Cloudflare Under Attack Mode is a fast way to increase protection when a site is being hit by suspicious traffic or an active DDoS attack.
This guide explains how to enable Cloudflare Under Attack Mode, what it does behind the scenes, and the limits you should know before you switch it on.
What Cloudflare Under Attack Mode does
Under Attack Mode is a security setting in Cloudflare that adds an intermediate JavaScript challenge before visitors can reach your website.
Instead of sending traffic directly to your origin, Cloudflare verifies the browser first, which helps block many automated bots, scrapers, and malicious requests.
This feature is most commonly used during Layer 7 attacks, where the attacker tries to overwhelm a website with HTTP requests rather than raw bandwidth.
It is also useful when a site suddenly sees a spike in suspicious traffic from data centers, botnets, or repeated login attempts.
- Shows a browser verification challenge before access is granted
- Filters out many non-browser bots and simple scripts
- Helps protect websites during short-term attack events
- Can reduce load on the origin server quickly
When should you use Under Attack Mode?
Use Under Attack Mode when your site is under active pressure and you need an immediate defensive layer.
It is not a permanent setting for normal operations because it affects every visitor who is not already trusted or exempted.
Common situations include:
- A sudden spike in requests from unknown sources
- An application-layer DDoS attack targeting your homepage, login page, or API
- Repeated scraping that is slowing down your server
- Temporary risk after publishing a sensitive page or making a public announcement
It is less appropriate for routine traffic management, content delivery, or standard bot mitigation.
For those cases, Cloudflare Bot Management, WAF rules, rate limiting, and firewall rules are usually better choices.
How to enable Cloudflare Under Attack Mode
To enable Cloudflare Under Attack Mode, you need access to the Cloudflare dashboard for the site you want to protect.
The process takes only a few clicks, but it is important to confirm that Cloudflare is already proxying your traffic through the orange cloud DNS record.
Step 1: Sign in to Cloudflare
Log in to your Cloudflare account and select the domain you want to protect.
If the domain is not active in Cloudflare yet, you will need to add it and complete DNS setup first.
Step 2: Open the Security section
In the dashboard, go to the security controls for the selected zone.
Cloudflare’s interface changes over time, but the setting is typically located under a security or overview page where quick protection options are displayed.
Step 3: Turn on Under Attack Mode
Look for the setting labeled Under Attack Mode or a similar one-click protection option.
Toggle it on to activate the challenge page for incoming visitors.
Once enabled, visitors will see a brief security check before entering the site.
Cloudflare evaluates whether the browser can pass the challenge, which helps separate real users from simple automated traffic.
Step 4: Verify your site behavior
After enabling the mode, test your website from a normal browser and from a separate network if possible.
Check that your critical pages still load and that trusted users can access the site without unnecessary friction.
Step 5: Monitor logs and analytics
Use Cloudflare analytics, firewall events, and origin server logs to determine whether the attack is slowing down.
Watch for blocked requests, challenge completion rates, and any unintended access issues for legitimate visitors.
What happens after you turn it on?
After you enable Cloudflare Under Attack Mode, most visitors will see a browser challenge page for a few seconds.
Cloudflare checks the client before allowing access, and visitors with clean browser behavior usually continue automatically.
Some users may experience extra friction if they use privacy tools, disable JavaScript, or rely on strict browser settings.
Automated tools, basic scrapers, and many attack scripts are more likely to fail the challenge.
- Cloudflare inserts an intermediate verification page
- Legitimate browsers usually pass within seconds
- Non-browser traffic is often blocked or delayed
- Origin server load can drop quickly during an attack
Best practices before enabling the mode
Before turning on Under Attack Mode, make sure the rest of your Cloudflare configuration is ready.
The feature is effective, but it works best when combined with other security controls.
Confirm your DNS records are proxied
Under Attack Mode protects traffic that goes through Cloudflare’s proxy.
If a DNS record is set to DNS only, traffic can bypass Cloudflare and reach your origin directly.
Whitelist essential services
Check whether monitoring tools, payment processors, email service callbacks, or partner integrations need access.
If necessary, create firewall rules or allowlists so those systems are not interrupted.
Prepare for reduced user convenience
Expect some legitimate visitors to report a delay or extra verification prompt.
This is normal during an attack response, but it can affect conversion rates, especially on e-commerce or media sites.
Have a rollback plan?
Decide in advance when you will disable the mode.
Once the attack subsides, you may want to switch back to standard protection to reduce friction for ordinary visitors.
How long should you keep it enabled?
Keep Under Attack Mode enabled only as long as needed to mitigate the incident.
For many sites, it is a temporary response that lasts minutes, hours, or a short period while traffic patterns stabilize.
If the attack persists, review Cloudflare firewall events, rate limiting rules, and origin-side protections.
A long-running incident may require more specific mitigation than a broad challenge page alone.
Common limitations to know
Under Attack Mode is helpful, but it is not a complete defense strategy.
Advanced attackers can sometimes adapt, and some legitimate users may be affected more than expected.
- It can inconvenience real users, especially on older devices or restrictive browsers
- It is not ideal for APIs, mobile app traffic, or machine-to-machine requests
- It does not replace WAF rules, bot management, or origin hardening
- It may not stop sophisticated distributed attacks on its own
If your site relies on API traffic, consider using narrower Cloudflare firewall rules or authenticated access instead of enabling a sitewide challenge.
The goal is to reduce attack impact without breaking essential functionality.
How to disable it safely
When the threat has passed, return to the Cloudflare dashboard and turn Under Attack Mode off.
Then confirm that normal pages load without delay and that any custom rules you added during the incident are still appropriate.
After disabling it, continue monitoring traffic for a short time.
Attackers sometimes shift tactics after an initial defense is removed, so it is useful to keep an eye on request spikes, error rates, and challenge logs.
Alternatives to Under Attack Mode
If you need more targeted control, Cloudflare offers several alternatives that may fit better than a sitewide challenge.
- WAF rules: Block or challenge traffic based on IP, country, headers, user agent, or request path
- Rate limiting: Restrict repeated requests to sensitive endpoints like login or search
- Bot Management: Detect and classify automated traffic more precisely
- Firewall rules: Allow, block, or challenge traffic using custom logic
- Managed Challenge: Apply a lighter verification step to suspicious requests only
These tools can be combined with Under Attack Mode during a serious event, or used instead of it when you need finer control.
Quick checklist for using Cloudflare Under Attack Mode
- Confirm the site is proxied through Cloudflare
- Enable Under Attack Mode in the Cloudflare dashboard
- Test access from a standard browser
- Monitor analytics and firewall logs
- Whitelist critical integrations if needed
- Disable the mode once the attack ends
Knowing how to enable Cloudflare Under Attack Mode can help you respond quickly when your website is targeted.
Used correctly, it buys time, reduces origin strain, and gives you room to apply more precise protections.