Issue with WooCommerce API access – Need to lower Security Level or allow CJ IPs

What is the name of the domain?

What is the error message?

“Your store currency has been changed. Please refresh before syncing again.”

What is the issue you’re encountering

Issue with WooCommerce API access – Need to lower Security Level or allow CJ IPs

What steps have you taken to resolve the issue?

Hello Cloudflare Community,

I am facing an ongoing issue with integrating my WooCommerce store (https://benzarahub.com) with the CJ Dropshipping platform.

CJ is unable to sync products to my store, and after multiple troubleshooting steps (including API setup, refreshing settings, and even creating a new CJ account), the error persists. Their team mentioned that the problem may be caused by Cloudflare’s security settings blocking their API requests.

Here’s what I’ve tried:

Disabled “Under Attack Mode”

Checked SSL settings

Created firewall rules

Tried to allow access via IP

Unfortunately, the issue remains unresolved. I suspect Cloudflare is blocking or delaying CJ’s API calls. I’m currently on the free plan, so I don’t have direct access to advanced support.

What I need:

Guidance on how to allowlist CJ’s IPs or endpoints properly.

How to set the security level to “Low” for API-related paths (like /wp-json/wc/)

Any suggestions on how to bypass or fine-tune Bot Fight Mode to allow this integration.

Here’s the error they get:

“Your store currency has been changed. Please refresh before syncing again.”

I appreciate any help from moderators or experts. Thank you in advance!

Best regards,
Sanae

What are the steps to reproduce the issue?

Even after refreshing and reconfiguring everything (API, Cloudflare, WooCommerce settings), the error still appears. CJ support told me the issue may come from Cloudflare blocking or delaying API communication.

Screenshot of the error

Check the reason the requests are being blocked in your security event log and then adjust your WAF as needed…
https://dash.cloudflare.com/?to=/:account/:zone/security/events

If requests are being blocked by Bot Fight Mode, note that BFM on a Free plan can’t be overridden by WAF custom rules so instead you will need to do one of:

  • disable Bot Fight Mode
  • use IP Access Rules to allowlist IPs instead of WAF custom rules
  • upgrade to a paid plan where custom WAF rules can skip Super Bot Fight Mode