Troubleshooting

    Cloudflare is blocking Lemwatch checks

    Fix Cloudflare "Challenge", "Managed Challenge", or 1020 errors that make Lemwatch see your site as down.

    Updated 2026-07-09
    2 min read
    cloudflare
    firewall
    challenge

    Quick answer#

    In Cloudflare, create an IP Access Rule that allows Lemwatch's probe IP ranges, and add a WAF exception for the Lemwatch/1.0 User-Agent. Cloudflare's Bot Fight Mode and Managed Challenge otherwise block automated checks.

    What it fixes#

  1. Cloudflare error 1020 (access denied)
  2. "Managed Challenge" or "JS Challenge" pages returning HTTP 403
  3. Bot Fight Mode flagging Lemwatch as a bot
  4. Rate limits triggering during frequent checks

    5. Where to find it in Lemwatch#

    Copy the IPs from Settings → Monitoring → Probe IPs. Everything else happens in the Cloudflare dashboard.

    How to fix it#

  5. In Cloudflare, go to Security → WAF → Tools → IP Access Rules.
  6. Add each Lemwatch CIDR with action Allow and scope This website.
  7. Go to Security → Bots and disable Bot Fight Mode on the site's zone, or add a WAF Skip rule for User-Agent Lemwatch/1.0.
  8. Under Rate Limiting rules, exclude Lemwatch IPs from any rate limits.
  9. In Lemwatch, click Check now — the site should return the real 200 response.

    10. FAQ#

    Will this weaken my security?#

    No — Lemwatch IPs are static and published. Allow-listing a known monitor is standard practice.

    What about Super Bot Fight Mode?#

    Same fix: add a Skip rule for the Lemwatch User-Agent under Custom Rules.

    Related#

  10. Whitelist Lemwatch monitoring IPs
  11. Bypassing bot protection
  12. Fixing 5xx errors from firewalls
    13. Was this article helpful?

    Previous

    Whitelist Lemwatch monitoring IPs

    Next

    Fixing 5xx errors caused by your firewall

    Related Articles

    Whitelist Lemwatch monitoring IPs

    Allow Lemwatch checks through your firewall, WAF, or rate limiter using our published IP ranges and User-Agent.

    Fixing 5xx errors caused by your firewall

    Diagnose 502, 503, and 520 responses that only appear in Lemwatch — usually WAF rate limits or origin timeouts.

    Bypassing bot protection for Lemwatch checks

    Configure bot-management platforms (Cloudflare, DataDome, PerimeterX, Akamai) so Lemwatch checks succeed without weakening security.

    I'm Not Receiving Alerts

    Triage missing or delayed alerts: quiet hours, channels, spam, thresholds, maintenance mode, escalation policies, and acks.

    Back to Help Center