How To Mitigate DDoS Attacks Against Your Website with CloudFlare

After logging in, you will be taken to the Get Started with Cloudflare page. Here, you must click the Add site button at the top to add your website to Cloudflare:

Enter the domain name that you want to use Cloudflare with and click the Add Site button. You should be taken to a page that looks like this:

In this tutorial, we will select the Free plan option. If you want to pay for a different plan because you want additional Cloudflare features, feel free to do so. Then, click the Continue button.

The next page shows the results of the DNS record scan for your site. Be sure that all of your existing DNS records are present, as these are the records that Cloudflare will use to resolve requests to your domain. In our example, we used flippeddev.com as the domain:

Note that, for your A and CNAME records that point to your web server(s), the Status column should have an orange cloud with an arrow going through it. This indicates that the traffic will flow through Cloudflare’s reverse proxy before hitting your server(s).

The next page will display name servers that need to be removed and the Cloudflare name servers that should be added. Here is an example of what the page might look like:

To change your domain’s nameservers, log in to your domain registrar control panel and make the DNS changes that Cloudflare presented. For example, if you purchased your domain through a registrar like Google or NameCheap, you will need to log into the appropriate registrar’s control panel and make the changes there.

The process varies based on your particular domain registrar. If you can’t figure out how to do this, it is similar to the process described in How to Point to DigitalOcean Nameservers From Common Domain Registrars except you will use the Cloudflare nameservers instead of DigitalOcean’s.

In the example case, the domain is using DigitalOcean’s nameservers and we need to update it to use Cloudflare’s DNS.

When you are finished changing your nameservers, click the Continue button. It can take up to 24 hours for the nameservers to switch but it usually only takes several minutes.

Because updating nameservers takes an unpredictable amount of time, it is likely that you will see this page next:

The Pending status means that Cloudflare is waiting for the nameservers to update to the ones that it prescribed (e.g. olga.ns.Cloudflare.com and rob.ns.Cloudflare.com). If you changed your domain’s nameservers, all you have to do is wait and check back later for an Active status. If you click the Recheck Nameservers button or navigate to the Cloudflare dashboard, it will check if the nameservers have updated.

Once the nameservers update, your domain will be using Cloudflare’s DNS and you will see it has an Active status.

This means that Cloudflare is acting as a reverse proxy to your website, and you have access to whichever features are available to the pricing tier that you signed up for. If you’re using the free tier, as we are in this tutorial, you will have access to some of the features that can improve your site’s security, speed, and availability.

We won’t cover all of the features in this tutorial, as we are focusing on mitigating ongoing DDoS attacks, but they include CDN, SSL, static content caching, a firewall (before the traffic reaches your server), and traffic analytics tools.

Also note the Settings Summary, right below your domain will show your website’s current security level (medium by default) and some other information.

Before continuing, to get the most out of Cloudflare, you will want to follow this guide: Recommended First Steps for All Cloudflare Users. This is important to ensure that Cloudflare will allow legitimate connections from services that you want to allow, and so that your web server logs will show the original visitor IP addresses (instead of Cloudflare’s reverse proxy IP addresses).

Once you’re all set up, let’s take a look at the I’m Under Attack Mode setting in the Cloudflare firewall.

If you want enable I’m Under Attack Mode, the easiest way is to go to the Cloudflare Overview page (the default page) and toggle it on in the right sidebar:

The security settings will immediately switch to I’m Under Attack status. Now, any visitors to your site will be presented with the Cloudflare interstitial page that was described above.

As the I’m Under Attack Mode should only be used during DDoS emergencies, you should disable it if you aren’t under attack. To do so, go to the Cloudflare Overview page, and it back off. This will open a modal like this:

Then select the security level that you would like to switch to. The default and generally recommended, mode is Medium. Your site should revert back to an Active status, and the DDoS protection page will be disabled.