At the advice of the hosting company, I enabled Under Attack mode on a couple of sites. This has reduced the malicious traffic but also has led to some issues with social previews from pages and their blog. When sharing a link, the social preview is essentially the Cloudflare challenge instead of the underlying page or post.
Is there a way to safely have social previews bypass the Under Attack challenge?
You’d make a firewall rule for the Known Bots selector (which means friendly bots like GoogleBot) with the Bypass action and then include Security Level in that bypass - since Under Attack Mode is just a security level.