CloudFlare Pages&#x2F; Workers is pretty nice

I&#x27;ve always been a fan of cloudflare or firebase for static sites.

I use AWS, S3, Cloudfront, ACM with a budget alert.

Depending on your use case, Hetzner is as cheap as it gets while retaining high quality.

Just something to keep in mind: this also has about half of additional bandwidth costs (above 100GB) of the reddit post, so in your case you&#x27;d be billed for ~$57k or so with similar DDOS. At least they seem to provide monitoring&#x2F;alerts based on their Security page.

Keep in mind that according to their forum you&#x27;ll be charged $30&#x2F;100GB for bandwidth over free allowance of 100GB:<a href="https:&#x2F;&#x2F;community.render.com&#x2F;t&#x2F;confused-about-the-free-tier&#x2F;19092" rel="nofollow">https:&#x2F;&#x2F;community.render.com&#x2F;t&#x2F;confused-about-the-free-tier&#x2F;...</a>&gt; Exceeding allotted Bandwidth does result in automatic overage charges. $30 for additional 100 GB blocks.So the same shady pracrice as on Netlify.

&gt; used to use s3 for the longest time, but aside from costing a nominal fee, it&#x27;s so unnecessarily complicated in this day and ageits like 10 minutes of setup tops to host on s3

<a href="https:&#x2F;&#x2F;render.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;render.com&#x2F;</a> is free for static sites with custom domain support and SSL included. been happy so far!used to use s3 for the longest time, but aside from costing a nominal fee, it&#x27;s so unnecessarily complicated in this day and age.

Looks nice but then so does Netlify at face level! Seems like it is pay as you go, and there is a settable max spend per month.Does their ddos protection work differently than Netlify and could Bunny ever pull the same stunt with billing?

Love Bunny too, wonderful service and great team. I wish there&#x27;d be an easy way to set up auto-deploy to Bunny Edge Storage on GitHub commit (to avoid doing so manually), but I guess it&#x27;s not to hard to do through GitHub Actions.

I switched from Bunny to BlazingCDN, with same performance...
1000TB - $0.0025 per Gb
And the support helps a lot, they even made the config for Asia for free<a href="https:&#x2F;&#x2F;blazingcdn.com&#x2F;pricing&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blazingcdn.com&#x2F;pricing&#x2F;</a>

I use BunnyCDN to host several sites, they have a minimum cost of $1 per month and I usually pay $1 per month.I run my sites [0] on Hugo and copy the generated sites (Makefile) to BunnyCDN with their command line tool.It&#x27;s a plain CDN, but does include DNS hosting for easy SSL certificates and has scriptable DNS [1] where you can run Javascript for dynamic DNS.I went with them b&#x2F;c they are in the EU, but I&#x27;ve stayed because I love them.[0] e.g. <a href="https:&#x2F;&#x2F;www.amazingcto.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.amazingcto.com&#x2F;</a>[1] <a href="https:&#x2F;&#x2F;bunny.net&#x2F;dns&#x2F;" rel="nofollow">https:&#x2F;&#x2F;bunny.net&#x2F;dns&#x2F;</a>

If it’s really pure static, github is great because it’s impossible for you to be billed. If you want some functions, Cloudflare free plan is nice because you can configure it to stop operating when the usage limit is reached, or pay $5 a month for more than you’ll likely ever need for a hobby project. Also bandwidth is free.

You typically can&#x27;t replace Netlify with Cloudflare. You need something like Github actions with some storage, S3 or something and then one can put Cloudflare in front of it all for caching, DDOS protection and so on.

Cloudflare. You will get a call if on a free or pro ($25&#x2F;month) plan [1] if your bandwidth usage is so high it would warrant increasing your plan. Worst case, they turn you off. Preferred over denial of money attack based on your use case. Set and forget after pointing at your origin (time is money).You&#x27;ll get a call on any of their plans if your bandwidth usage exceeds certain thresholds, I am assuming your median usage is relatively tame.Disclosure: Cloudflare enterprise customer, no other affiliation. I don&#x27;t get anything for saying nice things.[1] <a href="https:&#x2F;&#x2F;www.cloudflare.com&#x2F;plans&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cloudflare.com&#x2F;plans&#x2F;</a>

I&#x27;m hosting a few large (multiple TB) projects on Cloudflare R2 with no issues for more than a year now. Super happy.

Hetzner or DigitalOcean with Coolify [0] works great, it&#x27;s like an open source Heroku that runs on any host, you get git push to deploy, and a bunch of other features built in. It only works on one machine at a time though so it&#x27;s not like a CDN but for small sites, it&#x27;s great.[0] <a href="https:&#x2F;&#x2F;coolify.io" rel="nofollow">https:&#x2F;&#x2F;coolify.io</a>

I mean you gotta put your server somewhere (I guess hosting it on your connection?)

But you need a static IP, stable internet, UPS, and permission from your wife to have a 24&#x2F;7 powered noisy box in a room

Having built serverless apps and &quot;old-fashioned&quot; apps, I seriously believe the old fashioned way is better.The best of both worlds is to host on AWS EC2 or a similar product from your web service provider of choice.

For less than 1% of OP&#x27;s monthly bill, you can build or obtain a more-than-enough server, drop your static files on it, and serve through nginx. And you get to keep it forever; there&#x27;s no monthly subscription fee!Seriously, maybe I&#x27;m just old, but I look at the pricing of these hip and modern SaaS products for dead simple software and I cannot believe my eyes. The &quot;old fashioned way&quot; works just fine (and has always worked just fine) and is orders of magnitude cheaper.

For static sites my choice is usually CloudFlare in front of a S3 bucket. It costs pennies. With cloudflare R2 it might be even easier.

Hetzner VPS + nginx works fine and goes a looong way. Alternatively, SourceHut pages or GitHub pages is okay too.If it’s been a while since you did any server work: <a href="https:&#x2F;&#x2F;www.dannyvankooten.com&#x2F;blog&#x2F;2024&#x2F;static-site-hosting-vps&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.dannyvankooten.com&#x2F;blog&#x2F;2024&#x2F;static-site-hosting...</a>

For personal servers you can use the dynamic DNS feature on your modem in combination with Cloudflare if you like doing it at home, if it&#x27;s for your business you can see if you can afford the €2 per month for Hetzner managed hosting or your local equivalent.

I just migrated some projects to Cloudflare Pages for the time being.

So if I want to migrate off of netlify to something better, where?

Exactly. I think this also might be a reason why they didn&#x27;t implement ddos protection on this level. So, they can grab as much as they can.

