Debugging a "why was I blocked" ticket in five minutes

Debugging a "why was I blocked" ticket in five minutes

A user writes in with a screenshot of the challenge page or an error. Here's the quickest path to an answer.

1. Ask for the Ray ID from the bottom of the error page. It's the key to everything.
2. Open Security Events and search by that Ray ID. You'll see the rule that fired, the action, and the request details.
3. Look at the matched field. If it was a rate limit, check the counting key and how many requests preceded it. If it was a WAF rule, check the exact expression.
4. Decide: false positive or correct behaviour. Both are possible.
5. Fix the rule, not the user. Adding one IP to an allow list solves one ticket and creates a hole.

Keep a small internal note of every false positive you find. After a month it becomes your best guide to which rules are too broad.