Get started
Free, Pro, and Business plans
The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit.
In some situations, the default protection offered by DDoS rules may need to be fine-tuned to your specific situation. You may also want to configure additional protection using other Cloudflare products.
Adjust the provided DDoS rules
If one or more DDoS rules provided by Cloudflare affects legitimate traffic, you can adjust them so that they do not perform any mitigation action against this kind of traffic. Follow the steps in Handle a false positive to reduce the sensitivity level of one or more DDoS rules and allow incoming legitimate traffic.
Configure additional protection
To configure additional protection against DDoS attacks, refer to the related Cloudflare products listed in Network-layer DDoS Attack Protection and HTTP DDoS Attack Protection.
Enterprise plan
Cloudflare’s DDoS protection systems automatically detect and mitigate DDoS attacks. Additionally, the systems may flag suspiciously-looking incoming traffic from legacy applications, Internet services, or faulty client applications as malicious and apply mitigation actions. If the traffic is in fact legitimate, the mitigation actions can cause service disruptions and outages in your Internet properties.
To prevent this situation, Cloudflare recommends that you perform these steps to get started:
- Set the ruleset actions for all the DDoS Attack Protection managed rulesets to Log.
- Analyze the flagged traffic.
- Adjust the sensitivity or action of individual managed ruleset rules, if required.
- Switch ruleset actions from Log back to the default.
Prerequisites
You must have one of the following:
- A zone onboarded to Cloudflare but without updated DNS records
- An IP application onboarded to Spectrum
- An IP Prefix onboarded to Magic Transit
1. Configure ruleset actions to Log
Configure ruleset actions to Log for each of the DDoS Attack Protection managed rulesets.
Do the following in the Cloudflare dashboard:
- Log in to the Cloudflare dashboard, and select your account and zone.
- Go to Security > DDoS.
- Next to the managed ruleset you are configuring, select Configure.
- In Ruleset configuration > Ruleset action, select Log.
- Select Save.
- Repeat the procedure for all DDoS Attack Protection managed rulesets.
Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to log
by following these instructions:
- Configure an override for the HTTP DDoS Attack Protection managed ruleset
- Configure an override for the Network-layer DDoS Attack Protection managed ruleset
2. Review flagged traffic
- Go to your analytics dashboard (the exact dashboard depends on your Cloudflare services).
- Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if Log mode were disabled. Take note of the rule IDs.
3. Customize managed ruleset rules
Customize the managed ruleset rules you identified, changing their sensitivity or their action, using the Cloudflare dashboard or using the API.
If you are using the Cloudflare dashboard, refer to:
- Configure HTTP DDoS Attack Protection in the dashboard
- Configure Network-layer DDoS Attack Protection in the dashboard
If you are using the API, refer to:
When using the API, ensure that you add any required rule overrides without removing the ruleset override you configured in Step 1.
4. Switch ruleset actions back to the default
Revert the change you did in Step 1, changing the action of each managed ruleset rule back to its default value.
Do the following in the Cloudflare dashboard:
- Go to Security > DDoS.
- Next to the managed ruleset you would like to configure, select Configure.
- In Ruleset configuration > Ruleset action, select Default.
- Select Save.
Alternatively, if you are using the API, remove the override you previously configured at the ruleset level. Ensure that you only remove the ruleset override and not any of the rule overrides you may have configured in Step 3.
Repeat the procedure (via dashboard or API) for all DDoS Attack Protection managed rulesets.