Skip to content
Docs
CtrlK
Go to Dashboard
Origin Shield & Cloaking

Protect your web server from direct-to-host bypass attacks by verifying requests with WebOptiva Origin Request Signing

When you connect your domain name to WebOptiva, visitor traffic flows through WebOptiva's edge network where security checks take place. However, if a sophisticated attacker manages to discover your original hosting server's direct IP address, they might try to send attacks directly to your host, bypassing WebOptiva completely. Origin Shield closes this loophole.

Origin Shield and Cloaking screen displaying shared-secret request signing controls, origin advisory callout, and the Direct Bypass diagnostic probe
Enable shared-secret origin signing and verify your origin rejects direct bypass on the Origin Shield tab.

⚠️ Crucial pre-requisite: coordinate with your web developer or hosting provider#

> [!WARNING] > Do not enable Origin Request Signing until your web developer or server administrator has configured your web server! > When Origin Request Signing is enabled, WebOptiva attaches a shared-secret header to every legitimate visitor request. If your web server is instructed to require this header but hasn't been configured with the matching secret, it will reject all incoming visitors and your site will appear broken. Always use the built-in Test Direct Bypass button to verify connectivity first.

What is Origin Cloaking?#

Origin Cloaking means your origin server is never exposed as a direct target. WebOptiva edge nodes attach the shared-secret header x-weboptiva-origin-identity to every forwarded request, and your origin rejects anything without it. Automated scanners that find your server's IP address still cannot reach it, because they cannot produce the secret header.

Step-by-step: configuring Origin Shield#

  1. In Security operations, click the Origin Shield & Cloaking tab in the sub-navigation bar.
  2. Select your website domain name from the dropdown at the top.
  3. In the Origin Shield card, review the advisory banner and the Origin Request Signing section.
  4. Click Enable Signing. WebOptiva reveals the shared secret once — copy it and configure your origin server to require the x-weboptiva-origin-identity header with that value.
  5. Click Test Direct Bypass in the Origin Cloak Diagnostic Probe card. Wait for the CLOAKED (Protected) result confirming your origin rejects raw requests.
  6. When you need to change the secret, click Rotate Secret, update your origin to accept both secrets, then click Promote to Active (15m Grace).
  7. Use Disable at any time to stop signing and let unauthenticated traffic reach your origin again.

Expected result#

Complete perimeter protection where direct attacks against your hosting server IP are rejected because they lack the shared-secret header, while edge traffic continues to flow normally.

Back to Origin Shield & Cloaking