In mid-to-late June 2026, Read the Docs absorbed the largest attack in its history: 5.5 million requests per minute at peak against a normal daily peak under 100,000, sustained for nearly ten days, against a small ops team running on Cloudflare. This is the write-up of what failed and what actually held.

The attack was deliberately built around the defenses it expected:

  • Millions of unique IPs across hundreds of ASNs, mixing residential blocks with hosting providers — breaking per-colo rate limiting
  • Systematically randomised HTTP headers and TLS parameters, which made JA3/JA4 fingerprinting useless
  • Cache evasion by design: random 404 paths and uncached 302 redirects served by the Python backend instead of the edge
  • Adaptive rotation of target paths and IP pools whenever a rule landed
  • A “yo-yo” pattern — ramp until the rate-limit threshold shows, then back off — designed to maximise autoscaling spend

What worked, roughly in order of impact:

  • Move uncached work to the edge. The first page came from uncached redirects; they were served by Cloudflare within about 30 minutes.
  • The “penalty box.” Rate-limit fingerprints, ASNs and domains that generate too many non-200 responses. Legitimate readers and well-behaved bots almost always get cached 200s, so redirects and 404s are a cheap signal — this made the biggest difference automatically.
  • Cache everything, including 404s and temporary redirects, even for a few minutes. The fastest request is the one the CDN answers.
  • Targeted JS challenges instead of “Under Attack Mode” for all visitors, which would have broken every API integration.
  • Keep an escape hatch — hard blocks are rare, and solving one challenge buys about a day of clean access.
  • Manage edge and WAF rules in Terraform, so complex changes could be reviewed and rolled out under pressure.

What did not: IP blocking against proxy networks, header and TLS fingerprinting against randomised clients, protocol-inconsistency checks (the attack was all HTTP/2 and HTTP/3), and Cloudflare’s automated botnet mitigation, which let a large share of traffic through to origin.

The transferable lesson is that any endpoint more expensive than a cache hit will be found and used — the attackers knew which paths bypassed caching and kept probing for more. The strategic one is less comfortable: with AI tooling and proxy networks making this cheap, sustained floods are becoming baseline reality for public services rather than an enterprise-only event. The team calls the current quiet an “extended reprieve,” not a resolution.