Application security: Cloudflare’s view

The Threat Landscape at the Edge

Cloudflare’s position in front of millions of web properties provides a unique vantage point for observing application security trends. The network handles roughly 32 million HTTP requests per second on average, peaking above 44 million. Of that total, about 2.5 million requests per second are stopped by security controls before they reach a customer’s origin infrastructure. This section breaks down what that mitigated traffic looks like and what it tells us about how attackers operate.

Defining the Terms

To interpret the following data, a few definitions are needed. Mitigated Traffic refers to any HTTP request that received a terminating action such as BLOCK or CHALLENGE; requests with LOG, SKIP, or ALLOW actions are excluded. Bot Traffic is any request classified by Cloudflare’s Bot Management system as automated, meaning it received a bot score between 1 and 29. API Traffic includes requests with response content types of XML, JSON, gRPC, or similar. Unless noted otherwise, the statistics below cover the three months from December 1, 2021, to March 1, 2022.

Where Mitigations Come From

Roughly 8% of all HTTP traffic proxied by Cloudflare is mitigated. The sources of these blocks are not evenly distributed. Fully automated, always-on services handle the bulk of the work, while customer-configured rules account for a significant slice as well. The breakdown is as follows:

• Layer 7 DDoS mitigation is responsible for 66% of all mitigated requests. These managed rules require no user configuration and automatically detect attacks from botnets such as Meris and Mirai, as well as other known attack tools. Volumetric attacks naturally produce enormous amounts of malicious traffic.
• Custom WAF Rules contribute 19% of mitigated traffic. These are user-defined filters written in Cloudflare’s wirefilter syntax, and they represent the largest category of human-configured security policies.
• Rate Limiting accounts for 10.5% of mitigated requests. It is commonly used as a second layer of defense against traffic patterns too small to trigger DDoS protection.
• IP Threat Reputation (the Security Level setting in the dashboard) drives 2.5% of mitigations. Cloudflare assigns a threat score to each IP based on observed network behavior and challenges traffic when the score exceeds a customer’s threshold.
• Managed WAF Rules, handcrafted by Cloudflare’s security team, contribute about 1.5% of mitigated requests.

Looking at the Managed WAF Rules in isolation reveals the most common attack types. HTTP anomalies dominate, making up over 54% of blocked requests. This category includes malformed method names, null byte characters in headers, non-standard ports, and POST requests with a content length of zero.

Better-known attack vectors are far less prevalent than their reputation might suggest. Cross-site scripting (XSS) and SQL injection combined account for only 13% of mitigations. Information disclosure attempts rank third at 10%, and software-specific CVE-based attacks account for about 12% — more than SQLi alone. The recent Log4J vulnerability highlights how quickly proof-of-concept exploits are weaponized, and the data suggests that patching speed is a critical defensive measure.

IP Addresses Remain the Default Filter

The 19% of mitigations from Custom WAF Rules comes from a corpus of roughly 6.5 million deployed rules. Examining which fields customers use in those rules provides insight into how security teams build their defenses. The source IP address, or fields derived from it such as client country location, appears in approximately 64% of all custom rules. This persistence is notable because IP addresses are becoming less reliable as security signals, particularly with the rise of services like iCloud Private Relay. However, IP-based filtering remains the quickest and simplest method during an active attack.

Beyond IP-derived fields, standard HTTP request attributes — URI, User-Agent, Path, and Referer — are the most commonly used. The average custom rule combines at least three independent fields, indicating that customers typically build multi-condition filters rather than relying on a single signal.

The State of Automated Traffic

Bot traffic makes up about 38% of all HTTP requests observed by Cloudflare. This includes both Verified Bots — well-known crawlers like GoogleBot that benefit site owners — and thousands of custom-built tools such as scanners and attack bots. Customers do not treat all automation equally. When traffic is identified as coming from a verified bot, site owners allow 41% of it through to their origins and block only 6.4%. The remainder is handled with challenges or other non-terminating responses.

Non-verified bot traffic receives much stricter treatment. Of the 31% of bot traffic that Cloudflare cannot attribute to a known legitimate source, customers mitigate 38.5% of requests. Interestingly, almost 30% of this unverified bot traffic is logged rather than blocked immediately. Many enterprise customers deliberately avoid giving attackers a clear feedback signal; they tag and monitor the traffic instead, choosing to drop it later or redirect it to alternate content. A small portion — nearly 3% — of non-verified bot requests are automatically stopped by DDoS protection via connection_close, as these often originate from botnets targeting customer applications.

The distinction between verified and non-verified bots underscores an important point: automation is not inherently malicious, but the two categories require very different security postures. Site operators clearly value the ability to make that distinction at a granular level rather than applying a simple binary bot-or-not policy.

Bots and the Human Web

The majority of traffic on the Internet is not generated by humans clicking through web pages. Instead, it comes from automated software—bots—that perform everything from search indexing to credential stuffing. Because this activity consumes resources and can probe for weaknesses, identifying and managing bot traffic is now a core part of application security, not merely an operational nuisance.

