July 28 Incident report: Service availability disruption
Webflow experienced a sustained availability disruption across Designer, Dashboard, Marketplace, and user sign ups between July 28-31.
While hosted sites remained live, some core platform functionality was unavailable. We’ve restored reliability, and here’s how we got there. For a broader reflection on how this impacted our customers and what we’re changing as a company, read our CEO Linda’s post here. Below is a technical breakdown of the incident from an engineering perspective.
The first two phases of disruption were caused by a malicious attacker producing sustained load on our systems and specific API endpoints, resulting in elevated latency and intermittent service outages. These attacks were mitigated through firewall protections, IP blocking, and backend infrastructure investigation.
The third and most disruptive phase was triggered by ongoing attack traffic compounded by performance degradation after scaling up a critical backend database cluster with a dual-socket CPU hardware architecture to provide operational headroom. While the larger database cluster size was shown to be higher performance, we later learned that the single-socket CPU architecture performs better for our services.
