In 2024, Thanksgiving (November 28), Black Friday (November 29), and Cyber Monday (December 2) significantly impacted Internet traffic, similar to trends seen in 2023 and previous years. This year, Thanksgiving in the US drove a 20% drop in daily traffic compared to the previous week, with a notable 33% dip at 15:45 ET. In contrast, Black Friday and Cyber Monday drove traffic spikes. But how global is this trend, and do attacks increase during Cyber Week?

At Cloudflare, we manage and protect a substantial amount of traffic for our customers, providing a unique vantage point to analyze traffic and attack patterns across the Internet. This perspective reveals insights like Cyber Monday being the busiest Internet traffic day of 2024 globally, followed by Black Friday, with patterns varying across countries. Notably, global HTTP request volume on Cyber Monday 2024 was 36% higher than 2023, with 5% of that traffic blocked as potential attacks.

For this analysis, we examined anonymized and aggregated HTTP requests and DNS queries across our network to uncover key patterns. Cyber Monday, December 2, was the day with peak traffic, and key findings for that day include:

• Cloudflare processed a peak of 99.8 million HTTP requests per second at 15:33 UTC on Cyber Monday, December 2.

• Cloudflare handled approximately 5.4 trillion daily requests on Cyber Monday, with blocked potential attacks comprising around 5% of all traffic. This was higher than the 5.1 trillion daily requests on Black Friday, where 6% of request traffic consisted of blocked potential attacks.

• Daily global HTTP request volume on Cyber Monday 2024 (December 2) increased by 36% compared to Cyber Monday 2023. In comparison, Cyber Monday 2023 had shown a 27% increase over Cyber Monday 2022.

This year’s trends, like those observed in previous years, show how Internet traffic typically peaks in late November but tends to drop in December. In 2024, Cyber Monday was again the busiest day for global Internet traffic. However, Black Friday didn’t make the Top 3, as Sunday, December 1, and Tuesday, November 26, saw higher traffic. Black Friday ranked #5, coming behind November 21. Note: On December 1, 2024, a customer-specific software update event contributed to the increased Internet traffic observed that day, including at the country level.

Highest Internet traffic days, worldwide

#1 Cyber Monday, December 2, 2024 #2 Sunday, December 1, the day before Cyber Monday #3 Tuesday, November 26, 2024

In the US, the ranking was similar, with Cyber Monday, Sunday, and Black Friday being the busiest days for Internet traffic. On Cyber Monday, traffic was 12% higher than the previous week and 57% higher than Cyber Monday 2023.

Highest Internet traffic days, United States

#1 Cyber Monday, December 2 #2 Sunday, December 1 #3 Black Friday, November 29

Additionally, most US states show a similar trend, with Cyber Monday generating the most traffic, followed by Sunday, December 1, and Black Friday, November 29. Arizona, West Virginia, and Arkansas saw increases in traffic of over 20% compared to the previous week. Almost all other states experienced traffic increases exceeding 10%, including some of the most populous ones like California (11%), Florida (11%), and New York (11%).

In looking at just traffic to Shopping and Retail sites based in the US that use Cloudflare, Cyber Monday recorded the highest traffic, followed by Black Friday and the Black Friday weekend. Traffic to these sites increased significantly during Cyber Week, starting on Monday, November 25, with a 7% increase compared to the previous week and a 57% jump compared to the first week of November.

During Thanksgiving Day, mobile usage in the US increased significantly, with mobile device traffic accounting for 51.7% of all traffic, compared to 42.4% the previous week. The trend intensified on Black Friday, with mobile’s share peaking at 51.9% (up from 43.9% the prior Friday) and reaching a similar level on Saturday, November 30, at 52%. However, Cyber Monday saw a shift to desktop use, with mobile device share dropping to 43.4%, lower than the previous Monday. This mirrors a similar trend observed in 2023.

These patterns suggest that Black Friday shopping in the US often involves more out of home/office activities, with people relying on mobile devices for Internet access while on the go, whereas the opposite tends to occur on Cyber Monday, a day when many return to work and school in the US.

Internationally, a trend of peak Internet traffic in November is observed in most countries, as highlighted in our 2023 Year in Review. This trend is likely linked to colder weather in the Northern Hemisphere, where approximately 87% of the world's population resides, as well as holidays and shopping periods, among other factors.

Here's a table summarizing the November and early December days with the most traffic, where Cyber Week plays a significant role.

Highest Internet traffic days

Countries like the Philippines (where Singles’ Day was the top shopping day again this year), Japan, South Korea, Thailand, and Indonesia (where Cyber Monday ranked second this year) show increased traffic in October and November compared to other months. However, they do not exhibit an obvious increase in traffic during Cyber Week.

As noted earlier, Singles' Day (November 11), a major Asian shopping event, ranked among the Top 3 traffic days in Turkey, the Philippines, and other countries.

Aggregated data from our 1.1.1.1 resolver reveals category-specific DNS traffic growth to E-commerce sites, showing a steady increase throughout November, similar to the overall Internet traffic trends.

In the US, E-commerce DNS traffic in November 2024 followed a similar pattern compared to 2023. Black Friday (November 29) ranked as the top day for DNS traffic in the E-commerce category, followed closely by Cyber Monday and Tuesday, November 26. This aligns more closely with overall US Internet traffic trends, where Cyber Monday ranked #1.

Also in the E-commerce category, DNS traffic on Black Friday peaked between 15:00 and 18:00 ET (13:00 and 15:00 PT), with an 18% increase at 18:00 ET compared to the previous week. On Cyber Monday, peak traffic occurred later, from 20:00 to 22:00 ET (17:00 to 19:00 PT).

The UK showed a similar trend in DNS traffic to E-commerce sites, mirroring its Internet traffic patterns, and following the same pattern as 2023. In 2024, Black Friday (November 29) ranked #1, followed by Cyber Monday (December 2), and Thursday, November 21.

In Australia, Saturday, November 30 (the day after Black Friday), was the top day for E-commerce DNS traffic, followed by Cyber Monday and Black Friday. Canada followed a similar trend, with Black Friday ranking highest, followed by Cyber Monday.

In Germany, the busiest E-commerce day was Thursday, November 21, a week before Black Friday, followed by Black Friday (November 29) and Monday, November 25. Cyber Monday did not make the top three, consistent with 2023.

In France, Black Friday remained the top E-commerce day, as in 2023, followed by Cyber Monday (December 2) and Thursday, November 21.

Focusing on the US again, so-called “low-cost” E-commerce sites (which include recent entrants like Temu and fast-fashion brands) have become increasingly popular, and experienced more DNS traffic in the days leading up to Black Friday and Thanksgiving, specifically November 26 and 27. Cyber Monday ranked third.

As observed last year, second-hand shopping sites (ones that offer previously used items) in the US gained more momentum and DNS traffic during the two weeks before Black Friday week. Traffic to these sites peaked on November 12, with Cyber Monday coming in as a close second.

DDoS (distributed denial-of-service) attacks remain a common tactic for disrupting Internet properties. Our data shows that Shopping and Retail sites in the United States protected by Cloudflare experienced a significant rise in DDoS activity on Cyber Monday. On that day, 7% of all traffic in this category was mitigated as DDoS attacks, with an additional 8% flagged as potential threats.

More broadly, DDoS activity targeting the US in general (not limited to E-commerce) also spiked during Black Friday week. Starting November 24, the share blocked as DDoS attacks rose sharply, peaking at over 2% of all traffic on November 25. Across the entire Cyber Week, there was a 41% increase in blocked DDoS attack requests compared to the previous week.

From a cybersecurity perspective, trending events, topics, and individuals often trigger spikes in email traffic, including malicious, phishing, and spam messages. This was evident during the Paris 2024 Olympics, the US elections, and shopping periods like Black Friday and Cyber Monday. Between November 1 and December 2, 2024, Cloudflare’s Cloud Email Security service processed nearly 24 million emails mentioning “Black Friday” or “Cyber Monday” in the subject. Of those, 19.4 million referenced “Black Friday” while 4.2 million mentioned “Cyber Monday”, with 76% (3.2 million) of the Cyber Monday emails sent on December 2, 2024.

During this period, “Black Friday” emails were not only higher volume but also showed higher percentages of spam (10.8%) and malicious content (0.9%) compared to emails mentioning “Cyber Monday” in the subject, which had 1.8% spam and 0.2% malicious content.

In the next chart, we focus on emails with “Black Friday” in the subject, given that it generated the highest percentage of spam and malicious emails. Spam emails peaked in mid-November, making up 29% of all emails, and reached 26% on Cyber Monday. Malicious email percentages were also higher in mid-November, with 3% recorded on November 14, before Black Friday week.

The busiest day for “Black Friday” emails was November 29, Black Friday itself, with 4.1 million emails, followed by Saturday, November 30 (1.5 million), and Wednesday, November 27 (1.4 million).

Internet traffic trends during Black Friday and Cyber Monday show varying patterns globally and regionally. Cyber Monday leads in traffic overall, followed closely by Black Friday. While the US and Canada share similar trends, countries like the UK, Germany, and Australia saw traffic higher on Black Friday than Cyber Monday. In most countries, activity also increased in the days leading up to Black Friday.

On the cybersecurity front, DDoS attacks were more noticeable during Cyber Week in 2024, especially targeting shopping-related sites.

