Yes. Proxying hides your origin IP address from DNS, but it does not stop anything from connecting to that address directly. Concealment buys you time; only a rule at the origin closes the door.
This is the most consequential misunderstanding in Cloudflare onboarding. A proxied record answers queries with a Cloudflare address, so the obvious lookup no longer returns your server. It is easy to read that as a shield. Cloudflare’s own proxy status documentation is careful about the wording: proxying hides origin IP addresses. Hiding and defending are different jobs.
The routes an address escapes by
Cloudflare’s guidance on protecting your origin names most of these directly, and the striking thing about the list is how little of it involves anyone attacking you. Addresses mostly leak through ordinary configuration:
- Records you left grey-clouded. A DNS-only record answers with the real address by definition. Cloudflare advises auditing existing DNS-only records — it calls out
SPFandTXTentries — to make sure they do not carry origin IP information. - Mail on the same machine. Cloudflare recommends not hosting a mail service on the same server as the web resource you want to protect, for a specific reason: mail sent to non-existent addresses bounces back to the sender and reveals the mail server’s IP. Nobody has to break anything — the server volunteers it.
- History. DNS records are public and historical copies are retained, so the address you used before you onboarded remains discoverable afterwards. This is why Cloudflare’s setup guidance recommends rotating your origin IPs once you are onboarded rather than keeping the address that was public for years.
- Your own application. Anything that emits an absolute URL or connects outward — webhook callers, password reset emails, error pages, SSRF-prone endpoints — can carry the address out with it.
None of these are exotic. They are the reason “we are behind Cloudflare” and “our origin is unreachable” are rarely the same statement.
Making the origin refuse strangers
The fix is not better hiding. It is arranging for your origin to reject any request that did not arrive through Cloudflare. Cloudflare documents several ways to do that, at different layers and with different costs, and rates each one:
| Approach | Layer | Rated | Main cost |
|---|---|---|---|
| Cloudflare Tunnel | Application | Very secure | Run the cloudflared daemon on the origin |
| Authenticated Origin Pulls | Transport | Very secure | Needs Full or Full (strict); certificate work per origin |
| Secret header validation | Application | Moderately secure | Config on both sides; must stay over TLS |
| Allowlist Cloudflare IPs | Network | Moderately secure | Vulnerable to spoofing; the list changes |
Tunnel is the one that changes the shape of the problem rather than patching it. Because cloudflared makes outbound-only connections to Cloudflare, the origin does not need a publicly routable address at all — and an address that does not exist cannot leak. Everything else on that list is a filter in front of a server that is still reachable.
Two cautions worth reading before you pick. On Authenticated Origin Pulls, Cloudflare notes that the certificate it provides for easy configuration only proves a request came from the Cloudflare network — not from your zone specifically — so uploading your own certificate is the stricter option. And on IP allowlisting, Cloudflare rates it only moderately secure and flags IP spoofing explicitly. Use it as a floor under one of the stronger two, not instead of them.
A sensible order to do this in
You do not need all of it, and doing it in the wrong order produces an outage rather than a hardened server. Working from cheapest to most disruptive:
- Audit DNS first. Every grey-clouded record, every leftover
mail,cpanel,ftpordirecthostname, every TXT record with a literal address in it. This is free and closes the widest hole. - Then allowlist Cloudflare at the firewall. Do this before rotating anything, and remember Cloudflare’s companion advice: allowing Cloudflare addresses at the origin is also what keeps proxied traffic from being blocked once the default becomes deny.
- Add a second factor. Authenticated Origin Pulls or a secret header, so that a spoofed source address alone is not enough.
- Rotate the address last. Rotation is what makes the historical records worthless — but only after the routes that would leak the new one are closed. Rotating first simply publishes a fresh address through the same open door.
If you have several origin records behind one hostname, do the audit against all of them. It only takes one forgotten record to make the other work decorative.
FAQ
Does Cloudflare hide my origin IP address?
It hides it from DNS. A proxied record answers with a Cloudflare address instead of yours, so the ordinary way of looking up a server no longer returns it. That is concealment, not protection: if the address becomes known by some other route, nothing stops a connection straight to it.
How do I stop people bypassing Cloudflare and hitting my origin directly?
Make the origin refuse anything that did not come from Cloudflare. The options Cloudflare documents are Cloudflare Tunnel, which removes the public IP entirely, Authenticated Origin Pulls at the transport layer, a secret header added by a transform rule, and allowlisting Cloudflare IP ranges at your firewall.
Can changing my server IP fix an origin IP leak?
It helps, and Cloudflare recommends rotating origin IPs after onboarding because historical DNS records are public and keep the old address alive. But rotation only buys time. If the route that exposed the address is still open, the new one leaks the same way.
Do DNS-only records expose my origin server?
They can. Any record left grey-clouded answers with the real address, and Cloudflare specifically advises auditing DNS-only records such as SPF and TXT entries to make sure they do not contain origin IP information.
Is allowlisting Cloudflare IP addresses enough on its own?
Cloudflare rates it as moderately secure rather than very secure, and notes it is vulnerable to IP spoofing. It is also a list that changes, so it needs maintaining. Treat it as a solid floor to combine with Authenticated Origin Pulls or a secret header, not as the finished job.