Bot fight mode blocking API connection - WAF whitelisting won't work

[navid1]

I am using a free Cloudflare plan for my wordpress/Woocommerce online store. For this I use an external shipping software solution: Billbee. Recently I noticed that Billbee can’t connect to my site anymore and I was able to trace the problem back to Cloudflare’s botfight mode.

I found this article referring to my problem:

Bot fight mode blocking my API client

Hi, I’m on a Cloudflare PRO plan and the Bot fight mode is super useful to me, it’s set to block every known bad bots. The problem is that I just launched an API on my website and it’s now blocking legitimate traffic from my API clients. It displays a message like this: " Please enable cookies. Sorry, you have been blocked You are unable to access domain"…etc Is there a way to disable this security on a particular set of URIs ? Without having to whitelist every single IP that needs to req…

As described in this post, I’ve already tried whitelisting the Billbee IP or User-Agent but without success.

(ip.src eq 159.69.228.174)

It seems as if the botfight mode would take effect before the firewall rules do.
In the picture above you can see the activity log with the bot fight mode turned off (9:41) as well as in the activated mode (10:07).
The firewall rule only takes effect when botfight mode is turned off.

Is there any other way i can whitelist my API connection and keep bot fight mode running?

[fritex]

Greetings,

Thank you for asking.

@navid1

As described in this post, I’ve already tried whitelisting the Billbee IP or User-Agent but without success.

@navid1

would take effect before the firewall rules do

would be IP Access Rules

IP Access rules · Cloudflare Web Application Firewall (WAF) docs

@navid1

Is there any other way i can whitelist my API connection and keep bot fight mode running?

Yes.

Since it’s related to the WordPress, I’d suggest you to whitelist your origin host / server / hosting IP address by navigating to the Security → WAF → Tools → IP Access Rules with the action “allow” for your Website and try again.

It knows to happen due to the WordPress using HTTP/1.0 and empty user-agent, therefore while executing WP-Cron or some other related JSON/REST API request via plugin.

Create an IP Access rule · Cloudflare Web Application Firewall (WAF) docs