How to let Power Automate talk to your Cloudflare protected website
You built a Power Automate flow that talks to your WordPress site. Maybe it’s an HTTP action, a webhook, or you’re using one of our connectors. You tested the URL in your browser and it works fine. But when Power Automate tries to reach it, you get a 403 error, a timeout, or just nothing at all.
You’ve probably spent a couple hours on this already. The flow is correct. The URL is correct. The logic is sound. It should work!
But it doesn’t. âšī¸
If your website uses Cloudflare, there’s a very good chance that’s what’s blocking you.
Why this happens
Cloudflare sits between your website and the rest of the internet. Its job is to block traffic that looks suspicious.
When Power Automate sends a request to your site, Cloudflare sees it coming from a Microsoft server it recognizes as a bot and blocks the connection.
Your flow is fine. Your site is fine. They just can’t talk to each other because Cloudflare doesn’t know to let Microsoft through. (There is a feature called Bot fight mode that controls this behavior. If you have it enabled, Power Automate can’t reach your website!)
This is one of those problems that’s hard to diagnose because nothing obvious is broken.
The error messages from Power Automate aren’t helpful. They don’t mention Cloudflare at all. You might see “403 Forbidden,” a Cloudflare challenge page buried in the response body, or a generic timeout. None of that points you in the right direction.
Good News: The fix is straightforward!
The solution is to tell Cloudflare which IP addresses belong to Microsoft and create IP access rules that let them through. Microsoft publishes these IP addresses in a file that gets updated every week.
In order to do this (before our tool), you had to find the right download on Microsoft’s site, open a massive JSON file, identify which IP ranges apply to Power Automate (there are thousands), format them into Cloudflare firewall expressions, and then either navigate the Cloudflare dashboard or build the right API call. Get one thing wrong and it doesn’t work. Wait too long to update and the addresses change on you.
We’ve helped clients through this process more times than I want to count. It was always tedious. So we built a tool to handle it. đ
The Power Automate + Cloudflare Whitelister
This is a free, open-source tool that does everything described above in about two minutes. It runs entirely in your browser. No accounts, no sign-ups.
Here’s how it works:
- Click one button to download the latest IP addresses from Microsoft. No hunting for files, no figuring out which download is current.
- Leave the defaults. The tool already knows which IP ranges belong to Power Automate. For most people, the default selection is exactly right.
- Copy the instructions and send them to whoever manages your Cloudflare account. The output includes the IP addresses, step-by-step dashboard instructions, and a ready-to-run API command. Everything your IT team needs is in one document.
- Or apply directly if you manage Cloudflare yourself. Paste in your API token and Zone ID and the tool handles the rest.
That’s it. The tool generates the firewall rules, chunks them so they stay within Cloudflare’s expression size limits, and preserves any existing custom rules you already have in place.
You don’t need to be the person who manages Cloudflare
This was an important design decision. In many organizations, the person building Power Automate flows isn’t the same person who manages the Cloudflare account. The tool is built for that reality.
Step 3 produces a complete, self-contained document you can copy and paste into an email or a Teams message. It explains what the rules do, why they’re needed, and exactly how to apply them. Your IT team or Cloudflare admin doesn’t need to use the tool themselves. They just follow the instructions.
Symptoms this fixes
If any of these sound familiar, this tool is probably what you need:
- Power Automate HTTP actions return 403 Forbidden errors against your site
- Webhooks from Power Automate or Logic Apps never arrive
- Flows that worked fine for weeks suddenly stop working (Microsoft’s IP addresses changed)
- Power Automate can reach other websites but not yours
- You see Cloudflare challenge pages in your flow’s HTTP response body
- Custom connectors that call your WordPress site time out
Microsoft updates these addresses weekly
This isn’t a one-time fix. Microsoft adds and removes IP addresses on a regular cycle. If your Cloudflare rules get stale, Power Automate can get blocked again even though it was working before.
The tool offers a calendar reminder after you generate your instructions. We recommend re-running it once a month to keep your rules current. It takes two minutes and it saves you from debugging the same problem again three months from now.
Privacy
Everything happens in your browser. The tool downloads the IP address list from Microsoft and processes it locally. No data is sent to any other server. If you choose to apply rules directly to Cloudflare, those credentials go to Cloudflare and nowhere else. You can save them locally for convenience or clear them at any time.
The project is open-source on GitHub. You can read every line of code.
Try it
This tool is free, it requires no sign-up, and it works right here on our site. If Power Automate has been failing to reach your website and you haven’t been able to figure out why, give this a shot. Especially if your site runs behind Cloudflare.
Launch the Power Automate + Cloudflare Whitelister â
We built this to solve a problem we kept running into with our own clients. We’re excited to put it out there for everyone. If you have questions or run into anything, reach out.
