Home 📖 Features & How-To 🛡️ How to Allowlist OTTO in Cloudflare and WAFs

🛡️ How to Allowlist OTTO in Cloudflare and WAFs

Last updated on Oct 26, 2026

🔎 Why OTTO Needs Firewall Access

OTTO needs to visit your website to scan pages, detect issues, and apply optimizations. Security tools such as Cloudflare, Sucuri, Wordfence, or your host's firewall sometimes mistake automated visits for unwanted bots and block them. When that happens, OTTO may not work properly on your site.

Adding OTTO to your allowlist (also called a whitelist) tells your firewall that these visits are safe.

⚠️ Signs OTTO Is Being Blocked

  • Site audits fail, stay empty, or show errors such as 403 (Forbidden) or 503 (Service Unavailable).
  • OTTO shows pages as unreachable even though they load fine in your browser.
  • Optimizations do not appear on your live pages.
  • You see repeated challenge pages (such as CAPTCHA) in your firewall logs for Search Atlas traffic.

📋 What You Need Before You Start

  • Admin access to your Cloudflare account, hosting panel, or security plugin.
  • The current list of OTTO IP addresses and the crawler user-agent details.

Important: IP addresses can change over time, so we do not publish a fixed list in this article. To get the most up-to-date IPs, open the chat widget in the bottom-right corner of the platform and type human teammate. Using an outdated list is a common reason OTTO gets blocked again later.

☁️ How to Allowlist OTTO in Cloudflare

Menu names can vary slightly depending on your Cloudflare plan and dashboard version. The general steps are:

  1. Log in to your Cloudflare dashboard and select your domain.
  2. Go to Security and open WAF.
  3. Choose Custom rules and click Create rule.
  4. Name the rule something clear, such as Allow OTTO Crawler.
  5. Set the condition to IP Source Address****is in, then paste the OTTO IP addresses provided by our team.
  6. Under the action, choose Skip and select the security features to skip, such as rate limiting, managed rules, and bot protections.
  7. Place the rule at the top of your rule list so nothing else blocks the request first.
  8. Click Deploy.

Alternatively, you can add each IP under Security then WAF then Tools (IP Access Rules) and set the action to Allow.

🤖 Check Bot Protection Settings

Even with an allow rule in place, Cloudflare's bot features can still challenge OTTO. Review these settings:

  • Bot Fight Mode / Super Bot Fight Mode: make sure the allow rule is applied or that verified or known traffic is not challenged.
  • Under Attack Mode: this shows a challenge page to every visitor and will block OTTO. Turn it off when you are not actively under attack.
  • Rate limiting: make sure OTTO IPs are excluded so scans are not cut off midway.
  • Browser Integrity Check: consider skipping it for the OTTO IPs if you still see blocks.

🧱 Other Firewalls and Security Tools

The steps differ by tool, but the idea is the same: allow the OTTO IP addresses and skip bot or rate-limit checks for them.

  • Hosting firewalls (cPanel, Plesk, managed hosts): add the IPs to the allow list in your security or firewall section, or ask your host to do it.
  • WordPress security plugins: look for a whitelist or allowed IPs setting in plugins such as Wordfence, iThemes Security, or All In One WP Security.
  • Sucuri, Imperva, Akamai, AWS WAF: add the IPs to an allow list or create a rule that bypasses bot and rate-limit checks.
  • Server-level rules (.htaccess, Nginx, ModSecurity): make sure no rules deny the OTTO IPs or block the crawler's user agent.

✅ How to Confirm It Worked

  1. Save and deploy your changes, then wait a few minutes for them to take effect.
  2. Return to OTTO in Search Atlas and run a new scan or audit of your site.
  3. Check that pages are crawled successfully and that errors such as 403 or 503 no longer appear.
  4. If you have access to firewall logs, confirm the OTTO requests now show as allowed or skipped.

🛠️ Troubleshooting Tips

  • Still seeing 403 errors: check that your allow rule sits above other blocking rules and that every OTTO IP was entered correctly, with no extra spaces.
  • Works for some pages only: a rule on a specific path, such as login or admin pages, may be blocking OTTO. Review path-based rules.
  • Multiple security layers: if you use Cloudflare plus a hosting firewall plus a plugin, each one needs the allowlist.
  • Challenges returning after a while: the IP list may have changed. Ask for the latest list through chat.
  • Using a CDN or proxy: make sure the rule is applied at the layer that sees the visitor's real IP address.

🔐 Is Allowlisting Safe?

Allowlisting only the specific OTTO IP addresses is safe and limited. It does not open your site to other traffic. Avoid allowing broad IP ranges you do not recognize, and review your rules from time to time to remove outdated entries.

💬 Need More Help?

If you need further assistance, open the chat widget in the bottom-right corner of the platform and type human teammate to be instantly connected with a member of our team. Let us know which firewall or security tool you use and any error messages you see, so we can help you faster.