Cloudflare Origin Hardening Checklist: Firewall, Bots, Strict SSL

Originally published on kuryzhev.cloud Why this checklist A client of mine once showed me their Cloudflare dashboard during what they thought was a DDoS attack. Traffic graphs were flat. Zero anomalies. Meanwhile their origin server's CPU was pegged at 100% and the app was falling over every few minutes. The attacker hadn't gone through Cloudflare at all — they'd found the origin IP and were hitting it directly, completely bypassing the WAF, the rate limiting, the bot protection, everything. That's the moment I started treating cloudflare origin hardening as a separate discipline from "just turning Cloudflare on." Here's the uncomfortable truth: proxying your DNS through Cloudflare (the orange cloud icon) does not protect your origin server by itself. It protects requests that go through Cloudflare's edge. If someone finds your real IP — via old A records in DNS history tools like SecurityTrails, via certificate transparency logs on crt.sh, via a misconfigured mail server S