11 ms·

Do not put your site behind Cloudflare if you don't need to

• thoroughburro 11mo ago
  [flagged]
• thejazzman 11mo ago
  I think the big error here is thinking cloud flare is DDoS when it’s an entire self contained platform with workers and pages etc.. You’d see those same errors if someone took their own site down while working on it , probably accidentally
• zikero 11mo ago
  If we're talking about putting static assets (like basic websites) on their CDN, or moving your backend to Workers, (etc...) you are by definition moving _away_ from single point-of-failure. > Maybe that's the core of this message. Face your fears. Put your service on the internet. Maybe it goes down, but at least not by yet another Cloudflare outage. Well I'd rather have my website going down (along with half the internet) be the concern of a billion dollar corporation with thousands of engineers - than mine.
  • shiandow 11mo ago
    That's a bit like the 'nobody was fired for choosing Oracle' argument, but it does make sense. Still a bit weird to pretend we now have cyber weather that takes our webpages down.
    • MattGaiser 11mo ago
      > That's a bit like the 'nobody was fired for choosing Oracle' argument, but it does make sense. The reaction to AWS US-East-1 going down demonstrates this. As so many others were in the same boat, companies got a pass on their infrastructure failing. Everyone was understanding.
    • julianozen 11mo ago
      Definitely has similarities. I think we do not realize how most top websites and services rarely go down anymore, and we use them 100 times more than we did 20 years ago. Building your own networking, compute, storage, CDN, or database solutions to avoid dependencies on AWS or Cloudflare would almost certainly lead to more service downtime than relying on highly sophisticated third parties. But now, when one of these services breaks, everything on the internet goes down. And it is a lot easier to explain to your director of engineering that the whole internet is down than to say that your custom home-rolled storage system fell over, or whatever esoteric infrastructure failure you may run into doing it yourself.
  • greengreengrass 11mo ago
    > you are by definition moving _away_ from single point-of-failure Depends on the frame of reference of “single point-of-failure”. In the context of technical SPOFs, sure. It’s a distributed system across multiple geographies and failure domains to mitigate disaster in the event any one of those failure domains, well, fails. It doesn’t fix that technology is operated by humans who form part of the sociotechnical system and build their own feedback loops (whose failures may not be, in fact are likely not going to be, independent events). SPOFs also need to contemplate the resilience and independence of the operators of the system from the managing organisation. There is one company that bears accountability for operating CF infra. The pressures, headwinds, policies and culture of that organisation can still influence a failure in their supposedly fully distributed and immune system. For most people hosting behind Cloudflare probably makes sense. But you need to understand what you’re giving up in doing so, or what you’re sacrificing in that process. For others, this will lead to a decision _not_ to use them and that’s also okay.
  • Justsignedup 11mo ago
    Yuuuuup. We once had a cloudflare outage. My CEO asked "mitigate it" I hit him back with, okay, but that'll take me weeks/months potentially, since we're tiny, do you really want to take away that many resources just to mitigate a once every few years half the internet is down issue? He got it really quickly. I did mitigate certain issues that were just too common not to, but when it comes to this sort of thing, you gotta ask "is it worth it" Edit: If you're so small, cloudflare isn't needed, then you don't care if you go down if half the internet does. If you're so big that you need cloudflare, you don't wanna build that sort of feature set. The perfect problem.
    • papichulo2023 11mo ago
      Is it removing cf as the middleman temporally such a big deal?
      • nijave 11mo ago
        I think that really depends on feature usage. You can use Argo/Cloudflare tunnels to route to private backends that are normally unroutable. In such a setup, it might be quite difficult to remove Cloudflare since then you have no edge network and no ability to reach your servers without another proxy/tunnel product. If you're using other features like page rules you may need to stand up additional infrastructure to handle things like URI rewrites. If you're using CDN, your backend might not be powerful enough to serve static assets without Cloudflare. If your using all of the above, you're work to temporarily disable becomes fairly complicated.
      • bastawhiz 11mo ago
        It depends. The site is up, but now you're pumping 10x/100x the traffic. What are you scaling up? Suddenly you're not blocking bots or malicious traffic. How many spam submissions or fake sales or other kinds of abuse are you dealing with? Is the rest of your organization ready to handle that?
    • otabdeveloper4 11mo ago
      Afaik, Cloudflare is mostly used for anonymity and privacy, not for scale. DDoS protection is one nice side effect of privacy, but I'd imagine there are others too.
  • dizhn 11mo ago
    I just paused cloudflare on a site of mine. On a normal day, it would be pretty easy to unpause it if it gets hit by a DDOS. Now cloudflare is down and the site is up again. Small sites do not benefit much from the performance effects of cloudflare either. Site won't be in their cache.
  • rozap 11mo ago
    Nice, yea as long as the problem is someone else's then that's just as good as there being no problem at all.
  • TZubiri 11mo ago
    > yet another Cloudflare outage. Are these common? I guess by using cloudflare you are pooling your connection with other services that are afraid of being ddosed and actively targetted, whether by politics or by sheer volume. Unless you have volume or political motivations, it might be better not to pool, (or to pool for other purposes)
• MallocVoidstar 11mo ago
  > As they say in security, "no one will burn a zero day on you!". For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" The last I saw you can hire DDoS as a service for like $5 for a short DDoS, and many hosts will terminate clients who get DDoSed.
  • shaky-carrousel 11mo ago
    And many hosting platforms will fight with you the DDoS. I'd rather choose wisely my hosting company.
• arend321 11mo ago
  I'm waiting for my first DDoS attack at which point I will hide behind Cloudflare. I have all the bits in place to make that a smooth transition but would hate every aspect of it.
  • zenmac 11mo ago
    Depending on who your ISP is, there may be things they can do to help.
• xacky 11mo ago
  I don't consider Cloudflare part of the "real" internet anymore, instead it's a private intranet that got too big.
  • zoeysmithe 11mo ago
    This is my worry. What is cloudflare exactly? What regulations are they under? Am I and my privacy protected? How much of my privacy do I need to give up for whats essentially part of a protection racket, be it intentional or not. What happens when I use their SSL, can they sniff my packets? What intelligence and law enforcement do they work with? As someone with vulnerable and targeted identities its a lot harder to hand over my autonomy to what's essentially the modern 1980s IBM or whatever. This is a closed for-profit company that exists to maximize shareholder value, not protect me. Its incredible we took a decentralized model and centralized it with things like cloudflare and social media. I think we need pushback on this somehow, buts hard right now to see how its possible. I think the recent talk about federation has been helpful and with the world falling into right-wing dictatorships, this privacy and decentralization is more important than ever.
    • SirHumphrey 11mo ago
      Cloudflair is what happens when a platonic idea of the internet clashes with market realities. All the questions posed are very important but most websites are run by businesses with motives about as pure as Cloudflair’s. As for people… A programming club I attended is filled with people who run homelabs, use Linux and generally dislike anything corporate. The project to switch communication of discord is now more than a year old. I do feel sometimes that resistance against corporate internet is futile.
