## **🔍 Why This Is Needed**

OTTO is Search Atlas's AI SEO automation bot. It crawls your website to scan pages, identify optimisation opportunities, and apply changes on your behalf. If your Shopify store is proxied behind Cloudflare, Cloudflare's security rules may block or challenge OTTO's requests — preventing it from working correctly. Whitelisting OTTO in Cloudflare ensures the bot can access your site without interference.

## **⚠️ Important: Shopify vs WordPress Differences**

The whitelisting process for Shopify differs from the WordPress guide published on the Search Atlas blog. Shopify does not give you access to server configuration files (such as **.htaccess**), so all traffic rules must be managed entirely within your Cloudflare dashboard. Follow the Shopify-specific steps below.

## **📋 What You Will Need**

- Access to your Cloudflare account (the account managing your Shopify store's domain)
- Your Shopify store's domain confirmed as an active zone in Cloudflare
- OTTO's IP addresses and user agent string (listed in the section below)

## **🤖 OTTO Bot Details**

Use the following identifiers when creating your Cloudflare rules:

- **User Agent:****OTTOBot** (the user agent string sent by OTTO during crawls)
- **IP Addresses:** Contact the Search Atlas team via the chat widget to obtain the current list of OTTO IP addresses, as these may be updated periodically.

## **🛠️ Step-by-Step: Whitelist OTTO in Cloudflare**

1. **Log in to Cloudflare** and select the domain associated with your Shopify store from your account dashboard.
2. **Go to Security → WAF** using the left-hand navigation in Cloudflare.
3. Click the **Custom Rules** tab, then click **Create rule**.
4. **Name your rule** something descriptive, such as **Allow OTTO SEO Bot**.
5. Under **If incoming requests match…**, set the following conditions using **OR** logic between them:
   - Field: **User Agent** | Operator: **contains** | Value: **OTTOBot**
   - Field: **IP Source Address** | Operator: **is in** | Value: **(paste each OTTO IP address)**
6. Under **Then take action…**, select **Skip** from the dropdown, then enable **Skip all remaining custom rules**. This ensures OTTO bypasses WAF blocks without disabling your protection for other visitors.
7. Set the rule **order** so it appears above any existing block or challenge rules that could affect bot traffic.
8. Click **Deploy** to save and activate the rule.

## **🔒 Also Check: Bot Fight Mode and Security Level**

Two additional Cloudflare settings can interfere with OTTO even after you create a custom rule:

- **Bot Fight Mode:** Go to **Security → Bots**. If **Bot Fight Mode** or **Super Bot Fight Mode** is enabled, it may challenge or block OTTO independently of your WAF rules. You may need to disable this feature or, if you are on a Business or Enterprise plan, configure bot exceptions to allow the OTTOBot user agent.
- **Security Level:** Go to **Security → Settings**. If the security level is set to **I'm Under Attack**, all visitors including bots will face a JavaScript challenge. Lower this to **High** or **Medium** while OTTO performs its scans, then raise it again afterwards if needed.

## **✅ How to Verify OTTO Can Access Your Site**

1. In Search Atlas, go to **Left sidebar → OTTO SEO** (URL: **/seo-automation-v3**).
2. Select your Shopify project and trigger a new **Scan**.
3. If the scan completes without errors and OTTO begins returning page-level recommendations, the whitelist is working correctly.
4. In Cloudflare, you can also go to **Security → Events** and filter by the OTTOBot user agent to confirm requests are being allowed rather than challenged or blocked.

## **💬 Need More Help?**

If you need further assistance, open the chat widget in the bottom-right corner of the platform and type **human teammate** to be instantly connected with a member of our team.