Skip to main content
Start free →

Product

Features How it works The Agent Safety & security About

Resources

Cookbook Blog Docs Changelog Support Alternatives
Pricing Account
Docs

Fixing firewall blocked errors when WPVibe edits your site

Some sites sit behind a security layer (Cloudflare, or a host firewall like WP Engine’s) that inspects incoming requests and blocks anything that looks like an attack. When WPVibe saves content that contains code, such as page-builder layouts, custom HTML or JavaScript, code snippets, or a database query, that firewall can mistake the write for a hacking attempt and stop it before it reaches WordPress.

If you have seen an error about a request being “challenged” or “blocked by Cloudflare,” this is what happened. A few things to know first:

  • Your site is fine. Your login, your Application Password, the WordPress REST API, and the WPVibe plugin all work normally. Reads and ordinary edits go through.
  • It is not a WPVibe bug or a billing issue. The firewall never lets the request reach your site, so nothing on the WordPress side can change the outcome. The fix is a small rule on the firewall.
  • It usually looks intermittent. Plain edits pass and only code-heavy writes get blocked, so it can seem random. It is not: it is the request content that triggers it.

The fix: allow WPVibe’s requests through the firewall

Every WPVibe request carries a header, X-WPVibe: 1. Tell your firewall to skip its checks for requests that carry that header. This is safe: the header is set by WPVibe on its own authenticated calls, and the request still has to pass your normal WordPress login.

If your site is on Cloudflare

  1. Open the Cloudflare dashboard and select your site’s domain.
  2. Go to Security → WAF → Custom rules → Create rule.
  3. Name it something like Allow WPVibe.
  4. Set the expression: (http.request.headers["x-wpvibe"][0] eq "1")
  5. Set the action to Skip, and tick All remaining custom rules, Managed rules, and (if shown) Super Bot Fight Mode and Rate Limiting.
  6. Deploy, then retry the edit in WPVibe.

If your Cloudflare plan is on the free tier and the block comes from Bot Fight Mode, that specific feature cannot be skipped by a rule. Either turn Bot Fight Mode off for this site, or upgrade to a plan with Super Bot Fight Mode, which can be skipped by the rule above.

If your site is on WP Engine

WP Engine runs its own security layer, and on sites with the Global Edge Security add-on it is a WP Engine-managed Cloudflare firewall you cannot access directly. There is no self-serve setting for this; the exception has to be added by WP Engine support. Contact them (live chat in the User Portal is fastest) and ask them to allowlist requests carrying the X-WPVibe header, or the user agent WPVibe/1.0, for the WordPress REST API (/wp-json/wpvibe/v1/). Mention your domain and roughly when a blocked edit happened so they can find it in their firewall logs. If they can only allowlist by IP address, contact us and we will route your site’s WPVibe traffic through a static IP you can give them.

Any other host

Ask your host’s support to allowlist the X-WPVibe header (or the WPVibe/1.0 user agent) for REST API requests. This is a common request and any managed host can do it.

If it still fails after adding the rule

A small number of blocks come from bot detection rather than content inspection, which looks at where the request comes from rather than what it contains. The header rule above will not clear those. If you have added the rule and code-heavy writes still fail, reply to WPVibe support with your site’s domain and we will look at the specific block with you.