How-to
Path Explorer
Rank path prefixes by traffic volume, 499/4xx rate, and cache bypass to surface abuse-sensitive endpoints (checkout, login, API).
Jump to section
What it shows
The Paths page ranks the path prefixes your site receives traffic on, across every dimension that matters for spotting abuse — total requests, bytes served, 499 rate, 4xx rate, bypass rate, and the ASN sending the most traffic to each path.
Click any row to drill into the path detail page, which shows which ASNs are hitting that path, a status-class timeseries, cache breakdown, and user-agent families — everything you need to decide whether a path is under attack.
When it's useful
- Incident triage. Sort by 4xx rate and look for a payment-submit or login endpoint near the top with >5% errors. Card-testing and credential stuffing live there.
- Capacity planning. Spot endpoints consuming disproportionate bytes or origin time.
- Cache tuning. High bypass rate on a path that should be cacheable points to a Vary-header or TTL misconfiguration.
- Bot detection. Unusually-high bytes-per-request paired with low 2xx is a probing signature.
Quick-find pills
The row above the table has one-click keyword filters — Payment, Checkout, Submit, Cart, Account, Login, Order, API. Click a pill to pre-fill the search box. "Submit" is the best single-keyword dragnet for SFCC sites — nearly every checkout controller contains "Submit" in the action name (CheckoutServices-SubmitPayment, COBilling-Submit, etc.).
Understanding *other
On some rows you'll see a path called *other. This is a catch-all for any paths below the top 24 traffic ranks in a given batch — Cloudflare Analytics Engine enforces a limit of 25 writes per batch, so we preserve the most important paths explicitly (checkout, login, cart endpoints always win regardless of volume) and roll everything else into *other to keep totals accurate.
Filters and search
- Range picker (top right): 30m · 1h · 2h · 6h · 24h · 7d · 30d. 30m and 2h are tuned for short experiments.
- Source picker: narrow to one Logpush source when you have multiple connected.
- Status / cache filters in the filter bar: narrow to e.g. "only 4xx paths" or "only cache-bypassed".
- Search: text match on the path prefix.
Related
- Pausing Alert Emails — if a spike floods your notifications.
- Path Traffic Spike Detector — automates what the Paths page shows you manually.