← All guides SECURITY · 403 Forbidden

Firewall or Security Rules Blocking Real Visitors

A site can be fully online and still turn real visitors away if a firewall, Web Application Firewall (WAF), or bot-protection rule is set too aggressively. This tends to look different from a true outage: some visitors get through fine while others are blocked.

Signs it's a firewall or security rule, not a real outage

• The site works from some networks or locations but not others
• You see a 403 Forbidden or a "verify you are human" / bot-check page instead of a timeout
• The block coincides with a recent change to security or WAF settings, or a spike in traffic that triggered rate-limiting

Where these rules commonly live

• CDN / reverse proxy level — Cloudflare and similar services offer WAF rules, bot-fight modes, and rate limiting that can be too strict for the traffic pattern of a small site.
• Hosting platform firewall — many hosts include their own request-filtering layer separate from any CDN.
• Server-level firewall — on a self-managed server, tools like iptables or ufw can be misconfigured to block ports or IP ranges that legitimate visitors use.
• Geo-blocking — rules that restrict traffic by country, sometimes left on from testing and forgotten.

How to fix it

1. Check your CDN or hosting dashboard's security/WAF section for recently added rules, and temporarily disable ones you don't remember setting on purpose.
2. Check bot-protection sensitivity settings — an aggressive setting can flag ordinary browsers as bots, especially visitors using a VPN or privacy-focused browser.
3. Review rate-limiting rules if the block started during a traffic spike; a limit that's too tight for legitimate use is a common cause.
4. If you manage the server directly, review recent changes to firewall rules and confirm the ports and IP ranges you expect are actually open.