Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cloudflare explained why Kiwi Farms was its most dangerous customer ever by pointing to a claimed escalation in targeted threats, doxxing, and swatting during the 48 hours before September 3, 2022. Cloudflare said the escalation created an “unprecedented emergency and immediate threat to human life,” not merely offensive speech.
That explanation marked a sharp reversal. On August 31, Cloudflare had defended a policy under which pass-through security services would generally not be terminated because a customer’s speech was hateful, immoral, or offensive. Four days later, Cloudflare blocked Kiwi Farms, presenting the action as an emergency exception to infrastructure neutrality.
Key takeaways
- Cloudflare blocked Kiwi Farms on September 3, 2022, after saying targeted threats, doxxing, and swatting had escalated into an emergency involving an immediate threat to human life.
- Cloudflare’s August 31, 2022 policy said offensive or hateful content alone would not normally justify terminating pass-through security services.
- Cloudflare was not Kiwi Farms’ conventional web host; Cloudflare supplied reverse-proxy, CDN, origin-shielding, and DDoS-protection services that made the forum harder to knock offline.
- The #DropKiwiFarms campaign increased pressure and visibility, but Cloudflare said the final decision depended on the alleged escalation in specific, operational threats rather than campaign demands alone.
- Deplatforming caused major disruption without permanently erasing the community: a 2023 academic study found activity and traffic fell by roughly half during the period it examined, followed by migration and recovery.
Why did Cloudflare say Kiwi Farms was its most dangerous customer ever?
Cloudflare said Kiwi Farms became an exceptional case because the company believed the situation had moved beyond offensive speech into a specific and immediate physical-safety emergency. Cloudflare had defended continuing to provide security services just days earlier, then reversed course on September 3, 2022.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →In its September 3, 2022 statement, CEO Matthew Prince said rhetoric and targeted threats on Kiwi Farms had escalated during the previous 48 hours. Prince described the situation as an “unprecedented emergency and immediate threat to human life.”
Popular on Amazon
Cloudflare public-policy executive Alissa Starzak gave a similar explanation to Ars Technica, saying the company had seen specific information about planned actions, doxxing, and swatting. Those details represent Cloudflare’s stated assessment and contemporaneous reporting; they should not be presented as a judicial finding that every threat came from Kiwi Farms or that every user participated in harassment.
The phrase most dangerous customer ever therefore describes Cloudflare’s extraordinary internal characterization of the Kiwi Farms case. The phrase is not a universally measurable ranking of every customer Cloudflare has ever served, nor does it prove that Kiwi Farms was objectively more hateful than all earlier customers.
What changed between Cloudflare’s policy statement and the block?
Cloudflare’s stated rule changed from a general presumption of infrastructure neutrality to a fact-specific emergency exception. On August 31, 2022, Cloudflare said it generally did not believe a pass-through security provider should terminate service because a customer’s speech was hateful, immoral, or offensive.
Recommended Free Tools
Cloudflare’s August 31 abuse-policy explanation argued that security services should be governed by service-specific rules, legal process, and narrowly tailored responses rather than popular opinion. Cloudflare said content-related disputes should ordinarily be directed toward the site’s host, law enforcement, courts, or another provider with the power to address the specific material.
Cloudflare also acknowledged that it had previously terminated The Daily Stormer and 8chan. Cloudflare said those decisions caused it to reconsider the power a private infrastructure company exercises when it withdraws services based solely on reprehensible content. The company said it had seen authoritarian governments use similar reasoning when seeking action against human-rights organizations.
The Kiwi Farms decision was presented as different because Cloudflare believed waiting for ordinary legal or provider processes could leave identifiable people in unacceptable danger. Cloudflare’s policy did not become a general rule that offensive forums should automatically be removed. Instead, Cloudflare described Kiwi Farms as one of a small number of emergency cases involving intentional real-world harm and ineffective alternative interventions.
Was Cloudflare hosting Kiwi Farms?
