Allowlist OnChange in Cloudflare and other firewalls

Enter a public domain to try scoping. You do not need to install software, share website credentials, connect Cloudflare, or change security settings. When access is limited, OnChange explains what could be discovered and keeps blocked content out of accessibility evidence.

The steps below are for an authorized site administrator who has chosen to approve access. Existing reports remain available with their original limitations.

Discovery and capture carry the same account-and-site verification header. A site administrator can combine that private value with the intended hostname and applicable outgoing addresses:

Find your header value: after a blocked scoping request finishes, open I manage this website: optional access steps. For monitoring, open the monitor, go to Settings, and look for Let OnChange through the site's firewall. A blocked monitor also shows the values right on its page, with copy buttons and a ready-made Cloudflare rule.

First inspect the blocked request in Cloudflare Security Events. The right exception depends on the protection that acted on it. Super Bot Fight Mode supports scoped Skip rules. Ordinary Bot Fight Mode does not.

When Super Bot Fight Mode is the cause

1. 1
   In the Cloudflare dashboard, select your website, then open Security and go to the security rules page. Choose Create rule, then Custom rules.
2. 2
   Name it “OnChange approved scope”.
3. 3
   Choose Edit expression and paste the expression from your scoping request or monitor. Use your actual hostname and private value. Scoping includes published outgoing addresses when available; a hostname-and-header example looks like this:

   (http.host in {"example.com" "www.example.com"} and any(http.request.headers["x-onchange-verify"][*] eq "ocv1_…"))

4. 4
   Under Choose action, select Skip and select only All Super Bot Fight Mode rules. Keep other custom rules, managed protections, and rate limits enabled.
5. 5
   Review the match and save the rule. Recheck access and remove the exception when the engagement ends.

Cloudflare stores header names in lowercase, which is why the expression uses x-onchange-verify.

Other Cloudflare protections

For a custom or managed rule, review an exception for the specific rule shown in Security Events. For rate limiting, review the scan's request rate with the administrator. A Super Bot Fight Mode exception does not override a different protection that blocked the request earlier.

Ordinary Bot Fight Mode cannot be skipped with a custom rule. Cloudflare documents IP Access allowances, which can have broader effects. Let the administrator review those tradeoffs or a product with granular exceptions. Changing site protection is optional; you can keep the limited discovery result.

See Cloudflare's Skip rule guidance and Bot Fight Mode false-positive guidance.

1. 1
   Open your project, then Firewall.
2. 2
   For the header: add a custom rule where the request header X-OnChange-Verify equals your value, with the action Bypass.
3. 3
   For the IP (also covers Attack Challenge Mode and system mitigations): add OnChange's IP address to System Bypass Rules.
4. 4
   Publish the changes.

1. 1
   Open the web ACL in front of your site and choose Add rules, then Add my own rules.
2. 2
   Create a rule that inspects the single header x-onchange-verify, match type Exactly matches string, with your value.
3. 3
   Set the action to Allow and give the rule a lower priority number than Bot Control and your managed rule groups, so it runs first.
4. 4
   Save the web ACL.

To allow by address instead, create an IP set with OnChange's IP and an Allow rule that references it.

The same two options work everywhere: allow requests whose X-OnChange-Verifyheader equals your value, or allow OnChange's IP address. Menu names change between versions, so search for the terms below.

• Akamai (Bot Manager, App & API Protector): Add OnChange's IP to a client list used as an allow list, or define a custom bot that matches the header and set its action to allow.
• Imperva: Add OnChange's IP to the site's allowlist in the WAF or bot protection settings.
• HUMAN (PerimeterX) and DataDome: Add an allowlist entry for the header value or the IP in the bot protection console.
• Sucuri: Add OnChange's IP under Access Control, Allowlist IP addresses.
• Wordfence (WordPress): Add OnChange's IP under Firewall options, Allowlisted IP addresses.
• nginx, HAProxy, or your own rate limiter: Exempt requests that carry the header value (or come from the IP) from bot checks and rate limits.

1. 1
   In OnChange, open the monitor and press Check now, or create a fresh scoping capture.
2. 2
   The blocked notice disappears and the status returns to OK once the check reaches your page.
3. 3
   In Cloudflare, check Security Events for your “OnChange approved scope” rule and the Skip action.

Still blocked? Check which protection now acts on the request, that the hostname and private value match, and that any outgoing address constraint matches the actual request. Our support team can look at the blocked response with you.

Do I need to change my firewall to try free scoping?

No. Start with a public domain. No installation, website credentials, Cloudflare API key, or firewall changes are required. If the website blocks the attempt, any discovered addresses stay available as an incomplete inventory. The sample report is available to explore before you decide whether to approve access.

Why not allowlist OnChange's user agent?

A user agent is easy to copy and does not prove that a request came from OnChange. Review the private account-and-site verification value, hostname, and outgoing address where applicable instead. Keep the exception limited to the protection causing the block.

Is the header value secret?

Treat it like a password for this one rule. It is unique to your OnChange account and this website. OnChange sends it only to that host and its www equivalent; it is stripped from cross-site requests. Keep it out of public posts and screenshots. If it may have leaked, remove the exception and contact support before restoring it.

Do I need both the header rule and the IP rule?

Scoping's suggested match includes the hostname, private verification value, and published outgoing addresses when available. Regional monitor proxies can use other addresses, so their access rule needs to match the actual route. An IP-only allowance is broader and should be reviewed by the site administrator, particularly for ordinary Bot Fight Mode.

What if I don't manage the website?

You can try the public scan and review what it can reach. If protection blocks access, keep the result's limitations, explore the sample report, or try another public website. An authorized site owner may choose to review access later. Do not change another site's security or publish the private verification value.