Live data from Hacker News

Requests dropped when using Cloudflare’s free tier for a commercial project

pawelurbanek.com

111–120 of 128 posts

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#111

One gotcha for CloudFlare is that I find they will serve CAPTCHA pages for asset requests (like JavaScript or CSS) which will break your site (obviously the user won't see the captcha when the browser was expecting JS or an image). To avoid this you need to turn the firewall and security feats to "Essentially Off" at least for asset requests (you can do this partial blocking via a page rule). That being said this doe…

Are you sure they didn't fix this? I remember getting those all the time, but haven't encountered one for several months now.

I would have to check the timeline but I was seeing this frequently with their IPFS gateway (as you can't control the security settings). It was a couple of months ago now so maybe it has been fixed recently.

I'm curious, do you know how it was fixed? Is it not serving a captcha for the second request on a connection or something? Or does it somehow figure out that asset requests are "safe"?

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#112

Earlier quoted context omitted.

Are you sure they didn't fix this? I remember getting those all the time, but haven't encountered one for several months now.

I would have to check the timeline but I was seeing this frequently with their IPFS gateway (as you can't control the security settings). It was a couple of months ago now so maybe it has been fixed recently. I'm curious, do you know how it was fixed? Is it not serving a captcha for the second request on a connection or something? Or does it somehow figure out that asset requests are "safe"?

My experience was with using Tor Browser to access websites using cloudflare.

I'd expect it to be based on the Accept request header (and possibly the Content-Type response header to prevent bypassing it). Or perhaps even the Content-Type of past requests to that url.

But I don't really understand what the purpose of these captcha checks is in the first place. Handling a captcha challenge is more expensive for the server than most GET requests. Perhaps it's done in anticipation of later POST requests (which can't be blocked transparently without breaking the functionality of the website).

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#113
post #92

Earlier quoted context omitted.

I basically have something similar to your use-case. While I'm on the free tier for all my domains, the supplemental agreement, at least in the US version, removes the specific limitation to serve primarily html/text content if you enable Cloudflare Workers, which also has a free tier, applies on an account and not domain level, and has no requirement for you to serve your content through their KV system. I ended up…

Video is really not allowed in the TOS for Cloudflare Workers either, see this discussion about the topic: https://community.cloudflare.com/t/cloudflare-workers-live-v...

Serving videos (cached or not) is only allowed by using Cloudflare Stream or as a part of Enterprise contract.

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#114

I have two domains with millions of requests a month and hundreads of GB of bandwidth, both of them work quite well even in free mode. However today and few days ago too it seems requests going through Cloudflare are just timing out. So we finally move to paid plan We're monitoring both endpoints (CF and the origin)

Do keep us updated, I also upgraded but i really dont know what benefits are there to pro plan, tried it before felt no difference.

For now I'd say

the advanced cache statistics (will help us reduce traffic sent to the S3 origin, in one case, and reduce bandwidth cost)

Traffic is served from the closest location to the user (instead of the bigger central locations, where they can serve traffic cheaper)

Plus paid suppport, for sure

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#115
There is a pretty big collection of Hungarian historical photos online, a bit more than a terabyte, well above 100K of them and the photos are on B2 with Cloudflare fronting it. There's many terabytes of traffic each month and it's on the free tier. Since the hosting costs are covered by yours truly, I can assure you the project couldn't possibly afford cloud storage traffic prices. We would need to store it on a VPS and all the problems that come with it -- disk size, availability, reliability etc. I am so grateful for B2-CF to do this.

Special kudos for allowing the -- very cheap, only $5 -- worker addon without forcing a paid plan.

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#116
As someone who has run a wide range of sites on Cloudflare for many years, I am certain this is bupkis.

1. Cloudflare doesn’t send 503 when they’re deliberately rate limiting; they send it when there’s an unexpected problem. It’s fairly rare, and it usually results in something being posted on cloudflarestatus.com if it persists.

2. Sometimes error rates are low enough or the conditions are obscure enough that you may have to contact support to point out that it’s happening. This is even rarer.

3. When you switch between plans, the IP addresses assigned to you may change, and users may hit different edges. If the issue is regional (as is usually the case), this may resolve it.

4. I have been sending tens of requests per second to a free plan over the course of several years and have never measured an increase in 503 responses on Cloudflare’s end compared to a paid plan.

5. Cloudflare’s response mentions specific 503 errors that are fairly rare; they’re notable because they look like a standard Nginx 503 page, rather than a nice Cloudflare error page. The only difference is that they will say “cloudflare” at the bottom where the Nginx version would normally be. You probably frequent sites that use Cloudflare free plans; how often do you see this error message?

6. What the hell is this n=1 correlation? It reads like a conspiracy theory. It is a conspiracy theory.

There are plenty of reasons to criticize Cloudflare, but this isn’t one of them.

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#118
Unpopular opinion - there's a lot of entitled people here and jumping to conspiracy.

There is no such thing as a free lunch [0] for people to depend a commercial service on. If your business model depends on another company providing you a free service perhaps you should reconsider.

This seems to be a person being cheap and jumping to conclusions, claiming broad assumptions and conjecture as fact.

Yes, cloudflare's free tier is deliberately dropping your requests to foil your freeloading commercial company - raise pitchforks!

Assuming this is all true (which I don't), I don't feel sympathy for the author for not purchasing a paid plan.

[0] https://en.wikipedia.org/wiki/There_ain%27t_no_such_thing_as...

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#119
post #3

I am talking internally with the customer support team about what happened to this customer's traffic. It is definitively not the case that doing "four requests per minute" gets you rate limited.

I’d look into idle connection handling, I’ve had problems in the past with cloudflare and it’s long open sockets to origin being quietly closed at origin, breaking requests to cloudflare.

Re: Requests dropped when using Cloudflare’s free tier for a commercial project

#120
post #68

Earlier quoted context omitted.

Like I wrote, for some integrations it is not possible to gather all the logs. Also how will you know that a client accessing your website in a browser gets 503 instead of your web page?

You don't, but your monitors will show the 503 happening, how often, on which endpoint operation and in which regions; that will give you a pretty good picture of whether is actually your CDN layer or something else triggering the 503

What if it's a specific browser with a specific TLS stack, or something weird?
Post reply on HN