Trace the reverse proxy path

Cloudflare acts as a reverse proxy in front of your origin. The browser never talks to your server directly. It connects to Cloudflare, and Cloudflare either answers at the edge or opens a separate connection to the origin and relays the response.

That splits every request into two legs. Browser to Cloudflare, then Cloudflare to origin. When something breaks, the first question is always: which leg failed?

How your request finds Cloudflare

Anycast advertises shared Cloudflare addresses from many locations at once. Internet routing carries a visitor to a nearby Cloudflare data center, so a user in Tokyo and a user in Milan resolve the same hostname but land on different machines.

You can see which data center answered you:

curl -s https://flaviocopes.com/cdn-cgi/trace | grep colo
# colo=MXP

/cdn-cgi/trace is a diagnostic endpoint Cloudflare exposes on every proxied hostname. colo=MXP means the Milan data center handled my request.

Read the evidence in the headers

Request a proxied page and look at what came back:

curl -I https://flaviocopes.com
# HTTP/2 200
# server: cloudflare
# cf-ray: 95a2c81f4e2a39d1-MXP

server: cloudflare tells you the response passed through the proxy. The cf-ray header is a unique ID for this specific request, and its suffix repeats the data center code. Save it: support and log searches use it to find one request among millions.

The origin is still the origin

Cloudflare answered fast, but who produced the page? The origin remains the system that produces uncached application responses, unless you replace it with Workers, Pages, or another platform service.

Check your application logs on the origin side:

203.0.113.7 - - [03/Aug/2026:10:14:22 +0200] "GET / HTTP/1.1" 200

Notice the client address. It belongs to Cloudflare, not the visitor, because Cloudflare opened this connection. The real visitor IP travels in the CF-Connecting-IP header instead. Logging the connecting address as “the user” is the classic mistake on this path: your analytics collapse into a handful of Cloudflare IPs and you cannot tell visitors apart.

Now trace one request end to end. Request a proxied page, record the cf-ray, then find the matching request in your application logs and note which address appears there.