Cloudflare Detector

From structural signatures in the public HTML and response headers (domains, paths, attributes, scripts). Every verdict lists how many times each pattern matched — nothing is guessed.

If only a bare brand keyword matches without structural evidence, we label it \u201clikely\u201d instead of \u201cconfirmed\u201d — we would rather under-report than cry wolf.

No. The audit runs inside the request and the URL you paste is not written to storage. There are no third-party tracking scripts on the page either, so no log of who checked what exists. Copy the result yourself if you want a record.

Partly, but rarely completely. The HTML sent to your browser, the response headers, script paths and asset structure have to be exposed to work, so there is always something readable. Server-side code, build config and private APIs stay invisible. That is why this tool reports the evidence it found rather than claiming a full picture. No match does not mean the technology is absent.

It masks the origin's real IP address, which is a large part of why sites put it in front. From the public internet you generally only see Cloudflare's edge, not the hosting provider or the datacentre behind it. So you can confirm that a site uses Cloudflare, but not where the server lives.

Headers beginning with cf- are added by Cloudflare at the edge and are hard to fake. A site can mention Cloudflare in its copy, but it cannot easily produce these headers out of nowhere. They also carry an edge node code and a request ID, which help when debugging caching and origin issues.