In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practic

In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.