[{"data":1,"prerenderedAt":186},["ShallowReactive",2],{"publication:en:P075":3},{"meta":4,"copy":17,"relatedArticles":146,"terms":178,"term":179,"resourceParent":180,"glossaryParent":183},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P075","\u002Fblog\u002Fcloudflare-origin-exposure","article","protect origin server behind Cloudflare","Protect your origin server behind Cloudflare: scope and verify the boundary","Protect an origin server behind Cloudflare","Review authorized origin paths, TLS, network restrictions and origin authentication. Verify the normal website and agreed direct-path controls after changes.",[13,14],"\u002Fservices\u002Fcloudflare","\u002Fservices\u002Flinux-vps","2026-09-22","2026-10-30",{"intro":18,"sections":19,"checklistTitle":95,"checklist":96,"faq":104,"sources":114,"links":118,"cta":141},"To protect an origin server behind Cloudflare, map the authorized traffic paths, validate the origin TLS connection and choose supported controls that restrict who can reach the application directly. A proxied DNS record or a known origin IP does not by itself prove the boundary. Verify the intended public path and agreed restricted paths without disrupting legitimate services.",[20,25,37,77,85,90],{"title":21,"paragraphs":22},"Agree the origin scope before investigating reachability",[23,24],"Identify the website, hosting account, origin endpoints and infrastructure owner from authorized configuration records. Include known IPv4 and IPv6 listeners, load balancers and relevant alternate hostnames where they are in scope. The purpose is to review your own service boundary, not discover or probe unrelated infrastructure. A historical address or shared-hosting label is not enough to establish the current origin or permission to test it.","Separate website traffic from administration, mail, backup, monitoring and other services that may share a server. Agree which paths must remain available and who can authorize network or web-server changes. Retain a protected administrative recovery route before applying restrictions. An origin control that blocks the only management path can turn a review into a service incident.",{"title":26,"paragraphs":27,"sources":30},"Distinguish proxying, encryption and origin authentication",[28,29],"A proxied record directs the relevant supported traffic through Cloudflare, but it does not alone establish the origin's inbound restrictions. Cloudflare's origin-protection guidance describes multiple controls at different layers. Select them for the actual hosting and architecture rather than assume that enabling a WAF closes every other route to the application.","Review the separate TLS connection from Cloudflare to the origin. Full (strict) applies origin certificate requirements, including validity and hostname matching. That is different from authenticating the connecting client to the origin. Keep the visitor certificate, origin certificate validation and permission to reach the application as three observations in the review.",[31,34],{"label":32,"url":33},"Cloudflare: protecting the origin server","https:\u002F\u002Fdevelopers.cloudflare.com\u002Ffundamentals\u002Fsecurity\u002Fprotect-your-origin-server\u002F",{"label":35,"url":36},"Cloudflare: Full (strict) origin certificate requirements","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fssl\u002Forigin-configuration\u002Fssl-modes\u002Ffull-strict\u002F",{"title":38,"paragraphs":39,"sources":42,"table":46},"Choose a supported control for each authorized path",[40,41],"Network restrictions can narrow allowed sources; authenticated origin connections can add a client-identity check; an architecture using a supported tunnel has another connection model. The appropriate arrangement depends on the provider, ports, available features and legitimate dependencies. Keep monitoring, health checks and management paths explicit rather than add broad unexplained exceptions when something stops working.","Cloudflare's global Authenticated Origin Pulls certificate identifies the Cloudflare network, not uniquely your account. Its documentation describes stricter arrangements with customer-specific certificates at supported scopes. Verify what identity your selected control actually accepts. A setting called authenticated should not be reported as a customer-specific boundary unless its certificate, scope and origin enforcement support that conclusion.",[43],{"label":44,"url":45},"Cloudflare: Authenticated Origin Pulls and certificate scope","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fssl\u002Forigin-configuration\u002Fauthenticated-origin-pull\u002Fexplanation\u002F",{"caption":47,"headers":48,"rows":52},"Origin path and acceptance register",[49,50,51],"Path or control","Evidence before change","Acceptance after change",[53,57,61,65,69,73],[54,55,56],"Public visitor route","Intended hostname, proxy path and application owner.","The normal website and agreed business actions work.",[58,59,60],"Origin TLS","Current connection mode and served certificate.","The supported origin certificate checks pass.",[62,63,64],"Inbound restriction","Allowed sources, ports and enforcement point.","Agreed unauthorized direct application path is denied.",[66,67,68],"Origin authentication","Certificate identity and supported scope.","Only the intended authenticated path is accepted.",[70,71,72],"Operations","Approved monitoring, backup and administration needs.","Required service paths remain available.",[74,75,76],"Recovery","Authorized operator and supported previous state.","The owner can correct a failed change safely.",{"title":78,"paragraphs":79,"example":82},"Verify the boundary with agreed benign observations",[80,81],"Start with configuration and log evidence. If a behavioral check is needed, agree the exact owned target, hostname, protocol, source and harmless request. Keep the expected result beside the observation and use a controlled test arrangement when possible. A denied request supports that tested path; it does not prove every alternate address, listener or future configuration is protected.","Likewise, seeing an IP address in a public record does not prove a working WAF bypass or a successful compromise. The application may reject the request through another control. Avoid broad scans, password attempts or attack payloads to answer a configuration question. Record the evidence needed to distinguish a known address, network reachability and unauthorized application