Cloudflare and reverse proxy — a secure setup
The orange cloud does not protect services outside the proxy. Use Full (strict), trusted client-IP headers and block direct origin access.
Cloudflare can front public HTTP traffic, but the origin still needs hardening. Without firewall rules an attacker may bypass the proxy and connect directly to the server IP.
The reverse proxy routes hostnames, terminates TLS and sets forwarding headers. It must not trust X-Forwarded-For from arbitrary Internet clients.
DNS and TLS mode
Proxy the DNS record, select Full (strict) and install a valid origin certificate for the hostname. Flexible leaves an unencrypted hop and commonly causes redirect loops.
- Test the origin certificate before enabling the proxy.
- Keep DNS-only records only where required.
- Do not proxy unsupported protocols.
Block proxy bypass
Allow Cloudflare address ranges on 80/443 or use an authenticated tunnel. Put management behind a VPN, Access or a separate MFA-protected hostname.
Real client IP and rate limits
Trust client-IP headers only from known proxy sources. Rate-limit both at the edge and in the app, and correlate logs with request identifiers.
- Test HTTP-to-HTTPS and canonical-host redirects.
- Enable HSTS only after checking every subdomain.
- Monitor the origin independently of the external proxy.
Cloudflare and proxy check
- TLS uses Full (strict).
- The origin rejects arbitrary source IPs.
- Client headers are trusted only from the proxy.
- Admin access has an additional control.
Put it into practice
Check TLS
Verify the public certificate and expiry after deploying the proxy.
Check TLSFrequently asked questions
Does one configuration fit every environment?
No. Inventory traffic, dependencies and the threat model first, then tighten controls. Verify each change externally and keep a rollback plan.
Where should I start?
Start with a tested backup, current patches and a smaller public attack surface. Then add monitoring and document an owner for every service.
How often should I repeat the review?
After every infrastructure or major-version change and at least quarterly. Monitor critical dependencies, certificates and backup outcomes continuously.