When your site is flooded with traffic

A flood is far more automated requests than real visitors ever send — hundreds or thousands a second, often from many addresses at once. Left alone it slows your site and every other site on the same server, so we watch every site's traffic every two minutes and act on our own.

What we do

When a site takes a flood for two checks in a row, or it is overloading its server, we switch on a visitor check at our servers: anyone who is not on your trusted list is asked to pass a quick browser check before the site opens. Real visitors pass it in a moment; automated floods do not. If your site is on its own Cloudflare zone, we also switch on Cloudflare's Under Attack mode, which stops most of the flood before it reaches us.

You get an e-mail and a notice on the site's page saying so. The site's Security section shows the protection, the peak rate and when it can lift.

Under Attack stays on until the flood stops

While we hold a site under attack you cannot lower its Cloudflare security level from the dashboard or the API — the CDN tab says so and shows the earliest time it can lift. We check it on every pass: if it is switched off anywhere else, we switch it back on, and if that keeps happening we e-mail you once to explain why it must stay on. Floods that come back the moment Under Attack goes off are exactly what this prevents.

It lifts by itself

Once the traffic has been back to normal for a few checks, and the hold has passed, we switch everything back to how it was — including your own Cloudflare security level. The hold starts again every time the flood is still arriving, and a site that is flooded again soon after is held for longer each time, up to a day.

What you can do

Usually nothing. If you expect a big burst of real traffic — a launch, a sale — add the addresses you trust in the site's Security → Firewall settings, and reply to our e-mail if you think a protection is wrong.