Failed to generate critical CSS (HTTP 403).

I found an event flagged by cloudflare waf :

What page rule do you advice me to implement on cloudflare in order to bypass cloudflare without compromising too much the security ?

Do I need to add a page rule for /wp-json/jetpack-boost/v1/critical-css/ ?

Regards,

Hi @trustmedias,

Thank you trying out Jetpack Boost and your report. I’m sorry to hear that you have run into issues.

We will test the plugin with your setup and will try to be the cause of your issue and recommendations for the best setup with Cloudflare. Would you be able to provide use with the details of the event flagged by Cloudflare waf?

Best,
David

Hi,

Of course, here’s the .json with all the firewall event details (I just deleted confidential information).

{
  "action": "challenge",
  "clientASNDescription": "na",
  "clientAsn": "3303",
  "clientCountryName": "CH",
  "clientIP": "",
  "clientRequestHTTPHost": "xx.xx",
  "clientRequestHTTPMethodName": "POST",
  "clientRequestHTTPProtocol": "HTTP/2",
  "clientRequestPath": "/wp-json/jetpack-boost/v1/critical-css/singular_post/success",
  "clientRequestQuery": "",
  "datetime": "2021-04-21T19:20:12Z",
  "rayName": "6438f7e54ef2d721",
  "ruleId": "981176",
  "rulesetId": "",
  "source": "waf",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari/537.36",
  "matchIndex": 0,
  "metadata": [
    {
      "key": "group",
      "value": "owasp_inbound_blocking"
    },
    {
      "key": "rule_message",
      "value": "Inbound Anomaly Score Exceeded"
    },
    {
      "key": "score_total",
      "value": "68"
    },
    {
      "key": "score_rules",
      "value": "[\"960024\",\"981231\",\"959070\",\"981257\",\"981245\",\"981240\",\"981243\",\"973338\",\"958011\",\"973308\",\"973335\",\"973334\",\"973333\",\"973344\"]"
    }
  ],
  "sampleInterval": 1
}

• This reply was modified 3 years, 7 months ago by trustmedias.
• This reply was modified 3 years, 7 months ago by trustmedias.
• This reply was modified 3 years, 7 months ago by trustmedias.
• This reply was modified 3 years, 7 months ago by trustmedias.

When generating CSS, a lot of requests are made to your site to open each page, generate the CSS and compare it to other pages.

So I’d say that the solution for this is to set-up your firewall in a way that allows you to make a lot of requests rapidly.

I’m not sure if there’s a Cloudflare setting that you can use to set that up. At the very least – I think you should be able to “Enable Developer Mode” on your Cloudflare domain when generating Critical CSS – and disable it when the CSS is done generating.