How to let Recollect save drafts to a site that uses Cloudflare

When you save a note as a draft on your WordPress or EmDash site, Recollect’s servers connect to your site to upload the note’s images and create the draft. If your site uses Cloudflare’s bot protection, Cloudflare can mistake those requests for unwanted bot traffic and stop them. When that happens, Recollect shows this message:

Cloudflare’s bot protection on your site is blocking Recollect.

To confirm that this is the cause, open your site in the Cloudflare dashboard, go to Security → Analytics, and select the Events tab. Requests from Recollect show the user agent Recollect-Share/1.0, and the Service column shows Bot Fight Mode (or Super Bot Fight Mode on paid plans).

There are three ways to fix it. Pick the one that fits your site.

Recollect’s server IP addresses#

Recollect’s servers connect to your site from these IP address ranges:

• 74.220.50.0/24
• 74.220.58.0/24

These ranges are shared by all services hosted in the same region of Recollect’s hosting provider, not used by Recollect alone. They can change; if they do, this article will be updated.

Option 1: Turn off Bot Fight Mode#

This is the simplest fix, and it works on every Cloudflare plan, including Free. Bot Fight Mode on the Free plan doesn’t support exceptions, so it either applies to all traffic or none.

1. In the Cloudflare dashboard, select your site.
2. Go to Security → Settings.
3. Filter by Bot traffic.
4. Turn Bot fight mode off.

Your site keeps its other protections, such as Block AI bots, your custom rules, and Cloudflare’s DDoS protection.

Option 2: Allow Recollect’s IP addresses#

This keeps Bot Fight Mode on for everyone else, and it works on every plan, including Free: Bot Fight Mode doesn’t run for a request that matches an IP access rule.

1. In the Cloudflare dashboard, select your site.
2. Go to Security → Security rules.
3. Select Create rule → IP access rules.
4. For IP, IP range, country name, or ASN, enter 74.220.50.0/24.
5. For Action, select Allow.
6. For Zone, select This website, or all websites in your account if you share to several of them.
7. For Notes, enter Recollect.
8. Select Create.
9. Repeat these steps for 74.220.58.0/24.

An Allow rule also lets these addresses past your site’s other Cloudflare security rules. Because the ranges are shared with other services at the same hosting provider, only use this option if you’re comfortable allowing that traffic.

Option 3: Use Super Bot Fight Mode with a skip rule (Pro plans and above)#

On Cloudflare’s Pro, Business, and Enterprise plans, Super Bot Fight Mode replaces Bot Fight Mode and supports exceptions. You can let Recollect through only for the addresses your site’s publishing interface uses, and keep bot protection everywhere else. Use the expression for your site:

• WordPress: (ip.src in {74.220.50.0/24 74.220.58.0/24} and (starts_with(http.request.uri.path, "/wp-json/") or http.request.uri.query contains "rest_route="))
• EmDash: (ip.src in {74.220.50.0/24 74.220.58.0/24} and starts_with(http.request.uri.path, "/_emdash/"))

1. If Bot fight mode is on, turn it off (Security → Settings → Bot traffic), then turn on Super Bot fight mode.
2. Go to Security → Security rules.
3. Select Create rule → Custom rules, and name the rule Recollect.
4. Under When incoming requests match, select Edit expression and enter the expression for your site from above.
5. Under Then take action, select Skip, then select All Super Bot Fight Mode rules.
6. Select Deploy.

Other firewalls and security plugins#

The same problem can come from other firewalls or from security plugins on your WordPress site. If your site uses one, add Recollect’s IP ranges to its allowlist, or allow requests from those addresses to your site’s REST API (/wp-json/).

After you make a change, open Settings → Integrations in Recollect and select Test next to your site, or connect the site again.