Hello, my company website has been under severe DDOS attack the last week.
I have enabled proxy, WAF, managed rules that apply, IAUM mode, blocked highest traffic countries, user agents, and rate limiting but have still been unable to stop it. What am I missing?
There is chance that you are being attacked by someone going around Cloudflare. They could still be using the old IP address to contact your website, which would bypass any security you set up at Cloudflare. Make sure you have set up a firewall, either on your origin server or at your router (firewall IP rules at your host) that blocks all connections unless they come from Cloudflare-owned IPs: