promises, you must first add `wasm-bindgen-futures` and `js-sys` as dependencies:
+
+```toml
+---
+filename: Cargo.toml
+---
+[dependencies]
+cfg-if = "0.1.2"
+wasm-bindgen = "=0.2.73"
+wasm-bindgen-futures = "0.4"
+js-sys = "0.3"
+```
+
+Add the wrapper and change the type of the `kv` argument of your handler accordingly:
+
+```rust
+---
+filename: src/lib.rs
+---
+#[wasm_bindgen]
+pub fn handle(kv: WorkersKvJs, req: JsValue) -> Result<Response, JsValue> {
+    let req: Request = req.dyn_into()?;
+    let mut init = ResponseInit::new();
+    init.status(200);
+    Response::new_with_opt_str_and_init(None, &init)
+}
+
+#[wasm_bindgen]
+extern "C" {
+    pub type WorkersKvJs;
+
+    #[wasm_bindgen(structural, method, catch)]
+    pub async fn put(
+        this: &WorkersKvJs,
+        k: JsValue,
+        v: JsValue,
+        options: JsValue,
+    ) -> Result<JsValue, JsValue>;
+
+    #[wasm_bindgen(structural, method, catch)]
+    pub async fn get(
+        this: &WorkersKvJs,
+        key: JsValue,
+        options: JsValue,
+    ) -> Result<JsValue, JsValue>;
+}
+```
+
+## Create a wrapper around KV
+
+You could start using the `kv` parameter as is, but the function signatures generated by `wasm_bindgen` can be difficult to work within Rust. For an easier experience, create a simple struct around the `WorkersKvJs` type that wraps it with a more Rust-friendly API:
+
+```rust
+---
+filename: src/lib.rs
+---
+use js_sys::{ArrayBuffer, Object, Reflect, Uint8Array};
+
+struct WorkersKv {
+    kv: WorkersKvJs,
+}
+
+impl WorkersKv {
+    async fn put_text(&self, key: &str, value: &str, expiration_ttl: u64) -> Result<(), JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"expirationTtl".into(), &(expiration_ttl as f64).into())?;
+        self.kv
+            .put(JsValue::from_str(key), value.into(), options.into())
+            .await?;
+        Ok(())
+    }
+
+    async fn put_vec(&self, key: &str, value: &[u8], expiration_ttl: u64) -> Result<(), JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"expirationTtl".into(), &(expiration_ttl as f64).into())?;
+        let typed_array = Uint8Array::new_with_length(value.len() as u32);
+        typed_array.copy_from(value);
+        self.kv
+            .put(
+                JsValue::from_str(key),
+                typed_array.buffer().into(),
+                options.into(),
+            )
+            .await?;
+        Ok(())
+    }
+
+    async fn get_text(&self, key: &str) -> Result<Option<String>, JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"type".into(), &"text".into())?;
+        Ok(self
+            .kv
+            .get(JsValue::from_str(key), options.into())
+            .await?
+            .as_string())
+    }
+
+    async fn get_vec(&self, key: &str) -> Result<Option<Vec<u8>>, JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"type".into(), &"arrayBuffer".into())?;
+        let value = self.kv.get(JsValue::from_str(key), options.into()).await?;
+        if value.is_null() {
+            Ok(None)
+        } else {
+            let buffer = ArrayBuffer::from(value);
+            let typed_array = Uint8Array::new_with_byte_offset(&buffer, 0);
+            let mut v = vec![0; typed_array.length() as usize];
+            typed_array.copy_to(v.as_mut_slice());
+            Ok(Some(v))
+        }
+    }
+}
+```
+
+The above wrapper only exposes a subset of the options supported by the KV API, other options such as `expiration` instead of `expirationTtl` for put and other types than `text` and `arrayBuffer` for get could be wrapped in a similar fashion. Conceptually, the wrapper methods all manually construct a JS object using `Reflect::set` and then convert the return value into a standard Rust type where necessary.
