503 from the edge |
all origins failing health checks |
check origin address, port, TLS/SNI and that the origin allows our edge IPs; look at the health-check path |
certificate stays pending |
DNS not pointing at the edge, or CAA blocks the provider |
run the DNS check, fix CNAME/A/AAAA or CAA, request again |
| API clients or monitoring get the challenge page |
proof-of-work applies to them |
add an allow rule on their path or source IPs |
| apex domain cannot be onboarded |
CNAME at zone apex is invalid |
use A and AAAA records with the anycast addresses |
legitimate users get 429 |
limits too tight for the application |
raise req_per_10s or add a per-path rule |
| WAF blocks a form or upload |
CRS false positive |
move the rule id to logonly_rules or lower the paranoia level |
| double slash after a redirect |
target ends with / and redirect_type is prefix |
remove the trailing slash |
| change not visible |
propagation |
wait 30 s; emergency actions are immediate |