If you’re interested in more trends and insights about the Internet, check out Cloudflare Radar. Follow us on social media at @CloudflareRadar (X), https://noc.social/@cloudflareradar (Mastodon), and radar.cloudflare.com (Bluesky), or contact us via email.

​​Happy Holidays from everyone at Cloudflare!

Throughout the year, special events lead to changes in Internet traffic. We observed this with Thanksgiving in the US last week, where traffic dipped, and during periods like Black Friday (November 24, 2023) and Cyber Monday (November 27, 2023), where traffic spiked.

But how significant are these Cyber Week days on the Internet? Is it a global phenomenon? Does e-commerce interest peak on Black Friday or Cyber Monday, and are attacks increasing during this time? These questions are important to retailers and stakeholders around the world. At Cloudflare, we manage substantial traffic for our customers, which gives us a unique vantage from which to analyze traffic and attack patterns across large swaths of the Internet.

As we'll explore next, we observed varying trends. From a global perspective, there was a clear Internet traffic winner: Cyber Monday was the highest overall traffic day of 2023 (as it was for 2022), followed by Black Friday, and then Monday, November 21 from the same week. But zooming in, this pattern didn’t hold in some countries.

For this analysis, we examined anonymized samples of HTTP requests crossing our network, as well as DNS queries. Cloudflare's global data shows that peak request traffic occurred on Cyber Monday, and that recent weeks have generally been the year’s busiest. Here are some notable figures:

• Cloudflare processed a peak of 80 million HTTP requests per second at 16:10 UTC on November 27.

• The peak hour of 16:00 UTC saw more than 230 billion hourly requests.

• Cloudflare powered around 4 trillion daily requests on Cyber Monday (with blocked attacks comprising around 5% of all traffic), a figure only approached by Black Friday, which saw 3.86 trillion requests.

• There was a 27% increase in HTTP requests on Cyber Monday 2023 (November 27) as compared to Cyber Monday 2022 (November 28).

What about DNS queries?

• Aggregated from our 1.1.1.1 resolver showed that Cyber Monday 2023 experienced a peak of 1.68 trillion queries per day, with 22 million queries per second around 15:00 UTC. Of these DNS queries, 15% were encrypted (HTTPS and TLS). Back in August, the peak was at 1.35 trillion queries per day, marking a 24% increase.

• Traffic to our authoritative DNS servers also peaked on Cyber Monday, with 811 billion daily queries and a peak of 9.4 million queries per second around 15:00 UTC.

• So, during Cyber Monday, we saw a combined peak of over 100 million requests and queries per second across all Cloudflare services at around 16:00 UTC (November 27).

These numbers and trends are consistent with what we observed in 2022 and previous years, where traffic peaks in late November but usually drops in December. Here's a snapshot of global human Internet traffic this year (bot traffic shows a similar pattern).

Worldwide. Most popular Internet traffic days

1. Cyber Monday, November 27

2. Black Friday, November 24

3. Monday, November 21

From the US perspective, the ranking is similar, with Saturday, November 25, the day after Black Friday, ranking as the third busiest day for Internet traffic.

US. Most popular Internet traffic days

1. Cyber Monday, November 27

2. Black Friday, November 24

3. Saturday, November 25

Additionally, most U.S. states show a similar trend, with Cyber Monday experiencing the most traffic, followed by Black Friday. However, Alaska is a notable exception, where the days with the highest Internet traffic were November 13 and 14, coinciding with a snow emergency that closed schools and roads.

States like Colorado, Hawaii, Idaho, New Mexico, and California also had Saturday, November 25, as their second busiest day, but Cyber Monday also “won” there.

Internationally, a trend of peak Internet traffic in November is observed in most countries, as highlighted in our previous 2022 Year in Review (stay tuned for our 2023 edition in the next few weeks). This trend is likely linked to colder weather in the Northern Hemisphere, where approximately 87% of the world's population resided in 2023, as well as holidays and shopping periods, among other factors.

Here's a table summarizing the November days with the most traffic, where the Black Friday week plays a significant role.

Most popular Internet traffic days

Countries like India, Japan, South Korea, Thailand, and Indonesia, though they show increased traffic during October and November compared to other months, do not exhibit an obvious increase in traffic during Black Friday week.

Singles' Day (November 11), a popular Asian shopping event, only features in the top three traffic days in Turkey. In China, October saw bigger traffic peaks than November. However, in November, both Black Friday and the following day (November 25) showed clear increases in traffic, similar to Singles' Day. In South Africa, Singles' Day and Black Friday were the busiest traffic days in November, even though October also had higher peaks.

We observed last week that during Thanksgiving Day, mobile use in US Internet traffic was higher than in the previous week. This trend was intensified on Black Friday, peaking at 55.3% of all traffic, surpassing the typical weekend, which usually sees a higher mobile usage percentage. However, on Cyber Monday, desktop use took the lead, with the percentage of mobile device traffic dropping to 47.6%, lower than the previous Monday.

This trend seems to suggest that Black Friday shopping might involve more offline activities, with people in the US using their mobile devices more for Internet access on that day.

Using aggregated data from our 1.1.1.1 resolver, we have a more focused, category-specific view of the DNS traffic growth to e-commerce sites. There's a general rising trend throughout November, very similar to what we observed in the Internet traffic section.

Looking more closely at the US aggregated e-commerce sites, it's evident that Cyber Monday and Black Friday, in that order, were the days with the most DNS traffic, with Saturday, November 25, ranking third on the podium — exactly mirroring the HTTP traffic pattern discussed earlier.

The peak hours of DNS traffic on Black Friday were around 16:00 and 17:00 UTC, which correspond to 12:00 and 13:00 EST and 09:00 and 10:00 PST. The same pattern was observed on Cyber Monday.

During Cyber Week (November 20 to 27), there was a 15% increase in DNS traffic compared with the previous week. A consistently high level of DNS traffic was maintained throughout Black Friday week, starting on Monday, November 20, with the sole exception being a noticeable drop on Thanksgiving Day — DNS traffic to e-commerce sites was 6% lower than the previous week on that day.

The UK shows a very similar trend to the US in terms of Black Friday and Cyber Monday interest. However, in 2023, Black Friday and Cyber Monday are tied for the top spot, followed by Tuesday, November 21.

In Australia, Cyber Monday ranked as the most popular day for e-commerce DNS traffic, followed by Black Friday. Canada showed a similar pattern, with Black Friday being the most trafficked day, followed by Cyber Monday.

In Germany, Black Friday indisputably led in e-commerce DNS traffic, followed by the previous Friday, November 17, and then the Black Friday weekend. Cyber Monday did not make it to the top three in Germany.

In France, Black Friday was the most popular e-commerce day, followed by Saturday, November 18.

Focusing on the US only again, electronics e-commerce sites experienced more DNS traffic on Black Friday than on Cyber Monday.

This trend was mirrored in the fast fashion category, with Black Friday clearly in the lead.

It's perhaps unsurprising that second-hand shopping sites in the US gained more momentum and DNS traffic in the preceding week (November 12-18) leading up to Black Friday. However, these sites then reached their peak on Cyber Monday.

Regarding cyber threats, let's focus on DDoS (distributed denial-of-service) attacks, a popular method for disrupting Internet properties. Data from November 2023 shows that on Thanksgiving, DDoS attacks accounted for the lowest daily fraction of traffic volume observed in the month of November across the US. There were higher percentages of DDoS attacks in late August and September, associated with the HTTP/2 Zero-Day vulnerability, which led to record-breaking attacks.

The Black Friday week was not a peak period for DDoS attacks. The highest activity in November occurred earlier, mainly in the week of November 6-13.

This pattern is consistent with 2022, where a higher percentage of DDoS attacks was observed before November 21.

Going back to 2023, in terms of potential blocked attacks targeting the "Shopping & General Merchandise" industry, a similar pre-Black Friday week trend is evident. Here we’re including both DDoS and attacks blocked by the Managed Ruleset enforced by Cloudflare’s Web Application Firewall (WAF), and it’s a global perspective. The peak of 7.3 billion daily HTTP requests blocked by our WAF occurred during the weekend before Thanksgiving (November 18), coinciding with early Black Friday promotions.

The trends in Internet traffic during events like Black Friday and Cyber Monday highlight a complex pattern of behavior globally and regionally. Cyber Monday leads the way in Internet traffic, closely followed by Black Friday. The trends in the US and UK are similar, but other countries like Germany and France show distinct patterns. The period before Black Friday also gained traction in terms of Internet and e-commerce activity in some countries.

The shift towards mobile usage on Black Friday and desktop dominance on Cyber Monday (in the US) suggests different consumer behaviors, with e-commerce sites experiencing significant DNS traffic increase during these peak shopping periods.

In terms of cybersecurity, while attacks are constant, we observed a lower incidence of DDoS attacks during the Black Friday week in 2023, but there was a clear increase in the two weeks leading up to the most shopping-intense period.

And finally — don't forget, you can check Cloudflare Radar to track global and country-specific Internet traffic trends.

​​Happy Holidays from everyone at Cloudflare!

