How do I prevent attackers from discovering my real hosting IP (where I'm hosting my website) that is hidden behind CloudFlare Proxy?

  • 1
    @StephenOstermiller I wonder if you inverted the meaning of the original post with your edit ? I can't see why the OP would be asking to expose their real IP through Cloudflare, but that seems to be the thrust of the original quiestion? – davidgo Nov 20 '20 at 4:38
  • @davidgo that's right! – Tony Nov 20 '20 at 9:10
  • I asked for clarifications and this is what they said they meant in the comments. I then deleted those comments once I edited them into the question. The comment was " I want to make sure that my server IP won't be ever exposed to potential attacker " – Stephen Ostermiller Nov 20 '20 at 11:59

If Cloudflare Proxy is in use, you are pointing your DNS to Cloudflare, so this very action prevents people from seeing where you are hosting your website. So the only thing to do is to ensure there is nothing in your zone file which leaks this information through a related subdomain.

  • That's what I thought but I'm afraid there may be methods that will bypass this protection anyway – Tony Nov 20 '20 at 9:12
  • Its fairly robust protection. If someone could back your site through Cloudflare they might be able to force it to divulge its real address. Failing that it would be close to impossible. (3letter agencies can no doubt ask cloudflare, there might be some timing analysis attacks a privileged few network operators could do, but these are edge cases) – davidgo Nov 20 '20 at 9:39
  • 1
    The origin server is still on the public internet. It could be discovered through other means such as scans that look at all IP addresses in a block. Are there firewall rules that could be used to protect it so that only Cloudflare can access it? – Stephen Ostermiller Nov 20 '20 at 12:06

Like davidgo said once you change your domain's nameservers to Cloudflares' and activate the CDN your hosting IP will be covered. If you are still worried I recommended using Cloudflare Pro.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.