What the check looks at
A1 looks for the cf-ray header, which Cloudflare adds to the answers it passes on, in two places: a request your server sends to its own home page, and your own visit to the admin. If neither carries it, Cloudflare is not in front of the site, and every other check reports Not applicable without sending a single request.
When Cloudflare is there, A1 also describes the connection. Several of these can be true at once: a Tunnel when the request reaches PHP from a private address and carries CF-Connecting-IP; a Worker when the CF-Worker header is present; a zone in front of another Cloudflare zone when cf-connecting-o2o is 1; host managed when the headers match a host the plugin recognises; and plain proxied DNS when none of these apply.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| InfoConfidence: High | Cloudflare is in front of this site Cloudflare proxies the site, and the result says how. The other checks can measure what the edge does. |
| InfoConfidence: High | This site is not behind Cloudflare No response carried a Cloudflare header, so the other checks are reported as not applicable. |
| Could not checkConfidence: Low | This check could not be completed The request to your own home page failed, and your admin visit did not come through Cloudflare, so the plugin cannot say either way. |
When the result names a reason
loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.
Symptoms you may notice
- Every other check says Cloudflare is not in front of this site although you use Cloudflare: A1 did not see it.
- A note that you reached the admin through a hostname that does not go through Cloudflare, so some checks rely on the request the server made to itself.
- A note that your host runs Cloudflare for you: those settings are changed with the host, not in your own Cloudflare account.
Why it happens
A1 is a description, not a finding, so it is always Info. It matters because every other check builds on it: the cache checks need Cloudflare in front, and the visitor IP checks read the headers it adds.
With a Tunnel, cloudflared makes outbound-only connections to Cloudflare, so the server needs no publicly routable address (Cloudflare: Tunnel). That is why the request reaches PHP from a private address.
Confirm it by hand
Read the headers of your home page. cf-ray means the answer came through Cloudflare:
curl -sI "https://example.com/" | grep -iE "cf-ray|server|cf-cache-status"In the browser: DevTools, Network, select the page request and look for cf-ray in the response headers. In the Cloudflare dashboard, the DNS records of the site show whether they are proxied.
How to fix it
There is nothing to fix in A1 itself. If it says the site is not behind Cloudflare and you expect it to be, make the A, AAAA or CNAME record of the site proxied:
In WordPress: if you reach the admin through a different hostname than visitors use, the checks rely on the request the server makes to itself, which is enough for most of them.
Limitations
A1 sees the answers on its own requests and your admin visit. A setup that sends only some hostnames or paths through Cloudflare can look different for visitors.
Host-managed setups are recognised by the headers of hosts the plugin knows. Other hosts that run Cloudflare for you appear as plain proxied.
Related checks
- A2 Flexible SSL: the first thing to check once Cloudflare is in front.
- B3 Local proxy or Tunnel in front of WordPress: Tunnels and proxies in front of WordPress.
- E3 Cloudflare 52x errors: whether Cloudflare reached your server during the run.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.