stop treating cloudflare like it's a vpn — it's not

Three threads this week with people thinking Cloudflare hides their server IP.

Cloudflare sits between your server and the visitor. It sees the visitor's IP and your server's IP. It logs both. If law enforcement comes with a subpoena, Cloudflare hands over the origin IP.

Cloudflare is a CDN and a DDoS shield. It is not an anonymity layer. If your threat model requires hiding your server's location, you need something else.

it also requires a real identity for the enterprise plan

To add to this: Cloudflare can be bypassed in several ways.

1. DNS lookup of historical records — if the origin IP was ever exposed directly, it's in someone's database.

2. SSL/TLS fingerprinting — Cloudflare's TLS stack has a distinct fingerprint. Tools like censys can identify it and sometimes infer the origin.

3. Direct IP access — if the origin IP is known, visitors can bypass Cloudflare entirely by accessing it directly.

Cloudflare is useful, but it's not opsec by itself.

Depends what you're running, but Cloudflare + a bulletproof VPS in a jurisdiction that doesn't cooperate is a reasonable setup for most grey-area use cases.

The key is understanding what layer hides what. Cloudflare hides the origin from casual visitors, not from determined adversaries. If you're hiding from law enforcement, you need more than Cloudflare.

Show me one thread where someone claimed Cloudflare was a VPN.

Check the newbie-corner threads from the last week. Half of them think Cloudflare alone makes them untraceable.