{"id":3365,"date":"2026-10-24T03:17:13","date_gmt":"2026-10-24T03:17:13","guid":{"rendered":"https:\/\/maxaeo.ai\/blog\/cloudflare-perplexitybot\/"},"modified":"2026-10-24T03:17:13","modified_gmt":"2026-10-24T03:17:13","slug":"cloudflare-perplexitybot","status":"publish","type":"post","link":"https:\/\/maxaeo.ai\/blog\/cloudflare-perplexitybot\/","title":{"rendered":"Cloudflare Bot Management Blocking PerplexityBot: WAF Fixes and Validation"},"content":{"rendered":"

By maxaeo.ai \uff5c Published 2026-10-24 \uff5c Updated 2026-10-24<\/em><\/p>\n

When Cloudflare bot management blocking PerplexityBot<\/strong> prevents a page fetch, the cause may be a robots.txt directive, an AI crawler toggle, a WAF custom rule, a bot score threshold, or a managed challenge. The reliable fix is to identify the enforcement layer first, then allow only the traffic you intend to permit.<\/p>\n

This guide explains how to diagnose PerplexityBot failures, create safer Cloudflare rules, and verify that Perplexity can reach the correct pages without weakening protection for the rest of your site.<\/p>\n

\"Cloudflare<\/figure>\n

What does it mean when Cloudflare blocks PerplexityBot?<\/h2>\n

A PerplexityBot block means an edge security control rejected, challenged, or filtered the request before the origin served the page.<\/strong> A browser loading the same URL successfully does not prove that an AI crawler can access it, because Cloudflare evaluates bot identity, request behavior, IP reputation, and configured security rules separately.<\/p>\n

Cloudflare identifies PerplexityBot in its bot reference using the detection ID 33563889<\/code>. Bot Management customers can use detection IDs in WAF custom rules, while Cloudflare\u2019s broader AI crawler controls may apply through built-in settings. (developers.cloudflare.com<\/a>)<\/p>\n

The most common failure layers are:<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Layer<\/th>\nTypical symptom<\/th>\nWhat to inspect<\/th>\n<\/tr>\n<\/thead>\n
robots.txt<\/code><\/td>\nCrawler is instructed not to fetch<\/td>\n\/robots.txt<\/code>, including Cloudflare-managed directives<\/td>\n<\/tr>\n
AI crawler controls<\/td>\nConsistent block or policy action<\/td>\nSecurity settings under bot traffic<\/td>\n<\/tr>\n
WAF custom rule<\/td>\n403, block, or challenge in Security Events<\/td>\nRule expression and execution order<\/td>\n<\/tr>\n
Bot Management<\/td>\nLow-score request rejected<\/td>\ncf.bot_management.score<\/code> and verified-bot status<\/td>\n<\/tr>\n
Origin or application<\/td>\n4xx\/5xx after Cloudflare allows request<\/td>\nWeb server and application logs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

This separation matters because changing robots.txt<\/code> will not override a WAF rule, and adding an allow expression may not override a Cloudflare-managed bot setting.<\/p>\n

How do you find the rule blocking PerplexityBot?<\/h2>\n

Start with Cloudflare Security Events, not with a new allow rule.<\/strong> Filter by the affected hostname and URL, then inspect the action, rule ID, bot score, verified-bot field, detection ID, user agent, and Ray ID for a blocked request.<\/p>\n

Use this sequence:<\/p>\n

    \n
  1. Request a public URL with the declared user agent:\n
    curl -I -A "PerplexityBot" https:\/\/example.com\/target-page\n<\/code><\/pre>\n<\/li>\n
  2. Repeat the request against the site\u2019s canonical URL and any redirect destination.<\/li>\n
  3. Open Security Events<\/strong> in Cloudflare and locate the request by time, path, or Ray ID.<\/li>\n
  4. Record whether the action was Block<\/strong>, Managed Challenge<\/strong>, JS Challenge<\/strong>, Rate Limit<\/strong>, or an origin response.<\/li>\n
  5. Check whether the request was classified as a verified bot or merely matched a user-agent string.<\/li>\n<\/ol>\n
    A user-agent-only rule is weak evidence because user agents can be copied. Cloudflare says verified bots are evaluated through signals such as reverse DNS, published IP information, stable identification, and other validation methods\u2014not simply the text of the user agent. (developers.cloudflare.com<\/a>)<\/p>\n
    Which Cloudflare settings should you check?<\/h2>\n
    Check the AI crawler setting, bot settings, and custom WAF rules as separate controls.<\/strong> Cloudflare documents built-in settings for blocking AI crawlers, definitely automated traffic, likely automated traffic, verified bots, and static-resource protection. Bot Management customers can also create rules using bot scores and detection IDs. (developers.cloudflare.com<\/a>)<\/p>\n
    Review these locations:<\/p>\n
    1. AI crawler controls<\/h3>\n
    If an AI crawler blocking control is enabled, it may reject Perplexity-related traffic before your intended custom exception behaves as expected. Confirm whether the policy is designed to block all AI crawlers or only training-oriented traffic.<\/p>\n
    2. Bot score rules<\/h3>\n
    Cloudflare Bot Management assigns requests a score from 1 to 99. Cloudflare notes that scores below 30 are commonly associated with bot traffic, but a low score alone should not be treated as proof of malicious behavior. (developers.cloudflare.com<\/a>)<\/p>\n
    Look for expressions such as:<\/p>\n
    cf.bot_management.score lt 30\n<\/code><\/pre>\n
    or:<\/p>\n
    cf.bot_management.score lt 30 and not cf.bot_management.verified_bot\n<\/code><\/pre>\n
    A blanket rule can block legitimate automated access, including traffic that supports search or answer discovery.<\/p>\n
    3. Custom WAF rules<\/h3>\n
    Check for rules matching:<\/p>\n