A connected Cloudflare API token confirms authentication only — it does not confirm that the OTTO Worker script is deployed and routed to your domain. Work through the steps below to verify token permissions, Worker deployment, route configuration, and Cloudflare cache so the diagnostic scan at OTTO Settings → Diagnostics → Run Scan detects OTTO correctly.
📋 Recent Backend Fix — OTTO-1850 Detection Improvement
A backend fix (OTTO-1850) was released to improve detection of the Cloudflare Worker installation method. For most new deployments, the diagnostic scan now correctly identifies an active OTTO Worker without manual intervention.
If your site was affected before this fix shipped:
- Re-run the diagnostic scan from OTTO Settings → Diagnostics → Run Scan to confirm the issue is resolved.
- If the scan still reports OTTO as not found, continue with the manual verification steps below — token permissions, Worker deployment, route configuration, and cache may still need to be checked individually.
⚠️ Why a Connected Token Does Not Guarantee OTTO Detection
Saving and validating a Cloudflare API token in OTTO settings confirms that OTTO can authenticate with your Cloudflare account. It does not confirm that the OTTO Worker script has been deployed and routed to your domain. The diagnostic scan checks for the OTTO Worker script on your live site — if the Worker was never published, is misrouted, or is blocked by a cache layer, the scan reports OTTO as not found even though the token shows as connected.
Common causes of this mismatch:
- The Cloudflare Worker script was not published after the token was saved in OTTO
- The Worker route does not match your domain or subdomain
- The API token is missing the Workers Scripts: Edit permission needed to deploy the Worker
- Cloudflare's edge cache is serving a version of your site that predates the Worker deployment
- DNS records are set to DNS-only (grey cloud) instead of proxied (orange cloud), bypassing Workers entirely
🔑 Step 1 — Verify the API Token Has the Correct Permissions
A token with read-only access can validate successfully in OTTO but cannot deploy the Worker script. Confirm your token includes every required permission before moving on.
-
Log in to your Cloudflare dashboard and go to Profile → API Tokens.
-
Find the token you connected to OTTO and click Edit.
-
Confirm the token includes all of the following permissions:
- Account: Workers Scripts — Edit
- Account: Account Settings — Read
- Zone: Workers Routes — Edit
- Zone: Zone — Read
-
If any permission is missing, add it and click Continue to summary → Update token.
-
Return to OTTO settings and click Re-validate to refresh the connection with the updated token.
After re-validating, you must manually retry the Worker deployment (or reconnect the integration) — OTTO does not automatically re-attempt deployment after a token permission error.
🛠️ Step 2 — Confirm the OTTO Worker Is Deployed in Cloudflare
Validating the token in OTTO does not automatically publish the Worker. Verify that the Worker script exists and is active inside your Cloudflare account.
- Log in to dash.cloudflare.com and go to Workers & Pages.
- Verify that an OTTO Worker script appears in the list — look for a Worker named otto-worker (or the Worker name shown in your OTTO settings).
- If the Worker is listed, click it and confirm its status shows as Active.
- If the Worker is absent from the list, re-initiate deployment from OTTO settings: disconnect the Cloudflare integration, confirm the token permissions from Step 1, wait 30 seconds, then reconnect to trigger a fresh Worker deployment.
Once the Worker appears as Active in Cloudflare, proceed to Step 3 to verify its route assignment.
🔗 Step 3 — Confirm the Worker Route Matches Your Domain
A Worker that is deployed but not routed to your domain is invisible to the OTTO diagnostic scan. Verify the route covers your exact domain.
- In the Cloudflare dashboard, select your domain from the home screen to open its zone.
- Navigate to Workers Routes under the Workers & Pages section of your zone.
- Confirm there is a route matching your full domain — for example,
example.com/*or*.example.com/*. - If the route is missing or points to the wrong domain, click Add route, enter the correct pattern, and assign the OTTO Worker to it.
Ensure the route covers both the www and non-www versions of your domain if your site uses both. A missing or mismatched Worker route is the most frequent cause of OTTO diagnostic scan failures on sites with a valid connected token.
🗑️ Step 4 — Purge the Cloudflare Cache and Re-run the Diagnostic Scan
Cloudflare may be serving a cached version of your site that predates the Worker deployment. Purging the cache forces Cloudflare to serve the current live version so the OTTO Worker can respond correctly.
- In the Cloudflare dashboard, select your domain.
- Go to Caching → Configuration.
- Click Purge Everything and confirm the action.
- Return to Search Atlas and open OTTO settings for your site.
- Click Run Diagnostic Scan to re-check the installation status.
Important — WordPress sites without WP Rocket: OTTO sets a Cache-Control: public, max-age=3600 header on processed pages when WP Rocket is not active. This can cause Cloudflare (and other CDNs/edge servers) to aggressively cache pages — sometimes capturing a non-Worker-served version of your site before the OTTO Worker is fully registered.
- Confirm whether WP Rocket or another caching plugin is active on your WordPress site.
- If neither is active, the WP-329 fix corrected the header behavior on new responses — but previously cached responses at the Cloudflare edge persist until you purge them.
- Always run Purge Everything in Cloudflare after deploying or re-deploying the OTTO Worker on a non-WP-Rocket WordPress site to clear stale, pre-Worker cached pages.
If OTTO is now detected, the status in your OTTO dashboard will update to Active. No further action is needed.
⚠️ If the Diagnostic Scan Still Reports OTTO as Not Found
If you have completed Steps 1–4 and the scan still fails, check these additional edge cases:
- DNS proxy status: In your Cloudflare DNS settings, confirm the record for your domain shows an orange cloud (proxied). A grey cloud (DNS-only) routes traffic around Cloudflare entirely, so Workers never run.
- Multiple Cloudflare accounts or zones: Confirm the API token belongs to the Cloudflare account that controls your domain's DNS. A token from a different account will validate in OTTO but cannot deploy to the correct zone.
- Firewall rules or Page Rules: Check that no active Cloudflare firewall rule or Page Rule is set to bypass or block the Worker from running on your domain's routes.
- Force a full reconnect: In OTTO settings, disconnect the Cloudflare integration, purge the Cloudflare cache again, wait 60 seconds, then reconnect to force OTTO to redeploy the Worker from scratch.
If the issue persists after all of the above, contact Search Atlas support. Include your domain name, the name of your API token (not the token value itself), and a screenshot of your Cloudflare Workers Routes page so the team can diagnose the configuration quickly.
🎯 You have now verified the three layers required for OTTO detection: a correctly permissioned API token, an active deployed Worker, and a matching Worker route. For a complete walkthrough of the initial setup, see the OTTO Installation via Cloudflare guide.