Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (44%)
• Domains (25%)
• Web Tools (13%)
• Hosting (13%)
• E-mail (6%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
New York City	Cloud Services	14 days ago
Los Angeles	Cloud Services	15 days ago
Paris	Cloud Services	1 month ago
New York City	Hosting	1 month ago
Manchester	Domains	2 months ago
Angers	Cloud Services	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  MariMarketing Digital (@marimarketingw3) reported 6 minutes ago

  GM, Fam, Happy Saturday! Today I’m bringing you my market thoughts 💭 I came to this conclusion after scrolling through X this week and seeing the same news over and over again… 👀 Cloudflare just gave AI Agents a wallet, MetaMask launched Agent Wallet, and #Coinbase is moving in the same direction. Three major players, all within practically the same week. At first, I thought it was a coincidence. But three in a row? I don’t think that’s a coincidence anymore. I think it’s a clear signal. 🤔 Honestly, my reaction was pretty strange. It felt like 🚄 “watching a train start accelerating while everyone jumps on, and no one stops to check whether the tracks are even finished.” AI Agents can now spend, trade, and execute tasks on their own. But the question that kept coming back to me was: Who can actually prove what this Agent is? What did it do last time? Can you really trust your own Agent? 🔐 Without reliable identity and memory, even the smartest Agent is just a ghost employee with no track record. No matter how capable it is, you still wouldn’t trust it with anything important. And I don’t think I’m the only one who sees it this way. Most people are too busy jumping on the train to look back and check the tracks. That’s why I want to highlight that @DeAgentAI has been solving exactly this from day one: Identity, Continuity, Consensus. These aren’t just three features. They’re the foundation. The tracks need to be solid before the train can go the distance. If we build the AI infrastructure correctly, the buildings can keep rising. 🌇 #AIAgent #DeAgentAI 💡 What do you guys think? Spanish translation below 👇🏻

• 
  Enno (@aeevion) reported 9 minutes ago

  @Cloudflare @CloudflareHelp Ive been trying to reach support now for 1 month via tickets, via community forum and I got no reply. Can you please reopen my case here pelase? It was closed without a reply: case number 02073156

• 
  Mark Kilby (@MarkKilby2) reported 10 minutes ago

  Getting constant cloudflare errors when access your site, What's the solution @gameknot ?

• 
  Alex Cloudstar (@alexcloudstar) reported 13 minutes ago

  @attacomsian nice, never tried cloudflare pages. how are they? I used only R2 from Cloudflare

• 
  Alex Garcia (@alex_here_now) reported 13 minutes ago

  hey someone at cloudflare recently tweeted about interconnected agents succeeding to ship a thing across companies, can anyone help me relocate that

• 
  Jabol aso (@Jabolaso) reported 13 minutes ago

  @mikeydsoftware @Aditya_181105 Self managed server can use cloudflare services, but i dont have a usecase to use vercel, if im a self managing. Most of vercel service are related to their app deployment service

• 
  Mat Windle (@Maticated) reported 15 minutes ago

  @VadimStrizheus I do this. Sadly I can’t share my product with anyone because it’s all proprietary information for my company locked behind zero trust but I built a fully deployed app on cloudflare that keeps track of a multi million $$ project on top of our entire 1000+ tower cell network.

• 
  Warhead (@vz_warhead) reported 15 minutes ago

  @JaniBangiev damn, does it work the same for user's data in apps? should I also switch to cloudflare instead of supabase?

• 
  Artyom Shimanski (@a_shimanski) reported 18 minutes ago

  @JEROMEFARAILL @Namecheap @Cloudflare to be fair it was a cooling failure at PhoenixNAP, not an attack. the single region setup is the real issue

