An overload in computer usage caused Cloudflare's backup systems to fail, which brought down numerous ecommerce sites.

(Bloomberg)—CloudFlare Inc., an internet service meant to protect websites from going down, faced its own network issues on Tuesday, leading to several prominent sites, including those on Shopify’s ecommerce platform and blogging platform Medium, being unavailable for some time.

CloudFlare said it “experienced a global outage across our network that resulted in visitors to Cloudflare-proxied domains being shown 502 errors (“Bad Gateway”).” That stemmed from a single misconfigured rule within the Cloudflare Web Application Firewall during a routine deployment of new Cloudflare WAF Managed rules caused the outage.

The new rules were intended to improve Cloudflare’s ability to block attacks that could bring a website down by overloading it. However, rather than deploy a simulated testing mode that would enable it to identify and log false positives, one of its rules contained a regular expression that caused its system to become overwhelmed, leading to the 502 errors.

The “network performance issues” began around 9:50 a.m. in New York, just as social media users began complaining that sites around the internet weren’t working. Twenty minutes later, CloudFlare said it had made a fix and was monitoring the situation. It’s unclear just how many sites were hit, but the episode underscores how many services have come to rely on CloudFlare. The system works by effectively acting as a buffer between a website and the end user, making sure to block attacks that could bring a website down by overloading it.

“Internet infrastructure under attack again,” Shopify Chief Executive Officer Tobi Lutke tweeted, appending two angry-face emojis and a link to CloudFlare’s post about the outage. Shopify, which provides tools for people to sell online, said on its site that some of its users’ stores were down.

Matthew Prince, CEO of CloudFlare, said in a tweet that an overload in computer usage caused backup systems to fail and affect CloudFlare’s services. “No evidence yet attack related. Shut down service responsible for CPU spike and traffic back to normal levels. Digging in to root cause.” He later tweeted additional details.


Zak Stambor contributed to this story.