Whilst Cloudflare doesn’t recommend enforcing any kind of security policy solely by trusting their IP addresses, it is worth noting that if you are whitelisting their IP addresses, they’re due to change shortly.

To be more precise, by 7th May 2021 the change will need to be made, and it’s safe to do so straight away, so get it done sooner rather than later.

IP range to remove: 104.16.0.0/12

IP range to add: 104.16.0.0/13

IP range to add: 104.24.0.0/14

Also being delisted is IP range 104.28.0.0/14, which will be repurposed for other Cloudflare products, such as the Gateway and WARP products, so may therefore carry traffic from untrusted sources moving forwards.

For a full updated list of Cloudflare’s IP address, check out their IP ranges page.