No. Cloudflare said it was providing reverse-proxy, CDN, and pass-through security services rather than conventional web hosting. Cloudflare’s services could conceal the origin server, absorb or mitigate distributed denial-of-service attacks, and accelerate delivery, but Cloudflare did not control the forum’s database or editorial content.
Also popular on Amazon
| Service role | What the provider controls | How it applied to Kiwi Farms |
|---|---|---|
| Conventional web hosting | Stores the website’s files, database, and server environment; may be able to remove hosted material. | Cloudflare said another provider hosted the forum’s content, so Cloudflare generally could not delete that content itself. |
| Cloudflare reverse proxy and CDN | Routes traffic through Cloudflare, can cache and accelerate delivery, and can hide the origin server. | Cloudflare made the site more resilient and made the underlying host harder to attack directly. |
| DDoS protection | Filters or absorbs traffic floods intended to overwhelm a site. | Withdrawing protection could expose the origin to attack, which is why Cloudflare compared pass-through security to an infrastructure or utility function. |
That distinction created the central policy dispute. Activists argued that DDoS protection, origin shielding, and traffic acceleration materially enabled Kiwi Farms to remain available. Cloudflare responded that withdrawing those protections could effectively invite an unlawful cyberattack and give a private infrastructure company excessive control over speech.
Cloudflare’s abuse-policy materials describe the limits of its role when material is hosted by another provider. The policy distinction explains why Cloudflare could block its own services without claiming that it had removed Kiwi Farms’ content from the internet.
How did Keffals and the #DropKiwiFarms campaign affect Cloudflare’s decision?
The #DropKiwiFarms campaign created public pressure and gathered attention around the forum, but it was not the sole reason Cloudflare gave for terminating service. Cloudflare said the campaign coincided with a rapid escalation in targeted threats that changed the company’s risk assessment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
On August 5, 2022, trans Twitch streamer Clara Sorrenti, who is known online as Keffals, was swatted in London, Ontario. The incident renewed attention on Kiwi Farms and helped trigger the #DropKiwiFarms campaign, which urged Cloudflare and other infrastructure providers to stop serving the forum. The chronology and campaign were documented by WIRED’s reporting on Keffals and Kiwi Farms.
The campaign’s role is best separated into three parts:
- What activists argued: Cloudflare’s security services made a harassment forum more durable and harder to challenge.
- What Cloudflare’s policy said: Content providers and legal processes should normally address unlawful or abusive material, while pass-through security providers should avoid content-based exclusions.
- What Cloudflare said changed: During the final 48 hours, the company believed threats had become specific, operational, and urgent enough to justify an emergency exception.
This distinction matters because public pressure can expose evidence and affect a provider’s attention without being the provider’s stated legal or operational trigger. Cloudflare said it did not act simply because activists demanded that it do so.
Also popular on Amazon
What is the timeline of the Kiwi Farms deplatforming?
The sequence shows why the September 3 block was described as a reversal rather than a routine enforcement action.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Date | Event | Why it mattered |
|---|---|---|
| 2013 | Kiwi Farms was founded by Joshua Moon, according to later reporting and academic accounts. | The forum later became associated by critics and researchers with organized harassment, doxxing, stalking, and threats. |
| August 5, 2022 | Clara Sorrenti, known as Keffals, was swatted in London, Ontario. | The incident brought renewed attention to Kiwi Farms and helped launch the #DropKiwiFarms campaign. |
| Late August 2022 | Activists pressed Cloudflare and other providers to stop serving Kiwi Farms. | Cloudflare initially defended continuing to provide security services, emphasizing that it did not host the forum’s content. |
| August 31, 2022 | Cloudflare published its abuse-policy explanation. | The company said offensive content alone generally should not lead to termination of pass-through security services. |
| September 3, 2022 | Cloudflare blocked Kiwi Farms from using its infrastructure. | Cloudflare said the preceding 48 hours had produced an unprecedented emergency and immediate threat to human life. |
| September 4–5, 2022 | Kiwi Farms moved through alternative infrastructure, including a Russian domain and DDoS-Guard; DDoS-Guard later stopped serving the site. | The migration caused disruption but showed that one provider’s block was not the same as permanent deletion. |
| Late 2022–2023 | Research found major declines in activity, traffic, threads, posts, and active users, followed by fragmentation and recovery. | The intervention reduced reach and activity without eliminating the community. |
| 2025 | Later research described more self-controlled infrastructure, including in-house mitigation and hosting arrangements. | Repeated provider expulsions appeared to encourage greater technical independence from mainstream infrastructure. |
The early history and 2022 events are also discussed in The Washington Post’s reconstruction of the fight to keep Kiwi Farms offline.
