Three Mastodon issues because of Cloudflare Bot protection

I noticed some time ago that three tags: title, description, and image.

. I had enabled Bot Fight Mode, a Cloudflare feature that blocks automated traffic it deems suspicious. Services can register domains on Cloudflare to be recognized as good actors. In fact, Bluesky and Twitter have done it.

However, Mastodon was betrayed by its decentralized nature. Each Mastodon instance runs a specific domain; mine is infrastructure. Hetzner IP addresses carry a high threat score in Cloudflare's database — they're a popular choice with bot operators.

When Mastodon's crawler tried to fetch my pages, Cloudflare served it a JavaScript challenge instead of HTML. Mastodon's http.rb client can't solve JavaScript challenges. It got no useful response, cached the failure, and moved on.

The fix: turn off Bot Fight Mode in Security > Bots in the Cloudflare dashboard.

Conclusion

This is a well-known issue in both the Mastodon and Cloudflare communities. For a public static blog, Bot Fight Mode offers minimal protection while actively breaking legitimate crawlers. Turning it off fixed all three Mastodon issues at once.

To go further:

• on April 26^th, 2026.
  Vollständiger Original-Artikel

  Den kompletten Beitrag mit allen Details direkt auf dev.to lesen.

  ↗ Original-Artikel auf dev.to lesen