Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Stay away from cloudflare

13»

Comments

  • @kait said:

    @COLBYLICIOUS said:

    @Kolestor said:
    do you mean Flexible SSL causes MITM attacks? protect your backend and you are safe!

    I think the Full or Full (Strict) does that.

    It won't protect against mitm, it will only ensure the traffic between cloudflare and you js also encrypted with a self signed certificate or a proper certificate

    Then use XDP Synproxy on your server, it will should help against spoofing and MITM attacks

  • @Spirits said:
    Going to drop this article here
    unixdigest.com/articles/stay-away-from-cloudflare.html
    Any opinions, you agree with the author?

    On some forums, making a post like this and not sharing your own thoughts would get a temp ban. Otherwise, it's indistinguishable from spam. I'd support that at LET.

    Thanked by 1satorik
  • kaitkait Member

    @Kolestor said:

    @kait said:

    @COLBYLICIOUS said:

    @Kolestor said:
    do you mean Flexible SSL causes MITM attacks? protect your backend and you are safe!

    I think the Full or Full (Strict) does that.

    It won't protect against mitm, it will only ensure the traffic between cloudflare and you js also encrypted with a self signed certificate or a proper certificate

    Then use XDP Synproxy on your server, it will should help against spoofing and MITM attacks

    No, that is not how that works.

  • Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website and it's still the fastest DNS in the world according to DNSPerf.

    I am using it for some years and got nothing to complain to be honest, maybe if they will charge something that was free, I will do something.

    And yes, I am from EU.

  • kaitkait Member

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

  • @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

  • kaitkait Member

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

  • @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

  • kaitkait Member

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

    Then cloudflare is not hiding anything, I bet with just your domain I can find the real ip behind it in not so long time.

  • jontyjonty Member

    shit we already knew wow

  • Fossorial Pangolin is good as alternative

  • jontyjonty Member
    edited April 2025

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

    Then cloudflare is not hiding anything, I bet with just your domain I can find the real ip behind it in not so long time.

    cloudflare does hide your ip (as long as you don't leave your main page exposed on your ip and your rdns doesn't point to your domain) but they don't hide your host as if you submit a report to a cloudflare protected site they will forward your report to the host which can allow you to try and request to all the ips on the host with port 80 or 443 enabled
    best bet is to deny any ip address that isn't from cloudflare itself to prevent any bruteforce attacks like this

  • kaitkait Member

    @jonty said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

    Then cloudflare is not hiding anything, I bet with just your domain I can find the real ip behind it in not so long time.

    cloudflare does hide your ip (as long as you don't leave your main page exposed on your ip and your rdns doesn't point to your domain) but they don't hide your host as if you submit a report to a cloudflare protected site they will forward your report to the host which can allow you to try and request to all the ips on the host with port 80 or 443 enabled
    best bet is to deny any ip address that isn't from cloudflare itself to prevent any bruteforce attacks like this

    Yes that's what I said.

    Thanked by 1Erisa
  • @jonty said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

    Then cloudflare is not hiding anything, I bet with just your domain I can find the real ip behind it in not so long time.

    cloudflare does hide your ip (as long as you don't leave your main page exposed on your ip and your rdns doesn't point to your domain) but they don't hide your host as if you submit a report to a cloudflare protected site they will forward your report to the host which can allow you to try and request to all the ips on the host with port 80 or 443 enabled
    best bet is to deny any ip address that isn't from cloudflare itself to prevent any bruteforce attacks like this

    you can use reverse proxy with Cloudflare too! so main reports goes to the reverse proxy provider!

    Thanked by 1jonty
  • jontyjonty Member

    @Kolestor said:

    @jonty said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said:

    @kait said:

    @COLBYLICIOUS said: Fuck it, I will still gonna use Cloudflare because I like to hide my origin IP from the website

    Just make sure you enable the firewall or use the tunnel with the firewall.

    I am using the firewall, since I am using shared hosting mostly, I created some WAF rules in Cloudflare.

    Yeah, I mean if I go to your website real ip instead of cloudflare, can I access it and see your website?

    Since it's an shared hosting and I don't think I can control WAF that much on the server side, most probably yes.

    Then cloudflare is not hiding anything, I bet with just your domain I can find the real ip behind it in not so long time.

    cloudflare does hide your ip (as long as you don't leave your main page exposed on your ip and your rdns doesn't point to your domain) but they don't hide your host as if you submit a report to a cloudflare protected site they will forward your report to the host which can allow you to try and request to all the ips on the host with port 80 or 443 enabled
    best bet is to deny any ip address that isn't from cloudflare itself to prevent any bruteforce attacks like this

    you can use reverse proxy with Cloudflare too! so main reports goes to the reverse proxy provider!

    i do this so that whenever i do get a report from cloudflare i can easily switch my servers without losing any data whatsoever

    Thanked by 1Kolestor
  • Is there a way to configure the website on a shared hosting to accept traffic only from Cloudflare?

  • kaitkait Member

    @COLBYLICIOUS said:
    Is there a way to configure the website on a shared hosting to accept traffic only from Cloudflare?

    Do you have firewall access on the shared hosting?

  • @kait said:

    @COLBYLICIOUS said:
    Is there a way to configure the website on a shared hosting to accept traffic only from Cloudflare?

    Do you have firewall access on the shared hosting?

    Right now I want to install on a website hosted on @NameCrane and I don't think there is a way to setup that. If I am mistake, please correct me @NameCrane @Harambe @Francisco.

  • @rickey said:

    @Spirits said:
    Going to drop this article here
    unixdigest.com/articles/stay-away-from-cloudflare.html
    Any opinions, you agree with the author?

    No, of course I don't agree with the author. Cloudflare offers you a great service for absolutely free. You get free DDoS protection for your website, it prevents many bots, caches your pages, etc.

    And free and powerful easy html code injection to any page(when you can not change the html code easily,eg when it's served by go program)

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    @COLBYLICIOUS said:
    Is there a way to configure the website on a shared hosting to accept traffic only from Cloudflare?

    You’d do it with htaccess?

    Francisco

  • Francisco, hi.
    Do you have free time? I need you tomorrow at the office. Key - Exactly 💯

Sign In or Register to comment.