Get started
The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit.
In some situations, the default protection offered by DDoS rules may need to be fine-tuned to your specific situation. You may also want to configure additional protection using other Cloudflare products.
If one or more DDoS rules provided by Cloudflare affects legitimate traffic, you can adjust them so that they do not perform any mitigation action against this kind of traffic. Follow the steps in Handle a false positive to reduce the sensitivity level of one or more DDoS rules and allow incoming legitimate traffic.
To configure additional protection against DDoS attacks, refer to the related Cloudflare products listed in Network-layer DDoS Attack Protection and HTTP DDoS Attack Protection.
Cloudflare's DDoS protection systems automatically detect and mitigate DDoS attacks. Additionally, the systems may flag suspiciously-looking incoming traffic from legacy applications, Internet services, or faulty client applications as malicious and apply mitigation actions. If the traffic is in fact legitimate, the mitigation actions can cause service disruptions and outages in your Internet properties.
To prevent this situation, Cloudflare recommends that you perform these steps to get started:
- Set the ruleset actions for all the DDoS Attack Protection managed rulesets to Log.
- Analyze the flagged traffic.
- Adjust the sensitivity or action of individual managed ruleset rules, if required.
- Switch ruleset actions from Log back to the default.
You must have one of the following:
- A zone onboarded to Cloudflare but without updated DNS records.
- An IP application onboarded to Spectrum.
- An IP Prefix onboarded to Magic Transit.
- Log in to the Cloudflare dashboard ↗, and select your account.
- Configure all the rules in the HTTP DDoS Attack Protection managed ruleset, setting their action to Log.
- Configure all the rules in the Network-layer DDoS Attack Protection managed ruleset, setting the action to Log.
Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to log by following these instructions:
- Configure an override for the HTTP DDoS Attack Protection managed ruleset
- Configure an override for the Network-layer DDoS Attack Protection managed ruleset
- Go to your analytics dashboard (the exact dashboard depends on your Cloudflare services).
- Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if Log mode were disabled. Take note of the rule IDs.
Customize the specific managed ruleset rules you identified, changing their sensitivity or their action, using the Cloudflare dashboard or using the API.
If you are using the Cloudflare dashboard, refer to:
- Configure HTTP DDoS Attack Protection in the dashboard
- Configure Network-layer DDoS Attack Protection in the dashboard
If you are using the API, refer to:
- Configure HTTP DDoS Attack Protection via API
- Configure Network-layer DDoS Attack Protection via API
When using the API, ensure that you add any required rule overrides without removing the ruleset override you configured in Step 1.
Revert the change you did in Step 1, changing the action of each managed ruleset rule back to Default in Ruleset action.
Alternatively, if you are using the API, remove the override you previously configured at the ruleset level for each managed ruleset. Ensure that you only remove the ruleset override and not any of the rule overrides you may have configured in Step 3.