What the Cloudflare Outage Really Meant for Businesses
What happens when the gatekeeper goes down?
Cloudflare outages on November 18th and December 5th, 2025, caused chaos across much of the internet.
Major platforms, including X, OpenAI, and Spotify, went offline, and countless business websites became inaccessible. For a while, it felt like half the internet had disappeared.
Despite the number of calls asking, “Why’s our website down?”, the issue wasn’t caused by poor development. It was a failure at infrastructure level that was well beyond the control of individual site owners.
At Dock, we manage over 90 client domains through Cloudflare. When it went down, we were in the same situation as everyone else. Waiting, tracking updates, and explaining to clients why their website had gone AWOL.
To see why a Cloudflare outage is so disruptive, it’s important to understand what it does.
What does Cloudflare do?
Cloudflare acts as an invisible shield between users and a website’s server. When you visit a site, your request goes through Cloudflare first. This allows Cloudflare to check whether requests are real, filter out bots, limit heavy traffic, and block suspicious activity before they reach the website.
Most people never notice Cloudflare at work. The only time you might notice it is when you’re asked to complete an ‘Are You Human?’ security check.
Cloudflare also improves website performance by managing traffic and reducing server load. For example, when Utility puts the latest Jellycat toy live and traffic spikes, Cloudflare helps the website stay stable and responsive.
For most businesses, it’s an affordable way to protect your website without needing an in-house DevOps team.
Why was the outage so significant?
Cloudflare’s strength is also its weakness. Because it protects millions of websites worldwide, even a small problem can have a massive impact.
During the outages, many sites were immediately unreachable. Even tools that check if websites are down had trouble, since they also relied on Cloudflare. Cloudflare’s own status tools were hard to access for the same reason.
If ever a scenario highlighted the risks of relying on centralised infrastructure, this was it.
What caused the Cloudflare outage?
To be fair to them, Cloudflare has been open about the cause of the outage, which, despite early speculation, was not an external attack or a surge in malicious traffic.
The problem started when an internal change to a database permission caused Cloudflare’s Bot Management system to create an incorrect configuration file. This bigger-than-expected file was sent through Cloudflare’s network.
When their main routing systems attempted to load the file, it exceeded the maximum size. This caused parts of the network to stop handling requests, leading to errors and outages.
Because the system acted as if it were under attack, it took longer to find the real problem. Once their engineers found the bad configuration, they stopped it from spreading, reverted to a stable version, and began restoring services.
Cloudflare was careful during recovery, which is why the outage lasted hours rather than just minutes.
The impact on Dock and our clients
Frustrating as the Cloudflare outage was, there was nothing we could do on our end. We hadn’t changed any code, our servers were running, and security measures were still in place. Traffic simply could not pass through Cloudflare.
Clients were, of course, concerned about why their site was down and if competitors were still trading. In many cases, competitors were affected as well. Small comfort, but it helped us reinforce the reality that website downtime wasn’t isolated to Dock customers.
Our priority became monitoring updates and communicating progress to our clients.
One question that came up was, “Can we turn Cloudflare off and let traffic through directly?”
In principle, yes, you can turn Cloudflare off. But in practice, you risk removing years of security development. During outages like this, attackers actively look for sites that have reduced their protection. Turning Cloudflare off can expose a site to far more damage than a few hours of downtime.
You can make up for lost sales, but a serious security breach is much harder to fix.
Do I need Cloudflare for my website?
You don’t have to use Cloudflare, but we strongly recommend it. There isn’t another service that offers the same level of protection at a comparable price. Outages like this are rare, and in almost 15 years working with Cloudflare, this was the biggest issue we’ve seen.
No platform can guarantee perfect uptime, but Cloudflare remains one of the best options.
