Cloudflare Checker — Edge Protection & Security Headers
Detect Cloudflare, check cache status and 6 security headers in seconds
Working...
What can public response headers reveal?
Inspect publicly visible Cloudflare signals and security headers. This checker does not have access to your zone settings or firewall analytics.
A Cloudflare-related header is an observable response signal, not a complete assessment of protection. Its absence does not rule out another CDN, firewall or security service. Response headers may be configured at the application, origin server or edge; Cloudflare Transform Rules can add, change or remove them. Missing CSP warrants a policy review rather than a declaration that XSS is present. To evaluate active firewall rules or blocked traffic, consult authorized zone settings and analytics for the same hostname and period.
- Detect Cloudflare via CF-Ray header and "Server: cloudflare" — instant result
- Inspect cache headers and identify configuration to verify
- Verify all 6 security headers: HSTS, X-Frame-Options, CSP, X-Content-Type, Referrer-Policy, Permissions-Policy
Example: interpret a finding and fix it
Illustration only, not a check of your website.
A response shows Cloudflare signals but has no CSP. Inspect both the origin and edge response-header rules; Cloudflare can add, change or remove response headers.
After changing configuration, check the exact hostname, path and cache state. A rule scoped to selected URLs can produce different headers on the homepage and login page.
Public headers cannot reveal the complete WAF, Bot Management or DDoS configuration. Missing Cloudflare signals also cannot establish that the site has no other protection.
How to use in 3 steps
- 1Enter any URL on the domain you want to check (homepage or landing page).
- 2Click "Check now" — the tool sends an HTTP request and analyzes response headers.
- 3Review proxy, cache and header signals; consult authorized configuration before drawing conclusions.