Google Analytics is quiet till Saturday 14 March 2026. After that the positioning picks up just a few thousand customers a day and stays there. The shape checks in Cease Bots From Spamming Your ConvertKit Kind got here a month later. On 13 April 2026 I shipped them in pull request 150. A junk signup needed to get previous a honeypot, a timer, and Turnstile earlier than ConvertKit heard about it. The requests stored coming.
They have been studying the weblog put up about including a subscription kind to a React web site. That put up reveals the general public ConvertKit URL, so it’s a straightforward web page to flag and later hammer. Cloudflare checked out these requests and scored them as folks, which indicated these are some high-profile bots. Bot Struggle Mode, and the remainder of the automated bot tooling, solely acts on visitors Cloudflare has already determined is a bot. A excessive rating means these switches sit there.
The bot rating runs from 1 to 99. A 1 is nearly definitely automated. A 99 is nearly definitely an individual, so a excessive rating is what left Bot Struggle Mode idle. Two days after Turnstile, on 15 April 2026, pull request 151 stopped rendering the subscribe kind on that one put up. The web page was nonetheless up, and the requests stored coming.
The shape got here off as a result of signups have been nonetheless touchdown, not as a result of the web page views had. There have been fewer of them. They nonetheless cleared Turnstile, ConvertKit nonetheless acquired the subscribe, and a few of the addresses confirmed the e-mail. Managed mode solely places a checkbox up when Cloudflare is uncertain, and Cloudflare was not uncertain about these shoppers. The identical rating that left Bot Struggle Mode idle handed them a token. Double opt-in didn’t catch those that would open the inbox.
I ended ready for the rating. On 26 October 2026 I turned on a customized rule. On that one path, each customer will get an interactive problem.
What a customized rule is
A customized rule is a situation you write, plus an motion Cloudflare takes when the situation matches. The request has to cross via Cloudflare first. If the DNS report for the positioning is DNS-only, Cloudflare by no means sees the go to and the rule by no means runs.
The rule I saved is called Block bots from Converkit weblog put up. The expression is:
(http.request.uri.path wildcard r"/add-newsletter-subscription-form-to-react-website/")That’s URI Path, operator wildcard, worth /add-newsletter-subscription-form-to-react-website/. The motion is Interactive Problem.
The saved rule. One path, motion set to Interactive Problem.
Cloudflare’s personal kind asks you to want a Managed Problem. A managed problem lets Cloudflare choose. Cloudflare had already picked “individual” for these shoppers, which is why the automated instruments by no means fired. An interactive problem places a web page in entrance of the URL anyway. An individual solves it. A script that solely is aware of GET the HTML and POST the shape goes no additional.
A JavaScript problem is the quieter model. It runs within the background and hopes the consumer executes it. I needed the go to to cease, so I took the problem an individual can see.
After an individual passes, Cloudflare units a cf_clearance cookie. Later requests from that browser skip the problem till the cookie expires. The expiration will be configured in Cloudflare and default is half-hour.
The place to click on
Within the Cloudflare dashboard, open the positioning, then Safety, then WAF, then Customized guidelines. The menu has moved earlier than. If WAF is gone, search for Safety guidelines. The web page you need has a Create rule button.
Create a rule.
- Rule title: one thing you’ll acknowledge within the occasion log. Mine is
Block bots from Converkit weblog put up. - Subject: URI Path.
- Operator: wildcard.
- Worth: the trail,
/add-newsletter-subscription-form-to-react-website/. - Motion: Interactive Problem.
The expression preview ought to match the block above. Put it aside, and put it above any rule that skips WAF checks. A skip that matches first wins, and your problem by no means runs.
Open the put up in a non-public window. You must see the problem as soon as, then the article. A curl of the identical URL ought to get the problem web page, not the put up.
The drop
The rule checklist is the primary place the matches present up. The day after I saved it, this one had already fired 5.69k occasions. That’s 0.02% of visitors on the zone, and it’s all on one previous tutorial.
5.69k matches the day after the rule went on. 0.02% of visitors on the zone.
Analytics is the longer image. From January via 13 March the road sits on the ground. On 14 March it jumps, and from there it runs between roughly one and 6 thousand customers a day, via the April kind adjustments and on to October. The problem is the final day of this chart, 26 October, so the drop is a degree on the finish, not a brand new flat line but.
Customers per day for 2026. Quiet till 14 March, then just a few thousand a day.
Pages and screens makes the identical line particular. The whole and /add-newsletter-subscription-form-to-react-website/ sit on prime of one another from 14 March on. The house web page and the opposite posts barely go away the ground.
The e-newsletter tutorial and the positioning complete sit on the identical line from 14 March.
What this leaves alone
The remainder of the weblog is unchanged. The rule matches one path. Dwelling, tags, and each different put up keep as they have been.
The shape on that put up has been gone since 15 April 2026. The template skips SubscribeForm when the slug is /add-newsletter-subscription-form-to-react-website/. An individual who passes the problem can nonetheless learn the tutorial. They don’t get a kind to submit.
A script that already saved https://api.convertkit.com/v3/kinds/<form_id>/subscribe by no means touches this path. Cloudflare can not see that request. The perform, Turnstile, and double opt-in from the earlier put up are what meet it. If that URL is the entire downside, rotate the shape id. The problem is for the web page.
Summing up
I needed the bots categorized, after which blocked, by the product that’s speculated to know a bot from a browser. They arrived wanting like browsers. The repair was a customized rule that refuses to care in regards to the rating, and asks each consumer on that path to unravel a problem.
Till the following one, cheers.