      • rcxdude 11mo ago
        Cloudflare is what happens when the internet as a platonic idea fails to come up with a sensible answer to ddos attacks. When there's no pipe fat enough to take the traffic a moderate DDoS can bring to bear, you need means of filtering in a distributed fashion, and in way the internet is organised that takes connections and hardware which are essentially impossible for a small operation to muster.
• mariopt 11mo ago
  Enterprise self hosting is an expensive nightmare for most companies. I think it is time to discuss multi cloud deployments to escape outages. I am hosted on Cloudflare but my stack is also capable of running on a single server if needed, most libraries are not design with this in mind. I’m also wondering if all these recent outages are connected to cyber attacks, the timing is strange.
• neya 11mo ago
  The lesson I learned is it's OK to put your site with Cloudflare. It's not ok to put your DNS on a registrar who is also on Cloudflare. We got locked out because our registrar is also on Cloudlfare, and now I can't even switch DNS to get the site back up. Keep your domain name registrar, DNS service provider and application infrastructure provider separately.
  • mariopt 11mo ago
    Fair point but you also get exposed if the dns provider has an outage. Self hosting will also bring its own set of problems and costs.
    • thyristan 11mo ago
      Traditional non-cloud, non-weird DNS providers have sufficiently long TTLs, not the "60 seconds and then it's broken" crap that clouds do to facilitate some of their services. Something like TTL 86400 gets you over a lot of outages just because all the caches will still have your entries.
      • npn 11mo ago
        Only for you use case. I use cloudflare for my dynamic ip dns, caching that long make it worthless.
        • thyristan 11mo ago
          Yes, of course. But you usually don't put your important webserver doing bazillions of requests per short interval on dynamic IPs. Especially if you need to avoid any downtimes.
    • cj 11mo ago
      You can switch DNS providers if you're able to edit the domain's nameservers. You can also separate your DNS provider from your registrar, so that you can switch DNS providers if your registrar is still online.
    • 11mo ago
• fionic 11mo ago
  Cloudflare tunnels makes it dead simple these days. Like some others in the comments it seems; I'd rather Cloudflare fighting the war against hacker armies than me. Once our networks become compromised from opening our firewalls (possibly even not) our routers and IOT devices become unwillingly complicit in the army that's bringing the internet down.
  • shaky-carrousel 11mo ago
    Those aren't hacker armies, those are just windmills.
    • fionic 11mo ago
      Part of a network actively coordinating ddos attacks ? https://techcommunity.microsoft.com/blog/azureinfrastructureblog/defending-the-cloud-azure-neutralized-a-record-breaking-15-tbps-ddos-attack/4470422 https://techcommunity.microsoft.com/blog/azureinfrastructure... I would have shared bleeping computers blog post about the same attack but it's behind Cloudflare haha
• ZeroConcerns 11mo ago
  Fun fact: a whole bunch of local (as opposed to global: the distinction here is important) Cloudflare-related outages were caused by exactly this thinking: see https://blog.cloudflare.com/going-bgp-zombie-hunting/ https://blog.cloudflare.com/going-bgp-zombie-hunting/ and related HN discussion at https://news.ycombinator.com/item?id=45775051 https://news.ycombinator.com/item?id=45775051 But yeah, if you don't need Cloudflare, like, at all, obviously don't use them. But, who can predict whether they're going to be DDOS-ed in advance? Fact is, most sites are better off with Cloudflare than without. Until something like this happens, of course, but even then the question of annual availability remains. I tried to ask Claude how to solve this conundrum, but it just told me to allow access to some .cloudflare.com site, so, ehhm, not sure...
  • PunchyHamster 11mo ago
    one DDOS won't kill your business, and you can just turn on cloudflare after that happens, if it ever happens.
    • codegeek 11mo ago
      But imagine right now vs you only being down. It sucks right now but most customers are aware of why and we can just say "hey its everyone, just not us". If you had a DDOS attack only on you, imagine dealing with customers then. It is a double edged sword.
      • TrickyRick 11mo ago
        Being able to link to a BBC article (Or whatever major news source you prefer) to a customer is the best type of outage. "Look, this is so big it made the news - this isn't our fault"
    • DoctorOW 11mo ago
      Honestly I'm sure I'll get some eye rolls here, but that's my compromise. DNS through Cloudflare, orange cloud if and when I need to.
    • 11mo ago
• stabbles 11mo ago
  The xkcd comic does not apply. Goes to show that a very big block holding everything is equally bad.
• adityar 11mo ago
  Using cloudflare really helps cut the bandwidth bill for free for smaller self-hosted sites. That was my primary motivation - not security.
• quest88 11mo ago
  The lesson for me here is the round robin DNS configuration. I had an issue with the theme of your site probably not being important anyway. If your site probably isn’t important then it’s probably ok that it’s down too.
• throwaway150 11mo ago
  > For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a service. Sometimes people do DDoS your small blog because some random stranger didn't like something you said somewhere online. Speaking from experience. Very much the reason I'm posting this with a throwaway account. If your website receives DDoS, your hosts will take down your server. Nobody wants to be in this situation even if for a personal, small blog.
  • phyzome 11mo ago
    If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger? I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?
    • throwaway150 11mo ago
      > I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run circles around their support staff to bring back the website up again, then I guess, you don't have a problem. It's nice that you don't care. (Honestly speaking. Not being sarcastic at all.) Personally, I wouldn't mind DDoS on my personal site if the problem was just the DDoS. Unfortunately, mostly it isn't. A DDoS has other repercussions which I don't want to deal with exactly because it's a personal site. I just don't want to spend time with customer support staff to find out if and when I can bring my website back up again. DDoS on my personal website by itself isn't all that bad for me. But having to deal with the fallout is a pain in the neck.
• theideaofcoffee 11mo ago
  Unless these sites are your personal pages, oftentimes these decisions to use cloudflare or not are made by the business and money and risk people, not by the operations and other technically-minded employees. They see every other site using cloudflare and ask why they aren't as well. "No one was fired for buying IBM (or cloudflare)." Fat chance arguing against the people holding the purse strings.
• zitterbewegung 11mo ago
  How is this article anything other than advice on "you shouldn't have a single point of failure "?
  • hddherman 11mo ago
    In the current context, isn't Cloudflare a single point of failure?
    • davidmurdoch 11mo ago
      Many things probably went wrong at cloudflare for this to happen. So yes, but also no?
• codegeek 11mo ago
  Cloudflare is still down and now its been 5+ hours. Having said that, the thing about "if you don't need to" is not that simple. FOr personal sites/blogs, I can agree but then it really doesnt matter for those. For a real business, the value of cloudflare (As centralized as it gets) is the proxy especially against attacks. The other stuff like CDN/Caching etc are bonus on top. Unless there is a better option, just asking real businesses (no matter how small) to not use cloudflare is not an option.
  • beaker52 11mo ago
    5+ hours. It's amusing to reflect on all the "leaders" I've seen jumping on people's heads because a single feature of some unknown product was unavailable for 30 minutes.
    • zahlman 11mo ago
      The outrage over, for example, https://github.com/pypa/setuptools/issues/4910 https://github.com/pypa/setuptools/issues/4910 was far more swift.
  • NorwegianDude 11mo ago
    It is an option. You can run without cloudflare, and if you ever need filtering then you just swap over with little downtime.
