Whenever I try to use a site that has Cloudflare, all I get is "performing security verification" and an endlessly spinning circle (if I'm lucky). It's been like this all day, on two different web browsers.

Disclosure: we run a monthly domain security census (Defaults.Exposed). This is from the October 2026 edition, as of 12 October 2026.

52,954,675 domains in the census list only Cloudflare nameservers. We sent each one a single web request and checked the response for a cf-ray header:

The no-answer group is mostly domains with nothing to answer: 8,205,996 publish no IPv4 or IPv6 address at the apex. Another 2,790,233 point inside Cloudflare's published ranges and still didn't respond.

Two limits worth knowing. A DNS-only record that points at a host running on Cloudflare also comes back with a cf-ray, so from outside the two look the same. And 2,529,524 of the proxied domains answered with a 5xx.

Among the largest TLDs, .cn stands out: 48.8% of its 1,842,889 Cloudflare-nameserver domains answered without a cf-ray.

Full breakdown by TLD: https://defaults.exposed/research/cloudflare-proxied-share

I tried to move a project from vercel to cloudflare using vinext. It worked but it is very slow is there anyway I can fix it

Please don't judge me. I'm just a guy exploring new things. I bought a domain on Cloudflare for $8.20, and I currently already setup self-hosted n8n instance using Docker and then I want tunnel it through Cloudflare for the webhook. However, I still can't get it to work because the current Cloudflare interface looks different from the one in the video I'm watching and following.

Does anyone have any ideas on how to get this working? I tried the Route option, but it didn't work. Any help would be greatly appreciated!

I have rules set-up but South Africa won't screw off.

(ip.src.continent in {"AF" "AN" "AS" "OC" "SA" "T1"})

Anyone know how to get my website domain on Cloudflare cleaned?

It was falsely flagged for phishing over one month ago. I removed the hidden debug menu I had in my code. And then requested a review in the abuse/ mitigation panel. That was over a month ago.

I sent emails to the trust and safety team but heard nothing.

Is there anyway to speed up the review process?

What do you guys recommend?

Chrome, ive turned off ad block and tried again in a new tab

Setup

• Server: a cloud Ubuntu VM running cloudflared as a named tunnel (systemd service). SSH is published through Cloudflare Access.
• Clients: two machines keep a reverse SSH tunnel open to the server so it can reach them.
  • A Windows PC running Ubuntu under WSL2. A user systemd unit runs: ssh -N -o ServerAliveInterval=20 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R 127.0.0.1:22022:127.0.0.1:22022 ssh.example.com with ProxyCommand cloudflared access ssh --hostname %h and an Access service token. systemd restarts it on exit.
  • A Mac running the same kind of ssh -N -R … command (under caffeinate).
• All three ends are now on cloudflared 2026.10.0.

Symptom

• Both clients' tunnels die every 10–30 minutes. That was 10 drops in 2 hours this morning on the PC alone.
• The client logs client_loop: send disconnect: Broken pipe.
• After each drop, reconnecting fails for 1–2 minutes with Error: remote port forwarding failed for listen port 22022. The server's sshd still holds the dead session's port forward until it notices the client is gone.

What I've checked/tried

• sshd keepalives: server sshd has ClientAliveInterval 15 and ClientAliveCountMax 3. Recovery is still about 2 minutes.
• Server tunnel log: the server-side cloudflared was on QUIC and logged failed to accept QUIC stream: Application error 0x0 (remote) / Connection terminated a few times an hour. Those times did not line up with the client drops.
• Update and HTTP/2: I updated cloudflared everywhere and set protocol: http2 on the server tunnel. Since then I've had 1 drop in about 40 minutes, versus about 5 an hour before, so it's better but not fixed.

Questions

1. Does Cloudflare Access put an idle limit or maximum lifetime on cloudflared access ssh websocket sessions? Is there a setting to raise it?
2. Is a persistent reverse tunnel through Access a supported pattern at all, or should I use something else (Tailscale, WireGuard, or a second named tunnel on each client)?
3. Could the WSL2 NAT layer be dropping a long-lived TCP connection even with 20-second SSH keepalives? The Mac drops too, so I suspect the shared Cloudflare path.
4. Is there a good way to make the server release the dead forward faster?

Thanks!

Hi

So I bought a domain on Hostinger. Then pushed the website to Vercel. Then added a CNAME record with www pointing to the Vercel's DNS.

I want to protect my website through Cloudflare. When I go to Cloudflare DNS, I already see www.my-website-name.com type CNAME and content abcd123.vercel-dns-012.com and Proxy Status says "Proxied" (I modified the real values).

Does that mean it's also proxied? If yes, how did this end up here (I didnt add any DNS info to Cloudflare before. I am using the Turnstile only). If not, what should I do?

Sorry for sounding so noob. I'm mostly a FE developer and server stuff isn't my strong suit.

Thanks

Is it normal to have IPs that trace to Cloudflare probing non exists sub domains and files on a server ex cpcontacts.mydomain.com?

I deployed an unfinished application using Cloudflare services, more specifically the D1 SQLite storage. The app was not ready for the public, but I still wanted to test it with colleagues on live server before advertising it.

After deploying, I went to bed and woke up to a huge pending billing status. I realized my app had huge writes/reads during this short period, and it was still continuing. I stopped it, figured it was a bug on a specific route that would cause this issue on every call.

But why such a huge bill?? I'd only given the endpoint to a few individuals... Looking at the logs, I saw thousands of crawlers (anthropic in there -_-) leeching on every incremental page, which would trigger the bug each call. What a nightmare.