You just posted it on Reddit and I already see few comments of people say they will never use it. Stuff like this can cause PR damage worth millions to a company. I&#x27;m pretty sure that it will go viral and they won&#x27;t charge you.

Our AWS TAM says they don’t do this anymore, and we spend tens of millions of dollars with them annually. n=1, ymmv

That’s not because hosting instances doesn’t actually cost Amazon anythingExcept it doesn&#x27;t cost them anything. The marginal cost of keeping your single instance running is $0 (unless they were 100% out of capacity and they could have sold that instance to someone else either at full price or spot price)

I would say it is a scam, because you can&#x27;t set a budget limit.

AWS support, for example, tends to be really good about waiving charges for things that are clearly your mistake, like an unused instance that you forgot to turn off for a couple months.This is an admission that their UX sucks and makes it hard to know what state your account is in and what you&#x27;re paying for. They waive the fees because a few high profile cases of people paying thousands due to the AWS console being awful would drive a lot of customers away.

Eh, I wouldn’t say that’s necessarily the case. AWS support, for example, tends to be really good about waiving charges for things that are clearly your mistake, like an unused instance that you forgot to turn off for a couple months. That’s not because hosting instances doesn’t actually cost Amazon anything! It’s because they want to keep you as a customer even if it loses them a bit of money right now.In the Netlify case, though, insisting that this person still pay 5% is downright insulting. I’m sure they’re taking a hit already - just waive the whole thing.

If the attacker downloaded the 3,44mb audio file that OP mentioned, aren&#x27;t we talking about outgoing traffic?

Especially since they admit it was a DDoS attack. What I find outrageous is first that they charge for incomming traffic (which is often free with other providers), but also 55$ per 100GB. For comparisson, Hetzner charges you 1€ per 1TB of outgoing traffic while incoming is free.

&gt; they don&#x27;t trade bandwidth as a commodityI really don&#x27;t get your point. If you&#x27;re a hosting provider, the very thing you&#x27;re selling is bandwidth (and disk space). Everything else is a value added service.

&gt;it shows how disconnected this is from their real bandwidth costIt&#x27;s a value added service, they don&#x27;t trade bandwidth as a commodity. Therefore unfair characterisation.Plus, if you dive deeper: Bandwidth doesn&#x27;t cost anything because bandwidth is just about pulsing some light in some glass fiber and applying some minuscule voltage on some metal fiber.Okay, maybe it costs some amount of electricity but all this is just a business model for paying on capital expenditure through time share arrangements. People can have all kind of models for this, for example you can come together with others or pay it all by yourself to install the equipment and have free bandwidth for the lifetime of the equipment.It&#x27;s all just arrangements to cover the capital investment and earn something on top of it. That&#x27;s not a scam. A scam would be if they didn&#x27;t account correctly for the timeshare usage or induce usage to boost payments.

It wouldn’t be possible for them. Netlify doesn’t own transit, so AWS needs to get their fat cut even if Netlify waives their fatter cut.

no, they charge 6x according to that table. Because they are using aws

They overcharge egress by about 500x <a href="https:&#x2F;&#x2F;getdeploying.com&#x2F;reference&#x2F;data-egress" rel="nofollow">https:&#x2F;&#x2F;getdeploying.com&#x2F;reference&#x2F;data-egress</a>.So even a reduction to 0.2% would habe been possible. Honestly don&#x27;t understand why anyone feels comfortable overpaying so much. Especially when there is no configurable spending limit.

FYI: From my experience, if you do more the 20-25TB, you can get 75% off no questions asked.

Some quick back of napkin math says 190TB would cost about $12k in AWS cloudfront costs.

&gt; And since my amount is too large, they offer to discount to 5%, which means I still need to pay 5 thousand dollars.If they just reduce to 5% like that, it shows how disconnected this is from their real bandwidth cost. Really does feel like a scam.

They can discount to 5% since their fees are 10,000% higher than what it&#x27;s costing them...

That discount to 5% is incredibly odd and hand wavy, I would escalate to their manager.They should definitely be able to accomodate and account for what should be a very common issue (does).

Doesn&#x27;t Netlify have budget alerts?I know during heavy DDoS attacks they might be too late, but also cache?

Id recommend avoiding Vercel like the plague. Their entire business model is poorly aligned with your interests as a customer.

Why? If you use Vercel in the Free Tier you cannot automatically go to the Pro tier.You need to manually upgrade.Unless you need more than the Free-Tier Vercel should be fine.

Vercel has spend management controls, setting limits and SMS alerting: <a href="https:&#x2F;&#x2F;vercel.com&#x2F;blog&#x2F;introducing-spend-management-realtime-usage-alerts-sms-notifications" rel="nofollow">https:&#x2F;&#x2F;vercel.com&#x2F;blog&#x2F;introducing-spend-management-realtim...</a>

Doesn&#x27;t make me feel great about Vercel either (which I was looking at)

That sounds like a company that is happy to ignore customer pain. Agree, default-on telemetry that cannot fully be disabled is a red flag that on their side, the people with development experience have no say.

This seems like a lot of brouhaha about nothing. They just recorded the fact that a user opted out of telemetry, they didn&#x27;t stealthily send telemetry against user wishes.They removed this call in the meantime [0].[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;cli&#x2F;pull&#x2F;740&#x2F;files">https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;cli&#x2F;pull&#x2F;740&#x2F;files</a>

There are lots of reasons to avoid Netlify.<a href="https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;cli&#x2F;issues&#x2F;739">https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;cli&#x2F;issues&#x2F;739</a>

Woof. I was considering kicking the tires on Netlify, but they are officially out of consideration now.

The primary purpose of these services is to be able to scale up and continue working under heavy load, shutting the site down when this occurs would defeat the entire purpose of the service. I would say that they are transparent about both of the things you have listed by virtue of being one of those scaling serverless hosting services.

&gt;Netlify and others are extremely transparent about the fact that there are no limitsAre they also transparent about the fact that they1. Won&#x27;t do anything about a DDoS, and2. In case there&#x27;s a DDoS (or some other unusual traffic spike), you&#x27;ll only get notified waaaaay after the fact when you get the $100K bill, instead of getting a timely alert that would allow you to shut your site down to prevent getting extreme charges?No and no.It&#x27;s a scam.

It does say it&#x27;s pay-as-you-go on their pricing page. However they probably should have a giant warning page for new users who don&#x27;t know that this is how this kind of service works if they want to target the beginner web-dev market. As far as I know, no other similar service has this though.

My previous understanding was that service would be stopped once you hit past the free tier.Upon review, it does not look like this is the case. I have several very low traffic projects on which would have never been anywhere close to the free limit. However, if I get involved in a random spam attack, it seems I could be on the hook for several thousand dollars.This is incredibly dangerous. Netlify is often used as a beginner friendly free tier for static hosting. Not as something that is cheap, but as something that is free. This is just an overall dangerous position to put people in.

