Mitigated traffic climbs to 6.8% of all HTTP requests
Across the twelve months ending March 31, 2024, Cloudflare mitigated an average of 6.8% of all application-layer traffic, up from 6% in the prior period. During major global attack events, that share can spike toward 12% — far higher than anything previously observed across the network. The data reflects only traffic on Cloudflare's edge, not overall Internet patterns.
WAF and Bot Management rules account for the largest share of mitigated traffic at 53.9%, followed by HTTP DDoS rules, IP reputation, and access rules. Customers are increasingly combining signals like WAF Attack Score and Bot Score in custom rules to tighten security postures.
Attack speed outpaces defense
CVE exploitation attempts are arriving faster than ever. In one case, Cloudflare observed attempts against CVE-2024-27198, a JetBrains TeamCity authentication bypass, just 22 minutes after proof-of-concept code was published on March 4 at 19:45 UTC. Attackers are targeting the easiest vulnerabilities first — mostly scanning activity, followed by command injection attempts and exploitation of known PoCs such as Apache CVE-2023-50164 and CVE-2022-33891, ColdFusion CVE-2023-29298, CVE-2023-38203 and CVE-2023-26360, and MobileIron CVE-2023-35082.
This speed exceeds human capacity for writing WAF rules or patching, which is why Cloudflare has combined human-authored signatures with an ML-based approach to balance low false positives with rapid detection. Campaigns targeting RCE vulnerabilities show clear patterns, including pushes against Apache and Adobe installations in late 2023 and early 2024, plus a notable Citrix campaign in May.
DDoS remains the dominant threat vector
DDoS attacks still top the list of mitigated application traffic at 37.1%. Volumetric attacks rose sharply in February and March 2024, driven by both increased activity and improved detections. In Q1 2024 alone, Cloudflare's automated defenses mitigated 4.5 million unique DDoS attacks — equal to 32% of the total mitigated across all of 2023. Application-layer HTTP DDoS attacks increased 93% year-over-year and 51% quarter-over-quarter.
Motives range from ransom and botnet testing to political targeting. For instance, DDoS attacks on Sweden jumped 466% after its NATO accession on March 7, 2024, mirroring the pattern seen during Finland's admission the year prior. Attack sizes are growing, too. In August 2023, Cloudflare mitigated a hyper-volumetric HTTP/2 Rapid Reset attack peaking at 201 million requests per second — three times larger than any previously observed. The exploit took advantage of a zero-day vulnerability in the HTTP/2 protocol. Gaming and gambling became the most-targeted sector by DDoS, followed by Internet technology and cryptomining.
Bots dominate traffic; APIs grow with visibility gaps
Automated traffic now makes up about a third of all requests observed. Of that bot traffic, 93% is not on Cloudflare's verified list and is therefore considered potentially malicious. This classification excludes requests with bot scores from 1 to 29, which are flagged as bot-generated.
API traffic continues its climb, now representing 60% of all requests (identified by XML or JSON response content types, or equivalent Accept headers where responses are unavailable). Despite this growth, organizations have up to a quarter of their API endpoints unaccounted for — a significant blind spot when these are among the most targeted assets.
Client-side and third-party risk
This report also introduces a client-side security focus. According to Page Shield data, enterprise sites integrate an average of 47 third-party endpoints, widening the attack surface beyond server-side controls to include browser-side risks from external scripts and integrations.
Network scale and context
Cloudflare's network now processes an average of 57 million HTTP requests per second (up 23.9% YoY), peaking at 77 million (up 22.2%). DNS query handling averages 35 million per second (up 40%). In Q1 2024, the platform blocked an average of 209 billion cyber threats each day — an 86.6% increase year-over-year.
Definitions used throughout this report:
- Mitigated traffic: any eyeball HTTP* request terminated by actions including
BLOCK,CHALLENGE,JS_CHALLENGE, orMANAGED_CHALLENGE, excludingLOG,SKIP, andALLOWactions. Unsolved challenges are counted as mitigated. - Bot traffic: any request identified by Bot Management with a bot score between 1 and 29 inclusive.
- API traffic: any request with XML or JSON content types (or equivalent Accept headers when content type is unavailable).
Unless otherwise noted, data spans April 1, 2023, through March 31, 2024.
