Capture the failing URL, HTTP method, UTC time, Ray ID and a safe description of the action. Do not include passwords, session cookies or a full sensitive request body in public troubleshooting notes.

1. Open Security > Analytics and the Events tab for the relevant zone. Narrow the time window and filter using available Ray ID, path, source or action fields.
2. Inspect the matching event’s service and rule identifier. Distinguish a managed rule from a custom rule, rate limit or bot product.
3. Reproduce the action in a controlled session and confirm it is legitimate before changing protection.
4. For a managed-rule false positive, use the supported exception workflow scoped to the specific rule and request conditions. For a custom rule, correct its expression.
5. Retest the legitimate action and a safe matching control, then monitor the exception to ensure it does not bypass unrelated protection.

The legitimate request should succeed while the intended defensive rule remains active elsewhere. Record the exception’s reason and review date.

No event in a sampled view does not prove Cloudflare was uninvolved. Narrow the time range and inspect available logs. Bot Fight Mode has different bypass limitations from WAF managed rules, so a generic Skip rule may not solve it.

Usually a specific endpoint and rule exception is clearer. Shared or changing addresses can unintentionally exempt other traffic or stop helping the original user later.

• Creating a narrowly scoped Cloudflare WAF custom rule
• Choosing Cloudflare bot controls that fit the site and plan
• Reading Cloudflare security events for an incident
• Adding Cloudflare Turnstile with mandatory server-side verification

• Cloudflare: Waf Exceptions
• Cloudflare: Security Events