Your accessFlow audit may fail if your website’s firewall or bot protection blocks audit requests or presents a CAPTCHA challenge. These restrictions prevent accessFlow from reaching and testing your site.
To resolve this, follow the instructions below for the security service protecting your site. If you use multiple services, you may need to update each one.
After updating your security settings, run the accessFlow scan again.
Cloudflare configuration
To allow our scanner to complete an accessibility audit, configure a Skip rule in your Cloudflare dashboard. A Skip rule ensures our automated scanner is exempted from security challenges, rate limits, and bot protections.
Step 1: Define rule conditions
- Login to your Cloudflare dashboard, and select your domain.
- Go to Security > WAF > Custom rules.
- Select Create rule.
- Define these rule conditions:
- Rule name: Allow accessFlow scanner
- Field: IP source address
- Operator: equals
-
Value: 34.23.64.234
No CIDR mask or range is needed.
Step 3: Configure Skip action
Under the section Then take action, select Skip and check these boxes:
- All remaining custom rules
- Super Bot Fight Mode (Pro, Business, Enterprise)
- All rate limiting rules
- All managed rules
Step 4: Save and position rule #1
Select Deploy.
Make sure this rule is moved to the very top (Priority 1) of your Custom Rules list.
Important note for Cloudflare free tier accounts: Cloudflare does not permit rule-based bypasses for Bot Fight Mode on Free plans. If your domain is on a Free plan, go to Security > Settings > Bot Traffic and temporarily toggle Bot Fight Mode to Off during the audit.
Firewall or WAF configuration
Add 34.23.64.234 to your firewall or web application firewall (WAF) allowlist for HTTPS traffic to each domain accessFlow audits.
This is the scanner’s outbound IP address for the US region. The scanner makes standard HTTPS requests. No other ports or protocols need to be allowed.
Bot protection service configuration
In your provider’s bot protection settings, create an allowlist rule for requests whose User Agent contains AccessFlowBot/1.0.
If your provider needs more information, share the accessFlow scanner information page.
Identity verification
accessFlow signs every audit request. Your provider can use accessFlow’s public keys to verify that requests come from the accessFlow scanner.
Share the public key directory with your provider or the team managing your website’s security if they require it for verification.