The origin IP is the address of the source server behind Cloudflare’s proxy network. For your own website, auditing whether that address has ever been exposed is a critical hardening exercise: if the origin accepts direct connections, some of Cloudflare’s WAF and DDoS protections can be bypassed. This article transforms the outdated third-party IP discovery tutorial into a defensive checklist for domains and infrastructure you manage or have audit permissions for.
This change maintains the context of the author’s experience and the original image. Technical details that are risky, unverified, or potentially cause false positives are not presented as steps to be followed blindly.
| Layer | Hardening objectives |
|---|---|
| Cloudflare DNS | Appropriate web proxy records |
| Origin firewall | Restrict direct access to the server |
| Authenticated Origin Pulls | Verify mTLS connections from Cloudflare |
| Tunnel | Reduce the need for inbound listeners |
| Logging and backup | Detection and recovery |
What is the difference between Cloudflare IP and origin IP?
When DNS records are proxied through Cloudflare, visitors typically connect to the Cloudflare network, not directly to the application server. pengertian IP address explains the concept of an IP address, while reverse proxy and cara kerja proxy server help understand the reverse proxy architecture. Do not confuse the address displayed by the CDN with the original hosting address.
1. DNS audit of your domains
Go to the Cloudflare DNS dashboard and check that the HTTP/HTTPS record should be Proxied (orange cloud). Check for DNS-only records that accidentally point to application servers, as well as endpoint documentation that could reveal the origin. Test only domains you manage. Cloudflare settings serve as a baseline for hardening before monitoring cara cek IP on your own infrastructure.
2. Check email paths, subdomains, and legacy services
Mail servers, SMTP, FTP, staging subdomains, and legacy records can use the same IP as the origin without needing to. Audit your network design and separate public services if possible. SMTP email configuration discusses the role of email; don’t force an HTTP proxy to an unsupported service just to hide your address.
3. Restrict direct connections to the origin
Cloudflare recommends an origin firewall that only allows Cloudflare sources for HTTP/HTTPS when the architecture is appropriate. Add Authenticated Origin Pulls (mTLS) where supported and relevant. This technology helps origins verify connections are coming from Cloudflare, not directly from the internet, even if the origin IP is known.
4. Consider Cloudflare Tunnel or IP rotation
Cloudflare Tunnel uses outbound connections from the origin and can reduce the need for public listeners. Not all deployments are suitable; evaluate the network, SSH, and non-HTTP services. If old IP addresses have leaked, rotating them after the origin is fully protected can be beneficial, along with DNS updates and monitoring. WordPress hosting migration help the team think through a planned migration flow.
5. Be careful with historical exploitation methods
The old tutorial included enumeration tools, email webhooks, and XML-RPC pingback tests to find hidden IP addresses. These methods are not included in the instructions due to the different vulnerability statuses, privacy risks, and auditing permissions. Screenshots are retained for historical purposes; only perform security testing on assets you have the authority to manage.
6. Monitor WordPress health after hardening
Don’t let the firewall actually block the crawler you need. website crawl And sitemap. Check error 502 Bad Gateway if reverse proxy results in upstream failure, monitor Core Web Vitals and performance and user access. For Self-hosted WordPress, choosing hosting provides different security controls than managed blog services.
7. Technical checklist for agency team
Maintain an inventory of IP addresses, all subdomains, edge/origin rules, TLS updates, access logs, admin accounts, and rollback procedures. Origin protection helps. DDoS mitigation as well as protection from scraping and must not ignore technical SEO. Don’t assume backlink as a security measure: login links are not proof that the server is protected.
Cloudflare origin leak audit checklist for infrastructure teams
Start with an inventory of the domains you actually manage: server IPs, Cloudflare zones, subdomains, networks, mail services, staging servers, and migration history. A website can have its primary DNS proxied but still run administrative subdomains or legacy records directly on the same server addresses. Authorized audits help uncover these gaps before they can be abused.
| Findings | Risks | Audit recommendations |
|---|---|---|
| Web DNS only records | Origin exposed | Proxy evaluation for supported HTTP/HTTPS services |
| Origin accepting direct public connections | Cloudflare WAF bypassed | Origin firewall and mTLS where appropriate |
| Staging subdomains using the same IP | Attack surface increased | Network segmentation and throttling access |
| Old origin address is publicly known | Direct traffic can continue | Hardening, monitoring, then planned rotation |
| Internal application fails after firewall | Rules are too aggressive | Auditing ports, services, and access policies |
Why isn’t simply changing IPs enough?
Address rotation can reduce exposure, but the problem will recur if the old DNS, mail service, or firewall configuration isn’t fixed. Authenticated Origin Pulls use connection authentication between Cloudflare and the origin; Cloudflare Tunnel uses outbound connections from the server. Both are different and should be chosen based on your architecture, not applied haphazardly.
Record the before and after changes, including admin logins, media uploads, WordPress cron, email, monitoring, and public pages. Implement fixes within a maintenance window with a rollback plan. This audit targets your own domains and servers, or those that explicitly allow testing.
Image archive and original tutorial experience
Old screenshots document the tools and tests of their time; historical enumeration and exploitation methods should not be re-presented as procedures targeting someone else’s site.
View 9 original screenshots
FAQ: Cloudflare origin IP
1. What is Cloudflare origin IP?
The address of the original application server serving the request behind the proxy.
2. Does Cloudflare hide the origin IP automatically?
Only for proxied records and if the service configuration is correct.
3. Why is it important to secure the origin IP?
Direct access can bypass protection at the edge if the server is not restricted.
4. What is orange-cloud DNS?
Records routed through Cloudflare’s proxy network.
5. What are the dangers of DNS-only records?
Non-proxyed records can reveal server addresses when sharing an origin.
6. Is it okay to audit someone else’s site’s IP?
Only if you have the proper authorization and permissions.
7. What is the purpose of Authenticated Origin Pulls?
mTLS helps verify requests to the origin come from Cloudflare.
8. Is Cloudflare Tunnel the same as mTLS origin pull?
No. Tunnel uses outbound connections; AOP verifies connections through certificates.
9. What if an origin ever leaks?
Strengthen your firewall and consider IP rotation and log review.
10. Can IPs be changed after migration?
Yes, with DNS planning, firewalls, and additional services.
11. Can the origin firewall block all IPs?
Make sure to allow only the services you really need and secure administrative access.
12. Is the website always secure if the origin IP is hidden?
No. Application vulnerabilities and other data leaks still need to be addressed.
External reference
- Cloudflare — protect origin server
- Cloudflare — Authenticated Origin Pulls
- Cloudflare — Cloudflare Tunnel
