Learn which network ports Cloudflare proxies by default and how to enable Cloudflare’s proxy for additional ports.
Network ports compatible with Cloudflare’s proxy
By default, Cloudflare proxies traffic destined for the HTTP/HTTPS ports listed below.
HTTP ports supported by Cloudflare
HTTPS ports supported by Cloudflare
Ports supported by Cloudflare, but with caching disabled
How to enable Cloudflare’s proxy for additional ports
If traffic for your domain is destined for a different port than the ones listed above, for example you have an SSH server that listens for incoming connections on port 22, either:
- Change your subdomain to be , via your Cloudflare DNS app, to bypass the Cloudflare network and connect directly to your origin.
- Configure a for the hostname running the server. Spectrum supports all ports. Spectrum for all TCP and UDP ports is only available on the Enterprise plan. If you would like to know more about Cloudflare plans, please reach out to your Cloudflare account team.
How to block traffic on additional ports
Block traffic on ports other than 80 and 443 in Cloudflare paid plans by doing one of the following:
- If you are using , enable rule ID
100015(“Anomaly:Port - Non Standard Port (not 80 or 443)”).
- If you are using the new , enable rule ID
8e361ee4328f4a3caf6caf3e664ed6fe(“Anomaly:Port - Non Standard Port (not 80 or 443)”), which is disabled by default. This rule is part of the Cloudflare Managed Ruleset.
Ports 80 and 443 are the only ports compatible with:
- HTTP/HTTPS traffic within China data centers for domains that have the China Network enabled, and
- Proxying of
443 will be open so that Cloudflare can serve traffic for other customers on these ports. Tools like Netcat will report these non-standard HTTP ports as open.