• reconnecting 11mo ago
  tirreno guy is here. Don’t trust your traffic to autopilot, get a it back in your hands, take a look into your bots (1), perhaps there is no real need for CloudFlare at all. 1. https://github.com/tirrenotechnologies/tirreno https://github.com/tirrenotechnologies/tirreno
• lousken 11mo ago
  Cloudflare is nice for things like ZTNA, but only a very few need to use their caching services, 90% are just lazy devsoops people
• comrade1234 11mo ago
  The one time my company suffered a denial-of-service attack we were able to get support from our colo provider to stop the attack. This was years ago and our provider has been bought a couple of times and while the company has grown the staff are more remote and fewer in number so I'm not sure if we'd get the same support today. So, every now and then I think about at least putting our assets on a cdn with the option of using it in the case of a ddos attack but then I see things like today and the recent Aws problems and I just get the feeling I should keep everything close.
• Ensorceled 11mo ago
  All the sites that I'm personally aware of are either NOT behind Cloudflare, are large and targeted, or are behind Cloudflare because they have actually experienced a DDOS attack(s). I don't know of anyone that is just sticking themselves behind Cloudflare willy-nilly.
• herbst 11mo ago
  I get constantly attacked. Usually it's big actors like Facebook, Azure and OpenAI who bombard my servers without any respect or logic. I need to update my access rules constantly to keep them away (using Cloudflare) Sometimes it's clustered traffic, more classic DDoS, from China, Russia or America. That I could easily filter with the DDos protection from my hosting (which is cheaper than cloudflare anyway) What should I do if not Cloudflare to block with "complex rules" that is strong enough to survive hundreds of concurrent requests by big companies?
  • hat_monger 11mo ago
    The market has spoken, you are not needed.
    • deleted 11mo ago
      [deleted]
    • herbst 11mo ago
      Because big companies can't stop looking at my website ("borrow" my content for their AIs I guess) constantly? Makes sense
  • 52-6F-62 11mo ago
    There are other CDNs out there with less surface area, but the corollary being they are less of a target.
  • udev4096 11mo ago
    OpenAI bots are relentless. I used to see some random requests every time I requested LE cert for making a service public but now, it's always "gptbot"
  • rsync 11mo ago
    “Hundreds of concurrent requests…” Back in 2001/2002 my personal website was “slashdotted” several times… … which I learned about after the fact by seeing myself on slashdot. It was not noticeable as it occurred and my services were not impacted. So perhaps you need a p3-500 with 64 megabytes of ram and Apache 1.x and an old copy of cgi-lib.pl ?
• llm_nerd 11mo ago
  I have several tiny blogs behind Cloudflare. I'm not going to change a thing because of an exceptional event happening, and I think knee-jerk pontificating or being reactionary is extremely unproductive. And DDOS is hardly my concern, and was never the reason I went to CF in the first place, so the whole foundation of this seems to be a strawman.
• ottoflux 11mo ago
  this. despite all the ghost stories and war stories. it’s how apple sells you the watch to save you from that bear attack or that time you got trapped somewhere. the stories are real, and in some cases you may need it — in most cases you don’t. and it clearly doesn’t always protect you.
• sammy2255 11mo ago
  I don't think anyone is arguing that.. the truth is that all these big companies do actually need to
• osigurdson 11mo ago
  >> if you put your site behind a centralized service, then this service is a single point of failure I don't think it is fair to characterize Cloudflare as a single point of failure, at least in the tradition sense.
• lostmsu 11mo ago
  I would not need Cloudflare for personal projects if lack of IPv6 support in random places would not make connecting to services I run on little VMs difficult.
• osigurdson 11mo ago
  I'd happily use Cloudflare's proxy as it does a good job of serving static assets. The problem I have is the root certificate that it uses doesn't seem to be universally trusted.
• phoenix_x 11mo ago
  I actually would argue against this idea, it is quite resource intensive to keep your sites up-to-date with latest security patches (think something like webservers, openssl, tls cipher suites ...). Putting your site behind a CDN makes you not so vulnerable to these attacks.
• deleted 11mo ago
  [deleted]
• Exuma 11mo ago
  [flagged]
  • mallets 11mo ago
    Yup. All the inconvenience of unmanaged, just to get worse uptime and performance? Who wouldn't want that.
• spoaceman7777 11mo ago
  ?? It's free, and it protects you from all sorts of nasty things. I can't think of any reason not to use cloudflare. It's _dead easy_ to set up too. I can't help but think that the author understands what cloudflare actually does, or just has a poor understanding of what goes on on the internet. Probably a bit of just being in a bad mood about cloudflare being down too.
  • AndroTux 11mo ago
    But your site will be down for 3 hours once every 3 years!!1
  • lilOnion 11mo ago
    I get these arguments and I see the appeal. But should this be the primary reason to use them, this way the web is being massively centralized. Everything running through them doesn't seem that smart to me. But of course I understand that for most users this isn't really a concern and the benefits that cf provides are much more important rather then the centralization problem.
    • Faaak 11mo ago
      Yeah, for me this is the main reason. I don't need it (even though I self host many websites, some having 100k requests/day, which is reasonable for a homelab). But most importantly, and don't want all the traffic to my websites being MITM by a company, even more so when it's foreign
  • mrweasel 11mo ago
    Many also put their personal stuff behind CloudFlare because it's a good way to learn a tool that they might need professionally later. I'm all for decentralizing and I don't feel the need for CloudFlare personally, but yes, arguing that people really shouldn't be doing it, period, requires some good technical reason or a more convincing political stance.
  • bombcar 11mo ago
    The biggest argument against using it is that if everyone uses it, there is no Internet but Cloudflare; and so CLoudflare is the decider and arbiter of Internet access for all.
• k__ 11mo ago
  I've learned this the hard way, by putting an Arweave gateway behind Cloudflare. The gateway was checked regularly for random data and the client would stop a download after 1MB, causing the gateway to stop sending the rest of the file. However, Cloudflare CDN wouldn't stop when the client stop, causing the gateway to send the whole file. Some files are multiple GBs big, so I suddenly got an invoice of 600€.
• queenkjuul 11mo ago
  Counterpoint, my personal project sites aren't that important, but are self-hosted. My blog being inaccessible for for half a day is preferable, to having to figure out my own protections, and why not just use their free CDN while I'm at it. Do i need to? Definitely not. Am i going to stop using cloudflare? Also no. When it comes to bigger sites, i think having someone to blame for an outage (especially when these big ones are effectively "the whole Internet broke") is still probably preferable to managing it all yourself.
• bilekas 11mo ago
  I don't use even close to all the services they offer, mostly just DNS and some web workers but the convenience of it as opposed to rolling my own is, excluding down time, an incredible free offering. Way back years ago when I used to roll my own, any problems I had to fix took extremely long and painful. Could I do it again today ? Yeah sure, but I know I couldn't do a better job than Cloudflare.
• stroebs 11mo ago
  I get your gripe, but the free protection that Cloudflare offers automatically often far exceeds the effort required to thwart some random script kiddie’s attacks on my client’s Wordpress site. Add easy caching, tunnels, automated certificate management, etc. to that and it’s obvious why a lot of sites use them.