Beginning December 1, 2022, if you have a Business or Pro subscription, you will receive a complimentary allocation of Cloudflare Stream. Here’s what this means:

• All Cloudflare customers with a Biz or Pro domain will be able to store up to 100 minutes of video content and deliver up to 10,000 minutes of video content each month at no additional cost

• If you need additional storage or delivery beyond the complimentary allocation, you will be able to upgrade to a paid Stream subscription from the Stream Dashboard.

Cloudflare Stream simplifies storage, encoding and playback of videos. You can use the free allocation of Cloudflare Stream for various use cases, such as background/hero videos, e-commerce product videos, how-to guides and customer testimonials.

To upload your first video Stream, simply visit the Stream Dashboard and drag-and-drop the video file:

Once you upload a video, Stream will store and encode your video. Stream automatically optimizes your video uploads by creating multiple versions of it at different quality levels. This happens behind-the-scenes and requires no extra effort from your side. The Stream Player automatically selects the optimal quality level based on your website visitor’s Internet connection using a technology called adaptive-bit rate encoding.

Your uploaded video will appear on the Dashboard:

Click on the video in the list of videos to watch a preview, change settings or to grab the embed code:

Stream provides an embed code that can be used to place your uploaded videos onto your website. The embed code can be found under the Embed tab:

To include the video on your website, simply copy-and-paste the embed code.

You’ll notice in the screenshot above that the Embed tab lets you customize the viewing experience. It supports the following optional properties:

• Poster: The “poster image” is what appears on the video player before the user has started playing the video. By default, the poster image is set to the first frame in the video. However, you can change it by specifying another point in time or by specifying a URL to an image.

• Start Time: Let’s say you have a 10-minute instructional video and your customer writes in with a question that is answered in that video at the 8-minute mark. You can use the Start Time property to have the video playback begin at the 8-minute mark, so your customer with a specific question does not need to watch 8 minutes of the video wondering “when will it answer my question?”. Instead, you can share a link with the customer that begins the video playback at the 8-minute mark.

• Default Text Track: You can upload caption files for multiple languages for a given video. By default, captions are turned off. But if you want the captions to always render when the video plays, you can choose the default language from the Default Text Track dropdown.

• Primary Color: You can choose your brand’s primary color and have it applied to various elements within the player, including the play button and the seek bar. Here is an example of the Stream Player with the Primary Color property configured to the Cloudflare orange:

We live in a video-first world. Many Cloudflare customers already upload their videos to free video hosting services for marketing purposes. However, when you embed a video on your website that is hosted on a free video sharing service, your users often have to engage with unwelcomed ads and pixel trackers. Our hope is that by offering a free tier of Stream to Biz and Pro customers, you can use video to show off your products in a way that respects your users’ privacy and reflects your brand identity.

In addition to the features described in this announcement, Cloudflare Stream includes many more features including:

• Dynamic Thumbnail Generation

• Multi-language Captions

• Live Streaming

• Analytics

For a comprehensive list of features and how to use them, check out the Cloudflare Stream Docs.

November comes, the temperatures start to get colder for most of the planet's population (87% live in the Northern Hemisphere) and many are also starting to prepare for the festive season. That also brings significant changes in Internet traffic, most notably the online shopping kind of traffic.

So, what were the November days that e-commerce websites had the most traffic in the US and what about worldwide? Is humanity using more mobile Internet at this time? And what are the most popular days online — is Black Friday the winner?

We’ll dig into those questions using Cloudflare Radar. E-commerce is expanding and at an all-time high, especially after the pandemic accelerated the digital transformation process (e-commerce had a 32.4% increase in sales in the US in 2020 and is expected to grow this year).

Let’s start with e-commerce — we added a chart to Radar that shows trends for e-commerce by country. The worldwide trend is pretty evident: Cyber Monday, the day for supposedly last-minute discounts, was the clear winner.

#1. Cyber Monday, November 29.

#2. Monday, November 22.

#3. Black Friday, November 26 — November 24 is pretty close to Black Friday. All in all a very good week in terms of e-commerce traffic.

When we focus on the United States, the country that instituted Black Friday (the day after US Thanksgiving has since become a “retail bonanza” in other countries), the trend is a little different when we look to the full month of November.

#1. Cyber Monday, November 29.

#2. Tuesday, November 2.

#3. Monday, November 1.

The Black Friday week definitely had a big impact on e-commerce traffic, but besides the clear winner, Cyber Monday, the podium was actually completed with the first two days in November. Those days have a big traffic peak, but the Black Friday week has more sustained traffic over five days.

When we look just at last week, Black Friday isn’t actually the most popular day, it’s Monday, November 22 — that isn’t surprising given that shoppers also “returned to stores” on Black Friday 2021 and didn't do everything online.

Despite this, Black Friday 2021 had definitely more sustained traffic throughout the day. The line in the next chart stays up on November 26 (Black Friday) for several hours after 12:00 UTC, early morning in the US, more than in the previous days.

For example, when we look at the 00:00 UTC mark in those red circles (19:00 US East Coast time; 16:00 US West Coast time), Black Friday evening was the most popular evening of the week — even more than November 22. In the past few days, only Cyber Monday had (a lot) more traffic than Black Friday.

And we can also notice the “pause” in online shopping for Thanksgiving Day (we wrote a blog post about that).

With our new Radar tool for e-commerce websites, everyone can see the trends for their country looking back to the previous seven or 30 days. We can give some interesting examples by looking at some countries.

In the UK, for example, the most popular day was Black Friday, followed by Cyber Monday.

In Germany, Black Friday 2021, followed by Cyber Monday, were the most popular days although there’s a bigger traffic peak on November 2.

In the neighbourhood, ‘down’ in France, the most popular days for e-commerce were Thursday, November 18, and Tuesday, November 23. Those days were even bigger than Black Friday or Cyber Monday — there’s also a clear sustained increase in traffic in the Black Friday week.

Now let’s ‘travel’ to India, the fastest growing online retail market in the world, which also had the Black Friday week as the best week of the month for online shopping. Cyber Monday was the most popular day, followed by Wednesday, November 24, and also Black Friday.

One exception seems to be Japan. The start of the Black Friday week and the end of the previous week were the better periods for online shopping traffic — November 18, 23 and 20 were much better days than Black Friday or Cyber Monday.

Recently blogged about where mobile traffic is the most and least popular in the world and also how in September when most students go back to school (and people go back to work) mobile usage goes down. So mobile trends shift with human habits.

So how about November? If we look at the worldwide trend, it’s pretty clear that after Sunday, November 22, the mobile traffic percentage went up — Internet traffic from mobile devices represented 55% of the total in the past week.

We can also see in the next chart that Black Friday, November 26, saw an increase of more than 4% in the mobile traffic percentage, compared to the same period of the previous month. So, people were using their mobile devices a lot more to go online — 4% more.

Now let’s go to the US, where Thanksgiving (as we explained before) had a big influence on Internet traffic. That trend is even more pronounced, specifically on Thanksgiving day, November 25 (mobile traffic percentage grew more than 6%), but also on Black Friday, November 26. At the weekend mobile traffic went back down.

And remember: you can keep an eye on Cloudflare Radar to monitor how we see Internet traffic globally and in every country.

So if you want to relax in an active and learning way this weekend, here are some of the topics we’ve covered on the Cloudflare blog this past week that you may find interesting.

Making things fast is one of the things we do at Cloudflare. More responsive websites, apps, APIs, and networks directly translate into improved conversion and user experience. On November 10, Google announced that Google Search will directly take web performance and page experience data into account when ranking results on their search engine results pages (SERPs), beginning in May 2021.

Rustam Lalkaka and Rita Kozlov explain in this blog post how Google Search will prioritize results based on how pages score on Core Web Vitals, a measurement methodology Cloudflare has worked closely with Google to establish, and we have implemented support for in our analytics tools. Read the full blog post.

Getting to the Core: Benchmarking Cloudflare’s Latest Server Hardware

At the Cloudflare Core, we process logs to analyze attacks and compute analytics. In 2020, our Core servers were in need of a refresh, so we decided to redesign the hardware to be more in line with our Gen X edge servers. We designed two major server variants for the core. The first is Core Compute 2020, an AMD-based server for analytics and general-purpose compute paired with solid-state storage drives. The second is Core Storage 2020, an Intel-based server with twelve spinning disks to run database workloads. This is a refresh of the hardware that Cloudflare uses to run analytics provided big efficiency improvements.

Read the full blog post by Brian Bassett

We previously explained how and why we built Quicksilver. Quicksilver is the data store responsible for storing and distributing the billions of KV pairs used to configure the millions of sites and Internet services which use Cloudflare. This second blog post is about the long journey to production which culminates with Kyoto Tycoon removal from Cloudflare infrastructure and points to the first signs of obsolescence.

Geoffrey Plouviez takes you through the entire story of real-world engineering challenges and what it’s like to replace one of Cloudflare’s oldest critical components.

In this blog post, we explore how Cloudflare Workers continues to excel as a JAMstack deployment platform, and how it can be used to power e-commerce experiences, integrating with familiar tools like Stripe, as well as new technologies like Nuxt.js, and Sanity.io.

Read the full blog post and get all the details and open-source code from Kristian Freeman.

When we review design documents at Cloudflare, we are always on the lookout for Single Points of Failure (SPOFs). In this post, we present a timeline of a real-world incident, and how an interesting failure mode known as a Byzantine fault played a role in a cascading series of events.

