Cloudflare status: hosting issues and outage reports
No problems detected
If you are having issues, please submit a report below.
Cloudflare is a company that provides DDoS mitigation, content delivery network (CDN) services, security and distributed DNS services. Cloudflare's services sit between the visitor and the Cloudflare user's hosting provider, acting as a reverse proxy for websites.
Problems in the last 24 hours
The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.
At the moment, we haven't detected any problems at Cloudflare. Are you experiencing issues or an outage? Leave a message in the comments section!
Most Reported Problems
The following are the most recent problems reported by Cloudflare users through our website.
- Cloud Services (39%)
- Domains (22%)
- Web Tools (22%)
- Hosting (11%)
- E-mail (6%)
Live Outage Map
The most recent Cloudflare outage reports came from the following cities:
| City | Problem Type | Report Time |
|---|---|---|
|
|
Cloud Services | 12 days ago |
|
|
Cloud Services | 13 days ago |
|
|
Cloud Services | 29 days ago |
|
|
Hosting | 1 month ago |
|
|
Domains | 2 months ago |
|
|
Cloud Services | 2 months ago |
Community Discussion
Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.
Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.
Cloudflare Issues Reports
Latest outage, problems and issue reports in social media:
-
ruminations (@amphib0ly) reportedsignals need execution and a lot of people who want to use q are very busy they are founders / builders and are down to try stuff but also just want to put money in a wallet and let it work for them no amount of UI polish will make them want to use the UI and adding more assets won't sway them - they just want to buy convenience so, we made a baby sister for Q named Cassie - short for Cassandra, look it up cassie will help users execute trades on Quotient signals in their local environment or in a deployed, cloudflare run-time they control users bring capital Q brings intelligence Cassie brings execution
-
R (@dnagabut) reportedCloudflare announced programmable wallets built for AI agents, with preset spending limits and merchant restrictions in the design. Nothing has shipped yet. Right now you can reserve a handle. Funded account wallets, virtual wallets and programmable agent spending are all due in the coming months. Read the feature list again, because it is a permission model, not a payments product. The moment you let an autonomous agent buy things, you inherit a problem crypto has been failing at in public for years. How do you grant a program the ability to spend without granting it the ability to spend everything? DeFi's answer was token approvals. The result is a very long list of drained wallets where nothing was hacked at all. Someone approved unlimited spending to a contract years ago and forgot. So Cloudflare's version is delegated authority with a cap and an allowlist, plus anomalous-spending alerts that escalate to a human. Sensible. Also the bare minimum. And these are stablecoin wallets settling over x402, so this isn't a payments industry learning from crypto's mistakes. It is crypto. The layer above it is still wide open. An agent that can be talked into a purchase by hidden text on a web page is still an agent that can be talked into a purchase. Caps limit the blast radius. An anomaly alert only fires once the spending already looks strange. Neither one touches the trigger. Follow @dnagabut if you like your tech news with the catch included.
-
Fast&Final (@FastFinalAlgo) reportedCloudflare added MCP detection at the network level today $Algo ๐ฎ
-
Adam Szaloczi | DataBard (@AdamSzaloczi) reported@a_shimanski @Namecheap @Cloudflare I never experienced any downtime. But the whole ecosystem is so bloated and the admin process is confusing.
-
Quentin (@QuentLaBrute) reportedSay what you want about vibe coding, four months ago I could not use a terminal and had never written software. Since then I have self-hosted n8n, run a VPS on Coolify, grown a websiteโs traffic by 500 percent with SEO work, built a nutrition tracker on Airtable, learned *** and Cloudflare properly, set up an Obsidian second brain, and I am now finishing my first iOS app. Probably rather unimpressive for most here, but for me none of that was reachable for someone with my background two years ago. What decides whether this compounds is whether you understand why the thing works. If you cannot explain the fix, you cannot repeat it, and you have handed over the only part that was ever yours. What is the first real thing you built this way that a course would never have got you to?
