🔍 What This Error Means
When you try to publish or sync an article to your WordPress site, you may see a message such as "We're unable to sync with your WordPress site" or a status of cloudflare_blocked. This means your site is protected by Cloudflare, and its Web Application Firewall (WAF) is treating the request from Search Atlas as suspicious traffic.
Cloudflare sits between your website and the internet. When our platform sends content to your WordPress REST API — specifically the Search Atlas SEO plugin's /wp-json/metasync/v1/ route — Cloudflare can mistakenly flag that automated request and stop it before it reaches your site. The result is a blocked sync, even though your login details and plugin are correct. A related symptom is an HTTP 525 ("SSL handshake failed") response from Cloudflare for this endpoint, which points to a Cloudflare-side connection problem rather than incorrect WordPress credentials. Note that cloudflare_blocked is distinct from a wp_client_error status, which indicates a different WordPress connection issue rather than a Cloudflare block.
⚙️ Why Cloudflare Blocks the Sync
Cloudflare's firewall uses rules to filter out bots and automated tools. Publishing software like Search Atlas connects through the WordPress REST API, which can look like automated activity. Common reasons for a block include:
- Managed WAF rules that flag requests to the /wp-json/ REST API endpoint.
- Bot Fight Mode or Super Bot Fight Mode challenging non-browser traffic.
- Rate limiting rules that block repeated requests in a short time.
- Custom firewall rules created by your team or hosting provider.
- Security plugins working alongside Cloudflare that add extra filtering.
✅ Before You Begin
You will need access to your Cloudflare dashboard for the affected domain. If your site is managed by a hosting provider or developer, you may need to ask them to apply these changes. Always make one change at a time and re-test the sync so you know which fix worked.
🛠️ How to Allow the Sync in Cloudflare
Follow these steps to let Search Atlas connect to your WordPress site:
- Log in to your Cloudflare dashboard and select the domain you are trying to sync.
- Go to Security, then WAF.
- Open the Firewall rules or Custom rules tab.
- Create a new rule that allows traffic to your REST API. Set the field to URI Path, the operator to contains, and the value to /wp-json/. The SearchAtlas plugin specifically uses the /wp-json/metasync/v1/ path, so you can target that route if you prefer a tighter, more specific rule.
- Set the action for this rule to Skip or Allow, so these requests bypass the firewall.
- Save and deploy the rule, then try the sync again from the Search Atlas platform.
🤖 Adjust Bot Protection Settings
If the block continues, your bot protection may be the cause. In your Cloudflare dashboard:
- Go to Security, then Bots.
- Temporarily turn off Bot Fight Mode or Super Bot Fight Mode and test the sync.
- If this resolves the issue, create an exception so legitimate requests to /wp-json/ are not challenged.
You can also check Security, then Events, to see a log of blocked requests. This log helps you confirm which rule stopped the sync and lets you adjust the correct setting.
🌐 Allow Our Connection at the Server Level
Some hosts apply security at the server level in addition to Cloudflare. If you still see a block after updating Cloudflare, ask your hosting provider to confirm that requests to the WordPress REST API are not being filtered, and that your SearchAtlas SEO plugin is active and up to date.
🔁 Re-Test the Sync
After making your changes, return to the Search Atlas platform and try publishing again:
- Open the article you want to publish.
- Confirm your WordPress site is correctly connected in your integration settings.
- Click Publish or Sync and wait for the confirmation message.
If the sync succeeds, the block has been resolved. If it still fails, review your Cloudflare Events log again to identify any remaining rule that needs adjusting.
💡 Tips to Prevent Future Blocks
- Keep your SearchAtlas SEO plugin updated to the latest version. Search Atlas sends sync requests using a WAF-aware user agent designed to reduce false blocks, so running the latest plugin version ensures you benefit from this behavior.
- Avoid overly strict global firewall rules that apply to the entire site.
- Document any custom rules you create so they are easy to review later.
- Coordinate with your hosting provider before adding new security tools that may filter API traffic.