The Paths Page

What it shows

The Paths page ranks the path prefixes your site receives traffic on, across every dimension that matters for spotting abuse — total requests, bytes served, 499 rate, 4xx rate, bypass rate, and the ASN sending the most traffic to each path.

Click any row to drill into the path detail page, which shows which ASNs are hitting that path, a status-class timeseries, cache breakdown, and user-agent families — everything you need to decide whether a path is under attack.

When it's useful

• Incident triage. Sort by 4xx rate and look for a payment-submit or login endpoint near the top with >5% errors. Card-testing and credential stuffing live there.
• Capacity planning. Spot endpoints consuming disproportionate bytes or origin time.
• Cache tuning. High bypass rate on a path that should be cacheable points to a Vary-header or TTL misconfiguration.
• Bot detection. Unusually-high bytes-per-request paired with low 2xx is a probing signature.

Quick-find pills

The row above the table has one-click keyword filters — Payment, Checkout, Submit, Cart, Account, Login, Order, API. Click a pill to pre-fill the search box. "Submit" is the best single-keyword dragnet for SFCC sites — nearly every checkout controller contains "Submit" in the action name (CheckoutServices-SubmitPayment, COBilling-Submit, etc.).

The list extends itself with your own site's highest-volume controllers: any controller carrying real traffic that no standard pill covers gets its own pill automatically, so a custom or third-party controller surfaces without a product update. The same vocabulary is shared with the IPs page.

Two classification pills sit alongside the keywords:

• Email links — the pages your email sends land on, from the landing data. Scanner traffic concentrates here; see the Email drill-down on the Channels page for the send-by-send verdict.
• Bot-only doors — paths with real landing volume and almost no human entries: controllers no shopper touches. Anything arriving through one is automation by construction, and rows carrying the red bot-only door flag are usually the strongest candidates for tightening. The flag reads from the exact landing dataset, so it is trustworthy even at modest volume.

Entry channel

The filter bar gains an Entry channel filter: which acquisition channel actually enters through each path, from the same landing data. "Which pages does Google Paid land on" and "which doors does email traffic use" are one selection each, and each option shows how many paths carry that channel.

Understanding *other

On some rows you'll see a path called *other. This is a catch-all for any paths below the top 24 traffic ranks in a given batch — Cloudflare Analytics Engine enforces a limit of 25 writes per batch, so we preserve the most important paths explicitly (checkout, login, cart endpoints always win regardless of volume) and roll everything else into *other to keep totals accurate.

Filters and search

• Range picker (top right): 30m · 1h · 2h · 6h · 24h · 7d · 30d. 30m and 2h are tuned for short experiments.
• Source picker: narrow to one Logpush source when you have multiple connected.
• Status / cache filters in the filter bar: narrow to e.g. "only 4xx paths" or "only cache-bypassed".
• Search: text match on the path prefix.

Related

• Pausing Alert Emails — if a spike floods your notifications.
• Path Traffic Spike Detector — automates what the Paths page shows you manually.