Using Cloudflare Under Attack mode during a web attack

Confirm traffic is proxied through Cloudflare and collect evidence from security events and origin load. Keep an authorised administrator session and a communication channel available. Identify essential webhooks, APIs and checkout workflows before applying broad challenges.

1. Open the zone’s Overview and use the Under Attack Mode quick action where available, or the current equivalent security control.
2. If the incident is limited to certain paths, consider a supported configuration rule that applies the setting only to those requests.
3. Monitor security events, origin health and legitimate user access after enabling it. Check a normal browser session and essential nonbrowser integrations separately.
4. Investigate the underlying attack pattern and apply durable, appropriately scoped security controls where needed.
5. Disable the temporary mode once the incident has subsided and verify normal access again. Record the timing and effect for future response.

Origin pressure should improve without unacceptable disruption to necessary users and services. A challenge page appearing does not by itself prove the attack is contained.

If APIs or payment callbacks fail, avoid asking them to solve a browser challenge. Refine the scope using supported rules and trusted authentication, rather than broadly allowing all requests. Under Attack mode does not replace origin patching, application security or provider assistance for nonweb attacks.

• Using Cloudflare’s current security controls instead of old security levels
• Adjusting Cloudflare Challenge Passage
• Checking whether Cloudflare is active for a hostname
• Adding Cloudflare Turnstile with mandatory server-side verification

• Cloudflare documentation