• tedggh 11mo ago
  If you have a blog with 100 visitors per month why would you worry about being hit by an 4-8 hours outage once every year or two? I like Cloudflare because it is easy to setup and manage and because the amount of value you get for free or just a few bucks per month can’t be matched by any other company. Sure, if my income depends on my website/service uptime then I would probably consider other options. I think for most folks that’s not the case. Just chill and wait it out.
  • amatecha 11mo ago
    Adding Cloudflare to my site would actually cause more denial of service to legitimate users than it would if I never added CF. As someone using OpenBSD + Firefox with strict privacy settings and "resist fingerprinting", I am frequently blocked from sites because CF erroneously identifies my browser as suspicious (with no way for me to resolve this except use a different browser or computer). I'm not interested in blocking visitors because they use a different browser. Case in point: https://www.theregister.com/2025/03/04/cloudflare_blocking_niche_browsers/ https://www.theregister.com/2025/03/04/cloudflare_blocking_n...
  • dangus 11mo ago
    I swear these outages always have people forgetting how uptime works. Cloudflare went down for 5 hours this year. That’s 99.94% uptime. For real, who cares? Get a life and take a nice walk or something. Let the big enterprises worry about their backup plan.
• evolve2k 11mo ago
  We mainly use cloudflare due to the first class DNS experience. Free and super easy to work with. Anyone have a suggestion for an alternative? I don’t want to pay per domain but I would pay an agency fee for like 100 domains for a few hundred bucks sorta think, like migadu offers for email.
• TZubiri 11mo ago
  A couple of weeks ago my apprentice put a demo of ours behind cloudflare, I had him remove it. His explanation was interestingly "it hides our IP, if we remove it, they'll know our IP", yup, that's fine buddy, consider our IP to be a public piece of data. And we all lived happily ever after.
• deleted 11mo ago
  [deleted]
• retrofuturism 11mo ago
  I'm running a Raspberry Pi 5 at home as a lightweight web server. I put it behind `cloudflared` as to not leak my home IP address, and today I got to pay for it. Should I just stop being paranoid about "leaking my IP address" and self-host it 100%? All I fear is that my family will have to live with degraded internet experience because some script kiddie targeted me for fun.
  • JodieBenitez 11mo ago
    > I'm running a Raspberry Pi 5 at home Same here for years (Pi 4) but without the cloudflare part. It's been painless.
  • forbiddenlake 11mo ago
    You have other options besides leaking your home IP. You could use a VPN like Wireguard or a WG product like Tailscale, which is what I do. My Tailnet IPs are in public DNS, too, because it doesn't matter, they're not routable publicly. You could also get a cheap VPS in The Cloud and proxy requests to your home.
  • Gracana 11mo ago
    You could set up your own proxy. It doesn't have to be anything complicated, just a VPS with nginx forwarding requests to your servers on a VPN.
  • Fabricio20 11mo ago
    I would honestly not want to ever get targeted for a ddos attack on my home network ip. It's 5 bucks to buy a stresser online. Maybe you can even find one for free. People used to do that for fun when skype was around since you could resolve people's IP addresses due to a bug in skype. The worst possible outcome is they disconnect your network or block your port forwarding privileges outside of your own network being down for your family. I wouldn't wish ISP support on anyone, much less ISP support that would rather just terminate you than help you protect your homelab server.
• julianozen 11mo ago
  IMO this is terrible advice. 1. Put a moderate amount of money toward having the world's experts in uptime keep your site performing fast, and accept that occasionally your service goes down at the same time as everyone else. 2. Roll your own service, hire a large number of expensive experts to try to solve these problems yourself, and be responsible for your own outages and failures which will happen eventually and probably more frequently. If no one is going to die from your service going down, it seems like this is a perfectly reasonable third-party dependency. And if the issue is just your contract's SLA or a financial customer, the saving that comes from using Cloudflare can probably be worked through via negotiations.
• saltywhistle 11mo ago
  I use Cloudflare tunnels to expose lots of small projects to the internet that I host on my home server. I don't want my home internet to be knocked offline because someone decides to hammer my network and knock me offline for a while. Cloudflare handles caching of static resources, rate limiting, and blocking of bots with very little configuration. Also, my ISP here in the UK doesn't provide static IP addresses, so Cloudflare allows me to avoid using a dynamic DNS service, and avoid exposing ports on my router.
• conradfr 11mo ago
  Well good news, the Cloudflare error page gave me a perfect PageSpeed Insights score for a bit.
  • vntok 11mo ago
    It's very accessible as well!
• butz 11mo ago
  Worst thing is when local municipality is using Cloudflare on their pages and unintentionally breaks their RSS feeds, because they restrict foreign traffic. And RSS readers usually are running on some server in different country.
• neilv 11mo ago
  > Most of these sites are not even that big. I expect maybe a few thousand visitors per month. Incidentally, if you can make a site "static", so far I'm mostly liking AWS CloudFront loaded from S3. After many years serving my site from a series of VPSs/hosters/colo/bedroom. It's fast and inexpensive, and so far perfectly solid. Deploying consists of updating S3, and then triggering a CloudFront invalidation, which takes several seconds. The two key fragments of my deploy script (not including error checking, etc.), after the Web site generator has spat all the files into a staging directory on my laptop where I can test them as `file:` URLs, are: aws s3 sync \ --profile "$AwsProfile" \ --exclude "*~" \ --delete \ "$WebStagingDir" \ "s3://${S3Bucket}/" and then: aws cloudfront create-invalidation \ --profile "$AwsProfile" \ --distribution-id "$CloudFrontDistId" \ --paths "/*" \ < /dev/null 2>&1 | cat The main thing I don't like about it (other than the initial setup wizards having a couple bugs) is that it doesn't automatically map `foo/` URLs to `foo/index.html` S3 objects. The recommended solution was to use AWS Lambda, which I did temporarily, and it works. But when I get a chance, I will see whether I can make my deploy script duplicate S3 `foo/index.html` as S3 `foo/` and/or `foo`, so that I can get rid of the worse kludge of using Lambda. Unless CloudFront offers a feature to do this before then.
  • hk1337 11mo ago
    It's still a function you have to create but I would opt to use a cloudfront function instead of creating a whole lambda for the request routing. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope... https://github.com/aws-samples/amazon-cloudfront-functions https://github.com/aws-samples/amazon-cloudfront-functions
    • neilv 11mo ago
      Thanks, that looks very useful.
  • mariusor 11mo ago
    As far as I remember S3 makes a distinction between the paths /folderLikeResource /folderLikeResource/subResource, so you can basically map "foo/index.html" to distinct resource "foo".
• elondaits 11mo ago
  I administer a PHP website with very little legit traffic per month, but a few thousand pages probably. The bot traffic is crazy. We're not using Cloudflare for that site, but we're using a local static-page cache... and without it, the site simply can't function. You don't need to be the target of a dDoS to use a CDN. Also, using CDNs (Fastly via Github pages, not Cloudflare, in this case) once allowed us to be featured in a very large newspaper without worries, extra expenses, or extra work.
