Cloudflare Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  KalicoShade (@MidKnightKurama) reported 4 minutes ago

  @Labyrinthusian @TutaPrivacy All google or any cloudflare or AWS based website has to do is push a code line that says Is_google_first_party_true.False, if your device returns false, your blocked from ANYTHING that also uses google. Same for cloudflare, same for AWS. You dont even need to be on their service

• 
  Iaroslav Prokhorovich (@i_prokhorovich) reported 5 minutes ago

  Cloudflare is betting on a browser built for AI, not people. Kitesurf runs on Workers and is in beta via Browser Run, aiming to help agents browse, extract data, and complete web tasks with less CPU and memory than Chromium.

• 
  Andre Gironda (@AndreGironda) reported 7 minutes ago

  @chrissanders88 Initially, sight the incoming IPs from the alert, and associated packetry, e.g., naming resolution. A good lookup service for these IPs is Spur because if a threat actor, likely coming from a vpn or proxy service, and one perhaps unique. If CloudFlare tunnel, check with abuse@

• 
  Matt Marx (@marxmatt) reported 9 minutes ago

  @charlietlamb turbify is terrible. prices 5x cloudflare, frequent outages, slow customer website. all transferred

• 
  Chirag Kulkarni (@chiraggkulkarni) reported 10 minutes ago

  Cloudflare's new crawler settings could accidentally kill your Google indexing. Cloudflare is splitting crawlers into three buckets: Search. Agent. Training. The idea sounds simple: Block Training → keep your content out of AI training. Except there's a problem. Googlebot isn't just a “Search” crawler. Google uses the same Googlebot for search crawling and other purposes. It never needed separate bots for these jobs. So if Cloudflare's rules treat that bot as both Search and Training, blocking Training can end up blocking Googlebot too. That means you could be trying to keep your content away from AI training... …and accidentally keep Google away from your site. The instinct to block AI training isn't the problem. The problem is assuming Cloudflare's three-way split maps neatly onto how Google actually crawls the web. Cloudflare is rolling this out as the new default starting September 15. So before you flip that switch, check exactly what you're blocking.

• 
  Donnie Hale (@adhalejr) reported 12 minutes ago

  I so desperately want to use Cloudflare for everything. But: I hate Typescript; the dev platform is unapproachable; and the docs are poor. Want to do something ever so slightly different? Good luck figuring it out.

• 
  Uptimus (@UptimusApp) reported 12 minutes ago

  Aug 10, 2026 at 12:19 UTC: Cloudflare reports the incident affecting the 1.1.1.1 public resolver in Tel Aviv is resolved. The issue lasted 123 minutes, and DNS services are operational.

• 
  Kite AI Community and Ecosystem (@Kite_Frens_Eco) reported 12 minutes ago

  AI answer engines take content from the entire web but no longer send traffic back, hollowing out the foundation of the content economy. In this AI on Air clip, excerpted from a recent episode on the @Bankless show, the speaker is Matthew Prince @eastdakota, co-founder and CEO of @Cloudflare. ▷ The ads-based business model of the internet is approaching its end game: ad blockers had already pushed CPMs into a slow decline, but over the last two years AI has caused a near step-function drop in ad value. ▷ Google's AI overviews, ChatGPT, and Claude are not search engines but answer engines: they strip mine the web and hand users the answer directly, so no one clicks the links. Without eyeball traffic there is no ad revenue, and content creation is either retreating behind paywalls or shutting down entirely. ▷ For users this saves time, but these AI tools run on paid subscriptions. For people in the global south who cannot afford them, the internet is getting smaller, not bigger.

• 
  Dracomenda ⟐ (@DracoMenda) reported 16 minutes ago

  and with things like *** lab, static page containers, wireguard, and OpenWRT, you can do a lot of the same stuff Cloudflare does off an old laptop and a crap router out of your closet.

• 
  The Circuitry (@thecircuitry_) reported 21 minutes ago

  Cloudflare mitigated more than 800 network-layer DDoS attacks exceeding 1 Tbps in Q2, a fivefold increase from the prior quarter.

• 
  Paul (@hasieratik) reported 25 minutes ago

  @alexcloudstar it was an error on my end, to be honest; as I gave it green-light; just didn't think things through :D I've made sure to include in the system prompt instructions to specifically analyse for possible outcomes like these. Cloudflare was nice enough to wipe the bill as I'm an idiot

• 
  Alberto Fernández (@albertofdez20) reported 28 minutes ago

  Cloudflare gave AI agents a wallet this month. A handle, an account wallet holding digital dollars, and a spending cap per agent. Payment runs over x402, the HTTP status code for "payment required" that sat unused in the spec since 1996. The plumbing was there for thirty years. The settlement was not. A subscription assumes a human who forgets to cancel. An agent hits your endpoint four times and leaves. Per use pricing was always the honest model, and it needed a rail cheap enough to charge for one call. That part is done.

