Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (55%)
• Hosting (27%)
• Domains (18%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
Le Puy-en-Velay	Cloud Services	8 hours ago
Ann Arbor	Cloud Services	2 days ago
Palermo	Hosting	2 days ago
New York City	Hosting	11 days ago
New York City	Cloud Services	1 month ago
Los Angeles	Cloud Services	1 month ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Arijit (@arrzzt) reported 2 minutes ago

  @Cloudflare @eastdakota I cancelled Workers Paid today, just a day after the new billing cycle started. I haven’t really used anything from this month’s paid limits, but I’ve already got a $5.90 invoice. Any chance you can cancel this renewal and void the invoice? 🥹🙏🏻

• 
  Smail (@Smailancer) reported 3 minutes ago

  @levelsio @Cloudflare Why you don't fix the strict mode in cloudflare that bans tons of people who trying to reach the website?

• 
  Akash.eth🌊 (@sheikhakash69) reported 3 minutes ago

  @0xBlue Cloudflare moving first is a big signal. Domain depth will decide winners.

• 
  Ben Hocking (@bmwhocking) reported 5 minutes ago

  @rustie5555 There are a lot of round robin API calls for content. Works fine if you are close to their US data-centre. Sucks for us. They are using Cloudflare, I don’t believe they are processing at Cloudflare’s edge, just caching content. They need better & faster timeline building.

• 
  Yaz (@yazcaleb) reported 6 minutes ago

  @tin_runje @Cloudflare won't let you down

• 
  Α Ω Programmer (@OmegaNekoSimp) reported 15 minutes ago

  @sneedistan Cloudflare proetects terorrist oeganizations and will badically threaten to destroy your company if you don't pay them more money. They are a disgusting company. **** them. Also the Linux Kernel uses this.

• 
  Mikael Pawlo (@mpawlo) reported 15 minutes ago

  @stutireal cloudflare is never down - I would blame the dog

• 
  That Brazilian Omo Eko (@sholawa) reported 19 minutes ago

  Cloudflare has my airtel IP restricted lol.... Slow internet caused it; I must have hit the rate limit that day...

• 
  Rue Mohr🇨🇦 (@RueNahcMohr) reported 19 minutes ago

  @vccccnv I have never had this issue on a site that did not use cloudflare.

• 
  lasan (@las_nish) reported 22 minutes ago

  Comparisons of Free Trial Abuse Prevention Services If you're running a SaaS with a free trial or focusing on PLG, authentication and abuse prevention are not the same problem. - WorkOS: If you're already using WorkOS, WorkOS Radar is probably the first thing I'd look at. For a WorkOS stack, WorkOS AuthKit + Radar makes the most sense. You don't need to bolt another authentication system onto your app just to get abuse signals. - Auth0, Supabase Auth, Better Auth: These are primarily identity/authentication platforms. Integrating only these can't prevent free trial abuse. - Custom: Like the previous options, you need a custom way to prevent free trial abuse. Most free trial abuse methods involve disposable emails, Google dot variations, Google/Gmail domain variations, and plus addressing. That's why even when you block bots via Cloudflare Turnstile or CAPTCHA, you can still get these abusers. The industry standards: - Block free trial abuse using lists hosted on GitHub: This is a pain in the ***. If you don't want to pay money, you can use a service that offers a generous free tier. - WorkOS Radar: This is mainly used at the enterprise level. They focus more on WorkOS-related integrations rather than integrations with other providers. - ZeroBounce, NeverBounce, MillionVerifier, DeBounce: These are mainly used to clean/validate emails. There are 100s of alternatives, and most are similar with minor differences. They all have disposable email checking APIs. - UserCheck: This is also an email validation API, but they focus on blocking fake email addresses. It's better than a basic email verification API. - Autheona: This is in the same category as WorkOS Radar and UserCheck, but with more features. It also focuses on fake user detection and is growing with a real user base. Now, pricing: - WorkOS Radar: First 1,000 checks free, then $100 per 50 checks. No application-specific logic changes. Easy to integrate and manage. - ZeroBounce: 100 free validations in the free tier, then pay-as-you-go, starting at 2,000 for $39, and so on. - NeverBounce: No free trial or use case, $8 per 1,000 checks. - UserCheck: 1,000 API requests per month in the free plan. The rule-based engine is not included in the free plan, and you can get up to 1 request per second. - Autheona: 3,000 checks per month, with the rule-based policy engine included. Standard API request rate limitations apply, similar to paid plans. Now, use cases: - WorkOS Radar: Block disposable emails, plus addressing, and Google dot variations. - ZeroBounce, NeverBounce, etc.: Block disposable emails. - UserCheck: Block disposable emails, plus addressing, and Google dot variations; detect public emails; email suggestions; syntax validation; role detection. - Autheona: Everything included in UserCheck, plus business/free/government email identification, deliverability checks, fraud patterns, punycode and mixed-script checks, VPN detection, and bot detection (not necessary if you already use CAPTCHA, Cloudflare, etc.). Final decision from me: - Use WorkOS Radar if you're already in the WorkOS ecosystem. It's harder to integrate with other auth providers. - Use ZeroBounce-like APIs if you need basic disposable email checks. They're not as good if you need a better free tier. - Use UserCheck if you only need email-related validation and want to stay within the free plan. - Use Autheona if you need the most generous free tier available with a custom policy engine. All services take a maximum of a few hours to integrate and test. Both UserCheck and Autheona have a similar approach: integrate once and never touch the code again.

