Show HN: Detect paid Cloudflare plans on any website via ECH

https://experiments.pawelpokrywka.com/cloudflare-subscription-checker/

1•rapawel•1h ago

A tool that checks if any website uses a paid Cloudflare subscription by examining their public /cdn-cgi/trace endpoint. Cloudflare only allows disabling Encrypted Client Hello (ECH) in paid plans, so sni=plaintext indicates a paid subscription. Works on any Cloudflare-proxied site.

Comments

rapawel•1h ago

Example website with paid subscription: Substack https://experiments.pawelpokrywka.com/cloudflare-subscriptio...

phillipseamore•1h ago

Seems like this might a wrong assumption (or CF changed something). Just tested one of my own sites that's on the free plan and it has "sni=plaintext".

rapawel•1h ago

There are occasional false positives, but querying different Cloudflare data centers usually resolves this. I've found that switching VPN servers (which routes through different CF edge locations) eventually gives the correct result.

wordglyph•1h ago

My site https://wordglyph.xyz came back undetermined

rapawel•1h ago

The tool only detects a subset of paid Cloudflare users - specifically those with the default ECH settings. If your site shows as undetermined, it likely means you're on a free plan or a paid plan with ECH enabled.

From what I've observed:

- Free plans: ECH is forcefully enabled (sni=encrypted)

- Paid plans: ECH is disabled by default (sni=plaintext), but can be manually enabled

The tool can only definitively distinguish between free plans and paid plans that use the default ECH settings.

After 10 years of black hole science, Stephen Hawking is proven right

The future is open: Answering the most common tech writing worries

3 Fatal overdoses in L.A. County linked to synthetic supplement

Oregon mass layoffs approach Great Recession levels

The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs

Rule 30 (1d) cellular automata feeding into Conway's Game of Life (2d)

I built a fitness app via spec coding with Kiro

External Secrets Operator resumes releases

The Scientific Virtues

World emissions hit record high, but the EU leads trend reversal

Rock discovery contains 'clearest sign' yet of ancient life on Mars, NASA says

Can an Amazon AI voice guide you better than customer product reviews?

Elastic Projections

2027: Race to AGI Game

Camneerg: The Mac Plus Web Server

Russian 'YouTube' hides western movies on its front page

Wu Ming

Gleam is my new obsession

When Dementia Steals the Imagination of a Children's Book Writer

Bluetooth 8-Track Adapters Are a Thing (2022)

New AI hype "Our language models are so 'conscious' we need to give them rights"

Interactive Latent Flow Visualisation for Any LLM

Tailscale Systray for Linux

Study finds alarming levels of PFAS in blood of those living near USAF base

Software Agents work. But only if you do

House Just Passed a Bill Punishing "Politically Motivated" Boycotts of Israel

Lost $300 due to an API key leak from "vibe coding" – Learn from my mistake

Apache HertzBeat Graduates as an Apache Top-Level Project

The Master System Girl: A Console with Cooties?

Show HN: Mirenku – local/offline anime tracker

Show HN: Detect paid Cloudflare plans on any website via ECH

Comments

After 10 years of black hole science, Stephen Hawking is proven right

The future is open: Answering the most common tech writing worries

3 Fatal overdoses in L.A. County linked to synthetic supplement

Oregon mass layoffs approach Great Recession levels

The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs

Rule 30 (1d) cellular automata feeding into Conway's Game of Life (2d)

I built a fitness app via spec coding with Kiro

External Secrets Operator resumes releases

The Scientific Virtues

World emissions hit record high, but the EU leads trend reversal

Rock discovery contains 'clearest sign' yet of ancient life on Mars, NASA says

Can an Amazon AI voice guide you better than customer product reviews?

Elastic Projections

2027: Race to AGI Game

Camneerg: The Mac Plus Web Server

Russian 'YouTube' hides western movies on its front page

Wu Ming

Gleam is my new obsession

When Dementia Steals the Imagination of a Children's Book Writer

Bluetooth 8-Track Adapters Are a Thing (2022)

New AI hype "Our language models are so 'conscious' we need to give them rights"

Interactive Latent Flow Visualisation for Any LLM

Tailscale Systray for Linux

Study finds alarming levels of PFAS in blood of those living near USAF base

Software Agents work. But only if you do

House Just Passed a Bill Punishing "Politically Motivated" Boycotts of Israel

Lost $300 due to an API key leak from "vibe coding" – Learn from my mistake

Apache HertzBeat Graduates as an Apache Top-Level Project

The Master System Girl: A Console with Cooties?

Show HN: Mirenku – local/offline anime tracker