Free bot report

Cloudflare IP ranges

Cloudflare sends all proxied traffic to your server from a short, fixed list of IPv4 and IPv6 ranges. The list below comes from Cloudflare's official API and is refreshed daily. Use it to restore real visitor IPs on your server and to accept web traffic only from Cloudflare, so bots cannot go around your rules.

Cloudflare IPv4 and IPv6 ranges

Updated: 2026-11-05. Source: the official Cloudflare API (https://api.cloudflare.com/client/v4/ips), the same data as cloudflare.com/ips. 15 IPv4 and 7 IPv6 prefixes.

Download: IPv4 (TXT) · IPv6 (TXT) · CSV · JSON

Cloudflare IPv4 ranges: 15 prefixes
PrefixType
173.245.48.0/20ipv4
103.21.244.0/22ipv4
103.22.200.0/22ipv4
103.31.4.0/22ipv4
141.101.64.0/18ipv4
108.162.192.0/18ipv4
190.93.240.0/20ipv4
188.114.96.0/20ipv4
197.234.240.0/22ipv4
198.41.128.0/17ipv4
162.158.0.0/15ipv4
104.16.0.0/13ipv4
104.24.0.0/14ipv4
172.64.0.0/13ipv4
131.0.72.0/22ipv4
Cloudflare IPv6 ranges: 7 prefixes
PrefixType
2400:cb00::/32ipv6
2606:4700::/32ipv6
2803:f800::/32ipv6
2405:b500::/32ipv6
2405:8100::/32ipv6
2a06:98c0::/29ipv6
2c0f:f248::/32ipv6

The same ranges are shared by every proxied site on Cloudflare. Cloudflare uses other ranges for some of its products, but those addresses do not connect to your server.

Why your server sees Cloudflare IPs, not visitors

When a DNS record is proxied (the orange cloud), visitors connect to Cloudflare, and Cloudflare connects to your server. Your server and its logs see a Cloudflare address on every request. The visitor's real address travels in the CF-Connecting-IP header, which Cloudflare adds only on the way from its network to your server.

Until you restore it, three things go wrong:

  • Access logs show a few Cloudflare addresses instead of thousands of visitors, so you cannot see which bot is loading the server.
  • Per-IP limits on your server treat Cloudflare as one huge visitor. A rate limit or a security plugin can then block Cloudflare itself, and with it every real visitor.
  • Blocking a bad IP on the server does nothing, because the server never sees it.

X-Forwarded-For also carries the visitor IP, but it can hold a chain of proxies. Cloudflare recommends CF-Connecting-IP, because it always contains exactly one address.

Restore real visitor IPs

nginx. The ngx_http_realip_module replaces the client address with the one from a header, but only for requests from addresses you mark as trusted. Check that your nginx has it (nginx -V shows --with-http_realip_module), then add:

# Cloudflare IP ranges, updated 2026-11-05. Source: https://www.cloudflare.com/ips/
# http { } or server { } context. Needs ngx_http_realip_module.
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;

Download this file: cloudflare-nginx-realip.conf

Apache. Enable mod_remoteip and trust the same ranges:

# Cloudflare IP ranges, updated 2026-11-05. Source: https://www.cloudflare.com/ips/
# Needs mod_remoteip (a2enmod remoteip).
RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22
RemoteIPTrustedProxy 2400:cb00::/32
RemoteIPTrustedProxy 2606:4700::/32
RemoteIPTrustedProxy 2803:f800::/32
RemoteIPTrustedProxy 2405:b500::/32
RemoteIPTrustedProxy 2405:8100::/32
RemoteIPTrustedProxy 2a06:98c0::/29
RemoteIPTrustedProxy 2c0f:f248::/32

Download this file: cloudflare-apache-remoteip.conf

Both configs list every Cloudflare range as trusted on purpose. If your server took the header from anyone, a bot could send its own CF-Connecting-IP and choose which address your logs and limits see. With the trusted list, only requests that really come from Cloudflare can set it. Once the real IP is back, server-side limits work again, for example the ones in our nginx rate limit guide.

Accept web traffic only from Cloudflare

Your Cloudflare rules only apply to traffic that goes through Cloudflare. If someone finds your server's real address, for example in old DNS records or mail server settings, they can send requests straight to it and skip every rule. Cloudflare's own recommendation is to allow its ranges on ports 80 and 443 and drop everything else:

# allow Cloudflare on http and https, IPv4 and IPv6
for ip in $(curl -s https://www.cloudflare.com/ips-v4/); do
  iptables -I INPUT -p tcp -m multiport --dports http,https -s "$ip" -j ACCEPT
done
for ip in $(curl -s https://www.cloudflare.com/ips-v6/); do
  ip6tables -I INPUT -p tcp -m multiport --dports http,https -s "$ip" -j ACCEPT
done
# then drop all other web traffic
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP
ip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP

Before you run it, make sure that:

  • every hostname of the site is proxied, because an unproxied one will stop working;
  • partners, monitoring or payment services that call your server's IP directly are added to the allow list;
  • security plugins, for example in WordPress, allow Cloudflare ranges, so they do not block your visitors in bulk.

The rules touch only web ports, so SSH keeps working. On shared hosting without firewall access, ask your host to do it.

An allow list proves that a request came through Cloudflare's network, not through your own Cloudflare account. If you need that proof too, Cloudflare offers Authenticated Origin Pulls and Cloudflare Tunnel.

A Cloudflare IP in your logs is not a bot

If your logs are full of Cloudflare addresses, the real IP has not been restored yet. Do not block those addresses: every visitor comes through them. Find the bot by its real address instead. To check whether a request that calls itself Googlebot is real, compare its address with the Googlebot IP ranges or run our Verify Googlebot tool. To block one address or a whole network in Cloudflare itself, see how to block or allow an IP in Cloudflare.

Not sure which bots actually load your server? See bot protection setup: we find them by the real address and stop only the harmful ones.

FAQ

Where does Cloudflare publish its IP ranges?

On cloudflare.com/ips, as plain text files at cloudflare.com/ips-v4 and cloudflare.com/ips-v6, and in the API at api.cloudflare.com/client/v4/ips. The list on this page is taken from the API.

How often do Cloudflare IP ranges change?

Rarely. Cloudflare adds new ranges to its published list before it starts using them, so a daily or weekly refresh is enough. We refresh this page every day.

What is the CF-Connecting-IP header?

The IP address of the visitor who connected to Cloudflare. Cloudflare adds it to every request it sends to your server. It always holds exactly one address, unlike X-Forwarded-For.

Why does my server only log Cloudflare IPs?

Because your DNS records are proxied and the server records the address that connected to it, which is Cloudflare. Set up real IP restoration with the nginx or Apache config above.

Is 172.64.0.0/13 a private range?

No. 172.64.0.0/13 is Cloudflare's public address space. The private range is 172.16.0.0/12, which does not overlap with it. A network route that covers more than 172.16.0.0/12 can catch Cloudflare traffic by mistake and cause 521 or 522 errors.

Should I block Cloudflare IP addresses?

No, if your site is behind Cloudflare: all your visitors and search crawlers reach you through those addresses. Blocking them takes the site offline for every visitor.

Related

Rather not deal with this yourself?

If bots slow down your site, copy it or fill your analytics with fake visits, we can sort it out. We find out which bots visit your site, stop the harmful ones and check that Google, Bing and ad crawlers still get in. It starts with a free report.

Get a free bot report