The “hotline” on the front end of the Cloudflare website, is a call to action to drive new clients to use Cloudflare’s services.
What does "Under Attack" mode actually do?
When you flip that switch in your dashboard, Cloudflare puts up what's called a “Managed Challenge” page. This is an interstitial screen that every single visitor has to pass through before they can reach your site; a "click here if you're human" checkpoint.
A DDoS (Distributed Denial of Service) attack works by flooding your server with massive amounts of fake traffic from bots. The goal is to overwhelm your server until it crawls to a halt and stops responding to real visitors entirely.
When “Under Attack Mode” is on, that challenge page sits at the network level which means that the traffic hits Cloudflare's servers, not yours. Every connection that can't pass the human check gets stopped right there and your hosting server never sees the flood. The attack is still technically happening, but Cloudflare is absorbing it at the edge so your site stays up.
Cloudflare is upfront that this is a last resort. It does temporarily affect your site analytics, and real human visitors will see that interstitial page before they can get through. That's a friction cost worth paying when the alternative is your server going completely offline, but it's definitely not something you'd want running all the time.
What is "WeWatchYourWebsite"?
WeWatchYourWebsite takes a different approach to website security. It monitors activity associated with the website itself, rather than focusing on traffic at the network edge. That includes external traffic, website files, databases, and logs, looking for signs of malicious behavior.
That distinction is vital because an attack doesn't end when the malicious traffic reaches your site. From there an attacker may exploit a vulnerability in your site's code, add or modify files, inject malicious content into a database, or even establish a way to return later. WeWatchYourWebsite is designed to detect precisely those changes and investigate how the compromise happened.
However, detection isn't where this process stops. WeWatchYourWebsite can automatically remove malicious code it has detected and notify the user about what was found, what was remedied, and what may need further attention.
For example, its file-integrity monitoring checks for additions and changes. It automatically scans any files it detects as changed for malware.
In other words, Cloudflare and WeWatchYourWebsite address different parts of the security picture. Cloudflare's "Under Attack Mode" helps protect the site from hostile traffic at the edge. On the other hand, WeWatchYourWebsite monitors what's happening within and around the website itself and can take action when malicious activity results in a compromise.
How do they differentiate?
The clearest way to see why these tools aren't interchangeable is to run each one through two common failure scenarios.
Scenario 1: A sudden flood of malicious traffic
A coordinated botnet targets your domain. The volume of fake requests starts overwhelming your server infrastructure.
Cloudflare's response: this is exactly what Under Attack Mode is built for. You flip the switch, the Managed Challenge goes up at the network level, and the flood gets absorbed before it reaches your server. This way, legitimate visitors can still access your website, while automated traffic doesn't.
WeWatchYourWebsite's response: The monitoring it provides can analyze traffic and other server-level signals for malicious behavior, while also watching your files, databases, and logs for evidence that your site has been compromised. When it identifies malicious code, it can automatically remove it rather than simply notifying you that something is wrong.
Scenario 2: An attacker gets past the front door
Not every security incident looks like a traffic flood. An attacker may exploit a vulnerable plugin or another weakness and successfully modify files or introduce malicious code.
Cloudflare's response: Under Attack Mode isn't designed to detect or clean malicious files from your website after a successful compromise.
WeWatchYourWebsite's response: This is where file, database, log, and malware monitoring become important. Changes can be examined for malicious behavior, and detected malware can be automatically removed. WeWatchYourWebsite also analyzes logs and other information to determine how the compromise occurred.
The two approaches therefore aren't interchangeable. One helps protect the path to your website; the other helps identify and remediate what happens when malicious activity reaches the website itself.
So, is this overkill? No, but here’s what is
Relying on only one of them creates a real single point of failure. We recommend using both at their appropriate time of need.
Think of it like protecting a physical retail store. Cloudflare is the security guard at the front gate. When a crowd rushes the doors, the guard stops them from breaking the glass and pouring in.
On the other hand, WeWatchYourWebsite is the security team inside the building. It monitors what's happening, looking for signs of intrusion, and taking action when something malicious gets through.
Using both can provide broader coverage because they address different parts of the security picture. Whether you need both depends on your site's infrastructure, existing security controls, and the risks you're trying to address.
However, overkill can be real, but it typically comes from unnecessary redundancy within a single layer. Running three uptime monitors that all check the same endpoint or stacking multiple web application firewalls that inspect the same requests often adds cost and complexity without providing much additional protection. That's where you start paying for the same coverage twice.
Cloudflare and WeWatchYourWebsite sit on different layers and watch for different failures, so combining them lets them work in unison, each covering the gap the other can't see.
Building your full coverage, one layer at a time
Cloudflare and WeWatchYourWebsite aren't competing tools fighting for the same job; they address different parts of a security setup. One guards the gate, the other watches the inside. Using both can help close the gaps between those layers.
If you're not sure whether Under Attack Mode is configured correctly, or you don't have monitoring in place yet, that's exactly the kind of setup you can ask about during our Office Hours livestreams. Come join us every Thursday at 2 p.m. EST and we can walk through with you, no guesswork required.
FAQS
Does "Under Attack" mode hurt my SEO or scare off real visitors?
It can add friction, which is why Cloudflare frames it as a last resort rather than a default setting. The Managed Challenge page is a small speed bump for a real visitor, not a blocker, but it does mean an extra click before they reach your site, and it can temporarily skew your analytics while it's active. The tradeoff is worth it during an actual attack; it's not something you'd want running permanently.
How do I know when it's safe to turn Under Attack Mode back off?
Watch your traffic patterns in the Cloudflare dashboard. Once the flood of suspicious requests drops back to normal levels and your site's performance stabilizes, you can switch it off. If you're not sure how to read those patterns, the Office Hours community can help you make that call so you're not leaving the challenge page up longer than necessary.
Will I know if my site goes down without monitoring in place?
Only if a customer tells you or you find the issue yourself on the live site. Without active monitoring, there's no automatic alert when your site throws an error or goes offline. You could be losing visitors for hours before you find out. Monitoring closes that gap by notifying your team the moment something stops working.
Not really. Both Cloudflare and website monitoring platforms are designed to handle the complex stuff in the background. You don't need to understand the technical details to benefit from them. You just need to know when to turn them on and what the alerts mean, which is exactly what the Office Hours community is here to help with.
