Skip to content
Cloudflare Docs

Adaptive DDoS Protection

Adaptive DDoS Protection learns your unique traffic patterns and adapts to them to provide better protection against sophisticated DDoS attacks on layer 7 and layers 3/4, depending on your subscribed Cloudflare services.

Adaptive DDoS Protection provides the following types of protection:

  • Adaptive DDoS Protection for Origins: Detects and mitigates traffic that deviates from your site's origin errors profile.
  • Adaptive DDoS Protection for User-Agents: Detects and mitigates traffic that deviates from the top User Agents seen by Cloudflare on the network. The User Agent profile is built from the entire Cloudflare network and not only from the customer's zone.
  • Adaptive DDoS Protection for Locations: Detects and mitigates traffic that deviates from your site’s geo-distribution profile. The profile is calculated from the rate for every client country and region, using the rates from the past seven days.
  • Adaptive DDoS Protection for Protocols: Detects and mitigates traffic that deviates from your traffic’s IP protocol profile. The profile is calculated as a global rate for each of your prefixes.

Availability

Cloudflare Adaptive DDoS Protection is available to Enterprise customers according to the following table:

FeatureProfiling dimensionWAF/CDN1Magic Transit /
Spectrum BYOIP2
HTTP Adaptive DDoS Protection
For OriginsOrigin errorsYes—
For User-AgentsUser Agent
(entire Cloudflare network)		Yes—
For LocationsClient IP country and regionYes—
L3/4 Adaptive DDoS Protection
For ProtocolsIP protocol—Yes
For ProtocolsClient IP country and Region for UDP—Yes

1 WAF/CDN customers on the Enterprise plan with the Advanced DDoS Protection subscription.
2 Magic Transit and Spectrum BYOIP customers on an Enterprise plan.

How it works

Adaptive DDoS Protection creates a traffic profile by looking at the maximum rates of traffic every day, for the past seven days. These profiles are recalculated every day, keeping the seven-day time window. Adaptive DDoS Protection stores the maximal traffic rates seen for every predefined dimension value (the profiling dimension varies for each rule). Every profile uses one dimension, such as the source country of the request, the user agent, and the IP protocol. Incoming traffic that deviates from your profile may be malicious.

To eliminate outliers, rate calculations only consider the 95th percentile rates (discarding the top 5% of the highest rates). Cloudflare requires a minimum amount of requests per second (rps) to build traffic profiles. HTTP Adaptive DDoS Protection rules also take into account Cloudflare’s Machine Learning (ML) models to identify traffic that is likely automated.

Cloudflare may change the logic of these protection rules from time to time to improve them. Any rule changes will appear in the Managed rulesets changelog page.

DDoS protection based on the origin HTTP error rate

Cloudflare’s network is built to automatically monitor and mitigate large DDoS attacks. Cloudflare also helps mitigate smaller DDoS attacks, based on the following general rules:

  • For zones on any plan, Cloudflare will apply mitigations when the HTTP error rate is above the High (default) sensitivity level of 1,000 errors-per-second rate threshold. You can decrease the sensitivity level by configuring the HTTP DDoS Attack Protection managed ruleset.
  • For zones on Pro, Business, and Enterprise plans, Cloudflare performs an additional check for better detection accuracy: the errors-per-second rate must also be at least five times the normal origin traffic levels before applying DDoS mitigations.

Cloudflare determines the error rate based on all HTTP errors in the 52X range (Internal Server Error) and in the 53X range, except for error 530. Currently, for DDoS mitigations based on HTTP error rate, you cannot exclude specific HTTP error codes.

For more information on the types of DDoS attacks covered by Cloudflare's DDoS protection, refer to DDoS attack coverage.

View flagged traffic

To view traffic flagged by HTTP Adaptive DDoS Protection rules:

  1. Log in to the Cloudflare dashboard ↗, and select your account and website.
  2. Go to Security > Events.
  3. Filter by Service equals HTTP DDoS and by rule ID.

To view traffic flagged by L3/4 Adaptive DDoS Protection rules:

  1. Log in to the Cloudflare dashboard ↗ and select your account.
  2. Go to Account Home > Analytics & Logs > Network Analytics.
  3. Filter by Ruleset ID equals 3b64149bfa6e4220bbbc2bd6db589552 (the ID of the Network-layer DDoS Attack Protection managed ruleset) and by rule ID.

You may also obtain information about flagged traffic through Logpush or the GraphQL API.

Configure the rules

You can adjust the action and sensitivity of the Adaptive DDoS Protection rules. The default action is Log. Use this action to first observe what traffic is flagged before deciding on a mitigation action.

To configure a rule, refer to the instructions in the following pages:

For more information on the available configuration parameters, refer to the following pages:

Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal
Cookie Settings