Back to Checks
cloudflare

Under Attack Mode is disabled during normal operations

zone_security_under_attack_disabled
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Under Attack Mode configuration by checking if it is disabled during normal operations, as this mode performs additional security checks including an interstitial JavaScript challenge page that significantly impacts user experience.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Keeping Under Attack Mode permanently enabled causes operational issues.

  • Availability: all visitors face a 5-second interstitial challenge page before accessing the site
  • Accessibility: visitors without JavaScript support cannot access the site at all
  • User Experience: legitimate users experience unnecessary delays and third-party analytics show degraded performance

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_security_under_attack_disabled

Recommendation

Disable Under Attack Mode when not actively under a DDoS attack.

  • Use it only as a last resort during active layer 7 DDoS attacks
  • For ongoing protection, use Security Level settings (Low, Medium, High)
  • Configure specific WAF rules for targeted protection without impacting all users

Remediation

Terraform

# Set security level to high instead of under_attack
resource "cloudflare_zone_settings_override" "security_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    security_level = "high" # Use high instead of under_attack for normal operations
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > Settings
3Under 'Under Attack Mode', toggle it OFF
4Consider setting Security Level to 'High' for continued protection without the interstitial

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_security_under_attack_disabled(Check):
    """Ensure that Under Attack Mode is disabled during normal operations.

    Under Attack Mode is a DDoS mitigation feature that performs additional
    security checks including an interstitial JavaScript challenge page for all
    visitors. While effective during active attacks, it significantly impacts
    user experience and should only be enabled temporarily during actual DDoS
    incidents, not as a permanent security measure.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Under Attack Mode disabled check.

        Iterates through all Cloudflare zones and verifies that the security
        level is not set to "under_attack". Having this mode permanently enabled
        indicates either an ongoing attack or misconfiguration that degrades
        user experience unnecessarily.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Under
            Attack Mode is disabled, or FAIL status if it is currently enabled.
        """
        findings = []

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            security_level = (zone.settings.security_level or "").lower()

            if security_level == "under_attack":
                report.status = "FAIL"
                report.status_extended = (
                    f"Zone {zone.name} has Under Attack Mode enabled."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Zone {zone.name} does not have Under Attack Mode enabled."
                )
            findings.append(report)
        return findings

References