How to Allow Auto DM Studio Newsletter Requests Through Cloudflare

If your website uses Cloudflare and one of Auto DM Studio’s newsletter integrations, such as MailPoet, The Newsletter Plugin, or FluentCRM, you may need to create a Cloudflare rule to allow newsletter subscription requests.

Without this rule, Cloudflare may challenge or block requests coming from Auto DM Studio’s servers. When this happens, our servers receive a 403 Forbidden response and are unable to add subscribers to your newsletter.

When Is This Required? #

This configuration is recommended if:

• Your website is protected by Cloudflare.
• You use MailPoet, The Newsletter Plugin, or FluentCRM integrations.
• New subscribers are not being added successfully.
• You see 403 errors in your logs.
• Cloudflare security features are enabled on your site.

Why Does This Happen? #

When a visitor submits their information through an Auto DM Studio conversation, our servers securely send that information to your WordPress REST API.

Cloudflare may treat these requests as automated traffic and present a security challenge. Since our servers cannot complete interactive browser challenges, the request is blocked and the subscriber cannot be saved.

Creating a custom Cloudflare rule allows these authenticated requests to bypass Cloudflare security checks while remaining protected by Auto DM Studio’s signature verification.

Step 1: Log In to Cloudflare #

1. Log in to your Cloudflare account.
2. Select the website connected to Auto DM Studio.

Step 2: Create a Custom Security Rule #

1. Navigate to Security → Security Rules.
2. Click Create Rule.
3. Select Custom Rule.

Step 3: Enter the Rule Expression #

Paste the following expression into the rule editor:

(http.request.method eq "POST" and http.request.uri.path eq "/wp-json/auto-dm-studio/v1/newsletter/subscribe" and any(http.request.headers["x-auto-dm-studio-event"][*] eq "newsletter_subscribe") and any(starts_with(http.request.headers["x-auto-dm-studio-signature"][*], "sha256=")))

This rule specifically identifies authenticated newsletter subscription requests originating from Auto DM Studio.

Step 4: Configure the Action #

Set the rule action to:

Skip

Under the skip options, enable:

• All remaining custom rules
• All rate limiting rules
• All managed rules
• All Super Bot Fight Mode rules

Step 5: Set Rule Priority #

Set the rule order to:

First

This ensures the rule is evaluated before any other Cloudflare security rules.

Step 6: Deploy the Rule #

Click Deploy to save and activate the rule.

Verify the Configuration #

After deploying the rule:

1. Complete a newsletter signup flow using Auto DM Studio.
2. Verify that the subscriber is added successfully to your selected newsletter platform.
3. Confirm no 403 errors are being generated by Cloudflare.

Security Notes #

This rule does not expose your website’s REST API publicly.

Requests must still:

• Target the Auto DM Studio newsletter endpoint.
• Use the correct event header.
• Include a valid Auto DM Studio signature.

Requests that do not meet these requirements will not match the rule.

Supported Integrations #

This Cloudflare configuration applies to:

• MailPoet
• The Newsletter Plugin
• FluentCRM

If you are not using one of these integrations, this rule is generally not required.

Frequently Asked Questions #

Will this disable Cloudflare protection for my website? #

No. The rule only bypasses specific Cloudflare checks for authenticated Auto DM Studio newsletter subscription requests.

Is this required for all Auto DM Studio users? #

No. This is only necessary for sites using Cloudflare in combination with newsletter integrations that rely on Auto DM Studio’s REST API endpoint.

How do I know if Cloudflare is blocking requests? #

Common signs include:

• Subscribers not being added to your newsletter.
• 403 Forbidden errors in logs.
• Successful DM conversations but missing newsletter subscriptions.
• Cloudflare security events showing blocked REST API requests.