Cloudflare Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Jason Fleagle (@jjfleagle) reported 6 minutes ago

  @Cloudflare This is the kind of tooling that turns a privacy protocol into an operable system. The next useful artifact is a redacted debug receipt showing each hop, encapsulation step, draft version, timing, and failure boundary so teams can reproduce errors without exposing the request.

• 
  JeromeTheDJ (@JeromeTheDeejay) reported 8 minutes ago

  Cloudflare verification pmo so bad let me click through links stop slowing me down *****

• 
  Duane C (@DuaneC6) reported 15 minutes ago

  @CryptoCyberia The internet was never a system of tubes, it has always been 500 micro-services pointed at each other like loaded firearms. People on remote, nearly-uncontacted islands know when Cloudflare goes down, and now it goes down all the ******* TIME.

• 
  Harman (@itsharmanjot) reported 15 minutes ago

  Most developers scan file extensions and call it security. Attackers don’t care what your file extension check says. There’s an open-source tool that actually scans the bytes before a file ever touches your disk. It’s called pompelmi. A TypeScript toolkit for Node.js that scans uploads in-process, MIME spoofing, ZIP bombs, nested archives, polyglot files, before storage, before your CDN spreads it, before it becomes someone else’s problem. → Scans in-process with zero outbound network calls, bytes never leave your server, no cloud API, no daemon required → Deep ZIP inspection catches nesting depth, file count, and archive traversal tricks that simple extension checks miss entirely → Optional ClamAV antivirus integration plus optional YARA rule support, for teams that want signature-based detection layered on top → Drop-in adapters for Express, Fastify, Koa, NestJS, and Next.js, plus support for Bun, Deno, and Cloudflare Workers → Built-in security scorecard grades your actual upload configuration A through F, so you know your real exposure, not just whether the tool is installed → Quarantine mode auto-moves flagged files with a sidecar JSON report, so a suspicious upload gets isolated automatically instead of silently landing in your storage bucket Any app that accepts user uploads is dealing with a real attack surface most teams treat as an afterthought. pompelmi’s whole design is catching the risk at the entry point, not after the file’s already spread across your systems. 337 GitHub stars.

• 
  Michael Timbs (@michael_timbs) reported 17 minutes ago

  @thdxr Hahahahha. Improbable. One of the many reasons there’s very serious applications deployed on Cloudflare. Primitives are just wrong with terrible APIs the entire way down

• 
  NetAskari (@NetAskari) reported 19 minutes ago

  Based on that info it quickly builds a list of over 600 python scripts and sh files starting a full chain of recon and exploit measures. It logs all its operations, success rates and outcomes. From SQL Injections, http smuggling, race condition probing, cloudflare bypass, WAF evasion, cache poisoning etc. Its attack angles are pretty wide. None of the scripts or methods seems particularly clever but if a 'fire and forget' solution is what you are looking for, than this is not too bad. 4/6

• 
  Quirk 📐 (@AdamCQuirk) reported 21 minutes ago

  @BrianRoemmele @grok Trying to export ~926 ChatGPT business-account chats with scrapemychats. Tool works, login, discovery, resumable export all good. ~40 done so far. But large runs hit Cloudflare timeouts + HTTP 403 rate limits early. Pace drops from ~15s/chat to minutes, and the VM stalled overnight on one chat. Anyone exported 500+ chats reliably? Linux cloud VM vs local Mac? Tips for throttling at this scale welcome.

• 
  T_T🏴‍☠️XMREscrow (@xmrescrow) reported 25 minutes ago

  Things people usually have to take on faith, that you can check here: Our node relays every transaction through Tor, so payouts do not enter the network from a clearnet address tied to this service. We do not store IP addresses. Anti-abuse uses a keyed HMAC that cannot be reversed. Web-server error logs can hold an address transiently and are deleted within two days - it is on our legal page because saying "we log nothing" would be a lie. No accounts, no email, no KYC. An escrow is two private links and a PIN each. The onion carries no third-party code at all. The clearnet is Cloudflare-fronted for DDoS and we say so

• 
  Dr. Gonzo (@N3DrGonzo) reported 26 minutes ago

  @AnisDrawn PSN goes down more often than CloudFlare. And CloudFlare has an outage QUOTA. But yes, please tell me how an all digital ecosystem for a console is a good thing.