It smells like a scam, because they can suddenly bill any user they want for a scary number like $100,000, then when the user complains they &quot;generously&quot; reduce that to only 5%, or $5,000, hoping the user will just pay the massively reduced cost. This kind of thing - showing a huge number upfront then reducing it to a &quot;small&quot; number - is a classic scam.Who controls the DDOS bots? Are they truly a separate entity? There is no direct evidence to link them together, but you would think that an honest company would be more proactive in preventing problems like this for their customers.According to the linked reddit story, this is a known issue with Netlify and their response to past incidents is basically to pound sand. It all adds up to them purposefully trying to find ways to generate a high bill for their customers and hoping a small amount will pay for it.

Companies like these give out ridiculously huge free tiers in the hopes that very few users end up using the high free bandwidth limits. In most cases, they do. However, they do need to make their money back somehow.I don&#x27;t really get why people put their tiny static sites on hosts designed to never fall over no matter the traffic generated, no matter the situation. You&#x27;re running a blog, not a government service. You don&#x27;t need AWS or Netlify.The ability to withstand almost any DDoS attack for a high price is a valuable service. It&#x27;s not a scam. The people who get these huge bills just picked a hosting service that doesn&#x27;t fit their requirements. I can promise you that the $3 shared hosting providers won&#x27;t charge you $5k, five minutes after the DDoS starts your site just goes down.

&gt; Not to mention the strong conflict of interest for netlify, who stands to gain from their customers being attacked. Netlify is getting paid for something criminal in nature having occurred.I think you could argue that Netlify is guilty of racketeering in OP&#x27;s case.1. They admit illegal activity happened (a DDoS attack).2. They demand money to be reimbursed for the illegal activity. However, the reimbursement they ask is several hundred times higher than the actual damages incurred.

Because it&#x27;s unbounded liability.Not to mention the strong conflict of interest for netlify, who stands to gain from their customers being attacked. Netlify is getting paid for something criminal in nature having occurred.It&#x27;s like who is responsible for credit card fraud? If customers are responsible for credit card fraud, and it&#x27;s their responsibility not to get scammed, then who implements fraud prevention measures and what effect would that have on the volume of fraud?

I looked up the definition of scam and the goal is to make money out of the naivety of the victim. It involves a crisis, the illusion of shared exposure to a risk.The price of cdn bandwidth is about 0.01&#x2F;gb on low volume (cloudflare, aws, azure…) so op should be billed around $500 with 40TB. Netlify probably buys this for way less. He was presented a bill at $104k, « generously » reduced to $5k, still a x10 margin. Vercel and Netlify are outrageously expensive for what they do.

&gt; extremely transparent&gt; they probably should have a giant warning page for new users who don&#x27;t know that this is how this kind of service worksPick one

I understand the lack of limits but I haven&#x27;t accounted for DDoS attacks on Netlify infrastructure to impact me. I was assuming this only included real, &quot;organic&quot; traffic.What I think Netlify needs on their Plans page is to include &quot;DDoS attacks is included in your traffic&quot; as well as their 20%&#x2F;5% charge system.&gt; and can see why the lack of limits would make it a bad option for plenty of peopleJust out of curiosity, can you see any scenario where it WOULD be a decent option to use a free tier where you may be hit by a $20,000 or $5,000 bill out of the blue and outside of your control? You say &quot;plenty&quot; so I assume you consider this a reasonable system to some?

I don&#x27;t see why people are surprised by this or why people are calling it a scam. Netlify and others are extremely transparent about the fact that there are no limits. I completely understand not liking it and can see why the lack of limits would make it a bad option for plenty of people, but I don&#x27;t see how it can possibly be called a scam.

true. I have a 9€&#x2F;mo vps at Contabo for my blog and once boasted on HN that my small VPS is able to handle reddit&#x2F;hn hugs which one user seemed to take personally and they started a DDOS against my VPS.I only realized this after Contabo contacted me and said the traffic is so high that other clients service is also degraded and they will have to take my VPS down if its much longer (which was understandable). Gladly the ddos stopped soon.But never was there any talk about any cost, they were very supportive

in other words, &quot;if you&#x27;re thinking of using netlify, don&#x27;t&quot;.

It means they protect themselves from layer 3 and 4 DDoS. For layer 7 you&#x27;re mostly on your own. That&#x27;s what most companies mean when they talk about DDoS anyway.

It means that they will charge you 20k (a year&#x27;s rent for me, no biggie) instead of 100k for your free website, or 5k if you got lucky.

They reroute the network traffic to ensure none of it gets dropped so they can accurately overcharge you for the the correct amount.

<a href="https:&#x2F;&#x2F;www.netlify.com&#x2F;security&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.netlify.com&#x2F;security&#x2F;</a> sez “Active DDoS mitigation — Netlify monitors for traffic pattern anomalies and spikes, and effectively controls for them as needed” and now I&#x27;m curious about what that actually means.

What&#x27;s spend limit?Autoscaling is a feature!

Playing ”devil’s” advocate: tracking spend in real-time is not trivial. It adds complexity to stack. Bugs in the feature can cause sites to go down (for long time) without a reason. Larger online businesses likely rather sort out the problems later than risk shutting down in the middle of unexpected success.(But I also would like to see this feature)

Yep, for a static site you can throw nginx on some VPS for $10 a year and it&#x27;ll handle a decent amount of traffic.

I&#x27;m hesitant to use &quot;fancy&quot; cloud service&#x2F;hosting providers for reasons like this.I don&#x27;t understand why they won&#x27;t just raise a 503 if the traffic exceeds the spend limit, or at the very least provide that as an option.

This rings so true!I&#x27;ve dealt with Netlify&#x27;s support [1], and one of their CS heads was incredibly rude to me and blamed me for the problem they created.[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35610956">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35610956</a>

Their marketing is very much like this. It’s completely misleading. They are definitively not selling “keep it up at all costs, money no object”

To some extent, that answer is fair enough, assuming they make this clear up front. If their service is &quot;we&#x27;ll keep your site up no matter what, for a price&quot; that&#x27;s a fine service to offer. It&#x27;s not what the vast majority of people want, of course.If their advertising is targeted to small businesses and individuals who could never afford this type of service, they could be guilty of false advertising, at least morally guilty. I haven&#x27;t seen their marketing so I wouldn&#x27;t want to say.

“Stop dressing so sexy if you don’t like the attention” is the vibe I got.

