What a CDN does when a copyright notice names your site

Behind a proxy is the most common answer people give when asked what protects their site, and it is the one that survives contact with a complaint least well. A content delivery network changes who can see the address of your server. It does not change who decides what happens to what is on it, and the published complaint process is built to make sure that decision reaches the right desk quickly.

What a proxy is, structurally

Cloudflare and every network shaped like it sit in front of an origin you rent from somebody else. They cache what you let them cache, filter what you ask them to filter, and pass the rest through. What they do not do is hold your disk. Nothing you publish lives on their hardware unless you put it there deliberately, and that one fact governs everything below.

What happens to a copyright complaint

Somebody who wants your material gone looks the site up and finds the network in front of you, because that is what a lookup returns. So the report goes to the proxy. From there the sequence is public and the same every time.

1. 01The report is filedIt goes through a published abuse form, not an email, and it has to name a specific location — a URL, not a server.
2. 02The network checks what it holdsFor a proxied site the answer is nothing. A network that does not host the material cannot remove it, and says so.
3. 03The complaint is forwardedIt goes to two places: the operator of the website, and the hosting provider behind it. Neither has to discover it later.
4. 04The complainant is redirectedThey are given the identity of the hosting provider and told to take it up there. That is the designed output of the exercise, not a side effect.

Read the last step again, because it is the one that matters to you. The complaint is not absorbed and it does not stop. It gets addressed, routed and delivered to the only party that can act on it: your host.

The parts that surprise people

• The complainant learns who your host is. Not through a leak, not through a misconfiguration, and not because somebody was careless — telling them is the stated purpose of the process.
• The complaint reaches your host with a location already attached, so nobody upstream has to go looking for it.
• By default the name and contact details of whoever filed it travel with the complaint, to you and to your host. A few report categories may be filed anonymously; copyright is not among them.
• None of this depends on the proxy being set up badly. A correctly configured proxy behaves exactly this way, which is why tightening the configuration changes nothing.

Where the network does decide

The picture inverts the moment the material actually sits on their hardware. Pages, Workers, R2, Stream and Images are hosting products, and for those the network is the host: it runs the notice-and-takedown process in section 512, disables what a valid notice names, and restores it only if you file a counter notice and the sender declines to sue. Same company, opposite posture, decided by who holds the bytes.

A registrar is the same story with a different switch. Register the domain with the company that also proxies it and one organisation holds two independent levers over the same site, while the registry behind your domain is the one nobody thinks about until it is thrown.

What a proxy is genuinely worth

None of this is an argument against using one. Keeping the origin address away from opportunistic scanning, absorbing a volumetric attack on a network far larger than anything you could rent, serving cached bytes from a city near your reader — all of that is worth having. We recommend the pattern ourselves and have written down how to build it, including the four ways the origin ends up exposed anyway.

What the pattern buys is operational: shorter outages, a higher cost of finding you, and a public face you can replace in five minutes without touching your data. What it does not buy is a different answer to a letter.

The variable that is left

Take the network layer out of the question and one thing decides the outcome: what the company holding the metal is obliged to do, in the country the metal sits in. That is not a setting you can toggle afterwards. It is chosen once, on the day you pick where to deploy, and the jurisdiction settles it rather than the brochure.

A host in the United States forwards the notice and starts a clock because the statute pays it to. A host in Chișinău has no such bargain on offer and nothing to forfeit by declining, which is the entire mechanism in one sentence. The proxy in front of either one is the same software.

So none of this is a complaint about Cloudflare, which behaves correctly for the thing it is. A conduit that forwards is a conduit doing its job. The mistake sits at the other end of the wire: a content delivery network is a performance product, and people keep buying it as a jurisdiction. Only one of those decides what happens on the day.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.