Black Friday is 27 November: a three-week countdown for a shop that cannot go down

Black Friday 2026 is on 27 November, which is three weeks and one day from the publication of this article. Adobe expects US shoppers to spend $12.9 billion online that day, up 9.2% on 2025, and $15.1 billion on Cyber Monday, 30 November. Last year’s actuals were records too: $11.8 billion and $14.25 billion. Shopify’s merchants took $5.1 million a minute at the peak, which came at one minute past noon Eastern on the Friday.

None of those numbers will be yours, and that is the point. The question for any shop with a date circled on the calendar is not how big the day is for the industry. It is whether your site can take your own busiest hour, multiplied by whatever your promotion adds, without the checkout slowing to a crawl at the moment it matters most. Three weeks is enough time to find that out and act on it, if the weeks are used in the right order.

The numbers behind the day

The spike is steeper than the total suggests. Queue-it’s analysis of 2.4 billion visits across 138 retailers in 31 countries puts Black Friday 2025 at 77.5 million web visits, 78% above the 43.5 million of an average October Friday, and six million more than any other day of the season. Cyber Five traffic rose 15.5% year on year. Those are visits across a day; the hour-by-hour curve is far sharper, because deals go live at announced times and email sends land in the same minute.

Most of it is on a phone. 70% of Cyber Five retail visits came from mobile devices in 2025, up nine points. Mobile users are less patient with a slow page and more likely to refresh, and a mobile checkout has more steps to break.

A large share is not human. 28% of Cyber Five requests came from a bot or a data centre, by Queue-it’s count, down from 36% in 2024. Cloudflare saw bot traffic rise fourfold on Black Friday 2024, with bots at 29% of its network traffic that day. Scalpers, price scrapers and inventory hoarders arrive with the shoppers, and they do not refresh politely. Our guide to AI agent traffic covers the newest arrivals in that crowd.

The failures are public. Best Buy’s site went dark for 44 minutes on Black Friday morning 2014 after what the company called a concentrated spike in mobile traffic. On Black Friday 2025 it went down again for some shoppers, with Downdetector reports in the low thousands and no explanation from the company; Queue-it’s report notes Best Buy and Target among the season’s crashes. A shop the size of Best Buy survives a lost hour. A shop that makes a fifth of its year that weekend may not.

What breaks first, and why it is never the home page

A shopping spike does not load every part of a site equally.

The home page, category pages and product images sit in a content delivery network and are served from cache to almost any number of people. They are not where the outage starts. The outage starts where every request is different: product search, the cart, the checkout, the stock check and the payment call. Each of those reaches the database or a third-party service, and each of those has a ceiling that is lower than the web servers’ and slower to raise.

Three ceilings catch most shops. The database connection pool fills, after which every web server queues behind the same handful of connections and adding servers changes nothing. The payment gateway and the login provider have rate limits and their own busy days; your checkout inherits whichever is lower. The stock service, if it checks inventory on every cart update, becomes the slowest step on the page just as everyone adds the same item.

Then the refresh storm starts. A page that takes eight seconds gets reloaded at five, and the reload is a new request. We described the mechanism in Temple’s launch-night crash, where an order page folded minutes after a founder’s announcement; a Black Friday email send does the same thing to a shop at 9 am, except the announcement goes to everyone on the list.

The countdown: what to do in each week

This week, 5 to 12 November: measure and test

Estimate the peak hour. Open last year’s analytics and find the busiest hour of Black Friday weekend, in sessions. If you did not trade then, use your busiest hour ever. Multiply by the growth you expect from this year’s promotion, and by a share for the email send landing at once. Convert sessions to concurrent users with a simple rule: sessions in the hour, times the average session length in minutes, divided by sixty. A shop with 6,000 sessions in the hour and five-minute visits has about 500 people on the site at once. Set the test target at double that.

Run a load test at the target. You want the response time of the checkout path at that concurrency, its 95th percentile rather than its average, and the error rate. A checkout whose typical request takes a second but whose slowest five per cent take nine is a checkout that will lose the shoppers who matter.

Run a stress test to the breaking point. Keep raising the load until the site slows, then until it fails. Write down both numbers and what the failure looked like: slow pages, errors at the payment step, a database that stopped answering. That is your margin, and the shape of the failure tells you which ceiling you hit. Our explainer on load, stress, spike and soak tests sets out what each one measures.

Ask your providers. Email your payment gateway, your search provider and your email-sending service with your expected peak and ask what burst they will accept. Most have a published limit and a process for raising it, and the process takes days.

Next week, 12 to 19 November: fix, protect, retest

Fix the first ceiling you hit. Usually one of: raise the database connection pool and the instance size; cache the catalogue and the search results; take the stock check out of the cart update and do it once at checkout; move the confirmation email to a queue so a slow mail service cannot slow the order.