I asked Cloudflare for a refund, but they insisted it's not possible per their billing policy. Bummer and predatory tactics. Imagine if I hadn't been able to get access to the computer the next day. It would have racked up thousands of dollars in a few days.

The thing is, it is not possible to set a hard cap, nor is there one by default. So, I implore Cloudflare to implement this feature and have it enabled by default. Instead we have this useless alert that tells you you're getting rammed while sometimes you are not in a position to address the problem right away.

Also funny, I opened a support case first and they told me to wait for the billing invoice to be charged and then they would look into it. Fucking stupid of me, should have cancelled my card right away.

It was always annoying, after you self-host an app on cf, to keep it updated and watch it. So annoying that I built Appflare.

Appflare lets you install more than 100 apps from its catalog, and update them with literally just one click. It can also watch them to make sure they don't cause you a surprise bill, and can even pause them automatically in time.

It's like an app store, but for your own Cloudflare account.

github: https://github.com/appflare/appflare
docs: https://appflare.dev

Most apps (127 of them!) runs on the free tier!

Hey everyone,

I’m running into a frustrating issue after moving my website's media storage over to Cloudflare R2.

All of my regular photo images (.jpg, .png) are displaying perfectly fine, but none of my SVGs / Flaticons are showing up across the entire site. They just appear as blank spaces.

Here is what I have already tried to fix it:

CORS Policy: I set up a CORS profile on the R2 bucket explicitly enabling my public domain URL, allowing GET and HEAD requests.

Headers: Ensured Access-Control-Allow-Origin is pointing to my domain.

Caching & Purging: Purged the Cloudflare cache completely and tested in incognito/different browsers.

Despite this, the SVGs still refuse to render. Since the standard images load flawlessly, I'm wondering if this is a specific issue with how R2 or the CDN handles the image/svg+xml Content-Type header, or if there's an underlying CORS quirk with font/vector files that I am missing.

Has anyone encountered this when migrating to R2? Any ideas on how to fix this or what settings I should check next in my dashboard?

Thanks

I’ve been building a few small web tools and hosting them on Cloudflare Pages using the free .pages.dev subdomain. and I am wondering if there’s any issue with using these sites commercially.

For example, could I build a simple tool like a character counter, image resizer, calculator, etc., keep it on a .pages.dev domain, and monetize the site with display ads?

I’m not talking about anything high-traffic yet, just small utility sites that might eventually earn some ad revenue. Has anyone done this with Cloudflare Pages? Are there any restrictions, Terms of Service issues, or reasons I should move to a custom domain before monetizing?

(I don't wanna pay that fee of buying a domain)

i run a small browser calling app on workers. when you hit call, the browser leg connects to the phone provider, their webhook comes back, and only then do we dial the actual number.

that path used to go through three queue hops: the webhook went into a queue, then two more queued events ran before the dial. the priority consumer already had max_batch_timeout: 0 and max_batch_size: 5, so i assumed delivery would be close to instant. it wasn't. each hop waited 3 to 5.5 s, and the queue's lagTime metric averaged 4 to 6 s. callers sat in 5 to 16 s of silence after connecting, and some hung up before the other phone even rang.

the fix was boring. the webhook handler now commits the call state and places the dial inside the same request, and it only returns 200 once that's committed, so if anything fails the provider just resends the webhook. in a local test the gap dropped to about 0.26 s. the queue still carries the background work that can wait.

has anyone gotten push consumers reliably under a second? the consumer also had max_concurrency: 10, which cloudflare's docs say to leave unset, and i'm not sure if that or cold consumers after deploys was part of it.

Earlier this month I posted GitOrange here, a GitHub-style code host I put together on Workers and Artifacts the day Artifacts launched. I said it would be the base of my entry for Cloudflare's Git platform challenge. Entries close tomorrow, so here's where it ended up.

The first version was basically "GitHub on your own Cloudflare account". Once I pointed a bunch of Claude Code sessions at it at the same time, I realised the clone wasn't the interesting part. Three things broke.

1. Agents edit the same files, and they don't know what should land first.

Every pair of open PRs gets checked. A plain text check rules out most of them. The rest go to Clef, a small decision model on Workers AI that answers "are these two related?" with a probability. In one run it cleared 18 pairs for under half a cent in total. Only when it says yes, or isn't sure, does a bigger model read both diffs and write down why.

If one branch already contains another's commits, git decides, not a model. The result is a dependency graph that every agent reads over MCP, so each one knows what it's waiting on.

2. Nobody can read fifty diffs.

Reviewer agents do reviews, and each is its own git repo: an AGENT.md that says what it looks for, plus a knowledge folder. Changing a reviewer is just a PR.

Clef picks which reviewers a change concerns. A PR that added a table went to Data, DevOps and Features; a README change went to none of them.

When an agent needs a person, you get a plain question with a before/after table and a sequence diagram or ERD, not a diff. If you dismiss a finding, the agent commits that lesson to its own instructions so it doesn't ask again.

3. Every merge turns into a conflict.

Rebase only. GitOrange keeps open PRs rebased onto main by itself and lands them as fast-forwards, so two agents can't land over each other. Real conflicts go to a durable agent built on the Agents SDK, working in a sandbox. If it can't resolve one, the PR goes back to the coding agent with the exact commit and files.

It's still one Worker: Artifacts for git objects, D1, Workflows and Durable Objects for the agents, Containers for checks, Workers AI for Clef. Apache 2.0, same repo as before (this is now a mirror - active development through GitOrange only!): https://github.com/choyiny/gitorange

Two things I'm still unsure about, and I'd like to hear what you think:

- Is rebase-only too opinionated for teams that like merge commits?

- Would you let an AI resolve your merge conflicts if it showed you its reasoning?