Tom Lianza and Chris Snook’s  full blog post on Byzantine faults describes the consequences of a malfunctioning switch on a system built for reliability.

At Cloudflare, we pride ourselves in our global network that spans more than 200 cities in over 100 countries. To accelerate all that traffic through our network, there are multiple technologies at play. So let’s have a look at one of the cornerstones that makes all of this work.

Tom Strickx’ epic deep dive into ASICs is here.

Let us know your thoughts and comments below or feel free to also reach out to us via our social media channels. And because we talked about careers in the beginning of this blog post, check out our available jobs if you are interested to join Cloudflare.

The ability to handle immense scale is well-trodden territory for us on the Cloudflare blog, but scale is not always the first thing developers think about when building an application — developer experience is likely to come first. And developer experience is something Workers does just as well; through Wrangler and APIs like Workers KV, Workers is an awesome place to hack on new projects.

Over the past few weeks, I've been working on a sample open-source e-commerce app for selling software, educational products, and bundles. Inspired by Humble Bundle, it's built entirely on Workers, and it integrates powerfully with all kinds of first-class modern tooling: Stripe, an API for accepting payments (both from customers and to authors, as we’ll see later), and Sanity.io, a headless CMS for data management.

This kind of project is perfectly suited for Workers. We can lean into Workers as a static site hosting platform (via Workers Sites), API server, and webhook consumer, all within a single codebase, and deployed instantly around the world on Cloudflare's network.

If you want to see a deployed version of this template, check out ecommerce-example.signalnerve.workers.dev.

The frontend of the e-commerce Workers template.

In this blog post, I'll dive deeper into the implementation details of the site, covering how Workers continues to excel as a JAMstack deployment platform. I’ll also cover some new territory in integrating Workers with Stripe. The project is open-source on GitHub, and I'm actively working on improving the documentation, so that you can take the codebase and build on it for your own e-commerce sites and use cases.

As I wrote last year, Workers continues to be an amazing platform for JAMstack apps. When I started building this template, I wanted to use some things I already knew — Sanity.io for managing data, and of course, Workers Sites for deploying — but some new tools as well.

Workers Sites is incredibly simple to use: just point it at a directory of static assets, and you're good to go. With this project, I decided to try out Nuxt.js, a Vue-based static site generator, to power the frontend for the application.

Using Sanity.io, the data representing the bundles (and the products inside of those bundles) is stored on Sanity.io's own CDN, and retrieved client-side by the Nuxt.js application.

Managing data inside Sanity.io’s headless CMS interface.

When a potential customer visits a bundle, they'll see a list of products from Sanity.io, and a checkout button provided by Stripe.

Making API requests with Stripe's Node SDK isn't currently supported in Workers (check out the GitHub issue where we're discussing a fix), but because it's just REST underneath, we can easily make REST requests using the library.

When a user clicks the checkout button on a bundle page, it makes a request to the Cloudflare Workers API, and securely generates a new session for the user to checkout with Stripe.

import { json, stripe } from '../helpers'

export default async (request) => {
  const body = await request.json()
  const { price_id } = body

  const session = await stripe('/checkout/sessions', {
    payment_method_types: ['card'],
    line_items: [{
        price: price_id,
        quantity: 1,
      }],
    mode: 'payment'
  }, 'POST')

  return json({ session_id: session.id })
}

This is where Workers excels as a JAMstack platform. Yes, it can do static site hosting, but with just a few extra lines of routing code, I can deploy a highly scalable API right alongside my Nuxt.js application.

This idea extends throughout the rest of the checkout process. When a customer is successfully charged for their purchase, Stripe sends a webhook back to Cloudflare Workers. In order to complete the transaction on our end, the Workers application:

• Validates the incoming data from Stripe to ensure that it’s legitimate. This means that every incoming webhook request is explicitly validated using your Stripe account details, and can be confirmed to be valid before the function acts on it.

• Distributes payments to the authors using Stripe Connect. When a customer buys a bundle for $20, that $20 (minus Stripe fees) gets distributed evenly between the authors in that bundle — all of this calculation and the associated transfer requests happen inside the Worker.

• Sends a unique download link to the customer. Using Workers KV, a unique token is set up that corresponds to the customer's email, which can be used to retrieve the content the customer purchased. This integration uses Mailgun to construct an email and send it entirely over REST APIs.

By the time the purchase is complete, the Workers serverless API will have interfaced with four distinct APIs, persisting records, sending emails, and handling and distributing payments to everyone involved in the e-commerce transaction. With Workers, this all happens in a single codebase, with low latency and a superb developer experience. The entire API is type-checked and validated before it ever gets shipped to production, thanks to our TypeScript template.

Each of these tasks involves a pretty serious level of complexity, but by using Workers, we can abstract each of them into smaller pieces of functionality, and compose powerful, on-demand, and infinitely scalable webhooks directly on the serverless edge.

I'm really excited about the launch of this template and, of course, it wouldn't have been possible to ship something like this in just a few weeks without using Cloudflare Workers. If you're interested in digging into how any of the above stuff works, check out the project on GitHub!

With the recent announcement of our Workers KV free tier, this project is perfect to fork and build your own e-commerce products with. Let me know what you build and say hi on Twitter!

Black Friday was the biggest online shopping day but the second biggest wasn't Cyber Monday... it was Thanksgiving Day itself (the day before Black Friday!). Cyber Monday was the fourth biggest day.

Here's a look at checkout events seen across Cloudflare's network since before Thanksgiving in the US.

Checkout events as a percentage of checkouts on Black Friday

The weekends are shown in yellow and Black Friday and Cyber Monday are shown in green. You can see that checkouts ramped up during Thanksgiving week and then continued through the weekend into Cyber Monday.

Black Friday had twice the number of checkouts as the preceding Friday and the entire Thanksgiving week dominates. Post-Cyber Monday, no day reached 50% of the number of checkouts we saw on Black Friday. And Cyber Monday was just 60% of Black Friday.

So, Black Friday is the peak day but Thanksgiving Day is the runner up. Perhaps it deserves its own moniker: Thrifty Thursday anyone?

Checkouts occur more frequently from Monday to Friday and then drop off over the weekend.  After Cyber Monday only one other day showed an interesting peak. Looking at last week it does appear that Tuesday, December 17 was the pre-Christmas peak for online checkouts. Perhaps fast online shipping made consumers feel they could use online shopping as long as they got their purchases by the weekend before Christmas.

Happy Holidays from everyone at Cloudflare!

Black Friday by Per-Olof Forsberg, license: CC BY 2.0

To try and answer this question, we took a look at anonymised samples of HTTP requests crossing our network. First of all, let’s look at total page views from across our global network from the last few weeks and see if we can spot Black Friday and Cyber Monday:

All page views

So this is total page views by day (UTC) from November 19 (a week before Cyber Monday) until Monday December 3. Other than follow-the-sun fluctuations in a repeating daily pattern, each whole day is pretty similar in shape and size compared to the last. Black Friday and Cyber Monday aren’t visible in overall traffic patterns.

We have a very diverse set of customers across 12 million domain names and not all of them are selling products or doing so directly online. To identify those websites that are, I used metadata from the wonderful HTTP Archive project to export a list of domains using Cloudflare that were also running ecommerce software.

Here are the page views for these ecommerce sites over the same time period:

Ecommerce page views

So we can see clearly that our ecommerce customers are seeing a big increase in page views on November 23 and 26. Black Friday and Cyber Monday are most certainly a thing. This year Black Friday was quite a bit busier than Cyber Monday - around 22% busier in terms of page views. If we compare the page views of each day to the week prior, we can see the changes clearly:

% page view change vs previous week

The uplift starts on Wednesday but really kicks in during Thanksgiving with an increase of more than 100% on Black Friday.

So we’ve established that these shopping days are important in terms of visitor activity. More pages are being viewed on these days - but is anyone buying anything?

We’re dealing with trillions of requests across a really large data set of different websites without any specific knowledge of what a purchase transaction would look like for each - so to approximate this I took a crude approach, which is to look for successful checkout interactions in the data. If you imagine a typical ecommerce application makes a purchase with a HTTP request like “POST /store/checkout HTTP/1.1” we can look for requests similar to this to understand the activity.

% of checkout interactions vs prior week

We can see here that Black Friday has an almost 200% increase in checkout interactions compared to the previous Friday.

Using this raw number of checkout interactions to compare with the page views we have something approximating a conversion %. This is not a true conversion figure - calculating a true conversion figure would require data that identifies individuals and detailed action tracking for each website. What we have is the total number of page views (HTTP requests that return HTML successfully) compared to the total number of POST requests to a checkout. This gives us a baseline to compare changes in “conversion” over these big November shopping days:

% of checkout interactions / page views vs prior week

Each bar on this chart represents the % change in checkout interactions as a proportion of page views compared to the same day the previous week. We can see this increased by 45% on Black Friday compared to the Friday before (boring old beige Friday November 16). The following Saturday was booming at 60% - because we’re dealing with time in UTC, a UTC Saturday actually includes Black Friday traffic for some parts of the world, the same can be said of Tuesday which contains overlap from Cyber Monday - we’ll break this down a bit later.

On Cyber Monday, the increase actually beats Black Friday, meaning page views lead to cart interactions 57% more often than the prior Monday (boring old vanilla Monday November 19), albeit from a lower number of transactions.

