Skip to content
Emergency helpGet started
PHP critical fixes (php2shell)PHP fixed two critical remote code execution flaws on 21 October 2026. Check whether your site discloses an affected PHP version.Check your site
Back to Tools

Cloudflare IP Ranges

Cloudflare's current IPv4 and IPv6 address ranges, checked against Cloudflare's API every day. Paste IP addresses from your origin logs to see which are Cloudflare's, then copy the ranges as nginx, Apache, iptables, ufw, nftables or AWS security group rules.
Check IP addresses
  • Runs in your browser
  • Updated daily from Cloudflare

Unlimited: runs in your browser, no sign-in needed

  1. 1Input
  2. 2Results
Step 1

Is this IP address Cloudflare's?

Paste IP addresses one per line or separated by commas, or paste lines straight from an access log. IPv4 and IPv6 can be mixed; ports, brackets and the rest of the log line are ignored.

Checked in your browser as you type. Nothing you paste is sent to Vigilbase.

Ranges

Cloudflare's current IP ranges

Last updated October 26, 2026, from Cloudflare's API. The list is checked again every day. Source: cloudflare.com/ips

IPv4 ranges (15)

RangeAddresses
173.245.48.0/204,096
103.21.244.0/221,024
103.22.200.0/221,024
103.31.4.0/221,024
141.101.64.0/1816,384
108.162.192.0/1816,384
190.93.240.0/204,096
188.114.96.0/204,096
197.234.240.0/221,024
198.41.128.0/1732,768
162.158.0.0/15131,072
104.16.0.0/13524,288
104.24.0.0/14262,144
172.64.0.0/13524,288
131.0.72.0/221,024

IPv6 ranges (7)

Range
2400:cb00::/32
2606:4700::/32
2803:f800::/32
2405:b500::/32
2405:8100::/32
2a06:98c0::/29
2c0f:f248::/32
Configure

Copy-ready configuration

Built from the ranges above. Review each one before you apply it, and keep a way back in: a firewall rule that blocks your own access is easy to write.

Put this in the http block. Logs, rate limits and allow rules then see the visitor's address instead of a Cloudflare one.

Restore visitor IPs (nginx)
# Cloudflare IP ranges, retrieved 2026-10-26 from https://www.cloudflare.com/ips/
# Restores the visitor's address from CF-Connecting-IP (ngx_http_realip_module).
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;

Rather not keep origin rules and range lists up to date yourself? Vigilbase Shield is Cloudflare, fully managed: our team sets up and tunes the WAF, DDoS protection and bot filtering for your sites. Explore Vigilbase Shield

Check how your Cloudflare account is set up

The Cloudflare Checkup reviews your account with read-only access, including SSL/TLS, WAF and DNS settings, grades it A to F and emails you the full report.

Run the Cloudflare Checkup

Introducing Vigilbase OS

The cybersecurity operating system.

Connect the security tools you already pay for. Spin up personalised dashboards in minutes, with every log and event auditable and queryable in one place.

Get startedExplore Vigilbase Shield
one.vigilbase.com/acme.examplePreview · sample data

Acme Security OS

3 sources connected

Ingesting
Cloudflare

Threats mitigated

0

AWS

Root & IAM changes

0

GitHub

Org security changes

0

events | where severity >= medium | last 24h
    Vigil agentWorking
    1. Investigate Credential-stuffing burst against /login
    2. Fix Rate-limit rule deployed at the edge
    3. Verify Attack traffic down 98% in five minutes

    What are Cloudflare's IP ranges?

    Cloudflare's IP ranges are the IPv4 and IPv6 address blocks of Cloudflare's network. When a DNS record is proxied, visitors connect to Cloudflare, and Cloudflare connects to your origin server from an address in these ranges. Cloudflare publishes the list at cloudflare.com/ips and through its API, and changes it rarely.

    Origin servers behind Cloudflare use the list for two jobs: restoring each visitor's real IP address from the CF-Connecting-IP header, and accepting web traffic from Cloudflare only, so nobody can skip the WAF and DDoS protection by connecting to the origin directly.

    How to use Cloudflare's IP ranges on your origin

    Most origins behind Cloudflare need the list for the first two steps. The third closes the gap an IP allowlist leaves open.

    1. Restore visitor IP addresses

    Behind Cloudflare, every request reaches the origin from a Cloudflare address. Trust the CF-Connecting-IP header only from these ranges (set_real_ip_from in nginx, RemoteIPTrustedProxy in Apache). Trusting it from anywhere lets any client fake its address.