• 
  Lorenzo (@lorenzolfm) reported 29 minutes ago

  I've been thinking a lot about the recent @BtcpayServer vulnerabilities over the last few days. IMO, they also shed some light on other architectural and design issues in the application. I want to talk a little bit about them in this post. First, if you run BTCPay Server, please: - Upgrade to 2.4.2. - Rotate your LND credentials if you use LND. Treat the old ones as compromised. Also, I want to make it clear that I have deep respect for the project and its maintainers. I know how hard it is to ship safe software. Sometimes lessons are learned the hard way, and it really sucks when that happens. Okay, back to the topic. Here are some things I think could be improved: 1. Different server bindings for user-facing and admin features The goal of running a BTCPay Server instance is to accept Bitcoin payments. This means you have to expose the application to some network. Either a LAN if the merchant has a physical store, or the internet if it's an online store. As the app works today, exposing your PoS also means exposing all of the admin-facing features of the app. A customer can access /apps/appId to make a payment, but they can also access /login, the page that prompts for a username and password to access the admin interface. This means that users have to go out of their way to block public access to the admin interface. This could mean using local firewall rules if it's a LAN-exposed application, or Cloudflare WAF rules if it's exposed to the internet. And you have to configure those rules correctly. There are plenty of ways to shoot yourself in the foot: you could accidentally block legitimate URLs, forget to block something, or introduce another misconfiguration. This could be easily avoided by having separate server bindings for user-facing and admin-facing features. So instead of users having to worry about firewalls, they could simply expose the PoS binding and not the admin one. 2. Make sensitive features opt-in BTCPay Server has an API that can do almost everything the web UI can: create invoices, manage stores, create payouts, access wallets, etc. This is very useful for tech-savvy people to build custom software on top of the application, but it's a niche use case. Most people will just use what BTCPay Server already provides. From what I could tell on my own instance, there's no way to turn the API off at all. I'd argue this, and other sensitive features, should be opt-in rather than enabled by default. 3. Passwords shouldn't work as API credentials BTCPay Server has a really nice feature that lets you grant 46 different permissions to an API key. But you can also authenticate API calls with your username and password, and that method bypasses all of them. You get everything your account can do. My take is that basic authentication should never have been possible in the first place. An account password is a human credential. An API key is a machine credential. They shouldn't be interchangeable. Machine access should always require a credential that you deliberately created for that purpose. 4. Don't display sensitive data in plaintext When you connect BTCPay Server to a Lightning node, you give it a macaroon. It's sort of like a password with specific permissions baked into it. The problem is that the store settings page displays the entire connection string, including the macaroon, in plaintext. So if someone gets access to your admin UI, they don't need to do anything clever. They open one page and can read your Lightning credential straight off the screen. The same applies if you use a hot wallet. BTCPay Server stores the seed in its database, and you can view it through the UI. Credentials should be write-only. You paste them in once, they get masked, and that's it. If the application really needs to show a credential again, make me re-authenticate first and log the event in the database so it's traceable. 5. Audit Logs. In case **** happens, is very useful to be able to know what exactly happened. Which credential hit what API? When? What was the IP of the caller? Was it an inside job? was it a credential leak? was I drunk and pressed the wrong button? --- Please take all of this with a grain of salt. I had no involvement in building this software or in the decisions that made it what it is today, and it's very likely that some of what I pointed out has a good reason behind it that I can't see from the outside. This is just a comment from a user who is very paranoid about the software he runs. If I could be granted one wish, it would be splitting the customer-facing binding from the admin-facing one. That alone would be a huge security improvement, and it seems like a low enough hanging fruit.

• 
  Matviy (@matviy) reported 31 minutes ago

  @svpino How will that apply to logic with customer data or third-party API calls billed per call? Sure, you’ll find out it doesn’t work in the logs or maybe with a new shiny fat bill. But the bill could easily go into thousands, or customer trust is gone. No one who is “pro-code review” says the whole thing should be read and reviewed. What we are arguing is that key areas of the code must be checked because the cost of going wrong is very high. Literally a few days ago a guy wrote a viral post about how he was charged $8k by Cloudflare because his code had a loop in the wrong place.

• 
  Onramp (@OnrampBitcoin) reported 34 minutes ago

  "Attackers now iterate faster than our team can find and patch." That is Boltz, in their own notice, explaining why they pulled their service offline. New Final Settlement with @BackslashBTC, @MTanguma and @Lnelson_21: 🔶 Roughly 2,000 BTC swept from wallets with weak entropy, three separate advisories in a month, and why Bitcoin itself being untouched is the distinction that matters 🔶 China's top open model broke out of a sealed test environment. The same category of failure already reported at OpenAI and Anthropic 🔶 Agent traffic on the internet has passed human. Cloudflare expects a thousand to one within five years 🔶 An AI agent cancelled a stranger's gym booking to move its owner up the waitlist, then could not undo it 🔶 The Clarity Act stalls until at least mid-September