Cloudflare had two separate incidents on 20 October 2026. The longer one hit Zero Trust connectivity and the Dashboard for 3h 14m starting at 03:20 UTC, and a shorter 41 minute issue later mislabelled verified bot traffic. Both faults sat on Cloudflare's side.
Started
03:20 UTC
Duration
Lasted 3h 14m
Source
IsDown
Next time
Cloudflare is degraded. Is your product working?
An incident on their side does not always mean an outage on yours, and the only way to know is to already be watching your own endpoints. Set that up in under a minute and you will be notified the next time your own site is affected. And there will be a next time.
50 monitors for your own websites. No card.
Affected components: Cloudflare Sites and Services, Bot Management, Dashboard, Zero Trust
What happened?
The first incident started at 03:20 UTC and ran for 3h 14m. Cloudflare said traffic through Cloudflare One Gateway failed specifically when an identity policy was present in the policy decision, affecting all onramps to that Gateway, while Gateway policies with no identity policy kept working. The Dashboard was also impacted, which Cloudflare noted was under investigation alongside the main issue. By 04:40 UTC Cloudflare said the issue was identified and a fix was being implemented, and by 04:44 UTC a fix was live and being monitored. Even so, at 05:46 UTC Cloudflare reported the Access API still had higher-than-normal error rates and increased latency, while edge functionality including Access logins and Secure Web Gateway connectivity was fully restored. The Access API issue was closed out at 06:14 UTC, with error rates and latency back to normal. That is six updates across 2h 54m of active work before full resolution at the 3h 14m mark. The second incident started at 19:35 UTC and lasted 41 minutes, with Cloudflare saying its Bot Management feature was incorrectly flagging a limited number of verified bots as automated traffic. Only one update was filed for that incident, so there is no detail on what caused the misclassification or how it was fixed. No user reports were filed during either window. Cloudflare's status page is the only source for both incidents; no post-mortem has been published for either.
Learning
UptimeRobot's own probes against Cloudflare's api-control, dns-1111 and edge-data components in the EU and NA regions stayed at 100% uptime over 24 hours and 7 days, and 99.996% over 30 days, with this incident not registered as a hit against them. That is not a contradiction. The failure Cloudflare described was conditional, it only showed up when an identity policy was present in a Gateway decision, and it hit the Access API and Dashboard rather than the basic edge paths that uptime checks typically hammer. A narrow policy-path bug like this can break real traffic for real users while every synthetic check that does not exercise that exact path comes back green. The bot management misclassification is the same shape at smaller scale, a logic error in how traffic gets categorised rather than a connectivity drop that any monitor would catch. If you run Zero Trust or Bot Management on Cloudflare, your own uptime checks on your endpoints will not show you this kind of fault because the problem lives inside Cloudflare's policy evaluation, not on the wire between you and them. Your monitoring covers your half, UptimeRobot now watches the provider's half too, so next time you know which side broke without guessing.
