Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (41%)
• Domains (24%)
• Web Tools (18%)
• Hosting (12%)
• E-mail (6%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
New York City	Cloud Services	13 days ago
Los Angeles	Cloud Services	14 days ago
Paris	Cloud Services	1 month ago
New York City	Hosting	1 month ago
Manchester	Domains	2 months ago
Angers	Cloud Services	2 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Small News (@SmallNewsX) reported 7 minutes ago

  @ShimituMusic @NamecheapCEO Why will you take legal action? Since I started using Namecheap this is the first time their server went down. Big companies like Facebook, Cloudflare, even Google has gone down before so let’s take it easy with Namecheap.

• 
  Romano (@RNR_0) reported 8 minutes ago

  Tried to consolidate 2 Google workspaces into 1 with an alias email of my mother But without deleting the old ones, just renamed the email of the workspace Then I realized Stripe and Cloudflare used Google social login Also, noticed how weak AI was. 10x same GAM permissions etc

• 
  Artyom Shimanski (@a_shimanski) reported 8 minutes ago

  @JEROMEFARAILL @Namecheap @Cloudflare to be fair it was a cooling failure at PhoenixNAP, not an attack. the single region setup is the real issue

• 
  Delta (@deltaliquidity) reported 10 minutes ago

  @NoMcDonalds_ @Drallio We've made some updates VIA Cloudflare to fix this issue.

• 
  Ryan Hart (@thisdudelikesAI) reported 12 minutes ago

  I replaced my $2k/mo n8n stack with one Cloudflare Worker Sounds insane but hear me out n8n was doing 4 things for me: 1. Scraping 6 sites every 15 min 2. Running them through an LLM for classification 3. Dropping the good ones into a database 4. Firing a Telegram alert when something scored high That was it. 4 nodes worth of logic spread across 12 automations, a hosted plan, a Postgres addon, a queue worker, and a bill that kept climbing every month Then I sat down with Codex and asked one question: "what would this look like as a single script" 30 minutes later I had a Cloudflare Worker doing the exact same thing Here's the full stack: - Cloudflare Worker (the whole app, one file) - Cron Triggers (replaces n8n's scheduler, free) - Workers KV (replaces Postgres for this use case, free tier is plenty) - Workers AI or a direct call to Gemini Flash (classification, pennies) - Telegram Bot API (same as before, free) Total cost: $5 a month. And that's only because I upgraded the Worker plan for longer CPU time. You could genuinely run this on $0 The lesson isn't that n8n is bad. It's great for prototyping and for people who don't code The lesson is that once you know what your automation actually does, 90% of the visual builder is overhead you're paying for A Worker is a function. Your automation is a function. Skip the middleman If you're paying $500+ a month for any no-code automation tool right now, do this today: 1. Open Codex or Claude Code 2. Paste your workflow logic in plain english 3. Ask it to rebuild the whole thing as a single Cloudflare Worker 4. Deploy with 'wrangler deploy' 5. Delete the n8n subscription You'll be shocked how small the code actually is The no-code wave was a bridge. AI-written code is the destination

• 
  $empiternal$trafe (@SempiternalStrf) reported 14 minutes ago

  @NamecheapCEO That time when your website is running with cloudflare pages (static) so you aren't affected by this. Altho' everything else what I have is down [the web hosting itself], so I hope my data and stuff won't be lost in this process.

• 
  Sam (@bySamBoffa) reported 14 minutes ago

  I swear, Cloudflare products might be good as hell idk...but there are so many fragments and "idk, wtf is this?" and the docs man...

