All the IPs used by the Payment Gateway are allowlisted. I also see, that the WAF rule does work as expected. However, when enabling the Basic Default Bot Blocking options, no payment confirmation can received anymore
Was the site working with SSL prior to adding it to Cloudflare?
Ah, it looks like you’re trying to skip within Managed Rules, instead of Custom Rules. Managed Rule exceptions are only for skipping Managed Rules. Custom Rules would look like this: