Application Security Report: Q2 2023

What 46 Million Requests Per Second Reveal About Web Attack Trends

Cloudflare’s position on the network edge provides a broad, real-time view of Internet traffic. In Q2 2023, the company processed an average of 46 million HTTP requests per second, peaking at 63 million, alongside roughly 25 million DNS queries per second. That scale translates to about 112 billion blocked cyber threats per day, a dataset now published on a quarterly basis in the company's Application Security Report.

This analysis covers the period from April through June 2023. For clarity, "mitigated traffic" refers to HTTP requests that received a terminating action such as BLOCK, CHALLENGE, JS_CHALLENGE, or MANAGED_CHALLENGE; requests that were merely logged or allowed are excluded. Bot traffic is defined as requests with a bot score between 1 and 29 inclusive, and API traffic is identified by XML or JSON response content types. These figures reflect only traffic observed across Cloudflare's network, not the entire Internet.

Steady Mitigation Rates with Periodic Spikes

Daily mitigated HTTP requests held relatively stable at 6% of total traffic, down two percentage points from the prior year. That consistency is punctuated by periodic surges: in late May 2023, a spike approaching 8% of daily traffic was mitigated, driven largely by large-scale DDoS events. Of all mitigated requests, 75% were outright blocked, a six-percentage-point decrease from the previous report. The remainder were handled primarily through challenge actions, with managed challenges accounting for roughly 20% of that subset.

WAF Rules Overtake DDoS Mitigation

The biggest shift in mitigation strategy is the source of the blocks. Previously, Cloudflare's automated DDoS mitigation system accounted for more than half of all mitigated traffic. In Q2 2023, the WAF surpassed DDoS mitigation as the largest contributor, driven mainly by custom rule blocks rather than managed rules. This suggests that application owners are increasingly configuring their own business logic rules to lock down their applications, rather than relying solely on automated threat detection.

Managed WAF rules were not idle, however, peaking at 1.5 billion mitigations per day during the quarter—though they remain negligible relative to custom rule activity. The increase in custom rules points toward a positive security model, where customers allow known good traffic instead of merely blocking known bad traffic. Aggregated across all sources, the WAF now accounts for approximately 57% of total mitigations.

Geolocation and Bot Fields Dominate Custom Rules

Examining the roughly 7 million WAF custom rules deployed across the network reveals how application owners are tuning their defenses:

Geolocation-related fields are the most common decision factor, appearing in 40% of all custom rules. This approach lets organizations exclude geographies where they do not expect legitimate traffic, effectively reducing the attack surface—though it remains a coarse control that will not stop a determined attacker. Bot Management fields appear in 11% of custom rules, a figure that has been steadily rising as machine learning-based classification becomes more widely adopted.

Old Vulnerabilities Still Driving Attacks

When it comes to managed WAF rules, HTTP Anomaly detection remains the most common attack category, contributing approximately 32% of mitigated traffic. SQL injection moved into second place at 12.7%, surpassing directory traversal at 9.9%.

One notable finding is the dominance of a single rule in the DoS category. Most mitigated traffic in that category is tied to rule 100031 (old WAF) or ce02fd... (new WAF), which targets CVE-2015-1635, a Microsoft IIS vulnerability first disclosed more than eight years ago. The persistence of this rule's matches underscores that unpatched systems running legacy software remain a prime target—a reminder that threat actors continue to exploit long-known vulnerabilities at significant scale.

Another trend emerged in June: a surge in Broken Authentication rule matches, attributed to a single rule deployed to all customers, including free tier users. That rule blocks attempts to access wp-config.php, the WordPress configuration file that should never be retrievable directly over HTTP. The increase reflects continued automated scanning for this common misconfiguration.

The relevance of older vulnerabilities is further supported by the CISA/CSA list of the top routinely exploited vulnerabilities of 2022. Cloudflare's analysis of that list shows two entries—Log4J and Atlassian Confluence Code Injection—responsible for the overwhelming majority of attack traffic in the wild, with exploit volumes far exceeding the other ten vulnerabilities combined.

Bot Traffic: What the Scores Show

Cloudflare’s Bot Management product line continues to evolve, with recent additions including JavaScript Verified URLs for enhanced protection against browser-based bots, Detection IDs in Custom Rules for more granular configuration, and an improved onboarding UI. Self-serve customers have also gained the ability to “Skip” Super Bot Fight Mode rules and support for WordPress Loopback requests, improving integration with existing applications.

The classification output remains highly confident. Plotting bot scores across the analyzed period reveals a clear bimodal distribution: the vast majority of requests score below 2 or above 95, with few in the ambiguous middle range. This translates to 33% of traffic being classified as automated during this window. Over longer observation periods, the overall bot traffic percentage stabilizes at 29%, consistent with the data published on Cloudflare Radar.

Mitigation Trends for Unverified Bots

Mitigation of non-verified bot HTTP traffic has declined by 6 percentage points since the previous report, but bot signals remain a significant input to WAF configurations. Bot Management fields are used in 11% of all WAF Custom Rules, amounting to over 700,000 deployed rules relying on bot classification. The most common field is cf.client.bot, an alias for cf.bot_management.verified_bot, which leverages Cloudflare’s verified bot list to help customers distinguish between “good” and potentially malicious unverified bots.

Enterprise customers can access the more granular cf.bot_management.score, providing the raw score computed for each request — the same score underpinning the distribution graph above.

The mitigation data is corroborated by examining which Cloudflare services are responsible. While the DDoS mitigation system automatically blocks HTTP traffic across all customers, it accounts for only 13% of non-verified bot mitigations. WAF rules, predominantly customer-defined, account for 77% of these mitigations — a notably higher share than the 57% of mitigations seen across all traffic. Bot Management’s own one-click rules are counted separately from the bot fields used in WAF Custom Rules.

Tabular format for reference:

API Traffic Growth and Security

APIs Now Dominate Dynamic Traffic

The upward trajectory of API traffic continues unabated. APIs now account for 58% of total dynamic (non-cacheable) traffic, a 3 percentage point increase from Q1.

Investment in API Gateway is keeping pace. Several new security features have shipped in the last quarter:

• API Discovery Inbox View: A new interface that simplifies inventorying your APIs to prevent shadow IT and zombie APIs. Customers can filter to display only newly discovered endpoints, which can then be saved into the Endpoint Management system.
• Sequence Mitigation: An exclusive Cloudflare feature that allows API access control based on client behavior. This permits positive or negative security models built on the order of API paths a client accesses. For instance, a banking application can enforce that the funds transfer endpoint is only accessible after a user has visited the account balance endpoint, thwarting brute-force attempts that ignore normal application flow.

Further API security and management features are slated for release through the remainder of 2023.

Browser-Generated API Traffic Holds Steady

The share of API traffic generated by browsers has remained stable over the past quarter. This metric refers to HTTP requests that return non-HTML content requiring preprocessing, such as AJAX calls serving JSON payloads.

Attack Vectors on API Endpoints

HTTP Anomalies persist as the most common mitigated attack vector on API traffic, matching the previous quarter’s findings. SQL injection attacks remain a notable concern, contributing approximately 11% of total mitigated traffic, closely followed by XSS attacks at around 9%.

Tabular format for reference (top 5):

What’s Next

With the shift to a quarterly reporting cadence, future editions will expand on these insights. Planned coverage includes data from newer products such as Page Shield, which will allow analysis beyond HTTP traffic to examine the state of third-party dependencies. For more frequent updates, Cloudflare Radar remains the primary channel for ongoing application security data.