DDoS Protection

Cloudflare DDoS protection that helps keep your store or service online under attack

Independent DDoS readiness for online stores, SaaS platforms and high-traffic businesses: Under Attack Mode playbooks, Layer 7 mitigation, origin IP hardening, rate limiting and peak-traffic readiness — to help keep checkout and critical services open when traffic turns hostile.

Request Emergency Help Request a Cloudflare Audit

Who this is for

Online stores on any e-commerce platform
High-traffic sites preparing for Black Friday or drops
SaaS, APIs and corporate sites that cannot afford downtime
Banks, fintech and businesses recovering from an attack

Capabilities

What Cloudflare DDoS protection covers for a store

From a written readiness plan to live mitigation — the full DDoS surface, handled by one independent specialist.

DDoS readiness review

We assess your store, hosting and Cloudflare setup, then leave you with a written playbook you can run the moment traffic turns hostile.

Under Attack Mode setup

A clear plan for when and how to enable Under Attack Mode — and how to keep checkout and APIs working once it is on.

Layer 7 mitigation

Application-layer rules, challenges and managed DDoS protection tuned to absorb HTTP floods aimed at product, search and checkout pages.

Origin IP protection

We find and close the leaks that expose your real origin IP, so attackers cannot bypass Cloudflare and hit your server directly.

Rate limiting

Targeted rate-limiting rules on login, checkout, search and APIs that slow abuse without throttling genuine shoppers at peak times.

Monitoring & escalation

Alerting, dashboards and a defined escalation path so the right person acts in minutes instead of discovering an attack from customer complaints.

Problems we solve

The DDoS issues that hurt online stores

Store goes down at peak traffic

A flood of requests overwhelms your origin during a sale or drop. We add edge mitigation and rate limiting so legitimate orders still get through.

Exposed origin IP

Old DNS records, email headers or direct subdomains reveal your server. Attackers hit it directly and skip Cloudflare entirely. We lock it down.

Layer 7 floods hammer checkout

Volumetric defences pass but HTTP floods still bury your application. We tune L7 rules and challenges around the endpoints that matter.

No plan when an attack starts

Nobody knows who enables Under Attack Mode or which rules to deploy. We give you a written playbook and clear ownership.

Rate limits block real shoppers

Blunt rules throttle genuine customers during a Black Friday rush. We scope limits to abusive patterns, not normal buying behaviour.

Attacks discovered too late

Without monitoring, the first signal is a drop in revenue. We set up alerting and an escalation path so you react in minutes.

L3/L4 vs L7

What is the difference between volumetric and application attacks?

Volumetric L3/L4 attacks try to saturate your network with raw packets. Cloudflare’s always-on network absorbs the vast majority of this automatically, before it ever reaches your origin.

L7 application attacks are sneakier: they send valid-looking HTTP requests to expensive pages like search, cart and checkout. These need WAF rules, rate limiting and challenges — and they are where most e-commerce outages actually happen.

How we defend each layer

L3/L4: always-on network-layer absorption at the edge
L7: WAF, managed DDoS rules and targeted challenges
Rate limiting scoped to abusive request patterns
Caching safe assets to shrink the attackable surface

Origin protection

Why hiding your origin IP is non-negotiable

Edge protection only works if attackers have to go through the edge. If your real origin IP leaks, they can attack your server directly and bypass Cloudflare completely.

Origins commonly leak through stale DNS records, email headers, direct subdomains and misconfigured services. We find these exposures, lock your origin firewall to Cloudflare IP ranges, and rotate the IP when it has already been exposed.

Start with a Cloudflare audit

Origin hardening checklist

Audit DNS, subdomains and mail for IP leaks
Firewall origin to Cloudflare IP ranges only
Enable Authenticated Origin Pulls where supported
Rotate the origin IP after a confirmed leak

Emergency playbook

What happens when an attack starts

A rehearsed, four-step response so the right defences go up in minutes — not after revenue has already dropped.

1
1. Confirm & triage
Verify it is an attack, not a viral spike or a broken deploy. Check Cloudflare analytics, origin health and the targeted endpoints, then classify it as L3/L4 volumetric or L7 application.
2
2. Raise the shields
Enable Under Attack Mode or the prepared security level, deploy your saved WAF and rate-limiting rules for checkout, login and search, and challenge suspicious traffic at the edge.
3
3. Protect the origin
Confirm the origin only accepts Cloudflare IPs, tighten firewall rules and rotate the origin IP if it has leaked, so the attack cannot route around the edge.
4
4. Monitor & stand down
Watch traffic, error rates and conversion as mitigation takes effect, tune rules to release any blocked real customers, then ease settings back to normal and write up what happened.

Before an attack

What to prepare BEFORE an attack happens

The work that turns a crisis into a one-click response. We set all of this up so you are ready ahead of peak events.

Map and remove DNS records or subdomains that expose your real origin IP.
Lock the origin firewall to Cloudflare IP ranges (and Authenticated Origin Pulls where supported).
Pre-build and save WAF, rate-limiting and Under Attack rule sets so they deploy in one click.
Document who can enable Under Attack Mode and how to reach them out of hours.
Set up traffic, error-rate and origin-health alerting that pages a real person.
Identify checkout, login, search and API endpoints that must stay available under load.
Rehearse the playbook before peak events like Black Friday, launches or product drops.

Black Friday & peak-traffic readiness

Peak events draw both genuine demand and opportunistic attackers. The two look similar at the edge, so blunt rules either let attacks through or block paying customers. We prepare your configuration so it can tell them apart under load.

