Skip to main content

Migration is blocked by Cloudflare security

During migration, Cloudflare security settings can block server-to-server requests.

Updated over a week ago

While Cloudflare verification can be bypassed in a browser, our migration server cannot pass these checks unless it is explicitly allowed. As a result, the migration process may stop or fail. To resolve this issue, you need to allow our server IP addresses to bypass Cloudflare security rules.

How to allow our server IPs in Cloudflare

Follow the steps below to whitelist our server IPs in your Cloudflare account:

  1. Log in to your Cloudflare account.

  2. Select the website where the migration is running (your domain).

  3. Go to Security → Security Rules.

  4. Click Create a new rule.

  5. Give the rule a name (for example: Whitelist Migration Server IPs).
    ​

⚠️ Important: When Cloudflare Rules May Not Work

In some cases, even after correctly creating a Custom WAF rule and whitelisting our IP addresses, the migration may still fail.

This happens because certain Cloudflare security features operate at the edge level and may override your rule.

When this can happen

The rule may not apply properly if any of the following are enabled:

  • Under Attack Mode

  • Bot Fight Mode

  • Managed Rules

  • Rate Limiting

  • JavaScript (JS) Challenge

Important:
The JS Challenge runs under Bot Fight Mode and works at the edge level.
Because of this, even properly configured skip rules may not be applied.

How to properly configure the rule

Go to:

Cloudflare → Security → WAF → Custom Rules

Expression:

(ip.src eq 173.212.251.33) or (ip.src eq 185.161.226.58)

Action:
Skip

Make sure to skip:

  • Under Attack Mode

  • Bot Fight Mode

  • Managed Rules

  • Rate Limiting

⚠️ The rule must be placed at the top of the rule list (highest priority).

Rule configuration

Create two conditions, one for each migration server IP (Whitelist Migration Server IPs).

For each condition, use the following settings:

  • Field: IP Source Address

  • Operator: equals

  • Value: one of the IPs listed above

If migration still fails

If:

  • The IPs are correct

  • The rule is created properly

  • All skip options are selected

  • But migration only works when Under Attack Mode is disabled

Then the connection is likely being blocked by Cloudflare’s JS Challenge at the edge level.

Recommended solution (stable method)

If you cannot disable Under Attack Mode due to active bot attacks, create a dedicated migration subdomain.

Example:

migration.yourdomain.com

Steps:

  1. Add the subdomain in Cloudflare

  2. Set it to DNS Only (grey cloud)

  3. Add it to your web server

  4. Run the connector via this subdomain

Example connector URL:

https://migration.yourdomain.com/mp_connector/connector.php

This prevents Cloudflare security layers from interfering with migration.

Action settings

  1. Under Then take action…, select Skip from the dropdown.
    This allows the specified IPs to bypass Cloudflare security features.

  2. Click Deploy to activate the rule.

Reference

For more details, you can review Cloudflare’s official documentation on Skip Rules:
​https://developers.cloudflare.com/waf/custom-rules/skip/

What happens next

Once the rule is deployed and the IPs are allowed, the migration can continue without Cloudflare blocking the process.

Our Migrationpro Support Team is here to help!

Feel free to contact us via email at [email protected] or use the Live Chat available in the bottom-right corner of the page!

Did this answer your question?