Originally published on kuryzhev.cloud
Why this checklist
A client of mine once showed me their Cloudflare dashboard during what they thought was a DDoS attack. Traffic graphs were flat. Zero anomalies. Meanwhile their origin server's CPU was pegged at 100% and the app was falling over every few minutes. The attacker hadn't gone through Cloudflare at all — they'd found the origin IP and were hitting it directly, completely bypassing the WAF, the rate limiting, the bot protection, everything. That's the moment I started treating cloudflare origin hardening as a separate discipline from "just turning Cloudflare on."
Here's the uncomfortable truth: proxying your DNS through Cloudflare (the orange cloud icon) does not protect your origin server by itself. It protects requests that go through Cloudflare's edge. If someone finds your real IP — via old A records in DNS history tools like SecurityTrails, via certificate transparency logs on crt.sh, via a misconfigured mail server SPF record, or just by brute-forcing common subdomains before you enabled the proxy — they can talk directly to your server. No WAF, no rate limits, no bot challenge. Just raw TCP straight to your box.
This checklist closes three specific gaps: network-level access control (who can even reach the origin's IP), request-level filtering (bots, malicious payloads, brute force), and TLS trust between the edge and the origin (so the "encrypted" connection Cloudflare shows you is actually meaningful). If you only do one of these three, you haven't done cloudflare origin hardening — you've done a fraction of it.
