DDoS Mitigation
DDoS Mitigation tests whether you know which attack types Cloudflare absorbs automatically, which need configuration, and how those controls interact with caching and legitimate traffic.
Layer 3/4 versus layer 7
Network-layer attacks - SYN floods, UDP amplification, DNS reflection, GRE floods - are handled by Cloudflare's edge automatically and are unmetered on every plan. Anycast spreads traffic across many data centers so no single location absorbs the full volume; there is nothing to configure and no 'enable DDoS' switch. Non-HTTP protocols on the same network benefit from Spectrum or Magic Transit, which require explicit onboarding.
Application-layer attacks (HTTP floods) look like ordinary requests and cannot be filtered on volume alone. The HTTP DDoS attack protection managed ruleset scores request patterns and applies an action you choose: Log, Managed Challenge, or Block.
The knobs you control
- Sensitivity (High / Medium / Low) sets how aggressively the managed ruleset reacts; High catches more but can challenge real users during traffic spikes.
- Action override per ruleset or per rule.
- Rate limiting rules for endpoint-level abuse such as login attempts, which DDoS rules do not target precisely.
- Caching of static assets so floods never reach the origin; make sure query strings and cookies are not needlessly bypassing cache.
- Attack Surface Reduction to block traffic to endpoints you never use.
- Under Attack Mode - an emergency toggle that challenges every visitor. It is not a default.
Worked example
A marketing site returns intermittent 522s during a flood of requests to /search?q=<random>. Each unique query string is a cache miss, so every request reaches the origin. Reasoning: this is an L7 flood whose impact comes from cache-busting. Correct sequence: confirm in Security Events, raise HTTP DDoS sensitivity to High with a Managed Challenge action, add a rate limiting rule on /search per IP, and add a cache rule that ignores the query string for that path. Under Attack Mode would work but punishes real visitors and should be the last resort.
Traps
- Believing a cached site is immune when the attacker varies the query string.
- Leaving Under Attack Mode on permanently, which harms SEO and can break API clients.
- Expecting DDoS managed rules to stop credential stuffing - that is a rate limiting and WAF problem.
- Assuming attack traffic is billed; volumetric mitigation is not metered.