On 19 October the market demo started showing a Cloudflare error, and at first it looked like an attack. It was not. It was people, thousands of them, and one mistake of mine.

This site runs a small piece of code on each request, to redirect the bare domain and to put the right preview image on a shared link. It only needs to run on pages. It was running on everything: every JavaScript chunk, every audio file, every little data file. Each of those counted toward a free limit of 100,000 requests a day, shared across everything on the account. That day it reached about 127,000, and the market went down until midnight UTC.

The main site kept serving, because static files do not need that code. The fix is a list of the only paths the code should run on, with a test that keeps the list in step with the site’s real pages. Today it uses a small fraction of that limit.

The bigger lesson is that a shared free limit means one surge can take down a neighbour. I am keeping that in mind for what gets built next.