[robertcope]

Cloudflare doesn't make any attempt to hide the fact it's serving requests; the "server" header says "cloudflare".

The firewall logs show you exactly what rule triggers this behavior: ===== Ruleset ID: 48ba18287c544bd7bdbe842a294f1ae2 Ruleset Name: Bot Fight Mode for Definite Bots Rule ID: 874a3e315c344b1281ad4f00046aab6f =====

Users are generally free to disable rulees, the WAF, etc.