Traffic analytics

What Zone Analytics measures

Zone Analytics aggregates HTTP traffic processed for a zone. Requests count HTTP requests rather than people. Data transfer measures response bytes delivered through Cloudflare. Page views identify qualifying HTML page loads, and visits group activity using Cloudflare's privacy-preserving methodology. Security analytics describes requests detected or mitigated by Cloudflare products.

• Use the same metric, filters and interval when comparing periods.
• Paths and URIs are case-sensitive dimensions.
• Workers subrequests are not included in the ordinary zone request and bandwidth charts.

Requests, page views, visits and unique visitors

A single browser session can generate one page view and dozens of requests for images, scripts and API calls. Bots and API clients can generate requests without page views. Unique visitors and visits are estimates designed for traffic analysis, not identity or billing. They should not be reconciled as if they were equivalent counters.

• Requests answer how much HTTP work Cloudflare processed.
• Page views answer how many eligible HTML documents were loaded.
• Visits and unique visitors estimate audience activity without becoming a user registry.

Filters and dimensions

Use hostname, path, status code, country, browser, operating system, cache status and security dimensions to isolate a question. Start with one dimension, preserve the time range, and add filters gradually. Over-filtering can turn a broad service issue into an apparently empty chart.

• For an outage, split successful, client-error and server-error status families.
• For origin load, compare cache HIT, MISS, BYPASS and dynamic traffic.
• For abuse, compare mitigated traffic with the same hostname and path in ordinary traffic.

Time ranges, retention and sampling

Available time ranges, granularity, dimensions and sampling depend on the Cloudflare plan and dataset. A short interval is useful for incident timing; a longer interval is better for seasonality and capacity trends. Aggregated charts may be sampled and are not a complete request ledger.

• Do not infer a single visitor's activity from an aggregate chart.
• Do not use analytics as an invoice meter unless the contracted product explicitly defines that dataset as the billing source.
• Use request logs or Logpush when individual event fields and durable retention are required.

Establish a reliable baseline

Compare equivalent weekdays and hours over several weeks. Record releases, campaigns, cache purges, rule changes and incidents beside the timeline. A traffic increase with stable latency, error rate and origin utilization can be healthy growth; the same increase with cache misses or 5xx responses can indicate capacity pressure.

Investigate a traffic drop

Separate demand from delivery failure. Confirm authoritative DNS, edge TLS, origin reachability and recent Rules changes. Compare several hostnames and both cached and uncached traffic. If requests fall only for one country or user agent, investigate routing, client compatibility or a security rule before assuming demand disappeared.

• Check the exact start time against deployments and configuration changes.
• Compare edge status codes with origin logs.
• Confirm whether a Worker route or redirect moved requests to another hostname or path.

Investigate a security or error spike

Break the spike down by action, rule, hostname, path, country and source characteristics. A blocked event proves a rule matched, not that the request was malicious. Reproduce a known legitimate request and inspect the matching rule before creating an exception.

• Use the smallest stable scope for an exception.
• Do not disable the complete WAF or bot layer because of one false positive.
• Correlate Cloudflare time stamps with application and origin logs.

When to move from analytics to logs

Use logs when the question requires request-level evidence, a durable audit trail, custom retention or ingestion into a security platform. Select only the dataset and fields needed for that purpose, protect personal data, and design ingestion to tolerate delayed or repeated batches.