Unless you’ve been magically spared the rod of the Internal Server Error 500, you’ll have noticed that websites on the internet haven’t worked as normal today. The reason is that Cloudflare, a key internet infrastructure provider powering many of the biggest websites and platforms, has experienced a major outage.
Cloudflare is one of the most reliable infrastructure providers, and its Content Delivery Network has long ensured that websites are replicated across multiple servers worldwide, providing fast loading times for users everywhere.
Yet, its central role in powering some of our favorite apps, websites, and services also makes it a key bottleneck when things go wrong, as it has this morning. Here’s what happened, the websites affected, and Cloudflare’s somewhat spotty history in the face of these exact attacks.
Why were so many websites down today?
Cloudflare’s central role in powering the internet was thrust into the limelight around 6:00 a.m. Eastern Time this morning, November 18, as much of the internet suddenly stopped working.
I first noticed this issue on the social media site X (you may remember it as Twitter), and quickly realized it was a large outage when websites like Downdetector and several small blogs, which also rely on Cloudflare, demonstrated that this affected all websites, large and small — all stopped working.
It quickly became apparent that Cloudflare was having a major problem, and the company confirmed a global issue with widespread 500 errors. In web development parlance, this means an Internal Server Error, or a failure of the web server to fulfill a request. It’s generic by design, which also makes it challenging to fix, and outages lasted longer than a couple of hours this morning.
Cloudflare has taken down the internet before
At the time of writing — 9:15 am Eastern Time — there’s little information about the root cause behind these issues.
A report from Bleeping Computer suggests that this could be related to a 15 Tbps DDoS attack on Microsoft Azure; in other words, 500,000 IP addresses flooded Cloudflare in a targeted attack to bring down the platform, and much of the internet with it. However, it’s worth noting that, at the time of writing, Bleeping Computer is offline due to the Cloudflare outage, although platforms like X, Downdetector, and ChatGPT have all returned.
It’s not the first time that this has happened to Cloudflare, with notable outages dating back several years to 2019. Past outages have included major services like Amazon, Google, and Facebook for a few hours in 2019, an outage that affected even more sites than today's in 2023, and the current large outage that also impacted popular platforms such as Spotify, Canva, and League of Legends.
What this means for your favorite websites
There are several ways you’ll see this manifest itself throughout today, with some more obvious than others. First, many websites will display a splash screen and not load at all, as seen in the Bleeping Computer splash screen above.
However, Cloudflare provides more than just simple Content Delivery Networks and offers additional products, such as checkbox and captcha services, to prevent bot-like behavior. As I’ve seen today, Cloudflare’s checkbox feature is active on many websites, meaning sign-ins would have failed because the checkbox or captcha couldn't load.
Lastly, even as Cloudflare returns to full service, some websites may still have unresolved issues. Although it should clear itself automatically eventually, some websites — especially those updated less frequently — may have extended caching schedules that could affect when all services begin working.
This outage highlights a key flaw in the internet
We all know the internet isn’t perfect, but today’s outage follows a recent one for Amazon Web Services, which has proven that far too much of the internet relies on just a few key infrastructure providers. As such, an outage like today's can quickly affect a large number of internet users in both expected and unexpected ways.
Cloudflare provides a layer between the user and the server to cache website content, but it requires routing your traffic through their servers. Outages like today show a key flaw in this plan, especially as Cloudflare’s own reporting tools — including its Service Status page — haven’t been updated and show no reported problems.
I’ve been developing websites for over 20 years, and Cloudflare is undoubtedly a key infrastructure provider on the internet. Yet it clearly needs to reduce its redundancies, as outages lasting hours can quickly disrupt the internet and everyone’s daily lives.
Normally, if something is down, I turn to X, and then to Downdetector. With both of those down, I discovered a new trusty place that doesn’t rely on Cloudflare: Reddit. Who’d have thought that Reddit would survive the 500 error apocalypse?