-
Laurent Perrier (@maybelaurent) reported@remotecleanguy Namecheap is not a serious company. Transfer domain to Cloudflare, ask Claude to rebuild your website with Astro and host on Cloudflare workers. Every provider has outages but at least if Cloudflare is down so is the rest of the internet
-
Card Trading Marketplace (@CTM_Market) reported@a_shimanski @Namecheap @Cloudflare Lol our business email has been down since 9 am
-
Artyom Shimanski (@a_shimanski) reported@TaskLemonWorks @Namecheap @Cloudflare thanks, the worst part is clients don't know why you went quiet
-
Alex Greenland (@ajrgd) reportedcloudflare could never
-
Bob Stolzberg (@BobStolzberg) reported$1 .app or .dev domain registration on @Cloudflare even with the FREE plan! WTF are you waiting for?! Best place to build.
-
Task Lemon (@TaskLemonWorks) reported@a_shimanski @Namecheap @Cloudflare Sorry to hear that, having a main business account. Being down is extremely frustrated and upsetting.
-
Marius du Preez (@mdp_sec) reportedFollowing on from yesterday A browser can reach a signup page, fill every field, solve the CAPTCHA, and still be useless if nobody can verify the account. That became obvious once I started letting AI handle more of my bug bounty workflow. Browser automation was only half the problem. The system also needed to create identities, receive email, follow verification links, collect OTPs, keep attacker and victim accounts separate, and fall back to real phone numbers when a target refused email verification. I did not want the AI logging into a normal inbox for every account. I wanted email to behave like another research API. I now run three catch-all domains. For each signup, the system creates a new address containing the target, purpose, and timestamp. Nothing needs to be provisioned first. The address exists because the domain accepts everything. That means one target can have separate addresses for attacker, victim, admin invitation, password reset, organization owner, or any other role I need to test. If I revisit the target later, I create another set rather than guessing which old account belongs to which research cycle. Mail for all three domains enters through Cloudflare Email Routing. A catch-all rule sends it to one Email Worker. The Worker reads the raw message, extracts useful fields such as recipient, sender, subject, body, and timestamp, then sends the result to my own receiver over an authenticated webhook. The receiver writes messages into one rolling store and exposes a separate authenticated read endpoint. The write secret and read key are different, so the component accepting mail does not automatically get permission to read it back. The important rule is that AI never asks for the entire inbox. It queries the exact address it created for that test. This turns an otherwise messy shared catch-all into a deterministic part of the run. If the system registered target-attacker-1740000000 on one domain, it polls only for that recipient. An unrelated OTP arriving at the same time cannot be mistaken for the current account. When a message arrives, the AI does not need a visual mail client. It reads the stored RFC822 message, finds the verification URL or newest numeric code, and continues the browser flow. The same path handles account confirmation, magic links, password resets, invitations, change-email confirmations, and email OTP. Raw mail is preserved because the convenience body is not always enough. Real messages are multipart, HTML-heavy, encoded, or wrapped in tracking redirects. Keeping the original source means I can parse it properly when a simple body extraction misses something. I use email first whenever the product allows it. It is cheap, fast, unlimited for practical purposes, and easy to isolate. I can create five accounts for an authorization matrix without consuming phone numbers or waiting for manual inbox work. It also gives the AI a complete chain from signup request to verified session. SMS is the fallback, not the default. Some targets insist on a real mobile number. Others require one only after signup, or they gate a specific feature behind phone verification. In those cases the system can use physical Android devices with active SIMs, or rented non-VoIP US and UK numbers when geography matters. The trigger time is recorded before the code is requested. The system then reads only messages received after that point and extracts the newest matching OTP. This matters because SMS inboxes keep old codes, and