I hit 19.3M attack every second Help me Out

[bdipesh101]

What is the name of the domain?

example.com

What is the issue you’re encountering

I experienced a 19.3M attack per hour, all through HTTP. Despite purchasing the pro plan and activating the rules, I’m still facing this issue.

What steps have you taken to resolve the issue?

Here’s what I did on my Cloudflare setup:

Definitely automated Block
Static resource protection ON
Optimize For WordPress ON
JavaScript Detections ON
Block AI Scrapers and Crawlers ON
On WAF Manage Rule Set:

Cloudflare Manage Ruleset ON
Cloudflare OWASP Core Ruleset ON
Cloudflare Exposed Credentials Check Ruleset ON
For DDoS:

Activated Under Attack Mode
Even after taking these measures, my resource usage goes up to 80-90%. I’m unable to block the attack. Is there any solution to this that allows Google bots to access my site?

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Flexible

Screenshot of the error

[bdipesh101]

This step what i did, but still they are attacking with under attack mode also

[Erisa]

Check this:

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…

---

@bdipesh101

What is the current SSL/TLS setting?

Flexible

And this:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

This may also help, if requests are bypassing Cloudflare:

Protect your origin server · Cloudflare Fundamentals docs