Allowlist FormReceipt safely

If your site uses Cloudflare, Wordfence, Sucuri, or another WAF, automated test runs can be challenged before submit. The safest fix is targeted allowlisting for known FormReceipt markers.

1) Allowlist identity headers and user agent

FormReceipt sends stable bot identity metadata in request headers and user agent values during test runs.

• Allowlist requests where FormReceipt identity headers are present.
• Add a user-agent allowlist rule for your form route only (not all routes).
• Keep rate limits and abuse protections active for non-FormReceipt traffic.

Recommended match strategy:

• Route scope: your contact/test form path.
• Match on explicit FormReceipt bot markers (headers + user agent).
• Require HTTPS and standard host/path validation in your WAF rule.

2) Allowlist worker IP ranges when required

Some hosting providers or WAF setups require source IP allowlisting in addition to headers.

• If your policy requires IP allowlists, ask support for the current worker egress ranges.
• Apply CIDR allowlisting only for the form endpoint path.
• Review and refresh allowlisted ranges during routine security reviews.

3) Keep security controls tight

• Do not bypass your entire challenge/WAF stack.
• Avoid global allowlist rules at the domain root.
• Track allowlist changes in your internal security/audit notes.

For policy details and what FormReceipt sends during automation, see /bot.