Cloudflare · infra · fg-0217

Webhooks and API clients get challenged by Cloudflare Bot Fight Mode and a WAF Skip rule does not help

Stripe or GitHub webhook deliveries fail with 403 and a challenge page

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Bot Fight Mode runs outside the Ruleset Engine, so WAF custom rules and Page Rules cannot skip it. It may challenge API and automated traffic that legitimately has no browser.

Fix

Turn Bot Fight Mode off for the zone, or use Super Bot Fight Mode (Pro and up) which supports Skip rules, or allow the sender's IPs with an IP Access rule.

Apply

Cloudflare dashboard > your zone > Security > Bots > Bot Fight Mode: Off

Affects: Cloudflare zones with Bot Fight Mode enabled (Free plan bot product), as of October 2026

Sources

https://developers.cloudflare.com/bots/get-started/bot-fight-mode/

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp