Private Origins removes the need for a public origin address
Cloudflare announced Private Origins as generally available on October 30. The feature lets a proxied DNS record point to a private IP address while Cloudflare reaches the origin through an existing Cloudflare One connection. An organization can keep the application server off the public Internet while applying Cloudflare edge services to incoming requests.
The issuer says the design can work with Cloudflare WAN or a connector-based network configuration. Web Application Firewall rules, caching, bot controls and Workers can remain in the request path. These capabilities depend on the customer’s broader Cloudflare configuration; the announcement does not establish that every account or network design is eligible.
The announcement and product documentation disagree on availability
When CGH checked the issuer’s pages on October 30, Cloudflare’s announcement described the feature as generally available. The linked product documentation still labeled Private Origins a closed beta and directed interested customers to contact an account team. That page showed a May 7, 2026 update date.
The conflict matters for deployment planning. CGH treats general availability as Cloudflare’s current announcement, but the stale documentation does not confirm whether all accounts have received access or whether an enrollment step remains. Teams should verify the control in their own dashboard and confirm eligibility before making the feature a production dependency.
Several routing and health-check limits remain
Cloudflare says Private Origins does not currently support Argo Smart Routing or Dedicated CDN Egress IPs. The announcement also says origin health checks require Cloudflare Load Balancing. Those restrictions can affect organizations that depend on optimized routing, fixed outbound address ranges or independent availability monitoring.
Cloudflare did not publish feature-specific pricing, supported plan tiers or a country-by-country availability list in the reviewed materials. CGH has not tested the feature or verified rollout across customer accounts. Buyers should confirm those commercial and geographic details, plus the required private-network connection, before treating the general-availability announcement as proof of immediate usability.