Cloudflare Checker

Find out whether a website is on Cloudflare. The checker looks at the site's nameservers, compares its IP addresses with Cloudflare's published ranges and reads the headers on its HTTPS response.

Start a check

Non-Intrusive Scan
DNS and HTTP headers

Check

Is this website on Cloudflare?

Enter a domain or URL. We look up its DNS records and send one HTTPS request to read the response headers.

Introducing Vigilbase OS

The cybersecurity operating system.

Connect the security tools you already pay for. Spin up personalised dashboards in minutes, with every log and event auditable and queryable in one place.

Get started Explore Managed Cloudflare

one.vigilbase.com/acme.examplePreview · sample data

Acme Security OS

3 sources connected

Ingesting

Cloudflare

Threats mitigated

AWS

Root & IAM changes

GitHub

Org security changes

events | where severity >= medium | last 24h

Vigil agentWorking

Investigate Credential-stuffing burst against /login
Fix Rate-limit rule deployed at the edge
Verify Attack traffic down 98% in five minutes

How do you check if a website uses Cloudflare?

Three public signals show it. Cloudflare answers DNS queries for proxied records with addresses from its published IP ranges, its responses carry a CF-Ray header and usually Server: cloudflare, and zones on Cloudflare DNS usually use nameservers ending in ns.cloudflare.com. The checker reads all three, so it can tell proxied traffic apart from a domain that only uses Cloudflare for DNS.

As a WAF detector it answers one question: does traffic pass through Cloudflare's edge, where its WAF and DDoS protection run? Which rules are switched on cannot be seen from outside. The Cloudflare Checkup reviews that with read-only access to your own account.

What the Cloudflare checker looks at

Every signal is public and documented by Cloudflare. The checker sends one HTTPS request to the hostname; everything else is DNS.

IP addresses

The hostname's A and AAAA records, compared with Cloudflare's published IPv4 and IPv6 ranges. Proxied records return Cloudflare anycast addresses instead of the origin server's.

CF-Ray and Server headers

One HTTPS request to the hostname. Cloudflare adds CF-Ray to proxied responses, which normally also carry Server: cloudflare. A cf-mitigated: challenge header means Cloudflare served a challenge page.

Nameservers

The zone's NS records. Standard Cloudflare nameservers end in ns.cloudflare.com, and Foundation DNS uses foundationdns.com, .net and .org. Custom nameservers on the customer's own domain cannot be recognised.

Partial (CNAME) setup

A CNAME to a name ending in cdn.cloudflare.net means Cloudflare proxies the hostname while DNS stays with another provider, a setup Cloudflare offers on Business and Enterprise plans.

What the result means

Proxied through Cloudflare

Traffic for the hostname goes through Cloudflare's network, where WAF rules, DDoS protection and caching can apply. The account behind it is not visible from outside: it may be the site owner's or a hosting provider's.

Cloudflare DNS only

The zone uses Cloudflare nameservers, but the hostname resolves straight to the origin server, so Cloudflare's proxy features do not apply to it and the origin's IP address is public.

Not on Cloudflare

None of the signals point to Cloudflare. The site may use another CDN or WAF, or none.

Related checks and next steps

Cloudflare Checkup
Review your own account's WAF, SSL/TLS, DNSSEC and security settings with read-only access.
DNSSEC Checker
Check whether the domain's DNS answers are signed and validate.
HTTP Security Headers Checker
Grade the security headers the site sends.
Cloudflare WAF
How Cloudflare WAF rules work, and how Vigilbase sets them up and tunes them under change control.

Managed Cloudflare

Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.

Explore Managed Cloudflare

Managed SOC

Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.

Explore Managed SOC

Email a security expert

Sources

Questions

Cloudflare checker FAQ

How can I tell if a website is behind Cloudflare?

Check whether its hostname resolves to an address in Cloudflare's published IP ranges, and whether its HTTPS responses carry a CF-Ray header. Either one means requests go through Cloudflare's network. This checker does both, plus a nameserver lookup.Cloudflare Enterprise with Vigilbase

Is a site on Cloudflare protected by its WAF?

Only proxied traffic passes through Cloudflare's WAF and DDoS protection. Which managed and custom rules are on depends on the plan and the configuration, and cannot be seen from outside. Run the Cloudflare Checkup on your own account to review it.Cloudflare Checkup and report options How a web application firewall works

What does DNS-only mean?

A DNS-only record answers with the origin server's real IP address, so requests go straight to the server instead of through Cloudflare's proxy, and the address is visible to anyone who looks it up. Cloudflare's security and performance features apply only to proxied records.What Managed Cloudflare includes

Can a website hide that it uses Cloudflare?

Not easily. Proxied hostnames resolve to Cloudflare addresses, and Cloudflare's response header transform rules cannot change headers that start with cf- or the server header. A site can use custom nameservers, so the nameserver signal on its own is not conclusive.

Why does a site I host elsewhere show as proxied?

Some hosting and SaaS platforms run on Cloudflare, so a hostname pointed at them can be served by Cloudflare's network even when the site owner has no Cloudflare account.

Does the checker scan the site?

It makes standard DNS lookups and a single HTTPS request to the hostname, the same as loading one page, and reads the response headers. Results are not stored.Compare the public security checks