Protect your origin server — Enterprise

Your origin server Open external link is a physical or virtual machine that is not owned by Cloudflare and hosts your application content (data, webpages, etc.).

Receiving too many requests can be bad for your origin. These requests might increase latency for visitors, incur higher costs — particularly for cloud-based machines — and could knock your application offline.

Select a plan to see how Cloudflare can help you protect your origin:

Free Pro Business Enterprise

​​ Secure origin connections

When you secure origin connections, it prevents attackers from discovering and overloading your origin server with requests.

• DNS: Set up proxied (orange-clouded) DNS records and change your domain nameservers , which will also require that you allow Cloudflare IP addresses Open external link at your origin.
• SSL:
  • To encrypt all traffic between Cloudflare and your server, choose Strict (SSL-Only Origin Pull) SSL/TLS mode (requires server configuration)
  • To validate requests are coming from the Cloudflare network, set up authenticated origin pulls .
• Prevent external connections:
  • Origin Server (moderately secure): Configure your origin server to only allow traffic from Cloudflare IP addresses .
  • Cloudflare Tunnel (very secure): To encrypt all traffic and prevent any inbound connections to your origin, set up a Cloudflare Tunnel .

​​ Monitor origin health

For passive monitoring, create notifications for Origin Error Rate Alerts to receive alerts when your origin returns 5xx codes above a configurable threshold and Passive Origin Monitoring to see when Cloudflare is unable to reach your origin for a few minutes.

For more active monitoring, set up standalone health checks Open external link for your origin.

​​ Zero Downtime Failover

If you have another A or AAAA record in your Cloudflare DNS or your Cloudflare Load Balancer provides another origin in the same pool, Zero-Downtime Failover automatically retries requests to your origin even before a Load Balancing decision is made.

Cloudflare currently retries only once for HTTP 521 Open external link , 522 Open external link , and 523 Open external link response codes.

​​ Reduce origin traffic

​​ Block traffic

For more details, refer to Secure your website .

​​ Increase caching

​​ Distribute traffic

To randomly distribute traffic across multiple servers, set up multiple DNS records .

For more fine-grained control over traffic distribution — including automatic failover, intelligent routing, and more — set up our add-on load balancing service .

To protect specific endpoints from being overwhelmed by traffic spikes, set up a waiting room .