*HTTP includes both HTTP and HTTPS.
Bot Traffic: One-Third of All Application Requests
Cloudflare's bot detection systems have seen continued investment through 2024. In early July, the company announced "AIndependence," a one-click option available to all customers — including free tier — designed to block AI bots, scrapers, and crawlers. Complementary work has also gone into Turnstile, the company's privacy-preserving CAPTCHA alternative. These systems help separate human traffic from automated requests.
Across all application traffic processed by Cloudflare, 31.2% is bot traffic — a figure that has hovered around 30% for the past three years. Bot traffic is not inherently good or bad; it depends on intent. Verified bots, such as authorized search engine crawlers and customer service chatbots, perform useful functions. Unverified bots are often built for harmful purposes like inventory hoarding, DDoS attacks, or credential stuffing. Cloudflare classifies the latter as "unverified bots," and 93% of bots it identifies fall into this potentially malicious category. Whether a given bot is "bad" also depends on the application owner: a competitor scraping prices may be a serious problem for an e-commerce site and a non-issue for a site that doesn't sell anything.
Bot abuse concentrates where financial gain is possible. Consumer goods sites, for example, face inventory hoarding, price scraping from competitors, and arbitrage bots such as sneaker bots — all of which carry significant financial consequences for the target.
Figure 8: Industries with the highest median daily share of bot traffic
API Traffic: Majority Share of Dynamic Requests
APIs power modern web and mobile experiences, but they also expand the attack surface by giving outside parties a direct path to applications and databases. Attackers increasingly target API endpoints before traditional web interfaces, even as API-first adoption continues to grow.
APIs now account for 60% of dynamic (non-cacheable) traffic — up two percentage points from last year. Roughly 4% of that API traffic is mitigated on average by Cloudflare's security systems. A notable spike around January 11–17, representing almost a 10% increase in traffic share, was traced to a single customer zone receiving attack traffic mitigated by a WAF Custom Rule.
Figure 9: Share of mitigated API traffic
Among mitigation sources for API traffic, the WAF is the largest contributor, since standard malicious payloads apply equally to APIs and web applications.
Figure 10: API mitigated traffic broken down by product group
Shadow APIs: A Visibility Gap
Organizations often lack accurate API inventories, and you cannot protect what you cannot see. Using a machine learning model that scans all HTTP requests — not just known API calls — Cloudflare found that organizations have 33% more public-facing API endpoints than they know about (based on median figures comparing ML-based discovery with customer-provided session identifiers). This suggests that nearly a quarter of APIs are "shadow APIs" that may be improperly inventoried and secured.
Client-Side Risk: Third-Party Scripts and Connections
Modern web applications lean heavily on third-party JavaScript to ship features faster. But these dependencies load directly in the end-user's browser, placing organizations at risk since they have no direct control over third-party security. The Polyfill.io incident, which affected more than 100,000 sites, underscored how relevant this risk has become. In the retail sector specifically, 18% of all data breaches originate from Magecart-style attacks, according to Verizon's 2024 Data Breach Investigations Report.
Cloudflare's Page Shield product provides visibility into this ecosystem. The typical enterprise customer uses an average of 47 third-party scripts, with a median of 20. The average skews higher due to SaaS providers running thousands of subdomains. Common script providers include Google (Tag Manager, Analytics, Ads, Translate, reCAPTCHA, YouTube), Meta (Facebook Pixel, Instagram), Cloudflare (Web Analytics), jsDelivr, New Relic, Appcues, Microsoft (Clarity, Bing, LinkedIn), jQuery, WordPress, Pinterest, UNPKG, TikTok, and Hotjar.
Beyond loading scripts, there's the question of where those scripts send data. Each enterprise website connects to an average of 50 separate third-party destinations, with a median of 15. Attackers often abuse these connections to exfiltrate data unnoticed. The most common third-party connections include Google (Analytics, Ads), Microsoft (Clarity, Bing, LinkedIn), Meta (Facebook Pixel), Hotjar, Kaspersky, Sentry, Criteo, tawk.to, OneTrust, New Relic, and PayPal.
Cloudflare's full 2024 Application Security report, including additional recommendations, is available in PDF format, and many of its dynamic charts can be explored on Cloudflare Radar.