What we see here is just how much more browsing people do on mobiles today vs desktop, with mobile winning most days:

Page Views by Device Type

When it comes to checkout interactions though, we can see the situation is switched with visitors more likely to interact with the checkout on a desktop overall, but even more so on Black Friday (14% more likely) and Cyber Monday (20% more likely).

Checkout Interaction as % of Page Views

Let’s look at a specific region to understand more, starting with the US:

USA Page Views (PST)

We can see a more normal weekday pattern on the prior Thursday & Friday (15 & 16 Nov) whereby desktop page views eclipse mobile during the daytime while people are at their desks. In the evenings and weekends, mobile takes over. What we see from the 21st onward is evidence of people taking time off work and doing more with their mobile devices. Even on Thanksgiving, there is still a big rise in activity as people start gearing up for Friday’s deals or finding ways to avoid political discussion with relatives at home!

On Cyber Monday, traffic earlier in the day is lower as people return to work, however we are seeing heavy use of desktop devices. As the working day ends, mobile once again dominates. Things begin to settle back into a more regular pattern from Tuesday November 27 onwards.

Let's take a look at checkout interaction over the Black Friday to Cyber Monday weekend by device type.

USA Checkout Interaction % (PST)

Despite all of that mobile browsing activity, desktop devices are more commonly used for checkout actions. People seem to browse more on mobile, committing to buy more often with desktop, it may also just be that mobile users have more distractions both on the device and in the real world and are therefore less likely to complete a purchase. From personal experience, I also think the poor mobile optimisation of some sites’ checkout flows make desktop preferrable - and when customers are incentivised with discounts & deals, they are more likely to switch devices to complete a transaction if they hit an issue.

It might be obvious if you’re reading this from the UK, but despite the fact that Thanksgiving is not a holiday here, retailers have very much picked up the mantle from US retailers and seized the opportunity to drive sales over this weekend.

UK Page Views (UTC)

Page views to ecommerce websites on Cloudflare look very similar in shape to the US on Black Friday. However, mobile is more dominant in the UK, even during working hours. It’s worth noting one big difference here - Cyber Monday in the UK was only 22% up in terms of page views compared to the prior Monday - in the US the increase was more than 4x that.

UK Checkout Interaction as % of Page Views

When it comes to checkout, it also looks like UK visitors to ecommerce sites commit more with their mobile, but desktop is still more likely to lead to more conversion.

Taking Germany as another example, here’s how page views look:

Germany Page Views (CET)

Desktop use during typical working hours is much more pronounced in Germany. Black Friday and Cyber Monday show higher page views than a normal Friday / Monday but the difference is much smaller than regions such as the US & UK.

Black Friday is spreading internationally despite these still being normal working days for the rest of the world. Cyber Monday is also increasing ecommerce activity internationally but tends to be quieter than Black Friday. Overall, mobile browsing eclipses desktop, but those desktop page views tend to lead to checkout more often.

Retailers should continue to invest in making their mobile & desktop ecommerce experiences fast & resilient to seize on these key days.

A key Cloudflare feature is caching, which allows content to be served closer to the end user from our global network of data centers. Doing so improves the user's shopping experience and contributes to increasing the proportion of people completing a purchase (conversion rate).

For example:

• Walmart found improving page load time by 1 second increased their conversion rate by 2%

• Research for Amazon showed every 0.1 second of delay costs 1% of sales

• The Barack Obama campaign website saw an 80% page load time boost resulted in a 14% increase in donations

Cloudflare operates over 110 data centers around the world. When a website implements Cloudflare, visitor requests for the site will proxy through the nearest Cloudflare data center instead of connecting directly to the webserver hosting the site (origin). This means Cloudflare can store content such as images, JavaScript, CSS and HTML on our servers, speeding up access to those resources for end-users.

Most ecommerce websites rely on a backend database containing product descriptions and metadata such as prices. Without caching, each visit to a product page might involve several database requests to pull all the required data, which can introduce added latency to page load time, particularly on a busy website. Serving the website's homepage and product pages from Cloudflare's cache not only eliminates these costly database calls, but also reduces the load on your origin infrastructure.

To make the most of Cloudflare and to help maximize the speed of your website, serve as much content as possible from the Cloudflare cache.

By default, Cloudflare caches static content based on a fixed list of file extensions which includes assets such as images, CSS files and PDFs.

The reason Cloudflare only caches static content out of the box (and does not cache HTML content by default) is to avoid the risk of inappropriate data being cached. For example, if the shopping cart page is cached, then the next visitor might receive the cached version and see a cart with the incorrect contents. Therefore, while enabling more caching will let you make the most of Cloudflare, it requires careful and considered implementation.

Additional caching on Cloudflare can be enabled in one of two ways - using Page Rules or by sending cache headers from your origin. These two methods are explained in more detail here. In this blog post we’ll use Page Rules, but keep in mind you can use headers from your origin too.

A typical HTML page on an ecommerce website will contain static content (such as the product description) and dynamic content such as:

• a header section which varies according to the visitor’s logged in state - e.g. if the user is logged in, it may offer the user a “Logged in as..." message

• a basket section which populates as the user shops on the site

The user might have one or more session cookies to maintain these dynamic elements.

There are few ways to make the most of Cloudflare's caching, while taking into account the dynamic nature of ecommerce websites.

Note: the Bypass Cache on Cookie feature is only available on the Cloudflare Business and Enterprise plans

Many visitors to a site will be brand new, first time visitors - in other words, they won’t be logged in to the site and won’t have any items in their basket.

Serving their request from the Cloudflare cache means they can quickly view the page they’re looking for (whether the homepage or a specific product page). As they're a brand new visitor, the entire page can be served from the Cloudflare cache.

With most ecommerce platforms, as soon as the user logs in to the site or adds an item to basket, a relevant cookie is sent to the browser.

Cloudflare can cache the pages, but will bypass the cache should Cloudflare receive either of the cookies from the browser.

This is achieved by introducing a Page Rule with a “Bypass Cache on Cookie” setting:

In the above example, the Page Rule will cause all requests to the site to serve from cache, unless the web browser has sent a cookie named “loggedin” or “iteminbasket”.

Obviously every ecommerce platform is different, so always think through your settings and ensure you use the correct cookie values to ensure that there is no risk of private data (e.g. someone’s shopping basket) being served from cache and shown to another visitor.

A better solution would be to serve the entirety of the page from cache, but populate the dynamic elements using JavaScript / AJAX.

This means Cloudflare will serve the bulk of the page content and only small requests will pass (via Cloudflare) direct to origin to populate dynamic elements such as the basket contents.

To configure this, use a Page Rule with Cache Level “Cache Everything” for the static content and another Page Rule with Cache Level “Bypass” for the dynamic (AJAX) requests.

In this example, any requests going to www.example.com/ajax/basket_contents.php and www.example.com/ajax/logged-in-state.php would match the first Page Rule, which has cache level “Bypass” - Cloudflare will proxy the request but the request won't touch the Cloudflare cache.

Other requests, e.g. to www.example.com/products/product_page would not match the first Page Rule but would instead match the second “Cache Everything” Page Rule - thus the product page is served from the Cloudflare cache. Within that product page, the dynamic elements (such as the basket contents and the logged in state) are dynamically populated using the AJAX requests.

You should also consider introducing additional appropriate Page Rules for special pages such as the checkout pages - for example, you may wish to create a Page Rule that bypasses the cache for all the checkout pages.

Remember: only one Page Rule will execute for any given request, and Page Rules are processed in the order they exist in the Cloudflare control panel. Read over our Page Rules tutorial to better understand how they work.

Note: the Railgun feature is only available on the Cloudflare Business and Enterprise plans

Cloudflare’s Railgun technology optimizes the connection between Cloudflare and the website origin, for accelerating dynamic HTML content - content that can't be served from the Cloudflare cache.

Railgun helps in two ways:

• Establishing a persistent connection between Cloudflare and the website origin (to speed up initial connection times)

• Compressing the data that passes from the origin to Cloudflare by only sending content that has changed

Before Railgun:

After Railgun:

Railgun can happily be used in conjunction with the previously discussed caching methods.

If you’ve implemented method 1 (the bypass cache on cookie method) then Railgun will accelerate the requests which pass directly to origin due to the presence of the relevant bypass cache cookies.

Method 2 (caching everything on Cloudflare except AJAX calls to populate dynamic sections) is already more efficient than method 1. Railgun can still be used to further accelerate the AJAX requests that pass from Cloudflare to origin.

Railgun is a little more advanced as it requires installation of a small software package on (or very close to) the origin webserver to handle the compression. You can read more about Railgun here and find the installation documentation here.

Ideally a well optimized ecommerce website will leverage our caching service as much as possible - serving images, CSS and JavaScript from Cloudflare's network, in addition to as much static HTML content as possible. Adding our Railgun service to accelerate those inevitable non-cachable requests to the origin webserver will help create a fantastic, speedy shopping experience for your customers.

CloudFlare recently wrote about the group of cyber criminals claiming to be be the "Armada Collective." In that article, we stressed that this group had not followed through on any of the ransom threats they had made. Quite simply, this copycat group of cyber criminals had not actually carried out a single DDoS attack—they were only trying to make easy money through fear by using the name of the original “Armada Collective” group from late 2015.

