Show HN: Detect paid Cloudflare plans on any website via ECH

Posted by rapawel on Sunday September 14, 2025 @10:59AM
from the show-hn dept.

https://experiments.pawelpokrywka.com/cloudflare-subscription-checker/

A tool that checks if any website uses a paid Cloudflare subscription by examining their public /cdn-cgi/trace endpoint. Cloudflare only allows disabling Encrypted Client Hello (ECH) in paid plans, so sni=plaintext indicates a paid subscription. Works on any Cloudflare-proxied site.

( 5 comments | on HN )

Re:Show HN: Detect paid Cloudflare plans on any website via ECH by rapawel on Sunday September 14, 2025 @11:00AM (#45240260)

Example website with paid subscription: Substack https://experiments.pawelpokrywka.com/cloudflare-subscriptio...

[ Parent | on HN ]

Re:Show HN: Detect paid Cloudflare plans on any website via ECH by wordglyph on Sunday September 14, 2025 @11:25AM (#45240499)

My site https://wordglyph.xyz came back undetermined

[ Parent | on HN ]

Re:Show HN: Detect paid Cloudflare plans on any website via ECH by rapawel on Sunday September 14, 2025 @11:38AM (#45240609)

The tool only detects a subset of paid Cloudflare users - specifically those with the default ECH settings. If your site shows as undetermined, it likely means you're on a free plan or a paid plan with ECH enabled.

From what I've observed:

- Free plans: ECH is forcefully enabled (sni=encrypted)

- Paid plans: ECH is disabled by default (sni=plaintext), but can be manually enabled

The tool can only definitively distinguish between free plans and paid plans that use the default ECH settings.

[ Parent | on HN ]

Re:Show HN: Detect paid Cloudflare plans on any website via ECH by phillipseamore on Sunday September 14, 2025 @11:12AM (#45240375)

Seems like this might a wrong assumption (or CF changed something). Just tested one of my own sites that's on the free plan and it has "sni=plaintext".

[ Parent | on HN ]

Re:Show HN: Detect paid Cloudflare plans on any website via ECH by rapawel on Sunday September 14, 2025 @11:29AM (#45240535)

There are occasional false positives, but querying different Cloudflare data centers usually resolves this. I've found that switching VPN servers (which routes through different CF edge locations) eventually gives the correct result.

[ Parent | on HN ]