Under Attack mode puts a JavaScript challenge screen in front of every single visitor to your domain, checking each one before they reach your site. It's the emergency lever, not a setting you leave on. Flip it on during an active flood of bad traffic, and turn it back off once things settle, usually within a few hours.
You'll find it in the portal on the Cloudflare CDN page: open Manage on the affected domain and the Under Attack control is in that domain's settings.
When to actually use it
Under Attack mode is for active, obvious trouble, not routine spikes:
- Your site is slow or unreachable and you're seeing an unusual volume of requests
- You suspect a layer 7 (HTTP) flood, lots of requests hitting real pages rather than a network-level flood
- A launch, mention, or bot run has legitimate traffic mixed with junk and you need to buy time while you sort it out
It's not a fix for a slow site under normal load. If pages are sluggish without unusual traffic, that's a caching or server problem, not an attack, and Under Attack mode won't help. Check whether your static assets are cached properly first. See setting up a CDN with Cloudflare for how proxy mode and edge caching fit together, and what's already running by default at the origin.
What visitors see
Every visitor, on every request, gets an interstitial page for about 5 seconds while their browser runs a background check. Real browsers pass through automatically and land on your site. The friction is deliberate: it's designed to be trivial for a normal browser and expensive for a script issuing thousands of requests a minute.
A few things worth knowing before you flip it on:
- It applies to every visitor, not just suspicious ones. There's no way to scope it to specific paths or IP ranges from the toggle itself.
- Users on very old browsers or with JavaScript disabled may have trouble passing the check.
- API endpoints, webhooks, and anything else that isn't a browser making requests will likely fail the challenge. If a domain serves both a website and an API, expect the API traffic to break while this is on.
- Search engine crawlers can be affected too. Don't leave it running longer than the attack lasts.
Turning it off
Go back to the same domain settings screen and switch Under Attack mode off. The change applies immediately, no propagation delay to wait out. A reasonable rule: once your traffic graphs and error rates look normal for 30-60 minutes, turn it off. Leaving it on longer than needed just adds friction for real visitors for no benefit.
If the flood was hitting your domain at the DNS layer rather than your application, that's already absorbed before Under Attack mode even matters: our DNS runs on Cloudflare's Anycast network, which is built to keep answering lookups through that kind of noise on its own.
After the dust settles
Once traffic is back to normal, it's worth checking a couple of things while the incident is fresh. Look at whether the flood left anything behind, oversized log files, a spike in disk usage from error logs writing in a loop. The disk usage guide covers where that kind of bloat tends to hide. If the traffic was hitting a specific URL pattern you no longer need public, a targeted redirect can quietly close off that path going forward.
When to contact support
If you're not sure whether what you're seeing is an actual attack, if Under Attack mode doesn't bring things back under control, or if you need help scoping down protection instead of the all-or-nothing toggle, open a ticket from Support → New ticket in the portal. It's a real person on the other end, and during an active incident that's often faster than guessing at settings alone. Live chat works too if you need eyes on it immediately.