Guys, OP is clearly joking, he uses Cloudflare himself:
dig NS huijzer.xyz +short
fay.ns.cloudflare.com.
gerardo.ns.cloudflare.com.Do not put your site behind Cloudflare if you don't need to
311–320 of 391 posts
Re: Do not put your site behind Cloudflare if you don't need to
#312Can't find the following argument in the replies: respect your visitors by not showing cloudflare's spinners and other bs in their faces.
If your site is static, a VPS would carry it a long way. I once hosted a tiny video site - 500 daily visitors, 100GB, 10$/month. Worked better than youtube, 0 issues.
Re: Do not put your site behind Cloudflare if you don't need to
#313Earlier quoted context omitted.
That’s like saying you should buy car insurance after you wreck your car
How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?
That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
Re: Do not put your site behind Cloudflare if you don't need to
#314Earlier quoted context omitted.
What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service
What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?
It's not a matter of time. And i dont want cloudflare to track me across many different sites, nor my website visitors.
Re: Do not put your site behind Cloudflare if you don't need to
#315Earlier quoted context omitted.
That’s like saying you should buy car insurance after you wreck your car
My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.
I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.
Re: Do not put your site behind Cloudflare if you don't need to
#316> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…
What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service
Usually when a small blog goes down it's not a DDoS, it's that a post has gone viral (e.g. hits the front page of HN), and it going down can absolutely cost a lot (depending on the goal of the blog)
Re: Do not put your site behind Cloudflare if you don't need to
#317Earlier quoted context omitted.
How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?
That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
Not if you live in a desert, which most blogs do.
Re: Do not put your site behind Cloudflare if you don't need to
#318I have a small blog with a few hundred visitors per month (not including the AI scrapers), and I use Cloudflare because it lets me run everything on a box in my home office with Cloudflare tunnel in the way and I don't have to worry about a static IP or anything. The best part about Cloudflare is how unintrusive it is. It's properly a layer over everything that you have.
I run my stuff as quadlets on Linux, and `cloudflared` just forwards requests to a specific port. It's a reverse proxy. If I wanted to move off Cloudflare, I'd need to run Nginx (or Traefik/Caddy which I'm less familiar with) + certbot and switch DNS.
I like this layering approach, and when I decided to move from a cheap VPS to my own homeserver, I found it very easy to do so by just swapping a few things. I do have Google Fiber who don't mind when you host stuff so that's nice.
Of all the cloud services that are a problem, I'd say Cloudflare is particularly well-designed as a non-lock-in service and is very generous with the terms. So I am quite happy putting Cloudflare in between.
After all, if I'm only receiving a few hundred visits a month, it's not that important if Cloudflare is down. It's not like I'm providing an essential service except to my wife, who relies on some of the apps I've made for her Custom GPTs[1] and she is quite the forgiving user.
0: https://wiki.roshangeorge.dev/w/One_Quick_Way_To_Host_A_WebA... a description of how I host, but mostly structured as a note to myself
1: https://wiki.roshangeorge.dev/w/Blog/2025-10-17/Custom_GPTs
Re: Do not put your site behind Cloudflare if you don't need to
#319Earlier quoted context omitted.
this is too naive sorry, Hetzner will disconnect (and ban you if DDoS is too long), same as OVH. It works mostly for brutal UDP flooding but sophisticated attacks such as swarm of Puppeteers hosted on infected machines by the millions will not be protected, those "new DDoS mode" are offered by most DDoS providers.
Cloudflare will disconnect you from their free plan just as quickly. Especially when you are facing "infected machines by the millions".
Except that Cloudflare is geared towards ddos protection - i.e. you can monitor, get alerts, turn on temporary protection, etc. It can do this because that's it's main business. It's not possible to have the same expectations from infra providers like Hetzner.
Re: Do not put your site behind Cloudflare if you don't need to
#320> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…
Also: AI scrapers. Which have already been documented to basically DDOS sites.