• 
  Kyle Mistele 🏴‍☠️ (@0xblacklight) reported 27 minutes ago

  @QuinnyPig @awscloud why does lambda still not support handling a single long-lived websocket connection like cloudflare workers do

• 
  adas🧦🌹 (@adastroworld) reported 28 minutes ago

  @thsottiaux just does a cloudflare auth "human check" loop when trying to sign in from the browser lol

• 
  Synapse Brief (@Synapse_Brief) reported 28 minutes ago

  Containers were never built for this. Cloudflare just proved it. On July 14, Cloudflare shipped Dynamic Worker Loader, an open beta feature that lets a Worker spin up a new Worker at runtime running AI-generated code. No container spin-up. No hundreds of milliseconds of cold start. Just an isolate booting in a few milliseconds using a few megabytes of memory. Cloudflare's own numbers: isolates start in single-digit milliseconds and sip a few MB of RAM. A typical container takes hundreds of milliseconds and eats hundreds of MB. Cloudflare is calling this roughly 100x faster and up to 100x more memory efficient. That's their claim, not an independent benchmark — nobody's third-party tested it yet. But even half true, it changes the math on running untrusted, AI-written code at scale. Here's the part that actually matters more than the speed number. This isn't just a faster sandbox. It's Cloudflare betting that agents are done being chatbots that make sequential tool calls, and are becoming code runners instead. Their framing: the LLM writes TypeScript, that code executes inside a Dynamic Worker, and only the result comes back into context. No fifteen round-trip tool calls burning tokens. One execution, one output. They're also pushing TypeScript RPC as the interface layer over raw HTTP for agent tooling — shorter, more precise, easier to constrain than a pile of REST endpoints. If that thesis holds, TypeScript quietly becomes the default control plane for how agents actually do things, not just talk about doing things. Security-wise, it's locked down by default: no outbound network access unless you explicitly wire it up through globalOutbound, with interception and credential injection available if you need it. Runs across every one of Cloudflare's hundreds of edge locations, usually on the same machine and thread as the parent Worker. And the pricing is almost a joke next to what inference costs: $0.002 per unique Worker loaded per day, waived entirely during beta. What's missing: real customer traction numbers for this specific feature, and no outside party has stress-tested the 100x claim across varied workloads. Take the performance number as Cloudflare's marketing until someone independently reproduces it. Still — pair this with Cloudflare shipping temporary accounts for agents in the same window, and the pattern is obvious. They're not building a feature. They're building the execution layer underneath every AI agent that needs to actually do things instead of just chat about them. Curious if anyone's already load-tested this in production, or if we're all still just reading the launch post.

• 
  Prajwal Tomar (@PrajwalTomar_) reported 29 minutes ago

  Vibe coders are getting sued. People are shipping apps with real users and skipping the boring stuff that kills them. A 20+ year dev shared the pre-launch checklist every AI builder needs. I added what I learned after shipping 60+ apps at the agency. Don't skip this: 1. Protect yourself, not just your app. The moment you collect user data you're in legal territory (GDPR, CCPA). Have a privacy policy. Know where user data lives. 2. Row Level Security. Without RLS, anyone can open DevTools and read your entire database. Supabase → Auth → Policies. Zero policies means your app is naked. 5 min to fix. 3. Test the failure path, not just the happy path. Wrong password 5x. Reset for an email that doesn't exist. Verification link clicked twice. Signup with an existing email. Catches 80% of auth bugs. 4. Security baseline in 2 min. Prompt your AI: "Review my app as a security specialist and make sure I have strong security headers and a solid baseline security posture." 5. OWASP. Prompt: "Review my app against OWASP standards and highlight vulnerabilities." This is where SQL injection, XSS and auth bugs actually get caught. 6. Client-side validation is UX, not security. Attackers disable JS and hit your API directly. Validate again on the server. Every time. 7. AI code leaks data in 3 spots: .env values in the frontend, API responses returning too much, secrets in logs. Prompt: "Check my app for credential or sensitive data leaks in frontend or API routes." 8. API keys in the frontend means game over. If it's in the browser, assume it's already taken. Move it server-side or proxy it. 9. Rate limits before someone burns your API bill. Cap every endpoint hitting a paid API. I've watched a Supabase bill jump from $20 to $200 in a day. 10. CAPTCHA on public forms (Cloudflare Turnstile is free) plus CORS locked to your domain. 10 min, kills bot floods. 11. Error messages that don't leak. "User not found", not "SELECT * FROM users failed". Log full errors server-side, show users generic messages. Build fast. Just don't ship naked. (full breakdown in my article below)

• 
  AX1 (@ax1vc) reported 30 minutes ago

  Money was never the barrier to agents. Permission was. Permission is shipping today, just not on the money side. Cloudflare is working on getting Web Bot Auth through the IETF standard process. The requests are signed, sites verify the source of the request, and permissions are granted to entire categories of agents at once. Visa's agent standard is based on those same signed requests. Now see what verification actually does. Identity. Who's running this agent, and whether they disclosed it correctly. Cloudflare's own docs highlight the hole: you can verify the identity of the operator and know nothing about the user behind it. There's no information about what this specific agent actually accomplished stored in the signature. The Ethereum standard is ERC-8004, onchain registries for storing exactly that, co-authored by MetaMask, EF, Google, and Coinbase, with Base next on the list. But registries store records, they don't create them. Competitions will provide some kinds of records. What an agent can do within a sandbox. The record of what they accomplished out there somewhere with users and stakes involved needs a witness. That witness is a product that lets the agent in and keeps track of the results. That’s what we built, and it goes live this week.

• 
  Matt Schober (@migratewithmatt) reported 30 minutes ago

  Stopping the bad guys with Cloudflare: 2,176 malicious requests blocked or challenged in the last month #cloudflare