Since we published that article earlier this week, this copycat group claiming to be "Armada Collective" has stopped sending ransom threats to website owners. Extorting companies proves to be challenging when the group’s email actively encourages target companies to the search for the phrase “Armada Collective” on Google. The first search result for this phrase now returns CloudFlare’s article outing this group as a fraud.

Beginning late Thursday evening (Pacific Standard Time) several CloudFlare customers began to receive threatening emails from a "new" group calling itself the “Lizard Squad”. These emails have a similar modus operandi to the previous ransom emails. This group was threatening DDoS attacks unless a ransom amount was paid to a Bitcoin address before a deadline. Based on discussions with other security vendors, we can confirm that at least 500 of these emails have been sent out by this group claiming to be the “Lizard Squad.”

Each of these emails is exactly identical, including a Bitcoin address that has been re-used. As we discussed in our previous article, re-using the Bitcoin address means the group of cyber criminals has no way of identify which company has paid their ransom. If this group was legitimate, you’d expect to see a unique Bitcoin address for each individual target company.

Included below is an example email from the "Lizard Squad" compared to the Armada Collective:

While the emails have some differences, they are ultimately identical in their goal and how they go about attempting to extort money from the target companies. Similar to the group claiming to be the "Armada Collective", there is a general consensus within the security community that this group claiming to be the "Lizard Squad" is not in fact actually the group they claim to be. This is another copycat.

Unsurprisingly, we haven’t seen any example of the "Lizard Squad" actually following through on their threats. CloudFlare will continue to monitor the situation, and we’ll provide an update if any further changes develop.

CloudFlare would like to continue to stress the importance of not paying ransom if you receive a threat. Paying the ransom only emboldens these cyber criminals and provides them with funding to attack other companies. If you receive a threat please reach out to CloudFlare, and our team would be happy to discuss whether an attacker is known to carry through on their threats. While the threats made by these imposter groups are unlikely to result in an actual attack, we do encourage companies to use a service like CloudFlare to proactively protect their infrastructure against these types of attacks when there is a legitimate threat.

Even though CloudFlare offsets most of the load to your website via caching and request filtering, a certain amount of traffic will still pass through to your host. Knowing the limits of your plan can help prevent a bottleneck from your hosting plan.

CloudFlare allows you to block IP address individually or IPs from entire regions. If you don’t want or need traffic from certain IPs or regions, you can block them using your Threat Control panel. This is useful for sites who know where their visitors usually come from.

Take action to prevent attacks to your site during peak season by configuring your firewall to only accept traffic from CloudFlare IP addresses during the holidays. If you only accept CloudFlare IPs, you can prevent attackers from getting to your original IP address and knocking your site offline.

CloudFlare operates as a reverse proxy to your site so all connections come from CloudFlare IPs, so restricting our IPs can cause issues for visitors trying to access your site. The list of our IP can be found here: https://www.cloudflare.com/ips

By default CloudFlare caches static content with our CDN; however, you can extend our caching by creating custom Page Rules. Under the Page Rules section of your account, you can set a pattern--either your entire website, or a section of your site--then turn on the “Cache everything” option. Creating a page rule and setting the Cache Everything option helps reduce the number of times CloudFlare has to hit your origin to download cacheable items.

Setting up a custom Page Rule like this is ideal if you have a campaign going on over the holiday season. With the Cache Everything option enabled, CloudFlare will be serving your entire site, taking the load off of your server completely, making you site as fast as possible.

Edge Cache Expire TTL and the Browser Cache Expire TTL allows you to determine how long we cache resources at our edge, and how long browsers will cache assets.

To ensure visitor’s IPs show in your back-end server logs you can install mod_cloudflare to restore original visitor IP back to server logs. Our IP addresses will show up in your logs unless you install the modification to make sure you are logging the visitors’ actual IP addresses.

Auto Minification is a method that helps your site send as little information as possible to increase performance. It works by taking JavaScript, CSS, and HTML and removing all comments and white spaces.

Rocket Loader is an asynchronous JavaScript loader. It ensures that individual scripts on your page won’t block other content from loading, loads third party scripts in the order they are ready, and bundles all script into a single request so multiple responses can be streamed---in short, it makes your page render much faster on any device.

At a high level, Rocket Loader works like this:

(Available for Pro, Business, and Enterprise plans)Mirage will determine which images are visible to the end user and send those first, then other images that are off the screen will be lazy loaded as needed. This feature is especially useful for sites that with many images like most ecommerce sites

For example: if your sites has a images of seventy different t-shirts for sale, rather than having the customer wait for all seventy images to load, Mirage quickly delivers the images immediately visible to the user, then loads the rest of the images as the customer scrolls down. By having the most important images load lightning fast, the end user’s experience is improved.

(Available for Pro, Business, and Enterprise plans)Polish recompresses images to make them as small as possible in order to increase site performance.

For example: You may have images on your site that are not optimally compressed. When CloudFlare puts those images into cache it will automatically recompress them making them smaller, and allowing them to be loaded as quickly as possible. CloudFlare can compress images in a lossless or lossy way.

If you want to make quick changes to your page and have your visitors see that change immediately, you can purge individual files from CloudFlare’s cache.

For example, if you are running a sale only for Black Friday, and you want new content displayed to your visitors, you can purge a single page so that CloudFlare will return to your origin server to fetch a new version of that page for our cache.

Please Note: if you purge your entire cache your origin will receive a flood of traffic until CloudFlare get all of your assets back into our cache.

Even if you don’t implement any of the suggestions above you are still ahead of the game by being on CloudFlare’s network. Since we have 28 data centers around the world, we bring your site close to your visitors. And since we run an Anycast network, visitors are automatically directed to the closest data center meaning that your site will be faster as the request travels over a shorter distance.

We wish you all the best this holiday season! Good luck!

After undergoing a Payment Card Industry (PCI) Data Security Standard (DSS) 2.0 security control assessment, we’ve been certified as a Level 1 service provider. Achieving Level 1 status requires an assessment of our security controls by an independent third party—a Qualified Security Assessor (QSA).

Additionally, CloudFlare’s Web Application Firewall (WAF) helps companies meet PCI requirement 6.6. Our WAF not only helps protect our customers from application layer attacks, but also secures the data of online consumers making purchases on sites within the CloudFlare network.

What’s even better is that we’ve achieved Level 1 PCI compliance while still allowing for expansion of our global data center network. Over the coming weeks, we plan to turn on four new data centers in Madrid, Spain; Milan, Italy; Medellín, Colombia; and São Paulo, Brazil.

Stay tuned for updates on these new locations!

Have questions about CloudFlare’s PCI status? Check out this FAQ section.

The following is a guest blog post by Chris Holland, Director of Technology at Luxury Link. Luxury Link has been using CloudFlare’s Railgun acceleration technology since March 2013.

In March 2013, we started testing Railgun, and slowly rolled it out across our three web properties. We saw immediate results.

First, we saw instant reductions in time to retrieve uncached HTML documents, and as an ecommerce web property every millisecond counts. Using Railgun, the HTML for our home page (hosted in Los Angeles, California) loads 40 percent faster from the East Coast in the United States. Measurements we've run from London showed a 2x speedup, which is invaluable in positioning ourselves as a global player in the travel industry.

Second, we saw a reduction in outbound bandwidth from our origin web servers. Because Railgun does compression between the origin server and CloudFlare’s data centers, our bandwidth needs were dramatically reduced. This is especially important for our business because sudden peaks of traffic are commonplace.

We had tried other dynamic acceleration products offered by top-tier CDNs, but the results weren't as good and they cost a lot more than the CloudFlare Business plan.

Railgun, to put it mildly, was rather impressive.

We had the sneaking suspicion that Railgun's delta compression algorithm might have a noticeable impact on outbound bandwidth consumption out of our data center. In fact, it was more than noticeable!

In the chart below, the green line shows our outbound bandwidth consumption over a six month period. You can see that before we turned Railgun on in March, there are many spikes. Post-March, the spikes disappear.

It is important to note that with or without Railgun enabled, all of our HTML documents are delivered using gzip encoding. All our images, stylesheets and scripts are cached in CloudFlare data centers; as such they barely factor in the outbound bandwidth consumption. It's for the most part fair to state that our outbound bandwidth consumption is solely comprised of the retrieval of uncached HTML documents.

For us, this is why Railgun makes such a difference on top of the traditional CDN benefits. Railgun is accelerating and compressing the parts of the site that a normal CDN just can't handle. By accelerating the delivery of ‘uncacheable’ HTML pages, our visitors are getting better response times and we are seeing a big decrease in outbound bandwidth.

This chart shows the inbound (orange line) and outbound (green line) bandwidth on February 6, 2013, before we introduced Railgun. It shows a pretty typical story for us: dramatic peaks in traffic linked to specific email campaigns.

The data shows that our outbound bandwidth is between 5x and 10x our inbound. That's pretty typical of gzipped HTTP traffic serving mostly HTML: inbound traffic is made up of HTTP requests, most of which fit in a packet or two, while outbound traffic is made up of all the actual HTML documents in response to those requests.

Our peak traffic often comes from email campaigns sending users to some of our largest HTML documents, which is why we're more likely to come in at a 10:1 ratio. Off-peak outbound is still about 5x inbound traffic, and reflects a longer tail of smaller HTML documents from more organic browsing.

