The use case: how Hack The Box deploys Cloudflare WAF
Hack The Box uses Cloudflare WAF alongside DDoS mitigation, Rate Limiting and Bot Management to protect its cybersecurity training platform's applications and APIs. The WAF's rulesets let the team block malicious traffic without interfering with legitimate users.
Figures in the source
Figures published in Cloudflare WAF’s case study. They are not independently measured by usedby.
Cloudflare global CDN and edge caching cut page load times for cached assets by 30% to 45% on average
Workers held a 99.85% request success rate
The platform processes approximately 25 million requests monthly through Workers
Hack the Box supports a rapidly growing workforce of 300+ employees across Europe, the U.S., and Asia Pacific.
In the customer’s words
Cloudflare's platform could scale seamlessly alongside growth in traffic, users, and attack surface without introducing additional operational complexityOther companies using Cloudflare WAF
Customers across industries, with public evidence.
CalienteConfirmed
CrazyGamesConfirmed
Olive YoungConfirmed
VFS GlobalConfirmed
CapacityDeclared
HalcyonDeclaredGo straight to the source
Based on Cloudflare WAF’s published case study. We check the public evidence; the results are reported by the vendor.
cloudflare.com- Last checked
- Nov 12, 2026
Open source capture What the story claims, and what we checked
What we compared with the page.
- The passage quoted aboveChecked
Copied word for word from the page, near the name of Hack The Box.
- Hack The Box uses Cloudflare WAFChecked
Confirmed line.
- The result itselfNot checked
We quote it; we did not measure it.
Cloudflare's DDoS mitigation runs automatically, with no manual activation required. During coordinated attacks and sudden traffic spikes, Cloudflare absorbs the load without the team having to intervene. WAF gives them precise control over rulesets, so they can stop what needs stopping without interfering with legitimate users in the process.