Make a comparable request
Open Cloudflare / Origin Troubleshooter. Enter the public URL and the origin IP. Add an expected status or public content marker to identify the deployment. The direct probe keeps the original hostname and checks TLS trust.
Interpret the evidence
- Both endpoints return expected content: inspect headers and timing if a problem remains. This does not cover every visitor or authenticated state.
- The edge serves old content while the origin serves the expected marker: inspect cache policy and the specific cached response. Save the evidence before a targeted purge.
- The origin cannot be contacted: check origin access rules and TLS requirements. A protected origin may intentionally reject a direct probe.
- Only body hashes differ: examine nonces, compression and dynamic content before calling it a deployment failure.
Example: dynamic content
In this illustrative case, both pages contain Release spring and return 200, but a generated request ID changes the body hash. The status and marker checks pass; the byte difference is informational. If the origin instead contains Release winter, the required marker fails and gives you a specific deployment difference to investigate.
Keep TLS evidence separate
A Cloudflare Origin CA certificate is intended for the Cloudflare-to-origin connection. A direct checker using public roots may reject it while the public site remains valid. Do not weaken encryption based only on that observation. Inspect the public certificate separately and review the intended origin trust setup.
Confirm one change
Change the relevant route, deployment or cache rule, then rerun the same paths and expectations. Compare the earlier report. If the result is still unavailable, record that limit instead of treating it as a pass.
References: Cloudflare Origin CA and Cloudflare cache responses.