DDOS attack 100K requests

My website is under attack and I have done all three steps but still website is down.

Which three steps?

Pls also provide more infos

Cloudflare has a “What to do under DDOS attack”.

There are three steps you take (put on attack mode), Web Application Firewall enable and I blocked IP’s (They keeping changing them).

Well 100k requests in what time?
For some sites its normal, some cant even handle 20 r/s.

May you give us your FQDN and maybe some infos about the Setup?

  1. Hardware (CPU / RAM / Bandwidth)
  2. Software (OS / Version)
  3. CMS Setup (Wordpress / Drupal / Plain HTML)
  4. What Web Application FireWall settings do you have?
  5. Do you use CF as DNS Service only or do you proxy all the traffic through CF?
  6. What is the CF ERROR you get by calling your site?

Also you should tell us if your Pages are cached statically or not, mostly its up to this.
Does CF Cache your static assets? What are your CF Setting in the “Cache” section?

Instead of identifying bad guys, create a rule based on legitimate visitors, then challenge everyone else.