Guide
How to report a website to Cloudflare
By Josh Pigford, founder of Knockoff
Cloudflare can't remove a site it only sits in front of. Its abuse form passes your notice to the site's owner and host, and the reply we got named that host and its abuse address. File the report so it doesn't bounce, then send the host the same notice. That second notice is what can take the copy down.
- 1. Check whether the copy is a Shopify store. If it is, Shopify is the host.
- 2. File notice one on Cloudflare's abuse form, on the right report type.
- 3. Read the reply for the host's name and abuse address.
- 4. Send notice two to that host.
Check first whether the copy is a Shopify store
When a site copied your store, it's easy to see Cloudflare in the headers and head straight for its form. Look once more first. Shopify serves its storefronts through Cloudflare too. Its developer docs say Shopify gives merchants "a world-class content delivery network (CDN) backed by Cloudflare." So a copycat Shopify store answers with the same headers as any site behind Cloudflare. Its host is Shopify, and Shopify's report form is where it goes.
A DNS lookup shows a domain's nameservers, its CNAME and the address it resolves to. Your browser's developer tools show the response headers on the Network tab. Here's what each signal proves:
- Nameservers ending in ns.cloudflare.com. Cloudflare runs the domain's DNS. That's all they prove.
- An address inside Cloudflare's ranges. If the IP falls in the ranges on Cloudflare's published IP list, the site runs through Cloudflare. This is the real test.
- The "server: cloudflare" and "cf-ray" headers. Shopify stores send these too, so they don't rule Shopify out.
- A CNAME to shops.myshopify.com, an address in 23.227.38.0/24, or a "powered-by: Shopify" header. It's a Shopify store.
If it's a Shopify store, stop here. Reporting a Shopify store walks through which form to pick and what happens after. Anything else goes to Cloudflare.
You file the same report whether Cloudflare hosts the site or only proxies it, and Cloudflare works out which.
If Cloudflare does host it, on Pages, Workers, Workers KV, Stream or Images, it removes the content or disables access under its DMCA process. If the site's owner answers with a counter-notice, Cloudflare shares it with you and gives you 10 days to respond. Show in that window that you've filed a lawsuit, or access comes back. Most reports are about the other case. Cloudflare says "the vast majority" of the abuse reports it receives are about sites using its pass-through security and CDN services, and "we cannot remove content from the Internet that we do not host." For those, the rest of this page is your route.
The Shopify check comes first. Every other copy gets two notices: one on Cloudflare's abuse form, and one to the host the reply names.
Notice one: fill in Cloudflare's abuse form so it doesn't bounce
Cloudflare takes reports on its abuse form. Pick the report type first, because each type has its own boxes. For a copied store, three of them matter.
- Copyright Infringement & DMCA Violations. For your product photos and your product copy. This is the type for a store running your pictures.
- Trademark Infringement. Only if you hold a registration. The form says "A federal or international trademark registration number is required," and Cloudflare "only acknowledges abuse reports from trademark holders or their legally authorized representatives." With no registration, use the copyright type. Getting copies taken down without a trademark covers why your photos carry the claim on their own, and copyright vs trademark explains the split.
- Phishing & Malware. Only when the site really is phishing. Cloudflare puts a warning page in front of a site once it confirms phishing, and that can tempt people to relabel a copied store. Don't. It's a misstatement on a report with your name on it.
If the problem is the domain name itself, say a name built on your brand, this form isn't the route. Cloudflare says to direct trademark complaints about a domain name to the domain's registrant (whoever registered it) through the WHOIS lookup, and it follows ICANN's Uniform Domain-Name Dispute Resolution Policy (UDRP) for those disputes.
The copyright type is a full DMCA notice. Cloudflare says "we only process reports that include all information required by section 512(c) of the DMCA", so a report with a gap in it goes nowhere. These are the boxes that get a report bounced or put your details in front of the copycat:
| Box on the form | What to put in it |
|---|---|
| "Your full name" and "Copyright holder's full name"Copyright type | The person filing goes first. The owner of the photos goes second, usually your company. If someone files for you, their name goes first and yours second. The trademark type asks only for your name |
| "Title"Copyright and trademark types | "Authorized agent" when someone files for you. It's optional, and it says why the filer isn't the owner |
| "Telephone"Copyright type | Digits only. When we filed, the box refused a formatted number |
| "Infringing URLs"Copyright and trademark types | Pages on one hostname only. A copy on a second hostname is a second report. The copyright type takes up to 250 URLs at a time |
| "Describe the original work"Copyright type | Links to your originals: the product pages and photo files the copies came from |
| "Registration number" and "Registration office"Trademark type | A federal or international registration number, and the agency you registered the mark with. Required |
| "Logs or other evidence of abuse"Trademark type | Required. Screenshots or links that show the site using your mark |
| The "I understand and agree" checkboxCopyright type | Your good-faith statement, and your statement under penalty of perjury that you're authorized to act for the owner. Under 17 U.S.C. 512(f), knowingly and materially misstating that something infringes makes you liable for damages |
| "Digital signature"Copyright type | Your full name, typed |
Fill the form as if the copycat will read it, because they can. On both of those types, the boxes "Please forward my report to the website hosting provider" and "Please forward my report to the website owner" come ticked and can't be unticked. Most of the contact boxes, the URLs and your description of the work carry the note "This field may be released by Cloudflare to third parties such as the Lumen Database," a public archive of takedown notices. And for some Cloudflare customers with their own abuse programs, the form says reports can go to them directly and in full, including reporter contact information, comments and supporting evidence, "without redaction or preprocessing by Cloudflare." So use a business contact block: the company's name, a business email, a business phone and a business address.
