Troubleshooting

Symptom	Cause	Fix
503 from the edge	all origins fail their health checks	check address, port, TLS/SNI and health-check path, and that the origin firewall allows the edge addresses, see Origins
503 with X-ZP-Reason: origin-busy	origin at maxconn, its queue full	raise the origin's capacity, or maxconn if it can take more
health shows Misconfigured	a configured hostname resolves elsewhere, or no origin and no redirect	GET /services/{fqdn}/dns names the hostname and its target, see Services
certificate stays pending	DNS not at the edge, or CAA blocks the provider	fix CNAME, A/AAAA or CAA, then POST /services/{fqdn}/ssl/issue again, see TLS
certificate upload rejected	only ECDSA is accepted	ECDSA (P-256) certificate, or ACME
apex domain cannot be onboarded	no CNAME at the zone apex	A and AAAA with the anycast addresses
change not visible	propagation	wait 30 s; emergency actions take seconds
API clients or monitoring get the challenge page	proof-of-work applies to them	protection_allowlist, or a skip rule on their address and path with skip: ["pow"], see Protection rules
legitimate users get 429	limits below the application's real traffic	raise req_per_10s or add a per-path rule, see Rate limits
429 for legitimate users during a distributed flood	origin under load, path_aggregate_per_10s below the real peak of that path	raise it or give the path its own rule; check maxconn
403 and you cannot tell who did it	several stages can deny	pr_deny in the logs names the rule or limit; empty plus coraza_action=deny is the WAF
WAF blocks a form, upload or API payload	CRS false positive	rule id into disabled_rules, or a lower paranoia_level, see WAF
one visitor blocked on every page, images included	a WAF rule matches their session cookie	that rule id into disabled_rules
your own rules stopped applying	an allow rule above them exempts the traffic	narrow the allow rule to a source and path
a rule list blocks far more than intended	rules combine with AND, negated deny rules narrow each other	alternatives into one rule with match_mode: or
works from one network, fails from another	limits, challenges and country rules act per source	test from several networks before changing anything
double slash after a redirect	target ends with / and redirect_type is prefix	remove the trailing slash, see Redirect
API answers 401 from a dual-stack host	the request left over the address family not bound to the key	bind both addresses, or curl -4, see API access
a visitor reports an error page with a Ray ID	the page names the failing side: You (rule, limit, country) or Site (origin refused, busy or silent)	send support the Ray ID and Edge Node from the footer; we find the request within 14 days

Error pages

When ZERO-PROTECT answers itself with 403, 429, 502 or 503, the page says where the request failed (visitor, ZERO-PROTECT or your site) and what the visitor can do, and ends with the Ray ID and Edge Node. The Ray ID is also in the X-ZP-Ray response header and reaches your origin as X-Request-ID. A country rule shows "not available in your region". Logo, colours and texts come from your branding, see Account.