Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Domains (35%)
• Cloud Services (26%)
• Web Tools (17%)
• Hosting (13%)
• E-mail (9%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
Paris	Cloud Services	13 days ago
New York City	Hosting	15 days ago
Manchester	Domains	1 month ago
Angers	Cloud Services	2 months ago
London	Domains	2 months ago
Noida	Hosting	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  DJ Alex Parker (@DjAlexParker) reported 6 minutes ago

  @XBOXSupport Could we get a technical breakdown of the incident? @Cloudflare do it when they have issues and provide lots of detail, would be nice for you to do it too

• 
  The Holyheights 🇰🇪 (@the_holyheights) reported 13 minutes ago

  People are launching apps to real users while skipping the unglamorous work that quietly sinks them. Here is the essential pre-launch checklist every AI builder should run through. Don’t skip these steps: 1. Protect yourself, not just your product. The second you start collecting user data, you’re operating under real legal requirements (GDPR, CCPA, etc.). Publish a privacy policy and know exactly where that data lives. 2. Enable Row Level Security. Without RLS, anyone can open DevTools and read your entire database. In Supabase, go to Auth → Policies. Zero policies = your app is completely exposed. Fix it in five minutes. 3. Test the failure paths, not just the happy path. Wrong password five times in a row. Password reset for an email that doesn’t exist. Verification link clicked twice. Signing up with an email that’s already registered. These catch roughly 80% of auth bugs. 4. Establish a security baseline in two minutes. Prompt your AI: “Review my app as a security specialist and make sure I have strong security headers and a solid baseline security posture.” 5. Check against OWASP. Prompt: “Review my app against OWASP standards and highlight vulnerabilities.” This is where SQL injection, XSS, and authentication flaws actually surface. 6. Client-side validation is UX, not security. Attackers simply disable JavaScript and hit your API directly. Always validate again on the server—every single time. 7. AI-generated code commonly leaks data in three places: .env values ending up in the frontend, API responses returning too much information, and secrets appearing in logs. Prompt: “Check my app for credential or sensitive data leaks in frontend or API routes.” 8. API keys in the frontend = game over. If it’s visible in the browser, assume it’s already compromised. Move it server-side or proxy the request. 9. Add rate limits before someone burns through your API budget. Cap every endpoint that hits a paid service. I’ve seen a Supabase bill jump from $20 to $200 in a single day. 10. Put CAPTCHA on public forms (Cloudflare Turnstile is free) and lock CORS to your own domain. Ten minutes of work that stops most bot floods. 11. Error messages that don’t leak information. Show “User not found,” not “SELECT * FROM users failed.” Log the full technical details server-side and give users only generic messages. Build fast. Just don’t ship unprotected.

• 
  sam with his computer (@samwcomputer) reported 13 minutes ago

  cloudflare just made blocking ai training bots the default on ad-supported pages starting september. opt-in security was never going to work, defaults are the only setting that actually gets used

• 
  PaulSD (@paulsd_95) reported 13 minutes ago

  @thte857 @FuckKoroks You'd be mad too if your work relies on something online and that critical work got blocked because Cloudflare went down for hours. Wouldn't be surprised if lives were ruined or lost because of it.

• 
  Jayesh Gaddam (@jayesh_gaddam) reported 15 minutes ago

  Stopping the bad guys with Cloudflare: 382 malicious requests blocked or challenged in the last month #cloudflare

• 
  Daryl Ginn (@darylginn) reported 18 minutes ago

  @leftyv0 @Cloudflare I had AI migrate a postgres database to D1, but for some reason it chose not to create indexes, which is basically database 101. I was getting ~970 billion (yes, billion) row reads per day. The funny thing is if I had not used AI this would never have happened.

• 
  2WBIA (@2WBIA_5) reported 19 minutes ago

  @AbuShekauGamer I don't have an issue with cloudflare

• 
  AX1 (@ax1vc) reported 21 minutes ago

  Money was never the barrier to agents. Permission was. Permission is shipping today, just not on the money side. Cloudflare is working on getting Web Bot Auth through the IETF standard process. The requests are signed, sites verify the source of the request, and permissions are granted to entire categories of agents at once. Visa's agent standard is based on those same signed requests. Now see what verification actually does. Identity. Who's running this agent, and whether they disclosed it correctly. Cloudflare's own docs highlight the hole: you can verify the identity of the operator and know nothing about the user behind it. There's no information about what this specific agent actually accomplished stored in the signature. The Ethereum standard is ERC-8004, onchain registries for storing exactly that, co-authored by MetaMask, EF, Google, and Coinbase, with Base next on the list. But registries store records, they don't create them. Competitions will provide some kinds of records. What an agent can do within a sandbox. The record of what they accomplished out there somewhere with users and stakes involved needs a witness. That witness is a product that lets the agent in and keeps track of the results. That’s what we built, and it goes live this week.

