Cloudflare’s network now handles over 45 million HTTP requests per second on average, peaking at more than 61 million requests per second. That's up from 32 million average requests per second a year ago, and the growth is reflected in Netcraft’s February 2023 survey, which showed Cloudflare as the most common web server vendor in the top million sites with a 21.71% market share. That scale gives us a useful vantage point on how attack patterns and mitigation strategies are evolving.

This analysis covers the 12 months from March 2022 through February 2023, unless otherwise noted. The data is based strictly on traffic observed across the Cloudflare network and does not necessarily represent overall Internet HTTP traffic patterns. Before presenting the findings, here are the operational definitions used throughout:

  • Mitigated traffic: Any HTTP request that received a terminating action — BLOCK, CHALLENGE, JS_CHALLENGE, or MANAGED_CHALLENGE — from the Cloudflare platform. LOG, SKIP, and ALLOW actions are not counted. This year, requests that received CONNECTION_CLOSE or FORCE_CONNECTION_CLOSE from DDoS mitigation are excluded because they only slow connection initiation. Unsolved challenges are counted as mitigated; solved challenges are not.
  • Bot traffic: Any HTTP request identified by Cloudflare's Bot Management as automated, meaning a bot score between 1 and 29 inclusive.
  • API traffic: Any HTTP request with an XML or JSON response content type. Where response content type isn't available (such as for mitigated requests), the Accept content type from the user agent is used as a proxy.

HTTP refers to both HTTP and HTTPS throughout.

Mitigated Traffic Is Down as a Share, Not in Volume

The share of all proxied HTTP requests that are mitigated has dropped to 6%, down two percentage points year over year. So far in 2023, that figure is even lower, sitting between 4% and 5%. However, total mitigated request volume has remained relatively stable; the percentage drop reflects growth in clean traffic, not an absolute decline in attacks. Large spikes in mitigation, such as those in June and October 2022, tend to correlate with major DDoS attacks.

Of all mitigated requests, 81% are outright BLOCKed, with the rest distributed across the various challenge types.

DDoS Still Dominates, but WAF Is Closing the Gap

Layer 7 DDoS mitigation remains the single largest source of mitigated traffic. This includes record-setting attacks such as the one reported in February 2023 that peaked at 71 million requests per second (that incident lasted only about five minutes and isn't visible in daily-aggregated charts).

What's changed is the growth of WAF-based mitigations, which now account for nearly 41% of mitigated requests, up from the 31% aggregate share that WAF Custom Rules, WAF Rate Limiting Rules, and WAF Managed Rules held in last year's report. The increase is partly attributable to WAF technology improvements that detect and block a broader range of attacks.

Looking deeper, WAF Custom Rules (formerly Firewall Rules) show a gradual upward trend in mitigation volume over the period, while l7ddos mitigations trend clearly downward. This suggests customers are increasingly using custom rules for business logic blocks and more targeted threat mitigation.

HTTP Anomaly Attacks Decline Sharply

HTTP Anomaly was the top attack vector mitigated by WAF Managed Rules, contributing 30% of that traffic in March 2023. That's a drop of nearly 25 percentage points compared to March 2022. HTTP anomaly signatures cover issues like malformed method names, null byte characters in headers, non-standard ports, and POST requests with zero content length. The decline correlates with botnets gradually shifting away from traffic patterns that match those signatures.

With HTTP anomalies removed from the picture, early 2023 attack vector distribution looks much more balanced across the remaining categories.

One notable spike occurred in late February 2023 in the CVE category, driven by a sudden increase in matches for two WAF Managed Rules:

  • Drupal - Anomaly:Header:X-Forwarded-For (id: d6f6d394cb01400284cfb7971e7aed1e)
  • Drupal - Anomaly:Header:X-Forwarded-Host (id: d9aeff22f1024655937e5b033a61fbc5)

Both rules are tagged against CVE-2018-14774, a reminder that even dated, well-known vulnerabilities remain frequent exploitation targets, presumably against unpatched systems.

Bot Traffic Insights

Bot Management has matured significantly over the past year with configurable heuristics, hardened JavaScript detections, automatic machine learning model updates, and the launch of Turnstile, Cloudflare's free CAPTCHA replacement. The result is increasingly accurate classification of human versus bot traffic.

The score distribution confirms that confidence: plotting bot scores over the last week of February 2023 shows a clear bimodal distribution. Most requests score either below 2 (definitely bot) or above 95 (definitely human), with very little in the ambiguous middle range.

30% of HTTP Traffic Is Automated

During that same last week of February 2023, 30% of Cloudflare HTTP traffic was classified as automated — roughly 13 million HTTP requests per second. That's 8 percentage points lower than in the same period last year.