blindly taking the first six-digit number is an easy way to lock an account or burn retries. Geography is part of the identity too. A US-only signup should not combine a US browser exit with an Australian phone number unless I am deliberately testing that mismatch. The browser pool already lets me choose a country-specific IP and timezone. The phone-number layer lets the account match that geography when the target enforces it. Email domains also have a fallback order. Some products reject an unfamiliar domain, block a domain after too many test accounts, or apply reputation rules inconsistently. If the primary domain fails, the system moves to the second, then the third. Every domain reaches the same backend, so nothing else in the workflow changes. This infrastructure becomes more useful after registration. Password-reset testing needs controlled access to both accounts and their mail. Invitation testing needs me to prove which address received which organization or role. Change-email testing needs visibility into notifications sent to old and new identities. Magic-link testing needs the original URL, its expiry behavior, and a second session where I can check replay or account binding. For evidence, I can render a real received message locally without loading remote images, scripts, forms, frames, or tracking resources. That gives me a clean screenshot for the report while keeping the evidence genuine. I am showing the message that arrived, not recreating it in a document. The full flow now looks like this. The AI chooses a browser profile and account role. It creates a unique address, registers the account, polls only for that recipient, extracts the link or OTP, verifies the account, and saves the resulting session with the correct role. If email is unavailable, it selects a real number that matches the required country, requests the SMS, reads the newest code, and continues. I only get involved when the product needs human judgment or a step cannot be automated safely. This is not an inbox replacement for its own sake. It is account infrastructure built for testing. The value is not receiving email. The value is letting every research run create traceable identities and reach authenticated product state without losing time to manual verification. #BugBounty #CyberSecurity #TogetherWeHitHarder
-
Reina Cruz ๐ฅผ๐งค๐จ๐บ (@rea1ReinaCruz) reported@Cloudflare @KLQuietComj7p @a_shimanski Fix human verification
-
orlie (@sunglassesface) reported@FreedomFries93 @joshmanders @PlanetScale Yeah, I used AWS in the past and honestly it wasn't that bad once you get past the setup. My point is not about comparing cloudflare to AWS. My point is the confusion in product offering within cloudflare itself
-
Jilles Soeters (@Jilles) reported@EmilioSchwaiger Not rude, totally fair. At the time of posting the message I saw it on my personal Cloudflare account (which happens to also be on the Cloudflare Paid plan) and just tweeted that excitingly. I should have done a little more due diligence. That's on me.
-
Mark (@peyoteheadlight) reportedcrazy how cloudflare warp fixes every isp based issue i have how did i only find out about this a few months ago
-
kyle (@rbxXlXi) reportedwtf since when did roblox start using cloudflare
-
Jรฉrรดme FARAILL (@JEROMEFARAILL) reported@a_shimanski @Namecheap @Cloudflare Namecheap is the absolute ZERO service. Only for such a simple DDoS attack..
-
Saint John: Evernode 1:1 Freedom (@AverageJohnEVR) reported@CyberTechWolff The next generation issue we will have is cookieless tracking/analytics Imagine cloudflare centralizing half the internet and store masked data from it They would be able to brainwash the world that way, with the right set of programming they can get someone to do anything they want We need a decentralized internet where segmenting isn't done, where humanbeings aren't treated as cattle....
-
