Can I disable bot protection for pages? My specific case is that Amethyst (Android App) is not able to access https://nostr.pasukaru.me/.well-known/nostr.json via TOR (using orbot). Without TOR it works. Accessing the page with a browser (also via TOR), I got the CF challenge. How can I disable that? On the domain level Bot Fight Mode is disabled. I also tried a Page Rule to Disable Security, no luck. Is there anything else? Thanks in advance. Account Id:

d46bcbfb96be0041b72c7b1fc72a076f

Pages.dev: https://6509bcfe.nip-5.pages.dev/ Deployment Id:

6509bcfe-10f3-48a6-b6b4-1e92859922d0

Have you tried adding a rule that sets the security level to Essentially Off?

Just tried that, same issue. :/

Do you know for sure the issue is the app being challenged/getting a 403 response code, or is it just that it doesn't load? You should be able to see under Security -> Events (magic link: ), the exact cause of the block. You can create Custom Rules (Security -> WAF) to skip most components, including security level challenges, an expression like

starts_with(http.request.uri.path, "/.well-known") and http.host eq "nostr.pasukaru.me"

with the Skip action skipping the specific component (that you found out via the security event) should do

I get this when using TOR:

Looks like a challenge, what do you see under Security -> Events?

It does appear there too:

A Security level challenge, if you've already got it on the lowest level possible it looks like that IP has really bad reputation. Should be able to just use the Custom Rule above ex.

Tried adding a custom rule to skip basically everything, still getting challenges

I would wait a minute or two after creating it

Will do

fwiw I'm able to access that url on TOR without any issues

Sometimes it works. Most of the times it doesnt. I guess it depends on which exit node you get. I can switch my tor identity and most of the time I do get challenges.

Since you have logging enabled for that rule, the Events tab should show every request with the Skip action, an easy way to tell if it's working or not (might need to select the last 30 mins rather then 24 hours, usually you see requests faster in it)

Yep, it does say skip now in the firewall events. But I still get a challenge ._.

hmm, as far as I know Pages itself shouldn't be doing any challenge stuff itself and it should be entirely dependent on your zone settings, hopefully it's just that it needs a second longer

Alright, couple more refreshes, now it seems to work. Will keep changing my identity a few more times to see if it is consistent now

Firewall Events aren't instant, they can take a hot minute to appear. It might help if you disable logging on the new rule, so you only see things still getting blocked. The only thing the "Skip" rule with everything enabled can't skip is DDoS Mitigations & Bot Fight Mode (free)

Bot fight mode is turned off. I don't have anything configured in Security > DDoS. Not sure what the default is. I'll try with an override with 'Essentially Off' sensitivity.

I would generally recommend a more targeted approach, only disabling exactly what you need on paths you need. DDoS Mitigation challenges/blocks are shown in your Events tab as well

Makes sense. For testing purposes that's fine for now. I'll turn everything back to normal later. Running out on things to turn off. I just also found the Configuration Rules (in addition to the page rules), where I also override the security level to Essentially Off for that domain.

Do you see the challenges in Security Events at all?

Only for other subdomains, not for nostr.pasukaru.me

Interesting. I tried resetting my identity a bunch with Tor and checking my threat_score, but it was always 0 or 1 out of 100 and never got challenged on your website. Wonder if it's something else, to do with the app itself or something

Yea no Idea. I don't think I'm getting exit nodes that are flagged as bot nets constantly. The app itself is only that single file, so not sure where else to look

On that TOR identity that gets challenged, what's your IP Threat Score? https://threat_score.chaika.dev/

threat score is 1

shouldn't be enough to be blocked unless the Security Level is high, that's what I was getting as well

Indeed. I can't make any sense out of this.

It's most likely that Pages itself has some security settings on it by default, except with a threat score of 1 you shouldn't be being challenged by its defaults. Would be easy enough to test though if you also get challenged trying to access https://nip-5.pages.dev/.well-known/nostr.json

Browser Integrity Check wouldnt give a challenge and would just throw > Error 1010: The owner of this website has banned your access based on your browser’s signature