Origin Exposure Checker
Is your real server IP leaking past your CDN?
A CDN only protects you while nothing else in DNS points straight at your server. This checks the records people forget — mail, cPanel, FTP, old staging hosts — along with your MX and the literal addresses in your SPF record, and flags anything resolving to a network other than your CDN's. Anyone can read those records, and an attacker who finds your origin can skip your CDN entirely, along with its caching, WAF and rate limiting.
Frequently asked questions
Why does it matter if my origin IP is public?
Because a CDN protects you by being the only way in. If someone knows your server's real address they can attack it directly — bypassing your WAF, your rate limits and your DDoS protection, all of which only exist at the edge.
How do origins usually leak?
Almost never through the website itself. It is the other records: mail.example.com and cpanel.example.com left pointing at the hosting box, an MX record on the same server as the site, or an SPF record listing the web server's IP as a sender.
What do I do if something is found?
Move the leaking service somewhere else, or change your server's firewall so it only accepts traffic from your CDN's addresses. Changing the origin IP alone does not help if the same records point at the new one.
Does "no leaks found" mean I am safe?
It means the common leaks are closed. Historical DNS records, certificate transparency logs and old archived data can still reveal an origin, and none of that is visible from a live lookup.