How to Tell If a Site Sits Behind a CDN (and Why It Matters)

A CDN (content delivery network) places proxy servers close to users so content is delivered faster and survives traffic spikes. Today most CDNs bundle WAF filtering and DDoS protection, so the question “is this site behind a CDN?” is as much a security question as a performance one.

The tells

• Response headers: server: cloudflare, x-served-by: cache-iad… (Fastly), x-amz-cf-id (CloudFront), x-vercel-id (Vercel). None of these are guaranteed, but their presence is a strong signal.
• DNS: the A/AAAA records point into ranges published by the CDN provider, not at the hosting company’s IP. whois or ASN lookup of the IP usually names the CDN directly.
• Caching behaviour: short TTLs and headers such as cf-cache-status, age and x-cache on repeated requests.

curl -sI https://example.com | grep -i "server\|cf-\|x-served\|x-cache\|x-amz"

Why you should care

As the site owner: some tests must account for the CDN to be meaningful. Checking the origin’s real SSL configuration or an open port through the CDN tests Cloudflare’s edge, not your server; conversely, seeing a certificate issued to your origin through the CDN edge is its own finding.

For security: if a CDN or WAF fronts your site, its filtering is the perimeter — but only if attackers cannot reach the origin directly. If your firewall allows any source IP to the origin, an attacker who discovers the real IP (from old DNS records, certificate-transparency logs, or subdomains that never went through the CDN) walks around the whole protection. Restrict the origin to the CDN’s published IP ranges, and keep the origin IP out of public DNS.

The WhoDNS CDN/WAF detector combines header fingerprints, IP ownership and behaviour checks and reports which provider, if any, sits in front of a domain — useful both for auditing your own setup and for understanding what you are actually testing when you probe someone else’s infrastructure.

🔗 Related tool: Detect the CDN and WAF in front of any site