Skip to main content

Cloudflare Troubleshooting

Cloudflare's security features can sometimes interfere with Google OAuth authentication. This guide covers common issues and their solutions.

Common Cloudflare Issues​

Overview​

IssueCloudflare FeatureSolution
CSRF token mismatchCachingBypass rules
403 on callbackWAF/Security LevelAllow rules
Bot fight blockingBot Fight ModeException
Challenge loopsSecurity settingsPage rules
Slow authenticationRocket LoaderDisable for GSI

CSRF Token Mismatch​

Symptoms​

  • "Invalid security token" error
  • Authentication fails after Google consent
  • Works without Cloudflare

Cause​

Cloudflare caches the page including WordPress nonces, which then become invalid.

Solution​

Option 1: Cache Bypass Rule

  1. Go to Cloudflare Dashboard > Rules > Page Rules
  2. Create new rule: 
    URL: yourdomain.com/wp-json/onetap/*
    Setting: Cache Level
    Value: Bypass
  3. Save and Deploy

Option 2: Cache Rules (newer)

  1. Go to Rules > Cache Rules
  2. Create rule: 
    Expression: (starts_with(http.request.uri.path, "/wp-json/onetap"))
    Cache status: Bypass cache

Additional URLs to Bypass​

yourdomain.com/wp-json/*
yourdomain.com/wp-admin/admin-ajax.php
yourdomain.com/my-account/*

403 Forbidden on Callback​

Symptoms​

  • Error 403 when Google redirects back
  • "Access Denied" page
  • Works fine without Cloudflare proxy

Cause​

Cloudflare WAF or Security Level blocking the OAuth callback.

Solution​

Option 1: WAF Exception

  1. Go to Security > WAF
  2. Click Tools
  3. Under IP Access Rules or custom rules
  4. Create exception for callback: 
    Expression: (http.request.uri.path eq "/wp-json/onetap/v1/callback")
    Action: Skip all remaining custom rules

Option 2: Firewall Rule

  1. Go to Security > WAF > Custom Rules
  2. Create new rule: 
    Name: Allow OneTap Callback
    Expression: (http.request.uri.path contains "/wp-json/onetap")
    Action: Skip (select which features to skip)

Option 3: Lower Security for Path

Create a Page Rule:

URL: yourdomain.com/wp-json/onetap/*
Setting: Security Level
Value: Essentially Off

Bot Fight Mode Blocking​

Symptoms​

  • One Tap or button doesn't work
  • "Checking your browser" challenge appears
  • Works in incognito or different browser

Cause​

Cloudflare's Bot Fight Mode may flag Google's OAuth requests.

Solution​

Option 1: Disable for OAuth paths

  1. Go to Security > Bots
  2. Find "Bot Fight Mode"
  3. Create exception rule: 
    Skip: (http.request.uri.path contains "onetap")

Option 2: Super Bot Fight Mode settings

If using Super Bot Fight Mode:

  1. Go to Security > Bots > Configure
  2. Under "Definitely automated":
    • Consider "Managed Challenge" instead of "Block"
  3. Under "Verified bots":
    • Ensure "Google" is allowed

Challenge Page Loops​

Symptoms​

  • Stuck on "Checking your browser" page
  • Page keeps reloading
  • Never completes OAuth flow

Cause​

Security challenge interrupts OAuth flow, preventing completion.

Solution​

  1. Create Page Rule for entire OAuth flow:

    URL: yourdomain.com/wp-json/onetap/*
    Security Level: Essentially Off

  2. Also consider for My Account page:

    URL: yourdomain.com/my-account/*
    Security Level: Low

Rocket Loader Issues​

Symptoms​

  • Google button doesn't render
  • "Cannot read properties of undefined" errors
  • Button appears then disappears

Cause​

Cloudflare Rocket Loader defers JavaScript, breaking Google Identity Services script initialization order.

Solution​

Option 1: Disable Rocket Loader globally (simplest)

  1. Go to Speed > Optimization > Content Optimization
  2. Find "Rocket Loader"
  3. Toggle Off

Option 2: Exclude Google scripts

Add to your site's HTML or via plugin:

<script src="https://accounts.google.com/gsi/client" data-cfasync="false"></script>

Option 3: Worker to exclude

If using Cloudflare Workers, exclude GSI scripts from optimization.

Orange Cloud (Proxy) Issues​

Symptoms​

  • Works with grey cloud (DNS only)
  • Breaks with orange cloud (proxied)

Cause​

Cloudflare proxy changes how requests are processed.

Diagnosis​

  1. In Cloudflare DNS, toggle your domain from proxied (orange) to DNS only (grey)
  2. Wait 5 minutes
  3. Test Google sign-in
  4. If it works, issue is Cloudflare proxy-related

Solution​

Rather than disabling proxy entirely:

  1. Keep proxy enabled for security
  2. Create exceptions for OAuth paths (see above)
  3. Ensure SSL mode is "Full (strict)"

SSL/TLS Configuration​

Symptoms​

  • "Insecure connection" warnings
  • Mixed content errors
  • Redirect loops
  1. Go to SSL/TLS
  2. Set mode to Full (strict)
  3. Enable Always Use HTTPS
  4. Enable Automatic HTTPS Rewrites

Edge Certificates​

Ensure you have:

  • Valid edge certificate (Cloudflare provides free)
  • Valid origin certificate (from your host or Let's Encrypt)

Page Rules (in order)​

Rule 1: Bypass cache for WP JSON

URL: yourdomain.com/wp-json/*
Cache Level: Bypass
Security Level: Essentially Off

