Cloudflare runs in front of 26.9% of all websites, according to W3Techs as of October 2026. Among sites whose reverse proxy W3Techs can identify, Cloudflare's share is 85.5%. To check if a domain uses Cloudflare, read four signals: nameservers, response headers, IP addresses and the browser's network panel.
Quick Answer: To check if a domain uses Cloudflare, run our DNS lookup tool and read the NS records. Nameservers ending in
.ns.cloudflare.commean the domain's DNS is on Cloudflare. Then check the HTTP response headers:server: cloudflareand acf-rayheader mean the traffic goes through Cloudflare's proxy. Our hosting check runs both checks in one lookup.
Why detect Cloudflare?
People check for Cloudflare for a few common reasons:
- Troubleshooting: Cloudflare's proxy sits between visitors and the origin server, so an error page may come from Cloudflare and not from the site.
- Security research: you see which protection layer a site has.
- Competitor analysis: you see which content delivery network (CDN) a competitor chose.
- Migration planning: a domain on Cloudflare DNS moves differently from one on a registrar's nameservers.
- Authorized penetration testing: the tester needs to know which layer they are testing.
Method 1: DNS nameserver check (most reliable)
The most direct way to check if a domain uses Cloudflare DNS is to read its NS (nameserver) records. In a full setup, the domain's nameservers point to Cloudflare.
How to check nameservers
Using our nameserver lookup tool:
- Enter the domain name (for example,
discord.com) - Look at the nameservers in the results
- If the nameservers end in
.ns.cloudflare.com, the domain's DNS is on Cloudflare. The tool names the DNS provider of each nameserver for you
Command line method
dig NS discord.com +shortCloudflare output (run on 2026-10-12):
gabe.ns.cloudflare.com.
sima.ns.cloudflare.com.
Non-Cloudflare output for canva.com, which uses Amazon Route 53:
ns-253.awsdns-31.com.
ns-730.awsdns-27.net.
ns-1421.awsdns-49.org.
ns-1851.awsdns-39.co.uk.
Cloudflare nameserver patterns
Cloudflare assigns each domain a pair of nameservers named after people. These pairs came back from lookups on 12 October 2026:
gabe.ns.cloudflare.com/sima.ns.cloudflare.com(discord.com)alina.ns.cloudflare.com/kip.ns.cloudflare.com(medium.com)dana.ns.cloudflare.com/woz.ns.cloudflare.com(notion.so)
Cloudflare's documentation describes the pattern as <proper_name>.ns.cloudflare.com. Enterprise customers on Foundation DNS get a different set: three nameservers named <color>.foundationdns.com, .net and .org. For example, shopify.com uses gold.foundationdns.com, gold.foundationdns.net and gold.foundationdns.org.
Limitations
Nameservers only tell you who runs the DNS. Two setups break the NS check:
- CNAME setup (partial setup). The domain keeps its own DNS provider and points individual hostnames at Cloudflare with a CNAME record. Cloudflare offers this on Business and Enterprise plans. The NS records never mention Cloudflare.
- DNS-only records. The nameservers are Cloudflare's, but the record is not proxied (see proxy vs DNS-only mode below).
canva.com is a real CNAME setup. Its nameservers are on AWS, but www.canva.com points to Cloudflare:
dig www.canva.com +noall +answerwww.canva.com. 54 IN CNAME www.canva.com.cdn.cloudflare.net.
www.canva.com.cdn.cloudflare.net. 54 IN A 104.16.102.112
www.canva.com.cdn.cloudflare.net. 54 IN A 104.16.103.112
A CNAME target ending in .cdn.cloudflare.net is a Cloudflare CNAME setup. For a deeper look at DNS records, see our guide on how DNS works.
Method 2: HTTP response headers
When Cloudflare proxies a website, it adds its own headers to every HTTP response. These headers catch CNAME setups that the nameserver check misses.
How to check headers
curl -sI https://discord.com | grep -iE "^(server|cf-)"Real output (2026-10-12):
cf-ray: a4942dfc8c590247-WAW
cf-cache-status: HIT
server: cloudflare
Cloudflare-specific headers
| Header | Example Value | What It Means |
|---|---|---|
cf-ray | a4942dfc8c590247-WAW | Request ID plus the code of the Cloudflare data center that answered (WAW is Warsaw). The clearest Cloudflare indicator. |
cf-cache-status | HIT, MISS, DYNAMIC | Whether Cloudflare served the response from its cache |
server | cloudflare | Cloudflare replaces the origin's server header with its own name |
cf-mitigated | challenge | Cloudflare answered with a bot challenge, not the page |
cf-apo-via | cache, proxy | Cloudflare's Automatic Platform Optimization for WordPress is active |
nel, report-to | a.nel.cloudflare.com endpoint | Network Error Logging reports go to Cloudflare |
CF-Connecting-IP | (not visible to you) | Sent only from Cloudflare to the origin, with the visitor's IP |
The cf-ray header is the most reliable indicator. Cloudflare adds a Ray ID to every request that passes through it. It also works for the CNAME setup above: curl -sI https://www.canva.com returned server: cloudflare and cf-ray: a4942dfbeef924bb-WAW, even though canva.com's nameservers are on AWS.
A proxied hostname also answers at /cdn-cgi/trace with a short plain-text report. This is a trimmed real answer from curl -s https://www.notion.so/cdn-cgi/trace:
h=www.notion.so
visit_scheme=https
colo=WAW
http=http/2
tls=TLSv1.3
If you see server: cloudflare and a cf-ray header, the site uses Cloudflare's proxy.