I don&#x27;t fully understand Netlify, but it seems though it tries to be a one-stop solution for everything it doesn&#x27;t have to be - you could put free Cloudflare in front of it and probably mitigate this kind of thing?<a href="https:&#x2F;&#x2F;docs.netlify.com&#x2F;domains-https&#x2F;custom-domains&#x2F;configure-external-dns&#x2F;" rel="nofollow">https:&#x2F;&#x2F;docs.netlify.com&#x2F;domains-https&#x2F;custom-domains&#x2F;config...</a>

The most bizarre thing is that this is a known issue that folks have asked them for ways to mitigate, to no avail. The reddit thread even links to an extremely weird dialogue where Netlify&#x27;s response boils down to, &quot;if you&#x27;re hosting a small site that gets DDoS&#x27;d, don&#x27;t.&quot;<a href="https:&#x2F;&#x2F;answers.netlify.com&#x2F;t&#x2F;limit-bandwidth-to-avoid-high-billing-caused-by-ddos&#x2F;13086" rel="nofollow">https:&#x2F;&#x2F;answers.netlify.com&#x2F;t&#x2F;limit-bandwidth-to-avoid-high-...</a>

Yeah Like wtf is wrong with that? Are people just to lazy to check what the conditions are when exceeding traffic? I&#x27;d never ever sign up for anything that just keeps charging...!?

Like in the past, when you went over your limit your page went offline. The good old Slashdot effect

I understand that some businesses might want to take the hit from a cost surge because they get an even higher revenue surge. But a large fraction of sites aren&#x27;t like that and would prefer a loss of service to a cost overrun. Service providers should always offer a &quot;maximum out-of-pocket cost&quot; service option. Those that don&#x27;t aren&#x27;t suitable vendors for most customers and customers should be warned about them.

I believe that&#x27;s what Firebase Hosting does.As I recall, you have to actively sign up for the paid plan (Blaze) to get pay-as-you-go billing. Otherwise, you get free quota, and if it&#x27;s up, it&#x27;s up.I think it also integrates into all of Google Cloud&#x27;s billing management stuff, but I&#x27;ve never had to bother with that.

So anyone whos site might be posted to HN should be on a business plan.

Yeah. Elsewhere in these comments there&#x27;s a link to a support thread[0] where Netlify support essentially says you shouldn&#x27;t ever need an option to suspend your site at a certain point because:#1. If you think there&#x27;s any chance of getting DDoSd, you should already be on a business plan instead of a starter tier.#2. If you think there&#x27;s any chance of your site going viral, you&#x27;re going to want to pay the cost anyway to let all those people visit.I agree that&#x27;s ridiculous and that the lack of any option of capping costs would mean I&#x27;d never sign up for the service. But that&#x27;s the official response, for what its worth.[0] <a href="https:&#x2F;&#x2F;answers.netlify.com&#x2F;t&#x2F;limit-bandwidth-to-avoid-high-billing-caused-by-ddos&#x2F;13086" rel="nofollow">https:&#x2F;&#x2F;answers.netlify.com&#x2F;t&#x2F;limit-bandwidth-to-avoid-high-...</a>

This &quot;one crazy trick&quot; does nothing to limit your true liability.If you go to a restaurant someone at your table orders 5,000 plates of mozzarella sticks, the fact that your credit card only covers $5 doesn&#x27;t mean you are magically absolved from the rest of the bill.For $100k, a debt collection firm would be more than happy to get a judgement against you. Credit card or no.

Use a virtual card with just a small amount of money on it to limit your liability.  Won&#x27;t work if you&#x27;ve entered a contract, but for a lot of these providers, including AWS it works.

Totally agree, it&#x27;s an unacceptable risk

&gt; use a free service that might, for reasons entirely outside your control, suddenly bill you 5k, or 104k... or any non trivial amount really.Like all of the big clouds with free tiers and nuke it from orbit level footguns lying about everywhere?

There&#x27;s no way in hell anyone should ever under any circumstance use a free service that might, for reasons entirely outside your control, suddenly bill you 5k, or 104k... or any non trivial amount really.Just suspend service on excessive overages...

What the hell. Netlify has implemented all these customer-hostile billing changes. Literally the worst. I migrated my company&#x27;s site off of Netlify when they tried charging for per user on one of my repos (a documentation site). Glad I left them and never looked back.

Lol I just deleted
the account (surprisingly easy). Since I didn’t have a custom domain, just let it die for now.

Me too, it took like 30 mins to create cloudflare account and move my small static sites.

Pulling my netlify hosted stuff today. F that. Sorry to hnbadges users!

What was the website that got DDOSed? <a href="https:&#x2F;&#x2F;jyutping.org&#x2F;en" rel="nofollow">https:&#x2F;&#x2F;jyutping.org&#x2F;en</a> ? (Since it&#x27;s behind Cloudflare now, I guess linking it here is fine.)At first I thought it might&#x27;ve been <a href="https:&#x2F;&#x2F;hanhngiox.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;hanhngiox.net&#x2F;</a> , but that one appears to have simply expired.

This is such a shame, I found the user experience pretty good on Netlify and now I can’t risk staying with them.

The test for federal class action lawsuit includes 4 prongs, all of which must be satisfied: numerosity, commonality, typicality, and adequacy. [1]I would think (as a former lawyer with only passing familiarity with class actions) that &#x27;typicality&#x27; would be the key question.&gt; to determine typicality the courts consider to what extent plaintiffs’ claims are markedly different or are generally the same (for instance arising from the same event or pattern) as those of other class members with respect to the relevant legal theory and factual circumstances of the case. [1]The defendant would probably claim that each plaintiff&#x27;s issues are quite unique. However, this prong is apparently not based on the typicality of the specific facts giving rise to the lawsuit, but rather the typicality of the nature of the claim or defense. And it&#x27;s apparently hard to &#x27;win&#x27; (defeat a class action) via this prong. [2]1: <a href="https:&#x2F;&#x2F;www.bonalaw.com&#x2F;insights&#x2F;legal-resources&#x2F;what-are-the-requirements-for-class-certification-under-federal-rule-of-civil-procedure-23" rel="nofollow">https:&#x2F;&#x2F;www.bonalaw.com&#x2F;insights&#x2F;legal-resources&#x2F;what-are-th...</a>2: <a href="https:&#x2F;&#x2F;california-business-lawyer-corporate-lawyer.com&#x2F;class-action-practice-guide-california&#x2F;class-action-requirement-statute-california&#x2F;" rel="nofollow">https:&#x2F;&#x2F;california-business-lawyer-corporate-lawyer.com&#x2F;clas...</a>

Any lawyer here can suggest if a class action suit is appropriate?

