Putting your site behind a CDN is like hiring a bouncer for the front door. It works perfectly, until someone discovers there's an open door at the back. For a website, the back door is the IP address of the origin server: if attackers know it, they can hit it directly and the CDN never even sees the traffic.
How it works, briefly
Without a CDN, the domain points to your server's IP and every visitor connects there. With a CDN, the domain points to the network's nodes: visitors connect to the nodes, and the nodes request the pages from your server.
If everything is set up properly, nobody outside needs to know the server's IP. If it's set up badly, knowing it is enough to bypass every protection.
How a site's real IP is found
Attackers have several ways to find it, almost all trivial.
DNS history
Some services have been recording the DNS records of millions of domains for years. If the site pointed straight at the server before moving to the CDN, the IP from back then is still there for anyone to look up. If you haven't changed it since, it's still the right one.
Other names on the same domain
mail.yoursite.com, ftp.yoursite.com, cpanel.yoursite.com, webmail.yoursite.com: they often point to the same server as the site, and don't go through the CDN. Trying them one by one is enough.
The MX record and emails
If the domain's email is handled by the same server as the site, the MX record says so. And the emails the site sends (order confirmations, password resets) carry the address of the sending server in their headers.
The HTTPS certificate
Some engines scan the whole Internet and record which certificate answers on every IP address. If your server answers with the yoursite.com certificate to anyone connecting to its IP, it can be found in seconds.
The site itself
Some features make the server send requests outward: WordPress pingbacks, webhooks, images fetched from a URL, link previews. Whoever controls the destination sees the request arriving from your IP.
How to close the back door
1. The server only answers the nodes
This is the most important measure, and it makes nearly all other discoveries useless: in the server firewall, leave ports 80 and 443 open only to the CDN node addresses. Anyone who knows the IP and tries to connect doesn't even get an answer.
With ufw, for each node:
sudo ufw allow proto tcp from NODE_ADDRESS to any port 80,443
then remove the rules that opened 80 and 443 to everyone. SSH access is separate, ideally restricted to your addresses or key-only.
With 1PrimeCDN the up-to-date node list is in the panel, under Pull Zone → Origin, along with ready-made commands for Nginx and lines for WordPress on shared hosting.
2. Every name goes through the CDN, or points elsewhere
Check every record on the domain. The ones the site needs (the main domain, www) go through the CDN. The ones that can't (email, for example) should point to a service other than the site's server: a dedicated email service, not the same machine.
3. Change the IP after moving
If the site pointed straight at the server for years, its IP is in DNS history. Once everything is behind the CDN and the firewall is closed, asking your host for a new address is the definitive fix: the new IP appears nowhere.
4. Don't answer strangers
Configure the web server so that anyone connecting to the IP without naming the site gets a generic error, not your site or your certificate.
5. Check what leaves the server
Turn off WordPress pingbacks if you don't use them, send email through a dedicated service and review plugins that contact external services.
We did it ourselves
The 1PrimeCDN panel and the email service our panels use run on a server whose IP, until recently, was published in DNS. We put it behind our own nodes and closed the firewall: today that server accepts web connections only from the network's nodes, and DNS only from our nameservers. It's the same procedure we recommend to customers.
In short
- a CDN only protects you if traffic goes through it;
- a server's IP is easy to find: DNS history, subdomains, emails, certificates;
- the real defence is a firewall that only accepts the nodes;
- if the IP has been known for a long time, change it after moving.
If the attack continues even with the CDN active, write to us from the «Under attack?» page: we'll work out together where it's coming from.
Want a site that holds up even under attack?
1PrimeCDN puts your site behind 8 European nodes with caching, HTTPS and Shield against bots and attacks. Fixed monthly price from €9.90.