Cloudflare is on, but the site still goes down. How to check bypass

Common complaint: “we have Cloudflare, why are we getting hit?” Support says requests never reached the edge. For owners it feels like magic. Often a side door is open.

DNS pointing at a shield is not the same as the origin being locked. Attackers find the server address and hit it directly. The shield never sees the traffic. The invoice still arrives.

Same pattern for other shields if origin is not limited to their ranges. People search it in plain words: Cloudflare bypass, origin exposed, traffic around the shield.

Orb44 asks one question: does the shield really stand in front, or can traffic go around it. We do not publish the raw server IP on the public page.

If the answer is bad: lock direct web access to the origin, leave only the shield path, re-check. If unclear: do not fake certainty — dig deeper in a full snapshot.

Mail or a subdomain can still leak the same box. The cabinet snapshot gathers those pieces on one card.

Check: orb44.com/cloudflare or /tools/shield.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.

Keep the bar honest. A green result on a narrow check is not a forever-safe certificate. It only says what we saw on the public page we fetched right now.

If the result is red, fix the concrete thing first — the script, the open side door, the listing — then re-check. Screenshots into the admin chat work better than vague worry.

Share the checker link with whoever actually owns the site. Owners search symptoms. Admins need a binary answer they can act on today.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.

Keep the bar honest. A green result on a narrow check is not a forever-safe certificate. It only says what we saw on the public page we fetched right now.

If the result is red, fix the concrete thing first — the script, the open side door, the listing — then re-check. Screenshots into the admin chat work better than vague worry.

Share the checker link with whoever actually owns the site. Owners search symptoms. Admins need a binary answer they can act on today.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.