You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/waf/troubleshooting/faq.mdx
+68-55Lines changed: 68 additions & 55 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,6 +26,74 @@ For more information on string syntaxes and escaping, refer to [String values an
26
26
27
27
If you are using a regular expression, it is recommended that you test it with a tool such as [Regular Expressions 101](https://regex101.com/?flavor=rust®ex=) or [Rustexp](https://rustexp.lpil.uk).
28
28
29
+
### Why are some rules bypassed when I did not create an exception?
30
+
31
+
If you have [SSL/TLS certificates](/ssl/) managed by Cloudflare, every time a certificate is issued or renewed, a [domain control validation (DCV)](/ssl/edge-certificates/changing-dcv-method/dcv-flow/) must happen. When a certificate is in `pending_validation` state and there are valid DCV tokens in place, some Cloudflare security features such as [custom rules](/waf/custom-rules/) and [WAF Managed Rules](/waf/managed-rules/) will be automatically disabled on specific DCV paths (for example, `/.well-known/pki-validation/` and `/.well-known/acme-challenge/`).
32
+
33
+
### Why is Cloudflare blocking a specific IP address?
34
+
35
+
Cloudflare may block an IP address due to various reasons:
36
+
37
+
-**Web Application Firewall (WAF) mitigation actions**: The Cloudflare WAF protects websites from various online threats, including malicious traffic, DDoS attacks, and common vulnerabilities. If your IP address is associated with suspicious or malicious activity, it might trigger the WAF and block requests.
38
+
39
+
-**High security settings**: The website owner might have set their Cloudflare security settings to a high level, making the filtering of incoming traffic stricter. In this situation, even legitimate users may get blocked or have to solve challenges.
40
+
41
+
-**Excessive requests**: Cloudflare may block an IP address if it detects an unusually high number of requests in a short period, in which case it will rate limiting subsequent requests. This is a protective measure against potential abuse or attacks.
42
+
43
+
-**Traffic from malicious bots**: Cloudflare employs bot detection mechanisms to distinguish between legitimate users and automated bots. If traffic from your IP address behaves like traffic from a malicious bot, it could get blocked.
44
+
45
+
-**Blocklisted IPs**: Cloudflare might block IP addresses listed on public blocklists due to their association with known malicious activities.
46
+
47
+
If your IP address is blocked, try the following:
48
+
49
+
-**Check Cloudflare Security Events**: Use the [Security Events](/waf/analytics/security-events/paid-plans/) log to check for specific reasons your IP might be getting blocked. Look for details on the type of threat or activity that triggered the block.
50
+
51
+
-**Contact the website owner**: If you are a legitimate user and your IP is wrongly blocked, contact the website owner or administrator. They may be able to allowlist your IP or investigate the issue further.
52
+
53
+
-**Verify your own website traffic**: Check for abnormal activity. If you manage a website behind Cloudflare, ensure that your site's traffic is legitimate and not triggering security measures inadvertently.
54
+
55
+
-**Check your IP reputation**: Verify whether your IP address is listed on public blocklists, such as [Project Honey Pot](https://projecthoneypot.org/). If so, take steps to address any issues that may have led to the listing.
56
+
57
+
-**Adjust your security settings**: If you are a website owner using Cloudflare, consider adjusting security settings to find the right balance between protection and accessibility.
58
+
59
+
## Bots
60
+
61
+
### How does the WAF handle traffic from known bots?
62
+
63
+
#### Caution about potentially blocking bots
64
+
65
+
When you create a WAF custom rule with a _Block_, _Interactive Challenge_, _JS Challenge_, or _Managed Challenge (Recommended)_ action, you might unintentionally block traffic from known bots. Specifically, this might affect search engine optimization (SEO) and website monitoring when trying to enforce a mitigation action based on URI, path, host, ASN, or country.
66
+
67
+
Refer to [How do I exclude certain requests from being blocked or challenged?](#how-do-i-exclude-certain-requests-from-being-blocked-or-challenged).
68
+
69
+
#### Bots currently detected
70
+
71
+
[Cloudflare Radar](https://radar.cloudflare.com/verified-bots) lists a **sample** of known bots that the WAF currently detects. When traffic comes from these bots and others not listed, the `cf.client.bot` field is set to `true`.
72
+
73
+
To submit a friendly bot to be verified, go to the [**Verified bots**](https://radar.cloudflare.com/traffic/verified-bots) page in Cloudflare Radar and select **Add a bot**.
74
+
75
+
For more information on verified bots, refer to [Bots](/bots/concepts/bot/).
76
+
77
+
:::note
78
+
79
+
There is no functional difference between known and verified bots. However, the known bots field (`cf.client.bot`) is available for all customers, while the verified bots field (`cf.bot_management.verified_bot`) is available for Enterprise customers.
80
+
:::
81
+
82
+
## Challenges
83
+
84
+
### Why Am I Being Challenged on a Cloudflare-Protected Site?
85
+
86
+
Cloudflare issues challenges to website visitors to protect against malicious activity such as bot attacks and DDoS. Key reasons include:
87
+
88
+
-**High Threat Score**: IP addresses with a high-risk score trigger challenges.
89
+
-**IP Reputation**: If your IP has a history of suspicious activity, it may be flagged.
90
+
-**Bot Detection**: Automated traffic resembling bots is filtered by Cloudflare.
91
+
-**Custom Firewall Rules**: Site owners may set rules targeting specific regions or user agents.
