Cloudflare on ASDA

Recently my mate was doin her shoppin on ASDA as normal and was blocked by Cloudflare and couldn't access ASDA any more to complete her shoppin.

What is the point of having security like that on a shoppin site that blocks you from making a purchase? Problem with Russian bots?

I would ask what your friend was doing that triggered the security?

Most commercial websites will have some sort of security, if not Cloudflare, then one of the other big cloud vendors such as AWS or Azure or Google Cloud have similar Web Application Firewall functions.

Check the internet provider, check if a VPN to another country was left on, check if the browser and operating system are up to date.

Bots are everywhere, its not as simple as looking at the IP address where they come from, as the controlling organisation can infect unpatched computers all over the world. So the 'bots' and even just DDOS capacity can hit from anywhere. Think of these services as an internet windscreen.

Edited by jchamier (Tue 10-Mar-26 16:57:41)

My parents had similar issue around 1 month ago.

Tried to go to ASDA website on Chrome and just got a Cloudfare message. FF worked OK. They have BT FTTP and IP hadn't changed recently. I cleared Chrome cache and it resolved the issue.

She was just ordering her shopping on phone then bam Cloudflare intervention. Maybe she was too quick accessing pages kinda bot like?

In reply to a post by jchamier:

I would ask what your friend was doing that triggered the security?

Most commercial websites will have some sort of security, if not Cloudflare, then one of the other big cloud vendors such as AWS or Azure or Google Cloud have similar Web Application Firewall functions.

Check the internet provider, check if a VPN to another country was left on, check if the browser and operating system are up to date.

Bots are everywhere, its not as simple as looking at the IP address where they come from, as the controlling organisation can infect unpatched computers all over the world. So the 'bots' and even just DDOS capacity can hit from anywhere. Think of these services as an internet windscreen.

Is this on a mobile network or on Wi-Fi? Does the ISP use CGNAT or does the connection have a public IP address of its own? Are you happy the phone isn't filled with malware?

Not sure she is just a casual acquaintance. Those details escape me, assume she was on carrier network if wifi it would be Virgin. Told her to reboot the phone which seemed to do the trick and she could continue shopping.

Edit: Asked her and she was on Virgin wifi. It's less likely an IP ban as it was working at first then stopped saying something she had done had caused the CF ban but didn't say what.

Edited by Banger (Tue 10-Mar-26 22:21:35)

I can't access my local council website because they use AWS's "Hosting Provider" list as a blacklist.
Not been able to for months! Not sure what I pay council tax for because clearly they are clueless.
I get this may happen.. but the fact they can't fix it just means they are being clueless.

I'd say find another company to shop with.

That was my point when posting. I found it strange a shopping site needed to protect itself in such a manner.

Cloudfare normally generates a 'checking your not a bot' page; usually with a simple checkbox. Did she try to skip that screen, perhaps by hitting the back button?

The only problem I have had with the bot protection, other than the nuisance of having to go through whatever process they require, was on a domain that I manage blocking emails. On most occasions if I opened the web site the system went through its process and the emails started flowing. This seems to have resolved itself - perhaps with an update to the software.

We have ASDA groceries and I have never had an issue (bar during their systems upgrades and transfer away from Walmart), our internet (Lightspeed) is CGNAT on the IPv4 side but ASDA's website does support IPv6 access and so does Lightspeed.

I cannot use IPv6 natively on my mobile data (1p mobile) but if I have iCloud Private Relay or Cloudflare Warp on I can get access to IPv6 internet via my IPv4 CGNAted 4/5G connection on my phone. I have tried Voxi, Giffgaff and Three PAYG as well and have never had an issue accessing ASDA over mobile data with the first two only offering IPv4 with CGNAT.

I wonder if there is some malware on a device on your home network if you have a public IPv4 or if your public IPv4 has recently changed to one that has been blacklisted by Cloudflare's systems specifically for ASDA. Running a traceroute it looks like ASDA use Cloudflare for their CDN.