access.",{"title":83,"text":84},"Illustrative identity-boundary gap","An owner expects a customer-specific origin identity, but the configured certificate only identifies the wider Cloudflare network. The configuration may be functioning as designed; its accepted identity is broader than the owner’s expectation and needs an explicit design decision.",{"title":86,"paragraphs":87},"Retest business functions and explain the remaining scope",[88,89],"After an authorized change, verify the normal public path and the agreed restricted path. Check representative forms, logins, scheduled tasks and integrations affected by the scope. Use approved test data and payment procedures. A denial on a direct path is not enough acceptance if the legitimate checkout, health check or renewal process now fails.","Preserve the relevant log conditions and identify who interprets source addresses behind the proxy. Do not blindly trust a forwarded client-IP header from arbitrary callers. If a required path fails, use the agreed recovery and investigate the specific dependency rather than leave the origin broadly open as an undocumented permanent workaround. Keep untested listeners and supplier-controlled infrastructure visible in the handover.",{"title":91,"paragraphs":92},"Maintain the boundary after infrastructure changes",[93,94],"Recheck the register after moving hosting, adding a load balancer, enabling a new address family or changing monitoring. Keep the source of any required allowlist and the owner of certificate lifecycle current. A firewall screenshot from the original deployment does not establish the state after a new origin is added or an old exception is copied to another server.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli knowledge of Cloudflare, websites and digital infrastructure. We can scope the authorized origin review, supported implementation and acceptance checks around your architecture. The handover explains the enforced boundary and the operational dependencies the business needs to preserve.","Origin-protection acceptance",[97,98,99,100,101,102,103],"Owned targets, authority and test scope agreed","Known origin addresses and listeners mapped","Visitor TLS, origin TLS and origin authentication distinguished","Supported restrictions preserve legitimate operations","Expected identity and certificate scope verified","Normal and agreed restricted paths tested","Recovery, exceptions and maintenance owners documented",[105,108,111],{"question":106,"answer":107},"Does an orange-cloud DNS record prove my origin is protected?","It identifies the proxy setting for the supported traffic. Review the origin’s actual inbound controls and alternate paths separately. Verify the normal route and an agreed restricted path within an authorized scope.",{"question":109,"answer":110},"Does knowing an origin IP prove a security bypass?","No, an address can be known while the application remains restricted. Distinguish identification, reachability and unauthorized access using configuration evidence and agreed benign checks, rather than treating a discovered address as a confirmed compromise.",{"question":112,"answer":113},"Does global AOP uniquely identify our Cloudflare account?","Cloudflare documents that its global shared certificate identifies the Cloudflare network, not one customer account. Review the supported certificate and scope options if a more specific identity boundary is required, and verify enforcement at the origin.",[115,116,117],{"label":32,"url":33},{"label":35,"url":36},{"label":44,"url":45},[119,121,124,127,130,132,135,138],{"path":13,"label":120},"Scope Cloudflare configuration and acceptance",{"path":122,"label":123},"\u002Fglossary\u002Fwaf","Understand which requests a WAF evaluates",{"path":125,"label":126},"\u002Fglossary\u002Fhttps","Distinguish the public and origin TLS connections",{"path":128,"label":129},"\u002Fblog\u002Fdns-change-checklist","Review DNS dependencies before a proxy change",{"path":14,"label":131},"Review the server and management boundary",{"path":133,"label":134},"\u002Fservices\u002Fweb-resilience-audit","Scope website resilience and service paths",{"path":136,"label":137},"\u002Fglossary\u002Ffirewall","Map the network and host enforcement boundaries",{"path":139,"label":140},"\u002Fblog\u002Fcloudflare-waf-false-positives","Investigate a legitimate workflow blocked by a managed rule",{"title":142,"description":143,"button":144,"type":145},"Review the origin boundary without losing the business path","Describe the hosting, proxy arrangement and concern. We can agree owned targets, supported changes and acceptance before work.","Discuss origin protection","check",[147,155,163,171],{"id":148,"path":128,"title":149,"description":150,"category":151,"artwork":152,"order":153,"publishedOn":154},"P068","DNS change checklist: protect your website and email","Plan DNS changes with an asset inventory, current records, provider ownership, DNSSEC checks, rollback and end-to-end verification of website and business email.","infrastructure","integrations",85,"2026-10-02",{"id":156,"path":157,"title":158,"description":159,"category":151,"artwork":160,"order":161,"publishedOn":162},"P115","\u002Fblog\u002Fdomain-expiry-risk","Prevent business domain expiration with clear ownership and renewal checks","Map the registrar, renewal date, payment owner and recovery route. Verify renewal evidence and service dependencies without assuming a universal grace period.","domain-renewal",70,"2026-09-12",{"id":164,"path":165,"title":166,"description":167,"category":151,"artwork":168,"order":169,"publishedOn":170},"P081","\u002Fblog\u002Fsecurity-headers-explained","HTTP security headers for business websites: choose, test and maintain","Choose security headers by browser behavior and website dependencies. Plan CSP, HSTS, framing and content-type changes with safe rollout and business checks.","security",62,"2026-08-31",{"id":172,"path":173,"title":174,"description":175,"category":151,"artwork":168,"order":176,"publishedOn":177},"P067","\u002Fblog\u002Fwebsite-ssl-warning","Website SSL certificate error: diagnose the failing connection","Separate certificate, hostname, trust-chain and CDN-origin issues from browser-only problems. Verify the affected HTTPS paths without bypassing visitor protection.",94,"2026-10-12",[],null,{"path":181,"label":182},"\u002Fresources","Website security resources and templates",{"path":184,"label":185},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058956]