--- title: Using Cloudflare and other reverse proxies with Vercel description: General information about using an external proxy to serve a Vercel Deployment. url: "https://vercel.com/kb/guide/can-i-use-a-proxy-on-top-of-my-vercel-deployment" published: 2025-11-03 last_updated: 2026-10-19 authors: Anshuman Bhardwaj install_vercel_plugin: npx plugins add vercel/vercel-plugin --- We recommend connecting directly where possible, but you can place a proxy in front of Vercel. An external proxy introduces security, caching, and operational tradeoffs. If your organization requires one, configure Verified Proxy, preserve certificate validation paths, and coordinate caching across both services. This guide covers Cloudflare, other hosted proxies, and self-hosted proxies such as Nginx and HAProxy. ## Choose your setup Start by identifying which service receives your visitors’ HTTP requests. | Setup | Request path | When to use it | | ------------------------------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------- | | Cloudflare DNS-only | Visitor → Vercel | You want Cloudflare to manage DNS while Vercel handles HTTP traffic directly. | | External proxy or CDN | Visitor → external proxy → Vercel | Your organization requires another service to handle traffic before it reaches Vercel. | | Self-hosted proxy | Visitor → your proxy → Vercel | You operate your own proxy infrastructure and can meet the Enterprise onboarding requirements. | | Vercel proxying to an external origin | Visitor → Vercel → external service | You want Vercel to forward selected requests to another backend through rewrites. | If you want Vercel to forward requests to another service, follow [Using Vercel as a reverse proxy](https://vercel.com/kb/guide/vercel-reverse-proxy-rewrites-external). The inbound proxy requirements below apply when another service sits in front of Vercel. ## Why is another CDN or proxy in front of Vercel not recommended? Vercel already provides a CDN and security controls. Adding another proxy creates a second service whose routing, caching, and security settings must work with your deployment. ### Reduced security visibility An external proxy changes the connection information Vercel receives. This reduces the signals available to identify suspicious traffic and distinguish individual visitors. Attack traffic forwarded by the proxy can also reach your Vercel project. Vercel provides [automatic DDoS mitigation on all plans](https://vercel.com/docs/vercel-firewall/ddos-mitigation). When many visitors share a proxy’s egress IPs, mitigation against malicious traffic from those addresses can also affect legitimate requests. [Verified Proxy](https://vercel.com/docs/security/reverse-proxy) allows Vercel to recognize supported proxy traffic using trusted source ranges and the required headers. Verified Proxy does not restore all the security signals available when visitors connect directly to Vercel. The [Bot Protection managed ruleset does not work](https://vercel.com/docs/bot-management#bot-protection-ruleset-with-reverse-proxies) when a reverse proxy is placed in front of Vercel. Masked signals can cause legitimate visitors to receive challenges, and changing proxy egress IPs can trigger repeated challenges. Review this limitation even if Verified Proxy is enabled. ### Additional network and operational overhead Requests pass through another network, adding connection and processing overhead. The effect depends on the proxy’s location, network, cache behavior, and your visitors’ locations. Measure the complete request path before adopting the setup. The proxy also becomes another service your application depends on. Your team or proxy provider must resolve outages and configuration failures in that layer. ### Two independently managed caches An external CDN can cache responses separately from Vercel. A deployment or cache invalidation on Vercel does not automatically update that external cache. For example, the external CDN might serve HTML from an earlier deployment while forwarding requests for its assets to the current deployment. This can produce stale pages, missing JavaScript, or broken styles. See [Troubleshoot stale content and missing assets](#troubleshoot-stale-content-and-missing-assets). ### Changed client IP and geolocation Without the appropriate configuration, your application may receive the proxy’s IP address or location. If you need the original client IP and geolocation preserved, review Verified Proxy Advanced with your Vercel account representative. ## Use Cloudflare with Vercel ### Use DNS-only mode for direct traffic You can keep Cloudflare as your DNS provider without enabling its reverse proxy. 1. Add your domain in your Vercel project’s **Settings → Domains**. 2. Configure the DNS records Vercel displays for that domain. 3. Set the relevant Cloudflare records to **DNS only**. 4. Confirm domain verification and certificate status in Vercel. Follow [Adding and configuring a custom domain](https://vercel.com/docs/domains/working-with-domains/add-a-domain) for current DNS requirements. Before switching an existing proxied domain to DNS-only mode, confirm that Vercel presents a publicly trusted certificate for the hostname. [Cloudflare Origin CA](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/) certificates are intended for connections from Cloudflare to an origin; browsers may reject them when connecting directly. ### Configure HTTPS when Cloudflare proxies traffic Use **Full (strict)** with an origin certificate that meets [Cloudflare’s validity, trust, and hostname requirements](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/). Flexible mode can cause a redirect loop: Cloudflare connects to Vercel over HTTP, Vercel redirects to HTTPS, and the cycle repeats. Configure HTTPS between Cloudflare and Vercel. If redirects continue, follow [Cloudflare's redirect-loop troubleshooting](https://developers.cloudflare.com/ssl/troubleshooting/too-many-redirects/). ### Plan wildcard certificate validation Wildcard domains require DNS validation for automatic certificate issuance and renewal. Use Vercel nameservers or follow the [documented method](https://vercel.com/docs/domains/working-with-domains/add-a-domain#use-wildcard-domains-with-an-external-dns-provider) to delegate certificate validation while retaining an external DNS provider. For Enterprise configurations, another option is to upload a Cloudflare Origin CA certificate containing the appropriate wildcard Subject Alternative Name. Review [Vercel’s custom certificate requirements](https://vercel.com/docs/domains/custom-ssl-certificate) and the implications for direct browser access before choosing this approach. Your team must [renew uploaded custom certificates](https://vercel.com/docs/domains/custom-ssl-certificate#ssl-best-practices); Vercel does not renew them automatically. ## Configure a required external proxy Before getting started, follow the prerequisites in [Reverse Proxy Servers and Vercel](https://vercel.com/docs/security/reverse-proxy#prerequisites). ### Step 1. Select the Verified Proxy option | Option | Availability | Purpose | | ----------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------- | | Verified Proxy Lite | All plans, for supported providers | Identifies supported proxy traffic using the required provider headers and known egress ranges. | | Verified Proxy Advanced | Enterprise, with manual onboarding | Supports self-hosted or other providers and original client IP/geolocation preservation. | Verified Proxy Lite is enabled automatically for supported providers when its requirements are met. Before proceeding, complete your provider’s configuration in the [supported-provider table](https://vercel.com/docs/security/reverse-proxy#supported-providers-verified-proxy-lite). Requirements differ: CloudFront needs an origin request policy that forwards the required header, while Akamai also requires an Origin IP ACL and protection against client IP header spoofing. Forwarding a client-IP header alone does not establish trust. Vercel must also recognize the proxy source and, where required, complete onboarding. ### Step 2. Configure the origin hostname and TLS Set the origin to a domain assigned to your Vercel project. Forward the correct HTTP `Host` header and enable outbound TLS Server Name Indication (SNI) for the intended origin hostname. For example, if the origin is `app.example.com`, configure the proxy’s Host and SNI settings for that domain. For Akamai, check **Forward Host Header** and **Use SNI TLS Extension**. For Fastly, check both the **SNI hostname** and the **Certificate hostname** against the Vercel origin domain. ### Step 3. Preserve validation and security paths Configure these exceptions at the external proxy: | Path | Requirement | | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `http:///.well-known/acme-challenge/*` | Allow HTTP-01 validation on port 80. Exclude these requests from proxy-enforced HTTP-to-HTTPS redirects and WAF or bot challenges that would block validation. | | `https:///.well-known/vercel/*` | Never cache these paths. Allow requests to reach Vercel. | The HTTP exception supports certificate issuance and renewal when the same