Cloudflare Origin & Proxy Posture

Cloudflare is a perimeter, and a perimeter only works if it's the only path in. The bypass model is straightforward: the attacker finds your origin IP and connects to it directly, skipping the WAF, rate limits, bot mitigation, and DDoS protection that Cloudflare provides at the edge. Origin IP discovery is depressingly easy — there are public services (Censys, Shodan, SecurityTrails, Certificate Transparency logs) that map domains to historical and current IPs continuously. If your DNS hygiene has ever let an origin IP slip out — a non-proxied subdomain, a mail server on the same IP, a TLS cert issued for the bare origin hostname — the attacker can probably find it. Combined with an origin firewall that doesn't restrict to Cloudflare's IP ranges, the entire perimeter is theatrical.

Common leak vectors: A records on subdomains that aren't proxied (Cloudflare's orange-cloud-vs-grey-cloud distinction in the DNS dashboard) — these resolve directly to the origin. Mail server IPs that match the web origin (`mail.yourapp.com` shares an IP with `yourapp.com`'s origin). TLS certificates issued for the bare origin hostname (e.g., `app-prod.us-east-1.compute.amazonaws.com`) appearing in Certificate Transparency logs. Historical DNS records from passive sensors (SecurityTrails has the last 5 years of DNS for most domains). Email headers that include the origin's IP in `Received:` chains. Server-side fetches that connect through the origin's IP to retrieve resources, leaking the IP via outbound DNS. Each is a small leak; together they reduce origin-IP enumeration to a few minutes.

Direct origin connections bypass the WAF entirely. Rate limits don't apply. Bot management doesn't trigger. DDoS protection is gone. An attacker who finds the origin IP attacks the bare web server, with whatever security posture that server has on its own — usually significantly weaker than the Cloudflare-protected experience suggested.

Front every public DNS record with Cloudflare's proxy (orange cloud, not grey). Move email to a separate IP from web hosting — use a transactional email provider so your origin's IP doesn't appear in mail headers. Use Cloudflare's Origin CA certificates instead of public CT-logged certs on the origin itself, so direct connections fail TLS validation. Lock down origin firewall to Cloudflare's IP ranges only — Cloudflare publishes them at cloudflare.com/ips/, and you should refresh that allowlist via automation. If origin IP leaks despite everything, rotate it (this is operationally annoying but achievable on cloud providers). Consider Cloudflare Tunnel (cloudflared) which removes the origin IP from the picture entirely — your origin makes outbound connections to Cloudflare and never accepts inbound traffic.