Origin server

Traffic sent straight to the origin skips the firewall's rules, the rate limits and the bot filtering entirely.

It also skips the caching, so requests that should have been absorbed at the edge reach the application.

Volumetric traffic aimed at the origin cannot be absorbed by the delivery network, because it never enters it.

The origin's own software, versions and error pages become directly observable, which they were not through the proxy.

Security headers added at the edge are absent, so a request to the origin receives the application's own unmodified responses — frequently without the policy the site is believed to have.

Historical DNS records. An address published before the CDN was adopted remains in passive DNS datasets indefinitely.

Certificates. A certificate issued directly for the origin hostname appears in Certificate Transparency logs.

Subdomains that were never moved behind the CDN — a staging host, a mail host, an admin panel — frequently resolve to the same infrastructure.

Outbound connections that reveal the address: a server-generated email's headers, a webhook, an error report.

None of this requires anything unusual. It is a matter of looking at public records.

Internet-wide scan datasets, which record what every address answers, allow the reverse lookup: finding the address that serves a particular site's content without knowing the hostname at all.

Restrict the origin's firewall to the delivery network's published address ranges, so nothing else can connect. This is the only complete measure.

Require a shared secret header that the edge adds and the origin checks, which covers networks that do not publish stable ranges.

Use a private connection between the edge and the origin where the provider offers one, so the origin has no public address at all.

Change the origin's address when adopting a CDN, so the historical record points at something no longer in use.

Resolve every hostname the organisation publishes and note which resolve outside the CDN's network.

Review certificate transparency records for names you did not expect to see.

Attempt an HTTP request to the origin address with the site's `Host` header. A response means the bypass works.

Check the mail server and any webhook sender, which are the two outbound paths that most often disclose the address.

Verify the restriction after every infrastructure change. A firewall rule scoped to an address range is quietly invalidated when the delivery network publishes new ranges or the origin is rebuilt.