Cloudflare through iframe embeds

Hello,

I currently have a WAF challenge setup on Cloudflare. However, this ruins every single iframe embed. See the image:


So in order to not cause this issue, I don't have the WAF challenge for all "/embeds/".

But some bots and bad traffic will still come through these embeds. How can I make this WAF work through iframe embeds?

What did you challenge specifically? All traffic? Did you try a managed challenge for threat score greater than 1? Sometimes managed challenge can cause problems if you’re challenging everything without whitelisting elements, files, user agents etc that are critical for website functionality. If you deploy a managed challenges for threat score greater than 1 that will sometimes not cause the same problems because it doesn’t automatically challenge everything.

Zombie Pop said:

If you deploy a managed challenges for threat score greater than 1

Click to expand...

Wow, This worked. @Zombie Pop I am so grateful. I reached out to Cloudflare support, nobody could help. The threat score worked perfectly. THANK YOU!

I wonder if this will block the proxy / fake traffic now. Debating on doing JS Challenge or Managed Challenge.

SaveFiles said:

Wow, This worked. @Zombie Pop I am so grateful. I reached out to Cloudflare support, nobody could help. The threat score worked perfectly. THANK YOU!

I wonder if this will block the proxy / fake traffic now. Debating on doing JS Challenge or Managed Challenge.

Click to expand...

Glad I could help. I’ve had my battles with cloudflare WAF.

Unfortunately it might not block everything but I bet it blocks the majority of it. You can see how much traffic it blocks by watching the rule.

What this represents is that there is some aspect of the iframe, or your website that you need to find and whitelist. If you can find the culprits that are causing the page not to load and whitelist those files, or urls, or whatever it is, you can secure the whole site and challenge all traffic coming to your server before it makes it to your server.

I still recommend that you deploy the Xframe header and a content security policy header. That will address other issues this might not totally solve.

Edit: as for JS challenge etc it will not be user friendly. I recommend you stick with managed challenge. CF has tons of data on IPs. They are capable of deciding what’s appropriate.