• 
  Marius du Preez (@mdp_sec) reported 15 minutes ago

  Following on from yesterday A browser can reach a signup page, fill every field, solve the CAPTCHA, and still be useless if nobody can verify the account. That became obvious once I started letting AI handle more of my bug bounty workflow. Browser automation was only half the problem. The system also needed to create identities, receive email, follow verification links, collect OTPs, keep attacker and victim accounts separate, and fall back to real phone numbers when a target refused email verification. I did not want the AI logging into a normal inbox for every account. I wanted email to behave like another research API. I now run three catch-all domains. For each signup, the system creates a new address containing the target, purpose, and timestamp. Nothing needs to be provisioned first. The address exists because the domain accepts everything. That means one target can have separate addresses for attacker, victim, admin invitation, password reset, organization owner, or any other role I need to test. If I revisit the target later, I create another set rather than guessing which old account belongs to which research cycle. Mail for all three domains enters through Cloudflare Email Routing. A catch-all rule sends it to one Email Worker. The Worker reads the raw message, extracts useful fields such as recipient, sender, subject, body, and timestamp, then sends the result to my own receiver over an authenticated webhook. The receiver writes messages into one rolling store and exposes a separate authenticated read endpoint. The write secret and read key are different, so the component accepting mail does not automatically get permission to read it back. The important rule is that AI never asks for the entire inbox. It queries the exact address it created for that test. This turns an otherwise messy shared catch-all into a deterministic part of the run. If the system registered target-attacker-1740000000 on one domain, it polls only for that recipient. An unrelated OTP arriving at the same time cannot be mistaken for the current account. When a message arrives, the AI does not need a visual mail client. It reads the stored RFC822 message, finds the verification URL or newest numeric code, and continues the browser flow. The same path handles account confirmation, magic links, password resets, invitations, change-email confirmations, and email OTP. Raw mail is preserved because the convenience body is not always enough. Real messages are multipart, HTML-heavy, encoded, or wrapped in tracking redirects. Keeping the original source means I can parse it properly when a simple body extraction misses something. I use email first whenever the product allows it. It is cheap, fast, unlimited for practical purposes, and easy to isolate. I can create five accounts for an authorization matrix without consuming phone numbers or waiting for manual inbox work. It also gives the AI a complete chain from signup request to verified session. SMS is the fallback, not the default. Some targets insist on a real mobile number. Others require one only after signup, or they gate a specific feature behind phone verification. In those cases the system can use physical Android devices with active SIMs, or rented non-VoIP US and UK numbers when geography matters. The trigger time is recorded before the code is requested. The system then reads only messages received after that point and extracts the newest matching OTP. This matters because SMS inboxes keep old codes, and blindly taking the first six-digit number is an easy way to lock an account or burn retries. Geography is part of the identity too. A US-only signup should not combine a US browser exit with an Australian phone number unless I am deliberately testing that mismatch. The browser pool already lets me choose a country-specific IP and timezone. The phone-number layer lets the account match that geography when the target enforces it. Email domains also have a fallback order. Some products reject an unfamiliar domain, block a domain after too many test accounts, or apply reputation rules inconsistently. If the primary domain fails, the system moves to the second, then the third. Every domain reaches the same backend, so nothing else in the workflow changes. This infrastructure becomes more useful after registration. Password-reset testing needs controlled access to both accounts and their mail. Invitation testing needs me to prove which address received which organization or role. Change-email testing needs visibility into notifications sent to old and new identities. Magic-link testing needs the original URL, its expiry behavior, and a second session where I can check replay or account binding. For evidence, I can render a real received message locally without loading remote images, scripts, forms, frames, or tracking resources. That gives me a clean screenshot for the report while keeping the evidence genuine. I am showing the message that arrived, not recreating it in a document. The full flow now looks like this. The AI chooses a browser profile and account role. It creates a unique address, registers the account, polls only for that recipient, extracts the link or OTP, verifies the account, and saves the resulting session with the correct role. If email is unavailable, it selects a real number that matches the required country, requests the SMS, reads the newest code, and continues. I only get involved when the product needs human judgment or a step cannot be automated safely. This is not an inbox replacement for its own sake. It is account infrastructure built for testing. The value is not receiving email. The value is letting every research run create traceable identities and reach authenticated product state without losing time to manual verification. #BugBounty #CyberSecurity #TogetherWeHitHarder

• 
  Adam Szaloczi | DataBard (@AdamSzaloczi) reported 15 minutes ago

  @a_shimanski @Namecheap @Cloudflare I never experienced any downtime. But the whole ecosystem is so bloated and the admin process is confusing.

