I'm getting a 403

[1xgamble]

I’m getting a 403 error that can’t get the sitemap since using Cloudflare. I set page rule and WAF rule. What should I do additionally?

page rules

cache rules

WAF
URI, contains, *.xml, skip

Note that DDos is turned off.

Please tell me solution and in detail.

[cbrandt]

When you get a block visiting your sitemap, what events do you see logged at Cloudflare Dashboard > Security > Events?

[1xgamble]

Thanks for the answer.

Below is a list of events. can you confirm?

[cbrandt]

On that panel, you need to filter either by your IP address or by the URI Path containing “sitemap”. Then check the column Service, it will tell you which feature is blocking your request for the sitemap.

[1xgamble]

Thanks for the quickly your response.

I just changed WAP from UPI to UPI path.

Currently, both WAP and Page rules are set. Where can I check if it’s working properly? I haven’t been able to solve it for several hours. Please help me.

[1xgamble]

page rules

SSL/TLS : Full
Under Attack Mode : off
robots.txt : uploaded

[cbrandt]

@1xgamble

Where can I check

As I told in my previous post, you should filter for either you IP address or “sitemap” in the Security Events panel.

If your WAF screenshot is for an exception (with the Skip action), I do not recommend that you match all XML files on your server, that’s too risky.

Instead, use as conditions:

Known-Bots ON
AND
URI Path contains “sitemap”

[1xgamble]

@cbrandt

Known-Bots ON
AND
URI Path contains “sitemap”

Thanks, Where do I change Known-Bots ON?
Changed from *.xml to sitemap.

And filtered by sitemap in event. Nothing is confirmed.

[1xgamble]

WAF

[1xgamble]

event filter

[cbrandt]

@1xgamble

Where do I change Known-Bots ON?

You need to click on AND to add a second condition, then pick the field Known Bot.

@1xgamble

event filter

After you visit the sitemap URL on your site, it should show there after a few minutes if it was blocked or skipped.

[1xgamble]

@cbrandt

After you visit the sitemap URL on your site, it should show there after a few minutes if it was blocked or skipped.

I changed

[1xgamble]

and I did what you said and it was confirmed in the event. Are there any problems now?

[cbrandt]

Good. It’s working now. Make sure to remove that Page Rule where you disable security for the XML files. (You can leave it on with the caching and performance part, but there’s no reason to disable security)

[1xgamble]

Deleted xml rule from page rules.

[1xgamble]

Thanks, but Still I can’t find sitemap in googld search console.

[cbrandt]

@1xgamble

googld search console

It may take a while. Check back tomorrow. That’s on GSC, not Cloudflare.

[1xgamble]

@cbrandt

It may take a while. Check back tomorrow. That’s on GSC, not Cloudflare.

Thank you very much. you are my hero!

[1xgamble]

I checked again and still get a 403 error.
However, if I pause cloudflare, the 403 error disappears and the sitemap works normally.
It looks like you need a different setup. can you help me?