• 
  Ray 🇺🇦🏳️‍🌈 (@uasneppy) reported 22 minutes ago

  I’ll try to fix snepclub twitter embedded later today, sorry :( I didn’t know about the new updates and me having to have a burner account, plus deploying it on Cloudflare 💀

• 
  Jason Fleagle (@jjfleagle) reported 26 minutes ago

  @Cloudflare This is the kind of tooling that turns a privacy protocol into an operable system. The next useful artifact is a redacted debug receipt showing each hop, encapsulation step, draft version, timing, and failure boundary so teams can reproduce errors without exposing the request.

• 
  Mitch Flindell (@buildo_baggins) reported 27 minutes ago

  @meaganrgamache Using Think for a project, had to switch to openrouter because glm inference on cloudflare was very slow

• 
  Cutshit (@cutshitdotnet) reported 31 minutes ago

  @notbrvnd0n urlscan's my first stop too 🫡 what i stack with it: resolve the redirect server-side first fetch it from a box that isn't mine, so i get the real destination without my machine ever touching the link passive recon before i open anything: domain age + TLD rep (a 25-day-old .xyz kinda answers itself) and yeah, for the Cloudflare gated ones you're right disposable Windows Sandbox, fresh instance nuked on close. never connect a wallet or sign anything in it. the drainer's almost never the page anyway it's the whatsapp/tg group one hop past it. 🦆

• 
  Porkbun (@Porkbun) reported 31 minutes ago

  @staabse @baiaphilia Well I'm biased and I'm one of the few folks who built Porkbun but here are my reasons: 1) We let you change your name servers and don't lock you in, at Cloudflare you have to upgrade to an expensive paid plan in order to do so should you ever want / need to. 2) Domain registration is our bread and butter and not a side gig we tacked on later. 3) We're not a multi-billion dollar mega-corp, we truly care about each and every one of our great customers and our company. 4) You can register your domain at Porkbun and still use it at Cloudflare and maintain the freedom to switch DNS providers when needed, eliminating the all eggs in one basket scenario. 5) Great pricing, we sell most domains at our cost (wholesale + ICANN fee + credit card fee), that said we can't afford to eat the credit card fee like Cloudflare can. 6) We actual engage with users on X ;) 7 ) Actual human customer support should you need it. I could keep going but these are pretty good reasons :)

• 
  groky (@groktuto) reported 35 minutes ago

  Wtf just happened is @Cloudflare down?

• 
  Syahmi Rafsanjani (@SyahmiRafsan) reported 37 minutes ago

  Hot take: if you’re already using Cloudflare but not Cloudflare Access, your security setup is only half-done. That 403 Forbidden screen isn’t a problem. That’s literally the point. Internal dashboards, staging sites and admin panels shouldn’t be public just because someone has the URL. You already use Cloudflare for DNS, CDN and WAF. Might as well put identity checks in front of the sensitive stuff too.

• 
  JD | RoyalCities (@RoyalCities) reported 38 minutes ago

  @TnVitNam1 @growing_daniel There isn't. Kimi (an open model) is right up there with them. I.e. The gap is not as wide as you think Also the capabilities between closed vs open comes down to how, where and more important WHEN you got your data. OAI and Ant were able to scrape the entire internet and pillage Anna's Archive in stealth before LLMs got so ubiquitous and people realized the data was very valuable. This was before CloudFlare basically got embedded into the very fabric of every website now gatekeeping mass web scraping making it harder for competition to do the same. but because of that initial data scrapes they were able to develop a flywheel - i.e. the first gen models built off of stolen IP let them get users -> now those users lead to more data. Lobbying to capture government regs and say others doing the same is "dangerous" is just the final step of pulling the ladder up behind them.

• 
  swisscheese (@swisscheese4299) reported 38 minutes ago

  @OpenAI image generation is still throwing intermittent 520 errors through cloudflare.

