# Ensure Under Attack Mode is disabled during normal operations

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787220365473-ensure-under-attack-mode-is-disabled-during-normal-operations
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure I'm Under Attack mode is turned off during normal operations. This mode shows a challenge page to every visitor and should only be turned on temporarily while the site is under an active application-layer DDoS attack.

**Rationale**

Under Attack mode challenges all visitors, which slows down every page load, can break APIs and mobile apps, and blocks legitimate automated tools. Leaving it on outside an attack harms the user experience with no real benefit. Normal protection should come from the WAF, rate limiting, and DDoS settings instead.

**Impact**

-   Visitors are not challenged on every visit
    
-   APIs and integrations work normally
    
-   The mode can still be turned on quickly during an attack
    

**Default Value**

By default, I'm Under Attack mode is turned off.

**Pre-Requisites**

-   Cloudflare account with Administrator or Firewall permissions for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Check the Security level setting and verify that I'm under attack mode is not turned on.
    
5.  If it is on and there is no active attack, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Turn off I'm under attack mode (or set Security level back to its normal value).
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Turn on I'm under attack mode again if an attack is still in progress.
    

**Reference**

-   [https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/](https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/)
    
-   [https://developers.cloudflare.com/security/settings/](https://developers.cloudflare.com/security/settings/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.