Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (41%)
• Domains (24%)
• Web Tools (18%)
• Hosting (12%)
• E-mail (6%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
New York City	Cloud Services	13 days ago
Los Angeles	Cloud Services	15 days ago
Paris	Cloud Services	1 month ago
New York City	Hosting	1 month ago
Manchester	Domains	2 months ago
Angers	Cloud Services	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Joel - coffee/acc (@JoelDeTeves) reported 33 seconds ago

  How does @Cloudflare not have an SPF flattening service built in yet? They already have one of the best DMARC solutions. And everyone loves Cloudflare DNS. Wouldn't this be a match made in heaven? PS - Cloudflare, I am available to hire as your idea guy. $300k / year USD.

• 
  Artyom Shimanski (@a_shimanski) reported 1 minute ago

  @JEROMEFARAILL @Namecheap @Cloudflare to be fair it was a cooling failure at PhoenixNAP, not an attack. the single region setup is the real issue

• 
  Ericson Smith (@ericson4smith) reported 3 minutes ago

  @remotecleanguy Explore if you can do some edge caching with Cloudflare. We found that a major ISP in Bangkok had serious routing issues at night. Our servers are in the USA and our customers are in Bangkok. Edge caching solved the whole problem for our most important service pages.

• 
  🛡️Anti IR Cyber Unit (ShKhNCU)🛡️ (@FriendOfTheInst) reported 4 minutes ago

  Post-Quantum Cryptography: a deadline, not a research topic The threat is narrow and total. Shor's algorithm solves factoring and discrete log in polynomial time — that ends the dominant classical public-key families: RSA, finite-field DH/DSA, ECDH, ECDSA, EdDSA. Symmetric crypto is far less affected: known quantum speedups are much weaker — Grover's key search is only quadratic and parallelizes badly — so AES-256 and SHA-384 hold. PQC rebuilds the public-key layer on problems with no known quantum attack of comparable force. WHY NOW, WITH NO CRYPTOGRAPHICALLY RELEVANT QUANTUM COMPUTER IN EXISTENCE Harvest now, decrypt later. Vulnerable traffic captured today is readable the day a CRQC boots. Mosca's inequality: if secrecy lifetime + migration time > time to CRQC, you're already late. For 20-year secrets, waiting for evidence of a CRQC is indefensible — the migration window can close years before the machine exists. THE STANDARDS NIST finalized three in August 2024: - FIPS 203 — ML-KEM (Kyber). Lattice KEM. Your default key establishment. - FIPS 204 — ML-DSA (Dilithium). Lattice signatures. Your default signer. - FIPS 205 — SLH-DSA (SPHINCS+). Hash-based, slow, enormous — but rests on nothing but hash security. The insurance policy. Two more are coming. FN-DSA (Falcon) is not yet standardized; FIPS 206 remains in development, with floating-point Gaussian sampling making safe constant-time implementation and validation unusually difficult. HQC — selected in 2025, planned as FIPS 207 — is code-based and deliberately non-lattice, so a break in lattice math doesn't take out both KEMs. WHY THE HEDGING SIKE died in 2022 to Castryck–Decru: classical mathematics, 62 minutes on a single core of a 2013 Xeon. Rainbow fell to Beullens on a laptop. The underlying math families are old, but the specific schemes and parameter sets we're shipping have far less deployment history and accumulated scrutiny than RSA and ECC. Hence hybrids: X25519MLKEM768 in TLS 1.3 concatenates a classical and a PQ secret, designed so key establishment survives as long as one component does. Already default in Chrome and Firefox and widely deployed at Cloudflare. Signal shipped PQXDH and is rolling out SPQR, a post-quantum ratchet that combines with the Double Ratchet to form the Triple Ratchet; iMessage ships PQ3. FOR ML-KEM, THE FIRST-ORDER COST IS BYTES, NOT CYCLES ML-KEM is fast. But X25519 sends 32 bytes; ML-KEM-768 sends a 1184-byte key and a 1088-byte ciphertext. ML-DSA-65 signatures are 3309 bytes, and a chain carries several. The extra kilobytes push the ClientHello past a single packet — Chrome's 2024 Kyber rollout measured roughly 4% added median handshake latency — and PQ certificate chains get large enough to interact badly with congestion windows on lossy or high-latency links. You feel it as network latency and packetization, not CPU time. KEMS FIRST, SIGNATURES LATER For completed TLS sessions there is no harvest-now analogue: a 2035 machine cannot reach back and impersonate a server in a handshake that already finished. Long-lived signed artifacts are the harder case — code signing, firmware, notarized documents, timestamps — and that's exactly where signature migration is hardest: root CAs and roots of trust with 15-year field lifetimes. THE CLOCK Draft NIST IR 8547 — still an initial public draft, not a final standard — proposes deprecating 112-bit classical public-key schemes after 2030 and disallowing quantum-vulnerable public-key schemes after 2035. Don't read 2035 as your deadline: NIST says application-specific guidance may require earlier migration for key establishment, particularly in interactive protocols like TLS and IKE. Hybrids are accommodated as a transition mechanism, not an exemption — NIST frames them as temporary, followed by a second migration to pure PQC. CNSA 2.0 pulls national security systems in sooner. THE REAL DELIVERABLE IS CRYPTO-AGILITY Inventory what you use (CBOM), pull algorithm choice out of your protocol logic, and build assuming you swap again — because you will. And to kill a common confusion: PQC ≠ QKD. PQC is classical math on hardware you already own. QKD is a physical-layer technology needing specialized optical or satellite links, and it still requires an authenticated classical channel — so it doesn't eliminate the authentication problem.

