How To Enable Cloudflare Under Attack Mode With xCloud

If your website is experiencing a sudden spike in malicious traffic or a DDoS attack, every second counts. Cloudflare’s Under Attack mode is a powerful defensive tool that can help protect your site during these critical moments. In this guide, we’ll walk you through how to quickly enable it directly from your xCloud dashboard, without logging in to Cloudflare separately. For an overview of what it does and which plans include it, see the Cloudflare WAF feature page.

Cloudflare’s Under Attack mode performs additional security checks to help mitigate layer 7 DDoS attacks. Validated users can still access your website, while suspicious traffic is blocked. It is designed to be used as a last resort when your site is under attack, and will temporarily pause access to your site and may impact your site analytics.

With xCloud, you can enable Cloudflare Under Attack mode right from the xCloud dashboard.

Step 1: Open your site’s security page

First, open your site. In the site menu, go to Security → Overview & Firewall (the browser tab reads Nginx and Security on Nginx servers and Security on OpenLiteSpeed servers).

The Cloudflare Under Attack Mode card appears for production sites whose domain is connected to Cloudflare through xCloud’s Cloudflare integration, on Nginx or OpenLiteSpeed. A site you proxy through Cloudflare by hand does not show it, and staging sites never do. It is also not shown when the site uses the Cloudflare Enterprise add-on.

Step 2: Enable Under Attack Mode

Scroll to the Cloudflare Under Attack Mode card and turn on the switch in the card header, before the title. xCloud asks Turn on Under Attack Mode? and explains that Cloudflare will show a challenge page to every visitor, including real ones, until you turn it off. Click Turn On.

There is no Save button: the change applies at Cloudflare as soon as you confirm. While the mode is on, the card shows a warning, and the Cloudflare rules tile at the top of the page shows Under Attack Mode on.

To turn it off, turn off the same switch and confirm Turn Off in the Turn off Under Attack Mode? dialog. Visitors then reach your site without the Cloudflare challenge again.

After enabling the feature, if you visit the Cloudflare dashboard and open your domain’s settings, you will see that Under Attack mode is active and working.

That’s all it takes. With just a few clicks in your xCloud dashboard, you can activate Cloudflare’s Under Attack mode and add an extra layer of protection to your site during a DDoS attack. Remember that this mode is meant for active threats. Once the attack subsides, turn it off so your visitors can access your site without the additional security challenge.