That makes sense, but is the Netlify subdomain visible from your custom domain? How would they be able to figure it out, other than humans leaking it somehow?

Every Netlify project is assigned a Netlify subdomain (i.e. `example.netlify.app`) that cannot be removed or proxied.If anyone figures out what your Netlify subdomain is, it&#x27;s my understanding that they can DDoS you and there&#x27;s nothing you can do about it.

Put Cloudflare proxy in front of Netlify&#x2F;Vercel deploys

Really uncomfortable with how many services like this are “we scale to your needs” and end up here. I guess capacity planning from oversubscribing bandwidth is its own can of worms but surely that is a bit… less surprise generating.

This and that similar story recently about Vercel makes me feel iffy about these services at this point. I guess I’ll either use Cloudflare pages or simple dedicated machines from Hetzner going forward.

For those who don&#x27;t get the reference: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;JayBauman1&#x2F;status&#x2F;1665024103282012161&#x2F;video&#x2F;1" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;JayBauman1&#x2F;status&#x2F;1665024103282012161&#x2F;vi...</a>

But they do. And they’re the ones writing it off.

You don&#x27;t even know what a write-off is.

Nah. I think the dev community has long memory. Events like this is damaging for years. Whenever Netlify is mentioned, someone will inevitably point to this thread for a few years.

The very fact that you expect that making front page of hn will make them cancel that bill means that it will soon be over.These kind of stories (alongside cancelled accounts) repeat over and over again and will soon become so not newsworthy that they will either not end up in front page, nor people will check on the eventual outcome which means these companies will get away with not moving a finger.

Thanks.When I received a message from the bank saying my account was in the red I discovered that AWS had been billing me 1100 &#x2F; month for 5 months before I even noticed. It was for something I&#x27;d set up one night while bored and then forgot about it. They drained my account :( Even had the nerve to say I had to pay for premium support only to get a &quot;lol, pay&quot; response.

didnt even take 2 hours till your predication came true, you are the messiah

If you bend over and pay in such circumstances, you are part of the problem. Twilio tried to pull this crap on me and I simply created another account with an email forwarder and left them holding the bag on the previous account

Since the author has gone viral I expect some netlify exec is going to take over and write this bill off to $0. In the words of Kramer “these big companies, they just write it off!”A moment of silence for the people who got DDoS-ed, didn’t go viral and still had to pay $5k.

I feel a class action lawsuit is incoming. Potentially with FTC support...

First of all Hetzner would&#x27;t let your server to be DDOSed for 192TB if it&#x27;s not your normal usage. They&#x27;ll likely just null route your IP if serious attack hit.They also likely drop any charges if you escalate via support in case it was actually DDOS. E.g if you normally have 100GB &#x2F; month and now you magically have 50TB &#x2F; day.What Netlify does is a scam.

Which is vastly preferable to a thousand dollar bill (not to mention a hundred thousand dollar bill) for most websites.

Hetzner will just null route your server if you’re DDoS’d.

I also take advantage of their free services and only pay for R2 on Cloudflare since it&#x27;s the best value managed provider I could find.I prefer to keep my App&#x27;s stateless and running in Docker containers which means storing all uploaded files and generated assets in R2 managed storage - which is also used for Litestream backups of our SQLite databases.Blowouts are minimized when using low cost services, e.g. we had a rogue process that ended up causing 1.5M writes to R2, which only ended up costing us $4.50 in that month.

I really hate Clouflare and at the same time love them. Love them for their free, generous 500k req.&#x2F;day pages and workers, hate them for not having spending limits (or at least I can&#x27;t find them). I get that they probably don&#x27;t care about individuals and small businesses paying them peanuts, and corps can afford to pay extra if something blows up, but for me it just means I will only use a free account, and they get none of my money.

More reasons why I avoid clouds with outrageous bandwidth fees, and prefer Hetzner&#x27;s low cost fixed pricing with Cloudflare R2&#x27;s 0 egress fees.Even if the DDoS wasn&#x27;t caught by Cloudflare, the total cost for 192TB bandwidth on Hetzner would be €172. Although even after 10 years on Hetzner I&#x27;ve never paid for any bandwidth, always well within their generous 20TB free bandwidth.

This is the reason I&#x27;ve never used all of these user-facing serverless services. The price depends on the usage, but if anything goes wrong they are the ones to decide what you pay. It&#x27;s not comfortable thinking that you could screw up, or get DDoS&#x27;d, and the remedy is hoping they wave the bill.

Cloudflare has free DDOS protection.Additionally, they own ( or co-own) their DC, while Netlify and Vercel doesn&#x27;t. So they can fix any billing issues at their end.

A lot of today&#x27;s managed service solutions turn scaling problems into billing problems. While that&#x27;s a useful tradeoff for many business use-cases, there should still be a way to set limits so you don&#x27;t wind up with insane cost overruns.

Oh God roaming is one my biggest nightmares and it’s the worst UX to not get charged, too. ‘You want to go on vacation? Make sure to hunt down an option hidden 3 levels deep and enabled by default because we really like money and you didn’t read the fine print? Too bad, we really like money’

And it is, I remember cases where telcos were prevented from charging thousands for roaming expenses because they were not licensed to make large loans.

If people are paying attention then Netlify should be done as a company.

Yep, this is a company that screams for more regulation.

looks like it is not just defaulting to unbounded liability. it is forcing unbounded liability as there is no way to turn it off and limit your exposure.

Defaulting to unbounded liability as the standard operating procedure for cloud infrastructure should be illegal.

They might not get Ddos protection because Shirky principal. Institutes further problems they are meant to solve

If it’s a static website; use GitHub to host and put behind cloudflare.If you need a nice front end, spin up a Wordpress instance with a provider like digital ocean or vultr or any other number of places. It’s like $5-10&#x2F; month and has terabyte bandwidth without issue typically.Then put the site behind cloudflare or at least configure a plugin for ddos protection.

Yeah. Any host that won&#x27;t infinitely scale out will solve this concern for you.

My experience is that customers don&#x27;t really care that much about small amounts of downtime no matter what size you are, people mostly get that unexpected stuff happens as long as you don&#x27;t get hacked or misplace their data. Customers might complain a bit but seldom leave because of a few hours downtime.This seems to mostly hold true to developers also, GitHub manages to survive just fine after all.

Host on a provider which bills per hour. This caps your cost. It also makes your users pissed because you will go down, but if you’re small, you can afford that. If you’re big, you already have scaling options and should have a team to handle ddos.

That’s a free tier that doesn’t sound sustainable then, so that raises alarm bells to me.