Next take a look at this chart from May 8, 2013, with CloudFlare Railgun running on our site:

Railgun shines when many users access a handful of similar URIs, which is the pattern of our peak traffic. Even though the documents being returned are different in subtle ways for each user, those unique subtleties are the only bits of information exiting our data center. Think "diffs." Railgun essentially flattens our peaks: going from a 10:1 ratio to a 1:1 ratio, our peak outbound traffic is 1/10th of what it used to be before Railgun.

Off-peak outbound traffic, which is the longer-tail organic browsing, is also down to a 3:1 ratio from a 5:1 ratio without Railgun.

After much hard work internationalizing our platforms, we were extremely thrilled to launch our site in the UK just before July 4th: http://www.luxurylink.co.uk. As we expand internationally, our audience will continue to grow geographically further from our data center located in Los Angeles, California, and Railgun will have an even greater impact by ensuring less data has to travel over increasing distances. Our UK site is also backed by Railgun.

While Railgun is likely to have a different impact for every application based on trafficked URIs and heterogeneity of documents, our observations would indicate that the impact for most web applications will fall somewhere between "noticeable" and "unbelievable."

Looking at these numbers, Railgun ought to be extremely attractive to cloud-hosted companies, such as people using services like Heroku, AWS or the Rackspace Cloud, as well as anyone paying for every single byte transferred in and out of their applications.

I would love to one day see Railgun's "edge agents" implemented as Chrome, Firefox, or Safari extensions. Right now, while very significant in terms of percentage, Railgun's acceleration is only marginally "felt" by end-users: full HTML documents are still sent to end-users from CloudFlare's edges. Picture a day when this "diff'ing" technology gets baked into the web browser, such that a web property becomes faster as you browse it because you're rarely ever retrieving a full HTML document for a given request, but rather a small HTML fragment which might fit in a single packet.

Dreaming up possibilities afforded by CloudFlare's platforms could be a full-time occupation. But before getting too far ahead of ourselves, Railgun as it stands today ought to be wildly transformative to the Internet and the many businesses that operate online. It certainly is to us.

Forecasters have estimated that online holiday shopping will account for almost 25 percent of total ecommerce sales in 2012. That's more than $54 Billion dollars in online transactions. With so much shopping happening online, we thought we'd talk to one of our ecommerce customers to hear what they do to prepare their site for the busiest time of the year.

Luxury Link curates exclusive travel experiences with luxury properties around the world at insider prices. Chris Holland is the Director of Technology at Luxury Link, and has more than 16 years of web development experience. I recently spoke with Chris to learn more about Luxury Link, what he has seen over the years in the ecommerce industry, and what it's like to run an ecommerce site when the holidays hit.

Since 1997, luxurylink.com has evolved from an exclusive e-mail list to exclusive online listings. Luxury Link has pioneered the web-based auction model for Luxury Travel. Our audience is extremely savvy, discerning and demanding of the greatest possible value for the most outstanding luxury vacation experiences.

While we used to have the niche to ourselves, the online travel landscape is competitive and so we are constantly working to optimize our website to make sure our visitors get the most out of the experience. Our web property experience includes everything from design to merchandising to site performance to SEO and the conversion funnel, as well as offering valuable insights to travelers while accommodating innovative marketing and product strategies. We, in the Tech Team, have our work cut out for ourselves catering to many business functions.

We've had to evolve beyond merely "selling online." It's no longersufficient to put up a page clamoring "Here are 12 a mazing vacations this week." We've seen travelers increasingly seeking inspiration and guidance. Finding the right vacation is a personalized and, at times, challenging process as many variables need to be juggled. While we've dramatically improved search and categorization on our site, we're just getting started. Solving these problems is less about using a specific search technology like Lucene, SphinX, SLI Systems, or Endeca and more about information architecture and accommodating a critical factor: Human curation. Everything you see on our site is an ever-evolving blend of human and machine curation. While search engines will seek out what you want, we have the added responsibility of helping visitors shape their traveling desires.

These core fundamentals really matter: performance, SEO, business intelligence, merchandising, and seasonal relevance.

For site performance, one of the tools we use is CloudFlare. To audit and monitor site speed, we use a blend of inexpensive resources such as webpagetest.org,Google PageSpeed Insights, and WatchMouse(now Nimsoft Cloud Monitor). I'll defer to your local expert to cover SEO.

We leverage Google Analytics and in-house-built event frameworks and data warehousing for various aspects of business intelligence. I'm a big fan of Tableau Software to crunch data.For any site, and especially commerce sites, analyzing your marketing channels and respective conversion rates can uncover valuable insights: A/B testing is a very important part of this process. We've found PHP Scenario very helpful and we've integrated it into our A/B testing platform.

You might also consider giving your customers a voice by launching a community around your brand. While we've had a community on our site for some time, participation in it had died down. In 2012 we completely revamped it into "The Luxury Lounge" -- This initiative has brought about renewed interest from our loyal members in sharing their travel experiences. It's a veritable trove of great travel insights. It is positive for SEO, as well.

Online commerce has had to evolve beyond just listing and selling products, as competition and margins have become fierce. Consumers seek insights and guidance. Commerce sites featuring fresh, relevant and timely content in the form of editorial and consumer insights, tend to do better than sites that don't. In recognition of this, Google's algorithm updates have shaken things up. Incumbent sites that once merely listed products are finding themselves displaced by sites offering relevant content about those products. SEO is an exciting world where quality content is king, and this has had an impact on every commerce site I've worked on.

It is typically all about Q1 for the travel industry. We expect a 50% jump in traffic in January over November. While we do have plenty of capacity, CloudFlare's "always-on" feature is a nice safety net.

We ensure our zabbix monitors are well-tuned, stick to best practices when deploying new code, don't stray away from our phones at nights, and generally do everything we can to ensure the site is running fast.

The top five pages and locations people are looking at include:

• Ski and Snow Destinations

• Caribbean

• Cabo San Lucas

• London

• BaliGuided Tours

Our server origin is in downtown Los Angeles. We have seen a big speed difference in the average time it takes to download a dynamic web page weighing 23,000 bytes from Texas:

Without CloudFlare: 569 milliseconds
With CloudFlare: 332 milliseconds

This is for dynamic content. In other words, for this type of request, CloudFlare has to fetch the dynamic content from our system, and then pass it along to the user, every time. Going through CloudFlare for dynamic content delivery is 42 percent faster.

Overall, I believe CloudFlare is the best thing to happen to the Web in recent memory, and by extension, the Internet at large. CloudFlare's infrastructure is staggering and the architecture and pace of innovation are simply impressive. CloudFlare's offerings have an incredibly positive impact on site owners and web visitors.

We are looking forward to co-hosting a meetup next week on Wednesday, November 14, with Braintree, the fastest growing payments platform for online and mobile commerce.

This meetup will:

• Answer all of your questions about what to look for as you decide which payments provider is best for you

• Debunk payment myths

• Give insight into what the future of payments may hold

The speakers will give an overview of various payment solutions for different business types and stage of growth. From startups to SMBs - this meetup will answer your questions and give guidelines for best practices in choosing an online payment service.

Braintree speakers will be Charity Kittler, who directs training at Braintree, and Jenna Wyer, VP of Sales for Braintree.

There will be pizza, beer and good times, hope to see you there!

Doors open at 6:30PM, presentation starts at 7PM.

RSVP for the Braintree and CloudFlare meetup

What if there was an automated system that could analyze all of your page content, determine what your users are talking about and deliver highly targeted product references directly in your content? Say hello to Prosperent's ProsperLinks.

CloudFlare is excited to announce our newest app, Prosperent's ProsperLinks. Their affiliate tool is a very simple way to earn extra revenue on your content without diminishing your readers' experience.

When enabled and configured, it instantly analyzes your page content and turning product references into affiliated links. Additionally, ProsperLinks automatically affiliates existing links in your content. You get paid when your readers make a purchase!

Prosperent is an advertising company that specializes in retail and product advertising. With over 3,000 merchants including Zappos.com, 6pm, Overstock.com, Backcountry, REI, Nordstrom's and thousands of other retailers, Prosperent makes the best products available through their advertising products, and improves profitability for publishers.

With ProsperLinks, you are in control of the user experience. Choose from single underline, double underline, or links with a price comparison hover box. This allows you to maximize revenue while minimizing the impact to your visitors.

ProsperLinks is free to install and 70% of revenue will be paid to the website owner. CloudFlare will pay publishers directly, on a net-60 day basis. For example, revenue accrued in March will be paid by the end of May. Payments are made at the end of each month.

Sign up today!

Growth continues at a lightning pace for Pinnacle Cart and they've just announced something huge.

"We literally just announced that we are offering ecommerce software for free," said Mike. "We are big believers that the space is going into a commodity play and we partnered for our first offering with Chase and Parallels to offer a free version of Pinnacle Cart to customers."

With a competitive market and ecommerce software becoming a more commodity-based field, Mike said they felt now was the time to go with a free version of their service.

"We are going to be first to market with that play. It's big times for us," said Mike.

By offering a free service, Pinnacle Cart has now empowered any entrepreneur to get started, with the hope that once those businesses succeed and grow they will upgrade to paid services. Kudos to Pinnacle Cart for making the process to becoming a business owner easier and much more affordable.

