I want to host an ActivityPub website with my domain using Cloudflare. The ActivityPub website requires requests between different external server software (e.g. Mastodon). I found the requests from other servers were blocked with “JS Challenge” by the Bot fight mode.
As I still have other websites hosted under this root domain and I don’t want to disable the Bot fight mode with risks, I tried adding Firewall rules to bypass requests with a specific Hostname. But I just found the whitelist I set in Firewall rules hasn’t affected the Bot fight mode. It keeps challenge requests from other servers.
Is there any way to solve this problem or could the Cloudflare team make the Firewall rules effective for Bot fight mode?