• 
  Josh Pigford (@Shpigford) reported 44 minutes ago

  i'm so confused by @claudeai artifacts. half the time it'll give me a shareable URL. other times it swears that capability has never existing and isn't possible and i should use cloudflare pages.

• 
  Lonnie VanZandt (@lonniev) reported 47 minutes ago

  Delegating LLM queries to background tasks is a bit difficult to vibe code. Cloudflare scheduling thread, MCP, a thread pool for long-running tasks, delegation to the LLM service, job completion monitoring. It's a bit much for our AI tools to figure out. So, while that gets worked out, the dynamic part of the Post here can and does timeout and then show only the remark that Claude can take too long. It'll come together soon. Then the post will share some interesting discovered implementation fact about Nostr in DPYC.

• 
  Xoge (@ClassyXoge) reported 48 minutes ago

  The only self custody is complete ownership of code, node and wallet. To ensure your ip is not logged, to ensure no down server or cloudflare reroute can stop you. Be your own bank, has never been more real than madlab

• 
  Charity Gamble (@cgambledev) reported 49 minutes ago

  Took an old laptop (2013), installed Ubuntu 26.04 LTS, then installed Forgejo to host my own repos. Set up a Cloudflare tunnel & installed Cloudflared to handle it. Set the laptop to never go to sleep. Cloned my Obsidian vault from GitHub, pushed it to my Forgejo.

• 
  Nashon (@WEGNERJOASH) reported 51 minutes ago

  @Okwachjamal Generating 15 gb of data takes time. Had an option of running it on a vps but don't want to login to my cloudflare through that. Writing it to local sqlite is faster and ensures that I can resum sending it to remote db if I have a network issue. I can also test locally.

• 
  Rach (@KnudRach) reported 53 minutes ago

  @Cloudflare can you help restore a staging site that went down?

• 
  Lucas Rodriguez (@LucasSaasbr) reported 55 minutes ago

  Cloudflare blocks or challenges bad requests from hitting my website. #cloudflare

• 
  Bobby Umar | Keynote Speaker 🇨🇦 (@raehanbobby) reported 56 minutes ago

  Tried so hard to contact @Cloudflare & @CloudflareHelp for some support. But it kept directing me to a website. How do I talk to a person? I have charges I don't understand, for an account I don't know about. So either I talk to you, or cancel you getting paid. #custserv #fail

• 
  Zubiqo (@zubiqo) reported 56 minutes ago

  JUST IN: 📈 Cybersecurity startup Spur Intelligence secures a $200M round led by Insight Partners. The Florida-based company was founded in 2017 by two former Defense Department engineers. Spur builds tech to help enterprises identify fake users hidden behind proxy networks. Cloudflare reported last month that bots have officially surpassed human traffic online. "As sophisticated criminal VPNs, residential proxy networks, and anonymization infrastructure proliferate, organizations are increasingly operating with a critical blind spot: they can see the activity, but not the infrastructure behind it." — Thomas Krane And it's basically just machines talking to machines out there now, turning bot mitigation into a massive mandatory tax for every enterprise network.

• 
  haden staab (@staabse) reported 57 minutes ago

  @Porkbun @baiaphilia Firstly, I never said there was something wrong with you. You’re more than welcome to give us your pitch. Why should I use Porkbun over Cloudflare?

• 
  Lonnie Jordan (@LonnieJordan843) reported 59 minutes ago

  @bdkjones @Cloudflare @Apple Once again Cloudflare problems. Too many this year. They are done by ‘28.

• 
  Shigaraki Tomura (@grimmjow_sats) reported 1 hour ago

  NVIDIA, MICROSOFT, IBM, CLOUDFLARE AND CROWDSTRIKE JUST FORMED A 37-ORG ALLIANCE — AND THEY'RE NOT AFRAID OF THE MODEL. they call it the Open Secure AI Alliance. it shipped an open-source stack, NOOA, to test, trace, audit and govern how agents actually behave in production. read what they're guarding against and it's obvious: → not "the AI goes rogue" → over-permissioned agents with access they never needed → tool calls nobody can trace after the fact the scary part of an agent was never its IQ. it's the keys you handed it and the logs you don't have. 37 of the biggest names in compute and security just admitted the same thing at once. everyone shipping agents is one untraced tool call away from the incident. follow and bookmark before your stack becomes the case study

• 
  Doni (@donidhernandez) reported 1 hour ago

  @fazley111 @Cloudflare had a similar ghost charge issue with a service once. worth opening a support ticket, sometimes it's a pre-auth that never cleared