Security troubleshooting

Start with the request ID and firewall event whenever available.

A legitimate request is blocked

Check:

• Firewall action
• Rule ID and rule name
• Whether the decision came from a platform protection or custom rule
• Client IP
• Path and method
• Country and ASN
• Rule order
• Recent firewall changes

If a custom rule caused the block:

1. Disable or narrow the rule.
2. Confirm traffic recovers.
3. Recreate the issue with the Log action.
4. Refine the conditions.
5. Re-enable enforcement.

Do not create a broad Bypass attack challenge rule until you understand which layers it does and does not skip.

A request is challenged unexpectedly

Check whether:

• Attack Mode is enabled
• A custom rule uses Challenge
• The client lacks a valid verification cookie
• The request uses a different hostname or deployment
• Cookies or JavaScript are blocked
• A privacy tool removes verification state

An API or webhook stopped working

Attack Mode and browser challenges are usually incompatible with machine clients.

Create a narrow Bypass attack challenge exemption based on strong signals such as:

• Trusted IP range
• Dedicated webhook path
• Dedicated API hostname

Continue validating webhook signatures in application code.

A browser is stuck in a challenge loop

Check:

• JavaScript is enabled
• Cookies are allowed for the hostname
• The system clock is approximately correct
• The hostname remains consistent across redirects
• Multiple domains are not switching between unprotected and protected hosts
• CSP is not blocking challenge assets

Use the request ID from the challenge page when contacting support.

A verified bot is blocked

Check:

• The bot is genuinely verified
• Customer rules do not explicitly deny it
• The request comes from expected infrastructure
• Allow verified bots is enabled for Attack Mode
• Custom Challenge rules do not match the bot first

Do not allow a bot solely by user agent when stronger verification is available.

A rule does not match

Check:

• The rule is active
• Rule order
• Exact path representation (normalized vs raw)
• Method
• Header spelling and key
• Case sensitivity
• Client IP source
• IPv4 versus IPv6
• Unknown geography
• Environment (production vs preview)

Use Log with one condition at a time to isolate the mismatch.

A rule matches too much traffic

Common causes include:

• contains used instead of equals
• Missing hostname condition
• Broad IP list
• Negated condition
• Incorrect AND/OR grouping
• Empty or missing header behavior
• Path normalization assumptions

Rule changes appear inconsistent by region

Check:

• Change timestamp
• Edge region in request logs
• Whether older requests were already in flight

Firewall changes propagate after a short delay. Escalate behavior outside that window with request IDs and regions.

Information to include with support

Include:

• Workspace and project
• Deployment ID
• Domain
• Request ID
• Approximate timestamp
• Client region
• Firewall action
• Rule ID
• Expected behavior
• Reproduction steps

Related guides

• Custom rules
• Attack Mode
• Firewall observability
• Report a vulnerability