How we scaled and protected Eurovision 2023 voting with Pages and Turnstile

Eurovision 2023: How a global voting platform scaled through Cloudflare

For the first time in its history, the Eurovision Song Contest allowed viewers from non-participating countries to vote online in 2023. With an estimated 162 million viewers across participating nations and millions more watching via livestreams, the contest became a worldwide event that demanded an infrastructure capable of handling extreme traffic surges and potential attacks.

once.net, the team behind the contest's digital voting platform, built and operated the system using a combination of Cloudflare services—including Pages, CDN, DDoS protection, WAF, and Turnstile—to manage the massive load and keep malicious actors at bay.

The platform behind the voting app

based.io, once.net's live data platform, was designed to handle up to 400 million concurrent connected users. Leveraging a real-time graph database, a custom networking layer, cloud functions, and infrastructure orchestration, the platform continuously monitors traffic and system health to scale resources dynamically. This real-time responsiveness proved essential for absorbing spikes, outages, and coordinated attacks without downtime.

In addition to Eurovision, based.io powers several other production workloads, including Tally, an interactive live television platform used by European broadcasters in over 100 live shows, and Airhub, a drone flight logging startup.

Managing peak demand without load balancers

based.io eschews traditional network or HTTP load balancers in favor of a client-side service discovery model. Each backend server registers a unique access key—valid for 15 seconds—with a central service registry. It also reports health metrics such as active connections, CPU, memory, and requests per second every 300 milliseconds. Clients query this registry for the optimal server URL and key, then establish long-lived connections. When a server becomes overloaded, it disconnects a portion of clients, who then rediscover available servers.

The central registry itself could become a bottleneck or attack vector, so based.io placed it behind Cloudflare's global network with a cache TTL of three seconds. This setup leverages fast cache propagation and Tiered Caching to reduce the registry's load while maintaining up-to-date server information. The elimination of load balancers reduces attack surface and allows for more efficient connection distribution based on real-time server health.

Scaling is fully automated. Additional machines, each supporting 40,000 connected users, are spun up in batches of hundreds. As each machine comes online, it configures its own DNS record via the Cloudflare API. Thanks to Cloudflare's high-speed DNS propagation, these changes take effect globally within seconds, resulting in a total machine turn-up time of roughly three seconds. This is critical in a 45-minute voting window with peak traffic occurring within minutes of opening.

Frontend and security layers

The voting landing page, esc.vote, was hosted directly on Cloudflare Pages, deployed via git commits with no need for origin infrastructure management. This removed concerns about the page's reachability or scaling under extreme load.

To protect payment API endpoints used for online vote validation, once.net deployed Cloudflare Turnstile. Using the invisible widget, requests from emulated browsers such as Selenium were blocked without requiring extra user interaction, preserving the user experience and conversion rates.

Grand Final performance

While the two semi-finals saw roughly 200,000 concurrent users each, the Grand Final on May 13 presented a far greater challenge. The once.net team pre-provisioned servers, coordinated with Cloudflare monitoring, and watched concurrent users climb steadily throughout the show. Several DDoS attempts against the site were automatically and instantaneously mitigated with no visible impact.

The discovery registry server was also targeted. Although the cache TTL was kept low at five seconds, allowing high-rate distributed traffic to still generate significant load, the infrastructure held. During normal conditions, the cache hit ratio was 20%; during a major attack, it peaked near 80%, demonstrating the effectiveness of combining Cloudflare CDN and DDoS protection for both dynamic and real-time content.

By the end of the event, based.io reached 1.3 million concurrent users at peak, processed 350 million total events, and served seven million unique users within three hours. The Cloudflare Pages-hosted landing page handled 2.3 million requests per second at peak, while Turnstile ensured voting payments came from genuine human users.

The impact spread beyond the platform itself, showing up in worldwide traffic statistics as a noticeable but brief spike—consistent with the global event's digital footprint.