DocsLet Ledge's health checks, backups and uptime checks through Cloudflare's bot protection and firewall.
Cloudflare's bot protection and firewall can treat Ledge as a bot. When that happens, health checks fail with a 403, uptime checks see a challenge page and report the site down, and backups or update runs can't start, because the request that starts a copy is blocked.
The way through is a secret header. Ledge sends it with every request, and a Cloudflare rule lets requests that carry it skip the bot and firewall checks. Everything else, including requests to /_ledge/ without the header, still goes through Cloudflare as normal.
Generate a long random value:
openssl rand -hex 32Use a new value, not the site's LEDGE_SECRET_KEY. The header ends up in your Cloudflare rules, and keeping it separate means you can change one without the other.
Edit the site's health check and each uptime check. Under Advanced settings, add a custom header:
X-Monitor-TokenLedge sends the health check's headers with every request to the plugin or package, so backups and update runs carry it too.
In the Cloudflare dashboard for the domain, go to Security → Security rules and create a custom rule:
Expression:
any(http.request.headers["x-monitor-token"][*] eq "YOUR_SECRET")Action: Skip
WAF components to skip: All remaining custom rules, All rate limiting rules, All managed rules and All Super Bot Fight Mode Rules. Under More components to skip, also tick Browser Integrity Check and Security Level.
Leave All remaining custom rules in this phase unticked. It overlaps with All remaining custom rules, and Cloudflare won't save the rule with both ticked.
Put the rule first in the list of custom rules, so it runs before any rule that blocks.
Click Poll Now on the health check and on an uptime check. If the health check still fails, its latest result shows the status code Ledge got:
403 or a challenge page: Cloudflare is still blocking. Check the header name and value match in both places, and that the rule is first.401: the request reached your site, but the site's secret key doesn't match. See Install the Craft plugin.Bot Fight Mode
On Cloudflare's free plan, Bot Fight Mode can't be skipped by custom rules, so the header doesn't help while it's on. Turn it off for the domain, or move to a paid plan, where Super Bot Fight Mode can be skipped.