Checks at the edge / VERSION 1.0.0

Cloudflare Worker for Proxy & VPN Detection

Check signup requests at the Cloudflare edge. Download a Worker with protected routes, secret API keys, monitor mode and allow/deny IP rules.

Source and setup instructions included · Published October 28, 2026

Check selected actions before they reach your origin

This Worker adds network checks to exact POST paths such as /signup and /register. GET requests, assets and unrelated paths pass through. It is a starter for a Cloudflare route on an existing proxied origin, not a standalone site or DDoS protection service.

Set up the Worker

1. Download and extract the ZIP. Install the official Cloudflare Wrangler CLI in your own development environment.
2. Edit wrangler.toml: add a route for your own proxied hostname and set PROTECTED_PATHS to the exact POST paths your application uses. Paths are case-sensitive; a trailing slash is a different path.
3. Keep MODE = "monitor". Add the API key as a Worker secret using the command below. Never commit it in your configuration or JavaScript.
4. Deploy to a staging hostname first. Submit a protected action and check the anonymous proxyradar decision in Worker logs.
5. Set MODE = "block" only after reviewing results. Remove the Worker route to roll back.

npx wrangler secret put PROXYRADAR_API_KEY
npx wrangler deploy

Policy variables

Trust the right client IP

The Worker uses Cloudflare’s CF-Connecting-IP at the edge, not user-supplied X-Forwarded-For. Disable Pseudo IPv4 “Overwrite Headers” for this route so IPv6 visitors keep their real IP. Avoid chains of Workers that rewrite visitor identity. Restrict direct origin access if the Worker is intended to enforce a policy.

Latency and failure handling

A cold lookup can wait up to 15 seconds; measure the impact on your form before enforcement. The client limits simultaneous lookups to eight per Worker instance, caches successful positive results for 60 seconds and negative results for 30 seconds, and coalesces duplicate in-flight requests. The cache is local to each instance, not a global rate limit. Errors remain unknown and are never cached as clean.

Use platform or application rate limits before this check. Cloudflare usage charges may apply. A successful lookup consumes a ProxyRadar query; a local cache hit does not send a new request. API keys, IPs and form bodies are not included in the integration’s decision logs.

All integrations · API reference · Coverage and limitations · Account support