Why Cloudflare Blocked Googlebot on My Bluehost Sites and Tanked My Impressions
By Cap Puckhaber, Reno, Nevada
The Day My Search Impressions Fell Off a Cliff
I run seven websites, and I check their search performance every week. Two weeks ago, I opened Google Search Console and felt my stomach drop. One of my sites had lost ninety percent of its impressions in a matter of days. Nothing on my end had changed. My content stayed the same, and my theme stayed the same too. Not a single plugin had been touched, updated, or removed in weeks. The sudden collapse made no sense at first glance, so I assumed the report itself was broken.
I dug through my usual tools to find an explanation. Ahrefs could not complete a fresh site audit. Google Search Console showed that my sitemap could not be read. Every one of these failures traced back to the same three letters. My host had quietly changed how Cloudflare handled my site. Cloudflare was returning a 403 error to almost every automated visitor that tried to reach it. That single detail turned out to explain the entire mess.
Why a 403 Error Is Worse Than It Sounds
A 403 error means a server understood a request and refused it anyway. Your visitors rarely see this error, because Cloudflare only sends it to bots and crawlers. That is exactly what makes it so dangerous for a site owner. You can check your own site in a browser all day long and see nothing wrong. At the same time, Googlebot, Ahrefs, Search Console, and any other automated tool keep hitting a locked door in the background.
Because the block is invisible to a human visitor, most people find out through indirect signs instead. A sudden drop in impressions, a failed audit, or a sitemap error are usually the first clues. By the time those signs show up, Google may have already started removing pages from its index. Catching a 403 block early can save you weeks of lost visibility, so I now check my Coverage report at least twice a week.
What Cloudflare Actually Does
Cloudflare is a service that sits between your website visitors and your actual web server. Picture a security guard standing in front of your building. Every request for your site passes through Cloudflare first. Cloudflare then decides whether that request looks safe. A request that looks fine gets waved through to your server right away. One that looks suspicious can get blocked, challenged, or slowed down instead.
Bluehost bundles a basic version of Cloudflare with most hosting plans. Most site owners never touch its settings, and I was one of them for years. Because the tool runs quietly in the background, many people forget it exists at all. That is exactly what happened to me. I never went looking for Cloudflare settings, since I never had a reason to open that menu before.
How Cloudflare Sits Between Visitors and My Server
When someone types my domain into a browser, that request hits Cloudflare’s network first. It never reaches Bluehost directly. Cloudflare checks the request against a set of rules and bot detection systems. Once the request passes those checks, Cloudflare forwards it along to my actual server. This setup speeds up loading times, and it blocks a lot of genuine attacks. The tool itself is not a bad one, and I still use it on every site today.
What Googlebot and Other Bots Are
A bot is simply a small program that visits websites automatically instead of a human clicking around. Some bots are helpful, and some bots cause nothing but trouble. Googlebot is Google’s own crawler, and its entire job is to visit your pages and read the content. It then reports what it finds back to Google’s index. Without Googlebot successfully reaching your site, Google cannot know your pages exist, let alone rank them for anyone searching.
Ahrefs, Semrush, and Screaming Frog also send out their own bots to crawl your site. These bots build the audit reports that site owners depend on every week. Because these tools need a bot to reach every page, a firewall that blocks bots blocks the reports too. My site returned a 403 error to every one of these crawlers at once. Both Google’s index and my own audit tools went dark on the exact same day.
How I Noticed the Problem
Ahrefs Site Audit Went Quiet
My weekly Ahrefs crawl usually finishes within an hour and returns a full report. This time the audit stalled after only a few minutes. It then returned almost nothing useful to review. Every page it tried to reach came back with a 403 status instead of the normal 200. I assumed my server was just having a bad day. A second attempt the next morning brought back the exact same result.
Google Search Console Could Not Read My Sitemap
Next, I opened the Sitemaps section inside Search Console. A red warning sat next to my file that had never appeared before. The status read “Couldn’t fetch,” which is Google’s polite way of saying it hit a wall. I resubmitted the sitemap twice that same afternoon. Both attempts failed within seconds of clicking submit. A sitemap failure this consistent rarely comes from a small typo, so I knew something deeper had gone wrong.