• 
  @jorgediazapps (@jorgediazapps) reported 17 minutes ago

  I wired Grok Bot into the actual stack I run the company on. Not a toy demo. MCP where it exists. Raw API or the browser where it doesn’t. Live MCP right now: Gmail, Google Calendar, Google Drive Stripe + Link Coolify (read-only official MCP — writes go through their API) Cloudflare docs, builds, observability Typefully, Castmagic, Octolens DataForSEO, DataFast, Apify Resend, AgentMail Composio, Context7 No real MCP, still connected: Enlac. ee (short links + static hosting — dashboard + API) Outrank (blog → Strapi webhook) Strapi on cms. doublemyleads .com Facebook via the signed-in browser (never paste the password) GitHub official MCP The bot doesn’t get a new brain. It gets the same tools I already pay for. That’s the whole trick.

• 
  Dave Rekuc (@DaveRekuc) reported 18 minutes ago

  @MattElms Open a support ticket yet? I for sure would. Including the cloudflare confirmation screenshotted.

• 
  Sajid Mehmood (@smehmood) reported 23 minutes ago

  @axat_div @ethan_breitk @binsquares Cloudflare, no. For the others, they all started on the hyperscalers, but several of them are moving off in a major way (e.g. Railway Metal, Modal uses a number of neoclouds, etc.) And even if the hyperscaler is the underlying compute, it's meaningful that they are losing the direct customer relationship

• 
  Gentra (@Gentraxyz) reported 24 minutes ago

  @a_shimanski @Namecheap @Cloudflare Spaceship has the same issue Their hosting is down too

• 
  Task Lemon (@TaskLemonWorks) reported 27 minutes ago

  @a_shimanski @Namecheap @Cloudflare Sorry to hear that, having a main business account. Being down is extremely frustrated and upsetting.

• 
  Fast&Final (@FastFinalAlgo) reported 27 minutes ago

  Cloudflare added MCP detection at the network level today $Algo 🔮

• 
  Ericson Smith (@ericson4smith) reported 29 minutes ago

  @remotecleanguy Explore if you can do some edge caching with Cloudflare. We found that a major ISP in Bangkok had serious routing issues at night. Our servers are in the USA and our customers are in Bangkok. Edge caching solved the whole problem for our most important service pages.

• 
  hexmint ✌️ (@hexmint) reported 29 minutes ago

  @Cloudflare you really need to QA this Create Worker page. If I enter two letters in any of the text boxes here, the first letter is lost. And if there is a single letter there, I need to press backspace twice to delete it. Feels like a React issue idk

• 
  Dev Basu 🇨🇦/🇮🇳/🌎 (@devbasu) reported 29 minutes ago

  I am amazed. We were under a DDoS attack for the last 48 hours. Used @ChatGPT Codex to configure our hosting provider -> Cloudflare challenge -> talked to customer support back and forth to establish WAF rules. Codex had warmth + competence. All via computer use. Wow.

