Intermittent false “Website Down” alerts in Zabbix when Cloudflare proxy is enabled

[Tojo Sebastian]

We are experiencing intermittent false “website down” alerts in Zabbix while monitoring websites that are proxied through Cloudflare. The behavior suggests a potential interaction issue between Cloudflare proxying and Zabbix web monitoring, rather than actual site downtime.

1. Environment

• Hosting: DigitalOcean
• Web Server: NGINX
• OS: Ubuntu
• Application: WordPress
• CDN / Proxy: Cloudflare (orange cloud enabled)
• Monitoring: Zabbix Web Monitoring (HTTP/HTTPS scenarios)

---

2. Monitoring Configuration


Zabbix web scenario settings:

• Update interval: 90 seconds
• Attempts: 2
• Timeout: 45 seconds

Monitoring is performed using Zabbix web scenarios, not ICMP or agent-based checks.

---

3. Observed Behavior

• Zabbix triggers intermittent “website down” alerts
• Alerts occur only when Cloudflare proxy is enabled
• Alerts do not trigger immediately after enabling the proxy
• Alerts appear randomly (sometimes persist for hours)
• Alerts often self-resolve within minutes
• Real users can access the websites normally during alert periods

---

4. Behavior When Cloudflare Proxy Is Disabled

• Alerts stop initially
• In some cases, alerts still appear later but far less frequently

---

5. Server Health During Alerts


During alert windows, we observed:

• No high CPU, memory, disk, or network usage
• No spikes in NGINX error logs
• No PHP-FPM crashes or restarts
• No firewall rules blocking HTTP/HTTPS traffic
• Fail2ban is enabled only for SSH

---

6. Prior Cloudflare Feedback


Cloudflare has confirmed:

• No incidents or maintenance during alert times
• No visible errors from the Cloudflare side
• Enabling/disabling the proxy has a direct impact on alert frequency

---

7. NGINX Configuration Notes

• Previously used limit_req_status 444
• Changed to 429
• Alerts continue even after removing 444 responses
• No rules explicitly blocking Cloudflare IP ranges

---

8. Key Observation


Despite alerts:

• Websites remain reachable
• Alerts appear to be false positives
• Behavior strongly suggests a monitoring/proxy interaction issue, not real downtime

---

9. Assistance Requested


We would appreciate guidance on:

• Known issues between Cloudflare proxy and Zabbix web scenarios
• Potential impact of:
  • IPv6
  • TLS / SNI handling
  • Expected HTTP status codes
  • Cloudflare edge behavior vs monitoring probes

Any guidance on correctly configuring Zabbix web monitoring for Cloudflare-proxied sites would be appreciated.

[PavelZ]

There's a lot of unnecessary text.
The problem is that Cloudflare is blocking your requests, and they seem suspicious.

You need to find a way to whitelist the server IP (or agent, or proxy) in Cloudflare. This can be done in several ways, but always through Cloudflare's settings.

[Tojo Sebastian]

Just for your information, the Zabbix check is performed for the website and not via zabbix agent. Are you suggesting that we should identify a way to whitelist the Zabbix server IP address or hostname in Cloudflare so that it is excluded from any custom rules, security checks, or other Cloudflare filtering mechanisms?

Thanks for the assistance.

[PavelZ]

Cloudflare isn't a proxy. Don't even call it that.
Cloudflare is an attack mitigation service. That's the whole problem.

[Tojo Sebastian]

Actually, the issue was triggered recently; previously, there were no such issues. The alerts were repeatedly triggered by Zabbix but resolved automatically within a short period. During this time, we tested by disabling the proxy for the affected websites, and once the proxy was turned off, the down alerts stopped completely.

As suggested, could you please confirm whether we need to check for an option in Cloudflare to explicitly allow Zabbix checks from the Zabbix server IP address, so that they are excluded from any custom rules, security checks, or other Cloudflare filtering mechanisms to resolve the issue?