# How to protect a server's IP from being exposed?
**URL:** https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424
**Category:** Self-hosting
**Created:** [February 8, 2022, 1:52am UTC](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424 "2022-02-08T01:52:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@RedBear](https://meta.discourse.org/u/RedBear)
#### Post date: [February 8, 2022, 1:52am UTC](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424/1 "2022-02-08T01:52:41Z")
My forum has CloudFlare and when inserting a URL from this service, I can get the real IP of my server, this is a big gift for DDoS attacks.
I checked it on the Discourse Meta and this forum don’t have URL-filtration too.
Blocked domain by IPlogger can’t help because the attacker can use a custom domain using the script for logger ip address. I think need use whitelist to filter domain who can use onebox.
> Example: if admin allow only url from Youtube, Twitter, Imgur, all other url will be blocked.
Maybe Discourse have this setting? I can’t found ☹
**Update**
Setting `blocked onebox domains` and `allowed inline onebox domains` in this page `/admin/site_settings/category/onebox` not work.
I create this rules:
Onebox show it:
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [February 8, 2022, 11:39pm UTC](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424/3 "2022-02-08T23:39:58Z")
We don’t have a complete end-to-end guide on doing this, but here are other relevant topics:
> [@Hiding the origin on cloudflare](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496):
>
> While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it. What interested me was specifically this section: Never initiate an outbound connection based on user action If the attacker can get your web server to connect to an arbitrary address, they will reveal your …
> [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720):
>
> I keep my forum’s server behind cloud flare due to a large amount of attacks against the site. The link previews and emails can leak the server’s backend IP Address. The email issue was resolved by setting up a SMTP relay that strips headers (if the user pulls email headers to get the IP, they get the relay and not the forum’s IP). Is there a way to make the link previews go through a proxy server?
---
### Author:  [@RedBear](https://meta.discourse.org/u/RedBear)
#### Post date: [February 9, 2022, 12:20am UTC](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424/4 "2022-02-09T00:20:24Z")
I think I found a solution with setting CSP. I managed to allow images only from my domain, need time for the dough and I will share the decision.
---
### Author:  [@kuydiyadri](https://meta.discourse.org/u/kuydiyadri)
#### Post date: [May 28, 2023, 6:45am UTC](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424/6 "2023-05-28T06:45:15Z")
please share, i have change many time ip address coz the hacker get my ip from iplogger.