• 
  Marius du Preez (@mdp_sec) reported 21 minutes ago

  Following on from yesterday A browser can reach a signup page, fill every field, solve the CAPTCHA, and still be useless if nobody can verify the account. That became obvious once I started letting AI handle more of my bug bounty workflow. Browser automation was only half the problem. The system also needed to create identities, receive email, follow verification links, collect OTPs, keep attacker and victim accounts separate, and fall back to real phone numbers when a target refused email verification. I did not want the AI logging into a normal inbox for every account. I wanted email to behave like another research API. I now run three catch-all domains. For each signup, the system creates a new address containing the target, purpose, and timestamp. Nothing needs to be provisioned first. The address exists because the domain accepts everything. That means one target can have separate addresses for attacker, victim, admin invitation, password reset, organization owner, or any other role I need to test. If I revisit the target later, I create another set rather than guessing which old account belongs to which research cycle. Mail for all three domains enters through Cloudflare Email Routing. A catch-all rule sends it to one Email Worker. The Worker reads the raw message, extracts useful fields such as recipient, sender, subject, body, and timestamp, then sends the result to my own receiver over an authenticated webhook. The receiver writes messages into one rolling store and exposes a separate authenticated read endpoint. The write secret and read key are different, so the component accepting mail does not automatically get permission to read it back. The important rule is that AI never asks for the entire inbox. It queries the exact address it created for that test. This turns an otherwise messy shared catch-all into a deterministic part of the run. If the system registered target-attacker-1740000000 on one domain, it polls only for that recipient. An unrelated OTP arriving at the same time cannot be mistaken for the current account. When a message arrives, the AI does not need a visual mail client. It reads the stored RFC822 message, finds the verification URL or newest numeric code, and continues the browser flow. The same path handles account confirmation, magic links, password resets, invitations, change-email confirmations, and email OTP. Raw mail is preserved because the convenience body is not always enough. Real messages are multipart, HTML-heavy, encoded, or wrapped in tracking redirects. Keeping the original source means I can parse it properly when a simple body extraction misses something. I use email first whenever the product allows it. It is cheap, fast, unlimited for practical purposes, and easy to isolate. I can create five accounts for an authorization matrix without consuming phone numbers or waiting for manual inbox work. It also gives the AI a complete chain from signup request to verified session. SMS is the fallback, not the default. Some targets insist on a real mobile number. Others require one only after signup, or they gate a specific feature behind phone verification. In those cases the system can use physical Android devices with active SIMs, or rented non-VoIP US and UK numbers when geography matters. The trigger time is recorded before the code is requested. The system then reads only messages received after that point and extracts the newest matching OTP. This matters because SMS inboxes keep old codes, and blindly taking the first six-digit number is an easy way to lock an account or burn retries. Geography is part of the identity too. A US-only signup should not combine a US browser exit with an Australian phone number unless I am deliberately testing that mismatch. The browser pool already lets me choose a country-specific IP and timezone. The phone-number layer lets the account match that geography when the target enforces it. Email domains also have a fallback order. Some products reject an unfamiliar domain, block a domain after too many test accounts, or apply reputation rules inconsistently. If the primary domain fails, the system moves to the second, then the third. Every domain reaches the same backend, so nothing else in the workflow changes. This infrastructure becomes more useful after registration. Password-reset testing needs controlled access to both accounts and their mail. Invitation testing needs me to prove which address received which organization or role. Change-email testing needs visibility into notifications sent to old and new identities. Magic-link testing needs the original URL, its expiry behavior, and a second session where I can check replay or account binding. For evidence, I can render a real received message locally without loading remote images, scripts, forms, frames, or tracking resources. That gives me a clean screenshot for the report while keeping the evidence genuine. I am showing the message that arrived, not recreating it in a document. The full flow now looks like this. The AI chooses a browser profile and account role. It creates a unique address, registers the account, polls only for that recipient, extracts the link or OTP, verifies the account, and saves the resulting session with the correct role. If email is unavailable, it selects a real number that matches the required country, requests the SMS, reads the newest code, and continues. I only get involved when the product needs human judgment or a step cannot be automated safely. This is not an inbox replacement for its own sake. It is account infrastructure built for testing. The value is not receiving email. The value is letting every research run create traceable identities and reach authenticated product state without losing time to manual verification. #BugBounty #CyberSecurity #TogetherWeHitHarder

• 
  Malte Hedderich (@hedderichpro) reported 22 minutes ago

  Big fan of Cloudflare. Every few weeks they solve another problem for me on the free tier. Today it was Zero Trust. I wanted my dev subdomains behind a real login. Add an application, pick the hostname, allow my email. Five clicks. Now dev.* shows a Cloudflare Access login before the app loads. No auth code.

• 
  TheKillerEdge (@TheKillerEdge) reported 29 minutes ago

  @mark_ppc Brutal because you did everything "right" and still got throttled. Add to the check: after the Cloudflare fix, watch your server logs for a week and confirm GPTBot, ClaudeBot and PerplexityBot are pulling 200s at volume, not just your one curl. A WAF rule can still rate-limit them quietly. You can't get cited by a page the model was never allowed to read. How many sites do you reckon are blocking themselves without knowing?

