Hiding an address is not an access-control mechanism. Restrict who can reach the origin and verify the restriction from outside your network.

The public name is the distribution

Apex and www should flatten or CNAME to Cloud CDN. History records, staging names and forgotten subdomains are how origin stays public.

The delivery model

How it works

Hide origin IP

  1. 01RoutePublish the CDN as the website’s delivery path.
  2. 02RestrictPermit only required upstream and management access.
  3. 03AuditFind alternate hostnames and exposed services.
Conceptual model for this configuration. The actual path depends on provider policy and application behavior.

Firewall the pull

Allow Cloud CDN to fetch. Deny the world. If you use more than one CDN, allow every pull path. Validate origin TLS.

Look for leaks

Mail headers, old NS records, certificate transparency for unused hosts, and application code that prints server IPs. Clean those.

Emergency is easier when this is already done

If you are under attack and origin is still public, hiding it is part of the incident. Doing it on a quiet Tuesday is cheaper.

Validate before production

Check DNS history, alternate hostnames, IPv6 exposure, and unrelated services on the origin address. Test restrictions before and after a change to CDN upstream addresses. Keep an authenticated management route and a tested rollback.

  • Record the configuration and expected result before changing traffic.
  • Keep evidence of the test and a working rollback for the previous behavior.

Sources & further reading