Cloudflare Hides the Hosting Company. We Found It Anyway.

Cloudflare is the largest reverse proxy on the internet. A reverse proxy sits between the visitor and the actual web server. When someone visits a website behind Cloudflare, the request goes to Cloudflare first. Cloudflare caches the page, filters malicious traffic, and forwards the request to the real hosting server. The visitor never connects to the origin server directly. That means that the real hosting company is invisible. All 40 million domains behind Cloudflare show "Cloudflare" as their hosting provider, regardless of where the site actually runs. For anyone doing web intelligence, this is a problem. For Cloudflare, it is the product.

We analyzed the full Dataprovider dataset for March 2026 to find out what is behind those domains. All numbers in this analysis are based on unique primary domains.

40 million domains and growing

Of the 362 million unique domains in the Dataprovider database, 40 million resolve to Cloudflare IP space. That is 11% of the observable web routed through a single company.

Four years ago, that number was 12 million. Cloudflare has more than tripled its domain count since March 2022: +220% in four years. The last year was the strongest: +50%, from 26 million to 40 million.

That growth rate is unusual for a company already at this scale. Hostinger grew faster in percentage terms (+594%), but from a base of 1.2 million. Hetzner doubled (+119%).

Less than half actually works

Of the 40 million Cloudflare domains, only 18.5 million return a working website. That is 46%. The other 54% is a mix of access denied responses, redirects, and dead domains. More than half of all domains behind the largest reverse proxy on the internet do not serve a functioning website.

That ratio has been getting worse. In mid-2025, Access Denied overtook Available for the first time. Available has since retaken the lead, but the gap keeps narrowing.

11 million dead domains

The most striking finding is the number of Cloudflare domains that do not work at all. Not just blocked by a firewall. Nonfunctional.

HTTP status codes in the 400 range mean the request itself is the problem: the page does not exist or the URL is wrong. Status codes in the 500 range mean the server is the problem: the hardware is down, the software has crashed, or the connection between the proxy and the origin server has failed.

6 million Cloudflare domains return a 4xx error. The DNS points to Cloudflare, Cloudflare accepts the request, but there is no website. There never was one, or it has been removed.

Another 5 million domains return a 5xx server error. The proxy tries to reach the origin server and fails. The hosting server is down, unreachable, or no longer exists.

In total, over 11 million domains behind Cloudflare are dead. That is 29% of all Cloudflare domains.

To put that number in context, we compared the dead domain rate across major hosting companies. A domain counts as dead if it returns an error in the 400 or 500 range, or does not respond at all. Domains blocked by robots.txt are excluded: those sites are alive, they are just blocking crawlers.

Google and DigitalOcean have the highest dead rates, at 32% and 31%. Cloudflare follows at 29%. The pattern at the top is clear: platforms that attract small or experimental projects accumulate dead domains. Amazon's 16% is inflated by millions of GoDaddy parked domains that point to Amazon IP space but have no web server.

Who is behind the proxy

When a domain uses Cloudflare as its reverse proxy, the hosting company vanishes from IP-level data. But it does not vanish entirely. Dataprovider tracks hundreds of variables per domain: nameservers, HTTP headers, DNS CNAME records, cookies, server signatures, and historical data. Many of these signals survive the Cloudflare proxy and reveal the real host.

Of the 18.5 million available Cloudflare domains, we can identify the hosting company or platform for over 5 million. That is 27% of all working Cloudflare websites.

Dataprovider uses a combination of signals that survive the Cloudflare proxy to identify the real hosting company. The method works differently per provider, but the result is the same: the hosting company that would otherwise be invisible becomes visible again.

WP Engine, Kinsta, and Cloudways mandate Cloudflare for all customers. 100% of their domains show "Cloudflare" as the hosting company. The same applies to Flywheel. Together, these managed WordPress hosters represent over 560,000 domains hidden behind the proxy. Without signal-based detection, none of them would appear in any hosting count.

Does Cloudflare attract fraud?

A free proxy that hides your hosting company sounds like an invitation for criminals. We checked. We compared eCommerce trust grades, cybersquatting indicators, and payment methods across Cloudflare, Google, Hostinger, Amazon, and Hetzner.

The eCommerce trust grade tells the clearest story. Dataprovider assigns each online store a trust grade from A (highest) to F (lowest), based on SSL certificates, payment methods, and contact information. At Amazon, 97.1% of e-commerce sites score an A. At Google: 90.7%. At Hostinger: 85.2%. At Cloudflare: 77.6%. That is the lowest A-rate of any major hosting company.

The low-trust end (grades D, E, and F) shows the same pattern. Cloudflare has 113,288 low-trust e-commerce sites, 4.3% of its graded online stores. In absolute numbers, that is more than all other hosting companies combined. Hetzner (4.2%) has a similar percentage, but on a much smaller base.

Cybersquatting tells a subtler story. Amazon hosts more cybersquatting domains in absolute terms: 431,932 versus Cloudflare's 124,729. But the nature of those domains is fundamentally different. At Amazon, 83% of cybersquatting domains are parking pages or placeholders. They are registered and parked, nothing more. At Cloudflare, 80% are real websites: business sites, content sites, and online stores. Of the cybersquatting domains behind Cloudflare that have a detectable website type, 15.7% are e-commerce sites. At Amazon: 0.4%.

Squatters at Amazon register a domain and wait. Squatters at Cloudflare build a working site behind the proxy. Some examples: burberly.com is a webshop impersonating Burberry. www.michaelskors.fr poses as the French Michael Kors store. www.turtlebeache.com mimics Turtle Beach. All three run WooCommerce, score an E or F trust grade, and sit behind Cloudflare. The real hosting company is invisible.

The picture is mixed. Cloudflare does not stand out on cybersquatting. But its e-commerce trust profile is weaker than any other major hoster. Whether that is because the free proxy attracts less trustworthy operators, or because legitimate small stores behind Cloudflare simply lack the resources for trust signals, the data cannot tell.

Even for these suspicious domains, the proxy is not airtight. Dataprovider can identify the real hosting company for 33% of all low-trust e-commerce sites behind Cloudflare, and for 20% of all cybersquatting domains. The proxy hides the host at the IP level, but other signals give it away.

What this means

Cloudflare routes 11% of the observable web. But 29% of that footprint is domains that never had a functioning website or have since been abandoned.

For hosting market analysis, Cloudflare creates a blind spot. The 1.95 million GoDaddy domains behind Cloudflare do not show up in IP-based hosting counts. Neither do the 357K WP Engine domains, the 324K Newfold domains, or the 206K IONOS domains. Without the right data, these hosting companies appear smaller than they are.

Dataprovider can identify the real host for over 5 million Cloudflare domains. That is 27% of all working Cloudflare websites where the hosting company is restored, despite the proxy.

Dataprovider offers this identification as an MCP skill for AI assistants. It works for individual domains and in bulk. The skill is available through the Dataprovider MCP connector.

Data: Dataprovider dataset, March 2026. All counts based on unique primary domains.