probeo

How to fix CF-Ray Header?

cf_ray_header_present global

The issue

The CF-Ray header gives each request a Cloudflare identifier, which ends in a code for the Cloudflare data center that handled it. It confirms the site runs behind Cloudflare. Probeo treats cf-ray as a standard header and never flags it, and uses it to recognize Cloudflare as the site’s CDN.

The cause is Cloudflare, which adds the header to every response it proxies. The CDN is public anyway: a proxied hostname resolves to Cloudflare’s published IP ranges.

Scope

The header is on every response that passes through Cloudflare. Its value differs per request and says nothing about the origin server.

How to check you have it

  • By hand: run curl -sI https://example.com/ and look for cf-ray in the output.
  • In the browser: open DevTools, select the document in the Network tab, and read its response headers.

The fix

In most cases, leave the header in place.

Cloudflare doesn’t let Response Header Transform Rules add, modify or remove headers whose names start with cf-. The Ray ID is also what Cloudflare support asks for when tracing a failed request, so it has a use. Put the effort into headers that name software and versions, which probeo does flag.

Done when: the headers that disclose software and versions are gone, and the check above shows only Cloudflare’s own headers.

Do not

  • Do not build client-side logic on the Ray ID.
  • Do not treat removing it as hiding the CDN; DNS already shows it.
  • Do not spend effort here while versioned Server or X-Powered-By headers remain.

FAQ

What information does the CF-Ray header contain?

A unique identifier for the request, ending in a code for the Cloudflare data center that processed it.

Can the header be removed without affecting request processing?

Browsers don’t use it, so nothing would break. The obstacle is that Cloudflare’s Transform Rules can’t remove headers that start with cf-.

Should the CF-Ray identifier be retained for internal debugging?

Yes. Cloudflare support uses the Ray ID to find a specific request in its logs.

Are there other Cloudflare headers that should be removed?

CF-Cache-Status discloses the same fact, and probeo treats it as standard too. A Server: cloudflare header names the CDN without a version, so probeo doesn’t flag it either.

Does removing the header improve security?

Very little. A proxied hostname resolves to Cloudflare’s published IP ranges, so the CDN is visible without any header.

Can the header be removed using Cloudflare Workers?

Cloudflare’s documentation rules out Transform Rules for headers that start with cf-. Test before relying on a Worker to do it, and weigh it against the Ray ID’s use in support cases.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.