Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Domains (35%)
• Cloud Services (26%)
• Web Tools (17%)
• Hosting (13%)
• E-mail (9%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
Paris	Cloud Services	12 days ago
New York City	Hosting	14 days ago
Manchester	Domains	1 month ago
Angers	Cloud Services	2 months ago
London	Domains	2 months ago
Noida	Hosting	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Andy Hattemer (@andyhattemer) reported 6 minutes ago

  @jewelchidinma No known issues, what exactly is not working for you? We have seen in the past that certain ISPs block DNS for the Tables UI in console, switching to Google or Cloudflare DNS fixes it

• 
  Prajwal Tomar (@PrajwalTomar_) reported 6 minutes ago

  Vibe coders are getting sued. People are shipping apps with real users and skipping the boring stuff that kills them. A 20+ year dev shared the pre-launch checklist every AI builder needs. I added what I learned after shipping 60+ apps at the agency. Don't skip this: 1. Protect yourself, not just your app. The moment you collect user data you're in legal territory (GDPR, CCPA). Have a privacy policy. Know where user data lives. 2. Row Level Security. Without RLS, anyone can open DevTools and read your entire database. Supabase → Auth → Policies. Zero policies means your app is naked. 5 min to fix. 3. Test the failure path, not just the happy path. Wrong password 5x. Reset for an email that doesn't exist. Verification link clicked twice. Signup with an existing email. Catches 80% of auth bugs. 4. Security baseline in 2 min. Prompt your AI: "Review my app as a security specialist and make sure I have strong security headers and a solid baseline security posture." 5. OWASP. Prompt: "Review my app against OWASP standards and highlight vulnerabilities." This is where SQL injection, XSS and auth bugs actually get caught. 6. Client-side validation is UX, not security. Attackers disable JS and hit your API directly. Validate again on the server. Every time. 7. AI code leaks data in 3 spots: .env values in the frontend, API responses returning too much, secrets in logs. Prompt: "Check my app for credential or sensitive data leaks in frontend or API routes." 8. API keys in the frontend means game over. If it's in the browser, assume it's already taken. Move it server-side or proxy it. 9. Rate limits before someone burns your API bill. Cap every endpoint hitting a paid API. I've watched a Supabase bill jump from $20 to $200 in a day. 10. CAPTCHA on public forms (Cloudflare Turnstile is free) plus CORS locked to your domain. 10 min, kills bot floods. 11. Error messages that don't leak. "User not found", not "SELECT * FROM users failed". Log full errors server-side, show users generic messages. Build fast. Just don't ship naked. (full breakdown in my article below)

• 
  Michael Tierney (@Michael_WCD) reported 7 minutes ago

  Cloudflare Pages and Workers are ideal for marketing sites. They eliminate server management, scaling issues, and security worries. Edge functions like Workers also reduce latency by running closer to users. A server in a datacenter can't compete with that.

• 
  The Holyheights 🇰🇪 (@the_holyheights) reported 9 minutes ago

  People are launching apps to real users while skipping the unglamorous work that quietly sinks them. Here is the essential pre-launch checklist every AI builder should run through. Don’t skip these steps: 1. Protect yourself, not just your product. The second you start collecting user data, you’re operating under real legal requirements (GDPR, CCPA, etc.). Publish a privacy policy and know exactly where that data lives. 2. Enable Row Level Security. Without RLS, anyone can open DevTools and read your entire database. In Supabase, go to Auth → Policies. Zero policies = your app is completely exposed. Fix it in five minutes. 3. Test the failure paths, not just the happy path. Wrong password five times in a row. Password reset for an email that doesn’t exist. Verification link clicked twice. Signing up with an email that’s already registered. These catch roughly 80% of auth bugs. 4. Establish a security baseline in two minutes. Prompt your AI: “Review my app as a security specialist and make sure I have strong security headers and a solid baseline security posture.” 5. Check against OWASP. Prompt: “Review my app against OWASP standards and highlight vulnerabilities.” This is where SQL injection, XSS, and authentication flaws actually surface. 6. Client-side validation is UX, not security. Attackers simply disable JavaScript and hit your API directly. Always validate again on the server—every single time. 7. AI-generated code commonly leaks data in three places: .env values ending up in the frontend, API responses returning too much information, and secrets appearing in logs. Prompt: “Check my app for credential or sensitive data leaks in frontend or API routes.” 8. API keys in the frontend = game over. If it’s visible in the browser, assume it’s already compromised. Move it server-side or proxy the request. 9. Add rate limits before someone burns through your API budget. Cap every endpoint that hits a paid service. I’ve seen a Supabase bill jump from $20 to $200 in a single day. 10. Put CAPTCHA on public forms (Cloudflare Turnstile is free) and lock CORS to your own domain. Ten minutes of work that stops most bot floods. 11. Error messages that don’t leak information. Show “User not found,” not “SELECT * FROM users failed.” Log the full technical details server-side and give users only generic messages. Build fast. Just don’t ship unprotected.

• 
  swisscheese (@swisscheese4299) reported 13 minutes ago

  @OpenAI image generation is still throwing intermittent 520 errors through cloudflare.

