OneLineShield

What an exposed origin is, and why it matters

Putting your website behind Cloudflare does not stop anyone reaching your server directly. Here is why that happens, and how to tell if it applies to you.

Putting a website behind Cloudflare changes where the name points. It does not move your server, and it does not switch off the address your server already had.

So both doors stay open: the one through Cloudflare, and the one straight to your machine. The second one is what people mean by an exposed origin.

Why this happens at all

Your server has an IP address. That address answers requests from anyone who sends them, because that is what a web server does. Pointing a DNS name somewhere else does not tell the server to stop.

Cloudflare hides the address from the name. It cannot hide it from someone who already knows the number, and there are ordinary ways to learn it: old DNS records that were never deleted, mail sent from the same machine, certificate transparency logs, or a subdomain that was never moved.

What it actually means for you

It means the protection is optional from the attacker side. Someone who sends requests to the IP address instead of the name gets your server with nothing in front of it: no rate limiting, no bot filtering, no request inspection.

This is not an emergency, and we are not going to describe it as one. It is an open door on a building that may or may not be interesting to anyone. Worth closing, on a normal working day.

The reason it is worth knowing about is that it is invisible from the outside. Your website loads fine. Your dashboard says protected. Nothing looks wrong, because from the front nothing is wrong.

How to tell whether it applies to you

Ask your server directly instead of asking the name. If you know your origin address, request the site from it and see whether you get your website back.

  1. Find your origin address, the one your hosting company gave you.
  2. Request your site from that address rather than from your domain.
  3. If your website answers, the door is open. If the connection is refused or times out, it is not.

This is one of the checks we run every ten minutes, and the result is a flag on your dashboard rather than a score. If we cannot determine it, we say that instead of guessing.

How to close it

On your server, accept connections on ports 80 and 443 only from Cloudflare address ranges, and refuse everything else. Cloudflare publishes those ranges, and they change rarely.

Where you set that depends on what you run: a firewall rule, a hosting panel setting, or a line in your web server config. Your hosting company can usually do it for you if you tell them exactly that sentence.

Test it before you walk away. A rule that blocks Cloudflare as well as everyone else takes your website offline, and it does so quietly if you were only checking through the proxy.

This works the same whether you use us or move your nameservers to Cloudflare yourself. It is your server and your rule; we only tell you whether it is doing what you think it is doing.

All posts