The storm, when it happens
When Shield finds a storm of new IP addresses on the same paths, live or within the past 24 hours, the Cloudflare page shows a banner naming the networks involved.
Rotating proxies
See rotating proxy traffic on the paths it targets
A rotating proxy pool gives every request a new address, so a per-IP rate limit never fires. FindIP Shield watches a Cloudflare-proxied hostname for storms of brand-new IP addresses hitting the same paths, shows you the networks involved, and lets you protect that one path while every other path stays untouched.
Free Preview · 10,000 events per site per day · No credit card · Terms apply
New-IP storms by path
Proxy
Hosting / datacenter
Tor
Malicious IP
IP and ASN changes in session
The problem
Per-IP limits count addresses. Rotation makes every address new.
Credential stuffing and scraping through a rotating pool do not look like one noisy client. They look like thousands of first-time visitors who each make one or two requests to the same login or search path.
A limit keyed on the IP address sees nothing unusual, because no single address does anything unusual. Blocking a whole network category site-wide stops the storm and also turns away legitimate visitors on VPNs and corporate proxies.
The pattern is visible in the aggregate: many addresses never seen before, the same few paths, a short window. That is what Shield looks for, and the fix it offers is scoped to the path under attack.
What Shield shows you
The evidence, then the response you choose
Two remedies, both reversible
Review the networks and add the subnets to the blocklist, or attach a rotation-defence rule to the targeted path only. Both are ordinary policy changes that you can edit or undo in Access rules afterwards.
Rotation inside one session
With the browser SDK installed, a session seen from more than one IP, network or country carries that as a reason on the event. The server verify endpoint returns the same flags and the number of distinct addresses.
Setup
Connect Cloudflare in three steps, no code
For hostnames proxied through Cloudflare, on any plan. Shield deploys one Worker and one route, and starts in Monitor mode, which never blocks.
Connect Cloudflare
Authorize FindIP with your Cloudflare account. The consent screen lists exactly what is requested, and nothing is deployed yet.
Pick one hostname
Choose a hostname that is proxied through Cloudflare. Shield deploys one Worker and one route in front of it and shows you both before activating.
Watch in Monitor mode
Monitor is the default and never blocks. The Activity tab shows every screened visit with its outcome and reason, and a Balanced preview shows what that mode would have blocked.
Prefer another route? Not on Cloudflare? The browser SDK reports IP and network changes within a session on any site.
Boundaries
What a risk score is, and what it is not
An assessment, not proof. A VPN, a hosting network or a changing IP is common for privacy-conscious and corporate users too. Shield explains the reasons so you can decide; it does not pass judgement on a person.
Friction, not a security boundary. Anything decided in the browser can be bypassed by someone who controls it. For decisions that matter, verify the session from your server with your secret key.
Unknown is never safe. Where no intelligence was available the status is unknown. Shield fails open: if a decision does not arrive, the form submits as normal.
Questions
Frequently asked
No. A single request from a clean residential address can look like any other visitor. Shield reports the network signals it has for each address and looks for the rotation pattern across requests. It does not claim to identify every proxy, and a risk score is an assessment, not proof.
It attaches a rotation-defence rule to the targeted path prefix: Balanced mode at strict sensitivity with all network categories. Every other path keeps the site's own mode. You can edit or remove the rule in Access rules at any time.
No. Keep your rate limits, authentication controls and any Cloudflare security features you use. Shield adds the network classification and the new-address pattern, with the reason shown. It does not fingerprint devices or analyse behaviour.
A hostname proxied through Cloudflare, no existing Worker route covering it, and Workers capacity on your plan. On the Free plan, Workers requests are capped at 100,000 per day across all your Workers. Shield checks for a route conflict before installing and refuses rather than interfere.
Requests pass through unchanged. Balanced mode never blocks without intelligence: if the lookup is unavailable or slow, the decision is monitor, never block.
Keep reading
Related
Start by watching one real flow.
Create a free Shield site, install it, and look at the first real event before you decide on any response.
Monitor traffic on CloudflareFree Preview · Informational risk signals · You control enforcement