+
+## Using the wrapper
+
+You are now ready to use the wrapper to get and put values from and to our KV namespace. The following function is a simple example handler that writes the key `foo` with the value `bar` to KV, if a `PUT` request is made to `/foo?value=bar`, and reads and returns the value of key `foo` from KV, if a `GET` request is made to `/foo`. Note that `handle` is now asynchronous, and that you will be using the `Url` and `UrlSearchParams` features that you declared earlier in `Cargo.toml`:
+
+```rust
+---
+filename: src/lib.rs
+---
+#[wasm_bindgen]
+pub async fn handle(kv: WorkersKvJs, req: JsValue) -> Result<Response, JsValue> {
+    let req: Request = req.dyn_into()?;
+    let url = web_sys::Url::new(&req.url())?;
+    let pathname = url.pathname();
+    let query_params = url.search_params();
+    let kv = WorkersKv { kv };
+    match req.method().as_str() {
+        "GET" => {
+            let value = kv.get_text(&pathname).await?.unwrap_or_default();
+            let mut init = ResponseInit::new();
+            init.status(200);
+            Response::new_with_opt_str_and_init(Some(&format!("\"{}\"\n", value)), &init)
+        },
+        "PUT" => {
+            let value = query_params.get("value").unwrap_or_default();
+            // set a TTL of 60 seconds:
+            kv.put_text(&pathname, &value, 60).await?;
+            let mut init = ResponseInit::new();
+            init.status(200);
+            Response::new_with_opt_str_and_init(None, &init)
+        },
+        _ => {
+            let mut init = ResponseInit::new();
+            init.status(400);
+            Response::new_with_opt_str_and_init(None, &init)
+        }
+    }
+}
+```
+
+You can use [`wrangler dev`](/cli-wrangler/commands#dev) to test the Worker:
+
+```sh
+$ curl 'localhost:8787/foo'
+""
+$ curl -X PUT 'localhost:8787/foo?value=bar'
+$ curl 'localhost:8787/foo'
+"bar"
+```
+
+## Putting it all together
+
+With all previous steps complete, the final `lib.rs` should look as follows (you can also find the full code as an example repository at <https://github.com/fkettelhoit/workers-kv-from-rust>):
+
+```rust
+---
+filename: src/lib.rs
+---
+extern crate cfg_if;
+extern crate wasm_bindgen;
+
+mod utils;
+
+use cfg_if::cfg_if;
+use js_sys::{ArrayBuffer, Object, Reflect, Uint8Array};
+use wasm_bindgen::{prelude::*, JsCast};
+use web_sys::{Request, Response, ResponseInit};
+
+cfg_if! {
+    // When the `wee_alloc` feature is enabled, use `wee_alloc` as the global
+    // allocator.
+    if #[cfg(feature = "wee_alloc")] {
+        extern crate wee_alloc;
+        #[global_allocator]
+        static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;
+    }
+}
+
+#[wasm_bindgen]
+pub async fn handle(kv: WorkersKvJs, req: JsValue) -> Result<Response, JsValue> {
+    let req: Request = req.dyn_into()?;
+    let url = web_sys::Url::new(&req.url())?;
+    let pathname = url.pathname();
+    let query_params = url.search_params();
+    let kv = WorkersKv { kv };
+    match req.method().as_str() {
+        "GET" => {
+            let value = kv.get_text(&pathname).await?.unwrap_or_default();
+            let mut init = ResponseInit::new();
+            init.status(200);
+            Response::new_with_opt_str_and_init(Some(&format!("\"{}\"\n", value)), &init)
+        }
+        "PUT" => {
+            let value = query_params.get("value").unwrap_or_default();
+            // set a TTL of 60 seconds:
+            kv.put_text(&pathname, &value, 60).await?;
+            let mut init = ResponseInit::new();
+            init.status(200);
+            Response::new_with_opt_str_and_init(None, &init)
+        }
+        _ => {
+            let mut init = ResponseInit::new();
+            init.status(400);
+            Response::new_with_opt_str_and_init(None, &init)
+        }
+    }
+}
+
+#[wasm_bindgen]
+extern "C" {
+    pub type WorkersKvJs;
+
+    #[wasm_bindgen(structural, method, catch)]
+    pub async fn put(
+        this: &WorkersKvJs,
+        k: JsValue,
+        v: JsValue,
+        options: JsValue,
+    ) -> Result<JsValue, JsValue>;
+
+    #[wasm_bindgen(structural, method, catch)]
+    pub async fn get(
+        this: &WorkersKvJs,
+        key: JsValue,
+        options: JsValue,
+    ) -> Result<JsValue, JsValue>;
+}
+
+struct WorkersKv {
+    kv: WorkersKvJs,
+}
+
+impl WorkersKv {
+    async fn put_text(&self, key: &str, value: &str, expiration_ttl: u64) -> Result<(), JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"expirationTtl".into(), &(expiration_ttl as f64).into())?;
+        self.kv
+            .put(JsValue::from_str(key), value.into(), options.into())
+            .await?;
+        Ok(())
+    }
+
+    async fn put_vec(&self, key: &str, value: &[u8], expiration_ttl: u64) -> Result<(), JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"expirationTtl".into(), &(expiration_ttl as f64).into())?;
+        let typed_array = Uint8Array::new_with_length(value.len() as u32);
+        typed_array.copy_from(value);
+        self.kv
+            .put(
+                JsValue::from_str(key),
+                typed_array.buffer().into(),
+                options.into(),
+            )
+            .await?;
+        Ok(())
+    }
+
+    async fn get_text(&self, key: &str) -> Result<Option<String>, JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"type".into(), &"text".into())?;
+        Ok(self
+            .kv
+            .get(JsValue::from_str(key), options.into())
+            .await?
+            .as_string())
+    }
+
+    async fn get_vec(&self, key: &str) -> Result<Option<Vec<u8>>, JsValue> {
+        let options = Object::new();
+        Reflect::set(&options, &"type".into(), &"arrayBuffer".into())?;
+        let value = self.kv.get(JsValue::from_str(key), options.into()).await?;
+        if value.is_null() {
+            Ok(None)
+        } else {
+            let buffer = ArrayBuffer::from(value);
+            let typed_array = Uint8Array::new_with_byte_offset(&buffer, 0);
+            let mut v = vec![0; typed_array.length() as usize];
+            typed_array.copy_to(v.as_mut_slice());
+            Ok(Some(v))
+        }
+    }
+}
+```