Cloudflare’s observed traffic shows that roughly one-third of all requests are automated. While a significant portion of this is benign—think search engines and monitoring tools—a meaningful percentage is designed to abuse applications. The data shows that mitigated bot requests make up a substantial share of all blocked traffic, with distributed denial-of-service (DDoS) protection handling much of the load. However, a considerable volume of bot mitigation falls to Browser Integrity Check and Block IP rules, indicating that simple source-based filtering still plays a vital role in defense.

It is important to note that not all bot traffic is malicious. In fact, nearly half of all bot requests are considered "good" or verified. The problem is that a large proportion of the remaining traffic is both unwanted and difficult to classify as definitively malicious or benign. This "unclassified" traffic often comes from tools that can switch behavior, making it a grey area that security teams must monitor closely to avoid false positives while blocking actual attacks.

Measuring the threat landscape

When Cloudflare blocks a request, it categorizes the reason. Globally, the bulk of mitigated requests—over 80%—are stopped not by a specific security rule, but by the network's own DDoS mitigation systems. This indicates that volumetric attacks are a persistent, opportunistic threat against almost any connected service.

For the remainder of mitigated traffic, the reasons are more varied. The data shows a clear split between requests blocked by a WAF (either managed rules or custom rules) and those blocked by IP or bot management products. In terms of specific attack payloads, SQL injection (SQLi) and cross-site scripting (XSS) are the most common types detected by the WAF managed rules. Notably, the volume of threats like SQLi and XSS is relatively close, a sign that attackers are casting a wide net across different application layers and not solely focusing on the most notorious vulnerabilities. The WAF data also shows a long tail of other vectors, from file inclusion attempts to command injection, each contributing a smaller but non-negligible portion of the blocked requests.

Looking at the specific industries hit by these attacks, the insights reveal a bell curve distribution. Several sectors—such as consumer services, financial services, and the internet economy—cluster in the mid-range of attack rates. Interestingly, the sectors traditionally assumed to be high-value targets, such as banking, do not necessarily top the charts for raw attack surface. Instead, a higher percentage of mitigation is often seen in sectors like higher education and blockchain, which may have larger public-facing footprints relative to their security staffing levels.

DDoS: the persistent baseline

While the security community spends considerable energy on advanced evasion techniques, the reality of the threat landscape is that DDoS remains the most effective and commonly used tool. The statistics bear this out: HTTP DDoS attacks represent the overwhelming majority of all mitigated traffic and a large share of bot-related blocks.

Attackers rarely rely on a single vector. The majority of these DDoS attacks use multiple methods simultaneously, attempting to overwhelm both the network layer (with packet floods) and the application layer (with request floods). Even when an attack is not classified as a full DDoS event, roughly a quarter of mitigation actions are triggered by bot-fighting tools that target the automated nature of these attacks. Breaking this down further, a significant number of these actions could be avoided if the offending IP addresses were simply blocked, but the use of Block IP rules is often a a blunt instrument. Ultimately, the data shows that the scale of these attacks increased dramatically and persisted far longer than in previous years, with the most common peak bandwidth of the top DDoS events sitting in the tens of gigabytes per second range—often sustained for over an hour.

The rise of shadow APIs

Much of the application traffic now hitting the web is not meant for human eyeballs. Application Programming Interfaces (APIs) enable the computer-to-computer communication that underpins modern software, but they introduce a distinct security paradox. The structured data format of APIs—typically JSON or XML—frequently triggers a high volume of false positive alerts in standard Web Application Firewalls (WAFs). At the same time, because these interfaces often lack the user-facing routes of a standard website, many organizations fail to track them. These forgotten endpoints, known as shadow APIs, become prime targets for attackers seeking unpatched or unmonitored code.

The scale of this problem is significant. API traffic is the fastest growing segment on Cloudflare’s network, making up over half of all requests. It is also a more targeted attack surface than standard web apps. While global traffic averages an 8% mitigation rate, API endpoints see a roughly 10% block rate. This suggests attackers are hone in on APIs specifically, and that the risk is not just theoretical.

The methods used to mitigate API threats differ from those used on traditional web traffic. DDoS protection still does the heavy lifting, accounting for the majority of blocked API requests. But, more tellingly, Custom WAF rules account for a much larger slice of the pie for API mitigation than they do for general web traffic. This reveals a common strategy among developers: use custom allowlists and validation logic to lock down endpoints that cannot be fully secured by managed signatures alone. Over time we expect API Gateway features such as schema validation to gradually take over this task, as they are explicitly designed to formalize the shape of acceptable requests.

When it comes to the specific attack types hitting these endpoints, the WAF managed rules tell a different story than they do for the web at large. SQL injection does not just lead the pack for APIs; it is the number one vector. Furthermore, vectors are more evenly distributed, indicating that a wider range of exploits—from command injection to deserialization attacks—are being actively tried out on these high-value targets.

Tabular data for reference:

Future security intelligence

The insights drawn above represent a snapshot of a constantly shifting threat picture. The plan is to update these observations regularly, moving away from static reports and toward a more dynamic, real-time view of the traffic and attack data flowing into the network. The goal is to make deeper analytics publicly available on Cloudflare Radar, giving the community the ability to filter and investigate these same trends with greater granularity.