• 
  Shraddha Bharuka (@BharukaShraddha) reported 32 minutes ago

  📂 SaaS Stack ┃ ┣ 📂 Frontend ┃ ┣ 📂 React ┃ ┣ 📂 NextJS ┃ ┣ 📂 Vue ┃ ┣ 📂 TailwindCSS ┃ ┗ 📂 Shadcn UI ┃ ┣ 📂 Backend ┃ ┣ 📂 NodeJS ┃ ┣ 📂 Django ┃ ┣ 📂 Laravel ┃ ┣ 📂 FastAPI ┃ ┗ 📂 Express ┃ ┣ 📂 Database ┃ ┣ 📂 PostgreSQL ┃ ┣ 📂 MySQL ┃ ┣ 📂 MongoDB ┃ ┣ 📂 Redis ┃ ┗ 📂 Supabase ┃ ┣ 📂 Auth ┃ ┣ 📂 Clerk ┃ ┣ 📂 Auth0 ┃ ┣ 📂 Firebase Auth ┃ ┣ 📂 Supabase Auth ┃ ┗ 📂 NextAuth ┃ ┣ 📂 Payments ┃ ┣ 📂 Stripe ┃ ┣ 📂 Paddle ┃ ┣ 📂 Dodo Payments ┃ ┣ 📂 Lemon Squeezy ┃ ┗ 📂 Polar ┃ ┣ 📂 Emails ┃ ┣ 📂 Resend ┃ ┣ 📂 SendGrid ┃ ┣ 📂 Mailgun ┃ ┣ 📂 Postmark ┃ ┗ 📂 Amazon SES ┃ ┣ 📂 Storage ┃ ┣ 📂 AWS ┃ ┣ 📂 Cloudflare ┃ ┣ 📂 Google Cloud Storage ┃ ┣ 📂 Supabase Storage ┃ ┗ 📂 Uploadcare ┃ ┣ 📂 Deployment ┃ ┣ 📂 Vercel ┃ ┣ 📂 Netlify ┃ ┣ 📂 Railway ┃ ┣ 📂 Render ┃ ┗ 📂 AWS ┃ ┣ 📂 Domains and DNS ┃ ┣ 📂 Namecheap ┃ ┣ 📂 Hostinger ┃ ┣ 📂 Cloudflare DNS ┃ ┣ 📂 Google Domains ┃ ┗ 📂 SiteGround ┃ ┣ 📂 Analytics ┃ ┣ 📂 Google Analytics ┃ ┣ 📂 Plausible ┃ ┣ 📂 PostHog ┃ ┣ 📂 Mixpanel ┃ ┗ 📂 DataFast ┃ ┣ 📂 Monitoring ┃ ┣ 📂 Sentry ┃ ┣ 📂 LogRocket ┃ ┣ 📂 Datadog ┃ ┣ 📂 NewRelic ┃ ┗ 📂 UptimeRobot ┃ ┣ 📂 DevOps ┃ ┣ 📂 Docker ┃ ┣ 📂 Kubernetes ┃ ┣ 📂 GitHub Actions ┃ ┣ 📂 CI CD ┃ ┗ 📂 Terraform ┃ ┣ 📂 Search ┃ ┣ 📂 Algolia ┃ ┣ 📂 Meilisearch ┃ ┣ 📂 Elasticsearch ┃ ┣ 📂 Typesense ┃ ┗ 📂 OpenSearch ┃ ┣ 📂 AI Integration ┃ ┣ 📂 OpenAI API ┃ ┣ 📂 Anthropic API ┃ ┣ 📂 Replicate ┃ ┣ 📂 HuggingFace ┃ ┗ 📂 Gemini API ┃ ┣ 📂 Integrations ┃ ┣ 📂 Zapier ┃ ┣ 📂 Make ┃ ┣ 📂 n8n ┃ ┣ 📂 Pabbly ┃ ┗ 📂 Webhooks ┃ ┣ 📂 Security ┃ ┣ 📂 SSL ┃ ┣ 📂 Cloudflare ┃ ┣ 📂 WAF ┃ ┣ 📂 Rate Limiting ┃ ┗ 📂 Secrets Management ┃ ┣ 📂 Marketing ┃ ┣ 📂 Search Console ┃ ┣ 📂 Outrank ┃ ┣ 📂 Buffer ┃ ┣ 📂 Analytics ┃ ┗ 📂 Kit ┃ ┗ 📂 Customer Support ┣ 📂 Intercom ┣ 📂 Crisp ┣ 📂 Zendesk ┣ 📂 Tawk ┗ 📂 HelpScout

• 
  Philippe Martin (@PhyByte) reported 33 minutes ago

  Writing the code was never the hard part. Owning what happens after it ships is. @cursor_ai bringing in a team that built agents specifically for that post-deploy loop (with real production experience from Cloudflare, Twitch, etc.) feels like one of the more grounded moves in this space with everything that happening at @SpaceXAI with @grok

• 
  .null. (@Blacktrace_) reported 37 minutes ago

  @Cloudflare effectively putting the “bouncer” at the network layer rather than asking the agent to behave itself.