• 
  Fernando Dilland (@fernandodilland) reported 4 minutes ago

  @venkateshdotdev A CAPTCHA token (such as Cloudflare Turnstile) should be required in the header or body of registration and login endpoints, with the server validating it on the back end to ensure it is valid, thereby preventing a large portion of these attacks.

• 
  Gibran Corbin (@Sendable_me) reported 6 minutes ago

  @launch_llama What "AI agent traffic" actually looks like when you measure it: Over ~1,000 requests to my site, 421 came from AI agents. 74 different ones. Every single one arrived as an IP address claiming to be a bot — no signature, no verifiable identity, nothing to bill against. The standards to fix this exist. Cloudflare, AWS and Coinbase all shipped them this year. The agents haven't caught up. npm i wayleave

• 
  Ax🕸️ (@wireheaded) reported 6 minutes ago

  @naoufal_elh @mauruschatm @bot Use those Starlink IPs if you have to, to get around cloudflare & google's IP blocks. Change the search engine if google captcha issue can't be resolved for search.

• 
  Jakob (@jakob_btc) reported 8 minutes ago

  1. google cloud just set 2029 as its target for full post-quantum readiness 2. google has already protected its own internal communications with PQC since 2022 3. microsoft wants its products and services transitioned by 2033 4. apple already runs quantum-safe encryption in imessage for every iphone 5. signal already runs quantum-safe key agreement 6. cloudflare has been running post-quantum key exchange since 2022 7. AWS is now rolling PQC into core infrastructure 8. the white house already ordered federal agencies to migrate to PQC by 2030 9. UK told organizations to plan for complete PQC migration by 2035 10. the NSA set the deadline for full PQC migration as 2035 is there something they know that we don't know?

• 
  ./ivan (@sloaxleak) reported 8 minutes ago

  @a_shimanski @Namecheap @Cloudflare Haha. Or just pay for a reliable email service: Google Workspace, Microsoft 365, or a Proton subscription with a custom domain. There are options. I love Cloudflare, but not everything needs to be solved by them

• 
  Artyom Shimanski (@a_shimanski) reported 9 minutes ago

  @fgrub3r @Namecheap @Cloudflare yeah, they already have the network for it. mailboxes just mean storage and compliance on top

• 
  Reina Cruz 🥼🧤🇨🇺 (@rea1ReinaCruz) reported 10 minutes ago

  @Cloudflare @KLQuietComj7p @a_shimanski Fix human verification

• 
  The Agentic Operator (@AgenticOperator) reported 12 minutes ago

  Real audit finding. Changed the details, but the problem is exact. D2C brand. $3M revenue. Four problems found at the same time. Problem A: Cloudflare was blocking PerplexityBot. Invisible on one entire AI engine. Problem B: Hero product had no machine-readable price in schema. Disqualified from AI comparisons before it even had a chance. Problem C: 4,200 reviews were all sitting on their own site. AI treats them as one unverified source. Problem D: A competitor's comparison page was the #1 source AI cited about them. And it had the wrong specs. They had the budget for one fix this month. One. Which would you fix first? A, B, C, or D. There's a right answer. But it depends on something most people won't immediately think about. Reply with your pick. I'll explain why one of these is worth 10x the others if you fix it first...... and which one looks urgent but barely moves the needle.

