导航|地址|刷新
Protect your origin server

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/fundamentals/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Cloudflare Fundamentals

/

Overview

Concepts

How Cloudflare DNS works

Traffic flow through Cloudflare

Accounts, zones, and profiles

Cloudflare IP addresses

Get started

Accounts

Create account

Account security

Add abuse contact

Allow Cloudflare access

Leaked Password Notifications

Manage active sessions

Review audit logs - v1

Audit Logs - v2

SCIM provisioning

Overview

Authentik

Microsoft Entra

Okta

Troubleshooting

Secure compromised account

Set up SSO ↗

Zone holds

Find account and zone IDs

Change Super Administrator

OrganizationsBeta

Overview

Organizations for Enterprise

Organizations for MSSP and Distributors

Policy sharing

Limitations and troubleshooting

Members and permissions

Members and permissions

Manage

Policies

Roles

Role scopes

User GroupsNew

Set up dashboard SSO

User profiles

Overview

Verify email address

Log in to Cloudflare

Profile settings

Account recovery

Delete your Cloudflare account

Email address and password

Multi-Factor Email Authentication

Two-factor authentication

Domains

Overview

Add multiple sites via automation

Change your domain version

Manage subdomains

Move a domain between Cloudflare accounts

Onboard a domain

Pause Cloudflare

Redirect one domain to another

Remove a domain

Star domains

Performance

Improve SEO

Maintenance mode

Minimize downtime

Optimize site speed ↗

Prepare for surges or spikes in web traffic ↗

Test speed

Security

Prevent DDoS attacks ↗

Protect your origin server

Recovering from a hacked site

Scan for PCI compliance

Secure your website ↗

Under a DDoS attack?

Cloudflare's API

Get started

Create API token

Get Global API key (legacy)

Get Origin CA keysDeprecated

Token formats

Account API tokens

How to

Make API calls

Create tokens via API

Control API Access

Restrict tokens

Roll tokens

API token template URLs

Reference

REST API ↗API

GraphQL API ↗

Wrangler API ↗

API token permissions

API deprecations

API token templates

Rate limits

SDKs

Troubleshooting

OAuth Applications on Cloudflare

Overview

Create your OAuth client

Integrate your OAuth client with Cloudflare

Authorizing an application

Reference

Migration guides

SCIM migration

Policies

Cloudflare Cookies

Compliance documentation

Content Security Policies (CSPs)

Delivering Videos with Cloudflare

Licenses

Project Cybersafe Schools

Abuse

Overview

Review abuse policies

Complaint types

Providing specific URLs

Customer abuse report obligations

View and submit reports

Blocked Content

SDK ecosystem support policy

Troubleshooting

/cdn-cgi/ endpoint

Account and domain management best practices

Cloudflare and Google Analytics

Cloudflare crawlers

Cloudflare HTTP headers

Cloudflare Ray ID

Cloudy AI agentBeta

Connection limits

Cryptographic Attestation of Personhood

Error responses

Glossary

Markdown for AgentsBeta

Network Layers

Network ports

Partners

Redirects

Scans and penetration testing policy

TCP connections

Under Attack mode

RSS Feeds

Available RSS Feeds

Consuming RSS Feeds

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Cloudflare Fundamentals llms.txt ↗

Cloudflare Fundamentals llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Cloudflare Fundamentals

/Security

/Protect your origin server

Protect your origin server

Last updated Apr 20, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewSecure origin connections Application layer Transport Layer Network LayerMonitor origin health Zero Downtime FailoverReduce origin traffic Block traffic Increase caching Distribute traffic

Your origin server ↗ is a physical or virtual machine that is not owned by Cloudflare and hosts your application content (data, webpages, etc.).

Receiving too many requests can be bad for your origin. These requests might increase latency for visitors, incur higher costs — particularly for cloud-based machines — and could knock your application offline.

Secure origin connections

When you secure origin connections, it prevents attackers from discovering and overloading your origin server with requests.

DNS:
Proxy records (when possible): Set up proxied (orange-clouded) DNS records to hide your origin IP addresses and provide DDoS protection. As part of this, you should allow Cloudflare IP addresses at your origin to prevent requests from being blocked.

Review DNS-only records: Audit existing DNS-only records (SPF, TXT, and more) to make sure they do not contain origin IP information.

Evaluate mail infrastructure: If possible, do not host a mail service on the same server as the web resource you want to protect, since emails sent to non-existent addresses get bounced back to the attacker and reveal the mail server IP.

Rotate origin IPs: Once onboarded, rotate your origin IPs, as DNS records are in the public domain. Historical records are kept and would contain IP addresses prior to joining Cloudflare

Application layer

Cloudflare Tunnel (HTTP / WebSockets)

Cloudflare Tunnel connects your resources to Cloudflare without a publicly routable IP address, by creating an outbound-only connections to Cloudflare’s global network.

Security: Very secure.

Availability: All customers.

Challenges: Requires installing the cloudflared daemon on origin server or virtual machine.

HTTP Header Validation

Only allow traffic with specific (and secret) HTTP headers.

