Preventing Cloudflare being bypassed.
THE PROBLEM
If an attacker learns the address of our server, they can send traffic directly to it, bypassing Cloudflare entirely.
Every protection you configured is then irrelevant.
HOW THE ADDRESS LEAKS
A DNS record left unproxied, such as an old subdomain or a direct record Mail headers, which necessarily reveal the sending server Historical DNS records, which are archived publicly A subdomain like cpanel or ftp pointing directly
WHAT YOU CAN DO
Review every DNS record and proxy everything that serves web traffic Remove records you do not need Be aware that mail hostnames must remain unproxied and will reveal the address
THE HONEST POSITION
For a shared hosting account, the server address is shared with many sites and is fairly discoverable.
Complete origin protection is difficult on shared hosting and is more achievable on a dedicated address.
WHAT THIS MEANS PRACTICALLY
Cloudflare protection is real and not absolute. Keep your own site secure as well.
IF YOU ARE UNDER SUSTAINED ATTACK
Open a ticket. We can apply server-side measures.