  • cosmic_cheese 11mo ago
    Simply put, in order for moving off of Cloudflare (or similar) to be practical, bot and scraper traffic is going to have to be reigned in heavily. Getting bots under control would be better for the health of the web anyway, but the chances of that happening are practically zero. Even if the AI bubble collapses entirely, there's still going to be loads of ill-behaved scrapers and exploit sniffers roaming about. I don't know if it's possible to fix this issue, short of the entire world enacting strict regulations mandating that scrapers and bots be well-behaved, which is never going to happen and even if it did could end up being just as or more destructive than rogue bots.
• paulnpace 11mo ago
  It also not necessary to use external fonts. I'm finding many pages that run fontawesome are looking something other than "awesome" right about now.
• 63stack 11mo ago
  These threads always make me think what percentage of the commenters are commenting due to FUD, and how many are shilling. "My home ip address might leak", "hacker armies will attack me", "only cloud flare with its billion dollar engineers can protect you on the internet", "if the attacker gets your server ip it's GAME OVER", "rampant run of the mill ddos attacks that will make your provider NUKE YOU FROM ORBIT". Meanwhile CF is closing in on monopolizing the internet.
• talkingtab 11mo ago
  Lets solve the problem. Why should some IP address be on the internet when it is being used for malicious activity. Everyone seems to assume there is no fix for this. Really? The discussion is here is sort of which way do you want to let DDos sites damage you? By signing up for Cloudflare or not signing up for Cloudflare. In both case normal users suffer harm. Why? This is a serious question.
• etchalon 11mo ago
  As someone who maintains/hosts a lot of small business sites, allow me to inform this thread that the author of this post is as wrong as any person can be wrong. If you're not behind Cloudflare, the level of effort required to impact your operations goes down, not up. Yes, of course, you're not impacted by massive outages like this, but you will be affected by other outages, and you will have a harder time recovering. Do not listen to this author.
• hk1337 11mo ago
  Cloudflare is a little like Google, they're doing a lot of really cool and amazing things to better the internet but they're frontend interface to use the services kind of sucks, they're raising the bar though so that everyone gets better. It's like when backend developers do really cool shit and also make your frontend.
• dpacmittal 11mo ago
  I'm mostly using cloudflare to block AI crawlers which don't respect robots.txt
• alex7o 11mo ago
  Yeah but cloudflare is one of the few places with free static hosting so ... Not much of a choice
• deleted 11mo ago
  [deleted]
• tristor 11mo ago
  I put my personal website behind Cloudflare, and I recommend that you do too. Why? Pretty simple, really. My personal website, along with some other services, can run successfully from a $10/mo VPS on Digital Ocean because I can be assured that anything I post will have its traffic primarily absorbed by Cloudflare. This lets me do things I want to do without having to consider the consequences or eating the direct cost myself, like having a gallery of my travel photography where I post nearly full-sized images that can be arbitrarily crawled. I have no concerns about my images being "stolen", because for the most part there'd be no reason to do so, but I'd have to stop doing that if I didn't have Cloudflare in front of my site because of AI crawlers and other things that will abuse the shit out of my little VPS. Do I think I'm on the target list for a DDoS? Not at all. Do I think badly behaved crawlers and the general tom-fuckery of the Internet will destroy my little VPS and/or cause me outage bills? Absolutely. Cloudflare prevents all that, and as a bonus lets me geo-block bad actors to minimize the likelihood of even that happening. See, my entire website is static, and for most people, so should yours be. The greatest thing about a static website is that the entire surface area is cacheable via a CDN. I /built/ my site with the idea of putting it behind Cloudflare in mind, specifically so I could do whatever I wanted (as long as it didn't need to query a database) and be entirely out of the woods. It's worked great for over a decade, and I expect it to continue working great for a decade more. The fact it is currently down is not a big deal because I get maybe one organic visitor every week that's not my mom.
• steviedotboston 11mo ago
  Every site should be behind cloudflare unless its static HTML.
• tuhgdetzhh 11mo ago
  Yeah, but I need it.
• thedelanyo 11mo ago
  These days Cloudflare offers more than network (CDN) and security (WAF). I guess there's - workers and containers for backend/fullstack, pages for severless/frontend/fullstack, storage and database solutions, and Ai and stuffs.
• Glyptodon 11mo ago
  I don't know if I need to, but cloudflare pages is without a doubt one of the easiest and cheapest ways to host a static personal site.
  • stavros 11mo ago
    That's where I host my site. It really is massively simple, a few clicks to create a new deployment, push to git to update, done.
• utopiah 11mo ago
  Yep, my websites are up and running. No AWS, no CloudFlare, no problem. We get excited by KPIs like uptime or scale while in truth for most of us those are not the key metrics. We think like BigTech because that's the metrics they sell us. It's a mistake that is profitable for them.
  • utopiah 11mo ago
    See kravietz's reply "...99% of websites hosted CF do not need neither AWS or CF..." in https://agora.echelon.pl/notice/B0P53zburJfENpkXEu https://agora.echelon.pl/notice/B0P53zburJfENpkXEu
• LucavagoHellman 11mo ago
  [dead]
• MT4K 11mo ago
  Also, Cloudflare’s human-checking page makes sites not work with JavaScript disabled even if the site itself doesn’t require JS.
• mcherm 11mo ago
  Which is more likely, a DDOS attack on your site or a Cloudflare outage? I think that for most sites the DDOS attack is more likely.
  • amatecha 11mo ago
    Neither - users being blocked because they use an uncommon browser: https://www.theregister.com/2025/03/04/cloudflare_blocking_niche_browsers/ https://www.theregister.com/2025/03/04/cloudflare_blocking_n...
  • jolmg 11mo ago
    Seems very unlikely for most sites to attract enough attention to get a DDOS. Searching "cloudflare outages": https://hn.algolia.com/?q=cloudflare+outage https://hn.algolia.com/?q=cloudflare+outage Cloudflare apparently has outages every 1-2 years or so.
• amatecha 11mo ago
  All the people posting all their reasons why they use Cloudflare ("it's free!"/"it's easy!"/"my site won't go down!") makes me realize this apparent arms race is going to effectively result in the total centralization of all web content. Cool. Seems like a great idea to rely on a singular US service rather than diversify the risk across hundreds/thousands of services around the world. What could possibly go wrong?
  • amatecha 11mo ago
    Oh yeah: If you host behind Cloudflare, you can basically expect your site/service is inaccessible by all of Spain every weekend or so: the government there decided to just completely cut off Cloudflare to stop illegal sports streaming sites. A couple posts about this: https://daniel.es/blog/cloudflare-vs-la-liga/ https://daniel.es/blog/cloudflare-vs-la-liga/ https://harro.com/2025/06/06/is-blanket-ip-blocking-justified-la-liga-vs-cloudflare-on-piracy-enforcement/ https://harro.com/2025/06/06/is-blanket-ip-blocking-justifie... https://cybersecurityadvisors.network/2025/04/15/la-liga-blocking-of-cloudflare-ips-in-spain/ https://cybersecurityadvisors.network/2025/04/15/la-liga-blo... https://www.techradar.com/vpn/vpn-privacy-security/cloudflare-wants-to-fix-spains-blocking-of-illegal-football-streams-ahead-of-next-laliga-season https://www.techradar.com/vpn/vpn-privacy-security/cloudflar...
