Publishing on Cloudflare without access restrictions

Note Cloudflare are changing their product continuously and this guidance may become out of date. If this guidance does not help, please check the links to Cloudflares own documentation in this guidance or contact IATI support.

Assumptions

A publisher has published files on a website with many other types of content.

They don’t want to remove Cloudflare entirely from this website, as the protection Cloudflare offers is essential for other parts of the website.

Goals

This document describes how to configure Cloudflare to allow access to the published IATI files without removing protection from other parts of the website.

Steps

1. Open the Cloudflare dashboard and login to the account in question.
2. Select the website you need to configure.
3. Go to Security > WAF > Custom rules.
4. Select Create rule.
5. Enter a descriptive name for the rule in Rule name.
6. Under “If incoming requests match”, use the Field drop-down list to choose an HTTP property. Select “URI Path”.
7. Use the Operator drop-down list to choose the operator for the rule. Use “Contains”.
8. For the Value, enter the path to the published files. You can enter the full path, or you can enter the first part of the path only if there are multiple IATI files in the same place. (e.g. “/sites/default/files/iati/”)
9. Under “Then take action”, select “Skip”.
10. Select “All Super Bot Fight Mode Rules” option.
11. Under the “More components to skip” dropdown, select “User Agent Blocking” and “Browser Integrity Check”
12. Select Deploy to publish your rule.

Once this has been published, you can test your files to make sure access is allowed.

Links to Cloudflare documentation

On Custom rules

On rules

On skip action

On logging to investigate issues