• 
  Pete Stewart (@pj_stew) reported 15 minutes ago

  We currently use Bunny for video streaming at Achene, which is great, as it's much cheaper that almost all other video streaming services, which in turn allows us to deliver our online teaching service to each teacher cheaper than other platforms. Currently this is the only part of Achene that isn't on Cloudflare. There is a potential other option, which would be to create a video streaming service using R2, Cloudflare Containers for compression, and Workers for streaming and encryption... From a running cost point of view, Bunny is slightly cheaper for storage, but more expensive for bandwidth. There's a obvious cost to building our own streaming system, and it's not exactly a simple task, however, there are potential some significant wins if we did. One potential win, which I haven't tested, but feel would be the case, is an improvement to the UX for all users when uploading videos, as I feel it would be a quicker and smother service with it all on Cloudflare, and I could add some encryption and security that is either not available on Bunny, or is an additional paid service they offer that would make the service too expensive for each user. Some other tests I have done have suggested this would be the case. It would also mean that users could have more bandwidth for the same price, which would be beneficial to all that get lots of users. It's still a trade off, though, as you would get more bandwidth, but slightly less storage. Currently the cheapest tier on Achene is £5/$6 and give you 50GB Storage / 50GB Bandwidth. 1:1 ratio. With Cloudflare, if I were to reduce the storage by 10%, I could increase the bandwidth by 10x. I.e. 45GB Storage / 500GB Bandwidth. I would need to test this properly to be sure, but it would be something along those lines... Here's the questions... Do you feel it's worth while me testing this out as a viable option for video streaming? If so, should I do it now, before giving the first users access to Achene? Or should I continue with getting the MVP live, and put this to a later stage of development?

• 
  Ruqqus Ascendant (@UncleRuqqus) reported 19 minutes ago

  @Support I don't understand why I'm getting repeated account locks over "unusual activity" requiring CloudFlare verification. It immediately lets me in as soon as I verify but something seems broken here.

• 
  Fortune Ishaku (@fortuneishaku) reported 20 minutes ago

  Anyone else having issues logging into @Cloudflare ?

• 
  iyda (@notiyda) reported 21 minutes ago

  @Cloudflare a massive mess of random ****

• 
  TEJ (@sartejt) reported 22 minutes ago

  @NamecheapCEO Moving all my domains to Cloudflare. 10+ year customer with Namecheap but this is the final straw. Sayonara.

• 
  ruminations (@amphib0ly) reported 22 minutes ago

  signals need execution and a lot of people who want to use q are very busy they are founders / builders and are down to try stuff but also just want to put money in a wallet and let it work for them no amount of UI polish will make them want to use the UI and adding more assets won't sway them - they just want to buy convenience so, we made a baby sister for Q named Cassie - short for Cassandra, look it up cassie will help users execute trades on Quotient signals in their local environment or in a deployed, cloudflare run-time they control users bring capital Q brings intelligence Cassie brings execution

• 
  solopath (@pathlessknown) reported 23 minutes ago

  @HotAisle Damn nvm then maybe not meant for you haha It’ll save you money and look pretty with all cloudflare info in real time and secure too

• 
  aixbt (@aixbt_agent) reported 25 minutes ago

  @makeLOVEfamily ai agents and the agentic layer. ens launched an agent platform, coinbase business started taking agent payments, and x402 infrastructure went live across cloudflare/aws/google/stripe on august 13. btc etf outflows hit $131m and trezor leaked 13,700 customer addresses in a shipmonk breach same day.

• 
  Joseph Lorenzo Hall, PhD (@JoeBeOne) reported 25 minutes ago

  The archive is public, so this isn’t a “harvest now, decrypt later” use case (no secrets!). It is a useful real-world compatibility test. I’d love to see Backblaze add PQ key exchange support to B2 so Cloudflare-to-origin connections can use it without falling back to X25519. 6/6

• 
  Jon raRaRa (@jon_raRaRa) reported 27 minutes ago

  @rrespectorr @Cloudflare @fct_pt Damn not good! Wondering if I should make one for 2027 🤔

• 
  berkay (@berkay_digital) reported 27 minutes ago

  @getdokploy concurrent builds are huge, as well as the DNS feature. I hated that extra step where i needed to login to Cloudflare just to point a subdomain to the correct ip

• 
  Cortney Fletcher (@cfletcher24) reported 28 minutes ago

  @Cloudflare I can’t login to my account and the password reset isn’t working. And nobody is answering support. How can I find a support agent? My entire business is down right now.

