# Hiding the origin on cloudflare
**URL:** https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496
**Category:** Support
**Created:** [8월 12, 2018, 12:20오전 UTC](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496 "2018-08-12T00:20:35Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@imaBASKET](https://meta.discourse.org/u/imaBASKET)
#### Post date: [8월 12, 2018, 12:20오전 UTC](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496/1 "2018-08-12T00:20:36Z")
While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it.
> **[DDoS Prevention: Protecting The Origin](https://blog.cloudflare.com/ddos-prevention-protecting-the-origin/)**
>
> One of the many great features that CloudFlare provides is protection from Distributed Denial of Service (DDoS) attacks. A malicious party who wants to make your website or web service unavailable could try to overwhelm it with requests from...
What interested me was specifically this section:
> **Never initiate an outbound connection based on user action**
> If the attacker can get your web server to connect to an arbitrary address, they will reveal your origin IP. Features like “upload from URL” that allow the user to upload a photo from a given URL should be configured so that the server doing the download is not the website origin server. This is important because if an attacker can choose the URL entered, they can set up a web site specifically to monitor who connects to it, or use a public service that monitors the IPs that contact unique URLs.
I have tested this and indeed it does appear to get the origin IP from the server when uploading a remote image, so my question is what if anything can I do to stop that?
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [8월 12, 2018, 12:56오전 UTC](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496/2 "2018-08-12T00:56:07Z")
it gets IP because the image is parsed, you’d have to set up a proxy on the back end
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [8월 12, 2018, 1:01오전 UTC](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496/3 "2018-08-12T01:01:52Z")
Related topics:
> [@Mailgun leaking server's real IP behind Cloudflare](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128):
>
> Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [\*\*REAL IP HERE\*\*]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UTC) No DDoSers have discovered this yet. Additionally, a security researcher just pasted me the following information and told me it was pulled using “linux dig” IP address \*\*REAL IP HERE\*\* Reverse …
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720):
>
> I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8월 12, 2018, 3:00오전 UTC](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496/4 "2018-08-12T03:00:06Z")