• 
  FunkyBeatz (@FunkyxBeatz) reported 30 minutes ago

  Small FYI on a sidequest... Stopping the bad guys with Cloudflare: 2,812 malicious requests blocked or challenged in the last month #cloudflare

• 
  m81 (@m81bode) reported 39 minutes ago

  @PhaedraXTeddy @Cloudflare Why does this ***** have maga in his name? His ***** *** would be in prison if he were in America. It’s too bad China is a ********.

• 
  Yoav Tchelet (@yoavtchelet) reported 40 minutes ago

  Spent forty minutes trying to pin down one figure: Cloudflare’s crawl-to-refer ratio for Anthropic’s crawler. What came back: 286,930:1. 38,065:1. 23,951:1. 10,300:1. 4,580:1. All credited to Cloudflare. None linked to it. Two carried identical numbers with identical phrasing, which is copying rather than measuring. Cloudflare’s own current post gives no headline figure and sends you to your own dashboard. It also says Claude app referrals arrive with no Referer header, so the ratios overstate the gap. Not one retelling carries that line. Those articles were written to be cited by AI. Wrong number, ingested, permanent. I work in this. I’ve quoted a blog and felt like an analyst.

• 
  rusa (@rusabuilds) reported 46 minutes ago

  Cloudflare down again?

• 
  Joe Hansen (@joehansen) reported 50 minutes ago

  🚨 Cursor adds Firetiger team to close the loop from writing code to running it in production • The Firetiger team is joining Cursor • Firetiger builds AI agents that monitor software after it ships — watching rollouts, catching regressions, investigating incidents, and feeding findings back to coding agents • Founded in 2024 by Rustam Lalkaka and Achille Roussel (ex-Cloudflare, Twitch, Segment, Twilio) • Goal: agents that can ship a change, observe how it behaves in production, and fix problems when they appear • Firetiger’s work will be integrated across Cursor as part of a broader push toward long-running, context-aware agents This is the logical next step after SpaceX locked in full ownership of Cursor. Writing code is becoming cheap. Making sure that code actually works once it hits production is still expensive and manual. By absorbing a team that specializes in the production feedback loop, Cursor is trying to own the entire cycle - generate, deploy, observe, repair, inside one system. That is the difference between a coding assistant and an autonomous engineering layer.

• 
  unreallulu (@UnrealLuluLdn) reported 51 minutes ago

  @Tibbzzee @Aditya_181105 The cloudflare ai bot drives me insane. It's so insecure and thorough, which is a terrible combination.

• 
  Brant Tedeschi (@BrantTedeschi) reported 53 minutes ago

  @YoungbloodJoe @cPanel Was the main server that hosts cpanel/whm behind cloudflare? Never trust GoDaddy for anything. The IP should never be public facing. So they should never know the real IP address.

• 
  solopath (@pathlessknown) reported 54 minutes ago

  @HotAisle Damn nvm then maybe not meant for you haha It’ll save you money and look pretty with all cloudflare info in real time and secure too

• 
  CryptoGG👨🏻‍🎓 (@CryptooGG_) reported 55 minutes ago

  PAY $0* FOR ALL SUBSCRIPTIONS 😳 Most people don’t realize how quickly small monthly payments add up. ChatGPT — $20/mo Claude — $20/mo Netflix — $23/mo Spotify — $12/mo Notion — $10/mo Adobe — $60/mo Perplexity — $20/mo Cursor — $20/mo That’s roughly $185/month. $2,220/year. And that’s before the subscriptions you forgot you’re even paying for. The good news? You don’t always have to pay the full price. Here are 7 ways to cut your subscription bill: 1. Check for retention offers Before canceling, start the cancellation process. Some services may offer discounts, free months or cheaper plans to keep you. It won’t always work, but checking costs nothing. 2. Use student pricing If you’re eligible, check student plans for services like GitHub, Adobe, Spotify, Notion, YouTube Premium, Google AI and Perplexity. Some require university verification. 3. Compare annual pricing If you know you’ll use something for a year, compare annual vs monthly billing. $20 × 12 = $240. If the annual plan is $200, you save $40. Just don’t buy annual plans for tools you barely use. 4. Check regional pricing Prices can vary by country. If your country has local pricing, make sure you’re getting the price you’re legitimately entitled to. Don’t use fake locations or payment details to bypass restrictions. 5. Replace what you barely use Premiere Pro → DaVinci Resolve Microsoft Office → Google Docs 1Password → Bitwarden Notion Plus → Notion Free / Obsidian Canva Pro → Canva Free Paid local AI → Ollama / LM Studio You don’t need to replace everything. Just stop paying for features you barely use. 6. Stop subscribing to every AI tool You probably don’t need ChatGPT + Claude + Gemini + Perplexity + multiple coding tools. Try free options first: Google AI Studio Hugging Face OpenRouter GitHub Models Cerebras Cloudflare Workers AI Ollama LM Studio Upgrade when you actually need the extra limits or features. 7. Downgrade before canceling Sometimes you don’t need to cancel. You just need a cheaper plan. $20 → $10/month = $120 saved per year. Do that across five subscriptions and you save $600/year. Now look at that $185/month stack again. Cut a few unnecessary subscriptions, downgrade others, use legitimate discounts and replace what you can. Even a 40% reduction saves roughly $888/year. The biggest mistake is treating subscriptions like fixed expenses. Bookmark this and audit your subscriptions this weekend.

