How to File a DMCA Takedown on Cloudflare (2026 Guide)

To file a DMCA takedown on Cloudflare, submit your notice at abuse.cloudflare.com/dmca under 17 U.S.C. § 512. Because Cloudflare is a CDN and reverse proxy rather than a host, it cannot remove infringing content directly. Instead, it forwards your complaint to the website operator and the origin hosting provider, whose contact details Cloudflare will share with you.

What Is a DMCA Takedown on Cloudflare?

A DMCA takedown notice is a formal legal request asking a service provider to remove content that infringes your copyright. Under the Digital Millennium Copyright Act, 17 U.S.C. § 512, online service providers are required to respond to valid takedown notices or risk losing their liability protections.

Filing one with Cloudflare, however, works very differently from filing with a traditional web host. Cloudflare is not a hosting company in the conventional sense. Understanding this distinction is the single most important thing you can do before spending time on a takedown request.

Why Cloudflare Is Different: CDN vs. Hosting Provider

Most websites you encounter online sit on servers owned by a hosting company such as AWS, GoDaddy, SiteGround, or Bluehost. That host stores the actual files.

Cloudflare is a content delivery network (CDN) and reverse proxy. When a user requests a webpage, the request hits Cloudflare's global network first. Cloudflare checks its cache, applies security rules, and then passes the request to the origin server, the actual host, before returning the response to the user.

In plain terms: Cloudflare is the gatekeeper, not the landlord. It does not store most of the content it serves on a long-term basis. As Cloudflare itself states, "although we are unable to remove content from the Internet that we do not host, we are able to connect rightsholders with the website operators and hosting providers who can."

This distinction has enormous practical implications for DMCA enforcement.

Cloudflare's Safe Harbor Position Under 17 U.S.C. § 512

Because Cloudflare is a pass-through service rather than a content host for most traffic, it relies on multiple safe harbor provisions under the Copyright Act, 17 U.S.C. § 512:

§ 512(a) Transitory Transmission

This is Cloudflare's primary shield for CDN activity. A service provider is not liable for routing or transmitting infringing material if the transmission was initiated by someone else, occurs through an automatic process, and involves no selection of content by the provider. Cloudflare's core CDN function fits here.

§ 512(b) System Caching

When Cloudflare temporarily caches a webpage to speed up delivery, that activity falls under the caching safe harbor, provided the cache is updated regularly and Cloudflare acts on takedown notices for cached copies. Cloudflare states that it will clear its cache of allegedly infringing content in response to a valid § 512(b) notification.

§ 512(c) Storage of User Content

For services where Cloudflare actually stores content, such as Cloudflare Pages, Workers, Stream, Images, and R2 object storage, the standard hosting safe harbor applies. Under this provision, Cloudflare must remove infringing material promptly when notified and must maintain a repeat infringer termination policy.

The boundary between § 512(a) and § 512(c) is not settled. In a 2025 DMCA subpoena dispute, a federal judge concluded that Cloudflare functioned as a § 512(c) service provider because it stores cached copies on its servers, though the court reached that on an unrebutted showing at the subpoena stage rather than after full merits briefing. See the Recent Legal Developments section below.

What Cloudflare Actually Does After Receiving a DMCA Notice

Cloudflare's response depends on which service the infringing content is using.

For CDN/Reverse Proxy Traffic (Most Cases)

If the infringing site is simply using Cloudflare as a CDN, the most common scenario, Cloudflare will:

1. Forward your complaint to the website operator and the origin hosting provider.
2. Provide you with the hosting provider's contact information, so you can file a direct takedown with the actual host.
3. Give the hosting provider the origin IP address of the content at issue to help them locate it. Cloudflare describes this step as going to the hosting provider, not to you.
4. Clear its cache of the specific infringing URL where you provide a valid § 512(b) notification.

Cloudflare will not disable the site or remove the content directly. This is not an evasion. It is legally consistent behavior for a service operating under § 512(a).

For Cloudflare-Hosted Content (Pages, Workers, R2, Stream, Images)

If the infringing content is actually stored on Cloudflare's own infrastructure, Cloudflare will follow the standard DMCA notice-and-takedown procedure:

1. Remove or disable access to the infringing content.
2. Notify the account holder (the site operator).
3. Give the account holder the opportunity to file a counter-notification. Section 512 sets no deadline by which a subscriber must file one.
4. Restore access not less than 10 and not more than 14 business days after receiving a valid counter-notice, unless Cloudflare's designated agent first receives notice that you have filed a court action, per 17 U.S.C. § 512(g)(2)(C).

Cloudflare reports that it received approximately 125,000 DMCA reports for websites using its hosted services in the first half of 2025 and took action on approximately 54,000, compared with roughly 11,000 reports and 1,000 actioned in the second half of 2024. It also terminated hosting services to another 21,000 accounts based on abuse signals identified through that process. Cloudflare attributes the jump to work with several large rightsholders on unauthorized streaming, including giving them an API for streamlined reporting.

