What the check looks at
F3 resolves the bare domain (apex) and the www name and checks whether each resolves to Cloudflare. It applies when your site is on one of the two; a site on another subdomain is out of scope.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Both forms of your address go through Cloudflare Every visitor goes through Cloudflare. |
| PassedConfidence: High | Only one address is in use The other form has no DNS record. The result notes that visitors who type it get no answer at all, and that a proxied record that redirects would catch them. |
| WarningConfidence: High | One form of your address skips Cloudflare Visitors who use the other form reach your server directly, and the record gives its address away. |
| Could not checkConfidence: Medium | This check could not be completed The group ran out of time ( budget). |
| Could not checkConfidence: Low | This check could not be completed PHP cannot make DNS queries. |
| Not applicable | This site is on a subdomain Reason out_of_scope. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
budget: This group ran out of time before the check finished.php_function_unavailable: A PHP function this check needs is turned off on your server.out_of_scope: This check does not apply to a site set up like yours.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- The site behaves differently with and without www: no padlock, another certificate, or rules and cache that apply on one form only.
Why it happens
Each record has its own proxy status. A DNS only record “exposes your origin IP address to anyone who queries the record” (Cloudflare: proxy status), so one unproxied form is a way around Cloudflare.
Confirm it by hand
dig +short example.com
dig +short www.example.comBoth should return addresses from cloudflare.com/ips.
How to fix it
In Cloudflare: make both records proxied, the orange cloud.
In WordPress: keep one form as the Site Address under Settings, General; WordPress redirects the other to it once both reach the server through Cloudflare.
Limitations
F3 checks DNS only. It does not test whether the other form redirects to the right place.
Related checks
- F2 DNS records revealing your server: other records that reveal the server.
- A4 Redirect loops and HTTP to HTTPS: redirect chains of the home page.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.