• acedTrex 11mo ago
  I don't care about ddos on my blog/home stuff. I do however care about blocking annoying bots and some basic security stuff.
• hashstring 11mo ago
  Comparing burning a zero day to flexing DDoS capabilities is absolutely insane. I dislike CloudFlare for their extremely hostile stance against VPNs and for collecting a near autocratic control of a large part of the “world wide” web. I think that there are very valid concerns regarding that. And yes, that power is given to them by service providers, however also essential services use it and as a user I can not choose to not use your service without CF, so it’s still very much asymmetric.
• exe34 11mo ago
  cloudflare considered harmful.
• JohnMakin 11mo ago
  > Most of these sites are not even that big. I expect maybe a few thousand visitors per month. > This demonstrates again a simple fact: if you put your site behind a centralized service, then this service is a single point of failure. Even large established companies make mistakes and can go down. I'm guessing sites with a few thousand visitors a month don't much care about single points of failure. Seems like kind of a circular argument - if they're too small to care about needing a proxy in front of their service, then they are also probably too small to care about the handful of events that cause it to go down every so often. People talk about "single points of failure" like invoking that phrase in and of itself means something is bad. There are many areas where avoiding single points of failure is essentially impossible. It's about how much risk and impact you are willing to tolerate with those points of failure.
• NicoJuicy 11mo ago
  If you're hoster doesn't have perfect DDOS protection and bills you for bandwith. Good luck with your bill if you have a DDOS attack. If they don't close your account at least.
• eli 11mo ago
  > Most people use Cloudflare because they have been scared into the idea that you need DDoS protection I don't think that is correct that's why most people use Cloudflare
• xer0x 11mo ago
  Amen.
• nihiven 11mo ago
  Thanks for all the discussion here. I use cloudflared to proxy a bunch of small sites I serve from home. I will take a look a other solutions mentioned in this thread.
• more_corn 11mo ago
  Clearly there is plenty of DDOS capacity out there so your argument is invalid. One ten millionth of the current traffic would be enough to bring a small blog or service down. Also if you aren’t practiced at diagnosing a DDOS or if your monitoring is not tuned for it, diagnosing it can be supremely difficult. Answering as someone who has successfully diagnosed ddos at 11pm on a Sunday night without access to the logs or monitors (mostly because the necessary monitoring did not exist) And I could only do that because I had a decade of experience and I had the clarity of emotional distance (not my site, not my server, not my fault).
• porphyra 11mo ago
  Cloudflare has saved me from a bunch of "Hacker News Hug of Death". It also works around the world, including China, where I have a lot of friends and family. Quite nice.
• Nihilartikel 11mo ago
  I get it... but you can pry my cloudflare-tunnel from my cold dead hands. I'm no stranger to hosting things 'the hard way', but I am not going back from my happy casual hosting where I just spin up a docker container, and point the cloudflare tunnel at the local port and opt out of worrying over DDOS, SSL termination and certs, and everything else that goes with it. With tailscale, I don't even keep port 22 open to the world.
  • ibash 11mo ago
    Kamal + cloudflare tunnel is a neat setup.
• Apreche 11mo ago
  Even my tiny little personal sites got hammered by bots. I was very reluctant, but I feel like I had no choice but to go to Cloudflare. It was the only free option, and for tiny little sites it’s not worth paying for a solution.
• lightningspirit 11mo ago
  It is mentioned in the article that round-robin DNS is an alternative to this setup, however, in reality, it is not the same thing, and that's the reason load-balancers exist, and it is not feasible to provide something very similar due to the very nature of a distributed and cached DNS system.
• omani 11mo ago
  one way to mitigate DDoS is to enforce source IP checks on the way OUT of a datacenter (egress). sure there are botnets, infected devices, etc that would conform to this but where does the sheer power of a big ddos attack come from? including those who sell it as a service. they have to have some infrastructure in some datacenter right? make a law that forces every edge router of a datacenter to check for source IP and you would eliminate a very big portion of DDoS as we know it. until then, the only real and effective method of mitigating a DDoS attack is with even more bandwidth. you are basically a black hole to the attack, which cloudflare basically is.
• gspencley 11mo ago
  I ran a highly trafficked adult website for 18 years. In the early days, CDNs were unattainable for me and I managed my own rudimentary network by hosting bare metal servers in data centres around the world, using geo-ip aware DNS servers to send traffic to the closest data centre to them. My most significant running expense was bandwidth cost. So I never switched to cloud since the bandwidth costs would have instantly bankrupted me. Cloudflare, on the other hand, was the single most significant development when it came to my bottom line. Adding a basic, $200 / month business account saved me thousands per month on bandwidth + server costs. DDoS protection was just a nice perk. Most small websites are hosting with cloud providers these days. If their websites are at all media rich (and most are these days), and those assets can be cached by a CDN ... the cost savings on bandwidth are not marginal. They are often the difference between being able to afford to host your website or not having one at all. There are, of course, ways to optimize and reduce those expenses without a 3rd party CDN. But if Cloudflare still has their free plans for smaller traffic volumes, it is often a financial decision to use them over your cloud provider's CDN options.
• ManuelKiessling 11mo ago
  The problem is, we need to. It’s simply insane how many stupid, malicious requests we get without it, and we honestly are a small, unimportant site. If we don’t filter all this crap out, our metrics become basically meaningless, and our Data Warehouse, whose analyses we need to do business with our partners, would be one big „shit in, shit out“ travesty. And on the other hand, becoming non-affected by today’s Cloudflare incident was a single DNS update away, and effective in under a minute. I’m not saying we are perfectly happy, and I don’t exactly love the Cloudflare bill, but just slapping them in front of our loadbalancer and have them filter out the bad guys has been a good deal so far.
  • cube00 11mo ago
    > becoming non-affected by today’s Cloudflare incident was a single DNS update away Except you've now leaked your origin IP so expect increased junk being pointed straight at it. Sure you can firewall it off but even dropping packets burns CPU.
    • carlosjobim 11mo ago
      Of course not, you can point your domain(s) to any Cloudflare competitor.
• dwedge 11mo ago
  The massive centralisation going through cloudflare, especially their dns, is good reason to reconsider using them. It doesn't matter how good their product or ethos is, 10s of %s of the Internet traffic going through one company is a bad thing for the Internet.
• nick49488171 11mo ago
  Cloudflare pages (free) connected to GitHub is a very easy way to host your site though!
• simonw 11mo ago
  > For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" Running behind something like Cloudflare doesn't just protect against DDoS, it protects against surprise traffic spikes. If your site ends up on the Hacker News frontpage it's nice for it not to fall over right as people are trying to check it out.
• deleted 11mo ago
  [deleted]
• zajio1am 11mo ago
  CDNs and reverse proxies are important part of internet infrastructure. Problem here is not that webservers use CloudFlare, but that use only CloudFlare. Let's assume that i could easily use multiple CDNs/proxies and put them all in my DNS record. It would be nice if web browsers would use happy-eyeballs like logic to switch between multiple IP addresses, but i don't think this is default behavior with multiple A/AAAA records.
