I do use it but it involves lots of manual steps like putting it on Under Attack mode or blocking specific IPs or ASNs and it's a hassle when it should be automatic
@levelsio Why don't you just use cloudflare don't you think there service is a bit more advanced and actually they are not that expensive for basic protection?
Many users complained that Cloudflare forces tedious manual steps for Under Attack mode and IP/ASN blocking instead of providing automatic abuse protection, calling the lack of automation unscalable and frustrating.
No Digg Deeper questions have been answered for this story yet.
And with Cloudflare API key it can also start block stuff at their level without having to go in their dashboard!
Okay okay it won't block any DDOS, because that has to happen at Cloudflare's level and it still has Cloudflare in front so it can't use iptables on VPS etc.
But it helps to shut down people hammering the server (like scrapers)
@eliakuratli If an IP is probing my sites for .env etc it should just auto block, I don't get why I have to customize this for my 200+ domains in Cloudflare, again it's a hassle and it should be automatic
@ilyesm @levelsio It is actually built for that ;) You can use rate limiting rules for exactly at.
Check more infos here:
- https://blog.cloudflare.com/realtime-threat-intel-waf-rules/ - https://blog.cloudflare.com/attack-signature-detection/
@levelsio It's is possible but sadly only on a Enterprise plan...
https://developers.cloudflare.com/waf/account/
@eliakuratli Ahhh yes makes sense
Actually Cloudflare offers a lot of those features automated:
Just lower your DDoS ruleset sensitivity so it catches more on its own also use custom WAF rulesets just a onetime setup or automated with Claude.
Best part: you can set most of this up as code with Wrangler. Just let Claude read your traffic and write the rules for you, so it's kind of automated.
@bikykumarmanjhi @levelsio Try out Flarehawk
http://Flarehawk.com
@levelsio Exactly. Having to manually enable Under Attack Mode or block IPs/ASNs every time defeats the purpose. Good protection should be smart enough to detect and mitigate attacks automatically.
@levelsio Remembered that we configured that once for a client didn't knew that it's gated behind enterprise.
@levelsio The main problem with Cloudflare is that you still have to manually adjust IP/ASN rules, WAF, and other things, which doesn't scale.
Real-time, automated defence that adjusts to traffic patterns in place of you enforcing regulations during surges is what's lacking.
You’re talking about doing account-wide WAF configs. Auto blocking scanner activity is not what Cloudflare does. We see customer infra being hammered by scanners and fuzzers to the point where it’s borderline DDoS attacks. Cloudflare isnt built to stop that, so we built something that does!
@levelsio Thats the thing, the cheap basic tier is fine until you actually need the advanced features then the hassle piles up quick.
Yeah. Actually, making it yourself lets you customize freely, implement any features you want, and automate any parts with AI or whatever.
It's reasonable to build it yourself instead of using Cloudflare if it doesn't take too much time and effort to build and maintain, and if it actually gives you the results you want.
@levelsio all manual settings can be automatic with codex 'use computer', I mostly just ask codex to do my cf settings either via token api or use computer.
barely touch manual settings anymore, just ask codex to do it for me ;)
@levelsio Claude can tell CF
@levelsio That’s exactly what we’re doing with Flarehawk. Would love to give you a demo but feel free to try at http://flarehawk.com
@levelsio You could connect to the Cloudflare API to block it from there. That way they won't even reach your nginx
@levelsio The funniest part is that nobody had to exaggerate it.
@levelsio Yeah, that sounds like a pain. It really should be more straightforward.
@levelsio @eliakuratli I agree.