psa We're Cloudflare protected now

[Steven P. Administrators]

Thanks to repetitive botnet attacks, we have been forced to implement cloudflare protection today, (or more specifically WAF) which seems to be something every site needs these days.

Thankfully most of the attacks were nothing but a huge inconvenience that messed up our internal analytics. But it is just annoying to have thousands of IPs hitting an article from 2003, for what purpose? I do not know..

So once the DNS has fully propagated you might see a Cloudflare prompt to access Neowin.

Thanks as always for your continued support, it means a lot.

[+Warwagon MVC]

What's the article?

[Steven P. Administrators]

On 26/05/2025 at 22:59, Warwagon said:

What's the article?

It's really not important, as botnet attacks like this just choose a random one from a long time ago. (it has happened countless times over the past few years).

[SnoopZ]

Site keeps going down for me.

[Steven P. Administrators]

On 26/05/2025 at 23:27, SnoopZ said:

Site keeps going down for me.

What happens? Cloudflare error or something else?

[SnoopZ]

On 26/05/2025 at 22:41, Steven P. said:

What happens? Cloudflare error or something else?

Sorry I can't remember but it didn't have cloud flare in the error message I don't think, I've seen it once this afternoon and once this evening.

When/if it happens again I'll take a screenshot.

[SnoopZ]

Just happened again after closing browser after last message.

Can't get it to work in Vivaldi or Edge but tried Chrome and I can view the site again.

 

Error message is....

This site can’t be reached

The web page at https://neowin.net/ might be temporarily down or it may have moved permanently to a new web address.

ERR_ECH_FALLBACK_CERTIFICATE_INVALID

Edited May 26, 2025 by SnoopZ

[SnoopZ]

Just bombed out on Chrome too, also happens on more than one device and 3 browsers now.

It's just come back on Vivaldi but not sure how long it lasts before it goes again. I've tried with ad blocker off and it's still broken.

[Brandon H Supervisor]

Just had that fallback certificate error as well. Thought it was my adGuard acting up but Neowin is whitelisted.

[DaveLegg Developer]

I've disabled the "ECH" support, which will hopefully resolve this

[1337ish]

Just to say I run an IPB v4 forum behind Cloudflare WAF and there is a WAF rule that may trigger and block attachments at times if you want the rule.

[Steven P. Administrators]

On 27/05/2025 at 18:33, 1337ish said:

Just to say I run an IPB v4 forum behind Cloudflare WAF and there is a WAF rule that may trigger and block attachments at times if you want the rule.

Thanks, I will look into that now.

BTW our (staff only) online counter looks "normal" now, it has been 24 hours since the DNS propagation. I got the verify if you are human prompt an hour ago, so I think we're fully over worldwide now.

[jfam]

I host my own RSS reader (FreshRSS) and I've unable to pull the RSS feed for the last ~24 hours. I get a HTTP 403 Forbidden error. Presumably related to the timing of the Cloudflare changes.

If I check the site in the W3C validator, I get a similar error. https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Fneowin.net%2Fnews%2Frss

Works fine in a browser or from the command line from my little homelab server.

[Steven P. Administrators]

On 27/05/2025 at 18:48, jfam said:

I host my own RSS reader (FreshRSS) and I've unable to pull the RSS feed for the last ~24 hours. I get a HTTP 403 Forbidden error. Presumably related to the timing of the Cloudflare changes.

If I check the site in the W3C validator, I get a similar error. https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Fneowin.net%2Fnews%2Frss

Works fine in a browser or from the command line from my little homelab server.

I've forwarded it to the guy who can better respond about this.

[DaveLegg Developer]

On 27/05/2025 at 17:48, jfam said:

I host my own RSS reader (FreshRSS) and I've unable to pull the RSS feed for the last ~24 hours. I get a HTTP 403 Forbidden error. Presumably related to the timing of the Cloudflare changes.

If I check the site in the W3C validator, I get a similar error. https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Fneowin.net%2Fnews%2Frss

Works fine in a browser or from the command line from my little homelab server.

I've adjusted our rules, and the RSS feed should work now. Weirdly the validator.w3.org site validator still seems to be blocked, but if you add a trailing / on the RSS url, then it does work. The rule I've added applies to both, so I don't understand why that's happening. Could you let us know if your reader is now working again?

[jfam]

On 27/05/2025 at 13:30, DaveLegg said:

I've adjusted our rules, and the RSS feed should work now. Weirdly the validator.w3.org site validator still seems to be blocked, but if you add a trailing / on the RSS url, then it does work. The rule I've added applies to both, so I don't understand why that's happening. Could you let us know if your reader is now working again?

Hey Dave, it's working now. Thanks!

[Jason S. Global Moderator]

I use Feedly for my RSS feeds, and Neowin has been working correctly today. I see articles populating in my listing.

[WITHOUT-ME]

ok

[neufuse Veteran]

randomly the forum is acting odd for me now, sometimes it wont have the post text area sometimes it will... cache cleared as much as you can and multiple browsers doing this... also randomly seeing "verifying" with the cloudflare splash page

[Steffan]

Not sure if it's related or not but I'm not able to upload any pictures to the funny pictures thread

Sorry, an unknown server error occurred when uploading this file.

(Error code: -200)

I did clear the cookies for the site

[neufuse Veteran]

every time i post now it takes me to a cloud flare "we're verifying you are human please wait" page..... that's annoying enough to make me stop posting honestly

[SnoopZ]

On 28/05/2025 at 19:57, neufuse said:

every time i post now it takes me to a cloud flare "we're verifying you are human please wait" page..... that's annoying enough to make me stop posting honestly

If that happens most of the time alot of people will stop posting for sure, something the site needs to avoid.

[neufuse Veteran]

On 28/05/2025 at 15:16, SnoopZ said:

If that happens most of the time alot of people will stop posting for sure, something the site needs to avoid.

might have been a config issue, because i havent seen it in the past 2 posts

being someone that configures cloudflare i know there are a LOT of things you can set up that cause annoyances for valid people if you set scoring wrong or the Web app filter too strict

[sphbecker Moderator]

I haven't been able to comment on news since this change. I saw a few Cloudflare errors the first day, but that has cleared up, now just can't post. I click the button and it goes gray, and nothing ever happens. Tested on multiple browsers including Safari on my iPhone, same symptoms for all.

[1337ish]

I had to craft some rules to stop WAF being too sensitive for certain actions. I can easily PM the rule template or where to look if needed. CF Caching can be a bit aggressive as well.