Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (39%)
• Domains (22%)
• Web Tools (22%)
• Hosting (11%)
• E-mail (6%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
New York City	Cloud Services	12 days ago
Los Angeles	Cloud Services	13 days ago
Paris	Cloud Services	29 days ago
New York City	Hosting	1 month ago
Manchester	Domains	2 months ago
Angers	Cloud Services	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  ruminations (@amphib0ly) reported 4 minutes ago

  signals need execution and a lot of people who want to use q are very busy they are founders / builders and are down to try stuff but also just want to put money in a wallet and let it work for them no amount of UI polish will make them want to use the UI and adding more assets won't sway them - they just want to buy convenience so, we made a baby sister for Q named Cassie - short for Cassandra, look it up cassie will help users execute trades on Quotient signals in their local environment or in a deployed, cloudflare run-time they control users bring capital Q brings intelligence Cassie brings execution

• 
  R (@dnagabut) reported 5 minutes ago

  Cloudflare announced programmable wallets built for AI agents, with preset spending limits and merchant restrictions in the design. Nothing has shipped yet. Right now you can reserve a handle. Funded account wallets, virtual wallets and programmable agent spending are all due in the coming months. Read the feature list again, because it is a permission model, not a payments product. The moment you let an autonomous agent buy things, you inherit a problem crypto has been failing at in public for years. How do you grant a program the ability to spend without granting it the ability to spend everything? DeFi's answer was token approvals. The result is a very long list of drained wallets where nothing was hacked at all. Someone approved unlimited spending to a contract years ago and forgot. So Cloudflare's version is delegated authority with a cap and an allowlist, plus anomalous-spending alerts that escalate to a human. Sensible. Also the bare minimum. And these are stablecoin wallets settling over x402, so this isn't a payments industry learning from crypto's mistakes. It is crypto. The layer above it is still wide open. An agent that can be talked into a purchase by hidden text on a web page is still an agent that can be talked into a purchase. Caps limit the blast radius. An anomaly alert only fires once the spending already looks strange. Neither one touches the trigger. Follow @dnagabut if you like your tech news with the catch included.

• 
  Fast&Final (@FastFinalAlgo) reported 8 minutes ago

  Cloudflare added MCP detection at the network level today $Algo 🔮

• 
  Adam Szaloczi | DataBard (@AdamSzaloczi) reported 10 minutes ago

  @a_shimanski @Namecheap @Cloudflare I never experienced any downtime. But the whole ecosystem is so bloated and the admin process is confusing.

• 
  Quentin (@QuentLaBrute) reported 12 minutes ago

  Say what you want about vibe coding, four months ago I could not use a terminal and had never written software. Since then I have self-hosted n8n, run a VPS on Coolify, grown a website’s traffic by 500 percent with SEO work, built a nutrition tracker on Airtable, learned *** and Cloudflare properly, set up an Obsidian second brain, and I am now finishing my first iOS app. Probably rather unimpressive for most here, but for me none of that was reachable for someone with my background two years ago. What decides whether this compounds is whether you understand why the thing works. If you cannot explain the fix, you cannot repeat it, and you have handed over the only part that was ever yours. What is the first real thing you built this way that a course would never have got you to?

• 
  Laurent Perrier (@maybelaurent) reported 15 minutes ago

  @remotecleanguy Namecheap is not a serious company. Transfer domain to Cloudflare, ask Claude to rebuild your website with Astro and host on Cloudflare workers. Every provider has outages but at least if Cloudflare is down so is the rest of the internet

• 
  Card Trading Marketplace (@CTM_Market) reported 18 minutes ago

  @a_shimanski @Namecheap @Cloudflare Lol our business email has been down since 9 am

• 
  Artyom Shimanski (@a_shimanski) reported 19 minutes ago

  @TaskLemonWorks @Namecheap @Cloudflare thanks, the worst part is clients don't know why you went quiet

• 
  Alex Greenland (@ajrgd) reported 19 minutes ago

  cloudflare could never

• 
  Bob Stolzberg (@BobStolzberg) reported 19 minutes ago

  $1 .app or .dev domain registration on @Cloudflare even with the FREE plan! WTF are you waiting for?! Best place to build.

