How to hide your origin IP (step‑by‑step)

Mask your origin behind a protective edge and Secure DNS. This prevents direct L3/L4 attacks on your server.

1. Put an edge in front

   Create a site/app at your edge provider (WAF/CDN). Point it at your origin via hostname, not raw IP, when possible.

2. Move DNS to the edge

   Update A/AAAA/CNAME to the provider endpoints. Remove public A/AAAA that point directly at your origin hostnames.

3. Restrict direct origin access

   Allowlist only provider networks (or a VPN) at your host/firewall. Block all public traffic hitting the origin IP.

4. Harden HTTPS

   Force HTTP→HTTPS redirects and enable HSTS. Prefer HTTP/2/3. Set sane caching for static paths.

5. Validate

   Use our scanner to confirm your origin IP isn’t visible in public DNS and that edge headers are present.