• 6thbit 11mo ago
  Guys, OP is clearly joking, he uses Cloudflare himself: dig NS huijzer.xyz +short fay.ns.cloudflare.com. gerardo.ns.cloudflare.com.
  • dangus 11mo ago
    No way, that’s hilarious.
• IngvarLynn 11mo ago
  Can't find the following argument in the replies: respect your visitors by not showing cloudflare's spinners and other bs in their faces. If your site is static, a VPS would carry it a long way. I once hosted a tiny video site - 500 daily visitors, 100GB, 10$/month. Worked better than youtube, 0 issues.
• arjie 11mo ago
  I have a small blog with a few hundred visitors per month (not including the AI scrapers), and I use Cloudflare because it lets me run everything on a box in my home office with Cloudflare tunnel in the way and I don't have to worry about a static IP or anything. The best part about Cloudflare is how unintrusive it is. It's properly a layer over everything that you have. I run my stuff as quadlets on Linux, and `cloudflared` just forwards requests to a specific port. It's a reverse proxy. If I wanted to move off Cloudflare, I'd need to run Nginx (or Traefik/Caddy which I'm less familiar with) + certbot and switch DNS. I like this layering approach, and when I decided to move from a cheap VPS to my own homeserver, I found it very easy to do so by just swapping a few things. I do have Google Fiber who don't mind when you host stuff so that's nice. Of all the cloud services that are a problem, I'd say Cloudflare is particularly well-designed as a non-lock-in service and is very generous with the terms. So I am quite happy putting Cloudflare in between. After all, if I'm only receiving a few hundred visits a month, it's not that important if Cloudflare is down. It's not like I'm providing an essential service except to my wife, who relies on some of the apps I've made for her Custom GPTs[1] and she is quite the forgiving user. 0: https://wiki.roshangeorge.dev/w/One_Quick_Way_To_Host_A_WebApp https://wiki.roshangeorge.dev/w/One_Quick_Way_To_Host_A_WebA... a description of how I host, but mostly structured as a note to myself 1: https://wiki.roshangeorge.dev/w/Blog/2025-10-17/Custom_GPTs https://wiki.roshangeorge.dev/w/Blog/2025-10-17/Custom_GPTs
• m463 11mo ago
  it seems everyone here is of the mind "I do it because it's convenient" Just like most internet nonsense... "I like privacy, but it's convenient" "I don't like amazon policies, but it's convenient" etc... so luxuries become necessities...
• AuthAuth 11mo ago
  Very naive comment here but how is this traffic grinding sites to their knees? I would think that modern hardware is easily capable of handling the high traffic. I would only expect a DDoS attack to be bringing down servers.
• arp242 11mo ago
  Everything is a "single point of failure" if you play around enough with the definition of "single". Your custom server with backup solution is a "single" thing, which is really not that far off from what Cloudflare is. From a technical point of view it's hard to get more redundant than things like Cloudflare; it's really not that centralised beyond being one organisation. It's just that if your server fails no one hears about it. But as a rule, your custom server will fair more often than Cloudflare. And you "need" it quicker than you think. DaemonForums is a small (no longer very active) forum; I ran the site for the first few years from 2008 to 2013. I served it off a small Intel Atom server. I haven't been involved in over a decade, but last year the current admin added Cloudflare because traffic from bots was getting out of control. He helpfully posted some stats: Period Usage Maximum Expected Overusage July 2025 5 GB ∞ 5 GB No overusage June 2025 63 GB ∞ 63 GB No overusage May 2025 788 GB ∞ 788 GB No overusage April 2025 1038 GB ∞ 1038 GB 38 GB March 2025 540 GB ∞ 540 GB No overusage February 2025 379 GB ∞ 379 GB No overusage January 2025 397 GB ∞ 397 GB No overusage December 2024 401 GB ∞ 401 GB No overusage November 2024 484 GB ∞ 484 GB No overusage October 2024 328 GB ∞ 328 GB No overusage September 2024 357 GB ∞ 357 GB No overusage August 2024 355 GB ∞ 355 GB No overusage July 2024 326 GB ∞ 326 GB No overusage June 2024 189 GB ∞ 189 GB No overusage May 2024 238 GB ∞ 238 GB No overusage April 2024 225 GB ∞ 225 GB No overusage March 2024 125 GB ∞ 125 GB No overusage February 2024 76 GB ∞ 76 GB No overusage January 2024 68 GB ∞ 68 GB No overusage December 2023 34 GB ∞ 34 GB No overusage November 2023 31 GB ∞ 31 GB No overusage October 2023 31 GB ∞ 31 GB No overusage September 2023 24 GB ∞ 24 GB No overusage August 2023 22 GB ∞ 22 GB No overusage July 2023 22 GB ∞ 22 GB No overusage June 2023 22 GB ∞ 22 GB No overusage May 2023 18 GB ∞ 18 GB No overusage April 2023 20 GB ∞ 20 GB No overusage March 2023 21 GB ∞ 21 GB No overusage February 2023 20 GB ∞ 20 GB No overusage January 2023 34 GB ∞ 34 GB No overusage December 2022 38 GB ∞ 38 GB No overusage November 2022 28 GB ∞ 28 GB No overusage October 2022 25 GB ∞ 25 GB No overusage September 2022 18 GB ∞ 18 GB No overusage August 2022 36 GB ∞ 36 GB No overusage July 2022 84 GB ∞ 84 GB No overusage June 2022 71 GB ∞ 71 GB No overusage May 2022 91 GB ∞ 91 GB No overusage April 2022 89 GB ∞ 89 GB No overusage March 2022 88 GB ∞ 88 GB No overusage February 2022 89 GB ∞ 89 GB No overusage January 2022 89 GB ∞ 89 GB No overusage December 2021 98 GB ∞ 98 GB No overusage November 2021 101 GB ∞ 101 GB No overusage October 2021 97 GB ∞ 97 GB No overusage September 2021 92 GB ∞ 92 GB No overusage August 2021 94 GB ∞ 94 GB No overusage July 2021 84 GB ∞ 84 GB No overusage June 2021 83 GB ∞ 83 GB No overusage May 2021 92 GB ∞ 92 GB No overusage April 2021 91 GB ∞ 91 GB No overusage March 2021 76 GB ∞ 76 GB No overusage February 2021 68 GB ∞ 68 GB No overusage January 2021 82 GB ∞ 82 GB No overusage December 2020 74 GB ∞ 74 GB No overusage November 2020 76 GB ∞ 76 GB No overusage October 2020 71 GB ∞ 71 GB No overusage September 2020 65 GB ∞ 65 GB No overusage August 2020 75 GB ∞ 75 GB No overusage July 2020 71 GB ∞ 71 GB No overusage June 2020 65 GB ∞ 65 GB No overusage May 2020 71 GB ∞ 71 GB No overusage April 2020 56 GB ∞ 56 GB No overusage March 2020 59 GB ∞ 59 GB No overusage February 2020 56 GB ∞ 56 GB No overusage January 2020 61 GB ∞ 61 GB No overusage December 2019 55 GB ∞ 55 GB No overusage November 2019 51 GB ∞ 