Fix Cloudflare "Challenge", "Managed Challenge", or 1020 errors that make Lemwatch see your site as down.
Quick answer
In Cloudflare, create an IP Access Rule that allows Lemwatch's probe IP ranges, and add a WAF exception for the Lemwatch/1.0 User-Agent. Cloudflare's Bot Fight Mode and Managed Challenge otherwise block automated checks.
What it fixes
Cloudflare error 1020 (access denied)
"Managed Challenge" or "JS Challenge" pages returning HTTP 403
Bot Fight Mode flagging Lemwatch as a bot
Rate limits triggering during frequent checks
Where to find it in Lemwatch
Copy the IPs from Settings → Monitoring → Probe IPs. Everything else happens in the Cloudflare dashboard.
How to fix it
In Cloudflare, go to Security → WAF → Tools → IP Access Rules.
Add each Lemwatch CIDR with action Allow and scope This website.
Go to Security → Bots and disable Bot Fight Mode on the site's zone, or add a WAF Skip rule for User-Agent Lemwatch/1.0.
Under Rate Limiting rules, exclude Lemwatch IPs from any rate limits.
In Lemwatch, click Check now — the site should return the real 200 response.
FAQ
Will this weaken my security?
No — Lemwatch IPs are static and published. Allow-listing a known monitor is standard practice.
What about Super Bot Fight Mode?
Same fix: add a Skip rule for the Lemwatch User-Agent under Custom Rules.