Cloudflare Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Alex Garcia (@alex_here_now) reported 13 minutes ago

  hey someone at cloudflare recently tweeted about interconnected agents succeeding to ship a thing across companies, can anyone help me relocate that

• 
  berkay (@berkay_digital) reported 15 minutes ago

  @getdokploy concurrent builds are huge, as well as the DNS feature. I hated that extra step where i needed to login to Cloudflare just to point a subdomain to the correct ip

• 
  Mykyta Pavlenko (@mktpavlenko) reported 15 minutes ago

  @Shpigford @Cloudflare an spf fix that fast is absurdly satisfying

• 
  Onramp (@OnrampBitcoin) reported 19 minutes ago

  More of the internet's traffic is now agents than humans. Cloudflare expects a thousand to one within five years. The whole web runs on you showing up to look at an ad. If a model reads the page for you, nobody shows up and nobody gets paid. The fix has been sitting there unbuilt since the nineties.

• 
  Paul Michael (@paulmichaeldev) reported 22 minutes ago

  @iuditg That's not an SSL expiry, that's an SSL misconfiguration. It's also Atlassian's problem, not Anthropic. I've read your replies and I get your frustration, but how do you deal with a 3rd party dropping the ball with one of your startups? And do you blame all of the individual companies when CloudFlare shits itself causing half of the Internet to go down?

• 
  Nnamdi | Webflow Developer (@Chris_ogbona) reported 24 minutes ago

  @therealnnamani Cloudflare is better I in terms of global performance, it's mostly the go-to platform for web hosting etc. if cloudflare goes down just know almost the entire Internet is going with it bro🥲 And also they offer other services aside just hosting especially their security

• 
  Ericson Smith (@ericson4smith) reported 25 minutes ago

  @remotecleanguy Explore if you can do some edge caching with Cloudflare. We found that a major ISP in Bangkok had serious routing issues at night. Our servers are in the USA and our customers are in Bangkok. Edge caching solved the whole problem for our most important service pages.

• 
  Lý Quang Tùng (@LQuangT60430837) reported 25 minutes ago

  Hi @Cloudflare, I'm being wrongly billed for R2 storage deleted a year ago. Opened ticket 02264237 a week ago with no reply, and my account faces suspension on 26/08. Can someone please escalate this to the support team? Thanks! PS: Past tickets were never answered either.

• 
  Alex @Bickov (@bickov) reported 27 minutes ago

  Found out this week that Cloudflare was telling ClaudeBot, GPTBot and every other AI crawler to stay off my site. I never set that. A default toggle was writing my robots.txt for me and I had no idea

• 
  Cortney Fletcher (@cfletcher24) reported 27 minutes ago

  @CloudflareHelp URGENT @CloudflareHelp — BUSINESS-CRITICAL ACCOUNT LOCKOUT. We are a paying Cloudflare customer and have suddenly lost access to our account. Password/email recovery emails are not arriving.

• 
  andreasPappas (@PappySendsIt) reported 28 minutes ago

  @Jilles @SkywardAdi @Cloudflare we forgive you. I just scrambled to it as well. But, I did get [myname].dev for 12 bucks... not awful