51 GB No overusage October 2019 54 GB ∞ 54 GB No overusage September 2019 51 GB ∞ 51 GB No overusage August 2019 49 GB ∞ 49 GB No overusage July 2019 49 GB ∞ 49 GB No overusage June 2019 46 GB ∞ 46 GB No overusage May 2019 63 GB ∞ 63 GB No overusage April 2019 46 GB ∞ 46 GB No overusage March 2019 46 GB ∞ 46 GB No overusage February 2019 43 GB ∞ 43 GB No overusage January 2019 83 GB ∞ 83 GB No overusage December 2018 52 GB ∞ 52 GB No overusage November 2018 53 GB ∞ 53 GB No overusage October 2018 49 GB ∞ 49 GB No overusage September 2018 45 GB ∞ 45 GB No overusage August 2018 46 GB ∞ 46 GB No overusage July 2018 20 GB ∞ 20 GB No overusage July 2018 34 GB ∞ 34 GB No overusage June 2018 59 GB ∞ 59 GB No overusage May 2018 51 GB ∞ 51 GB No overusage April 2018 59 GB ∞ 59 GB No overusage March 2018 49 GB ∞ 49 GB No overusage February 2018 44 GB ∞ 44 GB No overusage January 2018 47 GB ∞ 47 GB No overusage December 2017 49 GB ∞ 49 GB No overusage November 2017 43 GB ∞ 43 GB No overusage October 2017 46 GB ∞ 46 GB No overusage September 2017 47 GB ∞ 47 GB No overusage August 2017 43 GB ∞ 43 GB No overusage July 2017 42 GB ∞ 42 GB No overusage June 2017 46 GB ∞ 46 GB No overusage May 2017 42 GB ∞ 42 GB No overusage April 2017 59 GB ∞ 59 GB No overusage March 2017 46 GB ∞ 46 GB No overusage February 2017 45 GB ∞ 45 GB No overusage January 2017 46 GB ∞ 46 GB No overusage December 2016 43 GB ∞ 43 GB No overusage November 2016 38 GB ∞ 38 GB No overusage October 2016 41 GB ∞ 41 GB No overusage September 2016 32 GB ∞ 32 GB No overusage August 2016 34 GB ∞ 34 GB No overusage July 2016 33 GB ∞ 33 GB No overusage June 2016 41 GB ∞ 41 GB No overusage May 2016 46 GB ∞ 46 GB No overusage April 2016 51 GB ∞ 51 GB No overusage March 2016 53 GB ∞ 53 GB No overusage February 2016 39 GB ∞ 39 GB No overusage January 2016 42 GB ∞ 42 GB No overusage December 2015 36 GB ∞ 36 GB No overusage November 2015 35 GB ∞ 35 GB No overusage October 2015 32 GB ∞ 32 GB No overusage September 2015 38 GB ∞ 38 GB No overusage August 2015 36 GB ∞ 36 GB No overusage July 2015 35 GB ∞ 35 GB No overusage June 2015 34 GB ∞ 34 GB No overusage May 2015 35 GB ∞ 35 GB No overusage April 2015 55 GB ∞ 55 GB No overusage March 2015 44 GB ∞ 44 GB No overusage February 2015 28 GB ∞ 28 GB No overusage January 2015 36 GB ∞ 36 GB No overusage December 2014 38 GB ∞ 38 GB No overusage November 2014 41 GB ∞ 41 GB No overusage October 2014 64 GB ∞ 64 GB No overusage September 2014 44 GB ∞ 44 GB No overusage August 2014 43 GB ∞ 43 GB No overusage July 2014 42 GB ∞ 42 GB No overusage June 2014 27 GB ∞ 27 GB No overusage May 2014 31 GB ∞ 31 GB No overusage April 2014 40 GB ∞ 40 GB No overusage March 2014 38 GB ∞ 38 GB No overusage February 2014 37 GB ∞ 37 GB No overusage January 2014 24 GB ∞ 24 GB No overusage From: https://daemonforums.org/showthread.php?t=12809#post76328 https://daemonforums.org/showthread.php?t=12809#post76328 The traffic increased by an order of a magnitude, to the point where it was causing problems. Does it "need" Cloudflare? Probably not – you can just expand your hardware, or maybe fiddle with some other stuff. But Cloudflare is simple, cheap, and easy. I have no great love for Cloudflare, but posts like this are not in sync with the state of the modern internet.
• armaautomotive 11mo ago
  If you set up Cloudflare in the first place you probably did it for a reason. Before Cloudflare DDoS attacks were widely common and very destructive.
• Thorrez 11mo ago
  >"no one will burn their DDoS capabilities on you!" You don't need to burn a DDoS capability to launch a DDoS attack. You just need to pay a few bucks to a booter service. A few minutes of searching turned up these: https://hardstresser.org/ https://hardstresser.org/ (this one looks like it offers a free trial) https://stresserbox.com/ https://stresserbox.com/ https://ip-stresser.cc/ https://ip-stresser.cc/ https://stresser.sx/ https://stresser.sx/ https://maxstresser.com/ https://maxstresser.com/
• jesuswasjew 11mo ago
  Problem is, new adopters of digital presence do so by standardized convention set by market and market incentivise faster and efficient adoption and cloudflare is/has become that standard as what wordpress became decades ago, for bloggers. The boogeyman hackers pose uncertainity and cloudflare standard promised a solution against it, especially ddos. I usually reverse dig new companies and almost all of them are behind cloudflare. It is just a learned helplessness.
• rldjbpin 11mo ago
  will always champion the notion of keeping things as simple as possible. however this take seems a bit overreactive. their stack has been some of the easiest low-hanging fruits for enhancing self-managed web stuff. almost everyone who agrees with this sentiment is also relying on someone else in the chain to keep their sites up. in my limited experience, the latter ended up being less reliable in the past decade or so. funnily enough the site was (momentarily) not loading for me, but instantly did right after.
• wzrr 11mo ago
  also true that no one care if your small blog is down for half a day?
• xela79 11mo ago
  Do put your DNS at cloudflare for your blog, as it can more effectively block all unwanted traffic. Dropped my bandwidth usage on personal blog from 4-5Gb/day to less than 500Mb by putting DNS through cloudflare and enabling their bot/ai blocks.
• ArtDev 11mo ago
  That is terrible advice. Cloudflare is normally an awesome CDN that is effectively free. It reduces resource usage by a large amount due to caching. Also, if my little blog gets posted on Reddit or somewhere and gets a huge spike.. it won't go down or cost me money in overages. This actually happened two years ago. I had massive DDOS style traffic that Cloudflare totally was able to mitigate.
• stevenicr 11mo ago
  True story: People (or bots) using cloudflare ips to probe for exploited files. I block the cloudflare cidr they are coming from. Website backup (wordpress using updraft free) - fails. Logs show failure to connect to updraft's web site. I lookup the website's dns and see cloudflare ips. Those ips are in the CIDR I blocked. I temp undo the block, run the updraft backup, and go back to blocking millions of cloudflare ips. Scratching my head on why updraft needs to connect to it's home site to run a backup, and why a better failure notice was not presented.