“Just turn on Under Attack Mode” is common advice during a website incident, but it’s rarely explained beyond that one sentence. Here’s what the setting actually does mechanically, when it genuinely helps, and \u2014 just as importantly \u2014 when it’s the wrong tool for what’s happening.<\/p>\n
When active, every visitor to your site is shown a brief interstitial page \u2014 usually for a few seconds \u2014 while their browser is checked to confirm it’s behaving like a real browser rather than an automated script. Only after passing this check does the visitor get through to your actual site content.<\/p>\n
Mechanically, this works because real browsers can execute certain background checks (JavaScript challenges) the way a genuine browser would, while simple automated scripts used in attacks typically can’t, or don’t bother to. The check filters out a large share of unsophisticated automated traffic before it ever reaches your server, without requiring any manual identification of which requests are “bad.”<\/p>\n
Recall the core problem in most attacks: your server has finite capacity, and an attack works by exceeding that capacity with more requests than it can process. Under Attack Mode doesn’t make your server handle more traffic \u2014 it reduces the amount of illegitimate traffic that reaches your server at all, by filtering it out at the Cloudflare layer before it ever gets there. Fewer requests reaching the server means the server itself has a fighting chance of handling what’s left.<\/p>\n
This is the part usually left out of the advice. Under Attack Mode adds friction for every<\/em> visitor, real or not \u2014 which means:<\/p>\n A real visitor sees a short-lived checking page \u2014 typically a matter of seconds \u2014 before being let through automatically. It’s mildly noticeable but not usually disruptive for a one-time visit during a known, temporary incident. The trade-off only becomes a real problem if it’s left running long after the emergency has actually passed.<\/p>\n Under Attack Mode is rarely the only<\/em> thing that should happen during an incident \u2014 it’s one piece alongside custom WAF rules targeting the specific attack pattern, rate limiting on sensitive endpoints like login or checkout, and, if the origin IP may be exposed, rotating it so attackers can’t simply bypass Cloudflare entirely and hit the server directly. Turning on Under Attack Mode alone, without addressing an exposed origin IP, can create a false sense of security \u2014 the front door is filtered, but a side door might still be open.<\/p>\n Under Attack Mode is a temporary, blunt-but-effective filter for suspected bot and attack traffic \u2014 genuinely useful in the right moment, actively counterproductive if left on indefinitely, and not a substitute for addressing the actual cause of an incident once things are stable.<\/p>\n","protected":false},"excerpt":{"rendered":" “Just turn on Under Attack Mode” is common advice during a website incident, but it’s rarely explained beyond that one sentence. Here’s what the setting actually does mechanically, when it genuinely helps, and \u2014 just as importantly \u2014 when it’s the wrong tool for what’s happening. What Under Attack Mode Actually Does When active, every […]<\/p>\n","protected":false},"author":226,"featured_media":40365,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[49],"tags":[],"class_list":["post-77053","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tips"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
What It Looks Like From a Visitor’s Perspective<\/h3>\n
How This Fits Into a Broader Response<\/h3>\n
Where This Fits in Tremhost’s Services<\/h3>\n
\n\n
\n \nScenario<\/th>\n What Applies<\/th>\n<\/tr>\n<\/thead>\n \n No Cloudflare\/proxy set up yet, active attack right now<\/td>\n Armor SOS \u2014 same-day cutover + Under Attack Mode activation<\/td>\n<\/tr>\n \n Cloudflare already active, want ongoing tuned protection<\/td>\n Armor Pro \u2014 managed WAF, custom rules, rate limiting<\/td>\n<\/tr>\n \n Need to toggle Under Attack Mode occasionally yourself<\/td>\n Available directly if you’re already on any Armor tier<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n The Short Version<\/h3>\n