Find a website's real origin IP behind Cloudflare

Quick answer

When a site uses Cloudflare (or any CDN), a normal DNS lookup returns Cloudflare’s IP, not the real server. People look for the “origin IP” for legitimate reasons — verifying your own setup, migrating hosts, debugging — so here’s how the hiding works and why it’s deliberately hard to bypass.

Why is the origin IP hidden behind Cloudflare?

Cloudflare sits in front of the real server as a reverse proxy. Visitors connect to Cloudflare, which forwards requests to the origin. A DNS lookup of the domain returns Cloudflare’s addresses, so the origin’s real IP stays concealed. This is a core security feature: it shields the origin from direct attacks, since attackers can’t hit a server they can’t find.

Confirming a site is behind Cloudflare

Resolve the domain — our Reverse DNS tool and a normal lookup will show Cloudflare-owned addresses, and the ASN organisation comes back as Cloudflare. That tells you the origin is proxied. The Bulk IP Audit tool confirms the network owner for any IPs you do find.

For your OWN site (the legitimate case)

If it’s your site, you don’t need to “find” the origin — it’s in your hosting panel and your Cloudflare dashboard (the DNS records show the origin IP behind the proxied entries). For migrations or debugging, get the origin from there, not by probing.

Why bypassing someone else’s is hard (and a caveat)

Trying to uncover a third party’s hidden origin runs into the fact that Cloudflare’s whole job is to prevent it — and a properly configured origin only accepts traffic from Cloudflare, so even a leaked IP may be firewalled off. We won’t walk through techniques to defeat another site’s protection: doing so is what the security control exists to stop, and probing infrastructure you don’t own can cross legal lines.

Hardening your own origin

If you run a Cloudflare-proxied site, make sure the origin doesn’t leak: restrict the origin firewall to Cloudflare’s IP ranges so direct connections are refused, avoid exposing the real IP through email headers or subdomains that bypass the proxy, and keep DNS records proxied. That way even a discovered IP is useless to an attacker.