Security: Moderately secure.

Availability: All customers.

Challenges:
Requires more configuration efforts on application- and server-side to accept those headers.

Basic authentication is vulnerable to replay attacks. Because basic authentication does not encrypt user credentials, it is important that traffic always be sent over an encrypted SSL session.

There might be valid use cases for a mismatch in SNI / Host headers such as through Origin or Page Rules, Load Balancing, or Workers, which all offer HTTP Host Header overrides.

Process:
Use Transform rules or Workers to add an HTTP Auth Header.

Configure your origin server to restrict access based on the HTTP Auth Header (or perform HTTP Basic Authentication).

Configure your origin server to restrict access based on the HTTP Host Header ↗. Specifically, only allow requests which contain expected HTTP Host Header values, and reject all other requests.

JSON Web Tokens (JWT) Validation

Only allow traffic with the appropriate JWT.

Security: Very secure.

Availability: Some customers.

Challenges:
Requires either installing incremental software or modifying application code.

Lots of manual work.

Resources:
Validate JWTs for an Access application

Validate JWTs for an API

Transport Layer

Authenticated Origin Pulls

Authenticated Origin Pulls helps ensure requests to your origin server come from the Cloudflare network.

Security: Very secure.

Availability: All customers.

Challenges:
Requires Full or Full (strict) encryption modes.

Requires more configuration efforts for application and server, such as uploading a certificate and configuring the server to use it.

For more strict security, you should upload your own certificate. Although Cloudflare provides you a certificate for easy configuration, this certificate only guarantees that a request is coming from the Cloudflare network.

Not scalable for large numbers of origin servers.

Cloudflare Tunnel (SSH / RDP)

Cloudflare Tunnel connects your resources to Cloudflare without a publicly routable IP address, by creating an outbound-only connections to Cloudflare’s global network.

Security: Very secure.

Availability: All customers.

Challenges: Requires installing the cloudflared daemon on origin server or virtual machine.

Network Layer

Allowlist Cloudflare IP addresses

Explicitly block all traffic that does not come from Cloudflare IP addresses (or the IP addresses of your trusted partners, vendors, or applications).

Security: Moderately secure.

Availability: All customers.

Challenges:
Requires allowlisting Cloudflare IP ranges at your origin server.

Vulnerable to IP spoofing.

Cloudflare Magic Transit

Cloudflare Magic Transit is a network security and performance solution that offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks.

Security: Very secure.

Availability: Enterprise-only.

Challenges
Client's routers must:
Support anycast tunneling.

Allow configuration of at least one tunnel per Internet service provider (ISP).

Support maximum segment size (MSS) clamping.

Cloudflare Network Interconnect

Cloudflare Network Interconnect allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience.

Security: Very secure.

Availability: Enterprise-only.

Challenges
Requires some networking knowledge.

Only applies to some customer use cases.

Dedicated CDN Egress IPs

Smart Shield Advanced provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and A geographically distributed group of servers which work together to provide fast delivery of Internet content.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>CDN services, as well as Spectrum. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing a small list of IP addresses through your The network layer in the OSI model, responsible for logical addressing, routing, and forwarding of data between devices on different networks.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>layer 3 firewall.

Security: Very secure.

Availability: Enterprise-only.

Challenges: Requires network-level firewall policies.

Monitor origin health

For passive monitoring, create notifications for Origin Error Rate Alerts to receive alerts when your origin returns 5xx codes above a configurable threshold and Passive Origin Monitoring to see when Cloudflare is unable to reach your origin for a few minutes.

For more active monitoring, set up standalone health checks for your origin.

Note

If you have multiple servers and want to proactively prevent origin problems, set up load balancing as an add-on service.

Zero Downtime Failover

If you have another A or AAAA record in your Cloudflare DNS or your Cloudflare Load Balancer provides another Any service or hardware that intercepts and processes incoming public or private traffic.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>endpoint in the same pool, Zero-Downtime Failover automatically retries requests to your origin even before a Load Balancing decision is made.

Zero-downtime failover will trigger a single retry only if there is another healthy endpoint in the pool and a 521, 522, 523, 525 or 526 error code is occurring. No other error codes will trigger a zero-downtime failover operation.

Reduce origin traffic

Block traffic

For more details, refer to Secure your website.

Increase caching

The cache stores data from your application (webpages, etc.) at Cloudflare data centers around the world, which reduces the number of requests sent to your origin server.

Distribute traffic

To randomly distribute traffic across multiple servers, set up multiple DNS records.

For more fine-grained control over traffic distribution — including automatic failover, intelligent routing, and more — set up our add-on load balancing service.

To protect specific endpoints from being overwhelmed by traffic spikes, set up a waiting room.

PreviousPrevent DDoS attacks ↗NextRecovering from a hacked site

Was this helpful?

YesNo

Edit pageReport issue

On this page

Overview

Secure origin connections

Application layer

Transport Layer

Network Layer

Monitor origin health

Zero Downtime Failover

Reduce origin traffic

Block traffic

Increase caching

Distribute traffic

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址