Check ID: zone_security_under_attack_disabled
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Under Attack Mode configuration by checking if it is disabled during normal operations, as this mode performs additional security checks including an interstitial JavaScript challenge page that significantly impacts user experience.

​
Risk

Keeping Under Attack Mode permanently enabled causes operational issues.
  • Availability: all visitors face a 5-second interstitial challenge page before accessing the site
  • Accessibility: visitors without JavaScript support cannot access the site at all
  • User Experience: legitimate users experience unnecessary delays and third-party analytics show degraded performance

​
Recommendation

Disable Under Attack Mode when not actively under a DDoS attack.
  • Use it only as a last resort during active layer 7 DDoS attacks
  • For ongoing protection, use Security Level settings (Low, Medium, High)
  • Configure specific WAF rules for targeted protection without impacting all users

​
Remediation

# Set security level to high instead of under_attack
resource "cloudflare_zone_settings_override" "security_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    security_level = "high" # Use high instead of under_attack for normal operations
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_security_under_attack_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks