Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
When you proxy a website hostname through Cloudflare, visitors connect to Cloudflare first, and Cloudflare forwards their requests to your host. That changes the public DNS answer, what your origin server sees as the connection source, and how HTTPS is established. It also gives Cloudflare an opportunity to apply configured caching and security rules along the way.
1. DNS points visitors to Cloudflare, not directly to your host
For a proxied A, AAAA, or CNAME record, DNS returns Cloudflare anycast IP addresses rather than the origin server’s address. The browser then sends its HTTP or HTTPS request through Cloudflare, which forwards it to the origin. Cloudflare describes this as a way to hide origin IP addresses from proxied DNS answers and provide DDoS protection in its origin-protection guidance.
A DNS-only record works differently: DNS returns its underlying target, and the HTTP proxy is bypassed. Other record types, including MX and TXT, cannot be proxied. See Cloudflare’s proxy-status documentation for the record behavior.
What this does—and does not—hide
Proxying can keep the origin address out of the DNS answer for that proxied hostname, but it does not guarantee that the address is undiscoverable. A DNS-only record or another public disclosure may still reveal it. Review DNS records and other places where the origin address may be exposed, and restrict direct access to the origin where appropriate.
#1 Best Overall
2. Your origin sees Cloudflare as the network peer
A proxied request reaches the origin from a Cloudflare IP address, not directly from the visitor’s address. Cloudflare supplies visitor-IP information in headers such as CF-Connecting-IP and X-Forwarded-For. Your application and infrastructure must be configured to use forwarded information safely if they rely on the visitor’s IP for logs, geolocation, authentication, or rate limiting. Cloudflare explains the relevant HTTP headers and proxy use cases.
Do not treat a forwarded-IP header as trustworthy merely because it is present. Configure the application to trust it only when the request comes through the intended proxy path; otherwise, a client may be able to supply misleading header values.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Check the origin firewall and integrations
- Allow Cloudflare’s published IP ranges through the origin firewall, or proxied visits may be blocked. Keep the ranges current using Cloudflare’s IP-address list.
- Check APIs, webhooks, or other integrations that validate an incoming source IP. They may see Cloudflare’s address rather than the visitor’s or service’s original address.
- Review access logs, geographic rules, and rate limits to ensure they use the intended visitor-IP value rather than treating Cloudflare’s network peer as the visitor.
3. HTTPS and request handling pass through an intermediary
With the standard proxy, Cloudflare terminates the visitor’s TLS connection and establishes a separate connection to the origin. The browser’s HTTPS session therefore ends at Cloudflare; the origin connection is a second leg. The TLS certificate and settings on each leg matter, so configure the origin connection and Cloudflare’s TLS mode to match your security requirements.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe visitor’s client certificate is not presented directly to the origin during the origin TLS handshake. If your application’s client-certificate design depends on the browser connecting directly to the origin, account for the proxy hop before enabling proxying. Cloudflare describes this request path in its proxy use cases and documents the headers it adds or changes in its HTTP-header reference.
Caching and security depend on configuration
Cloudflare may apply caching and configured security features, including DDoS protection and web application firewall rules. But proxying does not mean every request or asset will be cached. Cache behavior depends on the resource, response headers, and configuration: origin Cache-Control directives can govern caching, while Cache Rules can augment or override origin directives or defaults. See How Cloudflare DNS works and Origin Cache Control.
Choose Proxied or DNS-only by hostname
Use the hostname’s purpose and your origin setup to decide whether its record should be proxied. Cloudflare’s standard HTTP proxy handles HTTP and HTTPS, not arbitrary network services.
| Check | Proxied is a fit when… | DNS-only is a fit when… |
|---|---|---|
| Service | The hostname serves HTTP or HTTPS and should pass through Cloudflare. | The hostname serves mail, SSH, FTP, RDP, a game server, or another non-HTTP service. |
| Origin-IP requirements | Clients and integrations do not need to connect to or validate the origin’s public IP directly. | A third party requires the origin IP or the service needs direct DNS resolution. |
| Firewall | The origin allows Cloudflare’s published IP ranges. | The origin is intended to receive direct connections from clients or services. |
| Visitor-IP handling | The application can safely use forwarded visitor-IP headers. | The application requires the direct network peer address and cannot be adapted to use forwarded information. |
| TLS and certificates | The two TLS legs and any client-certificate requirements are compatible with a proxy. | The connection design requires the client’s TLS session or certificate to reach the origin directly. |
Mail-related records such as MX and TXT are not proxyable; keep applicable mail records DNS-only. For other non-HTTP services, use DNS-only unless you have a separate service suitable for proxying them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Before switching a website hostname to Proxied
- Confirm the record is for a website served over HTTP or HTTPS, rather than mail or another non-HTTP service.
- Check that the origin firewall accepts Cloudflare’s published IP ranges.
- Configure the application and logging stack to handle visitor-IP headers safely.
- Verify the TLS settings for both the visitor-to-Cloudflare and Cloudflare-to-origin connections, including any client-certificate dependency.
- Check DNS-only records and other public disclosures that could still expose the origin address.
- Review caching expectations against origin response headers and any Cache Rules; do not assume all content will be cached.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
