Fix Cloudflare Blocking Claude, ChatGPT, or Site MCP

If Claude, ChatGPT, Cursor, or another AI client cannot connect to your WordPress site through Site MCP, Cloudflare (or a similar WAF / bot filter) is one of the most common causes.

This is different from SiteSkite portal connection or backup problems. Here, the AI client itself is blocked because of its user-agent or because OAuth discovery / registration URLs are denied — even when SiteSkite’s own servers work fine.

For Cloudflare issues with backups, cron, or linking a site in the SiteSkite portal, see:
Troubleshooting Cloudflare: SiteSkite Backups & Site Connection

Symptoms

You may see one or more of these:

• Claude: “Couldn't register with SiteSkite’s sign-in service.”

• ChatGPT reports the site does not implement OAuth, or the connector fails during sign-in

• SiteSkite MCP diagnostics fail on “AI clients are not blocked” with HTTP 403

• A normal browser request succeeds, but the same request with an AI user-agent is blocked

• Cloudflare previously blocked a Claude-User or ChatGPT-User POST to your MCP endpoint

• You added an exception only for /wp-json/mcp/siteskite, but the connection still fails

Why This Happens

Connecting Claude or ChatGPT to a WordPress site with Site MCP is not only a call to the MCP endpoint. The AI client must also:

1. Discover OAuth metadata

2. Register itself (Dynamic Client Registration / DCR)

3. Open the consent / authorize screen

4. Exchange a code at the token endpoint

5. Then call the MCP endpoint with a token

Many Cloudflare setups (custom AI bot-blocking rules, Bot Fight Mode, Super Bot Fight Mode, WAF) block requests whose user-agent contains strings like:

• Claude-User

• ChatGPT-User

• Other AI client user-agents

If you only allow the MCP path, Claude can reach the endpoint but still fail at registration — which produces the “couldn't register with SiteSkite’s sign-in service” error.

SiteSkite Link uses DCR via /wp-json/siteskite/v1/oauth/register. It does not require Claude’s published OAuth identity document (CIMD) for this flow.

Confirm With SiteSkite MCP Diagnostics

1. Open WordPress admin → SiteSkite → MCP / Connect (or run MCP diagnostics from the plugin)

2. Run diagnostics and check:

• FAIL — AI clients are not blocked → Cloudflare / WAF is matching the AI user-agent

• WARN — host blocks /.well-known/ → optional for some clients; see below

• PASS — MCP endpoint responds with HTTP 401 unauthenticated → the MCP route itself is reachable

The AI user-agent probe uses:

• Path: GET /wp-json/siteskite/v1/diagnostics/echo?probe=<token>

• User-Agent: Claude-User/1.0 (+Anthropic; SiteSkite diagnostics probe)

If the same request succeeds with a normal browser user-agent and fails with the Claude user-agent, the bot filter is the cause.

Paths Claude / ChatGPT Need Open

Allow AI client user-agents on at least these paths for your site hostname:

1. /wp-json/mcp/siteskite — Site MCP endpoint

2. /wp-json/siteskite/v1/discovery/oauth-protected-resource

3. /wp-json/siteskite/v1/discovery/oauth-authorization-server

4. /wp-json/siteskite/v1/oauth/register — client registration (required for Claude)

5. /wp-json/siteskite/v1/oauth/token

6. /wp-json/siteskite/v1/oauth/revoke

7. /wp-admin/admin.php?page=siteskite-oauth-authorize — consent screen

Optional (improves ChatGPT / strict discovery compatibility):

• Any path under /wp-json/siteskite/v1/ that contains /.well-known/

• Root /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource

SiteSkite already provides discovery URLs without /.well-known/. A nginx/WAF blanket deny for /.well-known/ is often only a warning if the /discovery/ fallback works — but an AI user-agent block on /oauth/register will still break Claude.

Narrow Cloudflare Fix (Keep Your Bot Protections)

You do not need to turn off Bot Fight Mode for the whole site. Expand (or create) a narrowly scoped exception.

Recommended Security Rule

Go to Cloudflare → Security → Security Rules → Create Rule

When (custom expression example):

(http.host eq "your-domain.com") and (
  starts_with(http.request.uri.path, "/wp-json/mcp/") or
  starts_with(http.request.uri.path, "/wp-json/siteskite/v1/") or
  (
    starts_with(http.request.uri.path, "/wp-admin/admin.php") and
    http.request.uri.query contains "page=siteskite-oauth-authorize"
  )
) and (
  http.user_agent contains "Claude-User" or
  http.user_agent contains "ChatGPT-User"
)

Replace your-domain.com with your real hostname.

Action: Skip (bypass your custom AI bot-block rule / Bot Fight / WAF for these matching requests only)

Important:

• An exception for only /wp-json/mcp/siteskite is usually not enough

• Registration (/oauth/register) and discovery must be included

• Matching is often case-sensitive for Claude-User

Also Helpful

• Bypass cache for /wp-json/mcp/ and /wp-json/siteskite/v1/

• If Log Explorer shows challenges on these paths, skip managed/JS challenges for the same expression

Confirm in Cloudflare Log Explorer

Filter for blocked AI traffic, for example:

(http.request.uri.path contains "/wp-json/mcp" or http.request.uri.path contains "/wp-json/siteskite")
and (http.user_agent contains "Claude-User" or http.user_agent contains "ChatGPT-User")
and (securityAction eq "block" or securityAction eq "managed_challenge" or securityAction eq "js_challenge")

After You Update Cloudflare

1. Re-run SiteSkite MCP diagnostics

2. Confirm “AI clients are not blocked” passes

3. Retry the connector in Claude / ChatGPT using your Site MCP URL, for example:
   https://your-domain.com/wp-json/mcp/siteskite

Alternative: Platform MCP (Hosted Connector)

If you only need SiteSkite account tools (fleet management, backups orchestration, portal features) and do not need a direct connection to that WordPress site’s Site MCP endpoint, connect Claude or ChatGPT to the hosted connector instead:

• URL: https://mcp.siteskite.com

That path uses SiteSkite’s infrastructure and avoids your site’s Cloudflare rules. For editing/actions on that specific live WordPress site via Site MCP, you still need the site paths above to be reachable by the AI client.

Summary

Most SiteSkite customers connect Claude and ChatGPT without issues. When it fails behind Cloudflare, the plugin is usually fine — the AI client’s user-agent is being blocked on OAuth discovery or registration, not only on the MCP endpoint.

Allow Claude-User / ChatGPT-User (narrowly) on /wp-json/mcp/, /wp-json/siteskite/v1/, and the SiteSkite OAuth authorize page. Re-run diagnostics, then reconnect the AI client.