// TECHNOLOGIES / CLOUDFLARE

Cloudflare

Cloudflare, and whether it can be walked around.

Putting Cloudflare in front of your application is the desirable case — so server: cloudflare is a fingerprint, not a finding. The question worth asking is narrower and much harder: can your origin still be reached directly? If it can, every control you bought at the edge is optional for anyone who uses that address instead. NewScan proves it by content correlation — the origin must return the same application, with no Cloudflare edge evidence — because a 200 from an address in your zone proves nothing at all.

▸ Run the free scan ← All technologies

The dashboard blind-spot

// why an external scan matters

// THE DASHBOARD SHOWS (WHAT YOU CONFIGURED)

Your WAF rules, rate limits, Bot Management, Access policies, Cache Rules and proxy status — all as configured in the dashboard.

// IT CAN'T SEE (NEWSCAN DOES)

Whether a DNS-only record still points at the same web origin, whether that origin answers a direct request for your proxied hostname, and whether a .dev.vars or Worker bundle is handing out a runtime secret.

What NewScan records

// proven, then reproduced

Origin reachable directly

HIGH

A candidate address serves your application for your proxied hostname, returning the same content marker with no cf-ray. Every edge control becomes optional. The remedy is origin-side: Authenticated Origin Pulls plus a firewall allow-list.

Origin address disclosed by a public DNS record

MEDIUM

Recorded alongside the bypass: a DNS-only record pointing at the same web origin defeats the proxy with no attacker effort.

Worker/Pages secret exposed

HIGH

A public .dev.vars, Wrangler config, bundle or source map carrying a real secret with Workers/Pages context. A binding name is public and correct; a bound value is not.

What is never flagged

// the false-positive contract

A scanner earns its place by what it stays quiet about. These are guarantees, each one asserted by a test that fails the build if it regresses — not best-effort tuning.

server: cloudflare alone

Trivially spoofable by any origin. Two corroborating signals are required before anything is reported.

Port-scanning candidate addresses

Never. Only addresses the scan already resolved, or that you supplied, are contacted — one request each, all re-checked against scope.

Mail, verification and other non-HTTP DNS records

Cloudflare documents that some records cannot be proxied. Only a demonstrated web-origin linkage qualifies.

A generic cache-poisoning finding

Cache posture is an observation only, and no request is sent that could populate a cache another user then reads.

How it's proved

// training/tech/cloudflare

An edge, a leaking origin, a locked origin serving a different application, and a mail-like DNS-only sibling. The two negatives are the measurement: they prove a 200 from your zone is not a bypass.

// FINGERPRINT FIRST

The check is silent unless the product is confirmed by two independent signals. A single, spoofable marker confirms nothing.

// REPRODUCE BEFORE RECORD

Every finding is re-run by our own detector before it is written down. A model's self-assessment is discarded, not merged.

// SEVERITY THAT MAPS

One calibrated severity per finding, translated into PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA and NIST 800-53 ratings with remediation SLAs.

Run it against your own Cloudflare

NewScan is free and self-hosted — bring your own key. Every check on this page runs in the deterministic floor with no model and no provider key at all, so scanning your own Cloudflare surface is local to you and depends on no hosted resource.

Get NewScan (FREE) → Talk through your results