Shraddha Bharuka (@BharukaShraddha) reported๐ SaaS Stack โ โฃ ๐ Frontend โ โฃ ๐ React โ โฃ ๐ NextJS โ โฃ ๐ Vue โ โฃ ๐ TailwindCSS โ โ ๐ Shadcn UI โ โฃ ๐ Backend โ โฃ ๐ NodeJS โ โฃ ๐ Django โ โฃ ๐ Laravel โ โฃ ๐ FastAPI โ โ ๐ Express โ โฃ ๐ Database โ โฃ ๐ PostgreSQL โ โฃ ๐ MySQL โ โฃ ๐ MongoDB โ โฃ ๐ Redis โ โ ๐ Supabase โ โฃ ๐ Auth โ โฃ ๐ Clerk โ โฃ ๐ Auth0 โ โฃ ๐ Firebase Auth โ โฃ ๐ Supabase Auth โ โ ๐ NextAuth โ โฃ ๐ Payments โ โฃ ๐ Stripe โ โฃ ๐ Paddle โ โฃ ๐ Dodo Payments โ โฃ ๐ Lemon Squeezy โ โ ๐ Polar โ โฃ ๐ Emails โ โฃ ๐ Resend โ โฃ ๐ SendGrid โ โฃ ๐ Mailgun โ โฃ ๐ Postmark โ โ ๐ Amazon SES โ โฃ ๐ Storage โ โฃ ๐ AWS โ โฃ ๐ Cloudflare โ โฃ ๐ Google Cloud Storage โ โฃ ๐ Supabase Storage โ โ ๐ Uploadcare โ โฃ ๐ Deployment โ โฃ ๐ Vercel โ โฃ ๐ Netlify โ โฃ ๐ Railway โ โฃ ๐ Render โ โ ๐ AWS โ โฃ ๐ Domains and DNS โ โฃ ๐ Namecheap โ โฃ ๐ Hostinger โ โฃ ๐ Cloudflare DNS โ โฃ ๐ Google Domains โ โ ๐ SiteGround โ โฃ ๐ Analytics โ โฃ ๐ Google Analytics โ โฃ ๐ Plausible โ โฃ ๐ PostHog โ โฃ ๐ Mixpanel โ โ ๐ DataFast โ โฃ ๐ Monitoring โ โฃ ๐ Sentry โ โฃ ๐ LogRocket โ โฃ ๐ Datadog โ โฃ ๐ NewRelic โ โ ๐ UptimeRobot โ โฃ ๐ DevOps โ โฃ ๐ Docker โ โฃ ๐ Kubernetes โ โฃ ๐ GitHub Actions โ โฃ ๐ CI CD โ โ ๐ Terraform โ โฃ ๐ Search โ โฃ ๐ Algolia โ โฃ ๐ Meilisearch โ โฃ ๐ Elasticsearch โ โฃ ๐ Typesense โ โ ๐ OpenSearch โ โฃ ๐ AI Integration โ โฃ ๐ OpenAI API โ โฃ ๐ Anthropic API โ โฃ ๐ Replicate โ โฃ ๐ HuggingFace โ โ ๐ Gemini API โ โฃ ๐ Integrations โ โฃ ๐ Zapier โ โฃ ๐ Make โ โฃ ๐ n8n โ โฃ ๐ Pabbly โ โ ๐ Webhooks โ โฃ ๐ Security โ โฃ ๐ SSL โ โฃ ๐ Cloudflare โ โฃ ๐ WAF โ โฃ ๐ Rate Limiting โ โ ๐ Secrets Management โ โฃ ๐ Marketing โ โฃ ๐ Search Console โ โฃ ๐ Outrank โ โฃ ๐ Buffer โ โฃ ๐ Analytics โ โ ๐ Kit โ โ ๐ Customer Support โฃ ๐ Intercom โฃ ๐ Crisp โฃ ๐ Zendesk โฃ ๐ Tawk โ ๐ HelpScout
-
VJay (@nceevij) reportedIโve spent a good amount of time over the past few months in conversations and brainstorming around designing an agent economy protocol, particularly agent-to-agent payments. Nothing has shipped yet. Itโs still early. But one problem from those conversations keeps coming back to me: Looping payments. Agent wallets and spending caps are already starting to ship. Cloudflare rolled out its own approach this month. Most of the safety model around these systems rests on a fairly simple assumption: Each agentโs financial risk can be controlled independently. I think that assumption breaks once agents start paying other agents directly. Hereโs the problem. Imagine: Agent A โ Agent B โ Agent C โ Agent A Each agent has a spending cap. Each individual transaction is valid. Each agent stays within its own limit. And yet the system can continue circulating money in a loop while producing zero useful work. That loop could potentially be triggered by: โข Prompt injection โข A pricing or settlement bug โข Misaligned incentive logic โข Agents recursively purchasing services from one another The problem is that most current safeguards operate at the wallet level: โข Spending cap โข Merchant allow-list โข Maximum transaction size โข Per-transaction authorization Those controls answer: โIs this agent allowed to make this payment?โ They donโt necessarily answer: โWhat is happening across the payment graph formed by multiple agents?โ And that distinction becomes important in an agent economy. Interestingly, this isnโt really a new class of problem. It looks a lot like an old distributed systems problem wearing a new mechanism: Deadlock. Model each agent as a node. Model each pending or dependent payment as a directed edge. Now instead of looking only at individual wallet state, look at the graph. If: A is paying into B B is paying into C C is paying back into A you have a cycle. Distributed systems have dealt with similar global-state problems for decades. Techniques such as Chandy-Lamport distributed snapshots allow nodes to capture a consistent view of a distributed system without requiring everything to stop simultaneously. Applied to agent payments, the idea could look something like this: Agent Wallet = Node In-flight Payment = Directed Edge Payment Network = Dynamic Graph Then continuously inspect that graph for suspicious cycles rather than evaluating every wallet completely in isolation. And importantly, detecting a cycle doesnโt necessarily have to mean: โBlock everything.โ It could mean: Freeze the specific loop โ identify the participants โ inspect the intent โ release or terminate one leg of the cycle. Similar to how databases handle transaction deadlocks rather than allowing the entire system to grind to a halt. Why does this matter now? Because agent-to-agent payments are moving from demos toward production systems. As agents increasingly become economic actors that can hold balances, buy services, negotiate prices, and pay other agents, wallet-level controls alone may not be enough. We may need graph-level financial safety primitives. The question I keep coming back to is: Is per-agent spending limits + payment-graph cycle detection enough to prevent looping payments? Or is there a deeper failure mode that even this architecture misses?