• 
  Task Lemon (@TaskLemonWorks) reported 22 minutes ago

  @a_shimanski @Namecheap @Cloudflare Sorry to hear that, having a main business account. Being down is extremely frustrated and upsetting.

• 
  Marius du Preez (@mdp_sec) reported 24 minutes ago

  Following on from yesterday A browser can reach a signup page, fill every field, solve the CAPTCHA, and still be useless if nobody can verify the account. That became obvious once I started letting AI handle more of my bug bounty workflow. Browser automation was only half the problem. The system also needed to create identities, receive email, follow verification links, collect OTPs, keep attacker and victim accounts separate, and fall back to real phone numbers when a target refused email verification. I did not want the AI logging into a normal inbox for every account. I wanted email to behave like another research API. I now run three catch-all domains. For each signup, the system creates a new address containing the target, purpose, and timestamp. Nothing needs to be provisioned first. The address exists because the domain accepts everything. That means one target can have separate addresses for attacker, victim, admin invitation, password reset, organization owner, or any other role I need to test. If I revisit the target later, I create another set rather than guessing which old account belongs to which research cycle. Mail for all three domains enters through Cloudflare Email Routing. A catch-all rule sends it to one Email Worker. The Worker reads the raw message, extracts useful fields such as recipient, sender, subject, body, and timestamp, then sends the result to my own receiver over an authenticated webhook. The receiver writes messages into one rolling store and exposes a separate authenticated read endpoint. The write secret and read key are different, so the component accepting mail does not automatically get permission to read it back. The important rule is that AI never asks for the entire inbox. It queries the exact address it created for that test. This turns an otherwise messy shared catch-all into a deterministic part of the run. If the system registered target-attacker-1740000000 on one domain, it polls only for that recipient. An unrelated OTP arriving at the same time cannot be mistaken for the current account. When a message arrives, the AI does not need a visual mail client. It reads the stored RFC822 message, finds the verification URL or newest numeric code, and continues the browser flow. The same path handles account confirmation, magic links, password resets, invitations, change-email confirmations, and email OTP. Raw mail is preserved because the convenience body is not always enough. Real messages are multipart, HTML-heavy, encoded, or wrapped in tracking redirects. Keeping the original source means I can parse it properly when a simple body extraction misses something. I use email first whenever the product allows it. It is cheap, fast, unlimited for practical purposes, and easy to isolate. I can create five accounts for an authorization matrix without consuming phone numbers or waiting for manual inbox work. It also gives the AI a complete chain from signup request to verified session. SMS is the fallback, not the default. Some targets insist on a real mobile number. Others require one only after signup, or they gate a specific feature behind phone verification. In those cases the system can use physical Android devices with active SIMs, or rented non-VoIP US and UK numbers when geography matters. The trigger time is recorded before the code is requested. The system then reads only messages received after that point and extracts the newest matching OTP. This matters because SMS inboxes keep old codes, and blindly taking the first six-digit number is an easy way to lock an account or burn retries. Geography is part of the identity too. A US-only signup should not combine a US browser exit with an Australian phone number unless I am deliberately testing that mismatch. The browser pool already lets me choose a country-specific IP and timezone. The phone-number layer lets the account match that geography when the target enforces it. Email domains also have a fallback order. Some products reject an unfamiliar domain, block a domain after too many test accounts, or apply reputation rules inconsistently. If the primary domain fails, the system moves to the second, then the third. Every domain reaches the same backend, so nothing else in the workflow changes. This infrastructure becomes more useful after registration. Password-reset testing needs controlled access to both accounts and their mail. Invitation testing needs me to prove which address received which organization or role. Change-email testing needs visibility into notifications sent to old and new identities. Magic-link testing needs the original URL, its expiry behavior, and a second session where I can check replay or account binding. For evidence, I can render a real received message locally without loading remote images, scripts, forms, frames, or tracking resources. That gives me a clean screenshot for the report while keeping the evidence genuine. I am showing the message that arrived, not recreating it in a document. The full flow now looks like this. The AI chooses a browser profile and account role. It creates a unique address, registers the account, polls only for that recipient, extracts the link or OTP, verifies the account, and saves the resulting session with the correct role. If email is unavailable, it selects a real number that matches the required country, requests the SMS, reads the newest code, and continues. I only get involved when the product needs human judgment or a step cannot be automated safely. This is not an inbox replacement for its own sake. It is account infrastructure built for testing. The value is not receiving email. The value is letting every research run create traceable identities and reach authenticated product state without losing time to manual verification. #BugBounty #CyberSecurity #TogetherWeHitHarder