How did Kiwi Farms compare with The Daily Stormer and 8chan?
Cloudflare’s own comparison was about the type and urgency of the perceived danger, not an objective ranking of which community expressed the most hateful ideas.
| Customer | Cloudflare action | How Cloudflare later characterized the precedent | Key distinction in the Kiwi Farms explanation |
|---|---|---|---|
| The Daily Stormer | Terminated in 2017. | An earlier content-based termination that contributed to Cloudflare’s reconsideration of its power over speech. | Cloudflare said Kiwi Farms involved a rapidly developing threat to identifiable people, not only objectionable extremist expression. |
| 8chan | Terminated in 2019. | Another earlier termination discussed in Cloudflare’s later abuse-policy explanation. | Cloudflare said the Kiwi Farms case combined specific targeted threats, apparent escalation, and urgency in an unprecedented way for the company. |
| Kiwi Farms | Blocked on September 3, 2022. | Presented as an emergency exception to the general anti-content-moderation presumption for pass-through security services. | Cloudflare said waiting for ordinary processes could expose people to an immediate threat to human life. |
Cloudflare’s human-rights framework for abuse decisions provides the company’s explanation of why earlier terminations influenced its later preference for legal process and service-specific analysis.
What happened after Cloudflare blocked Kiwi Farms?
The block produced an immediate infrastructure scramble rather than a permanent disappearance. Visitors using affected Kiwi Farms domains saw a Cloudflare block page, after which the forum moved through alternative infrastructure, including a Russian domain and DDoS-Guard. DDoS-Guard subsequently stopped serving the site, causing further disruption.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The episode demonstrates the difference between blocking a provider and removing a community. A CDN or DDoS-protection company can make a website harder to reach and harder to attack, but a determined operator may seek another host, another proxy, a different domain, or infrastructure under closer control.
Did deplatforming permanently eliminate Kiwi Farms?
No. Deplatforming substantially disrupted Kiwi Farms, but available research supports disruption and displacement rather than permanent elimination.
Also popular on Amazon
According to the University of Cambridge authors’ 2023 study No Easy Way Out: The Effectiveness of Deplatforming an Extremist Forum to Suppress Hate and Harassment, activity, active users, threads, posts, and traffic fell by roughly half during the period examined. The study also found that users returned, the forum became more connected, and the community continued operating.
| Outcome | What the research supports | What it does not support |
|---|---|---|
| Immediate reach | Cloudflare’s block and the following provider moves caused major disruption and traffic fragmentation. | That Kiwi Farms content was permanently erased. |
| Forum activity | Activity, active users, threads, posts, and traffic fell by roughly half in the 2023 study’s examination period. | That every user left or that harassment ended. |
| Community resilience | Users returned and the community continued operating after migration. | That the intervention had no effect; disruption and reduced activity were documented. |
| Infrastructure | 2025 research described more self-controlled mitigation and hosting arrangements. | That mainstream provider pressure makes a community technically impossible to sustain. |
| Funding | Identified public donation addresses received more cryptocurrency after deplatforming. | That the figures represent Kiwi Farms’ complete finances. |
A 2025 GNET analysis described the forum’s movement toward in-house or closely controlled mitigation and hosting. A separate 2025 scholarly paper on Kiwi Farms’ replatformization likewise supports the broader conclusion that infrastructure pressure can encourage controversial communities to reduce dependence on mainstream providers.
