Cloudflare verification blocking AI Analysis — how to whitelist it

If your website sits behind Cloudflare (or another bot-protection / firewall service) that shows visitors a “Verify you are human” or “Checking your browser…” screen, that same screen can block our AI Analysis. This article explains why it happens and how to whitelist the analyzer in about two minutes.

Why this happens

AI Analysis visits your pages with an automated browser so it can take screenshots and read your content. Bot protection services can’t tell a helpful bot from a harmful one, so instead of your page they serve the verification challenge. The result is that the analysis either fails to capture your pages, or analyzes the verification screen instead of your real content.

How to tell this is happening

• The AI analysis fails, stalls, or reports it could not capture your pages.
• Results or suggestions mention things like “Just a moment…”, “Verify you are human”, or clearly don’t match what is actually on your page.
• The Optimization Hub tells you the analyzer was blocked and offers a re-run button. No credits are spent on a blocked run.

The recommended fix: whitelist your site’s secret key

Requires AB Split Test 2.6.5 or later. On an older version, use the query-string method below.

Every request the analyzer makes to your own site — including the screenshot render — carries a request header called X-ABST-Analyzer. Its value is a secret key unique to your site. Whitelisting on that key lets the analyzer through while leaving your protection fully in place for everyone else.

Step 1 — copy your key

In WordPress, go to Settings > AB Split Test > Integrations and find AI Analyzer Whitelist Key. Click Copy.

The key looks like v1. followed by twenty characters, for example v1.4f2a9c71b83e0d6a15c2. It is generated per site and never shared between customers.

Step 2 — create the Cloudflare rule

1. Log in to the Cloudflare dashboard and select your domain.
2. Go to Security > WAF > Custom rules (on newer dashboards, Security > Security rules) and click Create rule.
3. Name it something like AB Split Test AI Analysis.
4. Click Edit expression to switch from the visual builder to the expression editor, and paste the following — replacing the example with your own key:

   http.request.headers["x-abst-analyzer"][0] eq "v1.4f2a9c71b83e0d6a15c2"

   The header name must be lowercase inside the brackets. That is how Cloudflare stores header names, and the rule will silently never match if you capitalise it.

5. Set the Action to Skip. In the skip options tick All remaining custom rules, and under the additional components tick Security Level — that is the one that disables the challenge screen. If Browser Integrity Check and Rate limiting rules are offered, tick those too.
6. Click Deploy, then re-run your AI analysis.

Why this is better than the old query-string rule

Earlier versions of this guide had you match on abhash in the URL query string. That works, but anyone who knows the trick can append ?abhash=1 to a URL and walk through your challenge screen — the rule is effectively a public bypass, and the marker is documented publicly because it also powers the on-page selector helper.

The header key has neither problem. It is a secret only your site and our analyzer know, it can’t be guessed, and it can’t be added by someone typing in a browser address bar.

We deliberately do not identify the analyzer with a custom User-Agent string. A non-browser User-Agent on a headless render lowers your bot score and makes challenges more likely, not less.

Keeping your key safe

• Treat it like a password. Don’t paste it into forums, support threads, or public screenshots.
• If it does leak, click Regenerate on the same settings screen. This mints a new key immediately and invalidates the old one — so update your Cloudflare rule straight afterwards, or the analyzer will start being challenged again.
• Competitor analysis never sends your key. Requests to other people’s sites send the harmless value 1 instead, so your secret is only ever presented to your own domain.

Fallback: the query-string method

Use this only if you are on a plugin version older than 2.6.5, or your firewall can’t match on request headers.

Every analyzer request to your own site also appends abhash to the query string (for example yoursite.com/?abhash=1). Create the same Skip rule as above, but set the match to Field = URI Query String, Operator = contains, Value = abhash.

Because this is a bypass anyone could trigger, prefer to enable it only while an analysis is running and disable it afterwards — or upgrade and switch to the header rule.

If you use Bot Fight Mode

Cloudflare’s Bot Fight Mode (under Security > Bots) ignores Skip rules — a known Cloudflare limitation that applies to the header rule too.

• Bot Fight Mode (Free plan): turn it off, at least while the analysis runs, then turn it back on afterwards.
• Super Bot Fight Mode (Pro/Business): set “Definitely automated” to Allow while the analysis runs, or turn it off temporarily.

If “I’m Under Attack” mode is on

Under Attack mode challenges every single visitor. The Skip rule above (with Security Level ticked) should let the analyzer through, but if the analysis still fails, turn Under Attack mode off while it runs.

Is this safe?

Yes. The rule skips the human-verification challenge only for requests carrying your secret key. Every other Cloudflare protection — managed WAF rules you didn’t skip, DDoS protection, SSL — stays fully active, and normal visitors are completely unaffected.

Using a different firewall or security plugin?

The same idea applies to Sucuri, Wordfence, and bot protection built into your host: allow requests whose X-ABST-Analyzer header matches your key. If the tool can’t match on headers, fall back to allowing requests whose query string contains abhash, or relax the bot protection while the analysis runs.

A note on competitor analysis

Whitelisting only works on sites you control. If a competitor’s site is behind aggressive bot protection, some of their pages may not be capturable — the analysis will simply continue with the pages it can reach.

Still stuck? Contact support and we’ll help you get it whitelisted.