Your site is protected by security rules at Cloudflare, before visitors ever reach your server. They stop a huge amount of junk traffic: bots, scrapers, password guessers, spam. Every so often, though, they catch a real person. Here’s why, and what to do.
What The Rules Do
In plain English:
- Known good services get waved through: search engines, my management and backup tools, and the services your site depends on.
- Aggressive bots and known bad sources are blocked: abusive crawlers, scrapers, many AI crawlers, and attack traffic.
- Some visitors get a quick check (a “Verify you are human” page that usually passes by itself in a second or two): visitors from countries outside your audience, and traffic coming through data centers, cloud networks and many VPNs. Real people pass it. Bots usually don’t.
The list of countries is set for your site. If your audience includes countries that are getting challenged, just tell me and I’ll add them.
Why A Real Person Gets Caught
- They’re on a VPN or a privacy service. VPN traffic comes from data centers, which is where most bots live too.
- A browser extension is interfering (some security and privacy extensions do).
- They’re traveling, or connecting from a country outside your usual audience.
- An outside service is trying to talk to your site. Payment processors, email services, booking tools, “link preview” bots from social media. These run on cloud networks, so they need to be explicitly allowed. If you’ve connected a new service and it isn’t working, this is a likely reason.
“Suspicious Activity Detected” On A Form
If a form on your site says something like “Suspicious activity detected. Form submission blocked”, that’s usually not the Cloudflare rules. It’s the form’s own spam protection, and the most common cause is a page that was cached with an expired security token. It’s quick for me to fix, and important to tell me fast, because it can block every visitor from using that form.
About form spam in general: your forms use invisible spam protection, so visitors don’t have to solve puzzles. Some spam still gets through now and then. That’s normal. If it becomes a flood, let me know and I’ll tighten things up.
What To Send Me
If someone gets blocked or challenged, the most useful thing is the Ray ID. It’s a short code at the bottom of Cloudflare’s block or challenge page (looks like “Ray ID: 8f2a1b3c4d5e6f70”). With it, I can look up exactly which rule stopped them and why.
Post in Basecamp with:
- A screenshot of the page they saw (with the Ray ID visible)
- The page address they were trying to reach
- Roughly when it happened, and whether they were on a VPN
If an outside service (a payment processor, a booking tool, an email service) needs to reach your site, tell me which service and what it does. I’ll make sure it’s allowed through.
About AI Search
The default rules block many AI crawlers from copying your content. If you’d like your site to show up in AI-powered search and answers, let me know. That can be adjusted per site.