Metorik Docs
Store Connection Errors

Cloudflare is blocking Metorik

What this error means

Metorik syncs your store through the WooCommerce REST API, so our servers send requests to addresses like your-store.com/wp-json/wc/v3/. Cloudflare sits in front of your site and is stopping those requests. It doesn't know Metorik is a trusted service, so you need to tell it.

You'll see one of two messages in Metorik:

  • Cloudflare's bot check is blocking Metorik: Cloudflare is showing us a "Just a moment..." challenge page, which our servers can't complete.

  • Cloudflare is blocking Metorik: Cloudflare is blocking us with a 403 "Access denied" page.

The fix below works for both.

Not sure Cloudflare is involved? In Cloudflare, go to DNS → Records. If your store's record shows an orange cloud (Proxied), your traffic goes through Cloudflare (how proxy status works).

Cloudflare custom rules don't have an "Allow" action (that belonged to the old Firewall Rules). Instead, the Skip action lets matching requests bypass the security features you choose (Skip action). Cloudflare recommends custom rules over IP Access rules for this.

  1. Log in to Cloudflare and select your store's domain.

  2. Go to Security → Security rules (in the older dashboard, Security → WAF → Custom rules).

  3. Select Create rule → Custom rules.

  4. In Rule name, enter Allow Metorik.

  5. Under When incoming requests match, select Edit expression and paste the expression below.

    (ip.src in {23.239.31.174 45.33.123.9 45.33.116.36 96.126.113.196 173.255.205.248})

  6. Under Then take action, set Choose action to Skip.

  7. Under WAF components to skip, tick every box, including All remaining custom rules, All rate limiting rules, All managed rules and All Super Bot Fight Mode rules.

  8. Select More components to skip and tick every box there too (this includes Browser Integrity Check and Security Level).

  9. Select Deploy.

  10. If you have other custom rules, move this one to the top of the list, because Cloudflare runs them in order.

The Free plan allows 5 custom rules (plan limits), so if you've used them all, edit an existing one.

On the Free plan? A Skip rule can't bypass Bot Fight Mode, so if it's on, turn Bot Fight Mode off too (see below).

Other things to check

Bot Fight Mode (Free plan)

This is a common cause on Free plans, and it's the one thing a Skip rule can't bypass (Cloudflare explains why). So if Bot Fight Mode is on, the Skip rule alone won't fix this. You have two options:

  • Turn it off (recommended): go to Security → Settings, filter by Bot traffic, and turn Bot fight mode off (older dashboard: Security → Bots). Bot Fight Mode docs

  • Or add IP Access rules for Metorik's IPs (see below). Cloudflare says Bot Fight Mode can't trigger for a request that matches an IP Access rule, but some Free-plan users report it still does, so if you still see the error, turn Bot Fight Mode off.

Super Bot Fight Mode (Pro and Business plans)

The quick fix already covers this, as long as All Super Bot Fight Mode rules is ticked. Cloudflare's own advice is to use a Skip rule for exceptions (Super Bot Fight Mode docs).

Rate limiting rules

Metorik sends a lot of requests during your first sync, so a rate limiting rule can block us partway through. The quick fix covers this as long as All rate limiting rules is ticked.

Under Attack mode

Under Attack mode shows a "Checking your browser" page to every visitor, including Metorik. Ticking Security Level in step 8 should skip it for Metorik, and an IP Access rule set to Allow also bypasses it. If your site isn't under attack, turn it off: look for Security Level under Security → Settings (older dashboard: the Under Attack Mode toggle on your domain's overview page). Under Attack mode docs

IP Access rules

An IP Access rule set to Allow excludes that IP from security checks, including Browser Integrity Check, Under Attack mode and the WAF (actions). Each rule holds one IP, so you'll create five.

  1. Go to Security → Security rules and select Create rule → IP access rules (older dashboard: Security → WAF → Tools).

  2. In IP, IP range, country name, or ASN, enter 23.239.31.174.

  3. Set Action to Allow.

  4. Set Zone to this website only.

  5. Add the note Metorik and select Create.

  6. Repeat for 45.33.123.9, 45.33.116.36, 96.126.113.196 and 173.255.205.248.

Cloudflare only shows IP access rules in the Create rule menu once you have at least one (details). If it's missing, turn off Bot Fight Mode instead, or ask us for help.

Your web host runs Cloudflare for you

Some hosts, such as Kinsta and Cloudways, run Cloudflare for you. If you don't have your own Cloudflare login, ask your host's support team to let these Metorik IP addresses skip Cloudflare's security checks: 23.239.31.174, 45.33.123.9, 45.33.116.36, 96.126.113.196 and 173.255.205.248.

See exactly what blocked Metorik

Go to Security → Analytics, open the Events tab and look for one of Metorik's IPs. The Service field shows which feature blocked it (Security Events).

Verify it worked

  1. Go back to Metorik, click Retry, enter your store address again and approve the connection.

  2. If the same error appears, check Security Events (above) to see what is still blocking us.

Still stuck?

Message us using the chat in Metorik and we'll take a look. Please include:

  • Your store's domain.

  • Your Cloudflare plan (Free, Pro, Business or Enterprise).

  • Whether Bot Fight Mode, Super Bot Fight Mode or Under Attack mode is on.

  • Whether your host manages Cloudflare for you.

  • A screenshot of the rule you created.

Further reading

Was this helpful?
Was this helpful?