CloudFlare pricing is indeed positively ridiculous.At OpenTofu[0] we’re using CloudFlare R2 to host the providers and modules registry[1]. Bandwidth is free, you only pay for requests.This already would be great, but there’s more - you only pay for requests that actually hit R2. So with an almost 100% cache hit ratio, we barely register any billable requests.Recently someone decided to load test us and generated ~1TB of traffic over 1-3 days. All but a few of these requests were cached, so the whole situation probably cost us less than a cent.[0]: <a href="https:&#x2F;&#x2F;opentofu.org" rel="nofollow">https:&#x2F;&#x2F;opentofu.org</a>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;opentofu&#x2F;registry">https:&#x2F;&#x2F;github.com&#x2F;opentofu&#x2F;registry</a>

&gt; Cloudflare&#x27;s free tier is ridiculous: We do over 30TB+ of genuine traffic for $0It&#x27;s not really ridiculous if you think about what you&#x27;re giving them.You are massively benefiting their platform by providing them data which they use to train their services and then sell those services to other customers.I&#x27;d make a case that the data they collect is the most important part of their business and the free tier is a major component of this.

&gt; Cloudflare&#x27;s free tier is ridiculous: We do over 30TB+ of genuine traffic for $0. Makes it hard to move to any other platform. As a small tech shop, this is my Hotel California I&#x27;m happy to never leave.Yeah that&#x27;s how Cloudflare can reach total control over the Internet. With thunderous applause by people that should know better.I know that my position is outright blasphemous in this day and age, where even self-hosting a static site has become black magic and we need a third party to do it for us.

I don&#x27;t think it&#x27;s fair to call it their free tier - it&#x27;s their discretionary tier, there are numerous cases of the rug being pulled as and when it suits their business requirements to do so.  Being left homeless vs. urgently coughing up is exactly the wrong problem to be dealing with mid-attack, I can&#x27;t see any way to consider it free by any practical definition

I know that putting all eggs on one basket and giving it all to Cloudflare is not a good idea, if they have an outtage then I would also have it to. But when they are down, one third of the internet is down with them too. With 240$ a year for CDN, 60$ a year for serverless and $0.015 &#x2F; GB-month for S3-compatible storage with free egress, I don&#x27;t think anyone could find a better alternative than CF.
I&#x27;m mixing with AWS, CF and self-hosted machines and the infra cost is less than 5k$ a year. Now I can spend the remain hard earned money for some fresh marlboro cigarettes.

&gt; Cloudflare&#x27;s ddos protectionYeah, we got hammered once with over 10TB&#x2F;mo and noped out of Netlify as fast as we could: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;rethinkdns&#x2F;status&#x2F;1370342245841342466" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;rethinkdns&#x2F;status&#x2F;1370342245841342466</a> Had to pay the bill in full.Cloudflare&#x27;s free tier is ridiculous: We do over 30TB+ of genuine traffic for $0. Makes it hard to move to any other platform. As a small tech shop, this is my Hotel California I&#x27;m happy to never leave.

I&#x27;d even say build your system so as it can run on shared hosting. This way you even save the management.

This so much. My hetzner (best choice for a media server within Europe) has 0 downtime in 1.5 years. And exactly as you said I am using bunny as well, which costs me a few $ per year.

That is my setup after leaving AWS for some of my services (low user amount b2b).I put in far less resources and maintenance after I had the system running. Especially if you need to manage the software running anyway.

&gt; It takes more time and resources to manage itFor most of the new web projects, setting up your brand new server is pretty well documented process and should not take more than couple of hours.It get complicated when you grow and add more servers or components. But at that point, you should be able to afford a part-time consultant to handle complicated tasks or just use Cloud then.

If you want to sleep tight just get a dedicated server or VPS from something like Hetzner and&#x2F;or combine with CDN providers like BunnyCDN - set up alerts just in case though. It takes more time and resources to manage it but you could save a lot on it in this case.

This may seem weird, but I believe ToS ae the real problem here. I call it the &quot;car rental&quot; problem.When I rent a car in person, I am often given a contract. And this contract is filled with tiny print, and pages of it.There are often people behind you, waiting, and bored&#x2F;annoyed people behind the counter, waiting. This is beyond unreasonable.A point of sale contract should be short, in readable text, and understandable. For example, renting a car? Under a page, easily parseable, and if the person behind the counter cannot explain it, it is null and void.From a legal side, you can do this. And you can explain legal terms. Of course this means you are describing intent, which limits one in court, oh boo hoo Mr Lawyer. Cry me a river.Well the same should be true of any retail contract. Sign up for a service? One page with costs listed.At least then, there is hope of an end-user sort of understanding. And as one could claim that a DoS was actually targetting the provider, and not the website, that should be described too.So back to the topic at hand. I would write a demand letter, insistong Netify explain the charges, and ask them if they and their IP ranges were DoS, and if so that the charges be reversed.Because you shpuld not be paying, if someone attacks Netify.This letter should also be sent by mail, sig required, to the corporate address too.

It shouldn&#x27;t be like this, but it is.Unfortunately, in today&#x27;s world, DDoS protection is the equivalent of basic hygiene, foid and road safety. It&#x27;s just a travesty that the hosting providers don&#x27;t feel like it&#x27;s their responsibility to address it.

No. This is absolutely common. I remember well how shared hosters 10 years ago already put caps on cheap packages and took the websites offline in case of traffic. And today it&#x27;s Amazon who bills small players into dept.There are many provider who don&#x27;t tho.

Can&#x27;t hosts just make a site unavailable once it reaches its plan&#x27;s bandwidth limit, DDoS or not?I think being offline is a lesser headache than a large bill, especially for those who are inclined to a free tier to begin with.

I always run mine through Cloudflare, at least in part for this reason.

Imagine you lost your job. So you are here enjoying creating and hosting your hobby projects in theses services. Now, suddenly one fine morning you get slapped with $104K bill because someone decided to randomly ddos your one page dog lover website.Now, who in the would would be thinking of having ddos protection for their hobby project? This is just absurd thinking.

In enormous mansions atop large piles of money.

I&#x27;m moving everything to Cloudflare.

I was looking for a static site hosting option recently and tried out cloudflare pages. Fit my need perfectly. The generous free tier and the reasonable pricing model were the big factors.Oh, and the ability to put some authentication in front of it was a big feature for me.

Yeah, I&#x27;m already using Cloudflare because of Google Domains got de facto killed by Google via transferring it to Squarespace. Why not Cloudflare Pages, CDN, and R2 (S3-compatible storage) too? I&#x27;m even considering paying for the paid tier in the future if I ever go above the limits of 20 000 files per static site and the 25 MiB single file size limit [^1] (more than enough right now or in the near future).[^1]: <a href="https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;pages&#x2F;platform&#x2F;limits&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;pages&#x2F;platform&#x2F;limits&#x2F;</a>

I didn&#x27;t even know Cloudflare offered a JAMstack platform. I&#x27;m going to switch as I already use Cloudflare for domains.