• 
  Ryzm (@Goeun_6121) reported 37 minutes ago

  Anthropic’s IPO valuation could come down to one number: 2028 revenue bankers are reportedly working with a $190B-$200B sales forecast and applying revenue multiples against names like Palantir, Cloudflare and SpaceX that makes the revenue assumption almost as important as the IPO itself..

• 
  Fernando Dilland (@fernandodilland) reported 39 minutes ago

  @venkateshdotdev A CAPTCHA token (such as Cloudflare Turnstile) should be required in the header or body of registration and login endpoints, with the server validating it on the back end to ensure it is valid, thereby preventing a large portion of these attacks.

• 
  Sterling Labs (@sl_wire) reported 49 minutes ago

  A crawl is a program walking the web on its own, saving a copy of each page to build the pile of text a model learns from. Each page gets taken once. That was 36.40% of AI bot traffic in January 2025 and 44.56% in July. Agent traffic is the other thing, a page fetched right then because you asked, and it was 2.63% last October and 2.65% in July. Nine months flat. Both are shares of AI bot traffic, not of the web. @CloudflareRadar counts this because Cloudflare sits in front of a big share of it, and out on the whole web bots were 34.81% of requests in July against 65.19% human. Agents are at most 0.92% of everything, and that assumes every bot is an AI bot. Call it a third of a percent. The tollbooth is already built. $NET opened Pay Per Crawl in private beta on July 1 at a one cent minimum per successful retrieval, and the network already returns more than two billion payment required responses a day. Its own June investor day line was that the vast majority never become a transaction. Purpose is self declared at registration and nobody audits it, so hold the levels loosely. Anthropic’s crawl to referral ratio fell from about 8,800 requests per referral in April to 2,800 in July, and Adobe measured AI referred retail visits up 138% year over year in May. We are following what the models tell us. The agents aren’t out doing the shopping. Yet.

• 
  Term (@JaniBangiev) reported 51 minutes ago

  @schmedu_ @johnnycommits @supabase Yeah I know. As someone how is building their own startup I know there is a balance to be found here. But I think the difference for supabase becomes in the type of user they are targeting. A hobby user will probably never pay for a subscription if they can get the same thing if not better on cloudflare. So in their case the free tier does not make much sense I think.

• 
  Brant Tedeschi (@BrantTedeschi) reported 51 minutes ago

  @YoungbloodJoe @cPanel Was the main server that hosts cpanel/whm behind cloudflare? Never trust GoDaddy for anything. The IP should never be public facing. So they should never know the real IP address.

• 
  Choblin (@choblin29) reported 52 minutes ago

  Holy. Anthropic is reportedly projecting $190B-$200B in revenue by 2028. That is more than 4x its $47B revenue run rate in May. And Wall Street is already looking that far ahead to help value the IPO. Bankers and investors are using forward revenue multiples, with Palantir, Cloudflare and SpaceX among the reference points. Anthropic went from a ~$9B run rate at the end of 2025 to >$47B by May. It is also projecting at least $10.9B of Q2 revenue and is on track for its first quarterly operating profit at $559M. $200 billion revenue in 2028. Absolutely freaking insane growth if they can actually pull this off.

• 
  Cortney Fletcher (@cfletcher24) reported 53 minutes ago

  @Cloudflare I can’t login to my account and the password reset isn’t working. And nobody is answering support. How can I find a support agent? My entire business is down right now.