Tune-in to the interview clip to hear more on Pinnacle Cart's free ecommerce software.

At HostingCon 2012, CloudFlare co-founder Michelle Zatlyn sat down with 28 leading experts in the hosting industry. Their conversations were captured live and offer insight into the latest trends and news in hosting.

So, when the management team at Khataland.com got the call that Jill Martin was going to feature one of their products in the Steals & Deals promotion on Tuesday, January 24, they were excited. And then they got to work.[

](http://www.khataland.com/)

NBC editors tell featured companies to expect up to 100,000 hits in the span of a few minutes after the TV segment airs, with follow-on spikes as the show airs in each successive time zone. So the team at Khataland got in touch with CoreCommerce, who runs their online store, and made some plans to handle the expected surge.

Those plans quickly involved CloudFlare.

CloudFlare works in cooperation with any webserver or platform to make sure websites are safe, fast, and available. There's no relationship required between CloudFlare and your host, but it doesn't hurt that CloudFlare and CoreCommerce serve several customers together. For instance, earlier this month, Benderbound enjoyed the combination to make sure their site was fast and available during a smaller TODAY Show appearance.

So, when Khataland asked CoreCommerce for help, they recommended CloudFlare.

Here's how Brandon Wanamaker, from the quality assurance team, put it:

We always do our best to provide top-tier service to our customers at the product and customer experience levels. CloudFlare allows us to multiply our efforts to speed up the software; reduces the merchant's expense by absorbing a very large majority of bandwidth usage; and protects higher profile, or otherwise unfortunate, targets of a denial of service attack and other malicious traffic. The more merchants on our system using CloudFlare, the faster and safer the CoreCommerce system is. Shoppers are less likely to abandon their shopping carts on a faster site. Merchants avoid huge bandwidth usage and possibly overages. Finally, it makes our lives a little easier when the system is running smoothly. It's changed how we handle stores featured on a national TV broadcast, with potential surge in traffic. We insist on CloudFlare to keep their stores and CoreCommerce running quickly, with no hiccups. With such huge exposure, downtime is not an option, and in every case, CloudFlare has never failed. And the setup is way too simple for something that does so much. Registration, a few clicks and you're done! I can't say enough good things about the experience the CoreCommerce team and our merchants have had working with CloudFlare.

The team at Khataland signed up for CloudFlare directly, changed their nameservers, and ordered CloudFlare Pro to secure transactions with Full SSL. Everything was in place in under an hour, letting the Khataland and CoreCommerce team focus on other preparations for making a whole bunch of brand-new customers happy.

Here's what Khataland shared:

We had huge interest from Today Show viewers. In the first hour after the show, we had more than 60,000 views and sold more than half of our special packages for the show. Our website remained up and functioning during this huge spike.

See the spike for yourself, starting in the largest viewership (Eastern Time) with each time zone providing another bump an hour later.

Brandon on the CoreCommerce team tweeted about the resources saved.

Here's a more graphical view from the CloudFlare dashboard, showing thesavings.

Surges in traffic come for many reasons beyond TV promotion, from the Halloween holiday, a pre-Christmas sale, or simply Groundhog Day (next week!). CloudFlare's ability to deliver information quickly to your visitors without overloading your webserver becomes dramatically important during these surges.

But a fast, always available, secure website is important every day, so sign up for CloudFlare now.

I wrote a post last week about Surviving Black Friday, the biggest offline shopping day of the year in the United States. However, the biggest online shopping day of the year in the United States is said to be the Monday after Thanksgiving, known as Cyber Monday. We've been gathering data on traffic to ecommerce sites on CloudFlare to answer the question: is Cyber Monday real? Here's what we've found.

CloudFlare provides a terrific platform for ecommerce sites. Today, more than 10,000 sites that we classify as "ecommerce" use CloudFlare to make sure they are fast and protected from a wide range of threats. Performance matters in online sales: Amazon.com found, for example, that for every 1/10th of a second they can shave off your page loading time, they see a 1% increase in revenue. Security is especially important for ecommerce, and sites like Amazon.com employ extensive security teams to ensure they are in compliance with their merchant bank requirements.

CloudFlare, it turns out, powers about 5x the total traffic of Amazon.com, including a number of ecommerce sites large and small. The average ecommerce site on CloudFlare sees about 7,000 page views per day and 1,950 unique visitors. We pulled data from these sites in order to see how traffic changed last Monday.

Cyber Monday lead to a significant increase in traffic to ecommerce sites from U.S.-based visitors. On average, ecommerce sites saw 45% increase in page views and a 12% increase in the number of unique visitors from U.S.-based visitors coming to their sites.

What about outside the U.S.? It turns out that while Cyber Monday is big in the U.S, it doesn't spill over to the rest of the world. Canada saw a relatively minor 4% increase in ecommerce traffic, which could be expected simply from spillovers of U.S. sales. Other parts of the world actually saw decreases in ecommerce traffic. The UK was down 5%, China was down 10%.

Overall, CloudFlare saw 100 million more page views on Cyber Monday than the previous Monday, which represented about a 12% increase across our network. And attackers didn't take Cyber Monday off to hit the sales. In fact, attacks directed at ecommerce sites were up about 15%.

Over the next few weeks, we'll continue to track traffic to ecommerce sites and report on whether Cyber Monday really is the busiest online shopping day of the year.

This is the story of two things that are deeply American: post-Thanksgiving shopping and scrappy entrepreneurs.

On the fourth Thursday in November, the United States celebrates Thanksgiving. The Friday after Thanksgiving, known as Black Friday, is considered the official start of the holiday shopping season. It is typically the busiest (offline) shopping day of the year. Shopping after Thanksgiving is so deeply engrained in American culture that in 1939 in the midst of the Great Depression, when Thanksgiving was scheduled to fall on the last day of the month, then-President Franklin D. Roosevelt moved the holiday up a week in order to get people out and spending more quickly.

Retailers today are attuned to this tradition and offer specials to lure customers to their stores. People literally will camp out for a week in front of some retailers in order to be the first in line when the stores open Friday morning. If you're reading this outside the United States and think it sounds crazy, rest assured that most of us here do as well. That said, suffice it to say that there is a high demand among many for the details of the Black Friday deals.

Just as American as shopping after Thanksgiving is the fact that if the market demands something, scrappy entrepreneurs will step up to meet that demand. In this case, the website 2011BlackFridayAds.com provides a one-stop resource to find out what all the biggest retailers will be offering. The site was created by Ty Price, who has been tracking Black Friday deals since 2008. This year, if you search Google for "Black Friday 2011," among the more than 71 million sites returned, Ty's is the first result.

Ty had been through this before and knew the amount of traffic to his site could spike significantly in the days leading up to Black Friday. So, in late September, he signed up for CloudFlare to help manage the coming load. Because 2011BlackFridayAds.com is hosted through MediaTemple, one of CloudFlare's hosting partners, setting up our service took literally two clicks and less than a minute. The graph below shows the growth in traffic over the last month, peaking in the last 24 hours at nearly 3 million page views a day (about 35 per second).

Turns out a lot of people want to see Black Friday deals, and we're proud to have helped ensure 2011BlackFridayAds.com stay up and running under crushing load. CloudFlare didn't just make the site safer and protect it from attacks, we also significantly reduced the load on the servers so they could keep up with visitors' requests. In fact, CloudFlare cut the number of requests that needed to be handled by the server by nearly half a billion, or about 75% of the total load it would have experienced without CloudFlare. We also saved the site more than 23 Terabytes, 93% of the bandwidth that would have otherwise been used serving the site's pages.

Any downtime experienced by a site is quickly punished by Google,meaning that even if you have an initially popular site, if you can't stay online you can't stay on top. CloudFlare helped 2011BlackFridayAds.com stay fast and reliable, even under a crushing load, and the effect has kept it at the top of the rankings and kept the traffic growing. Speed and reliability are the foundation of SEO.

As Ty just wrote me via email: "CloudFlare has done wonders for us this year. It's amazing how fast the site is." Helping ensure the sites of entrepreneurs like Ty could perform as well as the big companies' is why we — a scrappy group of entrepreneurs ourselves — built CloudFlare in the first place.

While Black Friday is the biggest offline retail shopping day, the Monday after Black Friday, a day now known as Cyber Monday, is reportedly the largest for online shopping. Everyone in the U.S. returns to work, still in a shopping mood, and takes any downtime at their desks to scour Internet retailers for gifts. If you're an online business, you literally can't afford to go down. And, if you're a eMerchant who finds yourself worried over the coming days that your site might fail, spend the few minutes it takes to sign up for CloudFlare. Our basic service is free (Ty uses the PRO version for$20/month), it doesn't require any technical skill to setup, and it will work regardless of your platform.

The biggest Internet retailer in the world is Amazon.com. As of today, CloudFlare powers 5x the traffic of Amazon. In other words, if you're worried about a crush of traffic to your website over the coming holiday season, we're here for you and happy to help.

For those camped out in front of a Walmart for Black Friday, stay warm and make sure to check 2011BlackFridayAds.com from your smart phone for a preview of the latest deals. For those watching from the sidelines, check back to these pages after Cyber Monday for reports on Internet traffic patterns we saw.

And, for those in the United States, have a very Happy Thanksgiving.