Behind Cloudflare, the socket peer your origin sees is a Cloudflare edge address. CF-Connecting-IP carries the IP address of the client connecting to Cloudflare. Cloudflare recommends that logs and applications read CF-Connecting-IP or True-Client-IP instead of X-Forwarded-For, because those headers hold exactly one address while X-Forwarded-For can hold a comma-separated chain from intermediate proxies. Koskamo field note: only trust CF-Connecting-IP when the origin accepts traffic from Cloudflare alone; otherwise any caller can set it. Reviewed September 21, 2026.
Client IP addresses behind Cloudflare
Document v1 · Koskamo editorial · recorded 2026-09-21