Cloudflare is blocking my uptime monitor

How to recognise it

These are the signatures of a challenge rather than an outage:

• 403 or 429 with a very fast response time. A blocked request is rejected at the edge, so it comes back in single-digit milliseconds. A struggling server is slow; a firewall is instant.
• A 200 that fails your keyword check. The challenge page is a successful HTTP response. If the body contains Just a moment… your monitor did not reach your site at all.
• Cloudflare error 1020. "Access denied" — a firewall rule matched.
• It works from your laptop. Your browser has a cookie, a residential IP and a reputation score. A datacentre request has none of those.

Pingdomain names it for you: when a check fails and the body looks like a challenge, the error reads Blocked by the target's bot protection (Cloudflare) before the status code, and the response body is kept so you can read what actually came back. reCAPTCHA, hCaptcha, DataDome, PerimeterX and Imperva are recognised the same way.

Which Cloudflare setting is doing it

There are four common culprits, and they are configured in different places:

1. Bot Fight Mode / Super Bot Fight Mode. Under Security → Bots. "Block definitely automated traffic" catches every monitoring tool, including this one. It is the most common cause by a distance.
2. A WAF custom rule blocking or challenging by user agent, ASN or country.
3. Browser Integrity Check, which rejects clients that do not look like browsers.
4. Rate limiting, which produces a 429 that comes and goes — typically when a one-minute monitor shares an IP range with other traffic.

What not to do

Do not make the monitor pretend to be Chrome. A user agent that lies is indistinguishable from the traffic the protection exists to stop, it breaks again the moment the fingerprinting improves, and it removes the only thing that would have let you allow the checks deliberately. We will not do it, and a tool that offers to is solving your problem by creating someone else's.

The fix

Write a rule that lets your own monitoring through — that is what the next guide is for. It takes about two minutes and, done properly, it does not weaken your protection against anyone else.

If the site is not yours and the checks are unwanted, the answer is the opposite: a 403 is a clear answer, we report it as one, and the bot page explains how to have the monitor disabled entirely.