Own the Holidays and Get Ready for Agentic Commerce

DDoS attacks — A distributed denial-of-service (DDoS) attack floods your site with junk traffic to force it offline, often right at peak shopping hours. They're bigger than ever: in 2025 Cloudflare blocked a record 31.4 Tbps attack and mitigated 47.1 million DDoS attacks in total.

Bots — Not all automated traffic is helpful; some bots are built to profit at your expense. “Scalper” bots (a.k.a. Grinch bots) automatically buy up hot inventory the second it drops so resellers can flip it; scraper bots copy your prices so competitors can undercut you; and credential-stuffing bots (which rapidly test stolen username-and-password combos) try to break into customer and loyalty accounts. Over Black Friday 2024, nearly 1 in 5 requests to ecommerce sites were bad bots, and 63% of all login attempts came from bots.

Fraud — Attackers turn stolen logins, fake accounts, and “card testing” (running small charges to find which stolen card numbers still work) into chargebacks, lost inventory, and eroded trust. The fuel is everywhere: heading into Black Friday 2024, Cloudflare saw a 37% jump in login attempts using leaked passwords, and roughly 65% of people reuse passwords that have already been exposed in a breach.

API & client-side risk — Checkout runs on APIs (the behind-the-scenes links between systems) and third-party scripts (outside-vendor code that runs in the shopper's browser). Both are prime targets: API endpoints are often the first place attacks land, and malicious code slipped into checkout can skim card details (“digital skimming,” or Magecart). It's a wide surface: about 60% of dynamic traffic Cloudflare sees is API traffic, the average enterprise site runs 47 third-party scripts, and 18% of retail data breaches trace to Magecart-style attacks.