Understanding the Recent DDoS Attack Against Read the Docs

In June 2026, Read the Docs endured its largest DDoS attack, peaking at 5.5 million requests per minute—about 100 times normal traffic—and lasting nearly ten days. The attack was globally distributed, used millions of unique IPs, randomized HTTP headers and TLS parameters, and targeted cache-miss URLs and Nginx redirects to bypass Cloudflare’s automated defenses and rate-limit rules. The incident exposed limitations in IP-based rate limiting and highlighted the need for more adaptive, multi-layered mitigation strategies.