Rate limits tuned to abuse, not buying behaviour
Cache rules that protect the origin but never the cart
Saved Under Attack and WAF rule sets ready to deploy
A monitoring and escalation plan for the busiest hours

Scope

What is and isn’t included

Honest boundaries from the start, so you know exactly what this engagement covers.

What is included

DDoS readiness review and written response playbook
Under Attack Mode plan and configuration
Layer 7 WAF and managed DDoS rule tuning
Origin IP protection and firewall lockdown
Rate-limiting rules for checkout, login, search and APIs
Monitoring, alerting and escalation setup

What is not included

Server, hosting capacity or database administration
Application code fixes or performance refactoring
Anti-fraud, chargeback or payment-risk platforms
Backups, disaster recovery and restore testing
Guaranteed uptime (only via a signed SLA)

When you need this

You are under attack right now and the store is unstable
A sale, launch or product drop is coming up
You are preparing for Black Friday and peak season
Your origin IP may be exposed or has been attacked before
Nobody owns your DDoS response or escalation plan

When Cloudflare is not enough

Cloudflare is a strong layer at the edge that reduces risk and blocks a large share of malicious traffic. It does not replace:

Secure development, code review and timely patching of your application and plugins.
Backups, disaster recovery and a tested restore process.
A dedicated anti-fraud, chargeback or payment-risk platform.
Hosting, database administration and origin server maintenance.
Full incident response and forensics for large or regulated enterprises.

What Cloudflare can and cannot do

Cloudflare reduces risk, blocks a large share of malicious traffic, hardens critical endpoints and improves performance. No edge platform can make a website completely or permanently secure, and Cloudflare does not, on its own, stop payment fraud or replace secure development, patching, backups, anti-fraud platforms or proper hosting. We configure Cloudflare as one strong layer in a complete security posture.

Related services

Strengthen the rest of your defences

Emergency Cloudflare SupportUnder attack right now? Fast triage.Cloudflare WAF SetupRules that protect, not block.Bot ProtectionStop scraping and stuffing.Managed Cloudflare ServicesOngoing monitoring and tuning.Cloudflare for MagentoEnterprise store protection.Cloudflare AuditFind origin and config gaps.

Frequently asked questions

What is DDoS protection for e-commerce?

DDoS protection for e-commerce is the combination of edge mitigation, rate limiting and origin hardening that keeps an online store reachable when it is flooded with malicious traffic. With Cloudflare it means using always-on network-layer defence, Layer 7 application rules, Under Attack Mode and origin IP protection so genuine shoppers can still browse and check out during an attack.

What is Cloudflare Under Attack Mode and when should I use it?

Under Attack Mode is a Cloudflare security level that presents an interstitial challenge to visitors before they reach your site, filtering out most automated Layer 7 attack traffic. It is meant for active HTTP-flood attacks, not as a permanent setting, because it adds friction for real customers. We help you decide when to enable it, scope it to affected paths, and keep checkout and APIs working while it is on.

What is the difference between L3/L4 and L7 DDoS attacks?

L3/L4 attacks are volumetric: they try to saturate your network or transport layer with raw packets, and Cloudflare's always-on network absorbs most of this automatically. L7 attacks target the application layer with seemingly valid HTTP requests to expensive pages such as search, cart and checkout, so they need WAF rules, rate limiting and challenges. E-commerce sites are most often hurt by L7 attacks, which is where careful tuning matters most.

Why does hiding my origin IP matter?

If an attacker learns your real origin IP they can attack your server directly and bypass Cloudflare entirely, making the edge protection useless. Origins leak through old DNS records, email headers, direct subdomains and misconfigured services. We find these exposures, lock your origin firewall to Cloudflare IP ranges and, where needed, rotate the IP so all traffic must pass through Cloudflare.

Can Cloudflare keep my store online during Black Friday?

Cloudflare significantly improves your ability to stay online during peak events by absorbing attack traffic, caching what is safe to cache and rate-limiting abuse, but no provider can guarantee 100% uptime. Real peak readiness also depends on your hosting capacity, application performance and a tested plan. Uptime targets are only committed as part of a signed SLA. We prepare your configuration and playbook so you are ready before the rush, not scrambling during it.

Do you offer emergency help if I am under attack right now?

Yes. If you are under attack right now, request emergency Cloudflare support and we will triage the incident, raise the appropriate edge defences, protect your origin and stabilise the site. After the incident we harden the configuration and leave you with a playbook so the next attack is far less disruptive.

How this project is scoped — no hourly meter

Fixed scope, fixed timeline — priced by deliverable against an agreed Statement of Work, not by an hourly meter. Typically 2–4 weeks, delivered remotely.

What's included

Discovery & kick-off call to confirm goals and scope
Architecture & configuration review
Cloudflare setup for the agreed scope: DNS, SSL/TLS, WAF baseline, caching/performance and the products in your plan
Validation and a supervised go-live
Handover pack: runbook, configuration documentation and a team walkthrough
A 14-day post-go-live support window for fixes to what we configured

Not included (quoted separately)

Non-Cloudflare work (application/backend changes, third-party security tools)
Additional domains/zones beyond the agreed scope
Ongoing monthly management (that is a Care plan)
Anything not in the Statement of Work — handled as a separately quoted change order

Indicative “from” prices are a starting point. Your final price is confirmed in a written proposal after a free scoping call, and depends on the number of zones, the Cloudflare products in scope and environment complexity.

Get DDoS-ready before the next peak

Whether you are under attack now or preparing for Black Friday, we will harden your Cloudflare setup and leave you with a playbook you can run in minutes.