The point of getting behind a WAF is not only to filter attacks. The real gain is that the attacker does not know where to attack. If your origin IP is known, an attacker skips the WAF entirely and goes straight at your server, and the whole protection layer becomes meaningless.
The bad news: origin IPs usually leak not because of the WAF but because of everything around it.
1. DNS history
Even if you change your A record today, services that archive historical records keep the old value. For an attacker that is one query away.
What to do: after moving behind the WAF, change your origin server's IP address. Get a new one from your provider. That is the only method that makes historical records useless in a single move.
2. Subdomains
Pointing the apex domain is easy. These are the ones that get forgotten:
direct.example.com A 203.0.113.10 <-- origin
cpanel.example.com A 203.0.113.10 <-- origin
test.example.com A 203.0.113.10 <-- origin
old.example.com A 203.0.113.10 <-- originAttackers enumerate subdomains automatically; trying a few hundred common names takes seconds.
3. Mail records
MX, SPF and DKIM records very often point at the origin, because mail typically runs on the same machine. An ip4: entry in an SPF record publishes the origin address in plain text.
What to do: move mail to a separate host or a mail service. If it has to stay on the same machine, use a separate IP for outbound mail.
4. Certificate transparency logs
Every certificate authority, Let's Encrypt included, writes issued certificates to public logs. Those logs contain domain names, not IPs — but a subdomain you forgot shows up there, and that subdomain's A record then hands over the origin.
What to do: check transparency logs for your own domain regularly. If you see a subdomain you did not expect, clean up that record.
5. The origin itself
The final step: your origin should only accept traffic coming from the WAF. In its firewall, open ports 80 and 443 only to the HexShield server's address. With that in place, an attacker who knows the origin IP still cannot connect.
# on the origin server (ufw example)
ufw default deny incoming
ufw allow from <HexShield server IP> to any port 80,443 proto tcp
ufw allow 22/tcp # your own management access
ufw enableSaying "I'm behind a WAF" without doing these five things is like locking the door and leaving the key in front of it.