Documentation · Letting our agent through your CDN · Cloudflare

Allowing our agent through Cloudflare

On Cloudflare, our agent is let through with one custom rule: it matches our user agent and our addresses together, and its Skip action passes the request over Super Bot Fight Mode, rate limiting and Browser Integrity Check. The free plan’s Bot Fight Mode cannot be skipped by a rule, so on that plan an IP access rule does the job instead.

What to match

User agent starts with OttomAgent/
Source address is one of those in https://ottom.io/agent/ips.json

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses. The current addresses are also listed on our agent page.

What you need

A Cloudflare account with permission to edit the zone’s security rules.
The current addresses from https://ottom.io/agent/ips.json.
Which plan the zone is on. The free plan has Bot Fight Mode, which no rule can skip, so step 4 is different there.

Setting it up

1. Create a list of our addresses
In your account, go to Settings, Configurations, Lists, and choose Create new list. Name it ottom_agent, choose the IP type, and add each address from the file above.
2. Create a custom rule
In the zone, go to Security rules, choose Create rule, then Custom rules. Name it Allow Ottom agent. Choose Edit expression and paste the expression below. starts_with is a function and is case sensitive, so type it exactly.
```
(ip.src in $ottom_agent and starts_with(http.user_agent, "OttomAgent/"))
```
3. Choose what it skips
Set the action to Skip. Tick All Super Bot Fight Mode rules and All rate limiting rules. Under More components to skip, tick Browser Integrity Check and Security Level: skipping a whole phase does not skip Browser Integrity Check. Leave All managed rules unticked, so the managed rules that look for attacks still inspect our requests. Tick All remaining custom rules only if a custom rule of your own challenges bots.
4. On the free plan, add an IP access rule
Bot Fight Mode cannot be skipped by a custom rule. Cloudflare does not run it when an IP access rule matches first, so in Security rules choose Create rule, then IP access rules, and add each address from the file with the action Allow. This rule matches the address alone, and an Allow here also passes custom rules and managed rules, so add only the addresses in the file. The alternative is to turn Bot Fight Mode off.
5. Put the rule first and deploy it
Drag the rule to the top of your custom rules, so no rule above it challenges the request first, and choose Deploy.

Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In your zone’s security events, filter on the user agent starting with our token: the rule shows as the one that matched, with the action Skip.

When a scan is still blocked

The report still shows a bot protection block
Open your AI bot policies, under Security settings, Configure AI bot policies. A policy that blocks the Agent category can block unverified agents such as ours, and Cloudflare does not say that a Skip of Super Bot Fight Mode passes it. Allow the Agent category, or add the IP access rule from step 4.
Under Attack mode is on
Ticking Security Level in step 3 is the skip for it. If a scan is still challenged, the IP access rule from step 4 lets our addresses through.
The rule never matches
Check the list has every address in the file, and that the expression has the slash after our token. A list created under one account is not visible to a zone in another.

Good to know

Cloudflare announced that from 15 September 2026, new domains block AI agents and training bots by default on pages that show ads. A setting nobody on your team chose is still your policy, so read your AI bot policies once.
If you also use Cloudflare Bot Management on Enterprise, your bot rules are custom rules that read the bot score. Ticking All remaining custom rules in step 3 passes them, so put any custom rule that must still apply to us above this one.
Our own limits cap how often we visit any one store, counted across everyone who asks. The limits page has the numbers.

Cloudflare documentation

Menus move. If a name here no longer matches your dashboard, these are the pages we checked this guide against:

Questions

Why not an IP access rule on every plan?

It matches the address alone and passes your managed rules too. The custom rule matches the address and the user agent, and skips only the bot checks, which is the narrower opening. On the free plan the IP access rule is the only way past Bot Fight Mode short of turning it off.

What about Cloudflare’s verified bots setting?

This rule does not depend on it. It lets our agent through whatever your verified bots setting is, and changes nothing for any other bot.

The same rule for other providers, and why it is safe: the CDN guides.