Sign into an existing account

Aside from writing/modifying a browser to reject webp and webm, HTTP should already address the format problem via the Accept header and Not Acceptable status. What should happen is that a user can set the browser to send "Accept: image/png, image/jpg" when getting images, a HTTP compliant server reports if it can't, and a rogue server trying to send something else doesn't work. Trying to spoof the type should just cause image parsing to fail.

If switching png for webp ever works then the browser and server are as bad as each other. The CDN server could alter the image of course, but that is just the classic hotlink problem which has been around for decades (ref. "The requested image has been deleted", or annoyed sysadmins replacing hotlinked stuff with porn).

Is there a solution?

Very succinct, very accurate.

It sucks but I don't know of a better way for handling a DDOS attack.

If you had more resources than the average webhost then you could try to simulate wack a mole by changing how domain licenses function or have a script that detects a DDOS and just pastes the site back up to a different server on a different IP and changes where the the URL directs the intended users essentially this would double your hosting costs but with prevelence of CDNs it might dissuade attackers. But I imagine webhosts would advertise the feature and regular attackers would know to keep trying.

Google amp does the same spy thing.

Any Certificate Authority (CA) that comes pre-installed in your browser is capable of issuing a security certificate that is capable of being used for this sort of man-in-the-middle attack.

Web security is designed to keep out low level arbitrary attacks, but the big guys can own almost anything they want at any time.

(((They))) wrestled control of the DNS system years ago to make this type of attack easier for themselves.

This is dumb. Cloudflare doesn't randomly break encryption. Website owners CHOOSE TO configure cloudflare to be the web facing certificate to a. obscure the real site ip and b. Protect against ddos.