GEO FIELD NOTES · HOSTING SETTINGS
Cloudflare “Attack Mode” is quietly killing your SEO and GEO
Turn it off in 3 minutes — and use these settings instead
🔎 1. Check whether it is on
Two ways, pick one:
- Cloudflare dashboard → select your domain → Overview. A yellow banner reading “I’m Under Attack Mode” means it is on.
- Test from the command line (macOS, Linux or Windows PowerShell):
curl -sI https://yourdomain.com | grep -i "cf-mitigated\|http/"Seeing cf-mitigated: challenge or HTTP/2 503 means the whole site is being challenged.
📉 2. Why it hurts SEO
- Googlebot receives the challenge page and treats it as “temporarily unreachable” — index updates slow down and new pages take much longer to appear.
- Bing and other engines do not execute JavaScript at all: the fetch simply fails and the page may stay out of the index.
- Search snippets go stale, because crawlers cannot reach your latest content.
🤖 3. Why it kills GEO (the bigger problem)
GEO means being cited by ChatGPT, Perplexity, Google AI Overviews and similar engines. Their crawlers share one trait:
| Crawler | Used by | Runs JavaScript? |
|---|---|---|
| GPTBot | OpenAI training / ChatGPT search | ❌ No |
| ClaudeBot | Anthropic | ❌ No |
| PerplexityBot | Perplexity search | ❌ No |
| CCBot | Common Crawl (a major AI data source) | ❌ No |
The result: to AI, your website is a blank page. When someone asks “where should I eat yakiniku in Hong Kong?”, the AI cites your competitors — because it has never seen you.
⏱️ 4. Turn it off in 3 minutes
- Sign in to dash.cloudflare.com
- Select your domain
- Open Overview
- Find the “Under Attack Mode” toggle
- Switch it from On to Off
- Wait 30 seconds, then re-run the
curlcheck above to confirmcf-mitigatedis gone
🛡️ 5. What to use instead (this is not “running naked”)
Attack Mode is a blunt instrument: it blocks the attack and your SEO/GEO at the same time. The right approach is targeted rules:
| Setting | Suggested value | What it does |
|---|---|---|
| Security Level | Medium (normal) / High (under attack) | Challenges suspicious IPs only — normal visitors and crawlers are unaffected |
| Rate Limiting | 60 requests per IP per minute | Stops scanners and crawler floods without touching real users |
| WAF custom rules | Challenge /wp-login.php, /admin, xmlrpc.php only | Protects the backend, leaves public content alone |
| Bot Fight Mode | Safe to enable | Targets known malicious bots, not GPTBot or Googlebot |
✅ 6. How to verify afterwards
curl -sI https://yourdomain.com→ should returnHTTP/2 200with nocf-mitigated- Google Search Console → URL Inspection → “Test live URL” → you should see the full HTML
- AI test: ask ChatGPT or Perplexity “your brand + your category” and see whether you start getting cited
- After 7–14 days, check whether the number of indexed pages in Search Console has risen
❓ 7. FAQ
Will I get attacked if I turn it off?
With the Rate Limiting and WAF rules in section 5, real protection is better than Attack Mode — and it does not take SEO or AI visibility down with it.
Can I turn it off only temporarily?
You can, but every time you switch it back on you damage indexing again. Keep it off and use targeted rules instead.
I am not on Cloudflare — does this apply?
Yes. The same logic applies to any site-wide JavaScript challenge (some hosts call it “firewall mode”). The principle: protect the backend, not the content.
🏠 8. Timway hosting clients: we turn it off and block the attacks
You did not enable Attack Mode because you wanted to lose visitors — you did it because you were afraid of being attacked. So we do not simply tell you to switch it off. We remove the blunt challenge and replace it with precise rules.
| Attack Mode left on | Handled by Timway | |
|---|---|---|
| Blocking attacks | Challenges the whole site, including real visitors | Targets suspicious IPs, paths and rates only |
| Google / Bing | May receive the challenge; indexing slows | Search engines allow-listed, crawled normally |
| AI crawlers (GEO) | All blocked — AI never sees you | GPTBot / ClaudeBot / PerplexityBot allowed |
| Setup time | You have to research Cloudflare rules | We do it, usually within one business day |
| When something breaks | You watch the dashboard yourself | We monitor traffic and 5xx and notify you |
The five things we actually do
- Disable Attack Mode — and check for leftover site-wide challenges (Page Rules, custom WAF rules).
- WAF rules — challenge only backend paths (
/wp-login.php,/admin,xmlrpc.php) and obvious scanning behaviour. Public content is never touched. - Rate limiting — a per-IP limit tuned to your real traffic, stopping scanners and crawler floods without affecting people.
- Search engine and AI crawler allow-list — Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot and CCBot verified against their published IP ranges and allowed through, so SEO and GEO are never collateral damage.
- Monitoring and alerts — traffic spikes, unusual 4xx/5xx volumes and odd source concentration get reported to you, so you do not have to live in the dashboard.
The process (3 steps)
- Audit — we measure your current crawler visibility and Cloudflare configuration, including which crawlers are being blocked.
- Configure — Attack Mode off; WAF, rate limiting and allow-lists on. Every change is logged before and after.
- Verify — curl tests, Search Console and live AI search checks confirm search engines and AI crawlers get 200, then we send you the report.
🏢 9. Client examples (real sites, verify them yourself)
Both sites below are hosted by Timway behind Cloudflare, with Attack Mode already switched off and WAF plus rate limiting in place. You can verify this yourself:
| Client | Website | Tested 31 Oct 2026 |
|---|---|---|
| BeautyLab TCM women’s health & wellness | hkbeautylab.com | Googlebot, GPTBot, PerplexityBot and ClaudeBot all returned 200 — no JS challenge |
| RainbowCC Baby & maternity products, Sha Tin | rainbowcc.com.hk | Googlebot and PerplexityBot returned 200 — no JS challenge |
curl -sIL -A "Mozilla/5.0 (compatible; GPTBot/1.4)" https://www.hkbeautylab.com/If you get 200 instead of 503 or a challenge page, search engines and AI crawlers can read your content.
Running Cloudflare Attack Mode? Let us turn it off for you
One phone call: we disable Attack Mode, put real blocking rules in place (WAF + rate limiting + crawler allow-lists) and confirm Google and AI crawlers are getting 200 again.
Timway · just say “Cloudflare Attack Mode”