• 
  Harshit Sehgal (@harshit10sehgal) reported 23 minutes ago

  Cloudflare is basically trying to create an identity layer for ai bots. Their new BotBase for Operators lets crawler/agent developers declare: Who operates the bot. What it does. How it uses site content. And keep that information updated inside Cloudflare’s bot directory. This sounds boring, but the web has a weird problem rn. A website might see traffic from: Search crawlers. Training crawlers. Retrieval bots. Shopping agents. Browser agents. Scrapers. And increasingly autonomous users acting through agents. Blocking all bots destroys useful traffic. Allowing everything means losing control of your content. So we probably need something between: allow and block. Identity + declared behaviour isn’t enough to guarantee a bot behaves honestly. But imo the agentic web eventually needs something similar to: robots.txt + identity + permissions + economic rules.

• 
  Corey J. Gallon (@CoreyGallon) reported 23 minutes ago

  I'm stoked to recap my own talk from @aiDotEngineer World's Fair! The premise of "The Dark Arts of Web Automation: Teaching Agents to Use Websites Like Humans" fits on one slide: a CDP-driven browser is indistinguishable from one driven by a human, because the agent's clicks and keystrokes travel the same path inside Chrome that yours do. I provide a repeatable method for making agents actually operate the web, ending with a fully automated reCAPTCHA v2 solve with no human in the loop. To make your agent appear human to websites, you need the following things. - A CLI, not an MCP server. An Arize AI study found both hit ~83% task success, but the same task took MCP 71 round trips and eight minutes against seven turns and under a minute for the CLI. Anthropic have reported the CLI can be up to 75x cheaper in tokens. - Drive the browser through the Chrome DevTools Protocol. It's the same protocol behind the panel that opens when you hit F12. 57 domains now, but you only need the handful that give your agent digital senses: DOM and accessibility tree and screenshots to see, network and console to hear, clicks and keystrokes to act. - Sense, act, verify, repeat. Verification has to come through a different channel than the one you acted on. If you clicked something, don't ask the click whether it worked, check the network or the screen. - The "meatbag ladder". Rung one is a synthetic JavaScript click, free and instant and the right default. Rung two is a real click through CDP's input domain, which Chrome stamps trusted. Rung three is human motion and vision. Climb only as high as the page forces you. - Trusted versus untrusted is why your click does nothing. A synthetic click on a defended add-to-cart button fails silently, no error, and the page just drops it. The trusted one goes straight through. - Cloudflare Turnstile hides its checkbox behind a closed shadow root inside a cross-origin iframe with another shadow root inside that. So stop trying to grab the element. Ask where the iframe sits, do the math, fire a trusted click at that position on the glass. - Slider captchas are won by how you move. They sample the mouse into a trail of points, so the drag eases in, curves, deliberately overshoots and settles back. - Split the work: deterministic solver, agent operator. Code does the clicking, iframe piercing, screenshotting and rearming; the agent only looks at the grid and picks tiles. reCAPTCHA rounds expire, and an agent that round trips a model on every click burns the clock and loses. - Explore by hand, then write the path down. As code, as an agent skill, often both. Figure it out once, do it forever. It was delightful to speak at this conference, and to meet and talk with so many other AI Engineers working on cool projects! I look forward to the next AIE event. I'm working through the published talks from AI Engineer World's Fair sharing summaries and takeaways. Follow for more!

• 
  SoccerGuy (@SoccerGuyUS) reported 27 minutes ago

  @levelsio @Cloudflare Namecheap is awful. Anyone looking for a better Google Domains (since they rug pulled) alternative: Porkbun.

• 
  Jean Suze (@JeanSuze8) reported 29 minutes ago

  @Navlio @Lovable Cloudflare wasn’t the original cause. The initial issue happened before Cloudflare was added: mysite was unreachable from several Belgian networks, while it worked perfectly through a VPN and from abroad. DNS, TCP 443 and TLS were all fine, and another site of mine on the exact same hosting IP worked normally from the same connection. We only added Cloudflare later as a workaround. The redirect loop that appeared afterwards was a separate issue: my app still had an old hardcoded mysite → www.mysite redirect, while Lovable was redirecting www.mysite → mysite because the apex domain was set as primary. That created the infinite loop. That part is now understood and fixable. What we still don’t understand is the original Belgium-only outage. Nothing in the DNS/TLS tests explains why the hostname stopped returning HTTP responses from Belgian IPs but worked immediately over VPN. That’s the part we’re still waiting for Lovable to explain.

