Why does my firewall block SEOGuard but not Google?

Googlebot and other verified search crawlers are recognised by Cloudflare and Vercel and allowed automatically. SEOGuard runs on cloud servers, so bot protection treats it like any unknown data-center client and shows it a challenge page instead of your HTML.

Is it safe to add the rule?

Yes. The rule only matches requests carrying your site's secret token, which is random, unique to the site and never sent anywhere except your own domain. You can rotate it any time in Site settings → Crawler access.

Does a Turnstile widget block scans?

No. Turnstile only checks visitors who submit the form it protects. Scans fail when a whole page is challenged: Bot Fight Mode, Managed Challenge rules, Under Attack mode or Vercel Attack Mode.

Do blocked scans use my quota?

No. When we detect a firewall block we stop early and don't count the scan.

Docs

Allow SEOGuard through your firewall

If a scan fails with “blocked SEOGuard's crawler”, your CDN or host is challenging our requests. One rule fixes it, and it takes about two minutes.

Our crawler runs on cloud servers, so bot protection treats it like any other data-center traffic. Search engines such as Googlebot are usually allowed automatically — this only lets SEOGuard in. Every request we send carries a secret header unique to this site:

Header

x-seoguard-verify

Value

YOUR_SITE_TOKEN

Your site's token is in Site settings → Crawler access inside the SEOGuard dashboard.

Skip bot checks for SEOGuard (WAF custom rule)

In the Cloudflare dashboard open your domain → Security → Security rules → Create rule → Custom rules.
Name it Allow SEOGuard, click Edit expression and paste:
(http.request.headers["x-seoguard-verify"][0] eq "YOUR_SITE_TOKEN")
Under Choose action select Skip and tick All Super Bot Fight Mode rules, All managed rules, All rate limiting rules and All remaining custom rules. Under More components to skip also tick Security Level (covers I'm Under Attack) and Browser Integrity Check.
Place the rule first in the list and click Deploy.

Free plan "Bot Fight Mode" can't be skipped by any rule — Cloudflare runs it outside the rules engine. Turn it off under Security → Settings → Bot traffic → Bot Fight Mode or upgrade to Super Bot Fight Mode (Pro), which honours the Skip rule above.

A Turnstile widget on your forms doesn't stop us — it only checks visitors who submit them. What blocks us are challenge pages (Bot Fight Mode, Managed Challenge rules, Under Attack mode), which the rule above handles.

Alternative: allow the user agent SEOGuardBot. It's simpler, but anyone can fake a user agent — the header token can't be guessed, so prefer it.

Changes apply within a minute — then run the scan again. Blocked scans never count against your quota.

Common questions

Why does my firewall block SEOGuard but not Google?: Googlebot and other verified search crawlers are recognised by Cloudflare and Vercel and allowed automatically. SEOGuard runs on cloud servers, so bot protection treats it like any unknown data-center client and shows it a challenge page instead of your HTML.
Is it safe to add the rule?: Yes. The rule only matches requests carrying your site's secret token, which is random, unique to the site and never sent anywhere except your own domain. You can rotate it any time in Site settings → Crawler access.
Does a Turnstile widget block scans?: No. Turnstile only checks visitors who submit the form it protects. Scans fail when a whole page is challenged: Bot Fight Mode, Managed Challenge rules, Under Attack mode or Vercel Attack Mode.
Do blocked scans use my quota?: No. When we detect a firewall block we stop early and don't count the scan.