Allowlist Relvato behind Cloudflare or a firewall
Updated September 2026
If your site sits behind Cloudflare, Sucuri, Wordfence or a host WAF, its bot-protection can block Relvato’s automated checks with a 403 — before the request even reaches your site. Here’s how to let Relvato through, securely, with one rule.
Why the checks get a 403
Relvato runs your journeys in a real browser. A firewall or bot-protection layer (Cloudflare is the common one) sees that automated traffic and blocks it with an HTTP 403 at the edge — before it reaches your site. That’s a hard block, not a “checking your browser” challenge Relvato can wait out.
Your visitors never see this: it only affects Relvato’s verification requests. Nothing is wrong with your site — the edge just needs to be told Relvato is allowed.
How Relvato proves it’s Relvato
Every request Relvato makes to your site carries a stable header, X-Relvato-Token. Its value is unique to your site and derived from your site’s signing secret — it never changes and can’t be guessed, so it’s safe to match on in a firewall rule.
You’ll find the exact value in Relvato under your site → Settings → “Behind Cloudflare or a firewall?”. Copy it from there.
Add the Cloudflare rule
In the Cloudflare dashboard, open your domain → Security → WAF → Custom rules → Create rule. Set the action to Skip, and tick all Managed Rules, Bot Fight Mode, and Rate limiting.
For the rule expression, match the header to your site’s value: http.request.headers["x-relvato-token"][0] eq "<your value>". Relvato shows the full copy-paste expression in your site’s Settings. Deploy the rule — the next run should pass.
Other firewalls
The same idea works anywhere. In Sucuri, Wordfence, or a host/CDN WAF, add an allowlist rule for requests where the header X-Relvato-Token equals your site’s value. If your firewall can only allowlist by IP, note that Relvato’s checks run from a dynamic pool — so the header is the reliable option.
Where to allowlist Relvato, by firewall
| Firewall | Where to add it | What to match |
|---|---|---|
| Cloudflare | Security → WAF → Custom rules → Skip | X-Relvato-Token equals your value |
| Sucuri | Firewall → Access Control → Allowlist | X-Relvato-Token equals your value |
| Wordfence | Firewall → allowlisted rules | Requests carrying X-Relvato-Token |
| Host / CDN WAF | Bot or security rules | Allowlist the X-Relvato-Token header |
Questions
Is it safe to match on the header?
Yes. The value is a per-site secret derived from your signing secret — unique to your site and not guessable — so no one else can send it. It’s far safer than a broad user-agent or IP rule.
Does this weaken my firewall?
No. The rule only skips bot-protection for requests that carry your exact secret token; every other request stays fully protected.
I use Bot Fight Mode / Super Bot Fight Mode.
Those are the usual cause of the 403. Make sure your Skip rule ticks Bot Fight Mode (and on higher plans, add an exception for Super Bot Fight Mode) so Relvato’s requests bypass it.
It still fails after I add the rule.
Give it a minute to propagate, then re-run the check. If it still fails, confirm the header value matches exactly and that the action is Skip (Allow alone doesn’t bypass Bot Fight Mode).