Cloudflare configuration for Hubbee

Cloudflare sits in front of your WordPress site and routinely challenges automated requests. Hubbee makes regular small requests to /wp-json/bz/v1/* — exactly the pattern Cloudflare’s defaults treat as suspicious. The fix is a single Skip rule that explicitly allows our path through.

How to recognise the problem

Run the diagnostic on the Connect step. A Cloudflare block typically produces:

• cloudflare_challenge — body contains “Just a moment…” or “Checking your browser”
• HTTP 403 on /wp-json/ with the Cloudflare ray-ID header (cf-ray)
• HTTP 503 with a cf-mitigated: challenge header

Skip rule (recommended for most sites)

Cloudflare Dashboard → your site → Security → WAF → Custom rules:

1. Click + Create rule
2. Name: Hubbee REST allow
3. Field: URI Path · Operator: contains · Value: /wp-json/bz/v1
4. Action: Skip (then pick the products to skip: WAF Managed Rules, Bot Fight Mode, Rate Limiting Rules, Super Bot Fight Mode if available on your plan)
5. Deploy

The rule applies in < 30 seconds. Retry the connection from Hubbee.

Bot Fight Mode specifically

If you are on the Free plan and don’t have access to custom Skip targets, disable Bot Fight Mode on the /wp-json/* path:

1. Security → Bots → Configure Super Bot Fight Mode (or Bot Fight Mode on the Free plan)
2. Either turn it Off for the whole site (broad), or
3. On Pro+ plans: use Custom rules (see above) to scope the rule

Page Rules (legacy)

If your zone still uses Page Rules (deprecated in favour of Cache Rules + WAF Custom Rules), add:

• URL: *example.com/wp-json/bz/v1/*
• Setting: Security Level → Essentially Off
• Setting: Browser Integrity Check → Off

Use the new Custom rules instead whenever possible — Page Rules are scheduled for deprecation.

Rate Limiting

Cloudflare’s Rate Limiting product can also block legitimate Hubbee traffic if you have a low threshold on /wp-json/*:

1. Security → WAF → Rate limiting rules
2. Check any rule that matches /wp-json/*
3. Either exclude /wp-json/bz/v1/* from the rule, or raise the threshold to 60 requests/minute (Hubbee’s max push burst is ~30 req/min during bulk operations)

Page Cache

Cloudflare’s Auto-Cache should not cache /wp-json/* paths — they return personalised, authenticated content. The default behaviour is correct. If you customised your caching policy:

1. Caching → Cache Rules
2. Confirm no rule sets cache TTL for /wp-json/*
3. If a rule exists, add an Exclude clause: URI Path contains /wp-json/

API Shield

If you use Cloudflare API Shield:

• Add /wp-json/bz/v1/* to the allowed paths schema
• Or disable API Shield for the host until you have an OpenAPI schema ready

Verifying the fix

After saving any Cloudflare rule:

1. Wait 30 seconds for propagation
2. In a private browser tab, hit https://your-site.com/wp-json/bz/v1/ping → expect HTTP 401 (the endpoint exists, just rejects unsigned requests). 403 means Cloudflare is still blocking.
3. Hubbee dashboard → Sites → your site → Run diagnostic → expect problem: null.

If Cloudflare still blocks after the Skip rule is in place, check Security → Events for blocked requests against the Hubbee path — Cloudflare will name the exact ruleset that fired.