导航|地址|刷新
Define source origins

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/images/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Cloudflare Images

/

Overview

Get started

Introduction

Key concepts

Limits and formats

Optimization

Features

Remote images (transformations)

Overview

Define source origins

Create transformation flows

Transform via fetch

Control origin access

Draw overlays and watermarks

Integrate with frameworks

Set up rewrite rules

Preserve Content Credentials

Hosted images

Serve uploaded images

Create predefined variants

Enable flexible variants

Apply blur

Delete variants

Preserve Content Credentials

Browser TTL

Serve images from custom domains

Serve private images

Optimize with Workers

Draw overlays and watermarks

Make responsive images

Storage

Upload images

Methods

Upload via URL

Upload via custom path

Accept user-uploaded images

Upload via batch API

Upload via a Worker

Upload via Sourcing Kit

Overview

Enable Sourcing Kit

Edit sources

Credentials

Configure webhooks

Manage hosted images

Edit images

Export images

Delete images

Manage with Workers

Demos and architectures

Pricing

Cloudflare Polish

Overview

Activate Polish

Polish compression

Cf-Polished statuses

WebP may be skipped

Images API Reference ↗API

Reference

Troubleshooting

Security

Tutorials

Optimize mobile viewing

Transform user-uploaded images before uploading to R2

Examples

Platform

Changelog

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Cloudflare Images llms.txt ↗

Cloudflare Images llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Cloudflare Images

/…
Optimization

/Remote images (transformations)

/Define source origins

Define source origins

Last updated Apr 21, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewHow it worksAllow source images only from allowed originsAllow source images from any origin

When optimizing remote images, you can specify which origins can be used as the source for transformed images. By default, Cloudflare accepts only source images from the zone where your transformations are served.

On this page, you will learn how to define and manage the origins for the source images that you want to optimize.

Note

The allowed origins setting applies to requests from Workers.

If you use a Worker to optimize remote images via a fetch() subrequest, then this setting may conflict with existing logic that handles source images.

How it works

In the Cloudflare dashboard, go to Images > Transformations and select the zone where you want to serve transformations.

To get started, you must have transformations enabled on your zone.

In Sources, you can configure the origins for transformations on your zone.

Allow source images only from allowed origins

You can restrict source images to allowed origins, which applies transformations only to source images from a defined list.

By default, your accepted sources are set to allowed origins. Cloudflare will always allow source images from the same zone where your transformations are served.

If you request a transformation with a source image from outside your allowed origins, then the image will be rejected. For example, if you serve transformations on your zone a.com and do not define any additional origins, then a.com/image.png can be used as a source image, but b.com/image.png will return an error.

To define a new origin:

From Sources, select Add origin.

Under Domain, specify the domain for the source image. Only valid web URLs will be accepted.

When you add a root domain, subdomains are not accepted. In other words, if you add b.com, then source images from media.b.com will be rejected.

To support individual subdomains, define an additional origin such as media.b.com. If you add only media.b.com and not the root domain, then source images from the root domain (b.com) and other subdomains (cdn.b.com) will be rejected.

To support all subdomains, use the * wildcard at the beginning of the root domain. For example, *.b.com will accept source images from the root domain (like b.com/image.png) as well as from subdomains (like media.b.com/image.png or cdn.b.com/image.png).

Optionally, you can specify the Path for the source image. If no path is specified, then source images from all paths on this domain are accepted.

Cloudflare checks whether the defined path is at the beginning of the source path. If the defined path is not present at the beginning of the path, then the source image will be rejected.

For example, if you define an origin with domain b.com and path /themes, then b.com/themes/image.png will be accepted but b.com/media/themes/image.png will be rejected.

Select Add. Your origin will now appear in your list of allowed origins.

Select Save. These changes will take effect immediately.

When you configure allowed origins, only the initial URL of the source image is checked. Any redirects, including URLs that leave your zone, will be followed, and the resulting image will be transformed.

If you change your accepted sources to any origin, then your list of sources will be cleared and reset to default.

Allow source images from any origin

When your accepted sources are set to any origin, any publicly available image can be used as the source image for transformations on this zone.

Any origin is less secure and may allow third parties to serve transformations on your zone.

PreviousOverview NextCreate transformation flows

Was this helpful?

YesNo

Edit pageReport issue

On this page

Overview

How it works

Allow source images only from allowed origins

Allow source images from any origin

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址