stack twitter tryhackme rss linkedin cross

Wilco van Esch

Skip to main content

Search results

    Finding a Cloudflare event by Ray ID

    When one of your legitimate users gets blocked by Cloudflare, they will be quoted a Ray ID which you can use to look up the exact rule that blocked them. You can then choose to change the Block to a Challenge (CAPTCHA) or to Disable it altogether.

    Blocked by Cloudflare firewall page

    Search a Cloudflare event by Ray ID

    1. Log in to Cloudflare
    2. Navigate to the website you'd like to manage access for
    3. Go to Firewall
    4. Under Firewall Events, hit Add filter
    5. From the New filter dropdowns, select Ray ID, equals, and the user's Ray ID
    6. Hit Apply

    You should now be seeing the Activity log filtered down to 1 event.

    Investigate the Cloudflare event

    1. Select the event
    2. Copy the value for Rule ID, e.g. 100173
    3. Go to Managed Rules
    4. Under Cloudflare Managed Ruleset, hit Advanced
    5. In the search bar, submit a search query for the Rule ID you copied

    You should now be seeing the rules filtered down to 1 rule. You can view its description — to help you understand why the block occurred — and change the Mode to decide what should happen when a user (whether they be well-meaning or hostile) encounters it.

    Note: if you can't find the rule in the ruleset Cloudflare Managed Ruleset, try the other rulesets in the Managed Rules section.