I’ll answer this with the same answer I provided in your support request.
Thanks for your thoughts about Wordfence.
Cloudflare is under no obligation to let us know if their processes change and we don’t expect them to. We provide the last known instructions we have to allowlist IPs or fix issues with the way Cloudflare works. If someone reaches out and tells us those no longer work like you did, we update the documentation as we are currently doing. However, we still recommend that our users reach out to Cloudflare (as Josh advised you to do) as <span style=”text-decoration: underline;”>they are the best source of information when it comes to their systems</span>. Getting upset because we don’t know exactly how to fix a Cloudflare issue is kind of like asking a McDonald’s employee how they make burgers at Burger King and being mad because they can’t tell you exactly how it is done.
We can tell this is a Cloudflare block because we can see it in the connection detail of the diagnostic report you sent us.
HTTP/1.1 429 Too Many Requests
Date: Wed, 15 Mar 2023 19:41:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
CF-Cache-Status: DYNAMIC
Report-To: {“endpoints”:[{“url”:”https:\/\/a.nel.cloudflare.com\/report\/v3?s=t7wFqjEGy43bgnbwnstKsBfXJ6jcx4bnd6jLfZ4w5NJ0sv0EKrrw8cDRrD%2BF9gHkH0DcUmkmINZq9OqdKnS6pCSAmG8Jkyd59vxljJ1rwn5bAkgj42TM0b%2FIygc1nPBaBA%3D%3D”}],”group”:”cf-nel”,”max_age”:604800}
NEL: {“success_fraction”:0,”report_to”:”cf-nel”,”max_age”:604800}
Strict-Transport-Security: max-age=15552000; preload
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 7a873bf37f03c226-VIE
alt-svc: h3=”:443″; ma=86400, h3-29=”:443″; ma=86400
429 Too Many Requests
That means that Cloudflare is rate limiting connections from your website to itself. The website needs to connect to itself to start scans and do many other things like scheduled backups, scheduled posts, etc. Luckily in your case it appears that just the scanning is rate limited as I can see crons (scheduled tasks) are current. So adding your website IP address (yours should start with 185.X.X.X) to the allowlist in Cloudflare should have addressed this, along with the Wordfence IPs which I see you already added.
Lastly, I would like to remind you that support here in the forums is voluntary, just like your participation is according to WordPress.org. It is offered for free by staff that are paid and trained Wordfence employees. If a more one-on-one support experience is preferred then a paid license is what you should look into.
I do see that you said you uninstalled Wordfence so we wish you well in whatever security solution you chose to go with.
Mia