This might be a good time to point out Cloudflare Pages: <a href="https:&#x2F;&#x2F;pages.cloudflare.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pages.cloudflare.com&#x2F;</a>Under the free tier:&gt; Unlimited bandwidth

This strategy may work for a (D)DoS that is targeted to an application layer, but won&#x27;t work if the attack is designed to exhaust your bandwidth.Once you&#x27;re receiving more traffic than you network cards can handle, it does not matter if you&#x27;ll drop the packets with iptables or not.I was the target of attacks that caused Hetzner to terminate my contract. I was leasing physical servers there, so I assume the attacks were overwhelming their infrastructure.

Eventually you&#x27;re probably going to want an ipset, at least. Otherwise processing your chain will continuously cost more, and more, and more.

Use a token bucket on your web server to catch abusive IPs and then blackhole them using `iptables -t raw -I PREROUTING -s ip -j DROP`. I know. I run <a href="https:&#x2F;&#x2F;ipv4.games&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ipv4.games&#x2F;</a> which invites hackers to unleash their botnets, and the service runs on a small VM with only a few cores. It&#x27;s been attacked by botnets with 49,131,669 IP addresses. There&#x27;s no Cloudflare frontend or anything like that, because back when I used Cloudflare, the people who attacked the service would actually bring down the Cloudflare nodes before they brought down my web server. I doubt I&#x27;ve ever paid more than $100&#x2F;month to operate the service. Please note that your service provider needs to have free ingress in order for this strategy to be effective.

That’s a crazy high bandwidth. Bandwidth isn’t free, but $400 will get you a month of 10gig in my local peering point, that’s 1TB in 15 minutes.

Vervel charges $400&#x2F;TB for excess bandwidth, it&#x27;s not even DDoS you should worry about, just moderate success.

Wait until you learn that Vercel only supports blocking IP CIDR ranges on the Enterprise plan.

Those services exist, and you have the option to use them. Netlify is not one. Apparently, you chose that the un-insured solution was best for you.

Vercel seems to exist only to promote lock-in.

You can also turn on soft and hard spend limits on Vercel (including SMS alerts) <a href="https:&#x2F;&#x2F;vercel.com&#x2F;blog&#x2F;introducing-spend-management-realtime-usage-alerts-sms-notifications" rel="nofollow">https:&#x2F;&#x2F;vercel.com&#x2F;blog&#x2F;introducing-spend-management-realtim...</a>

Can anyone share an example of edge middleware that might protect you on Vercel?

&gt; Someone that doesn&#x27;t want me to do well can simply ddos me into bankruptcy out of nowhere.An interesting story that expands on the above concept but a different vector entitled, &quot;Illegal Life Pro Tip: Want to ruin your competitors business?&quot; : 
<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36566634">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36566634</a>

“We leave your safe deposit box unlocked. You might want to forge your own lock and key. If we happen to notice someone stealing out of your box, we will let them grab as much as they can for one minute, then maybe install our own lock if our revenue is close to target.”

This is my worst nightmare as a bootstrapped founder. And that there&#x27;s no way to put a limit on spend is ridiculous. Someone that doesn&#x27;t want me to do well can simply ddos me into bankruptcy out of nowhere.Just went through Vercel&#x27;s docs:---&quot;Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically mitigating the event. Mitigation usually takes place within one minute.Usage will be incurred for requests that are not recognized as a DDoS event, such as bot and crawler traffic.You should monitor your usage and utilize Edge Middleware to protect against undesired traffic based on its IP, User-Agent header value, or other identifiers.&quot;---That doesn&#x27;t help me sleep well.I feel that by now, these hosting providers should simply adopt best ddos protection practices and take responsibility for failure to protect.&quot;You should monitor your usage and utilize Edge Middleware to protect against undesired traffic based on its IP&quot; - there should be some really good defaults for this right?Clearly it&#x27;s possible - Cloudflare&#x27;s ddos protection is worded more strongly.I&#x27;m willing to pay more for the service for peace of mind. Like, even $10&#x2F;mo more to insure against getting smacked out of nowhere.

We really need to have list of these shady SaaS that will try to charge you money when you using their &quot;Free&quot; tier and never given them credit card.This should not be tolerated. Full stop.

That it why I always refuse to use hosting services with on-demand pricing, especially for personal projects: in the worst case scenario I&#x27;d rather see it down for a few days than be indebted for whatever amount.

Worth reading - thanks for sharing.Arguably a non-profit (unless it was selling stuff from the site, which is unlikely) would be exempt from their list of prohibitions.

GP probably refer to getting a huge surprise bill after a ddos attack, not github never got any ddos attack.

It can but it won&#x27;t result in surprise bill because the bandwidth is capped.

I am confused. Why couldn’t GitHub Pages suffer a DDOS attack? Also they don’t want you using them for business purposes:<a href="https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;pages&#x2F;getting-started-with-github-pages&#x2F;about-github-pages#prohibited-uses" rel="nofollow">https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;pages&#x2F;getting-started-with-github...</a>

Yeah I&#x27;m doing the same, a combination of OVH, Scaleway and Hetzner.Sure there is no such thing as &quot;free unlimited&quot; bandwidth but I much prefer unlimited with a fixed cost until they decide it&#x27;s not worth it and shut me down vs unlimited risk with no ability to cap it.The lack of cap is the worst part and it&#x27;s 100% a business decision. Every provider who tracks bandwidth could add a cap but they just choose not to because it&#x27;s too profitable and the risk is mostly* on the customer anyways.*there is of course a tiny chance they the customer goes bankrupt and they get almost notning, but usually they just need to pretend to be nice and forgive all or most of it

I recently rewrote a website&#x2F;small backend API for a non-profit organization. I could&#x27;ve gone with a serverless architecture for our forms handling API and reduced spending to nearly the free tier, but I had no good way to protect against a scenario like this. There was just not good enough documentation about how to completely cut off spending in the scenario of an attack, and I wasn&#x27;t comfortable leaving the organization open to a cost attack like this.So we&#x27;re using Github Pages for static hosting and a $5 box from OVH now. Unmetered bandwidth, plenty resources for our purposes. Cheap enough, and we will never, EVER, have to worry about an attack like this. Well worth it imo.Imo, serverless is great for internal jobs where you can control spending. For public facing things, you have to be a lot more careful.

