Origin bypass occurs when a client or attacker can connect directly to a backend server, or origin, instead of sending requests through a protective proxy such as a web application firewall (WAF). This can happen if the origin’s IP address is exposed or direct access is not restricted.
It matters because proxy rules can only filter traffic that passes through them. Attackers may use a direct route to avoid WAF inspection, so an edge block does not prove the origin is protected. Defenders should restrict origin access to trusted proxy addresses, avoid exposing origin details, and verify that public services cannot be reached through alternate routes. These measures complement—not replace—patching vulnerable software.