Skip to main content

Prevent Cloudflare from Blocking ePay Webhooks

If your website is using ePay webhooks (callback URLs), Cloudflare security features such as WAF rules or Bot Fight Mode may in some cases block or challenge the incoming requests.

This guide explains how to create a Custom Rule in Cloudflare to allow your ePay callback URL to pass without being blocked.

⚠️ Note: This configuration only applies to the specific callback URL. Your other security settings remain unchanged.

Step 1 - Open Your Domain in Cloudflare​

  1. Log in to your Cloudflare account.
  2. Select the relevant domain from your dashboard.

Navigate to: Security -> Security rules

Overview

Step 2 - Create a New Custom Rule​

  1. Click Create rule
  2. Select Custom rules

Create rule

Step 3 - Configure the Rule​

Fill in the rule using your callback URL path.

Rule Settings​

  • Field: URI Path
  • Operator: starts with
  • Value: /webhook
    (or the specific path used for your ePay callback URL)

Example:

This ensures Cloudflare matches all incoming requests that begin with this path.

New custom rule

Step 4 - Select Action​

Under Then take action:

  • Choose Skip

This tells Cloudflare to skip security checks for this specific URL.

No additional fields need to be modified.

Take action

Step 5 - Deploy the Rule​

  1. Click Deploy

The rule is now active.

deploy

Result

Cloudflare will now:

  • Allow ePay webhook requests to pass
  • Prevent WAF or Bot Fight Mode from blocking the callback
  • Ensure proper communication between ePay and your website

When Is This Necessary?

You may need this configuration if:

  • Payment status updates are not being received
  • Webhook requests are failing
  • Cloudflare logs show blocked or challenged requests on your callback URL

If you are unsure about your callback path, you can verify it in your ePay configuration.