    2. Accept web traffic from Cloudflare only

    Allow ports 80 and 443 from these ranges and block them for everyone else, in the host firewall or your cloud provider's security group. Keep separate rules for SSH, mail and any hostname that is not proxied.

    3. Authenticate the connection too

    Every Cloudflare customer's traffic comes from the same ranges, so an IP allowlist alone does not prove a request came through your zone. Turn on Authenticated Origin Pulls, or connect the origin with Cloudflare Tunnel instead of opening ports.

    4. Keep the list current

    Cloudflare adds ranges from time to time. Rebuild the configuration from this page or from Cloudflare's API when the list changes, rather than copying it once and forgetting it.

    Related checks and next steps

    • Cloudflare Checker

      See whether a website is on Cloudflare, and whether its traffic is proxied or DNS-only.

    • Cloudflare Checkup

      A read-only review of your Cloudflare account and zones, with an A to F grade and the fixes that matter most.

    • HTTP Security Headers Checker

      Check the security headers your site sends through Cloudflare.

    • Vigilbase Shield

      Cloudflare, fully managed: our team sets up and tunes the WAF, DDoS protection and bot filtering for your sites.

    Managed Cloudflare

    Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.

    Explore Managed Cloudflare

    Managed SOC

    Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.

    Explore Managed SOC
    Email a security expert

    Sources

    Questions

    Cloudflare IP ranges FAQ

    What are Cloudflare's current IP ranges?

    The current IPv4 and IPv6 ranges are listed on this page with the date they were retrieved. They come from Cloudflare's API (api.cloudflare.com/client/v4/ips), which publishes the same lists as cloudflare.com/ips-v4 and cloudflare.com/ips-v6. This page checks the API once a day.

    How do I check if an IP address belongs to Cloudflare?

    Paste the address into the checker on this page. It compares each address with every published range, IPv4 and IPv6, and shows the range it falls in. You can paste many addresses at once, including whole lines from an access log, and the check runs in your browser.A match means the address is in Cloudflare's network. It does not tell you which Cloudflare customer or service sent the request.

    Why do my server logs show Cloudflare IP addresses instead of my visitors?

    When a hostname is proxied, Cloudflare opens the connection to your origin, so the source address is Cloudflare's. Cloudflare sends the visitor's address in the CF-Connecting-IP header. Configure your web server to read it from requests that come from Cloudflare's ranges, with the nginx or Apache snippet on this page.A practical website protection guide

    Should I allow only Cloudflare IP addresses on my origin?

    For a proxied website, yes: allow ports 80 and 443 from Cloudflare's ranges and block them for everyone else, so attackers cannot reach the origin directly and bypass the WAF and DDoS protection. Keep your own rules for SSH, mail and any hostname that is DNS-only, because that traffic does not come through Cloudflare.How a web application firewall worksManaged WAF operations and change control

    Is allowlisting Cloudflare's IP ranges enough to protect my origin?

    Not on its own. Traffic for every Cloudflare customer comes from the same ranges, so someone could point their own Cloudflare zone at your origin's address. Add Authenticated Origin Pulls, which makes Cloudflare present a client certificate, or use Cloudflare Tunnel, which needs no open inbound ports at all.Application and API protectionWhat Managed Cloudflare includes

    Which ports does Cloudflare connect to?

    Cloudflare proxies HTTP on ports 80, 8080, 8880, 2052, 2082, 2086 and 2095, and HTTPS on ports 443, 2053, 2083, 2087, 2096 and 8443. The firewall snippets here open 80 and 443; add any other port your origin serves.

    Do I need Cloudflare's IP ranges if I use Cloudflare Tunnel?

    Not for the firewall. With Cloudflare Tunnel, the cloudflared connector makes outbound connections to Cloudflare, so the origin can block all inbound web traffic. You may still want the real IP configuration if your web server logs the connector's address.Internal access and Zero Trust

    How often do Cloudflare's IP ranges change?

    Rarely, but they do change. This page checks Cloudflare's API daily and shows when the list was retrieved. Rebuild any firewall or web server configuration you copied from it when the list changes.

    Is anything I paste sent to Vigilbase?

    No. The checker runs in your browser, and the addresses you paste are not sent to Vigilbase.Privacy and data handling