Method 3: IP range check
Cloudflare publishes its IP ranges at cloudflare.com/ips. If a domain's A record falls inside one of them, the domain is proxied through Cloudflare.
How to check
- Resolve the domain's IP address:
dig +short discord.com A162.159.128.233
162.159.135.232
162.159.136.232
162.159.137.232
162.159.138.232
- Compare it against Cloudflare's IPv4 ranges (the list at cloudflare.com/ips-v4 on 2026-10-12):
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22
All five discord.com addresses fall inside 162.158.0.0/15. Cloudflare also publishes seven IPv6 ranges, such as 2606:4700::/32, at cloudflare.com/ips-v6.
Our IP lookup tool gives the same answer without the range math: discord.com's addresses belong to AS13335 Cloudflare, Inc.
The published list does not cover every Cloudflare site. Cloudflare's Enterprise BYOIP option lets a company keep its own IP addresses behind Cloudflare. Two cases, checked on 12 October 2026:
shopify.comresolves to23.227.38.33. That address is not in the list above, but AS13335 (Cloudflare) announces it.notion.soresolves to208.103.161.xaddresses registered to Notion's own network, AS33191. Its responses still carryserver: cloudflareand acf-rayheader.
So an IP outside the list does not rule Cloudflare out. Check the headers too.
Quick check with our tool
Try it yourself
Check any website's hosting
Enter a domain or IP to see hosting provider, DNS records, and more.
Our hosting check combines these signals. It lists Cloudflare under CDN when it sees a cf-ray or server: cloudflare header, a Cloudflare autonomous system number (ASN), or a cdn.cloudflare.net CNAME. It lists Cloudflare as the DNS provider when the nameservers are on ns.cloudflare.com or foundationdns. Each answer shows the evidence behind it, next to the DNS records, SSL certificate details and server location.
Method 4: Browser developer tools
You can detect Cloudflare in your browser without any other tool.
Steps
- Open the website in Chrome, Firefox or Edge
- Press
F12, orCmd+Option+Ion Mac andCtrl+Shift+Ion Windows - Go to the Network tab
- Reload the page
- Click the first request (the main HTML document)
- Check the Response Headers section
What to look for
server: cloudflare, the most obvious indicatorcf-ray, present on every Cloudflare-proxied responsecf-cache-status, which shows caching behavior (HIT,MISS,DYNAMIC,BYPASS)
This method works for any site you can open in a browser and needs no command line.
Cloudflare proxy vs DNS-only mode
A domain can use Cloudflare's DNS without Cloudflare's proxy. Cloudflare has two modes for each DNS record:
| Mode | DNS Record | HTTP Proxy | Headers | IP Address |
|---|---|---|---|---|
| Proxied (orange cloud) | Managed by Cloudflare | Active: traffic routes through Cloudflare | cf-ray, server: cloudflare present | Resolves to a Cloudflare IP |
| DNS-only (grey cloud) | Managed by Cloudflare | Inactive: traffic goes straight to the origin | No Cloudflare headers | Resolves to the origin IP |
In DNS-only mode, the nameservers still show *.ns.cloudflare.com. The IP resolves to the origin server, and no Cloudflare headers appear. The domain uses Cloudflare for DNS, but not for CDN or security features.
Why websites use Cloudflare
Knowing why a site uses Cloudflare gives context to what you find:
- DDoS protection. Cloudflare absorbs attack traffic before it reaches the origin server.
- CDN. Cloudflare caches static files in data centers in 348 cities, according to its network page in October 2026.
- SSL/TLS. Cloudflare issues a free certificate for proxied hostnames (check one with our SSL checker).
- Web Application Firewall (WAF). Cloudflare blocks common attack patterns such as SQL injection and XSS.
- Bot management. Cloudflare challenges automated traffic.
- DNS hosting. The free plan includes it.
Frequently Asked Questions
Can I find the real IP address behind Cloudflare?
When a domain is proxied through Cloudflare, its DNS resolves to Cloudflare's IPs and hides the origin server. People look for the origin through DNS history, mail server (MX) records, or subdomains that skip the proxy. Hiding the origin is often the point of the setup, so only do this on sites you are authorized to test.
Does using Cloudflare mean a website is more secure?
Cloudflare adds DDoS protection, a WAF, bot management and TLS. It is one part of a site's security. The origin server, the application code and the hosting configuration still need their own protection.
Is Cloudflare the same as a hosting provider?
No. Cloudflare is a reverse proxy and CDN. It also hosts sites through Cloudflare Pages and Workers, but most Cloudflare sites run on an origin server elsewhere, at AWS, DigitalOcean or a traditional host. Cloudflare sits between visitors and that origin, caches content and filters traffic. Learn more about how to find out who hosts a website.
What percentage of websites use Cloudflare?
According to W3Techs, Cloudflare is used by 26.9% of all websites as of October 2026. Among websites whose reverse proxy W3Techs can identify, Cloudflare's share is 85.5%.
Wrapping up
Nameservers on ns.cloudflare.com or foundationdns show that Cloudflare runs the DNS. The cf-ray header shows that Cloudflare proxies the traffic, and it also catches CNAME setups and sites on their own IP ranges.
Enter any domain into our hosting check to see whether it uses Cloudflare, with its DNS records, IP geolocation, SSL certificate and hosting provider. For single checks, use the DNS lookup tool or the IP lookup tool.
Related articles
Written by
Piotr KulpinskiFounder of HostingChecker.online and a web developer with over a decade of experience in DNS, hosting infrastructure, and domain management. Piotr builds tools that help developers and site owners understand their web stack. Other products: OpenAlternative, EuroAlternative, Revinel and Dirstarter.