One Referer does not fit every source.
Some origins require a known site Referer, some reject it, and others depend on a browser-like request profile.
Business Proxy add-onPrivate beta
Many remote sources. One reliable image pipeline.
Smart Image Gateway sits in front of your WebP Cloud Proxy and turns unpredictable third-party image URLs into a secure, observable source for optimization and delivery.
Included at no additional add-on fee for qualifying Business Proxy deployments. Proxy usage remains metered under the agreed plan. Source names are compatibility examples and do not imply affiliation.
Unified Proxy output
images.customer.commanaged CDN · your CDN · directSource policy engineSmart Image Gatewayverify · normalize · fetch · recover
Xiaohongshu*.xhscdn.com
SSPAIcdnfile.sspai.com
Pixivi.pximg.net
Weibo*.sinaimg.cn
Instagram*.cdninstagram.com
Generic HTTPpublic image URL
Attached toOne Business Proxy
Add-on feeIncluded when qualified
Metered atThe Proxy delivery layer
Remote images are different
A normal origin is yours. These origins are not.
A fixed bucket or website usually has one cache policy and one authentication model. Feed readers, communities, AI products, and publishing tools can encounter millions of URLs across sources with conflicting behavior.
A different URL is not always a different image.
Tracking parameters and reordered queries can multiply cache keys, while signed source parameters must remain untouched.
Remote sources fail on their own schedule.
Timeouts, 429 responses, redirects, HTML error pages, and oversized files need bounded, source-aware recovery.
Who it is for
Products that render images they do not host.
Smart Image Gateway fits when the URL arrives inside someone else’s content. Your product is responsible for showing the picture. The same path also covers a community or CMS that embeds remote files in the pages it publishes.
FoloInoreaderNewsletter apps
Feed and newsletter readers
A reader such as Folo opens one article and meets images from the publisher, a CDN, and sometimes a tracker. The app still has to show the picture on its own HTTPS origin, send the Referer that source expects, and keep the subscriber’s address off that request.
WeiboXiaohongshuPixivInstagram
Social and community clients
Posts from Weibo, Xiaohongshu, Pixiv, and Instagram often answer only when the request looks like their own site. A client that embeds those pictures needs a separate source policy for each host.
Link previewsRead-it-laterAI readers
Previews and reading tools
Link unfurls, read-it-later apps, and AI products illustrate pages the user did not upload. Unique URLs dominate, so normalization and a stale fallback matter as much as the first successful fetch. A CMS that embeds remote images has the same shape.
Folo, Inoreader, and the source names above describe the shape of the workload. Mention does not imply affiliation, endorsement, or that the named product runs on this add-on.
How a product calls it
Change the address the browser requests.
Your renderer stays in place. The browser, or your server, asks for a URL you control. The Gateway fetches the remote file with the right policy, and the attached Proxy optimizes the response.
Example
The browser requests your Gateway.
Before the page reaches the browser, replace each remote src with a signed URL on smart-gateway-1.webp.se. The path after ,b64/ is the publisher URL in standard base64. The original address also stays on the element as data-original-src.
referrerpolicy="no-referrer" keeps the reader page from being sent as the Referer. The Gateway applies the source policy when it fetches.
smart-gateway-1.webp.se is an example hostname. A deployment uses the hostname, signature, and parameters agreed for your Business Proxy.
<img src="https://smart-gateway-1.webp.se/example-signature,b64/aHR0cHM6Ly93ZWJwLnNlLzEtMS5wbmc=" alt="1-1.png" data-original-src="https://webp.se/1-1.png" referrerpolicy="no-referrer" >
- Base64 payload
- aHR0cHM6Ly93ZWJwLnNlLzEtMS5wbmc=
- Decodes to
- https://webp.se/1-1.png
Rewrite the markup
When you render the article, replace each remote src with a signed URL on your domain. Keep the publisher address on data-original-src, and set referrerpolicy="no-referrer" so the reader page is not the Referer the origin sees.
Pass the URL as a query
Point the image at one endpoint and append the remote address, plus the width you want. Folo’s public client does this for hosts that require a Referer, including Weibo, Pixiv, SSPAI, Instagram, and Xiaohongshu. Size and format stay Proxy settings.
Fetch from your server
Request the image while you build a preview, digest, or notification. Web, mobile, and email then share your URL, and the origin sees the fetch from your backend.
One managed request path
Gateway intelligence before Proxy optimization.
The Gateway solves remote-origin behavior. The attached WebP Cloud Proxy remains the product boundary for transformations, cache, quota, domain, and delivery.
- 01
Remote URL
One of many source domains enters an authenticated workload.
- 02
Smart Gateway
Verify, normalize, fetch, retry, validate, and observe.
