June 24. Client messages me: multiple sites throwing 504s. The host's status page confirmed emergency maintenance on that server. Easy answer. Wait it out. Four things didn't fit. Several sites went down at the same moment. There was no advance notice. The domains were showing as disconnected from their sites. And we had only just upgraded that server to Enterprise. So I kept pushing support. When it was clear I wasn't getting a straight answer, I went around them and got an actual engineer on the line. 🔍 The real cause: the server's IP had been hit with a DDoS attack, and their network team null-routed it to protect the rest of their infrastructure. The block took the sites down. Nothing was wrong with the sites at all. The fix is all 55 sites behind Cloudflare. It masks the origin server's real IP and filters attack traffic before it reaches the host. The free tier is enough. ⚠️ The catch matters more than the fix. It only works if every site is behind it. A handful left exposed publish the origin IP again and the whole server is back on the table. Partial coverage is no coverage. If your host tells you maintenance and the timing feels wrong, ask them directly whether the IP has been null-routed. Different question, different answer.