Hi folks, a user of my website, shmax.com, reports intermittent 403 errors. I’ve read the official Cloudflare tips for addressing 403 issues, but the material seems to be geared towards general configuration or browser issues, but in my case the issue only happens very rarely (once every 3-4 days).
I asked the user to see if he could capture the headers in Chrome developer tools, and he submitted this:
I didn’t received any errors when I visited the page. Also, sending the headers or the 403 error code will not help much in this case, if this really is Cloudflare’s thing.
You need your visitor to get this cf-ray and send to you. Please note, that the logs vanish after 24 hours on most plans. So you need to get the cf-ray and check it on the same day.
Also, If you can ask your user to take a screenshot of the error page would be very useful. What error page is him receiving? An 1X error for example.
But that’s where we’re at, already. He replicated the error, sent the information, and there’s nothing in the Security events log at all. Is it possible to trigger a 403 for some other reason than security reasons? What other logs are there to look at?
Cloudflare does not generate a 403 error, it’s something on your origin or between your origin and visitors to your site. Did you follow the 403#CommunityTip QuickFix ideas?
I am also unable to replicate the error, can you replicate the error @shmax? Are the visitors reporting the error all from the same country (quickfix idea 3). The next time you get a report, ask the visitor to try a different browswer (quickfix idea 2). And, can you share a screenshot (#6)
And, I’d also check the quickfix ideas for 526 error to make sure the orgin certificate is ok with your Full security setting. Does the value of your CNAME record called shmax.com load properly for you?
Well, that doesn’t seem to agree with the material you linked to, which says:
“With the exception of requests that violate WAF rules or subdomains that are not covered by a certificate”, meaning it DOES generate 403 in some cases.
We also see “server: Cloudflare” in the response body I originally posted.
Finally, I have inspected the AWS logs in detail each time I receive a 403 report, and there is nothing there, which seems to be a pretty strong clue that the request is never getting as far as my server.
It sure seems to be happening at the Cloudflare level.
I read over the community tips, and again, all that material seems to be solving config or general browser issues, but none of those seem to apply to my case, where the problem is only rare and intermittent (meaning, everything works just fine 99% of the time, so there’s no reason to expect that changing browsers or fiddling with DNS settings is likely to change anything).
But I am interested in the “black & white” vs “Cloudflare branding” distinction, so I’ll ask the user to do his best to secure a screenshot of the displayed content as well as the header information the next time it happens.
Where cf serves the 403, you will see a cf branded page
Getting a screen shot from an affected visitor will help. Having them immediate try from a different browser/clearing cache, et al will also help diagnose.
This was in Chrome. He then tried in Edge and didn’t have any issues, but I’m not sure if that really proves anything, as we’ve seen in the past that 403 problems tend to disappear on their own on subsequent refreshes.
I never get an error when I visit the page. Please, ask your client to access your website through another browser, without any extensions, etc. And ask him if the problem persists. If yes, then you must check your logs again or/and ask help from your host provider to see if they can assist you.
