How to allowlist Astra's IPs in Cloudflare (CAPTCHA, Bot Fight Mode and WAF challenges)

Last updated: November 12, 2026

If your application sits behind Cloudflare, Cloudflare's bot protection can show Astra's scanner a CAPTCHA or "Just a moment..." challenge page instead of your application. The scan then fails the connectivity check, or runs but misses everything behind the challenge. This article shows how to let Astra's scanner through Cloudflare while keeping protection on for everyone else.

Who should read this

Developers and security or network admins who manage the Cloudflare account for a target that Astra scans, and who see any of these:

Connectivity Check Failure on a scan, or the target shows Unreachable during setup
Connectivity Check Error Details mentioning a Cloudflare page
Scans that complete with far fewer pages or findings than expected

Before you start

You need access to the Cloudflare dashboard for the domain, with permission to edit security settings.
Have Astra's scanner IP addresses ready. The current list is on Astra IP Ranges. Allowlist every address, because scans can come from any of them.
Find out which Cloudflare feature is challenging the scanner. Cloudflare's Security Events log shows this (see Step 4). The fix differs by feature, as described below.

Step 1: Allow Astra's IPs with a WAF custom rule (recommended)

A custom rule with the Skip action lets scanner traffic bypass the security features you choose.

In the Cloudflare dashboard, select your domain.
Open the WAF Custom rules page (under Security) and create a rule. Menu names change from time to time, so use Cloudflare's search if you can't find it.
Name it, for example Allow Astra scanner.
Set the condition to IP Source Address is in Astra's IP addresses. Or edit the expression directly and paste:

(ip.src in {168.144.85.193 168.144.87.223 34.69.226.239 35.193.102.27 12.202.180.108 34.136.217.65 35.222.104.14 104.154.201.208 34.27.197.32 34.135.0.247 153.54.104.217 34.70.219.138 104.154.186.213 34.69.130.106 34.135.25.35 34.66.6.242 34.41.10.119})

Set the action to Skip.
Choose what to skip. Cloudflare's Skip action offers these options:
- All remaining custom rules
- All rate limiting rules
- All Super Bot Fight Mode rules
- All managed rules
- Under Skip products: Browser Integrity Check, Security Level (this covers Under Attack Mode), Zone Lockdown and User Agent Blocking
Select the features that are challenging the scanner. If you aren't sure which one is responsible, select all that apply.
Deploy the rule.
Make sure the rule is above any other custom rule that challenges or blocks traffic. Cloudflare evaluates custom rules in order, so move it to the top of the list.

If the IP list on Astra IP Ranges changes, update the rule to match.

Reference: Cloudflare: Skip action options

Step 2: If Bot Fight Mode is the problem

Bot Fight Mode (the bot feature on Free plans) cannot be skipped with WAF custom rules, and the Skip action has no effect on it. Cloudflare's own documentation says so. Your options are:

Use Super Bot Fight Mode or Bot Management instead, where the Skip action does apply. Cloudflare recommends this route when you need exceptions for specific traffic.
Add an IP Access rule with the Allow action for each Astra IP address. Cloudflare says Bot Fight Mode does not trigger when an IP Access rule matches the request first, but it also notes Bot Fight Mode can still trigger in some cases. Test it before relying on it. Allowing an IP address this way also bypasses custom rules, rate limiting rules and managed rules for that address. See Cloudflare: IP Access rules.
Turn Bot Fight Mode off for the domain while you scan, and turn it back on afterwards. Do this only on non-production sites.

Cloudflare recommends custom rules over IP Access rules for new configurations, so use an IP Access rule only for this Bot Fight Mode case.

Reference: Cloudflare: Bot Fight Mode

Step 3: Check other things that can still block the scanner

Allowlisting the IPs in one place doesn't always cover every feature. Review these:

Under Attack Mode: shows an interstitial challenge to all visitors. Skip Security Level in your custom rule (Step 1), or turn Under Attack Mode off for the scan.
Rate limiting rules: include All rate limiting rules in the Skip rule, otherwise the scan can be throttled or blocked part-way.
Cloudflare Access / Zero Trust: an Access policy that requires login is not a CAPTCHA, and a WAF rule does not satisfy it. Add a Bypass policy for Astra's IP addresses in the Access application. See Cloudflare's Zero Trust documentation.
Any other firewall in front of your origin (for example your host's firewall or an origin-side IP restriction): allowlist the same IPs there too, and make sure Cloudflare's own IP ranges can still reach your origin.

Cloudflare Turnstile inside your application

Turnstile is Cloudflare's CAPTCHA alternative that you embed in your own pages, usually on login or signup forms. It works differently from the features above:

Turnstile widgets are configured at the account level. We did not find a Turnstile setting that skips or hides the widget for specific IP addresses, and Cloudflare's server-side validation guide doesn't describe one.
Your application verifies each Turnstile token on its own server through Cloudflare's siteverify endpoint. Any IP-based exemption would have to be built into your application.
The WAF rules in the steps above apply to Cloudflare's own challenges. We have not found documentation saying they suppress a Turnstile widget that your page embeds. Test this on your own site before relying on it.

If a Turnstile widget on your login form blocks the scanner, use one of these:

Staging or test environments: use Cloudflare's Turnstile test keys. Use a test sitekey in the page and the matching test secret key on your server, because production secret keys reject the dummy tokens that test sitekeys generate. The key pair 1x00000000000000000000AA (sitekey) and 1x0000000000000000000000000000000AA (secret key) always passes. Keep test keys out of production configuration. See Cloudflare: Turnstile testing.
Production: change your application's server-side check so it skips Turnstile validation for requests from Astra's IP addresses, and keep the check on for everyone else. Make sure the IP you compare against is the real client IP (for example from the CF-Connecting-IP header), and that nobody outside Astra can spoof it.

For other CAPTCHA providers, see How to scan web applications protected with CAPTCHA.

Step 4: Confirm it works

In Astra, open the target's settings, go to Target Setup → Scope and click Test Connectivity.
Connectivity check passed means the scanner can reach your site. Start your scan.
If it still fails, open See Details under Connectivity Check Failure on the failed scan. It shows whether access was denied or a Cloudflare page was returned.
In Cloudflare, open Security Events and filter by one of Astra's IP addresses. This shows which rule or feature acted on the request (for example Managed Challenge or Bot Fight Mode), so you know which one to add to the Skip rule or handle as described in Step 2.

Troubleshooting

The scan still shows a Cloudflare challenge after I added the rule. Check the rule order in the custom rules list. A challenge or block rule above the Skip rule is applied first. Then look at Security Events for the specific feature that acted. If it is Bot Fight Mode, see Step 2. Cloudflare also notes that Skip does not bypass every security feature, so check the event log rather than assuming.

Test Connectivity passes but login still fails. The challenge may be on the login form only, such as a Turnstile widget. See the Turnstile section above, and How-To: Fixing Scan Behind Login (SBL) Errors.

We can't add IPs individually. Contact Astra support from your dashboard and we can provide the ranges in CIDR notation.

The site opens in my browser but Astra says it's unreachable. Your browser is trusted by Cloudflare, while Astra connects from the IP addresses above. Allowlisting those IPs fixes this. See How to make sure Astra's scanner can reach your application.