Read those numbers narrowly. They count reports about the hosted products described in this section, which is the smaller side of Cloudflare's business. They are not a measure of how many complaints Cloudflare receives about the sites it merely proxies, and Cloudflare does not publish an equivalent figure for those. As the previous section explains, a CDN pass-through complaint does not get answered by removal at all.

Step-by-Step: Filing a DMCA Complaint With Cloudflare

Step 1: Identify Whether Cloudflare Is Hosting or Just Proxying

Before filing, determine what role Cloudflare is actually playing. Check whether the site uses Cloudflare Pages, Workers, or R2 storage, or whether it is simply routing traffic through Cloudflare's CDN.

If you are unsure, file anyway. Cloudflare will route your complaint appropriately and provide you with the origin host's details.

Step 2: Go to the Official Cloudflare Abuse Form

Navigate to abuse.cloudflare.com/dmca. This is the route Cloudflare directs complainants to. Cloudflare calls the abuse reporting form the primary way to report abuse and says it is generally unable to process complaints submitted to it by email, so use the form rather than writing in.

Step 3: Confirm You Are Filing Under Copyright and DMCA

The /dmca address takes you to Cloudflare's copyright and DMCA reporting path. Before submitting, confirm the complaint is filed under the copyright and DMCA category rather than a general abuse category, so it reaches Cloudflare's copyright team.

Step 4: Complete the Required Fields

A valid DMCA notice under 17 U.S.C. § 512(c)(3) must contain:

• Your signature. Your full typed name is legally valid as an electronic signature.
• Identification of the copyrighted work. A URL to your original content or a clear description.
• Location of the infringing material. The exact URL where infringing content appears.
• Your contact information. Mailing address, phone number, and email address.
• Good faith statement. "I have a good faith belief that the use of the copyrighted material described is not authorized by the copyright owner, its agent, or the law."
• Accuracy statement. "I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner or authorized to act on the owner's behalf."

For CDN cache removal, you must also provide either a hyperlink to a court order against the infringing site or documented evidence that the origin hosting provider has already removed the content.

Step 5: Submit and Wait for Cloudflare's Response

After submission, Cloudflare will forward your complaint to the website operator and the origin hosting provider. It will also provide you with the hosting provider's contact information so you can file a direct takedown.

Cloudflare has not published a service-level commitment for how quickly it processes copyright complaints. Its H1 2025 transparency report describes work to speed up the notice-and-takedown process without stating a guaranteed turnaround, so plan on following up with the origin host yourself rather than waiting.

How to Find the Actual Hosting Provider Behind Cloudflare

Because Cloudflare routes all traffic through its own network, the origin server's IP address is not immediately visible. Here are the most effective methods to identify it:

Check DNS history. Services like SecurityTrails allow you to view historical DNS records. If the domain previously pointed to a hosting provider before adding Cloudflare, that IP may still be active.

Look at subdomain records. Development or staging subdomains (for example, dev.example.com or staging.example.com) are sometimes not routed through Cloudflare and may reveal the origin server IP directly via DNS lookup.

Check MX records. If the site runs its own mail server on the same infrastructure as the web server, the mail exchanger (MX) record may point to the origin IP.

Ask Cloudflare, but understand the limits. Do not count on Cloudflare handing you the origin IP. Its stated practice is to give that address to the hosting provider to help them locate the content, not to the complainant. Cloudflare says it has "extended our trusted reporter program to certain rightsholder organizations to allow them to get access to sensitive origin IP address information." That is a vetted program for institutional rightsholder groups, not a routine option for an individual or a small business filing a one-off notice.

Obtain a DMCA subpoena. Under 17 U.S.C. § 512(h), you can petition a federal court clerk to issue a subpoena compelling Cloudflare to disclose information identifying the infringer. This is the most reliable method when the others fail, and a 2025 ruling discussed below strengthened the argument that Cloudflare is a proper target for such a subpoena.

When to File With Cloudflare vs. the Actual Host

File with Cloudflare when:

• You do not know who the actual host is and need Cloudflare to identify them.
• Content is stored on Cloudflare's own infrastructure (Pages, R2, Stream).
• You need the CDN cache cleared after the origin host has already removed the content.
• You are pursuing a DMCA subpoena and need to establish a formal record.

File directly with the host when:

• You have already identified the origin hosting provider through DNS research or Cloudflare's forwarded information.
• You want the fastest possible removal of the underlying content.
• The site is using Cloudflare only as a CDN.

In most cases, the most effective approach is to file with both simultaneously. Filing with Cloudflare gets you the host's contact information and establishes a paper trail. Filing with the actual host gets the content removed.

Counter-Notification Process

If you are the site operator and you receive a DMCA takedown notice forwarded by Cloudflare, you have the right to file a counter-notification if you believe the takedown was filed in error or constitutes a misuse of the DMCA.

A valid counter-notification under 17 U.S.C. § 512(g)(3) must include:

• Your physical or electronic signature.
• Identification of the material that was removed and its previous location.
• A statement under penalty of perjury that the removal was a mistake or misidentification.
• Your name, address, and phone number.
• Consent to federal court jurisdiction in your district.