• 
  Jloasxhq (@pcapdodger) reported 34 minutes ago

  @NYBackpacker @Real_RobN No, not quite lying. When I and Harry Hauri exposed it in NOV 2020, they denied it and by Feb 2021 after I mapped their entire network, they hid behind CLOUDFLARE and AWS. They denied it constantly, even when we exposed Goran in Canada who had been going between Serbia and Canada.

• 
  Kamil Fabian (@KamilFabian) reported 37 minutes ago

  @RueNahcMohr @lmilsfsd @Cloudflare just cler the cache. Problem is at your "receiver" ;)

• 
  Elijah Trillionz (@ElijahTrillionz) reported 38 minutes ago

  There is currently no cards or payment methods that is working for Cloudflare. @Cloudflare @CloudflareDev @CloudflareHelp And no way of getting help. This is bad

• 
  Calibaba (@cali_baba_) reported 38 minutes ago

  Vibe coding escaped the IDE 😭 Cloudflare has thousands of non-engineers building internal apps with AI agents. Meta is turning prompts into playable social experiences. The next billion “developers” may never call themselves developers.

• 
  Yoonsun Lee (@everdenepublic) reported 39 minutes ago

  @Secondmindsys I use Cloudflare as the token rotation ceremony. what broker is recommended? The Google MCP + API permissions login is a mine field.

• 
  Yash Desai (@yash_d_desai) reported 43 minutes ago

  Stopping the bad guys with Cloudflare: 20,273 malicious requests blocked or challenged in the last month #cloudflare

• 
  SyntaxError » CEO of "CEO of..."-names (@SyntaxError2505) reported 46 minutes ago

  @NewAgeRetroNerd It never failed on me Cloudflare should have a look

• 
  Anubrat (@anxbrt) reported 47 minutes ago

  I thought Cloudflare had solved our scalability problem. It hadn't. We were building a centralized data-annotation platform. The backend was running on the Cloudflare stack, and we had a CDN in front of our assets. So when I looked at the architecture, my thinking was pretty simple:=> Cloudflare + CDN → we're good. At least until we started testing it. Someone would add an annotation to an image,or make a small modification to an existing label,Nothing particularly expensive-looking,But every-modification generated a new pre-signed URL The CDN would cache the image, right? Then we started seeing the system struggle with barely ~10 users. We were making the CDN's job almost useless. Every time the image changed, we generated a new pre-signed URL. From the CDN's perspective: new URL -> new resource -> cache miss ->render/fetch the image again. And image rendering itself isn't cheap either. So a seemingly tiny action “modifying an image annotation” could trigger expensive image processing and effectively bypass the caching advantage we thought we had. p.s - Scalability isn't just about choosing infrastructure that scales. You can put the most scalable infrastructure in front of your application and still build a system that falls over with 10 users.

• 
  Kyle Avery (@kyleavery) reported 47 minutes ago

  @wongmjane @Cloudflare finally, i won’t need 3 workers for each service 🙏

• 
  Durp  (@durpsick) reported 49 minutes ago

  This will happen in the span of 30 days. We will also be adding • Accounts (if you wanna make one) • backed server support • meny charity's • better service support Everything listed will also be supported by Cloudflare Security!

• 
  Kala (@kalapowered) reported 52 minutes ago

  on 15 September Cloudflare starts blocking AI agents by default on any new site that shows ads. not scrapers, the agents shopping for a person who's waiting. search bots stay in, training bots stay out, and "verified" stops meaning "allowed" so the web is getting a bouncer, and the guest list for the paying lane is kept by Visa and Mastercard: an agent gets through with a key registered at the card network and a tag that says it's here to pay. fine by us, it's how every other door on the internet ended up. we're just enjoying that step one of buying anything online as a robot is a wristband 🙃

• 
  Goldman Stacks (@GoldmanStacks) reported 52 minutes ago

  @tresokure Your website is down with a DNS resolution error from Cloudflare.

• 
  Rue Mohr🇨🇦 (@RueNahcMohr) reported 54 minutes ago

  @itsmejacktv @VelvexVancreed cloudflare is usually an access blocker. I hate it when there is a cloudflare issue and I know, somewhere behind it, is a working server.

• 
  Xavier Rivera (@XavierRiveraX) reported 55 minutes ago

  Microsoft disclosed TerminalFix, a ClickFix variant that uses fake Cloudflare CAPTCHAs to trick users into running a malicious command via Windows Terminal or PowerShell instead of the traditional Run dialog. The chain uses DLL sideloading and a custom reverse-tunnel implant giving attackers persistent network access. Fix: restrict PowerShell and Run dialog execution via AppLocker or Group Policy, and enable PowerShell script block logging. Source: Microsoft/The Hacker News.

• 
  Michael K (@MKassabov) reported 57 minutes ago

  cloudflare proceeds to somehow be the worst distilled SDK to deal with :(

• 
  saint (@thetronchguy) reported 59 minutes ago

  aws, cloudflare, google, meta literally all have such ******* hostile ui it’s genuinely physically ******* painful to have to go spelunking thru the cave of mysteries just to get any ******* thing done no reason why having to use these dashboards genuinely leaves me wanting to fight someone EVERY single time man like how does it benefit you that your users would rather eat a ******* tire than use your **** dashboard??