Cloudflare Bot Fighting Mode – Sendcloud Sync Issued

  • RafaelDeJongh

    (@rafaeldejongh)


    7 months, 1 week ago

    We utilise Cloudflare for various reasons including security. Yet when we migrated to the new plugin/api we noticed we ran directly into sync issues where we would get sync errors only when Bot Fighting Mode was activated, yet this has been enabled ever since we first launched our Webshop and it worked just fine with the previous plugin, so for some reason the new plugin/api/sync/scraping method that’s being used causes Cloudflare to recognise the crawler as a bad bot and blocks it which prevents syncing in its entirety.

    We had multiple support tickets to have your support team look into this issue without any success or potential sight to a future fix for this, yet due to this we now require to have Bot Fighting Mode disabled and that causes extremely much unnecessary traffic which overload our server unnecessarily as no bots via this method are being blocked. All troubleshooting steps have been properly executed by myself and we also provided full admin access to one of your support agents which also confirmed that these were done but didn’t fix the issue. Obviously no security feature on our server is blocking this, and when the Cloudflare’s bot fighting mode is enabled the issues are directly present, same in the other way when the feature is disabled the error gets resolved.

    Yet we have a couple other api scrapers such as our POS which is used on an even higher frequency than syncing with Sendcloud, yet we don’t have had any issues with those crawlers with bot fighting mode active, so it must be something on how the crawler is set up that causes Cloudflare to block these requests.

    I did also contact Cloudflare and they said it’s something the developers have to look into to resolve and suggested that the developers send in a support request to Cloudflare as well.

    Hopefully this can be resolved ASAP as this is really slowing down our server due to the high volume of bots visiting our webshop which is simply unwanted and we required to upgrade our server 3 times already just to handle the traffic load to not have it completely die on itself.

    Thank you in advance for further information and assistance.

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • developmentsendcloud

    (@developmentsendcloud)

    7 months, 1 week ago

    Hey @rafaeldejongh ,

    Thank you for the detailed explanation, and I completely understand the frustration this issue is causing. I appreciate the time you’ve taken to troubleshoot and share the background.

    It sounds like the plugin is being flagged by Cloudflare’s Bot Fight Mode, which prevents proper syncing. As a first step, please ensure the following endpoints we use during order import are allowed/whitelisted within Cloudflare:

    /wp-json/wc/v3/orders
    /wp-json/wc/v3/products
    /wp-json/wc/v3/products//variations
    /wp-json/wc/v3/taxes
    /wp-json/wc-sendcloudshipping/v2/integration
    /wp-json/wc/v3/webhooks

    If you’ve already confirmed these endpoints are accessible and the issue persists, we recommend submitting a new support ticket in Sendcloud so we can further check this directly with Cloudflare. While I’ve logged this case internally for further investigation, detailed troubleshooting and escalations are handled through our support system to ensure proper tracking and protection of sensitive information.

    We understand that disabling Bot Fight Mode is not an ideal solution due to the increased unwanted traffic, and our team will work to find a resolution that allows your plugin to sync properly without compromising. Once a ticket is created, our support team can keep you updated on any progress made with Cloudflare.

    Thank you for your patience while we continue investigating this.

    Regards,

    Safan | Technical Support Specialist

    Thread Starter RafaelDeJongh

    (@rafaeldejongh)

    5 months, 2 weeks ago

    To get back to this ticket and inform others with similar issues, to start with the mentioned endpoints are indeed accessible and allowed as our POS also utilise these endpoints and have no issues when bot fighting mode is on. So we know for a fact that it can work as it does with our POS and we didn’t require to whitelist, alter, modify, or change any security settings at all with it in contrast with sendcloud’s plugin.

    The main reason I’m now getting back to you on this support thread is that I’ve made now 4 support tickets and they all have been closed without any proper solution, and I have to always start from zero as apparently this issue while being constantly said that it is noted down internally no one actually knows about it.

    So going over a month and 4 closed tickets that I didn’t want them to close but they did anyway I’ve pretty much had enough of this gross incompetence and constant requirement to re-explain myself that I’d prefer to handle it here instead, as I simply lost faith in your support system.

    So even with all these support tickets and multiple months now (even prior to submitting this ticket) of trying to get this resolved, we have absolutely not gotten anywhere closer to a solution. Not for this synchronisation issue or the failure to fetch pre-order products which I have also made multiple tickets for without a proper solution in sight.

    So can further support be given here or can I receive a direct email that I can contact as your support ticket system is simply not acceptable as they keep closing open tickets without providing any solution.

    Thank you in advance for further information.

    developmentsendcloud

    (@developmentsendcloud)

    5 months, 1 week ago

    Hello @rafaeldejongh,

    Thank you for getting back to us. I am genuinely sorry for the experience you’ve had with our support system. It is completely unacceptable that you’ve had four tickets closed without a resolution and have been forced to re-explain the issue each time. I deeply apologize for the frustration this has caused.

    You should not have to chase us for a solution, and I will do my best to get this case resolved for you.

    Thank you for the critical clarification that your POS system uses the same endpoints without issue while Bot Fight Mode is active. That is a vital piece of information. It confirms your suspicion that this isn’t a simple endpoint-blocking issue, but rather something specific to how our new plugin’s crawler/sync method is behaving that causes Cloudflare to flag it as a “bad bot.”

    In order to get the ball rolling again, I will escalate this personally, but I will need an internal ticket to do so.
    Could you please reply here with the 4 ticket numbers you previously created?

    With those numbers, I will do the following:

    1. Personally locate and merge all the previous tickets and notes, so no information is lost.
    2. Add your latest findings (especially the POS comparison) to the case.
    3. Escalate the entire investigation (including the separate issue you mentioned regarding pre-order products) directly to our Development teams.

    While we cannot conduct the full, in-depth technical investigation here on a public forum (due to security and privacy), I will wait for your reply here and then move the conversation to our internal ticket system once I know the ticket ID’s and your user ID in our system.

    I sincerely apologize again for the time and energy you’ve had to spend on this. Please provide those ticket numbers, and I will take it from there.

    Kind regards.

    Fabian | Technical Support Specialist

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.