My Impressions Dropped 90 Percent
The impressions graph in Search Console is usually the first place I look every Monday morning. This time it told the whole story on its own. My daily impressions fell from a steady baseline down to almost nothing within a single week. Pages that had ranked for months simply stopped showing up in results at all. Losing ninety percent of your visibility in seven days is the kind of number that makes you drop everything else you are working on.
What Bluehost Support Told Me
The First Answer Missed the Root Cause
I contacted Bluehost support and explained that Googlebot, Ahrefs, and Search Console were all being blocked at once. The first representative checked my site in a browser and told me it was live. That answer was technically true, but it missed the actual problem completely. A human visiting through a browser looks nothing like a bot making an automated request. Those two situations were not comparable at all, yet the representative treated them as the same thing.
I spent close to an hour on that first call trying to explain the difference. A site being reachable and a bot being blocked are two entirely separate issues. The representative had never heard of a Googlebot related 403 issue before that call. Cloudflare was never even mentioned during that first conversation. Because the support team did not understand the bot angle, I had to escalate the ticket before anyone connected the dots properly.
Why Bot Blocks Are Hard for Support Teams to Diagnose
Frontline support agents usually test a site the same way a customer would, which means opening it in a browser. That test will almost always pass, since Cloudflare rarely blocks a normal browser visit. A bot related block only shows up when someone checks server logs or tests with a crawler’s exact user agent. Most first level support scripts do not include that kind of test at all. So a customer reporting a bot block often sounds, to the agent, like a customer reporting nothing wrong.
Turning Off Attack Mode
A second representative eventually found the real cause after reviewing my account’s security logs. Cloudflare’s Under Attack Mode was active on my domain. Bluehost’s own team had apparently turned it on at some point without telling me. Under Attack Mode presents every visitor with a short verification screen before letting them through the door. Bots cannot solve that screen the way a person can with a mouse click. Googlebot and every audit tool were being stopped cold at that same checkpoint.
What Under Attack Mode Actually Does
Under Attack Mode is Cloudflare’s most aggressive security setting, and it exists for a specific kind of emergency. Site owners flip it on when they believe their server is under a live attack. A flood of fake traffic trying to crash a server is the classic trigger for this setting. While the mode is active, Cloudflare forces every visitor through a short computational challenge before allowing access. A real person barely notices the small delay this creates. Automated bots almost always fail that same check within seconds.
Under Attack Mode does not distinguish between a malicious bot and Googlebot. It treats both the same way every single time. My site had never been under any kind of attack that I knew about. This setting had no business being active in the first place. Bluehost told me they could not explain why it had been turned on. That answer was frustrating to hear after so much lost time and so many lost impressions. Once we turned the setting off, the difference showed up almost immediately inside my server logs.
The Test I Ran on Two Sites
Bluehost recommended turning off Cloudflare entirely to confirm it was the actual cause. I did not want to risk all seven sites at once on a guess. So I picked two lower traffic sites to use as a controlled test first. I turned Cloudflare off on those two domains and left the other five untouched for the moment. Within a single day, both test sites returned normal 200 responses to every crawler I checked manually.
Ahrefs completed a full audit on both test sites without a single 403 error appearing. Google Search Console successfully read both sitemaps within hours of my resubmission. The test confirmed exactly what I already suspected was happening. Cloudflare’s configuration on Bluehost was the actual culprit behind the block.
What I Watched For During the Test
I did not stop checking once the first crawl succeeded, because one clean pass is not proof of a lasting fix. Server resource usage on both test sites stayed under close watch for several days afterward. Failed login attempts, unusual traffic spikes, and strange requests hitting odd file paths were the three things I checked for most closely. Neither test site showed anything alarming during that window. That result gave me enough confidence to plan the same fix for my remaining five sites. It also gave me a short checklist that I now run on every domain after any security change.
The Numbers Across All Seven Sites
Before the block, my seven sites together averaged close to four thousand daily impressions in Search Console. During the worst week of the block, that combined number fell under six hundred. Three of my sites lost their sitemap entirely from Google’s crawl schedule during that stretch. Two more kept a handful of pages indexed, but new content stopped appearing in results altogether.
I spent roughly six hours total on phone calls, chat support, and digging through raw server logs to find the root cause. Once Under Attack Mode came off, my top test site regained a normal crawl rate within three days. The other site needed closer to five days before Ahrefs stopped flagging fresh 403 errors. Those numbers matter because they show the fix works, but recovery still takes patience rather than happening overnight.
