Using Cloudflare to Protect Your Site from DDoS Attacks

Learn how to defend your website against DDoS (distributed denial-of-service) attacks using Cloudflare’s "Under Attack" mode and IP whitelisting.

Understanding Cloudflare DDoS Protection

DDoS attacks involve multiple devices overwhelming a website with traffic, causing slowdowns or downtime. Cloudflare’s distributed network absorbs this traffic, reducing the impact of attacks.

For additional protection, you can enable "Under Attack" mode. This security feature checks incoming traffic before allowing access. Legitimate visitors see a brief interstitial page (about five seconds) while Cloudflare verifies the connection.

Alongside "Under Attack" mode, you can whitelist trusted IP addresses to further protect your site.

Enabling "Under Attack" Mode

1. Log in to your Cloudflare account.

2. In the left sidebar, click Websites, then select your domain.

3. In the right sidebar under Quick Actions, toggle the Under Attack Mode slider.

4. To disable it, click the slider again and select the desired security level.

Note: After an attack, using the High security level challenges visitors who have shown suspicious activity in the past 14 days. You can lower the level once the threat subsides.

Whitelisting IP Addresses

Whitelisting allows only trusted IPs to access your site, adding another layer of security.

1. Open the .htaccess file in /home/username/public_html/ using cPanel File Manager or SSH (replace username with your account username).

   • If the file doesn’t exist, create it.

2. Add the following lines at the top:

   order deny,allow
   deny from all

3. Copy Cloudflare’s IPv4 addresses from https://www.cloudflare.com/ips-v4 and paste them after deny from all, one per line, prefixed with allow from.

4. To add additional trusted IPs (e.g., home or office), use the same allow from IP_address format.

Tip: To find your IP address, visit http://ipfinder.us.

Save the .htaccess file. Your whitelist is now active.

Note: To remove whitelisting, either comment out lines with # or delete them.

More Information

For general Cloudflare guidance, visit https://www.cloudflare.com.