Status codes
| Status | When | Body |
|---|---|---|
301 | Plain HTTP, or www.<apex> when the apex is a proxied site. | Redirect to HTTPS or the apex. |
301, 302, 307, 308 | A redirect rule matched. | Redirect. |
400 | Ambiguous Transfer-Encoding or conflicting Content-Length. | Plain text. |
401 | Access gate login page. | HTML form. |
403 | IP rule, country rule, threat feed, WAF, SSRF, open redirect or prompt injection shield; AI Crawl Control block (by default). | Block page. |
403 | Challenge or tarpit from AI Crawl Control to a request that isn't a browser navigation. | {"error":"verificacion de navegador requerida"} or {"error":"forbidden"}. |
404 | WordPress hardening, source map or GraphQL shield. | Plain 404 page not found. |
413 | Body larger than max_body_mb, or larger than the shields' inspection limit. | Plain text. |
421 | The edge doesn't serve this name. | Generic page. |
429 | Rate limiting rule with block (or challenge for non-navigations). | Block page for browsers, {"error":"rate_limited","retry_after":N} otherwise, with Retry-After. |
429 | Rate limit rule, basic rate limit or pagination shield. | Block page. |
503 | Browser challenge. | Proof-of-work page, Cache-Control: no-store. |
502, 525, 526 | The origin couldn't be reached, or its TLS failed. | See SSL/TLS troubleshooting. |
AI Crawl Control blocks use the block_response you configure (401, 402, 403, 404, 410, 429, 451 or 503); see AI Crawl Control settings.
Response headers
On every response from your origin, the edge:
- sets
Servertonginxor yourfake_server_header; - removes
X-Powered-By,X-AspNet-Version,X-AspNetMvc-Version,X-Runtime,X-Generator,X-Debug-Info,X-Platform-Server,X-Served-By,X-Backend-Server,X-Drupal-CacheandX-Varnish; - adds, only when the origin didn't set them:
X-Content-Type-Options: nosniff,X-Frame-Options: SAMEORIGIN,Referrer-Policy: strict-origin-when-cross-originandPermissions-Policy: camera=(), microphone=(), geolocation=(); - sets
Strict-Transport-Securityon HTTPS responses when HSTS is on (see HSTS); - adds
Secure,HttpOnlyandSameSite=Laxto everySet-Cookiethat lacks them.
On /health, /status, /version, /api/health and /api/status, the edge removes version, build, commit, node_version, framework and nestjs fields from the JSON body, so the stack can't be fingerprinted.
CORS
If your origin reflects the request's Origin in Access-Control-Allow-Origin, the edge keeps it only when that origin is the same site (the name itself, a subdomain or a parent) or a host in cors_allow_origins. Otherwise it removes Access-Control-Allow-Origin and Access-Control-Allow-Credentials. A wildcard * together with Access-Control-Allow-Credentials: true loses the credentials header.
Headers your origin receives
| Header | Value |
|---|---|
X-Forwarded-For, X-Real-IP, CF-Connecting-IP | The client IP as the edge sees it (replacing any value the client sent). |
X-Forwarded-Host | The requested host. |
X-Forwarded-Proto | https or http. |
The edge removes X-Originating-IP, X-Remote-IP, X-Remote-Addr, X-Client-IP, True-Client-IP and Forwarded from requests, so a client can't spoof its address to your application.