Cloudflare Docs
DDoS Protection
Edit this page
Report an issue with this page
Log into the Cloudflare dashboard
Set theme to dark (⇧+D)

Cloudflare DDoS Protection

Detect and mitigate distributed denial-of-service (DDoS) attacks automatically.
Available on all plans

Cloudflare automatically detects and mitigates distributed denial-of-service (DDoS) attacks via our autonomous DDoS systems.

These systems include multiple dynamic mitigation rules exposed as DDoS attack protection managed rulesets. You can customize the mitigation rules included in these rulesets to optimize and tailor the protection to your needs.


​​ Features

​​ Managed rulesets

Protect against a variety of DDoS attacks across layers 3/4 (network layer) and layer 7 (application layer) of the OSI model.

​​ Adaptive DDoS protection

Get increased protection against sophisticated DDoS attacks on layer 7 and layers 3/4.

​​ Advanced TCP protection

Detect and mitigate sophisticated out-of-state TCP attacks such as randomized and spoofed ACK floods, or SYN and SYN-ACK floods.

​​ Advanced DNS protection (beta)

Protect against DNS-based DDoS attacks, specifically sophisticated and fully randomized DNS attacks such as random prefix attacks.


​​ Availability

FreeProBusinessEnterpriseEnterprise with add-on

Availability

YesYesYesYesYes

Standard, unmetered DDoS
protection (layers 3-7)

YesYesYesYesYes

HTTP DDoS attack protection

YesYesYesYesYes

Network-layer (L3/4)
DDoS attack protection

YesYesYesYesYes

Managed rules customization

YesYesYesYes, with Log actionExpression fields & multi-rule support

Proactive false positive
detection for new rules

NoNoYesYesYes

Adaptive DDoS protection

Only error adaptive rulesOnly error adaptive rulesOnly error adaptive rulesOnly error adaptive rulesAll adaptive rules

Traffic profiling signals for
adaptive DDoS protection

Error rates onlyError rates onlyError rates & historical trendsError rates & historical trendsError rates & historical trends, client country, user agent, query string, ML-scores

Advanced TCP Protection

Available to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customers

Advanced DNS Protection

Available to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customersAvailable to Magic Transit customers

Alerts

YesYesYesYesAdvanced alerts with filtering