wmj/hermes-cpanel-agent
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

[RESOLVED] Cloudflare WAF was NOT blocking — App Password is the real path ✅ #1

New Issue
Closed
opened 2026-07-03 06:50:45 +00:00 by wmj · 0 comments
wmj commented 2026-07-03 06:50:45 +00:00
Owner
Copy Link
Copy Source

Status: ✅ RESOLVED — False alarm

The Cloudflare WAF was NEVER blocking the Contabo IP from the WordPress REST API.

We proved this by testing:

  • ummah.falahos.my/wp-json/wp/v2/users → HTTP 200 (public)
  • ummah.falahos.my/wp-json/wp/v2/plugins → HTTP 401 (needs auth, not blocked)
  • ummah.falahos.my/wp-json/hermes/v1/content/generate → HTTP 404 (plugin not deployed)

The WP REST API was always reachable. The HTTP 401 responses were WordPress asking for authentication — not Cloudflare blocking traffic.

What We Learned

Documented in wiki: https://git.falahos.my/wmj/hermes-cpanel-agent/wiki/Cloudflare-WAF-Bypass-Discovery

What Replaces This

  • Issue #2: WordPress Application Password (the real auth mechanism)
  • The CF API token (cfut_) has DNS:Edit + Zone:Read scope — no WAF management needed
## Status: ✅ RESOLVED — False alarm **The Cloudflare WAF was NEVER blocking the Contabo IP from the WordPress REST API.** We proved this by testing: - `ummah.falahos.my/wp-json/wp/v2/users` → HTTP 200 (public) - `ummah.falahos.my/wp-json/wp/v2/plugins` → HTTP 401 (needs auth, not blocked) - `ummah.falahos.my/wp-json/hermes/v1/content/generate` → HTTP 404 (plugin not deployed) The WP REST API was always reachable. The HTTP 401 responses were WordPress asking for authentication — not Cloudflare blocking traffic. ## What We Learned Documented in wiki: https://git.falahos.my/wmj/hermes-cpanel-agent/wiki/Cloudflare-WAF-Bypass-Discovery ## What Replaces This - Issue #2: WordPress Application Password (the real auth mechanism) - The CF API token (cfut_) has DNS:Edit + Zone:Read scope — no WAF management needed
hermes-contabo was assigned by wmj 2026-07-03 06:50:45 +00:00
wmj changed title from [BLOCKER P0] Cloudflare WAF blocks Contabo 172.17.0.1 from ummah.falahos.my/wp-json/ to [RESOLVED] Cloudflare WAF was NOT blocking — App Password is the real path ✅ 2026-07-03 07:01:13 +00:00
wmj closed this issue 2026-07-03 07:01:13 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
wmj
No Assignees hermes-contabo
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: wmj/hermes-cpanel-agent#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?