🔍 Why This Is Needed
OTTO is Search Atlas's AI SEO automation bot. It crawls your website to scan pages, identify optimisation opportunities, and apply changes on your behalf. If your Shopify store is proxied behind Cloudflare, Cloudflare's security rules may block or challenge OTTO's requests — preventing it from working correctly. Whitelisting OTTO in Cloudflare ensures the bot can access your site without interference.
⚠️ Important: Shopify vs WordPress Differences
The whitelisting process for Shopify differs from the WordPress guide published on the Search Atlas blog. Shopify does not give you access to server configuration files (such as .htaccess), so all traffic rules must be managed entirely within your Cloudflare dashboard. Follow the Shopify-specific steps below.
📋 What You Will Need
- Access to your Cloudflare account (the account managing your Shopify store's domain)
- Your Shopify store's domain confirmed as an active zone in Cloudflare
- OTTO's IP addresses and user agent string (listed in the section below)
🤖 OTTO Bot Details
Use the following identifiers when creating your Cloudflare rules:
- **User Agent:**OTTOBot (the user agent string sent by OTTO during crawls)
- IP Addresses: Contact the Search Atlas team via the chat widget to obtain the current list of OTTO IP addresses, as these may be updated periodically.
🛠️ Step-by-Step: Whitelist OTTO in Cloudflare
- Log in to Cloudflare and select the domain associated with your Shopify store from your account dashboard.
- Go to Security → WAF using the left-hand navigation in Cloudflare.
- Click the Custom Rules tab, then click Create rule.
- Name your rule something descriptive, such as Allow OTTO SEO Bot.
- Under If incoming requests match…, set the following conditions using OR logic between them:
- Field: User Agent | Operator: contains | Value: OTTOBot
- Field: IP Source Address | Operator: is in | Value: (paste each OTTO IP address)
- Under Then take action…, select Skip from the dropdown, then enable Skip all remaining custom rules. This ensures OTTO bypasses WAF blocks without disabling your protection for other visitors.
- Set the rule order so it appears above any existing block or challenge rules that could affect bot traffic.
- Click Deploy to save and activate the rule.
🔒 Also Check: Bot Fight Mode and Security Level
Two additional Cloudflare settings can interfere with OTTO even after you create a custom rule:
- Bot Fight Mode: Go to Security → Bots. If Bot Fight Mode or Super Bot Fight Mode is enabled, it may challenge or block OTTO independently of your WAF rules. You may need to disable this feature or, if you are on a Business or Enterprise plan, configure bot exceptions to allow the OTTOBot user agent.
- Security Level: Go to Security → Settings. If the security level is set to I'm Under Attack, all visitors including bots will face a JavaScript challenge. Lower this to High or Medium while OTTO performs its scans, then raise it again afterwards if needed.
✅ How to Verify OTTO Can Access Your Site
- In Search Atlas, go to Left sidebar → OTTO SEO (URL: /seo-automation-v3).
- Select your Shopify project and trigger a new Scan.
- If the scan completes without errors and OTTO begins returning page-level recommendations, the whitelist is working correctly.
- In Cloudflare, you can also go to Security → Events and filter by the OTTOBot user agent to confirm requests are being allowed rather than challenged or blocked.
💬 Need More Help?
If you need further assistance, open the chat widget in the bottom-right corner of the platform and type human teammate to be instantly connected with a member of our team.