Security Level

In the Cloudflare dashboard, security level has the value Always protected and you cannot change this setting. To turn Under Attack mode on or off, use the separate toggle.

In the API and in Terraform, use security level to turn Under Attack mode on or off.

Cloudflare's Under Attack mode performs additional security checks to help mitigate layer 7 DDoS attacks.

When you select I'm Under Attack!, which enables Under Attack mode, Cloudflare will present a JS challenge page.

Warning

Only use Under Attack mode when a website is under a DDoS attack. Under Attack mode may affect some actions on your domain, such as your API traffic.

To set a custom security level for your API or any other part of your domain, create a configuration rule.

Threat score

Previously, a threat score represented a Cloudflare threat score from 0–100, where 0 indicates low risk. Now, the threat score is always 0 (zero).

Recommendation

Currently we do not recommend creating rules based on the threat score, since this score is no longer being populated.

---