Put bot protection in front of the shop. Your CDN or a bot-management service can challenge scrapers and rate-limit the paths bots hit hardest, usually search and add-to-cart. With more than a quarter of requests coming from non-humans, this alone can recover a third of your capacity.

Set up outside monitoring. An uptime check from outside your network, every minute, on the home page and on the checkout, with alerts to at least two people’s phones. Internal dashboards go quiet exactly when the site does.

Retest. Run the load test and the stress test again. The breaking point should have moved. If it has not, the fix hit the wrong ceiling.

Decide the fallback. If the breaking point is still below the expected peak, choose now what shoppers see when you are full: a waiting room that holds their place, a simplified order form, or a plain page that says when to come back. An error page loses the sale and multiplies the load.

The final week, 20 to 26 November: freeze and rehearse

Freeze. No deployments, no plugin updates, no theme changes, no new apps from 20 November. Every outage story has a change in it. Patch a confirmed security flaw if you must; nothing else.

Write the runbook. One page: who is on watch for each shift, how to raise capacity, how to turn on the waiting room, the payment provider’s emergency contact, the words you will post if the site goes down, and who posts them. Rehearse it once, with the person on the night shift.

Raise capacity ahead of the ramp. Deals that open on Thanksgiving evening in the US mean traffic from the night of the 26th. Scale the web tier and the database up on the afternoon of the 26th, not when the alert fires. Auto-scaling adds capacity minutes after load rises; for a spike you can see coming, that is minutes too late.

Run a final load test on the 24th or 25th. Against the frozen site, at the target. This one is to confirm, not to discover.

The four days, 26 to 30 November: watch and do not touch

Keep the capacity up through Cyber Monday. Keep a person watching the monitor from the first email send until the evening peak passes each day, with Shopify’s noon-Eastern peak as the warning of when the sharpest minute tends to come. Watch the payment provider’s status page as closely as your own. Say something in public within ten minutes if the site goes down; a short, honest note stops the refreshing. Change nothing until the morning of 1 December.

After: lower the capacity, keep the numbers

Scale back down on 1 December. Write down the real peak, the slowest hour, any errors and what the stress test predicted. Next year’s estimate starts from that page.

The two numbers that decide everything

Strip the plan back and it rests on two measurements: the load at which the site starts to slow and the load at which it fails. A shop that knows both can decide, with evidence, whether it needs more capacity, a waiting room or nothing at all. A shop that knows neither is guessing, and the guess is tested in public at the busiest hour of the year.

This is the gap BCDRPulse was built for. You verify the domain by adding a DNS record, so the platform can only ever test a site you own, then run a load test at the target you worked out above and read the checkout’s slowest responses and its error rate. A stress test keeps raising the pressure until the site degrades and fails, and reports where and how. For a shop expecting hundreds or thousands of concurrent buyers, the cloud load and cloud stress tests on the Business plan run from dedicated infrastructure at that scale and record how quickly the site recovers when the pressure lifts, which on Black Friday is the difference between a slow ten minutes and a lost morning. Free uptime monitoring does the outside watching, every five minutes on the Free plan and every minute on the paid ones, with email and webhook alerts the moment the checkout stops answering. A security scan the week before catches the expired certificate or missing header that would otherwise appear on the most-visited page of your year.

What the platform does not do is script a shopper’s journey through your particular checkout, so pair its results with your own walk through the cart and the payment step under load. And it does not fix the ceiling it finds; it finds it three weeks early, which is the only time a fix is cheap.

Checklist

This week

• Peak-hour estimate from last year’s analytics, doubled, written down as a concurrency target
• Load test at the target: checkout 95th percentile and error rate recorded
• Stress test to failure: the slow point, the failure point and the failure mode recorded
• Payment, search and email providers asked for their burst limits

Next week

• First ceiling fixed: connection pool, caching, stock check moved, email queued
• Bot protection and rate limits on search and add-to-cart
• External uptime monitoring on the home page and checkout, alerts to two phones
• Retest, and the breaking point moved
• Fallback chosen and built: waiting room, simple order form or holding page

Final week

• Change freeze from 20 November
• One-page runbook with shifts, scaling steps, provider contacts and the outage message
• Capacity raised on the afternoon of 26 November, database included
• Confirmation load test on the 24th or 25th

The four days

• Person on watch through each day’s peak
• Payment provider status page open
• Public note within ten minutes of any outage
• Nothing deployed until 1 December

The bottom line

The industry will set records on 27 November whether or not your site holds. Adobe’s forecast and Shopify’s noon peak describe the weather; your own two numbers describe the roof. Measure them this week, fix the first ceiling next week, freeze the week after, and spend Black Friday watching a site you already know can take it.