SO HERE IS THE UPDATE ON ALL THIS ..
Plugin v13.x Breaks on Cloudflare Sites — Webhook Architecture Change Not Documented
I want to share a detailed technical finding for anyone experiencing reviews not updating after the v13.x update, particularly on sites running behind Cloudflare.
After extensive debugging I traced the root cause to an undocumented architectural change in v13.x. In previous versions the plugin used WordPress’s WP-Cron system to pull reviews outbound from Trustindex’s servers on a schedule. In v13.x this was removed entirely — there is not a single wp_schedule_event or cron hook anywhere in the plugin source code.
The plugin now operates on a webhook model where Trustindex’s servers push reviews inbound to your WordPress site via wp-admin/admin-ajax.php?action=trustindex_reviews_hook_google. While this is a reasonable architectural decision, it was not documented in the changelog and creates an immediate breaking change for any site running behind Cloudflare.
The problem is that inbound POST requests from Trustindex’s AWS server (52.21.15.185) have no browser fingerprint, cannot execute JavaScript, and carry no cookies — which is exactly the profile Cloudflare’s Bot Fight Mode and Managed Challenge are designed to block. Every webhook push was receiving a cf-mitigated: challenge 403 response before it ever reached WordPress, silently killing all review syncing.
I confirmed this by inspecting the raw response headers:
cf-mitigated: challenge
server: cloudflare
cType: managed
The fix was to add a Cloudflare WAF Custom Rule with the following expression and action set to Skip:
(http.request.uri.path eq "/wp-admin/admin-ajax.php" and http.request.uri.query contains "trustindex")
Once that rule was in place reviews synced immediately.
My recommendation to the Trustindex team is to document this change prominently in the changelog and add a notice in the plugin’s troubleshooting tab for sites running behind Cloudflare, as it is an extremely common setup. A note in the setup wizard when the webhook URL is registered would also help — something as simple as “If your site is behind Cloudflare, you will need to whitelist this endpoint” would have saved considerable debugging time.