Of bot traffic, only about 8% comes from verified bots, which represents 2% of total traffic. Cloudflare maintains a list of 171 known good bot providers (such as Google and Facebook) so customers can distinguish well-behaved automated clients from undesirable ones.

Non-Verified Bots Face Higher Mitigation Rates

Since non-verified bot traffic frequently includes vulnerability scanners probing for exploits, it's not surprising that about 16% of it is mitigated. Customers often prefer to restrict the visibility such tools gain into their applications.

Even verified bots experience some mitigation: 1.5% of their traffic is held back. This typically reflects site administrators using WAF Custom Rules to prevent crawling of certain sections. The most common action for all bot mitigations is BLOCK (13% of bot traffic), but some customers use CHALLENGE actions (3%) to allow for human false positives to proceed if needed.

Notably, nearly 80% of all mitigated traffic is classified as bot. The remaining 20% classified as human is largely attributed to WAF Custom Rules implementing business logic blocks — such as US-based companies blocking European users for GDPR compliance — rather than genuine attack traffic.

The API Attack Surface

API traffic now makes up the majority of dynamic, non-cacheable HTTP requests that reach origin servers. Cloudflare's data shows that 55% of this traffic is API-related, a figure that has held steady year-over-year. Even among cached requests, nearly 7% are API-related, thanks to modern caching features that allow for custom cache keys and rapid revalidation — sometimes as frequently as every second.

When all HTTP traffic is considered — including redirects and static assets — APIs still account for 25% of requests. Cloudflare tracks this along two dimensions: the share of API traffic against all HTTP requests, and the share against dynamic traffic returning a 200 OK response.

API traffic over the last 12 months: % of total HTTP requests and % of 200 response non cacheable HTTP requests

Who Is Behind API Calls?

The "API-first" architecture model, where the initial HTML load provides only a skeleton and content is fetched via subsequent API calls (such as AJAX), has reshaped how traffic looks to security systems. Cloudflare's bot scoring data indicates that nearly two-thirds of API traffic is generated by human users in browsers, clustered at the high end of the "human" confidence range.

Bot score distribution of API traffic

Measuring mitigated API traffic presents a challenge, since blocked requests never reach origin servers and therefore lack a response content type to classify. Using the same methodology as the prior year's report, Cloudflare estimates that just over 2% of API traffic is mitigated, a significant drop from the 10.2% figure recorded last year.

Shifting Attack Patterns on APIs

HTTP anomalies have overtaken SQL injection (SQLi) as the most common attack vector against API endpoints. Attack patterns on API traffic demonstrate more variability throughout the year than global HTTP traffic; notably, there was a spike in file inclusion attack attempts in early 2023.

WAF rule category corresponding to the last mitigation action on API traffic over the last 12 months

Cloudflare's leaked credential check feature, available since March 2021 as part of its WAF, adds an HTTP request header whenever an authentication attempt uses a username/password pair known to be leaked. This provides a strong signal for detecting botnets performing credential stuffing attacks. Legitimate applications also use this signal to trigger additional security measures like two-factor authentication prompts or password resets.

Rising Brute Force Activity

Matched request trends over the past 12 months show a clear increase in leaked credential use beginning in the second half of 2022, indicating growing fraudulent activity against login endpoints. During large-scale brute force campaigns, Cloudflare has observed match rates exceeding 12,000 requests per minute.

Daily account takeover HTTP requests over the last 12 months

The feature includes signatures for authentication requests across a range of systems:

  • Drupal
  • Ghost
  • Joomla
  • Magento
  • Plone
  • WordPress
  • Microsoft Exchange
  • Generic rules for common authentication endpoint formats

Exchange Is the Top Target

Despite WordPress's widespread adoption, it is not the application most frequently targeted by brute force account takeover attempts. After generic authentication signatures, Microsoft Exchange is the most common match. This reflects the high-value nature of Exchange accounts, which are often gateways to sensitive corporate data.

By source country, the United States leads leaked credential match traffic by a wide margin. China is notably absent from the top contenders given its network size. Ukraine, however, led during the first half of 2022, coinciding with the start of the war there.

Daily account takeover HTTP requests by country over the last 12 months

The Road Ahead

The breadth of attacks observed across Cloudflare's network — from HTTP anomalies and SQL injection to cross-site scripting, account takeover attempts, and malicious bots — illustrates a constantly shifting threat landscape. Organizations operating online need visibility, detection, and mitigation capabilities to protect their applications and, more critically, their end users' data.

Cloudflare plans to update this report with additional data and insights across its product portfolio, and points to Cloudflare Radar for more frequent application security intelligence.