• 
  Marius du Preez (@mdp_sec) reported 30 minutes ago

  A lot of people have asked how the browser side of my AI bug bounty system works. It is probably the part people struggle with most because giving a model browser access is easy. Giving it browser access that can survive real signup flows, CAPTCHA, anti-bot systems, authenticated testing, multiple accounts, and concurrent hunts is a completely different problem. I currently run 100 persistent headed Chrome profiles on the same server as the rest of the research system. They are not disposable Playwright sessions and they are not clean profiles created for every target. Each one has its own Chrome user directory and keeps its cookies, local storage, history, consent state, challenge cookies, saved sessions, and anything else the browser normally accumulates. That means a profile becomes more useful over time. If it has already passed a Cloudflare challenge, accepted a consent banner, signed into Google, or built normal browsing history, that state is still there when it starts again. Four profiles also have their own Google accounts signed in for targets where normal registration is blocked and social login is the only realistic path. Every profile has a fixed Webshare IP. The pool is currently split into 50 US profiles, 20 UK, 10 Australia, 10 Germany, and 10 Singapore. When a target needs a specific country, the system leases a free profile from that range. If geography does not matter, it selects a free profile from the full pool. The same profile returns through the same IP rather than changing exit every request. That matters because the target is not looking at the IP in isolation. It sees the IP, country, timezone, cookies, account history, challenge state, and browser storage together. Keeping an old session while rotating through a different country every few minutes creates more problems than it solves. Chrome also starts with a timezone that matches the profile's exit country. This is done at process level, so Date and Intl behave natively. I am not patching the timezone in JavaScript after the page loads. I do not assume a proxy is good because the provider sold it as residential. All 100 assignments are checked against the live provider inventory. Traffic is sent through every assigned proxy to confirm the actual exit IP and country with Cloudflare. The IPs are also checked through ip-api, ProxyCheck, and Scamalytics so I can compare geography, proxy flags, hosting flags, blacklist data, and fraud risk. Those services disagree more often than people probably expect. A live Australian exit can be routed correctly while one older database still reports another country. One provider can call an IP residential while another calls it business or hosting. The audit records those disagreements and tracks changes over time. It does not automatically replace an IP because one service returned a bad-looking label. Each browser is fully headed. When a profile starts, it gets its own isolated 1920x1080 virtual display, its own small window manager, and its own noVNC connection. The 100 browsers do not share one desktop, so one profile cannot steal focus, resize another browser, or put a window over another hunt. Most of the time the AI drives Chrome through CDP. Each profile has a known CDP port, so the research phases can attach to the existing tab, navigate, inspect the DOM, fill forms, upload files, execute JavaScript, read console output, extract cookies, and capture screenshots. But because it is headed Chrome, I can open the exact same profile from my dashboard at any time. If a login needs MFA, a consent manager is stuck inside a cross-origin iframe, a CAPTCHA does not solve, or something on the page needs human judgment, the system surfaces the profile that needs attention. I open it through noVNC, complete that step, and close the viewer. The browser itself never moved. The same account, IP, cookies, tab, traffic, and authenticated state remain available to the AI when it continues. Every profile also has NoPECHA installed for reCAPTCHA, hCaptcha, Turnstile, Cloudflare challenges, and Geetest. Running the extension across 100 persistent profiles created its own reliability problem. An extension can be installed but missing its API key, missing its stored settings, disabled in the profile, or waiting for Chrome to download its code. Before a profile starts, the lifecycle manager checks the extension files, settings database, preferences, API configuration, and toolbar state against a known working copy. If anything drifted, it repairs the profile while Chrome is stopped. The automation also knows the solver may be clicking inside a challenge, so it waits for the challenge to clear instead of sending CDP input at the same time and breaking it. Normal browser traffic goes through a separate mitmproxy instance for each profile. The route is Chrome, then the profile's MITM, then its fixed Webshare proxy, then the target. Each browser writes to its own flow file, so traffic from two hunts is never mixed together. This is what makes the browser useful for more than navigating pages. The AI can register an account, perform one normal action, and capture the exact requests the real product generated. That includes OAuth redirects, token refreshes, GraphQL operations, multipart uploads, presigned storage requests, CSRF headers, service-worker traffic, and APIs that were never obvious from static recon. Once a valid request exists, the system decides whether it still needs the browser. Most API testing is faster through curl or a script using the browser's authenticated state. IDOR matrices, parameter tampering, injection, race conditions, and mass assignment do not need a UI click for every payload. If a request depends on rotating browser state, a service worker, SPA middleware, or page context, it can be executed inside the existing tab through CDP instead. There is also a no-MITM mode. Some anti-bot systems fingerprint TLS at the edge. Akamai is a good example. Chrome can look normal in JavaScript, but once mitmproxy terminates TLS, the target sees a different network fingerprint and refuses to validate the browser session. For those targets I switch that profile to a small authentication-forwarding tunnel. Chrome still uses the same fixed Webshare IP, but its TLS passes through without being decrypted. I lose traffic capture for that session, but the target sees native Chrome TLS and the login flow works. This is why CAPTCHA, JavaScript fingerprinting, TLS fingerprinting, and IP reputation cannot all be treated as the same browser problem. Each layer has a different fix. Profiles are leased to an exact platform, target, research cycle, and role. Two agents are never allowed to drive the same profile because tabs share cookies, storage, account state, and the same MITM file. Sharing a browser would create fast progress that nobody could trust. When a profile starts, the lifecycle manager archives its previous live capture, checks the exit configuration, fixes stale ports from crashed processes, clears only Chrome's crash-restore markers, verifies the CAPTCHA extension, starts the display, MITM, Chrome, and runtime support, waits for CDP, then records who owns it. When it stops, Chrome closes but the user directory remains. The profile keeps the state that made it useful. Inactive profiles are also included in an encrypted daily backup because recreating Chrome is easy. Recreating months of browser state and authenticated sessions is not. That is the browser stack. The model gets CDP access, but CDP is only one part of it. The useful system is persistent identity, fixed and measured egress, headed Chrome, isolated displays, CAPTCHA handling, traffic capture, native-TLS fallback, human takeover, ownership, and recovery working together. Without those layers, AI spends half the run fighting the environment and then reports the environment failure as target behavior. And yes this is a massive read #BugBounty #CyberSecurity #TogetherWeHitHarder

• 
  Bree Sharp | Web Developer & Tech SEO Consultant (@bree_sharp) reported 31 minutes ago

  @aakashgupta Most of the small sites on Cloudflare aren't publishers angry at Google. They're service businesses that need Google and have never looked at a bot management setting in their life. September 15 is going to feel like a traffic drop that came from nowhere.

• 
  ./ivan (@sloaxleak) reported 32 minutes ago

  @a_shimanski @Namecheap @Cloudflare Haha. Or just pay for a reliable email service: Google Workspace, Microsoft 365, or a Proton subscription with a custom domain. There are options. I love Cloudflare, but not everything needs to be solved by them

• 
  Saint John: Evernode 1:1 Freedom (@AverageJohnEVR) reported 33 minutes ago

  @CyberTechWolff The next generation issue we will have is cookieless tracking/analytics Imagine cloudflare centralizing half the internet and store masked data from it They would be able to brainwash the world that way, with the right set of programming they can get someone to do anything they want We need a decentralized internet where segmenting isn't done, where humanbeings aren't treated as cattle....