• 
  Reina Cruz 🥼🧤🇨🇺 (@rea1ReinaCruz) reported 24 minutes ago

  @Cloudflare @KLQuietComj7p @a_shimanski Fix human verification

• 
  orlie (@sunglassesface) reported 24 minutes ago

  @FreedomFries93 @joshmanders @PlanetScale Yeah, I used AWS in the past and honestly it wasn't that bad once you get past the setup. My point is not about comparing cloudflare to AWS. My point is the confusion in product offering within cloudflare itself

• 
  Jilles Soeters (@Jilles) reported 25 minutes ago

  @EmilioSchwaiger Not rude, totally fair. At the time of posting the message I saw it on my personal Cloudflare account (which happens to also be on the Cloudflare Paid plan) and just tweeted that excitingly. I should have done a little more due diligence. That's on me.

• 
  Mark (@peyoteheadlight) reported 27 minutes ago

  crazy how cloudflare warp fixes every isp based issue i have how did i only find out about this a few months ago

• 
  kyle (@rbxXlXi) reported 29 minutes ago

  wtf since when did roblox start using cloudflare

• 
  Jérôme FARAILL (@JEROMEFARAILL) reported 37 minutes ago

  @a_shimanski @Namecheap @Cloudflare Namecheap is the absolute ZERO service. Only for such a simple DDoS attack..

• 
  Saint John: Evernode 1:1 Freedom (@AverageJohnEVR) reported 37 minutes ago

  @CyberTechWolff The next generation issue we will have is cookieless tracking/analytics Imagine cloudflare centralizing half the internet and store masked data from it They would be able to brainwash the world that way, with the right set of programming they can get someone to do anything they want We need a decentralized internet where segmenting isn't done, where humanbeings aren't treated as cattle....

