What You Got Left

The day the internet stopped

Imagine you have an early morning flight. You packed your bags two days earlier, verified that your liquids meet the 3-1-1 standard, and your TSA PreCheck is active. You arrive at the airport two hours early, sit by your gate, and you don't get in line until your boarding group is called. You make it to the front of the line, smile when you hand the gate agent your boarding pass, knowing what is between you and your flight is a front line agent, and...

He says no.

You ask why. You inquire about the validity of your boarding pass, even though you know it's fine. You look around him and see the plane parked outside, pilots onboard, and flight attendants ready. His answer is still no. You turn around, looking for someone in leadership. You see them, but another gate agent blocks your path and tells you no. You turn to your right, and see a coffee shop. This is too much, and it calls for caffeine. Another gate agent appears and tells you no. You're surrounded by gate agents, and they all say the same thing:

No.

You did everything you were supposed to do. You had everything in place. But you were still denied access to the plane, and now most of the airport is also blocked.

Now imagine that happening to the majority of the people on the internet. That's how many of us felt on November 18th, 2025.

You may not have heard of the company Cloudflare, but you use it every day without knowing it. Here's what they do and how their solution works.

When you open an app or visit a website, your request doesn't go directly to the company that owns the service. It first passes through a middle layer. Cloudflare is that middle layer for a significant portion of the internet. About one in five websites sit behind it.

The middle layer is present for protection and speed. Cloudflare stands between you and the website or app like a security team at the front door. It's their job to verify that you're a real person and not a bot, which is software that abuses websites. They block countless floods of malicious traffic daily, while allowing you to get to your requested page faster by serving it to you at a location closest to you. If you've ever used sites like Shopify, ChatGPT, Spotify, and X (formerly Twitter), then you've experienced Cloudflare.

Those websites pay Cloudflare so they don't have to build all the security and redundancy themselves. While you never see it, sign up for it, or think about it, it works. And it does it quietly, in the middle of everything, so that you can get to virtually anything.

That's what makes what happened to Cloudflare on November 18th matter. When the middle layer fails, it doesn't matter that the websites are operational. You can't get on the plane because the gate agent is causing the jam.

Everything went wrong trying to do one thing right

Cloudflare has a database that can be likened to an internal records office. It holds raw data about bot behavior on the internet: what attack traffic looks like and which signals matter. It sits in Cloudflare's back office, not in the path of web traffic. That's important to know, because your request to get to Spotify never touches this database directly.

There is also a file: a report generated from that database. Every five minutes, a program asks the database a set of questions and writes the answers into one compact file. Think of this as a fresh briefing: "here's what bot traffic looks like right now, and this is what you should be monitoring." That file is the courier between the back office and the front lines.

The software is the front line. It runs on every Cloudflare server around the world, and this is what sits directly in the path of traffic. Every request to every website sitting behind Cloudflare must first pass through it. It reads the briefing sheet, holds it in memory, and uses it to score each request: this is a bot, so it's denied; this is a person, so you're granted access.

So the relationship flow looks like this: database → file → software. The database knows things. The file carries what the database knows. The software acts on what the file carries.

Congratulations. You're now a cybersecurity expert. Now let's use that expertise to go through what went wrong that day.

Cloudflare engineers made a routine change to the database to enhance Cloudflare's protection capabilities. Unfortunately, that change caused an unforeseen error: the program wrote each line in the file twice. That doubled the file size.

The software is designed for speed and efficiency, so it sets aside a fixed amount of memory for the file. That is a deliberate safety and performance choice. When the file was double its intended size, the software didn't skip the extra. It hit its limit and stopped entirely, because that is what it was supposed to do. But because all traffic flows through that software, when it stopped, everything behind it became unreachable. In other words, a change in the records office made the briefing sheet twice as thick, and the guard at the door was built to stop working rather than work from a bad sheet.

The hard limit that caused the crash was itself a protective decision. Cloudflare built the software to fail rather than run on data it couldn't trust. Even the crash was the system trying to be safe. Protection stacked on protection, and there was still failure.

Request unfulfilled

This is what it meant practically. For close to six hours, some of the most popular websites and services in the world couldn't be reached.