• 
  Panat (@ptaranat) reported 13 minutes ago

  @LevJampolsky @Teknium you're better off implementing a simple version of this. give each trust tier its own hermes profile with toolsets stripped in config (platform_toolsets, agent.disabled_toolsets). then you expose only the api_server, and let ur own app authenticate the user and broker ever call. hermes' shared API key reads every session on the instance so it never accepts a session ID from a client. you'll want to map the user to the session in a DB and translate server side. and also put a Cloudflare Tunnel + Access service token in front so the agent host doesn't open any inbound ports. something like this took me one afternoon.

• 
  Chris Board (@chrisboard_) reported 15 minutes ago

  From a network trace, it looks like a TCP handshake completes, but then a ClientHello is sent, but no response is received so keeps getting retransmitted until the timeout happens. I know there's nothing being shown on cloudflare status but this does seem like it might be related to cloudflare.

• 
  Janek Mann (@janekm) reported 19 minutes ago

  @doodlestein @yzhang390 But that's not really the issue... it's that e.g. Huggingface and Microsoft and Cloudflare and Fireworks can be easily stopped from hosting them with misguided regulation. Literally only harming US companies at the expense of Chinese ones, ultimately.

• 
  Grant Mucha (@grantmucha) reported 20 minutes ago

  Ordering $50,000 in server hardware today and reflecting on a post I read earlier that asked, "Why is it so difficult to build a genuinely good X, Y, or Z, and why do so many products remain 'good enough' for half a decade without ever becoming great?" The answer, in most cases, is not capability. It is priorities. One company pushes X, another pushes Y, and another pushes Z, all because each benefits the seller. I see **** like this every day, it's not what's best for the owner, but rather what's best for the seller. In my experience, greed and ego explain a large percentage of mediocre products and services. Companies CAN build something better, take starlink, starship, building quality is a decision. Most prioritize profit first, investors second, and customers last. Take hosting. I do not need to: > Invest in quality servers > Pay 40k per month for Cloudflare Enterprise > License LiteSpeed Enterprise > Include real WordPress management > Promise zero technical debt > Maintain 90 days of redundant backups I could operate with a fraction of that investment and significantly increase my companies profit. I choose not to because I know exactly how this industry operates. I know companies still running production servers from 2013 on outdated kernels. Can they upgrade? Absolutely. Will they? No. Most people are not aware that Cloudflare Enterprise is modular. Contracts are assembled like Lego blocks. One company may technically offer "Cloudflare Enterprise" with a single component, another may have a handful, and others may have more than 100 enterprise features and configurations enabled. All of them advertise the same label, yet they are not remotely the same product. Now consider the customer's side. Within 48 hours, I can move a business owner into what is effectively a top 1% WordPress hosting environment, complete with real WordPress management, for $1,490 per year or about $124 per month. Consider for a moment that some companies charge $200/mo or more for WordPress management alone, and let that sink in for a minute. No technical burden. No infrastructure management. All existing technical debt resolved. Full WordPress management. No worrying about backups, performance, security, updates. etc. Owners focus on business, and for $124/mo, this is a joke to the vast majority making money, every day, 365 days a year. Circling back to mindset, I believe the people who fail to see it are often operating from the same greed-and-ego framework. They have to sell X, so they recommend it to everyone relentlessly, whether it's right or not. And the why is simple! It comes down to what you choose to prioritize, the decisions you make, and whether you are willing to put quality ahead of profit. More importantly, it is whether you are willing to put the customer ahead of yourself and your business, and prioritize a genuine win-win relationship. At which point, I believe there is no limit in business.

• 
  Mārtiņš V. (@MartinMartinV_V) reported 23 minutes ago

  VPN Renegade, falsely accused of SQL injection by Cloudflare’s WAF, currently stuck in a primitive splitting mechanism. Debating whether my hatred of CAPTCHA should be covert or fully public. “Cloudflare Inc … NYQ: NET 262.15 USD +66.13 (33.74%)” @ChatoshiAi "Life is not a problem to be solved, but a reality to be experienced" Søren Aabye Kierkegaard parable comes into mind.

• 
  Quirk 📐 (@AdamCQuirk) reported 30 minutes ago

  @BrianRoemmele @grok Trying to export ~926 ChatGPT business-account chats with scrapemychats. Tool works, login, discovery, resumable export all good. ~40 done so far. But large runs hit Cloudflare timeouts + HTTP 403 rate limits early. Pace drops from ~15s/chat to minutes, and the VM stalled overnight on one chat. Anyone exported 500+ chats reliably? Linux cloud VM vs local Mac? Tips for throttling at this scale welcome.

• 
  Jaziu The Chief (@_jaziu) reported 31 minutes ago

  @thsottiaux I feel like sol may be more efficient but it tends to overthink so it consumes much more. Example: asked sol high how cloudflare (service) would benefit our project and it thought for 9 mins delivering good pretty answer but it was really expensive 1/2

• 
  Jerry Combs (@PointBlueTech) reported 31 minutes ago

  @PH0ENIXSMITH @thdxr Exactly. I never have to do anything in CloudFlare myself.

