“Just turn on Under Attack Mode” is common advice during a website incident, but it’s rarely explained beyond that one sentence. Here’s what the setting actually does mechanically, when it genuinely helps, and — just as importantly — when it’s the wrong tool for what’s happening.
What Under Attack Mode Actually Does
When active, every visitor to your site is shown a brief interstitial page — usually for a few seconds — while their browser is checked to confirm it’s behaving like a real browser rather than an automated script. Only after passing this check does the visitor get through to your actual site content.
Mechanically, this works because real browsers can execute certain background checks (JavaScript challenges) the way a genuine browser would, while simple automated scripts used in attacks typically can’t, or don’t bother to. The check filters out a large share of unsophisticated automated traffic before it ever reaches your server, without requiring any manual identification of which requests are “bad.”
What This Is Actually Solving
Recall the core problem in most attacks: your server has finite capacity, and an attack works by exceeding that capacity with more requests than it can process. Under Attack Mode doesn’t make your server handle more traffic — it reduces the amount of illegitimate traffic that reaches your server at all, by filtering it out at the Cloudflare layer before it ever gets there. Fewer requests reaching the server means the server itself has a fighting chance of handling what’s left.
When to Actually Turn It On
- Active DDoS traffic — your site is slow, timing out, or unreachable, and you suspect volume-based attack traffic rather than a genuine surge in real visitors
- Known bot/scraping surges — a sudden flood of automated traffic hitting the site aggressively
- During an active security incident — as part of broader containment while other fixes (WAF rules, credential resets) are being put in place
When It’s the Wrong Tool
This is the part usually left out of the advice. Under Attack Mode adds friction for every visitor, real or not — which means:
- It’s not meant to run permanently. Leaving it on all the time adds unnecessary friction to every legitimate visitor, which can hurt conversion rates, frustrate returning customers, and in some cases affect how search engines crawl your site.
- It won’t help with a genuine traffic surge from real visitors — like a viral moment or a big promotion — since the slowdown there isn’t from bots, it’s from real demand. Under Attack Mode won’t distinguish “attack” from “unusually popular,” so this scenario needs different handling (caching, scaling), not this setting.
- It doesn’t fix a compromised site — if the issue is malware, defacement, or unauthorized access rather than traffic volume, Under Attack Mode does nothing to address the actual breach; it’s a traffic-layer tool, not a cleanup tool.
What It Looks Like From a Visitor’s Perspective
A real visitor sees a short-lived checking page — typically a matter of seconds — before being let through automatically. It’s mildly noticeable but not usually disruptive for a one-time visit during a known, temporary incident. The trade-off only becomes a real problem if it’s left running long after the emergency has actually passed.
How This Fits Into a Broader Response
Under Attack Mode is rarely the only thing that should happen during an incident — it’s one piece alongside custom WAF rules targeting the specific attack pattern, rate limiting on sensitive endpoints like login or checkout, and, if the origin IP may be exposed, rotating it so attackers can’t simply bypass Cloudflare entirely and hit the server directly. Turning on Under Attack Mode alone, without addressing an exposed origin IP, can create a false sense of security — the front door is filtered, but a side door might still be open.
Where This Fits in Tremhost’s Services
| Scenario | What Applies |
|---|---|
| No Cloudflare/proxy set up yet, active attack right now | Armor SOS — same-day cutover + Under Attack Mode activation |
| Cloudflare already active, want ongoing tuned protection | Armor Pro — managed WAF, custom rules, rate limiting |
| Need to toggle Under Attack Mode occasionally yourself | Available directly if you’re already on any Armor tier |
The Short Version
Under Attack Mode is a temporary, blunt-but-effective filter for suspected bot and attack traffic — genuinely useful in the right moment, actively counterproductive if left on indefinitely, and not a substitute for addressing the actual cause of an incident once things are stable.