• X wouldn't load for most users. It showed an "internal service error" pointing at Cloudflare.
• ChatGPT was down. Millions of daily-workflow users were locked out, and OpenAI (the company that owns ChatGPT) had a status page blaming its third-party provider. Anthropic's Claude was also impacted.
• Spotify couldn't stream.
• People couldn't work: designers were unable to use Canva and Figma, corporations couldn't access Dropbox, traders couldn't use Coinbase, and job hunters couldn't access Indeed.
• McDonald's self-order kiosks were impacted.
• Downdetector, the website where people go to see if websites are operational, also couldn't be viewed. The place to go to see if something was down was down.

Most of these sites had Cloudflare-branded error pages. This means that the unfulfilled requests and outages had a face and a name. If you hadn't heard of Cloudflare, you did now, and your first impression was that it wasn't working. The errors that were presented are known as 5xx errors, which means the website's server failed to fulfill a valid request. It's not that your request was wrong; it's just the entity responsible for granting it couldn't.

Cloudflare owned the disruption and didn't shift blame. Cloudflare's CEO told the public, "We know we let you down today." Cloudflare had good intentions, had layered protection, and earned the trust of the bulk of the internet.

But they still failed. You can plan to do everything right and still get everything wrong.

Request fulfilled

I'm not bashing Cloudflare; I'm a customer of theirs as well. I've worked at organizations that have had their own disruptions. But there's a somber lesson in all of this: things built by people will eventually fail, whether or not someone does something wrong. And so will the people who love you.

The thing about love is that it is shown in power. I tell my daughters that I love them, but I show them in power. If they're hungry, I use the power I have to feed them. If they're scared, I use the power I have to protect them. If they're unsure of themselves, I use the power I have to remind them of who they are.

But my power has limits. While I can give them medicine, I can't heal them when they're sick. When they're at school, I can't be there with them. And if I'm honest, there have been times when they needed me to be patient and I was agitated. Like Cloudflare, people depended on me and I failed them, even when I did my best.

Dear reader and fellow maker, will you be honest? You've failed, too. Someone had a request for you that you couldn't fulfill. You've given a 5xx error code, too. The request was valid, so nothing was wrong with what was asked. It's that the one asked couldn't deliver. You may have loved the requester, you may have loved to grant the request, but your power wouldn't let you.

Only Jesus has power that can match His love.

Colossians 1:15-17 CSB
He is the image of the invisible God, the firstborn over all creation. For everything was created by him, in heaven and on earth, the visible and the invisible, whether thrones or dominions or rulers or authorities—all things have been created through him and for him. He is before all things, and by him all things hold together.

A significant chunk of the internet runs on Cloudflare, and things fell apart when they couldn't deliver. But in Christ Jesus, "all things hold together." Even with all the brokenness in the world, the Son of God is holding things together for Him to return. I was diagnosed with Crohn's Disease when I was 18. The symptoms started when I was almost 400 miles away from my support system (my mom and grandparents), but it was Christ who kept me. It is because of Christ that I am in remission. My mom lost her husband before Christmas in 2025, which meant that we had to face our first Christmas, our first New Year, my mom's first birthday, and countless other holidays without the man who received me as his son. It has been tough, we have broken down, but it was Christ Who kept us.

This is not saying that everything is fine in the world. We know it's not. But it is saying that God is a helper who is always found in times of trouble (Psalm 46:1).

Part of Intentional Compound Creativity is not just intentionally using and learning from what you've accomplished. The larger part, however, is consistently trusting in the Creator Who never fails. Cloudflare caused the internet to have 5xx errors saying that valid requests couldn't be fulfilled. But this is said of Christ:

2 Corinthians 1:20 CSB
For every one of God's promises is "Yes" in him. Therefore, through him we also say "Amen" to the glory of God.

Every request made to the Father in Jesus' Name is yes. Every request is fulfilled in Him, whether it is on this side of glory or the other. Either way, they are not denied. When life denies you, remember what you got left. Or maybe I should say Who never leaves you.

Jesus.

Receipts

1. Cloudflare outage on November 18, 2025. Matthew Prince, CEO, Cloudflare. Official postmortem, published 2025-11-18.
2. Cloudflare global outage, November 2025. ilert, citing W3Techs. Accessed 2026-08-10.
3. X down for thousands amid Cloudflare outage. The Hill, via AOL. Published 2025-11-18.
4. Cloudflare outage: what happened and what it means. Leanware. Accessed 2026-08-10.
5. Cloudflare outage November 18, 2025. Pinggy. Accessed 2026-08-10.
6. The Cloudflare outage explained. Training Camp. Accessed 2026-08-10.