User being blocked from my site by Cloudflare

[Sim]

Several of my users have reported being blocked from accessing my site by Cloudflare.

One of them was kind enough to report the Cloudflare RayID and I was able to use that to location the following information:


I don't think I have Bot Fight Mode enabled - so I'm not sure why these are blocking sites? This is a Pro account, so I have Super Bot Fight Mode options:



... any suggestions on what to look at to work out why this user is being blocked?

I have the following managed rules enabled:




... I note this was an email account confirmation action on XF 1.5

Any ideas?

 

[digitalpoint]

Disable Bot Fight Mode in Cloudflare.

Unless you are actually having a major issue with bots taking down your site, all it does it irritate legit users with false positives.

 

[Sim]

Disable Bot Fight Mode in Cloudflare.

Unless you are actually having a major issue with bots taking down your site, all it does it irritate legit users with false positives.

This is a Pro account, so I've got Super Bot Fight Mode, and from what I can tell, it's not actually enabled:

 

[whynot]

This is a Pro account, so I've got Super Bot Fight Mode, and from what I can tell, it's not actually enabled:

What does "Allow" mean?

 

[Mouth]

CF's new Trace functionality is quite good for tracking requests to your server and CF rules/action taken, perhaps this will help?

 

[Sim]

What does "Allow" mean?

The options are "Allow", "Block", "Managed Challenge" ... so Allow will mean "Allow this type of traffic to access the site"

 

[eva2000]

Cloudflare Free and Pro plan's Bot Fight Mode and Super Bot Fight mode lack finer grain controls so will catch legit users in definite bot class. So disable them. Only Cloudflare Enterprise plan's Bot Management product has the fine grain control to properly manage and tune bot requests.

 

[Sim]

So disable them

Any suggestion on exactly how to do that? From what I can tell, I don't actually have Super Bot Fight mode enabled?

 

[eva2000]

Any suggestion on exactly how to do that? From what I can tell, I don't actually have Super Bot Fight mode enabled?

Definitely Automated set to Allow which basically disables it from falsely blocking bots. Instead use WAF Firewall rules and rate limiting for better control.

 

[markku]

Definitely Automated set to Allow which basically disables it from falsely blocking bots. Instead use WAF Firewall rules and rate limiting for better control.

According to his screenshot, @Sim already had Definitely Automated set to Allow and this issue still happened...

 

[eva2000]

According to his screenshot, @Sim already had Definitely Automated set to Allow and this issue still happened...

In that case report the issue to Cloudflare tech support.

 

[⭐ Alex ⭐]

Several of my users have reported being blocked from accessing my site by Cloudflare.

In the meantime, I wonder if them using cloudflare warp would grant them a free pass.