주 콘텐츠로 건너뛰기
버전: 2.x

Cloudflare

Cloudflare sits in front of some stores and can ask visitors to pass a security check. The WCPOS app cannot always pass it, and then it cannot connect to your store or sync. The fix is a change in Cloudflare, made by the store owner or whoever runs the site's Cloudflare account. This page shows which setting to change and how.

At the till​

  • Security check window on the desktop app: tick the box within two minutes. The app carries on. Cloudflare asks again after 30 minutes, or after the time the store owner has set.
  • HOST121 on the iPad, iPhone or Android app: these apps cannot pass Cloudflare's check. They stay blocked until the store owner makes the change below.
  • Either way, send this page to the store owner. On the desktop app, passing the check lets the app connect for now, but the check comes back later.

Store owner: start at Find the Cloudflare feature that is blocking it.

Signs that Cloudflare is blocking the app​

  • "This store's hosting setup is blocking the app" on the connect screen, with error code HOST121.
  • A small window titled Security check for your-store.com opens on the desktop app while it connects or syncs.
Other signs the store owner may see
  • "Your store is behind Cloudflare" at the top of WP Admin > POS > Settings > General. The plugin shows it on any site that runs through Cloudflare, before anything goes wrong.
  • Cloud printing stops, and the printer card under WP Admin > POS > Settings > Cloud Print says "A security service (like Cloudflare or a firewall plugin) is blocking WCPOS Cloud Print". The relay reaches your store the same way the app does, so the fix below fixes printing too.
  • Older app versions reported "Site does not seem to be a WordPress site" or "The site took too long to respond" on a store that opens fine in a browser.

Find the Cloudflare feature that is blocking it​

The rest of this page is for the store owner. Open your site in the Cloudflare dashboard, then:

  1. Go to Security > Analytics and select the Events tab. Look for requests to /wp-json/ from the time the app was blocked. Their Service field names the feature that stopped them, such as Bot Fight Mode or Managed rules.
  2. Open the matching feature below. It says where the setting lives and how to fix it.
  3. No matching event? On the Free plan the log keeps only a sample of requests, so the app's may be missing. Check which of the four features below is on instead.

To confirm first that Cloudflare is the cause, use the optional terminal check.

Bot Fight Mode (Free plan): turn it off
  • Where: Security > Settings, filter by Bot traffic.
  • Fix: turn it off. A Skip rule cannot exempt the app from it (why).
Super Bot Fight Mode (Pro plan and above): add a Skip rule
Custom rules or managed rules that challenge visitors: add a Skip rule
Under Attack Mode: turn it off, or add a Configuration Rule
  • Where: Quick Actions on the site's overview, or the Security level setting under Security > Settings.
  • Fix: turn it off once the attack has passed. To keep it on for the rest of the site, add a Configuration Rule (Rules > Overview > Create rule > Configuration Rule) with the Skip rule's expression, and set I'm Under Attack to off.

The Cloudflare plugin for WordPress cannot add the rules on this page. Make these changes in the Cloudflare dashboard.

Add a Skip rule for the REST API​

A Skip rule lets requests to your store's REST API past the Cloudflare checks you tick below, and no others. WordPress still checks every login and permission.

참고

Bot Fight Mode on the Free plan ignores this rule. If Bot Fight Mode is the feature blocking the app, turn it off instead.

  1. In the Cloudflare dashboard, open your site, go to Security rules and choose Create rule > Custom rules.

  2. Under Rule name, enter WCPOS REST API.

  3. Under When incoming requests match, choose Edit expression and paste:

    (starts_with(http.request.uri.path, "/wp-json/")) or (http.request.uri.path eq "/" and (starts_with(http.request.uri.query, "rest_route=") or http.request.uri.query contains "&rest_route="))

    If WordPress lives in a subfolder, such as https://example.com/shop, use /shop/wp-json/ and /shop/ in place of /wp-json/ and /.

