False report?

Cloudflare is reporting high traffic and bandwidth, but my site is not public, has no backlinks, and is password protected. Showing 11+ GB usage and 100k+ unique traffic. Google Analytics not showing this. Why is CF false reporting?

Google Analytics isn’t accurate for most cases as it requires users have JS enabled, haven’t blocked ads and trackers, etc.

Cloudflare’s reporting is accurate in my case.
It will show both source IPs and URLs, check what those are.


But site has no backlinks, is password protected, robots protected. There should be little to no traffic. How is it reporting 200k+ traffic and 11GB+ usage when site is completely inaccessible and the whole site only has around 5MB or so? Ignore google analytics. This is abnormal.

How can it serve 9GB when the site is inaccessible and password protected?

With that amount of requests it’s a little over 1kB per request (request+response) on average, even returning the password protected page will return something. I’d say someone is hitting your site hard.

If you were to click on view more analytics you’d see some more info.


It only shows countries—no other info. I had the domain for over 15+ years—zero promotion or backlinks. It’s not even a high-value domain anyone can accidentally type in. I assume I have to upgrade to pro to see where the traffic is coming from… this looks like a shady attempt by CF to force people to upgrade. But CF has been around for so long to do something dishonest like this. I’m sure the report is wrong. But CF support is behind the paywall. :face_holding_back_tears:

You are right… I’m so used to non-free zones.

Certificates are logged, there are scrapers that try all domain names and IPs, it’s impossible to be hidden on the web just through obscurity, especially at the domain level.

I’m 100% sure it’s not. Data transferred is actually very low for the request count, which would align with a password protected resource returning an error.


Why would I get 140k+ per month of unique traffic to an unpromoted domain? There are hundreds of blogs that struggle for years with thousands of articles and still can’t get even over 50k per month traffic. It is a probable impossibility for my unused domain with zero promotion or index of any sort to get unique traffic like this. Common sense dictates this is a glitch, and please don’t say that’s an impossibility because I know that’s possible, but I can’t get in touch with CF technical team to fix a problem on CF side.

How is it on CF side? Based on common sense and probability. I repeat, most likely CF side, because it is a probable impossibility for me to get this much unique traffic. Until a couple of months back, it was just a domain with DNS pointing nowhere and not parked. If you are with CF, could you have a tech person reach out to me? If this is a glitch on CF side, it makes zero sense for me to upgrade using my loaned funds I need to get by as I’m currently unemployed and living on personal loans while searching for jobs.

You don’t need to upgrade and you don’t need someone from Cloudflare to contact you. The explanation provided by @matteo covered everything.

The traffic is likely bots, malicious or otherwise. All SSL certificates are logged to publicly accessible certificate transparency archives. These archive are ingested by bots resulting in eventual connections. If these connections reach your origin server you should be able to correlate the data.

If this traffic isn’t costing you anything, I fail to see the relevance in the difference between the methods used to calculate traffic.


I will third everything said by @matteo and seconded and added to by @epic.network.