Cloudflare took down our website
An online casino’s account of Cloudflare abruptly disabling its site and demanding an immediate jump from a $250/month “business” plan to a $10,000/month enterprise contract has raised accusations of extortionate sales tactics and opaque Trust & Safety processes. Commenters debate whether Cloudflare was reasonably trying to manage legal and IP‑reputation risk—by pushing the customer to bring their own IP space—or abusing its dominant position and mixing compliance enforcement with quota-free, discretionary pricing. The episode is cited as a cautionary tale about vendor lock‑in, the fragility of relying on a single CDN/DNS provider, and the broader trend toward centralized infrastructure power on the internet.
Alleged incident & immediate reactions
- OP (online casino) reports Cloudflare moved them from a $250/mo “Business” plan toward a $10k/mo Enterprise plan with 24h pressure and then abruptly purged their account when they didn’t accept.
- Many readers describe the behavior as “shakedown/extortion-like,” especially the sequence “pay 120k upfront or lose service” with little specific explanation.
- Others say the story is one‑sided and likely omits key details; several are explicitly withholding judgment until Cloudflare responds.
Gambling, legality, and ToS
- OP’s business is a large online casino using multiple domains per jurisdiction/feature and acknowledges this “could arguably” violate Cloudflare’s ToS (e.g., domain rotation, regulatory workarounds).
- Some see the multi-domain setup as normal compliance and UX; others view it as regulatory evasion.
- Debate: if the site is shady or borderline illegal, is it acceptable for Cloudflare to keep them only on a high‑priced enterprise tier? Opinions split sharply.
Cloudflare’s possible motives (contested)
- One theory: casino traffic is damaging IP reputation and getting Cloudflare IPs blocked; CF wants them on BYOIP under Enterprise as a “quarantine,” which is costly to run.
- Counterpoint: if IP reputation is the real issue, Cloudflare should say that plainly and offer a clear, reasonably timed migration path rather than opaque sales pressure.
- Some argue this is simply “risk‑priced service” (more legal/reputational risk → higher tier); others insist conditioning ToS leniency on payment is tantamount to extortion.
Sales, Trust & Safety, and communication
- Many are disturbed that Trust & Safety concerns were relayed primarily via sales reps with quota, not legal/technical staff, and that communications were vague and hurried.
- Several report similar Cloudflare patterns: free/cheap tiers with “no limits,” then sudden, undocumented upgrade demands once traffic grows. Others say their Cloudflare enterprise experience was transparent and fair.
Broader lessons and meta‑discussion
- Strong consensus on: don’t put all eggs in one basket; keep DNS, CDN, and hosting separable where possible; maintain a tested exit plan and external config backups.
- Some now see Cloudflare as a serious business risk / “central point of failure,” others still see them as a technically strong but culturally sales‑driven company.
- Meta: multiple commenters noticed the HN thread being downranked quickly; moderators later confirmed flamewar/flag-based downweighting rather than Cloudflare influence.