    What the expression matches

    The first half matches the API's normal address, /wp-json/. The second half matches the fallback address, /?rest_route=/, and only on the site's home address, so a page that happens to carry rest_route= in its link keeps its protection.

  4. Under Then take action, choose Skip.

  5. Choose what the rule skips. Tick these always:

    • All remaining custom rules, so your other custom rules do not challenge or block the app.
    • Security Level. If Under Attack Mode is on, also add its Configuration Rule.

    Tick these only when they apply:

    • All Super Bot Fight Mode rules, if Super Bot Fight Mode is on.
    • All managed rules, if the Events log shows Managed rules in the Service field for the app's requests. If you found no matching event, leave it unticked and see Still blocked?.

    Leave the entries marked (Previous version) unticked.

  6. Choose Deploy. If other custom rules challenge or block visitors, drag this rule above them in the Security rules list. Managed rules always run after custom rules, so their order does not matter.

Connect or sync in the app to confirm it gets through. To confirm from a computer, run the terminal check: the answer should be 200 with content-type: application/json, and no cf-mitigated line.

If Bot Fight Mode is on​

Bot Fight Mode on the Free plan ignores Skip and Allow rules. Cloudflare's own documentation says custom rules and Page Rules cannot bypass it. If Bot Fight Mode is on and the app is still blocked after you add the Skip rule, turn Bot Fight Mode off under Security > Settings, filter Bot traffic. Then try the app, or run the check once more. To keep bot protection, move to the Pro plan and use Super Bot Fight Mode: the Skip rule above does exempt it. If Bot Fight Mode is already off, see Still blocked?.

Check it from a computer​

This check is optional. It shows from your own computer whether Cloudflare is answering for your store, before or after the fix.

Check with a terminal

Open a terminal (Terminal on a Mac, PowerShell on Windows) and run this, with your store's address in place of your-store.com. On Windows, type curl.exe in place of curl.

curl -sI https://your-store.com/wp-json/

Read the first lines of the answer:

  • 403 and cf-mitigated: challenge: Cloudflare is blocking the app. Find the feature that does it.
  • 200 and content-type: application/json: this computer got through. Try connecting or syncing in the app. If the app is still blocked, Cloudflare may be treating it differently from your computer: check the features above, then Plugin Conflicts.
  • 404: the REST API is not at this address. Sites without pretty permalinks use a different one. Run the check again on 'https://your-store.com/?rest_route=/' (keep the quotes).

If WordPress lives in a subfolder, include it: https://example.com/shop/wp-json/.

How the desktop app gets past the check

The app talks to your store's REST API, the part of WordPress that answers apps with data. A web browser passes Cloudflare's check without you noticing; an app usually cannot. When Cloudflare answers with a check instead of data, the desktop app opens a hidden browser window and tries to pass the check on its own. If Cloudflare wants a tick box, the window appears and waits two minutes. Cloudflare then lets the app through for the time set in Challenge Passage (30 minutes by default), and the check comes back after that. The iPad, iPhone and Android apps have no such window.

Stop Cloudflare caching the API​

Cloudflare can also keep copies of the REST API's answers. The app then shows old products, prices and orders. The Skip rule does not change this: it only turns off security checks. If you cache HTML pages or use Automatic Platform Optimization (APO), add a Cache Rule with the same expression and set it to Bypass cache.

Still blocked?​

  • Open the Skip rule and check it is deployed, not saved as a draft (Save as Draft).
  • Check that no IP Access rule blocks or challenges the shop's internet connection.
  • No event for the app in the Events log? Before you skip managed rules, contact support (below) with the result of the terminal check.
  • Other services in front of your site can block the app in the same way. See Plugin Conflicts for security plugins and firewalls, and the hosting notes for GoDaddy, WP Engine and other hosts.
HOST121The error the app shows when a security check answers for your store.
Plugin ConflictsSecurity plugins and firewalls that block the app.
ServerHosting notes and what your server needs.
Discord Communitysupport@wcpos.com