• 
  Shraddha Bharuka (@BharukaShraddha) reported 39 minutes ago

  📂 SaaS Stack ┃ ┣ 📂 Frontend ┃ ┣ 📂 React ┃ ┣ 📂 NextJS ┃ ┣ 📂 Vue ┃ ┣ 📂 TailwindCSS ┃ ┗ 📂 Shadcn UI ┃ ┣ 📂 Backend ┃ ┣ 📂 NodeJS ┃ ┣ 📂 Django ┃ ┣ 📂 Laravel ┃ ┣ 📂 FastAPI ┃ ┗ 📂 Express ┃ ┣ 📂 Database ┃ ┣ 📂 PostgreSQL ┃ ┣ 📂 MySQL ┃ ┣ 📂 MongoDB ┃ ┣ 📂 Redis ┃ ┗ 📂 Supabase ┃ ┣ 📂 Auth ┃ ┣ 📂 Clerk ┃ ┣ 📂 Auth0 ┃ ┣ 📂 Firebase Auth ┃ ┣ 📂 Supabase Auth ┃ ┗ 📂 NextAuth ┃ ┣ 📂 Payments ┃ ┣ 📂 Stripe ┃ ┣ 📂 Paddle ┃ ┣ 📂 Dodo Payments ┃ ┣ 📂 Lemon Squeezy ┃ ┗ 📂 Polar ┃ ┣ 📂 Emails ┃ ┣ 📂 Resend ┃ ┣ 📂 SendGrid ┃ ┣ 📂 Mailgun ┃ ┣ 📂 Postmark ┃ ┗ 📂 Amazon SES ┃ ┣ 📂 Storage ┃ ┣ 📂 AWS ┃ ┣ 📂 Cloudflare ┃ ┣ 📂 Google Cloud Storage ┃ ┣ 📂 Supabase Storage ┃ ┗ 📂 Uploadcare ┃ ┣ 📂 Deployment ┃ ┣ 📂 Vercel ┃ ┣ 📂 Netlify ┃ ┣ 📂 Railway ┃ ┣ 📂 Render ┃ ┗ 📂 AWS ┃ ┣ 📂 Domains and DNS ┃ ┣ 📂 Namecheap ┃ ┣ 📂 Hostinger ┃ ┣ 📂 Cloudflare DNS ┃ ┣ 📂 Google Domains ┃ ┗ 📂 SiteGround ┃ ┣ 📂 Analytics ┃ ┣ 📂 Google Analytics ┃ ┣ 📂 Plausible ┃ ┣ 📂 PostHog ┃ ┣ 📂 Mixpanel ┃ ┗ 📂 DataFast ┃ ┣ 📂 Monitoring ┃ ┣ 📂 Sentry ┃ ┣ 📂 LogRocket ┃ ┣ 📂 Datadog ┃ ┣ 📂 NewRelic ┃ ┗ 📂 UptimeRobot ┃ ┣ 📂 DevOps ┃ ┣ 📂 Docker ┃ ┣ 📂 Kubernetes ┃ ┣ 📂 GitHub Actions ┃ ┣ 📂 CI CD ┃ ┗ 📂 Terraform ┃ ┣ 📂 Search ┃ ┣ 📂 Algolia ┃ ┣ 📂 Meilisearch ┃ ┣ 📂 Elasticsearch ┃ ┣ 📂 Typesense ┃ ┗ 📂 OpenSearch ┃ ┣ 📂 AI Integration ┃ ┣ 📂 OpenAI API ┃ ┣ 📂 Anthropic API ┃ ┣ 📂 Replicate ┃ ┣ 📂 HuggingFace ┃ ┗ 📂 Gemini API ┃ ┣ 📂 Integrations ┃ ┣ 📂 Zapier ┃ ┣ 📂 Make ┃ ┣ 📂 n8n ┃ ┣ 📂 Pabbly ┃ ┗ 📂 Webhooks ┃ ┣ 📂 Security ┃ ┣ 📂 SSL ┃ ┣ 📂 Cloudflare ┃ ┣ 📂 WAF ┃ ┣ 📂 Rate Limiting ┃ ┗ 📂 Secrets Management ┃ ┣ 📂 Marketing ┃ ┣ 📂 Search Console ┃ ┣ 📂 Outrank ┃ ┣ 📂 Buffer ┃ ┣ 📂 Analytics ┃ ┗ 📂 Kit ┃ ┗ 📂 Customer Support ┣ 📂 Intercom ┣ 📂 Crisp ┣ 📂 Zendesk ┣ 📂 Tawk ┗ 📂 HelpScout

• 
  VJay (@nceevij) reported 39 minutes ago

  I’ve spent a good amount of time over the past few months in conversations and brainstorming around designing an agent economy protocol, particularly agent-to-agent payments. Nothing has shipped yet. It’s still early. But one problem from those conversations keeps coming back to me: Looping payments. Agent wallets and spending caps are already starting to ship. Cloudflare rolled out its own approach this month. Most of the safety model around these systems rests on a fairly simple assumption: Each agent’s financial risk can be controlled independently. I think that assumption breaks once agents start paying other agents directly. Here’s the problem. Imagine: Agent A → Agent B → Agent C → Agent A Each agent has a spending cap. Each individual transaction is valid. Each agent stays within its own limit. And yet the system can continue circulating money in a loop while producing zero useful work. That loop could potentially be triggered by: • Prompt injection • A pricing or settlement bug • Misaligned incentive logic • Agents recursively purchasing services from one another The problem is that most current safeguards operate at the wallet level: • Spending cap • Merchant allow-list • Maximum transaction size • Per-transaction authorization Those controls answer: “Is this agent allowed to make this payment?” They don’t necessarily answer: “What is happening across the payment graph formed by multiple agents?” And that distinction becomes important in an agent economy. Interestingly, this isn’t really a new class of problem. It looks a lot like an old distributed systems problem wearing a new mechanism: Deadlock. Model each agent as a node. Model each pending or dependent payment as a directed edge. Now instead of looking only at individual wallet state, look at the graph. If: A is paying into B B is paying into C C is paying back into A you have a cycle. Distributed systems have dealt with similar global-state problems for decades. Techniques such as Chandy-Lamport distributed snapshots allow nodes to capture a consistent view of a distributed system without requiring everything to stop simultaneously. Applied to agent payments, the idea could look something like this: Agent Wallet = Node In-flight Payment = Directed Edge Payment Network = Dynamic Graph Then continuously inspect that graph for suspicious cycles rather than evaluating every wallet completely in isolation. And importantly, detecting a cycle doesn’t necessarily have to mean: “Block everything.” It could mean: Freeze the specific loop → identify the participants → inspect the intent → release or terminate one leg of the cycle. Similar to how databases handle transaction deadlocks rather than allowing the entire system to grind to a halt. Why does this matter now? Because agent-to-agent payments are moving from demos toward production systems. As agents increasingly become economic actors that can hold balances, buy services, negotiate prices, and pay other agents, wallet-level controls alone may not be enough. We may need graph-level financial safety primitives. The question I keep coming back to is: Is per-agent spending limits + payment-graph cycle detection enough to prevent looping payments? Or is there a deeper failure mode that even this architecture misses?