Section 512 does not set a deadline for filing a counter-notification. What it does set is the provider's timetable afterward. Once Cloudflare receives a valid counter-notice, it forwards the counter-notice to the original complainant, and under 17 U.S.C. § 512(g)(2)(C) it restores the material not less than 10 and not more than 14 business days later, unless its designated agent first receives notice that the complainant has filed a court action to restrain the infringing activity.

Watch out: A counter-notification is a sworn statement made under penalty of perjury, and it consents to federal court jurisdiction. Filing one invites the complainant to sue you within the statutory window. Do not treat it as a formality.

Recent Legal Developments: Cloudflare and DMCA Liability

The legal landscape around Cloudflare and copyright liability has been moving quickly, particularly outside the United States.

Tokyo District Court (November 2025). On 19 November 2025, the Tokyo District Court ruled against Cloudflare in a suit brought by KADOKAWA, Kodansha, Shueisha, and Shogakukan over CDN service to manga piracy sites. Read the numbers carefully, because they are widely misreported. The court recognized damages of approximately 3.6 billion yen, about $24 million at 150 yen to the dollar, "for four works alone." Because the publishers had claimed only a portion of the damages they suffered, the operative part of the judgment ordered Cloudflare to pay approximately 500 million yen, about $3.3 million. The larger figure is the harm the court recognized; the smaller one is what Cloudflare was ordered to pay.

United States (2025). In Shueisha v. John Doe, a DMCA subpoena dispute over the Mangajikan site, Judge Yvonne Gonzalez Rogers of the U.S. District Court for the Northern District of California denied the site operator's motion to quash, which had argued that Cloudflare is a mere § 512(a) conduit. The court concluded that Cloudflare "functioned as a Section 512(c) service provider" because it "stores content on its servers in the form of cached data to support faster loading of sites," which allowed the subpoena to proceed. Weigh that ruling for what it is. The court accepted Shueisha's prima facie showing and said so expressly because there was no evidence to the contrary, so this is a subpoena-stage conclusion on an unrebutted record, not a merits holding on Cloudflare's status after both sides litigated it. It is useful to anyone using the subpoena route described above, and it is not the last word.

Germany (November 2023). On 3 November 2023, the Cologne Higher Regional Court held that Cloudflare could be required to stop facilitating access to the pirate music site DDL-Music through its CDN, in a case brought by Universal Music, finding that "Cloudflare plays a central role in making the site available." The same ruling declined to impose blocking duties on Cloudflare's 1.1.1.1 public DNS resolver, which the court treated as operating in a purely passive, automatic and neutral manner.

Italy (order May 2024, reported October 2024). The Court of Rome ordered Cloudflare to stop serving the pirate streaming platform Guardaserie, disclose identifying account information about its operators, and block associated and future domains on penalty of €1,000 per day, in proceedings brought by the broadcaster RTI.

These cases point to a tightening of standards for CDN providers abroad. United States law still largely shields Cloudflare under § 512 for its pass-through services, but the § 512(a) versus § 512(c) line is being actively litigated, and Cloudflare's own enforcement volume has escalated sharply.

Tips for Effective DMCA Takedowns When Content Is Behind Cloudflare

1. Include exact URLs, not just the domain. Cloudflare processes URL-level requests more effectively than domain-level ones.
2. Document your original work with timestamps, file metadata, or registration records before filing.
3. Follow up with the origin host the moment Cloudflare provides their contact information. Do not wait.
4. Keep copies of all submissions, including timestamps, confirmation numbers, and email threads, in case you need to escalate to a court subpoena.
5. Consider a DMCA subpoena if the infringer is operating anonymously and the hosting provider is unresponsive.
6. Register your copyright with the U.S. Copyright Office, and register it early. Registration is a prerequisite to suing for infringement of a U.S. work, and timing controls your remedies. Under 17 U.S.C. § 412, no award of statutory damages or attorney's fees may be made for infringement of an unpublished work that began before the effective date of registration, or for infringement of a published work that began after first publication and before registration, unless registration is made within three months after first publication. Register late and you are generally left pursuing actual damages and the infringer's profits.

Registration timing and remedy questions turn on the specific facts of your work and when the infringement started. Talk to a copyright lawyer licensed in your jurisdiction before relying on any of this for a live dispute.

Disclaimer

This article presents general legal information about the DMCA notice-and-takedown process under United States federal law, 17 U.S.C. § 512, and summarizes selected foreign court rulings involving Cloudflare. It is not legal advice, and it does not create a lawyer-client relationship. Copyright enforcement outcomes depend on the specific facts of your work, your registration history, and the jurisdiction involved. Consult a lawyer licensed in your jurisdiction before acting on any of the information above. Information last verified on 2026-08-04.

See also: What is a DMCA Takedown? | Free DMCA Takedown Notice Builder | DMCA Takedown on AWS