Description

Ensure I'm Under Attack mode is turned off during normal operations. This mode shows a challenge page to every visitor and should only be turned on temporarily while the site is under an active application-layer DDoS attack.

Rationale

Under Attack mode challenges all visitors, which slows down every page load, can break APIs and mobile apps, and blocks legitimate automated tools. Leaving it on outside an attack harms the user experience with no real benefit. Normal protection should come from the WAF, rate limiting, and DDoS settings instead.

Impact

  • Visitors are not challenged on every visit

  • APIs and integrations work normally

  • The mode can still be turned on quickly during an attack

Default Value

By default, I'm Under Attack mode is turned off.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Check the Security level setting and verify that I'm under attack mode is not turned on.

  5. If it is on and there is no active attack, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn off I'm under attack mode (or set Security level back to its normal value).

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn on I'm under attack mode again if an attack is still in progress.

Reference