ASV scan errors behind Cloudflare, and how to get a valid PCI scan

First, understand what the scanner is actually hitting

When your hostname is proxied through Cloudflare (orange cloud), it resolves to a Cloudflare IP address. A scan of that hostname tests Cloudflare's edge, not your origin server. The ASV Program Guide puts every externally facing in-scope system in scope, so two things matter: (1) the hostname your customers use, which is what an attacker sees first, and (2) your origin server, if it can be reached from the internet directly. Cloudflare's own guidance is to scan the origin by its IP address, one scan per origin server. If your origin only accepts connections from Cloudflare's IP ranges, it is not externally reachable and you should say so when you set your scope; if it accepts connections from anywhere, it is in scope and must be scanned by IP.

The five ways Cloudflare blocks a scan

1. WAF managed rules and custom rules block or challenge scanner requests.
2. Rate limiting rules trip on the scanner's request volume.
3. HTTP DDoS protection treats a port sweep as an attack.
4. Bot Fight Mode and Super Bot Fight Mode challenge automated traffic.
5. Under Attack mode or a security level set to High challenges every visitor.

Any one of these produces a scan that is incomplete or inconclusive. Under the ASV Program Guide the ASV cannot pass a scan that was blocked or filtered by an active protection system; it has to be resolved first.

What 'inconclusive' means and the three ways to resolve it

The ASV Program Guide requires the scan to see what an attacker would see. If the scan is blocked, the ASV marks it inconclusive: the scan could not see enough to reach a valid result. You have three options:

1. Make a temporary configuration change for the scan window.
2. Provide evidence the scan was not blocked.
3. Agree a method with the ASV.

The Guide does not require permanently whitelisting the scanner or giving it more access than any other visitor; it requires that volume-based and correlated triggers do not fire. In Cloudflare, allowing the scanner's addresses through for the scan window is the simplest way to meet that.

Clone Systems lists the scanner address range in the support documentation inside the customer portal, and you can email support from the portal if you need help with it. It is not published on the public website, and it can change, so check it before each quarterly scan.

How to let the ASV scanner through Cloudflare (step by step)

1. Get the current scanner address range from the support documentation in your Clone Systems portal (or email support from the portal).
2. Security > WAF > Tools > IP Access Rules: add an Allow rule for the scanner range, applied to this website.
3. Security > WAF > Custom rules: create a rule that matches IP Source Address is in the scanner range, with the action Skip, and tick the options to skip all remaining custom rules, WAF managed rules, rate limiting rules and Super Bot Fight Mode. Move this rule to the top of the list; a blocking rule that fires earlier wins.
4. Security > DDoS > HTTP DDoS attack protection: add an override for the scanner range with sensitivity set to Essentially Off and action Allow (available on plans that allow overrides; on the free plan, schedule the scan outside peak traffic and expect to rescan if DDoS protection fires).
5. If you use Bot Fight Mode on the free plan, it has no exclusion list; turn it off for the scan window and turn it back on afterwards. Check Security > Settings for your bot protection settings.
6. Security > Events: run the scan and filter events by the scanner range. Every event should show Allow or Skip. Any Block, Managed Challenge or JS Challenge means the scan was interfered with.
7. Restore your previous settings after the scan if you changed anything beyond the Allow and Skip rules.

The Cloudflare findings you can dispute, and the ones you cannot

Disputable: file an exception in the portal with the evidence named.

• Open ports other than 80 and 443 on a Cloudflare IP. Cloudflare's anycast edge keeps them open for other customers; evidence is Cloudflare's documentation plus a WAF rule blocking the extra ports, or an origin firewall showing the ports are closed at the origin.
• TLS version or cipher findings reported on a Cloudflare IP where your Cloudflare SSL settings show the minimum TLS version set to 1.2. Evidence is the Cloudflare SSL/TLS settings page.
• HTTP header findings that Cloudflare adds or strips at the edge. Evidence is the Cloudflare configuration.

Not disputable: these are real findings and need fixing.

• Anything found on your origin IP.
• Expired or self-signed certificates on the origin.
• Old software versions on the origin.
• Open admin paths.

Clone Systems reviews exceptions within 24 hours, and you can rescan as soon as an exception is approved. Rescans are unlimited until you pass.

Checklist before your next scan behind Cloudflare

• Scope includes the hostname and, if reachable, the origin IP.
• Scanner range is current.
• Allow and Skip rules are in place and first in order.
• DDoS override is set.
• Bot Fight Mode is handled.
• Security Events are checked after the scan.
• Exceptions are filed with evidence for Cloudflare-side findings.

Related guides

• Whitelisting the ASV scanner for a valid PCI scan
• Failed your PCI scan? Here is what to do right now
• Load balancers and PCI ASV scanning
• Which IP addresses and domains to include in a PCI ASV scan
• What is a PCI compliance scan?