BREAKING: Cloudflare Lists Service Degraded 🟡 Workarounds Inside

Cloudflare Lists Service experiencing partial disruption. Immediate workarounds for indie hackers relying on WAF, firewall rules, and IP lists.

BREAKING: Cloudflare Lists Service Degraded 🟡

Status: Identified | Severity: Minor | Impact: Partial Disruption

---

What's Down & Who's Affected

Cloudflare's Lists Service is currently experiencing degraded performance. This affects:

WAF (Web Application Firewall) custom rules using IP lists, URL lists, or ASN lists

Firewall rules that reference managed or custom lists

API access to create, update, or deploy new lists

List-based blocking/allowing of traffic

Who's hit hardest: Projects with active firewall rules pinned to Cloudflare Lists, especially those filtering high traffic volumes or relying on real-time list updates.

If your site routes through Cloudflare without custom list rules: You're likely unaffected.

---

Immediate Workarounds (Do This NOW)

1. Failover to Static Rules

Convert dynamic list-based rules to static IP/domain blocks temporarily

Go to Firewall Rules → Export your current rules as reference

Manually rebuild critical rules without list dependencies

Priority: Block your top 10-20 threat sources by IP directly

2. Disable Non-Critical List Rules

Keep only essential blocking rules active

Temporarily disable:

- Rate-limiting rules using lists - Geographic blocking via lists - Custom reputation lists

Keep emergency security rules (DDoS, bot management) intact

3. Use Origin-Level Defense

Implement basic rate limiting at your origin (nginx, your app framework)

Deploy fail2ban or ModSecurity if running your own infrastructure

This buys you time while Cloudflare recovers

4. Monitor Queue Status

API requests to Lists endpoints may queue. Check: ``` GET https://api.cloudflare.com/client/v4/accounts/{account_id}/rules/lists ``` Expect delays—avoid retry loops. Set aggressive timeouts (5-10s max).

---

How to Check If You're Affected

1. Dashboard check: Firewall → Rules. Do your list-based rules show a warning icon or slow load times? 2. Traffic impact: Check your analytics. Seeing unexpected traffic spikes or blocks failing? 3. API test: Try updating a custom list via API. Getting 503 or timeout errors? 4. CLI test: ```bash curl -X GET "https://api.cloudflare.com/client/v4/accounts/YOUR_ACCOUNT_ID/rules/lists" \ -H "Authorization: Bearer YOUR_TOKEN" ``` Slow response = affected.

---

Alternative Tools to Consider

For immediate relief (not replacement):

Bunny CDN: Has native firewall rules without list service dependency

AWS WAF: Standalone WAF with IP set management (steeper learning curve)

Sucuri: Firewall-as-a-service with built-in rule engine

Origin-level: ModSecurity + local reputation databases

Note: These aren't drop-in replacements. Use for load distribution only.

---

Monitor Recovery

Check these sources:

1. Official: https://www.cloudflarestatus.com — refreshes every 1-2 minutes 2. Your dashboard: Firewall Rules section should show status improvements 3. Community: Check @Cloudflare on Twitter for updates 4. API health: Re-run the curl command above—response times should normalize

Expected recovery: Cloudflare typically resolves "Lists Service Degraded" within 2-4 hours. Once status shows "Operational," test rules before relying fully.

---

What NOT to Do

❌ Don't panic-disable all firewall rules ❌ Don't blast the API with retries ❌ Don't migrate mid-incident (creates new risks)

---

Stay calm. This is partial. Your sites stay online. Keep one eye on the status page and one eye on your origin metrics. We're through this together.

— SND Dev Team