Rule 2: Bypass cache for My Account

URL: yourdomain.com/my-account/*
Cache Level: Bypass

Rule 3: Bypass cache for WP Admin

URL: yourdomain.com/wp-admin/*
Cache Level: Bypass

Cache Rules​

Expression: (starts_with(http.request.uri.path, "/wp-json/"))
Action: Bypass cache

WAF Custom Rules​

Name: Allow OneTap OAuth
Expression: (http.request.uri.path contains "onetap") or
            (http.request.uri.path contains "wp-json/onetap")
Action: Skip (Super Bot Fight Mode, Security Level)

Speed Settings​

  • Rocket Loader: Off (or exclude GSI scripts)
  • Auto Minify JS: Off for WordPress (or test carefully)

Debugging Cloudflare Issues​

1. Check Ray ID​

When you see an error:

  1. Note the Cloudflare Ray ID at bottom of error page
  2. Go to Security > Events
  3. Search by Ray ID
  4. See what rule triggered

2. Disable Features One by One​

Test by temporarily disabling:

  1. Rocket Loader
  2. Bot Fight Mode
  3. Security Level (set to "Off" for testing)
  4. WAF Managed Rules

3. Development Mode​

For temporary debugging:

  1. Go to Overview > Quick Actions
  2. Enable "Development Mode" (3 hours)
  3. This disables caching
  4. Test Google sign-in

4. Check Headers​

Using browser dev tools:

  1. Network tab > select callback request
  2. Look for cf-cache-status header
  3. Should be BYPASS or DYNAMIC for OAuth endpoints

Cloudflare Workers​

If using Cloudflare Workers:

Don't Modify OAuth Requests​

// In your worker, passthrough OAuth
addEventListener('fetch', event => {
    const url = new URL(event.request.url);

    // Don't modify OAuth endpoints
    if (url.pathname.startsWith('/wp-json/onetap')) {
        return event.respondWith(fetch(event.request));
    }

    // Your other worker logic...
});

APO (Automatic Platform Optimization)​

Cloudflare APO for WordPress can cause authentication issues by caching pages that contain WordPress nonces.

Symptoms with APO​

  • Error message: "Cookie verification failed" or "Ha fallado la comprobación de la cookie"
  • Technical error: rest_cookie_invalid_nonce in browser console
  • Login works for some users but fails for others (depending on cache state)
  • Problem appears after Google authentication completes (not during)
  • Issue is intermittent - clearing browser cache temporarily fixes it

Cause​

APO caches the full HTML of pages, including embedded WordPress nonces (wp_rest nonce). These nonces:

  • Are valid for 24 hours
  • Get embedded in the page when first cached
  • Are served to all visitors from cache
  • Become invalid over time while still being served

When a user authenticates with Google, the plugin sends the cached (stale) nonce to the REST API endpoint, which rejects it.

Diagnosis​

Check if APO is caching your login pages:

# Check My Account page
curl -sI https://yourdomain.com/my-account/ | grep -iE "cf-cache|age:"

# Check Checkout page
curl -sI https://yourdomain.com/checkout/ | grep -iE "cf-cache|age:"

Problem confirmed if you see:

cf-cache-status: HIT
age: 1181  # (any value > 60 seconds)

Correct behavior:

cf-cache-status: BYPASS
# or
cf-cache-status: DYNAMIC

Solution: Create Cache Bypass Rule​

Step 1: Go to Cloudflare Dashboard → Rules → Cache Rules

Step 2: Click Create rule

Step 3: Configure the rule:

Rule name: Bypass cache for WooCommerce login pages

When incoming requests match...
Expression: (starts_with(http.request.uri.path, "/my-account")) or
            (starts_with(http.request.uri.path, "/mi-cuenta")) or
            (starts_with(http.request.uri.path, "/checkout")) or
            (starts_with(http.request.uri.path, "/cart")) or
            (starts_with(http.request.uri.path, "/finalizar"))

Then...
Cache status: Bypass cache

Step 4: Deploy the rule

Step 5: Purge cache

  • Go to Caching → Configuration → Purge Everything

Step 6: Verify the fix:

curl -sI https://yourdomain.com/my-account/ | grep -iE "cf-cache"
# Should show: cf-cache-status: BYPASS

Alternative: Using APO Plugin Settings​

If you're using the official Cloudflare WordPress plugin:

  1. Go to WordPress Admin → Settings → Cloudflare
  2. Find APO Settings
  3. Add exclusion patterns: 
    /my-account/*
    /mi-cuenta/*
    /checkout/*
    /cart/*

Pages to Always Exclude from APO Cache​

PageReason
/my-account/Contains login form with nonce
/mi-cuenta/Spanish version
/checkout/Contains nonces for payment
/cart/Dynamic cart contents
/wp-json/*REST API endpoints

Testing After Fix​

  1. Clear all caches:

    • Cloudflare: Purge Everything
    • WP Rocket/other cache plugin
    • Browser cache

  2. Test in incognito window

  3. Verify with curl:

    # All these should return BYPASS
    curl -sI https://yourdomain.com/my-account/ | grep cf-cache
    curl -sI https://yourdomain.com/checkout/ | grep cf-cache

  4. Test Google Sign-In - should work without errors

Testing Your Configuration​

Checklist​

After configuration:

  • Clear Cloudflare cache (Purge Everything)
  • Clear browser cache
  • Wait 5 minutes for propagation
  • Test in incognito window
  • Test on mobile device
  • Check browser console for errors
  • Verify callback URL works directly

Quick Test​

# Test callback endpoint is reachable
curl -I "https://yourdomain.com/wp-json/onetap/v1/test"

# Should return 200, not 403

Getting Help​

If issues persist:

  1. Cloudflare Support: For proxy/WAF issues
  2. OneTap Support: For plugin configuration
  3. Include:
    • Ray ID from errors
    • Screenshot of security events
    • Current Cloudflare settings

Next Steps​