• 
  🛡️Anti IR Cyber Unit (ShKhNCU)🛡️ (@FriendOfTheInst) reported 1 hour ago

  Post-Quantum Cryptography: a deadline, not a research topic The threat is narrow and total. Shor's algorithm solves factoring and discrete log in polynomial time — that ends the dominant classical public-key families: RSA, finite-field DH/DSA, ECDH, ECDSA, EdDSA. Symmetric crypto is far less affected: known quantum speedups are much weaker — Grover's key search is only quadratic and parallelizes badly — so AES-256 and SHA-384 hold. PQC rebuilds the public-key layer on problems with no known quantum attack of comparable force. WHY NOW, WITH NO CRYPTOGRAPHICALLY RELEVANT QUANTUM COMPUTER IN EXISTENCE Harvest now, decrypt later. Vulnerable traffic captured today is readable the day a CRQC boots. Mosca's inequality: if secrecy lifetime + migration time > time to CRQC, you're already late. For 20-year secrets, waiting for evidence of a CRQC is indefensible — the migration window can close years before the machine exists. THE STANDARDS NIST finalized three in August 2024: - FIPS 203 — ML-KEM (Kyber). Lattice KEM. Your default key establishment. - FIPS 204 — ML-DSA (Dilithium). Lattice signatures. Your default signer. - FIPS 205 — SLH-DSA (SPHINCS+). Hash-based, slow, enormous — but rests on nothing but hash security. The insurance policy. Two more are coming. FN-DSA (Falcon) is not yet standardized; FIPS 206 remains in development, with floating-point Gaussian sampling making safe constant-time implementation and validation unusually difficult. HQC — selected in 2025, planned as FIPS 207 — is code-based and deliberately non-lattice, so a break in lattice math doesn't take out both KEMs. WHY THE HEDGING SIKE died in 2022 to Castryck–Decru: classical mathematics, 62 minutes on a single core of a 2013 Xeon. Rainbow fell to Beullens on a laptop. The underlying math families are old, but the specific schemes and parameter sets we're shipping have far less deployment history and accumulated scrutiny than RSA and ECC. Hence hybrids: X25519MLKEM768 in TLS 1.3 concatenates a classical and a PQ secret, designed so key establishment survives as long as one component does. Already default in Chrome and Firefox and widely deployed at Cloudflare. Signal shipped PQXDH and is rolling out SPQR, a post-quantum ratchet that combines with the Double Ratchet to form the Triple Ratchet; iMessage ships PQ3. FOR ML-KEM, THE FIRST-ORDER COST IS BYTES, NOT CYCLES ML-KEM is fast. But X25519 sends 32 bytes; ML-KEM-768 sends a 1184-byte key and a 1088-byte ciphertext. ML-DSA-65 signatures are 3309 bytes, and a chain carries several. The extra kilobytes push the ClientHello past a single packet — Chrome's 2024 Kyber rollout measured roughly 4% added median handshake latency — and PQ certificate chains get large enough to interact badly with congestion windows on lossy or high-latency links. You feel it as network latency and packetization, not CPU time. KEMS FIRST, SIGNATURES LATER For completed TLS sessions there is no harvest-now analogue: a 2035 machine cannot reach back and impersonate a server in a handshake that already finished. Long-lived signed artifacts are the harder case — code signing, firmware, notarized documents, timestamps — and that's exactly where signature migration is hardest: root CAs and roots of trust with 15-year field lifetimes. THE CLOCK Draft NIST IR 8547 — still an initial public draft, not a final standard — proposes deprecating 112-bit classical public-key schemes after 2030 and disallowing quantum-vulnerable public-key schemes after 2035. Don't read 2035 as your deadline: NIST says application-specific guidance may require earlier migration for key establishment, particularly in interactive protocols like TLS and IKE. Hybrids are accommodated as a transition mechanism, not an exemption — NIST frames them as temporary, followed by a second migration to pure PQC. CNSA 2.0 pulls national security systems in sooner. THE REAL DELIVERABLE IS CRYPTO-AGILITY Inventory what you use (CBOM), pull algorithm choice out of your protocol logic, and build assuming you swap again — because you will. And to kill a common confusion: PQC ≠ QKD. PQC is classical math on hardware you already own. QKD is a physical-layer technology needing specialized optical or satellite links, and it still requires an authenticated classical channel — so it doesn't eliminate the authentication problem.

• 
  TheKillerEdge (@TheKillerEdge) reported 1 hour ago

  @mark_ppc Brutal because you did everything "right" and still got throttled. Add to the check: after the Cloudflare fix, watch your server logs for a week and confirm GPTBot, ClaudeBot and PerplexityBot are pulling 200s at volume, not just your one curl. A WAF rule can still rate-limit them quietly. You can't get cited by a page the model was never allowed to read. How many sites do you reckon are blocking themselves without knowing?