• 
  Fortune Ishaku (@fortuneishaku) reported 47 minutes ago

  Anyone else having issues logging into @Cloudflare ?

• 
  Deano (@deanthebard) reported 49 minutes ago

  @bhavyapandya07 Two hours down here, thought it was Cloudflare at first.

• 
  Joel - coffee/acc (@JoelDeTeves) reported 55 minutes ago

  How does @Cloudflare not have an SPF flattening service built in yet? They already have one of the best DMARC solutions. And everyone loves Cloudflare DNS. Wouldn't this be a match made in heaven? PS - Cloudflare, I am available to hire as your idea guy. $300k / year USD.

• 
  Craig Gordon (@craig10102) reported 56 minutes ago

  @WR4NYGov Here is what the company put out. It is a synopsis of their key value proposition: SAN FRANCISCO--(BUSINESS WIRE)-- Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud company, today announced financial results for its second quarter ended June 30, 2026. “We delivered a stellar second quarter, highlighted by revenue accelerating to $696.1 million, up 36% year-over-year, and record growth in total paying customers, large customers, and developers on our platform,” said Matthew Prince, co-founder & CEO of Cloudflare. “As the web shifts to AI answer engines and agent-driven commerce, we are seeing a fundamental rewrite of the Internet for machine-to-machine traffic. Cloudflare sits at the center of this paradigm shift—building the infrastructure, controls, developer tools, and payment rails for the Agentic Internet. The business model of the web is changing, and no company is better positioned than Cloudflare to help define its future.”

• 
  Jordan Coeyman (@acoyfellow) reported 60 minutes ago

  @threepointone No one better to do this than you. Thanks for being you. You are a critical reason why I was interested in Cloudflare as a customer, and why I wanted to join so badly. Bring us the weirdest ones!

• 
  Dean. (@dean_mcpherson) reported 1 hour ago

  I'm here for celld! We bet heavy on Durable objects for Stepper, and doubled down for our next massive project at Paperform The risky parts of building in DOs is the obvious vendor lock in with CloudFlare, and the subpar story for on prem/data residency If celld slots in there, it'll be massive @rough__sea

• 
  Peter (@cryptopeterb) reported 1 hour ago

  @R89Capital A few years ago, people believed no single blockchain could handle all the demand that existed for block space (hence the need for “modularity” to infinitely scale an L1 like Ethereum) If Solana can achieve 1 million TPS (via Firedancer) this cycle, and have all that block space used (infinite demand right??), even at just $0.001 per transaction, that’s over $31 billion per year in transaction fees Just comes down to whether you believe there’s truly that much demand for block space (which allegedly the Ethereum folks did) and whether you believe Firedancer can actually achieve and sustain anything approaching 1 million TPS While I’m skeptical there actually is that much demand for block space, allegedly companies like Cloudflare and others handling agent-based traffic are looking for a system that could handle huge throughput like that to manage/monetize AI agent traffic on the web writ large

• 
  Salina Mendoza (@inababi) reported 1 hour ago

  @a_shimanski @Cloudflare Waiting for the gimmick but nothing has arrived. Almost done migrating every single domain from my old registrar. Never going back.

• 
  1280 MHz (@1280MHz) reported 1 hour ago

  @a_shimanski I use MIAB, mailinabox. I think there's something similar these days that runs in a docker container. The hardest part of configuring an email server is locking it down and then routing the DNS. You can surely handle it, especially if you can use cloudflare API to set DNS.