Traditional hosting exposes your server's IP address to the whole internet, which makes it a target for attacks. A Cloudflare Tunnel flips this model around — and it's a big reason Dhruva Cloud sites are secure by default. Here's how it works in plain terms.
The old way: open ports
Normally, a web server listens on public ports (80 and 443) so browsers can reach it. That also means attackers can reach it — port scans, brute-force attempts and DDoS floods all hit your origin directly.
The tunnel way: outbound-only
With a Cloudflare Tunnel, your server makes an outbound connection to Cloudflare's network and keeps it open. Visitors connect to Cloudflare's edge, and Cloudflare passes requests down the tunnel to your server. Your origin never needs open inbound ports and its real IP stays hidden.
Why this matters for you
- DDoS protection: Attacks hit Cloudflare's massive edge network, not your small server.
- No exposed IP: Attackers can't target what they can't see.
- Free SSL at the edge: HTTPS is terminated by Cloudflare automatically.
- Global speed: Cached content is served from 300+ edge locations worldwide.
How Dhruva Cloud uses it
Every Dhruva Cloud site is served through a Cloudflare Tunnel. You don't configure anything — when your domain's zone goes active, we route it through the tunnel and your site is live with edge SSL, CDN caching and DDoS protection baked in.