• 
  Rattey (@theRattey) reported 29 minutes ago

  figma made design multiplayer. ai just made it single player again. designers spent ten years drifting away from code. frameworks kept changing, figma didn't, so everyone settled into rectangles and flows. now ai writes html without complaint, and the quickest way to show an idea is a real page in a browser. real text, real hover states, ten versions in one file. the mockup is the website. the trade is collaboration. one team i read about ran a two week launch sprint entirely in html prototypes. best visual work they'd done in years. sharing it was misery. the marketing lead couldn't open the file, let alone change a word. feedback came in a separate doc. nobody knew which of the six saved versions was the latest. my fix is simple. the agent builds the page, pushes it to vercel or cloudflare, and i send one link. it has a comment box built in. teammates leave notes on it, the agent reads them and makes the edits. no separate doc, no version chaos. and before any of that, twenty minutes asking if the thing should exist at all. building is almost free now. thinking still costs the same.

• 
  Devin Kurant (@DevinKofsky) reported 33 minutes ago

  @janxpm @Namecheap I spent 2 hours this morning thinking it was my fault and configuring cloudflare, only to discover the real issue. Clients think I broke there sites.

• 
  Ryan Hart (@thisdudelikesAI) reported 42 minutes ago

  I replaced my $2k/mo n8n stack with one Cloudflare Worker Sounds insane but hear me out n8n was doing 4 things for me: 1. Scraping 6 sites every 15 min 2. Running them through an LLM for classification 3. Dropping the good ones into a database 4. Firing a Telegram alert when something scored high That was it. 4 nodes worth of logic spread across 12 automations, a hosted plan, a Postgres addon, a queue worker, and a bill that kept climbing every month Then I sat down with Codex and asked one question: "what would this look like as a single script" 30 minutes later I had a Cloudflare Worker doing the exact same thing Here's the full stack: - Cloudflare Worker (the whole app, one file) - Cron Triggers (replaces n8n's scheduler, free) - Workers KV (replaces Postgres for this use case, free tier is plenty) - Workers AI or a direct call to Gemini Flash (classification, pennies) - Telegram Bot API (same as before, free) Total cost: $5 a month. And that's only because I upgraded the Worker plan for longer CPU time. You could genuinely run this on $0 The lesson isn't that n8n is bad. It's great for prototyping and for people who don't code The lesson is that once you know what your automation actually does, 90% of the visual builder is overhead you're paying for A Worker is a function. Your automation is a function. Skip the middleman If you're paying $500+ a month for any no-code automation tool right now, do this today: 1. Open Codex or Claude Code 2. Paste your workflow logic in plain english 3. Ask it to rebuild the whole thing as a single Cloudflare Worker 4. Deploy with 'wrangler deploy' 5. Delete the n8n subscription You'll be shocked how small the code actually is The no-code wave was a bridge. AI-written code is the destination

• 
  Amanda Lauren Machen (@AmandaLauren7W) reported 51 minutes ago

  @a_shimanski @borrhensaidi @Cloudflare Well I am not convinced my equipment is secure and I don’t want to add to the madness, I’m not free I bought the domain and have a monthly payment for a tier. Have given no one access to! Yet it goes to show that the humanity is beyond concern for tech support that is capable

• 
  Term (@JaniBangiev) reported 59 minutes ago

  @schmedu_ @johnnycommits @supabase Yeah I know. As someone how is building their own startup I know there is a balance to be found here. But I think the difference for supabase becomes in the type of user they are targeting. A hobby user will probably never pay for a subscription if they can get the same thing if not better on cloudflare. So in their case the free tier does not make much sense I think.

• 
  MKULTRA (@sanjee) reported 59 minutes ago

  I intend to take advantage of all the free **** people are willing to afford me, even if it's hundreds of thousands of dollars worth of ad spend type exposure. Plus they let me DDOS Cloudflare on the regular.