-
Fortune Ishaku (@fortuneishaku) reportedAnyone else having issues logging into @Cloudflare ?
-
Deano (@deanthebard) reported@bhavyapandya07 Two hours down here, thought it was Cloudflare at first.
-
Joel - coffee/acc (@JoelDeTeves) reportedHow does @Cloudflare not have an SPF flattening service built in yet? They already have one of the best DMARC solutions. And everyone loves Cloudflare DNS. Wouldn't this be a match made in heaven? PS - Cloudflare, I am available to hire as your idea guy. $300k / year USD.
-
Craig Gordon (@craig10102) reported@WR4NYGov Here is what the company put out. It is a synopsis of their key value proposition: SAN FRANCISCO--(BUSINESS WIRE)-- Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud company, today announced financial results for its second quarter ended June 30, 2026. โWe delivered a stellar second quarter, highlighted by revenue accelerating to $696.1 million, up 36% year-over-year, and record growth in total paying customers, large customers, and developers on our platform,โ said Matthew Prince, co-founder & CEO of Cloudflare. โAs the web shifts to AI answer engines and agent-driven commerce, we are seeing a fundamental rewrite of the Internet for machine-to-machine traffic. Cloudflare sits at the center of this paradigm shiftโbuilding the infrastructure, controls, developer tools, and payment rails for the Agentic Internet. The business model of the web is changing, and no company is better positioned than Cloudflare to help define its future.โ
-
Jordan Coeyman (@acoyfellow) reported@threepointone No one better to do this than you. Thanks for being you. You are a critical reason why I was interested in Cloudflare as a customer, and why I wanted to join so badly. Bring us the weirdest ones!
-
Dean. (@dean_mcpherson) reportedI'm here for celld! We bet heavy on Durable objects for Stepper, and doubled down for our next massive project at Paperform The risky parts of building in DOs is the obvious vendor lock in with CloudFlare, and the subpar story for on prem/data residency If celld slots in there, it'll be massive @rough__sea
-
Peter (@cryptopeterb) reported@R89Capital A few years ago, people believed no single blockchain could handle all the demand that existed for block space (hence the need for โmodularityโ to infinitely scale an L1 like Ethereum) If Solana can achieve 1 million TPS (via Firedancer) this cycle, and have all that block space used (infinite demand right??), even at just $0.001 per transaction, thatโs over $31 billion per year in transaction fees Just comes down to whether you believe thereโs truly that much demand for block space (which allegedly the Ethereum folks did) and whether you believe Firedancer can actually achieve and sustain anything approaching 1 million TPS While Iโm skeptical there actually is that much demand for block space, allegedly companies like Cloudflare and others handling agent-based traffic are looking for a system that could handle huge throughput like that to manage/monetize AI agent traffic on the web writ large
-
Salina Mendoza (@inababi) reported@a_shimanski @Cloudflare Waiting for the gimmick but nothing has arrived. Almost done migrating every single domain from my old registrar. Never going back.
-
1280 MHz (@1280MHz) reported@a_shimanski I use MIAB, mailinabox. I think there's something similar these days that runs in a docker container. The hardest part of configuring an email server is locking it down and then routing the DNS. You can surely handle it, especially if you can use cloudflare API to set DNS.