• 
  Mr. Code NJ (@perpetualtalk) reported 32 minutes ago

  @saltyAom Does Cloudflare support bun + elyisa? Is this in the rust rewrite?

• 
  SaltyAom (@saltyAom) reported 32 minutes ago

  @perpetualtalk Elysia does support Cloudflare Worker but this new version get a better support This runs on Bun 1.3.14 which is not Rust rewrite

• 
  Techtitanmb (@techtitanmb) reported 34 minutes ago

  Cloudflare is reporting an unresolved issue affecting its Berlin location. Have you noticed slower websites or connection problems today?

• 
  ObsidianIntel 𐎡𐎼𐎠𐎴 🇮🇷 (@IntelObsidian) reported 36 minutes ago

  @TMobile Most importantly, why did it take half a day before you acknowledged it? Learn from Cloudflare, they go down nearly daily, but at least they are quick to announce it, then they are detailed in their after action report.

• 
  Leo (@0xGKBRK) reported 41 minutes ago

  @Puftberry @FuckKoroks I’ve paid for both Cloudflare and BunnyCDN before. Both are great. But if a user complained about either of them I couldn’t shift the blame to the CDN because I put the CDN there. That’s the main issue.

• 
  Josh (@joshmanders) reported 42 minutes ago

  @leodev So if I am understanding this correctly, using Cloudflare email is $21.45 for 50k emails? Honestly that's acceptable to me. Especially if they have good inbox placement and reliability. AWS is saturated with spammers and ****. I'll pay a premium to guarantee my stuff hits inboxes.

• 
  defido 👊⛽️ (@defido) reported 44 minutes ago

  @meaganrgamache Moved to eve and vercel. Got tired of how bad the ai product was. Not sure why cf offers its own inference if it can deliver a stable product there. In terms of deploying something. Cloudflare is uniquely on its own with the way it runs its workers/containers. Using frameworks for agents has been a pain. Eve is supported by vercel in the same way they did Nextjs and they won that vertical. Cf doesn’t do oss well. You guys build and burn oss projects fast. Eve isn’t great the vercel workflows are terribly slow and inefficient. I don’t like the egress costs and vercel is expensive. But they do one thing right. Product works. And if it doesn’t. They fix it.

• 
  Igor bedesqui (@bedesqui) reported 46 minutes ago

  @hate_santi @AmpCode @t3dotcodes The ios app is in private beta, but for now you can use the --serve command to expose your T3 code server to other devices in the same network. Then, by using something like tailscale or cloudflare tunnels, you can access the web portal from your phone regardless of network

• 
  Matt (@meszmatew) reported 49 minutes ago

  Is anyone else having issues with cloudflare billing?

• 
  T_T🏴‍☠️XMREscrow (@xmrescrow) reported 50 minutes ago

  Things people usually have to take on faith, that you can check here: Our node relays every transaction through Tor, so payouts do not enter the network from a clearnet address tied to this service. We do not store IP addresses. Anti-abuse uses a keyed HMAC that cannot be reversed. Web-server error logs can hold an address transiently and are deleted within two days - it is on our legal page because saying "we log nothing" would be a lie. No accounts, no email, no KYC. An escrow is two private links and a PIN each. The onion carries no third-party code at all. The clearnet is Cloudflare-fronted for DDoS and we say so

• 
  Lantad (@lantadco) reported 50 minutes ago

  On Cloudflare? Check your AI crawler settings before Sept 15, not after. If "Training" is blocked, confirm Googlebot, Applebot and BingBot still have access. Mixed-use reclassification catches sites that never touched robots.txt.

• 
  Sharan Yalburgi (@sharanry) reported 52 minutes ago

  @Cloudflare worst part is it is impossible to monitor this latency

• 
  Michael Timbs (@michael_timbs) reported 55 minutes ago

  @thdxr Hahahahha. Improbable. One of the many reasons there’s very serious applications deployed on Cloudflare. Primitives are just wrong with terrible APIs the entire way down

• 
  Sample (@sample) reported 55 minutes ago

  Cloudflare suffers a parity issue where platform features/runtime configs are Wrangler-only; omitted from native API/Terraform providers. So one can't choose purely declarative IaC or pure Wrangler; they're forced a hybrid & IaC tools have to shell out to Wrangler CLI subroutines

• 
  Kamran Khan (@ItsKamranK) reported 55 minutes ago

  @Rian_Visser @Namecheap Rian....worlds best company use Cloudflare for security and speed....if you don't use that's OK....I use Cloudflare CDN for almost every project....I don't have any issue...and why I will pay extra price in renewal charges, if I renew in same flat prices...

• 
  PUNK SQUAD (@PUNKSQUADcom) reported 56 minutes ago

  @MaxUrus254 @DailyLoud Cloudflare then bot detection router. But no 99.9% of the site you need to login.

• 
  Zappy (@noelzappy) reported 57 minutes ago

  app-01 and db-01 on a private local network. app-01 is the only host with a public interface, sitting behind Cloudflare. db-01 has no public route at all, it's reachable only over the LAN from app-01.