The wording itself is the same as any DMCA notice. The free DMCA takedown notice generator writes the work description and the statements. Save what it gives you, because you'll reuse it for notice two.
What Cloudflare's reply tells you
For a site it doesn't host, Cloudflare's stated approach is to forward your complaint to the website operator and the hosting provider, give the host the site's origin IP (the address of the real server behind Cloudflare), and, "depending on the nature of your complaint, respond to you with additional details so that you can follow up as necessary."
When we filed a copyright report, the reply was an automated email titled "Response to your DMCA copyright infringement complaint." Here's the part that mattered. The host's name and address each sat on a line of their own:
"The host for the reported domain is:"
[the hosting company's name]
[its abuse email address]
"You may use this information to follow up directly with the hosting provider."
Cloudflare's reply to one of our copyright reports, with the host left out.
Take two things from it: who the host is, and its abuse address. Keep the email with your report.
Cloudflare's policy only promises "additional details," so not every reply will name a host. If yours doesn't, go straight to the registrar and the other routes below.
Don't spend your effort arguing with Cloudflare. A 2021 district court ruling granted Cloudflare summary judgment on a claim that it helped copyright infringement along (the legal term is contributory infringement) by serving sites that sold knock-off wedding dresses with the dressmakers' own photos. The judge wrote that "simply providing services to a copyright infringer does not qualify as a 'material contribution.'" The same order records both sides agreeing that Cloudflare tells a copyright complainant who the host is.
Notice two: send the same notice to the host
The host runs the servers the site lives on, and it can take the pages down. Send it the same notice you gave Cloudflare: the same page addresses, the same links to your originals, the same statements and the same signature. Use the abuse address from Cloudflare's reply, or the host's own abuse or copyright form if it publishes one. Open with one line saying Cloudflare's reply named them as the host for the domain.
Cloudflare says it forwards your complaint to the host already. Send yours anyway. It's addressed to the host, it comes from you, and it's the one you can follow up on when nothing happens.
Three more routes run alongside it:
- The registrar, in parallel. Its abuse contact is the right one when the whole domain exists to pose as you, rather than one page being copied. If the WHOIS record shows Cloudflare as the registrar, use the form's registrar type or registrar-abuse@cloudflare.com.
- The payment provider, when the host goes quiet. If the clone takes card payments, tell the processor that customers paid and got nothing, when that's what's happening.
- The search index. Ask Google to drop the copied pages from its results, so shoppers searching your name stop landing on them while the host decides.
What to do when someone copies your website covers each of those in full, along with the evidence to save before you send anything.
One of our filings, notice by notice
Here's how one of our own filings went, with the names left out. A copycat site was using a brand's product photos.
- 1. The first notice went to a big cloud provider. It answered by pointing us to Cloudflare.
- 2. We filed the copyright type with Cloudflare, from a business contact block.
- 3. Cloudflare's reply named the host. It was a different company again, with its abuse address on the next line.
- 4. The next notice goes to that host by email. Same notice, addressed to them.
A filing a few days earlier shows why the first notice can miss. That copycat ran on a hosted store builder other than Shopify, behind Cloudflare, and its product photos loaded from a cloud provider's content network. Our notice went to the photos' host. It took the notice, then wrote back that the site wasn't running on its servers and pointed us to Cloudflare.
Two lessons came out of them. The server that holds the photos isn't always the one that serves the page, so check where the page itself resolves before the first notice goes out. And file every route that opens up. A host that only turns up in Cloudflare's reply, late in the chain, is still a host nobody has sent a notice to yet.
Running that chain is the job Knockoff does for Shopify brands. We search the open web every day for your product photos, confirm each copy against your own, and file the takedown with Shopify, the web host or the domain registrar as your authorized agent, under one letter you sign once. When a reply points somewhere else, the next notice goes there.
Quick questions about Cloudflare reports
Can I email Cloudflare's abuse team? +
No. Cloudflare says it's generally unable to process complaints sent by email, and an email will likely get an automated reply pointing you back to the form.
Can one report cover my photos and my brand name? +
No. Copyright and trademark are separate report types with their own boxes. A copy that uses your photos and your registered name gets one report of each.
