Blocking Autonomous System Numbers is one of the most effective ways to cut down on bad bot traffic in Cloudflare’s firewall, but it’s also one of the easiest ways to accidentally block legitimate visitors, search engines, and even payment processors. Before reaching for a block-by-ASN strategy, it’s worth knowing exactly which networks should stay off your blocklist — and why.
Why ASN Blocking Requires Extra Caution
ASN-based blocking works by targeting entire networks rather than individual IP addresses, which makes it powerful but also blunt. Occasionally, legitimate users may share the same ASN as bad bots, so it’s a good idea to review and update any ASN blocklist periodically to avoid catching valid traffic in the crossfire. This is especially true for large, multi-tenant cloud providers, where a single ASN can host both malicious scanners and completely legitimate business services side by side.
Search Engine Crawlers: Google and Bing
The most important ASNs to protect are the ones tied to major search engines, since blocking them directly damages your site’s visibility. AS15169 (Google LLC) should always be allowed to ensure Google’s crawlers and services can reach your site without interruption, and the same logic applies to AS8075 (Microsoft Corporation), which ensures Bingbot and other Microsoft services can always access your site. Cloudflare itself explicitly allows search engine crawlers and bots by default, and if crawl issues do show up, they’re more often caused by anti-bot modules on the origin server than by Cloudflare’s own settings.
Payment and E-Commerce Infrastructure
Blocking the wrong network here can break checkout flows entirely rather than just filtering out spam. Networks tied to payment processing — including AS5091 and AS394562 for Stripe and AS17012 for PayPal — are considered essential to whitelist, since interrupting traffic from these ASNs can directly prevent customers from completing purchases.
Platform and CMS-Specific Services
If your site runs on WordPress or a related ecosystem, there’s a specific network worth protecting. AS2635 (Automattic Inc.) is the network behind Jetpack, WordPress.com, and WooCommerce services, and whitelisting it can prevent a wide range of potential conflicts with these widely used tools.
Major Social Platforms
Social referral and sharing traffic can also come from recognizable infrastructure worth protecting. AS32934 (Facebook, Inc.) is commonly included on recommended whitelists, since blocking it can interfere with link previews, sharing functionality, and legitimate referral traffic from the platform.
A Practical Baseline Whitelist
Putting these together, a reasonable starting whitelist for most Cloudflare-protected sites looks like this:
- AS15169 — Google LLC (search, crawling, and Google services)
- AS8075 — Microsoft Corporation (Bing and Microsoft services)
- AS2635 — Automattic Inc. (Jetpack, WordPress.com, WooCommerce)
- AS32934 — Facebook, Inc. (social referrals and sharing)
- AS5091 / AS394562 — Stripe, Inc. (payment processing)
- AS17012 — PayPal, Inc. (payment processing)
How to Add These Exceptions in Cloudflare
Setting up ASN-based rules follows the same basic path whether you’re blocking or allowing traffic. In the Cloudflare dashboard, navigate to Security, then WAF, then Tools, and select ASN from the dropdown menu under the IP, IP range, country name, or ASN field. From there, paste in the relevant ASN, choose Allow rather than Block for the networks listed above, and apply it either to the specific site or across your entire account depending on your setup.
Understand What “Whitelisting” Actually Does
It’s worth being precise about what an ASN allow rule accomplishes, since the terminology can be misleading. Allowing an IP or ASN will bypass any configured custom rules, rate limiting rules, and WAF Managed Rules — meaning a whitelisted ASN isn’t just given a pass on one rule, it’s exempted from your broader security stack entirely. This is exactly why the list of allowed ASNs should stay short and limited to networks you’re confident are legitimate, rather than a broad convenience list.
Structuring Rule Priority Correctly
Getting the order of operations right matters as much as choosing the right ASNs. Firewall rules typically execute top to bottom with the first match winning, except for Allow rules, which continue evaluation — meaning your whitelist rules should generally be placed before your ASN or country-based blocking rules, so legitimate traffic from services like Google or Stripe never has a chance to hit a block rule further down the list.
Join The Discussion
Getting ASN blocking right on Cloudflare is really a balancing act between locking down bad bot traffic and keeping the services your site actually depends on running smoothly. Have you accidentally blocked a legitimate service while trying to stop bot traffic, and if so, which ASN caught you off guard? And if you maintain your own whitelist or blocklist, what other networks would you add to this baseline — especially for platforms or integrations specific to your industry?