Did Kiwi Farms receive more cryptocurrency after deplatforming?
According to TRM Labs’ April 6, 2023 analysis, incoming Ethereum volume to identified Kiwi Farms donation addresses rose by more than 220 percent during the six months after deplatforming compared with the preceding period, while incoming Bitcoin volume rose by more than 230 percent.
Those figures describe identified public donation addresses analyzed by TRM Labs, not a complete accounting of the forum’s finances. The finding nevertheless illustrates an important unintended effect of infrastructure pressure: a community can lose mainstream providers while gaining motivation to use alternative funding and technical arrangements.
What policy question did the Cloudflare decision leave unresolved?
The unresolved question is who should decide when infrastructure neutrality must yield to an imminent threat to human life. Cloudflare argued that a private security provider should not ordinarily decide which speech remains reachable because withdrawing DDoS protection can expose a customer to attack. Critics argued that protection, origin shielding, and traffic delivery are not neutral when they materially increase the durability of a harassment forum.
The case creates four competing principles:
- Infrastructure neutrality: Network protection should not depend on whether a provider approves of a customer’s expression.
- Material enablement: A provider’s security and routing services can make harmful activity more resilient even when the provider does not host the content.
- Emergency exceptions: A narrow exception may be justified when a provider believes threats are specific, operational, immediate, and inadequately addressed elsewhere.
- Due process versus urgency: Legal and law-enforcement processes can limit arbitrary private censorship, but emergency threats may develop faster than ordinary procedures can respond.
Cloudflare attempted to preserve a general rule against content-based termination while retaining emergency authority for cases it believed involved real-world danger. Whether that boundary is sufficiently narrow, transparent, and accountable remains a policy question rather than a settled technical rule.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is the most accurate conclusion?
Cloudflare blocked Kiwi Farms on September 3, 2022 because it said a rapid escalation in specific threats, doxxing, and swatting created an unprecedented and immediate danger to human life. Cloudflare did not describe the action as a routine response to hateful speech or as a permanent deletion of the forum.
Also popular on Amazon
- Used Book in Good Condition
The decision matters because it tested the boundary between hosting and infrastructure. Cloudflare’s services did not host Kiwi Farms’ database, but they helped shield and protect the site. The resulting intervention reduced activity and disrupted access, yet migration, renewed participation, cryptocurrency fundraising, and more self-controlled infrastructure showed why provider-level deplatforming can suppress a community without making it disappear.
Frequently Asked Questions
Did Cloudflare host Kiwi Farms?
No. Cloudflare said it provided reverse-proxy, CDN, and DDoS-protection services rather than conventional web hosting. Cloudflare could block its own infrastructure, but it did not control the forum’s database or editorial content.
Did Cloudflare block Kiwi Farms only because of the #DropKiwiFarms campaign?
No. Cloudflare said the #DropKiwiFarms campaign created pressure and visibility, but the company attributed its final decision to an escalation in specific threats, doxxing, and swatting during the preceding 48 hours.
Did Cloudflare permanently shut down Kiwi Farms?
No. The block caused major disruption, but Kiwi Farms moved through alternative infrastructure, users returned, and later research described more self-controlled hosting and mitigation arrangements.
Was Kiwi Farms legally proven to be Cloudflare’s most dangerous customer ever?
No. “Most dangerous customer ever” should be understood as Cloudflare’s extraordinary internal characterization of the case, not as a universally measurable ranking or a judicial finding that the forum was legally responsible for every reported act by its users.
The Bottom Line
Cloudflare’s “most dangerous customer ever” explanation was an emergency rationale, not a general finding that offensive forums should be removed. The company said the decisive change was an immediate, specific threat to human life; the aftermath showed both the power and the limits of infrastructure-level deplatforming.