But they do tell you the pricing structure, right?

When you sign up for their &quot;Free tier&quot; there are no big red warning that they can charge you $100,000 out of the blue.

they are taking a risk because they haven&#x27;t credit checked the usermost people wouldn&#x27;t be able to pay a $100k bill

There&#x27;s a reason price plans are &#x27;pay as you go&#x27; - so that they don&#x27;t take on any risk for things like this. Moral of the story: never go for pay as you go by usage plans if this scenario is not mitigated through a third party. 
By no means am I trying to suggest a get out for Netlify here - more a rule of thumb for anyone worried the same could happen to them.

A successful distributed denial of money is likely much more devastating to anyone except really large companies than a successful DDoS. For a personal accounts it is entirely devastating with no upside, but even for a startup it would probably be better for your site to just go down instead of having huge bills generated.

I was searching for &#x27;cloudflare spending limits&#x27; based on comments here, at first glance they (like Vercel) seem to have a notify don&#x27;t terminate policy.What I didn&#x27;t appreciate is static assets are completely free: <a href="https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;pages&#x2F;functions&#x2F;pricing&#x2F;#static-asset-requests" rel="nofollow">https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;pages&#x2F;functions&#x2F;pricing&#x2F;#s...</a>So therefore I assume static cloudflare pages are free.Incidentally Vercel does seem to have an (annoyingly indirect) way of halting usage based on spending: <a href="https:&#x2F;&#x2F;vercel.com&#x2F;docs&#x2F;accounts&#x2F;spend-management" rel="nofollow">https:&#x2F;&#x2F;vercel.com&#x2F;docs&#x2F;accounts&#x2F;spend-management</a>Has anyone implemented this, are there any problems with it?

<a href="https:&#x2F;&#x2F;upcloud.com" rel="nofollow">https:&#x2F;&#x2F;upcloud.com</a> does pre-paid billing.

Any cloud service that offers prepaid billing on a credits model would get a lot of customers.(Prepaid is also superior from a cash flow perspective too.)

It&#x27;s also worth pointing out that Netlify&#x27;s pricing of $550 per 1TB is 5x more than AWS, Google Cloud, and other massive cloud providers charge, and those are already known for extortionate data transfer fees (50-100x more than more reasonable providers).

Netlify charge $55 per 100GB for overages on their starter plan. Keep in mind that they’re being billed by their provider at 95th percentile billing. That means they have ports running at say 100 gigabits per second and have a commit of say 50 gb&#x2F;s and they’re billed a flat rate for that as long as they don’t go over. Because they’re billed 95th percentile they can spike their connection traffic massively for 5% of the time and not get billed more. So Netlify themselves have a safety net and don’t need real-time monitoring to immediately cut their usage. And of course any spikes from a single user are massively diluted among their entire user base. So, yeah, they’re gouging big time.What they should have is monitoring per user and a default that 503s the site with no overages that has to be proactively disabled by the user. Instead they’re just letting it ride and trying their luck by negotiating down the overage charge to what they think the user can stomach.

Reading this article made me realise not to use these services for good. $5000 is a lot man.. It&#x27;s not that we make money out of thin air.

The pay as you go model is completely wrong.Companies should be legally required to allow their customers to set a ceiling to their monthly spending.

Vegeta worth a look if you want something a bit more sophisticated: <a href="https:&#x2F;&#x2F;github.com&#x2F;tsenart&#x2F;vegeta">https:&#x2F;&#x2F;github.com&#x2F;tsenart&#x2F;vegeta</a>

apachebench (cli command ab), is an Apache licensed stress testing utility, not much relation to the web server, which can be easily used to stress test a webserver.the binary should be easy to install with your package manager, you may have it installed alreadyexample:ab <a href="http:&#x2F;&#x2F;something.com" rel="nofollow">http:&#x2F;&#x2F;something.com</a>

This happened to me on a much smaller scale about a year back. I was never happier to have stuck to my guns, building my whole site with a single `hugo` command - it made it very easy to migrate off that platform for good.If anyone has a solid bash one liner to stress test a website, so that I can test whether my cloud billing cap will work correctly if I accidentally try to egress 100 MB of data or something, I would seriously appreciate it. There was one on a blog post here like a year back, using apache iirc, but I forgot to bookmark it.

Thats criminal, hope you get things sorted. Amazon would wave it.

Have you tested it end to end? When was the last time? I&#x27;m slightly worried about solutions like that. I like when it&#x27;s all host&#x27;s responsibility. (Having your own system on top is nice though)

You could probably set up rate limiting with iptables&#x2F;nftables as well if it’s a vps.

Here&#x27;s my workaround for Vercel:- Enable spend management (<a href="https:&#x2F;&#x2F;vercel.com&#x2F;team_name&#x2F;~&#x2F;settings&#x2F;billing" rel="nofollow">https:&#x2F;&#x2F;vercel.com&#x2F;team_name&#x2F;~&#x2F;settings&#x2F;billing</a>).- Set webhook to pause the project: <a href="https:&#x2F;&#x2F;vercel.com&#x2F;docs&#x2F;rest-api&#x2F;endpoints&#x2F;projects#pause-a-project" rel="nofollow">https:&#x2F;&#x2F;vercel.com&#x2F;docs&#x2F;rest-api&#x2F;endpoints&#x2F;projects#pause-a-...</a>When the amount hits the targeted value, Vercel will call the webhook that pauses the project.

I&#x27;m also interested to know this. I have a couple of static sites running on the free tier for friends&#x2F;family and now I&#x27;m planning on moving them all to a VPS as soon as I can.It is beyond ridiculous that serverless providers don&#x27;t offer a way to cap spending. The idea that it might cause your site to go offline is a complete non-argument. That what I _want_ to happen. I want to be able to say sure, I&#x27;m happy to sustain 10x traffic for a few hours, and maybe 3x sustained over days, but after that take it offline. I don&#x27;t want infinitely scaling infra precisely because of the infinitely scaling costs.

Does this issue only occur if you have billing info on file?I&#x27;m using the free tier and have no billing info set. According to this <a href="https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;ask-netlify&#x2F;issues&#x2F;6#issuecomment-520866255">https:&#x2F;&#x2F;github.com&#x2F;netlify&#x2F;ask-netlify&#x2F;issues&#x2F;6#issuecomment...</a>
&gt; if you have an event that puts you over the free-tier limits, Netlify will ask you to update your billing information and add a CCAlthough worryingly 
&gt; We just had this happen and our site didn&#x27;t stop working.Is there any way to ensure if you hit the limit sites just stop working and you don&#x27;t get billed?

Netlify just sent me a $104k bill for a simple static site