New usersFree DNS and CDN plans for every new account.Create your account
Log inSign up free
Documentation
Console

Origin request headers

Headers the edge adds when it contacts your origin: visitor IP, country, ASN, TLS / HTTP2 fingerprints and request ID.

4 min read Updated Oct 25, 2026

When an edge node forwards a request to your origin, it adds the headers below so the origin can read the real visitor details. Any copies of these headers sent by the visitor are removed first, so the values your origin receives can only come from the CDN.

HeaderContentsExample
X-Connecting-IPVisitor IP address (recommended way to get the visitor IP)203.0.113.10
X-Forwarded-ForVisitor IP, appended to any existing value198.51.100.1, 203.0.113.10
X-Real-IPVisitor IP203.0.113.10
X-Forwarded-ProtoProtocol the visitor usedhttps
X-IP-CountryCountry of the visitor IP (ISO 3166-1 alpha-2); omitted when unknownDE
X-IP-ASNAutonomous system number of the visitor IP; omitted when unknown3320
X-JA4Visitor TLS fingerprint (JA4); omitted for plain HTTPt13d1516h2_8daaf6152771_b186095e22b6
X-JA3-HashVisitor TLS fingerprint (MD5 of JA3); omitted for plain HTTPcd08e31494f9531f560d64c695473da9
X-HTTP2-FingerprintVisitor HTTP/2 fingerprint (Akamai format); sent only for HTTP/2 visitors1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p
X-Request-IDID of this request, the same as in the access logs; include it when you contact us about a problem9f1c2a7e4b6d8f00a3e5c7b9d1f3e5a7

X-IP-Country, X-IP-ASN, X-JA4, X-JA3-Hash and X-HTTP2-Fingerprint are off by default; contact us to turn them on for your domain. The other headers are sent for every domain.

Notes

  • With origin acceleration on, a request may pass through several CDN nodes. The values still describe the visitor: country and ASN are looked up from the visitor IP, and the fingerprints are measured by the node the visitor connected to and carried along with the request.
  • X-Forwarded-For can contain values added by the visitor or by proxies in between; only the last one is added by the CDN. Use X-Connecting-IP to get the visitor IP.
  • Origin request headers set in page rules are applied after these, so you can rewrite or remove them there.
  • These headers can only be trusted if nobody can reach your origin directly. Allow only the CDN origin IPs in your origin firewall.
  • For cacheable requests, Accept-Encoding is set to gzip or identity; the CDN compresses the response for each visitor itself.
Was this page helpful?