- 03
WebP Cloud Proxy
Resize, convert, watermark, cache, and account for usage.
- 04
Delivery
Use managed delivery, place your CDN in front, or read directly.
What the add-on contributes
The source layer that a generic image URL cannot express.
Source-aware requests
Apply the right Referer, User-Agent, query handling, and egress policy for each source instead of forcing every origin through one generic fetch rule.
Safe URL handling
Signed requests, protocol restrictions, private-network blocking, redirect checks, and image validation keep a flexible remote fetcher from becoming an open proxy.
Stable cache identity
Normalize equivalent URLs and collapse tracking variants before they fragment cache space or create unnecessary origin work.
Recovery built in
Coalesce concurrent misses, retry transient failures, open per-source circuit breakers, and serve stale or fallback responses when an origin becomes unreliable.
Bring your own egress
Route source fetches through an agreed HTTP or SOCKS proxy when a workload needs customer-controlled IP reputation, geography, or network policy.
Operational visibility
Measure latency, bytes, cache outcomes, source health, and circuit state so a broken upstream does not look like an unexplained image failure.
Keep the Proxy, choose the edge
Managed delivery is the default. Your CDN can still sit in front.
Smart Image Gateway remains attached to WebP Cloud Proxy in every mode. What changes is who owns the final cache and delivery path.
WebP Cloud managed delivery
One managed path for source policy, transformation, cache, custom domain, and image delivery.
Gateway → Proxy → WebP Cloud deliveryBring your own CDN
Keep the Gateway and Proxy as a controlled image origin while your CDN handles the final visitor-facing cache.
Gateway → Proxy → Your CDNDirect Proxy output
Read from the authenticated Proxy without another downstream CDN for previews, back-office, or low-volume clients.
Gateway → Proxy → ApplicationModeled high-cardinality workload
When almost every request is a new origin, the billing model matters.
This rounded example is based on historical production traffic from a feed-style workload. It is an illustration, not a named customer invoice.
≈12Mimage requests / month
≈5Munique source paths
≈0.75 TBmonthly output
<25%repeat cache hits
About $2.5k / month
At one unique transformation per source path, using Cloudflare Images' public price of $0.50 per 1,000 after the first 5,000. More variants can raise the count; URL normalization can lower it.
Check Cloudflare's current pricingGateway included. Proxy usage metered.
Source policy and recovery are provisioned with the qualifying Business Proxy. The quote is driven by Proxy request volume, cache, regions, and support—not a second retail product.
Model your workload with usEstimates compare billing shapes, not feature-identical products. Cloudflare, Cloudflare Images, and related marks belong to their respective owners; compatibility or comparison does not imply affiliation.
Commercial model for the private beta
No separate Gateway SKU—for now.
We attach Smart Image Gateway to a qualifying Business Proxy when a workload genuinely needs multi-source remote fetching. That keeps one technical owner, one request path, and one metered delivery agreement.
- Gateway add-on
- $0 for qualifying deployments
- Requests and delivery
- Consumed by the attached Business Proxy
- Custom source work
- Scoped when a private adapter or egress setup is required
Questions, answered
Before you put remote URLs into production.
The private beta is intentionally scoped around high-volume Business Proxy workloads, not an unrestricted public endpoint.
Can I buy Smart Image Gateway on its own?
Not currently. It is provisioned as an add-on for selected WebP Cloud Business Proxy deployments, so every image still passes through an authenticated Proxy before delivery.
Does the Gateway resize or convert images?
No. The Gateway deliberately stays byte-oriented: it fetches and validates the remote source. Your WebP Cloud Proxy performs resize, format selection, quality changes, watermarking, and cache-first delivery.
Can we keep our current CDN?
Yes, by arrangement. Your CDN can use the WebP Cloud Proxy as its authenticated image origin. The Gateway remains behind the Proxy, so source policy and transformation behavior stay consistent.
Is this a public URL proxy?
No. Hosted deployments use signed access, source policy, network safeguards, and workload limits. A qualifying customer can allow multiple remote sources without exposing an unrestricted public fetch endpoint.
Which sources are supported?
The private beta starts with generic public images and a monitored set of source-specific policies. Additional sources are evaluated from real customer workloads and may require a custom adapter scope.
How is it billed?
Qualifying Business customers do not pay a separate Gateway add-on fee. Requests still pass through the attached WebP Cloud Proxy and consume the request quota, cache, regions, and support capacity agreed in the Business plan.
Private beta · Business Proxy add-on
Show us the sources your current image pipeline struggles with.
Share a representative URL set, monthly request volume, cache behavior, and delivery topology. We will tell you whether Smart Image Gateway is a fit before proposing a deployment.