Cloudflare Private Origins Goes GA for Enterprise Accounts
Internal APIs and MCP servers get public-site protection without a public IP, if you're on Enterprise and get the return route right.
Cloudflare can now sit in front of a server with no public IP at all, because its private origins feature went generally available on October 30.
That means the WAF, cache, bot management and Workers setup you already use for your public site can now guard internal tools that never had a public address in the first place.
There’s a catch, though. Cloudflare’s own docs mark it Enterprise-only.
What changed
Until now, putting Cloudflare in front of a private service meant one of three things, according to Cloudflare’s announcement:
- Giving the server a public IP.
- Opening a port in your firewall.
- Running cloudflared next to the origin.
Now you point a proxied A or AAAA record at a private IP, and Cloudflare reaches the server over your Cloudflare One connection, with no inbound firewall exception.
Who is it for? Cloudflare names internal APIs, AI agent backends, MCP servers and operational tools that still take requests from outside, and I’d expect more of those soon.
WordPress, for one, wants built-in AI agent access in version 7.3.
What you get and what you don’t
These work as they do for public origins:
- WAF and managed rules
- Bot management and rate limiting
- Caching, transform and rewrite rules
- Workers
Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported.
Origin health checks need Load Balancing.
What you need first
The private origins developer docs say it plainly: Enterprise-only.
Then the blog post lists the rest:
- The Private Origins entitlement, which your account team turns on.
- Cloudflare One connectivity over IPsec, GRE, CNI, Cloudflare Tunnel or Cloudflare Mesh.
- Unified Routing, unless you connect through Tunnel.
Private routing switches on by itself for standard private ranges, such as 10.x and 192.168.x addresses, and Cloudflare’s API returns an error if you try to turn it off for those ranges.
One tip from the beta is worth keeping. Requests timing out? Check the return route for Cloudflare’s source ranges first, the most common failure it saw.
Why it matters
So is this for you? On a Free or Pro plan, no.
But maybe your company runs staging sites, admin dashboards or an MCP server you’ve kept off the public internet. Then I think this is the cleaner setup.
In practice, you keep your WAF rules and skip the firewall hole.
Meanwhile, Cloudflare is working on private-to-private traffic: users, services and AI agents on one private network reaching apps on another.
Its closed beta is targeted for early 2027.
On Enterprise already? I’d ask your account team for the entitlement before opening another port.
Common Questions
Is Cloudflare private origins available on Free or Pro plans?
No. Cloudflare’s developer documentation marks private origins as Enterprise-only, and the account team has to turn on the Private Origins entitlement before you can point a proxied record at a private IP.
What Cloudflare features work with private origins?
WAF and managed rules, bot management, rate limiting, caching, transform and rewrite rules, and Workers. Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks need Load Balancing.
Why do Cloudflare private origin requests time out?
Cloudflare says a missing return route for its source ranges was the most common setup failure in the beta. Over Cloudflare WAN or Mesh, route 100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6 back to Cloudflare.
