Cloudflare makes protection for private servers generally available: a DNS record to an internal address, with WAF, caching and Workers running in front

Your internal API was not built to face the Internet. A partner, a customer or an agent still has to send it a request. According to Cloudflare, before the June beta, protecting a service like that meant a public IP, an open firewall port or cloudflared next to the server. Now you point a proxied DNS record at a private address and Cloudflare reaches the server over the connection you already have with Cloudflare One.

Generally available does not mean you switch it on yourself. Your account team turns the entitlement on, and the announcement says neither what it costs nor which plans get it.

For a builder the gain is concrete. An internal MCP server or an AI agent backend gets the protection of a public site, and no port to the Internet is opened. One detail from the beta is worth knowing: according to Cloudflare, the most common setup failure is a missing return route. If requests end in a timeout and nothing reaches the origin, you check it first.

The address stays private. The protection is that of a public site.

Private-to-private is next: users, services and agents on one private network reaching applications on another through the same Cloudflare services. That is the company's plan. Engineering work is underway, with a closed beta targeted for early 2027. Until then the announcement covers only public traffic reaching private origins.

In practice you write to your account team first, and if you connect over Cloudflare WAN or Cloudflare Mesh, you also set up the return route.

The visual is generated code-art, no third-party images.