• 
  My1 (@nep.one - Misskey) (@My1xT) reported 56 minutes ago

  @_Chrysaetos_ @JoeMerrick @Viking_Hotline I think that might be the smallest problem. You still need to maintain the service to work. And that with the limitations of the 3ds system in mind. You cant just crank it to tls1.3 and slap cloudflare protection on because the 3ds likely can't work with that.

• 
  orlie (@sunglassesface) reported 57 minutes ago

  @acoyfellow @doodlestein @Cloudflare Yeah I read the comment in two ways, not sure what he meant either that's a good thing that it's being 'discussed' or the fact that it was on the front page is a bad thing... Not sure

• 
  Finance District (@FD_XYZ) reported 57 minutes ago

  Cloudflare just opened its network to AI agents: wallets, identities, payments. The company routes a fifth of the internet. When it starts building for agents, and Visa, Mastercard and Stripe are on the same rails, this isn't a crypto trend anymore. Agent payments have gone from an interesting idea to the thing everyone's building.

• 
  cas Ი𐑼 (@casdotxo) reported 59 minutes ago

  @ReisRyougi oh wow i've never done backend stuff good luck with that,, and i had tailscale set up on mine for a while which was nice but i ended up using cloudflare zero trust so i could use a custom domain and share services to people without them needing to install anything on their end

• 
  Vance Vicious (Real, living human being) 🤘😎🤘 (@VanceVicious) reported 1 hour ago

  @XFreeze Unfortunately for me none of the browsers on my pc will let me get to Grok. It keeps saying I'm blocked thanks to Cloudflare. I have asked @Support about this so many times, I can no longer count, but have yet to get a response. Shocking right?

• 
  Jota (@jota__feldmann) reported 1 hour ago

  I'm in love with Cloudflare Durable Objects. They make so much sense for a ton of domains and problems we've spent way too much time frying our brains trying to solve elsewhere.

• 
  Joseph Lorenzo Hall, PhD (@JoeBeOne) reported 1 hour ago

  Cloudflare support traced the 525 to a post-quantum-only origin setting. Cloudflare could offer X25519MLKEM768, but B2 couldn’t negotiate it—and no classical key exchange was available as fallback. The handshake failed before certificate validation. 4/6

• 
  Joel - coffee/acc (@JoelDeTeves) reported 1 hour ago

  How does @Cloudflare not have an SPF flattening service built in yet? They already have one of the best DMARC solutions. And everyone loves Cloudflare DNS. Wouldn't this be a match made in heaven? PS - Cloudflare, I am available to hire as your idea guy. $300k / year USD.

• 
  Sterling Labs (@sl_wire) reported 1 hour ago

  A crawl is a program walking the web on its own, saving a copy of each page to build the pile of text a model learns from. Each page gets taken once. That was 36.40% of AI bot traffic in January 2025 and 44.56% in July. Agent traffic is the other thing, a page fetched right then because you asked, and it was 2.63% last October and 2.65% in July. Nine months flat. Both are shares of AI bot traffic, not of the web. @CloudflareRadar counts this because Cloudflare sits in front of a big share of it, and out on the whole web bots were 34.81% of requests in July against 65.19% human. Agents are at most 0.92% of everything, and that assumes every bot is an AI bot. Call it a third of a percent. The tollbooth is already built. $NET opened Pay Per Crawl in private beta on July 1 at a one cent minimum per successful retrieval, and the network already returns more than two billion payment required responses a day. Its own June investor day line was that the vast majority never become a transaction. Purpose is self declared at registration and nobody audits it, so hold the levels loosely. Anthropic’s crawl to referral ratio fell from about 8,800 requests per referral in April to 2,800 in July, and Adobe measured AI referred retail visits up 138% year over year in May. We are following what the models tell us. The agents aren’t out doing the shopping. Yet.