Emergency Cloudflare Support
Under attack right now? Get urgent Cloudflare help.
Active incident hotline
Site down, flooded or being scraped? Email us with URGENT in the subject or book the fastest available slot — we start triage as soon as we connect.
Who this is for
- E-commerce stores losing sales to downtime
- SaaS & APIs hit by floods or abuse
- Publishers & marketplaces under scraping
- Teams whose site broke after a change
Emergency actions
What we do in the first minutes of an incident
A focused set of edge actions to take pressure off your origin without blanket-blocking the customers and crawlers you need.
Fast assessment
We get on a call or chat within the agreed response window, confirm what is actually happening, and read your live Cloudflare analytics before touching anything.
Under Attack Mode
When traffic is overwhelming Layer 7, we enable Under Attack Mode on the right hostnames so visitors are challenged before they reach your origin — not blanket-blocked.
Rate limiting
Targeted rate-limit rules on login, search, checkout and API endpoints to throttle floods and abusive clients while real customers keep browsing.
WAF temporary hardening
Tightened managed and custom WAF rules to drop known-bad patterns, with a clear note of what was changed so it can be relaxed once the incident ends.
Origin protection
If your origin IP is exposed, we move to lock it down so attackers cannot bypass Cloudflare and hit your server directly.
Bot traffic triage
We separate scrapers, credential-stuffing and automated floods from genuine users and search engines, then apply challenges that stop bots without harming SEO.
Emergency rules
How we work under pressure
Our emergency rules
- Assess before we change anything
- Smallest effective change first
- Every change logged and reversible
- Protect checkout, login and SEO traffic
- Clear communication throughout the incident
- A written hand-off when it is over
Problems we solve
The emergencies we get called in for
Layer 7 DDoS flood
A surge of HTTP requests is exhausting your origin and the site is timing out. We absorb and challenge it at the edge.
Bot or scraping storm
Aggressive scraping or credential stuffing is spiking load, distorting analytics and slowing real users. We triage and throttle it.
WAF blocking customers
A rule or rollout is challenging or blocking legitimate checkout, login or API traffic. We find it and fix it fast.
Exposed origin under direct attack
Attackers found your origin IP and are bypassing Cloudflare. We harden the origin so all traffic routes through the edge.
Site unstable after a change
A recent DNS, cache or TLS change broke the site. We diagnose, roll back safely and stabilise it.
Peak-event meltdown
A drop, sale or Black Friday spike is overwhelming the stack. We add rate limiting and caching headroom on the fly.
Response flow
Our emergency response process
A repeatable, low-risk sequence we follow on every incident — from first contact to a stabilised, documented configuration.
- 1
1. Triage & assess
We confirm the symptoms, read live Cloudflare analytics and identify the attack vector or misconfiguration before changing a single setting.
- 2
2. Stabilise the edge
We apply the right mix of Under Attack Mode, rate limiting and temporary WAF hardening to take pressure off your origin within minutes.
- 3
3. Protect the origin
We close direct-to-origin bypass routes, tighten allow-lists and make sure traffic can only reach your server through Cloudflare.
- 4
4. Monitor & report
We watch the traffic settle, relax temporary rules as it is safe to do so, then hand you a post-incident report and hardening plan.
Safety
Are emergency changes reversible?
Yes. Speed should never mean recklessness. Every emergency change — Under Attack Mode, rate limits, WAF rules, cache and origin settings — is recorded so it can be relaxed or rolled back the moment it is safe. You are never left with quiet rules that block real customers after the dust settles.
What Cloudflare can and cannot do
The post-incident report
When the incident is resolved you receive a concise write-up so the next spike is calmer than this one.
- Timeline of what happened and when
- The attack vector or misconfiguration found
- Every change we made, and why
- What was temporary versus permanent
- A prioritised hardening plan going forward
Scope
What is and isn’t included
Honest boundaries so you know exactly what emergency support covers — and what needs your hosting, development or fraud teams.
What is included
- Live incident triage and edge stabilisation
- Under Attack Mode, rate limiting & WAF hardening
- Bot and scraping traffic triage
- Origin protection and bypass lockdown
- Safe rollback of any temporary change
- A post-incident report with next steps
What is not included
- Application code fixes or security patching
- Server, hosting or database administration
- Backups, restores and disaster recovery
- Anti-fraud / chargeback platform setup
- Full enterprise forensics and legal incident response
When you need this
- Your site is down, slow or timing out right now
- Traffic graphs are spiking with malicious requests
- A WAF rollout is blocking real customers
- Attackers are hitting your origin directly
- A recent Cloudflare change broke checkout or APIs
- A drop, sale or campaign is overwhelming the stack
When Cloudflare is not enough
Cloudflare is a powerful layer at the edge and we tune it hard during an incident, but it does not replace:
- Secure development, code review and timely patching of your application and plugins.
- Backups, disaster recovery and a tested restore process.
- A dedicated anti-fraud, chargeback or payment-risk platform.
- Hosting, database administration and origin server maintenance.
- Full incident response and forensics for large or regulated enterprises.
After the fire is out
From firefighting to managed protection
Emergencies are stressful and expensive. The best outcome is never needing one again.
Stay on a retainer or managed care
With a managed Cloudflare care plan we monitor your traffic, keep WAF and bot rules tuned, and have your context loaded before the next incident — so response is faster and prioritised. Managed clients get same-day attention and pre-agreed playbooks instead of a cold start.
- Ongoing monitoring and rule tuning
- Pre-built Under Attack & rate-limit playbooks
- Priority response for active incidents
- Indicative emergency engagements from $3,000
Indicative pricing
Emergency engagements are indicative from $3,000. Final pricing depends on severity, duration, the number of domains and your Cloudflare plan, and is confirmed in a short scoping message before work begins. Repeated attacks are almost always cheaper to handle on a monthly managed plan than as one-off emergencies.
Related services
Harden your defences before the next incident
Frequently asked questions
What counts as emergency Cloudflare support?
How fast can you respond when we are under attack?
Are the emergency changes reversible?
Can you stop a DDoS attack completely?
How much does emergency Cloudflare support cost?
Do you offer ongoing protection after the incident?
Under attack right now? Let’s get you stable.
Email us with URGENT in the subject or request emergency triage. We start as soon as we connect — fast, calm and fully documented.
Guaranteed response and uptime targets are only offered as part of a signed SLA.