Original announcement: · Reporting prepared on the publication date above.
What to know
- The report describes Cloudflare’s network, not the entire Internet.
- Confirm protocol coverage before assuming a service is protected.
- Track customer tasks and false positives during mitigation.
What the new report measures
Cloudflare’s Q3 2026 DDoS report, published on 29 October, describes a shift toward shorter, repeated attacks. Across its own network, the company reports approximately 8,226 mitigated network-layer attacks per hour during the quarter. These are Cloudflare’s observations, not a count of every attack on the Internet or a measurement of Kiava customers.
Match protection to the service
A public website, an email service and a game server expose different protocols. Cloudflare’s DDoS documentation distinguishes network-layer and HTTP protection. Before buying or configuring protection, list each public service and ask the provider which traffic is actually covered. An HTTP reverse proxy should not be assumed to protect every port on the machine.
Give sensitive routes their own limits
Login, search and expensive report generation deserve a separate review from cached pages. Rate limiting rules let administrators define matching traffic and actions, with capabilities depending on the service plan. Choose limits using observed legitimate behavior. Include shared office connections, mobile users and trusted integrations when assessing false positives.
Prepare a short incident worksheet
Our suggested worksheet records the first observed symptom, affected hostname, request rate, response codes and provider incident reference. Compare edge and origin evidence before deciding whether the problem is hostile traffic, a deployment or a database slowdown. Assign one person to coordinate changes and another to test the customer journey. Keep a timeline so repeated bursts can be recognized after the first wave ends.
Measure customer impact and recovery
For a shop, test sign-in, basket and checkout. For a game community, test connection and normal gameplay. Ask whether mitigation restored those tasks, whether genuine users were blocked and whether temporary rules need adjustment. Our VPS security checklist covers the wider maintenance routine. Describe your protocols and availability requirements through Kiava IT services when planning a protection review; more RAM alone is not an incident response plan.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.