92
+
-**Browser Integrity Check**: Cloudflare verifies that browsers meet certain standards.
93
+
-**Challenge Passage**: Technologies like Privacy Pass reduce the frequency of repeated challenges.
94
+
95
+
To avoid repeated challenges, ensure your browser is up-to-date, disable any privacy tools that might block standard browser headers, or use a different network connection if your current one has a poor IP reputation.
96
+
29
97
### How do I exclude certain requests from being blocked or challenged?
30
98
31
99
In certain situations you want to enforce a blocking or challenging action but make an exception for specific types of requests.
@@ -89,61 +157,6 @@ Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large
89
157
- Expression: `(http.host eq "example.com" and cf.threat_score > 5)`
90
158
- Action: Block (or a challenge action)
91
159
92
-
### Why are some rules bypassed when I did not create an exception?
93
-
94
-
If you have [SSL/TLS certificates](/ssl/) managed by Cloudflare, every time a certificate is issued or renewed, a [domain control validation (DCV)](/ssl/edge-certificates/changing-dcv-method/dcv-flow/) must happen. When a certificate is in `pending_validation` state and there are valid DCV tokens in place, some Cloudflare security features such as [custom rules](/waf/custom-rules/) and [WAF Managed Rules](/waf/managed-rules/) will be automatically disabled on specific DCV paths (for example, `/.well-known/pki-validation/` and `/.well-known/acme-challenge/`).
95
-
96
-
### Why is Cloudflare blocking a specific IP address?
97
-
98
-
Cloudflare may block an IP address due to various reasons:
99
-
100
-
-**Web Application Firewall (WAF) mitigation actions**: The Cloudflare WAF protects websites from various online threats, including malicious traffic, DDoS attacks, and common vulnerabilities. If your IP address is associated with suspicious or malicious activity, it might trigger the WAF and block requests.
101
-
102
-
-**High security settings**: The website owner might have set their Cloudflare security settings to a high level, making the filtering of incoming traffic stricter. In this situation, even legitimate users may get blocked or have to solve challenges.
103
-
104
-
-**Excessive requests**: Cloudflare may block an IP address if it detects an unusually high number of requests in a short period, in which case it will rate limiting subsequent requests. This is a protective measure against potential abuse or attacks.
105
-
106
-
-**Traffic from malicious bots**: Cloudflare employs bot detection mechanisms to distinguish between legitimate users and automated bots. If traffic from your IP address behaves like traffic from a malicious bot, it could get blocked.
107
-
108
-
-**Blocklisted IPs**: Cloudflare might block IP addresses listed on public blocklists due to their association with known malicious activities.
109
-
110
-
If your IP address is blocked, try the following:
111
-
112
-
-**Check Cloudflare Security Events**: Use the [Security Events](/waf/analytics/security-events/paid-plans/) log to check for specific reasons your IP might be getting blocked. Look for details on the type of threat or activity that triggered the block.
113
-
114
-
-**Contact the website owner**: If you are a legitimate user and your IP is wrongly blocked, contact the website owner or administrator. They may be able to allowlist your IP or investigate the issue further.
115
-
116
-
-**Verify your own website traffic**: Check for abnormal activity. If you manage a website behind Cloudflare, ensure that your site's traffic is legitimate and not triggering security measures inadvertently.
117
-
118
-
-**Check your IP reputation**: Verify whether your IP address is listed on public blocklists, such as [Project Honey Pot](https://projecthoneypot.org/). If so, take steps to address any issues that may have led to the listing.
119
-
120
-
-**Adjust your security settings**: If you are a website owner using Cloudflare, consider adjusting security settings to find the right balance between protection and accessibility.
121
-
122
-
## Bots
123
-
124
-
### How does the WAF handle traffic from known bots?
125
-
126
-
#### Caution about potentially blocking bots
127
-
128
-
When you create a WAF custom rule with a _Block_, _Interactive Challenge_, _JS Challenge_, or _Managed Challenge (Recommended)_ action, you might unintentionally block traffic from known bots. Specifically, this might affect search engine optimization (SEO) and website monitoring when trying to enforce a mitigation action based on URI, path, host, ASN, or country.
129
-
130
-
Refer to [How do I exclude certain requests from being blocked or challenged?](#how-do-i-exclude-certain-requests-from-being-blocked-or-challenged).
131
-
132
-
#### Bots currently detected
133
-
134
-
[Cloudflare Radar](https://radar.cloudflare.com/verified-bots) lists a **sample** of known bots that the WAF currently detects. When traffic comes from these bots and others not listed, the `cf.client.bot` field is set to `true`.
135
-
136
-
To submit a friendly bot to be verified, go to the [**Verified bots**](https://radar.cloudflare.com/traffic/verified-bots) page in Cloudflare Radar and select **Add a bot**.
137
-
138
-
For more information on verified bots, refer to [Bots](/bots/concepts/bot/).
139
-
140
-
:::note
141
-
142
-
There is no functional difference between known and verified bots. However, the known bots field (`cf.client.bot`) is available for all customers, while the verified bots field (`cf.bot_management.verified_bot`) is available for Enterprise customers.
143
-
:::
144
-
145
-
## Challenges
146
-
147
160
### Do the Challenge actions support content types other than HTML (for example, AJAX or XHR requests)?
148
161
149
162
Previously, unless you customize your front-end application, any AJAX request that is challenged will fail because AJAX calls are not rendered in the DOM.
0 commit comments