Shielding your origin server: Crawl Audit check 161

Short answer: your origin is the server where your site actually lives. Putting a CDN or edge network in front of it means visitors and attackers reach the edge, not the origin directly. Check 161 looks for signs of a CDN in your response headers.

What Crawl Audit checks

• Pass: the headers mention a known CDN or edge provider, such as Cloudflare, Vercel, Fastly, Akamai, Netlify or CloudFront.
• Warning: none found.

The catalogue calls this an exposed port scan, but Crawl Audit doesn't scan ports. It never sends anything beyond a normal page request, and it reads only the headers your site already returns. A CDN can also be configured not to identify itself, in which case you'll see a warning even though one is there.

What Cloudflare advises

• Securing origin connections "prevents attackers from discovering and overloading your origin server with requests."
• "Audit existing DNS-only records (SPF, TXT, and more) to make sure they do not contain origin IP information."
• "Once onboarded, rotate your origin IPs, as DNS records are in the public domain."
• "Explicitly block all traffic that does not come from Cloudflare IP addresses". The same idea applies to any CDN: if the origin answers anyone, the shield has a side door.

Checklist

• Serve the site through a CDN or managed platform.
• Make sure no DNS record (old subdomains, mail, staging) points straight at the origin's IP address.
• At the origin's firewall, allow web traffic only from the CDN, and close every port you don't use.

On devmarde.com

Our responses come through Vercel's edge network (Server: Vercel), so it passes.

Sources

• Cloudflare, Protect your origin server (updated 2 October 2026), checked 6 October 2026.