Bypass all security relevant mechanism for specific SaaS Origin servers!?

[CLAG1]

What is the name of the domain?

example.com

What is the error number?

Sometimes getting: “HTTP/1.1 403 Forbidden”

What is the issue you’re encountering

We use a few SaaS services which need to access our server/website to either trigger a specific action (e.g. calling wp-cron.php of our Wordpress Installation to start Cronjobs) or to pull images from our server to perform specific analysis. Those services can access the mentioned ressources only partially - the logs show that only every second request is successful. The other requests are blocked and return “HTTP/1.1 403 Forbidden”.

What steps have you taken to resolve the issue?

We have already configured the SaaS requests IP addresses and UserAgents as exclusion-rules in WAF, as well as set the same Origin IPs and the UserAgents as specific Configuration Rules with Security Threshold “Effectively Off” - and still those services sometimes report/log "“HTTP/1.1 403 Forbidden” access errors.

How can this be nailed down further?

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full

[Laudian]

You can check why the requests were blocked here: https://dash.cloudflare.com/?to=/:account/:zone/security/events

[CLAG1]

Thanks!
Weird, from there it looks as if the rule (specific to my Cronjob trigger provider EasyCron) work just fine and are allowed everytime:

Even though on the EasyCron panel it suggests that every second run yields “403 / Forbidden”.

Now I’m quite confused!

[Laudian]

If you look further down in the activity protocol, it all says skipped?

In that case, the 403 block would likely be from your origin server. Did you check your server logs to see what status was returned?

[CLAG1]

Wow, damn, you are right! Would never have thought of that - but yes, indeed it looks like the origin server triggers this. Not sure how and why and every second requests comes through. Very weird indeed!!!