· Oct 30, 2026
Cloudflare services for private origins is now generally available
Markdown · JSON · Original source
says its private origins service is now generally available, allowing customers to point a proxied DNS record at a private IP and route requests to the origin over existing Cloudflare One connectivity. The origin stays private, while Cloudflare says services including WAF, caching, bot management, and Workers work as they do for public origins. The change addresses a problem Cloudflare says customers raised: internal , backends, MCP servers, and operational tools need to receive Internet requests without being built to face the Internet. Cloudflare says earlier approaches could require exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Access requires a Private Origins entitlement and Cloudflare One connectivity; some features remain unsupported or require Load Balancing. Cloudflare says work is underway on private-to-private traffic, with a closed beta targeted for early 2027.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
Blog · Article
Source details
Original source date: Oct 30, 2026 (2026-10-30T14:23:43.668Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-13T18:33:24.930Z. First observed: 2026-10-30T14:24:36.880Z. Retrieved: 2026-10-30T16:48:35.536Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
says access requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing unless connecting over Cloudflare Tunnel. The source names unsupported features and a requirement for origin health checks, but refers readers to developer documentation for the full list of current limitations. Private-to-private traffic is described as in development, with a closed beta targeted for early 2027; the source does not report results or a release date.
Open question
Which application services or connectivity setups remain unsupported beyond the exclusions lists?
Source-stated
Cloudflare says its private origins service is generally available and routes requests to a private IP over existing Cloudflare One connectivity.
Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection.
Source-stated
Cloudflare says the origin remains private while several application services work as they do for public origins.
Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins.
Source-stated
Cloudflare says customers raised the need to let Internet users reach internal services that were not built to face the Internet.
Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet.
Source-stated
Cloudflare says some features are unsupported, and origin health checks require Load Balancing.
Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing.
Source-stated
Cloudflare says it is working on private-to-private traffic and targets a closed beta in early 2027.
Engineering work is underway, and we’re targeting a closed beta in early 2027.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
API
An application programming interface: a defined way for software to request data or actions from another system.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
Editorial provenance
Version 1. Publication ID: d4c5fc2d-06f7-4bd6-8804-9420a072e969.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T18:33:24.930Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9211edbf8a1eee5c122206ceabcc5dfcb9a2664d57d68d7e6655af29e286fc01. Source text hash: 24247e167cfacfe82789f2b11ce2c0fc3b8a6740057b9f5148855918eb6b7b31.
Revision and source-check history
Version 1 · 2026-11-13T18:33:24.930Z
Cloudflare services for private origins is now generally available
says its private origins service is now generally available, allowing customers to point a proxied DNS record at a private IP and route requests to the origin over existing Cloudflare One connectivity. The origin stays private, while Cloudflare says services including WAF, caching, bot management, and Workers work as they do for public origins. The change addresses a problem Cloudflare says customers raised: internal , backends, MCP servers, and operational tools need to receive Internet requests without being built to face the Internet. Cloudflare says earlier approaches could require exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Access requires a Private Origins entitlement and Cloudflare One connectivity; some features remain unsupported or require Load Balancing. Cloudflare says work is underway on private-to-private traffic, with a closed beta targeted for early 2027.
Original source
Blog · Article
Source details
Original source date: Oct 30, 2026 (2026-10-30T14:23:43.668Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-13T18:33:24.930Z. First observed: 2026-10-30T14:24:36.880Z. Retrieved: 2026-10-30T16:48:35.536Z.
Limits
says access requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing unless connecting over Cloudflare Tunnel. The source names unsupported features and a requirement for origin health checks, but refers readers to developer documentation for the full list of current limitations. Private-to-private traffic is described as in development, with a closed beta targeted for early 2027; the source does not report results or a release date.
Open question
Which application services or connectivity setups remain unsupported beyond the exclusions lists?
Source-stated
Cloudflare says its private origins service is generally available and routes requests to a private IP over existing Cloudflare One connectivity.
Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection.
Source-stated
Cloudflare says the origin remains private while several application services work as they do for public origins.
Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins.
Source-stated
Cloudflare says customers raised the need to let Internet users reach internal services that were not built to face the Internet.
Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet.
Source-stated
Cloudflare says some features are unsupported, and origin health checks require Load Balancing.
Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing.
Source-stated
Cloudflare says it is working on private-to-private traffic and targets a closed beta in early 2027.
Engineering work is underway, and we’re targeting a closed beta in early 2027.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
API
An application programming interface: a defined way for software to request data or actions from another system.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
Editorial provenance
Version 1. Publication ID: d4c5fc2d-06f7-4bd6-8804-9420a072e969.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T18:33:24.930Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9211edbf8a1eee5c122206ceabcc5dfcb9a2664d57d68d7e6655af29e286fc01. Source text hash: 24247e167cfacfe82789f2b11ce2c0fc3b8a6740057b9f5148855918eb6b7b31.
uncertain · 2026-11-13T18:33:24.930Z · anthropic/claude-opus-5.5
Publication: d4c5fc2d-06f7-4bd6-8804-9420a072e969
attribution — pass: The reading consistently attributes the general-availability announcement, the customer problem, the limitations and the 2027 roadmap to Cloudflare. It does not present Cloudflare's assertions as established facts or as Escape Meridian's opinion.
Today, Cloudflare services for private origins is generally available.
summary — uncertain: The summary is faithful, but a non-specialist reader may not follow it. It leaves central terms unexplained: origin (the server hosting the app), proxied DNS record, private IP, WAF (the summary never expands it), MCP servers, Cloudflare One and cloudflared. It also never says plainly why this matters for AI agent backends. Smallest repair: briefly gloss origin, private IP and WAF, and add tooltip entries for MCP and proxied DNS. The question is also narrow, since the documentation the source cites largely answers it.
Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins.
date — pass: The originalPublished value (2026-10-30T14:23:43Z, from the publisher page) matches the feed entry and is consistent with the post's own 'Today' announcement framing. It refers to the June beta as an earlier event, so this is the first publication of this post.
support — pass: Each claim matches its verbatim excerpt. The access requirements, the unsupported features (Argo Smart Routing and Dedicated CDN Egress IPs), the Load Balancing requirement for health checks, and the early-2027 closed-beta target are all source-stated. The reading claims no demonstrated benefits or outcomes beyond Cloudflare's own statements.
Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing.
media — pass: The selected media ID is the verified direct link to the original Cloudflare blog post, which is the most direct way for readers to access the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Cloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareAn application programming interface: a defined way for software to request data or actions from another system.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore Cloudflare