We ran into an issue in the last 2 weeks where Webhooks coming from Intuit Quickbooks Online service to our app were getting blocked. Outgoing from us to QB was working fine still.
Narrowed it down to Cloudflare, and tried adding a Firewall rule to Allow that traffic, but it was till being blocked. I had read a couple posts here that Super Bot Fight Mode (in Firewall → Bots → Configure in the top right corner) was causing issues for others with Webhooks for different services. I changed that from Challange to Allow and the Webhooks started working.
I’m a bit of a newbie, but I would NEVER have expected a “Bot” setting to block a webhook, and certainly not from someone like Intuit.
This feature should have a warning in place, and also it should have a way for us to add a rule to allow traffic we want.
Adding this here in case anyone else runs into it, so they know how to fix it.