hostname is used through the proxy to Vercel. Wildcard certificates use DNS validation instead. ### Step 4. Define cache and traffic policies Start with external caching disabled unless you have a specific requirement for it. If you enable caching: - Respect response cache directives and distinguish shared content from personalized responses. - Keep `/.well-known/vercel/*` excluded. - Coordinate external invalidation with deployment promotion, rollback, and content updates. - Test that cached HTML and its referenced assets remain compatible across releases. Configure appropriate DDoS protection, rate limiting, and traffic controls at the external proxy so it does not simply forward abusive traffic to Vercel. ### Step 5. Complete self-hosted proxy onboarding For Nginx, HAProxy, or another self-hosted proxy, prepare: - Static public egress IP addresses. - A custom request header carrying the original client IP. - SNI on outbound TLS connections. - Consistent origin domains, such as a defined set under `*.vercel.example.com`. Dynamic egress IP addresses are not supported. Confirm that your setup meets the [Verified Proxy Advanced requirements](https://vercel.com/docs/security/reverse-proxy#self-hosted-reverse-proxies-verified-proxy-advanced) before contacting your Vercel account representative. ### Step 6. Verify the complete request path Test through the proxy and directly against Vercel. Confirm hostname routing, TLS, validation paths, cache behavior, and any required client-IP preservation. If you need to inspect a forwarded header, use a temporary, access-controlled diagnostic that exposes only the expected value. Remove it afterward. Do not return all request headers from a public endpoint: they can contain credentials or session information. A header arriving at your application confirms that transport has passed through the proxy. It does not, by itself, confirm successful Verified Proxy onboarding. ## Troubleshoot common failures | Symptom | What to check | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Visitors receive repeated challenges | Review the Bot Protection reverse-proxy limitation, changes in egress IPs, and caching of `/.well-known/vercel/*`. | | Redirect loops or origin TLS failures | Use HTTPS to the origin. Check certificate validity, Host, SNI, and conflicting redirect rules. | | Certificate issuance or renewal fails | Check port 80 access and the ACME path exceptions. For wildcard certificates, check DNS validation. Follow [domain diagnostics](https://vercel.com/docs/domains/troubleshooting). | | Pages are stale or assets fail after deployment | Compare direct and proxied responses, then inspect the external cache as described below. | | Client IP or location reflects the proxy | Review Verified Proxy Advanced requirements and onboarding. | | Direct deployment URLs remain accessible | Configure a separate access restriction; Verified Proxy does not block direct access. | | Failures occur only through the proxy | Inspect proxy routing, security rules, TLS, and caching. Compare with a direct Vercel request. | ### Troubleshoot stale content and missing assets Consider this sequence: 1. The external CDN caches HTML from deployment A. 2. You promote deployment B to the production domain. 3. The external CDN continues serving deployment A’s HTML. 4. A visitor requests an asset referenced by that HTML. 5. The request reaches deployment B, where that asset path may be unavailable. ![Stale cache issues with reverse proxies](https://images.ctfassets.net/hjgychtc108g/6pRRz96Ro0N2m71BP5RHOe/7ccf7edac2b5531e22ef9c899c27d6ed/stale-cdn-light-1080p.png) Stale cache issues with reverse proxies Vercel’s CDN cache keys include the unique deployment URL. Promoting a new deployment does not affect the previous deployment’s cache. [Vercel’s CDN cache keys](https://vercel.com/docs/caching/cdn-cache/purge#cache-keys) include the unique deployment URL, so promoting a new deployment does not affect the previous deployment’s cache. To investigate: 1. Identify the failing page and asset URLs. 2. Compare the HTML, status codes, and cache headers through the proxy and directly against the relevant Vercel deployment. 3. Bypass or invalidate the affected external cache entries and retest. 4. Correct the cache policy and deployment coordination that allowed incompatible content to be served together. A shorter TTL limits how long stale content remains cached, but does not guarantee consistency. If the asset also fails directly, investigate the build, asset path, and deployment rather than assuming the proxy caused it. ### Isolate problems before contacting support Use your deployment’s `*.vercel.app` URL, or another appropriately configured direct route, to establish whether the failure also occurs without the proxy. Account for application behavior that depends on the hostname. Include affected URLs, timestamps, response details, and the direct-versus-proxied comparison when contacting support. Vercel Support does not debug third-party proxy services. For performance or reliability issues, our [Support Terms](https://vercel.com/legal/support-terms) require direct use of the Vercel CDN and DNS configured according to Vercel’s documentation. Be prepared to reproduce the issue without the external proxy. Separately negotiated customer agreements may supersede these terms. ## Next steps - [Reverse Proxy Servers and Vercel](https://vercel.com/docs/security/reverse-proxy) - [Adding and configuring a custom domain](https://vercel.com/docs/domains/working-with-domains/add-a-domain) - [Bot Management](https://vercel.com/docs/bot-management) - [DDoS mitigation](https://vercel.com/docs/vercel-firewall/ddos-mitigation) - [Purging Vercel CDN Cache](https://vercel.com/docs/caching/cdn-cache/purge) - [Custom SSL certificates](https://vercel.com/docs/domains/custom-ssl-certificate) - [Deployment Protection with Trusted IPs](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/trusted-ips) ## Frequently asked questions ### Can I use Cloudflare DNS with Vercel without proxying traffic? Yes. Set the relevant Cloudflare DNS records to DNS-only and use the records specified by your Vercel project. HTTP traffic then connects directly to Vercel. Before changing an existing proxied setup, verify that the origin certificate supports direct browser access. ### Does Verified Proxy restore Bot Protection behind a proxy? No. Verified Proxy identifies supported proxy traffic, while the Bot Protection managed ruleset relies on signals that a reverse proxy obscures. Enabling Verified Proxy does not remove the documented [Bot Protection limitation](https://vercel.com/docs/bot-management#bot-protection-ruleset-with-reverse-proxies). ### Can I use Nginx or HAProxy in front of Vercel? Yes, through Enterprise onboarding for Verified Proxy Advanced. You need static egress IPs, an original-client-IP header, outbound SNI, and predictable origin domains. Prepare those details and contact your Vercel account representative. ### Why does my app or monitoring show the proxy’s IP address? Vercel receives the connection from the proxy, so client-IP and geolocation information can reflect that proxy. If you need original client information, ask your account representative which application headers and monitoring views Verified Proxy Advanced supports for your configuration. ### Does Verified Proxy block direct access to my deployment? No. Proxy identification and access restriction are separate controls. Evaluate [Vercel WAF rules](https://vercel.com/docs/vercel-firewall/vercel-waf) or [Trusted IPs](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/trusted-ips), depending on your plan and requirements. Check protection across production, preview, custom, and deployment domains rather than assuming one setting covers every route. ### Does a “Proxy Detected” warning mean setup failed? No. Vercel can display a proxy warning even when Verified Proxy is configured. The warning indicates that requests pass through an external proxy and that the associated limitations still apply. Verify the actual configuration and request behavior using the setup checks. ### Why do I see stale pages or missing assets after deployment? The external CDN may be serving older HTML while requests for its assets reach a newer deployment. Compare direct and proxied responses, invalidate affected external content, and correct cache coordination. A shorter TTL alone does not guarantee a fix. Follow the troubleshooting steps above. ## More Firewall guides - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](/kb/guide/how-to-conduct-pci-scans-on-vercel-guide): Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. - [Protect Sensitive Routes with Vercel WAF: Challenge and Deny Rule Recipes](/kb/guide/suspicious-traffic-in-specific-countries): Use Vercel WAF custom rules to block or challenge unwanted traffic by country, ASN, IP address, user agent, path, or cookie, without redeploying. - [How to prepare your storefront for Black Friday traffic](/kb/guide/black-friday-preparation): A practical checklist for keeping your storefront fast and your checkout path healthy through Black Friday and Cyber Monday traffic, from load testing to instant rollback.