What Turning Off Cloudflare Actually Does
Turning off Cloudflare removes the security layer sitting between your visitors and your server. Your site starts talking directly to every visitor, bot, and potential attacker without a filter in front of it anymore. This includes malicious traffic that Cloudflare had quietly been catching without your knowledge for years. Flipping that switch is not a decision to make casually, even when it fixes an indexing problem right away.
The Risk I Accepted
Without Cloudflare, my real server IP address becomes visible instead of staying hidden behind Cloudflare’s network. Attackers who learn your real IP can target your server directly with traffic floods or login attempts. My server also loses Cloudflare’s caching and speed benefits once the switch flips off. Pages can load a little slower for visitors without that caching layer in place. I accepted this tradeoff temporarily because getting my pages back into Google’s index mattered more right then. A small speed loss felt worth it compared to staying invisible in search results.
Anyone considering the same move should watch their server resource usage closely afterward. A sudden spike in traffic or failed login attempts is often the first warning sign. It usually means unwanted bots have found the exposed site again. Bluehost’s version of Cloudflare cannot be configured beyond a simple on or off switch. Site owners on that plan lose the middle ground entirely because of this limit. You either get full protection with the bot blocking risk, or you get no protection with full bot access. There is no dial in between on that free bundled tier.
The Mistake That Cost Me More Impressions
Here is the part of this story that stings the most to admit. After confirming the fix worked on my two test sites, I meant to disable Cloudflare on my remaining five sites that same week. Life got busy, a client project pulled my attention away, and I simply forgot to finish the job. Those five sites kept sitting behind Under Attack Mode for far longer than they ever needed to.
Every one of those five sites kept losing impressions the entire time I forgot about them. Googlebot kept hitting the same 403 wall day after day without fail. My visibility kept sliding further down while I focused on other work entirely. Do not let a fix that works on paper sit half finished the way I did. If you test something on part of your setup and it works, roll it out everywhere immediately. Do not trust yourself to remember later, because a calendar or a client call will always get in the way.
What I Am Doing Today to Fix It
I finally turned off Cloudflare on the remaining five sites once I realized how long they had been sitting broken. My server logs already show Googlebot successfully reaching pages that had returned 403 errors for days. Ahrefs is queued to run a fresh audit tonight on every domain I manage. I expect that audit to complete without a single error this time around.
Resubmitting My Sitemaps
Search Console needed a fresh look for each affected property, so I went in one at a time. Each sitemap file went back in manually instead of waiting for Google’s normal schedule to run. A manual resubmission tends to prompt Google to attempt a fresh crawl faster. I plan to check the Coverage report daily until impressions climb back toward their normal baseline. Recovery from a block like this usually takes days rather than hours. Patience matters just as much as the technical fix itself in situations like this one.
What You Can Do If Cloudflare Is Blocking Your Bots
Plenty of site owners host on Bluehost or a similar provider without ever touching Cloudflare’s settings. If your traffic suddenly drops for no obvious reason, do not panic and disable everything at once. Work through these checks in order first, because the cause is usually easier to find than it feels in the moment.
Check your Google Search Console sitemap status first. A “Couldn’t fetch” message combined with a normal looking site in your browser is the clearest sign of a bot specific block. This single screen would have saved me close to an hour on the phone. I wish I had checked it before calling support that first day.
Open the Coverage or Pages report and look for the exact phrase “Blocked due to access forbidden.” That phrase points directly at a 403 response coming from your server or your firewall. Seeing it next to dozens of pages at once is a strong signal that a security setting is the culprit rather than a content problem.
Look inside your Cloudflare dashboard under the Security section for Under Attack Mode and Bot Fight Mode. Both settings can silently block verified bots like Googlebot even when your site looks completely normal to a human visitor. Turn off Under Attack Mode first. It is the most aggressive setting, and the least likely to be necessary for a small business site.
Ask your host directly whether Cloudflare on your plan can be configured or only switched on and off entirely. Many budget hosting plans, including Bluehost’s standard tier, only offer a full toggle rather than granular rule building. If you need to allow verified bots while still blocking bad traffic, you will likely need a configurable Cloudflare plan for that domain.
Test any fix on one low traffic site before applying it everywhere else. Once you confirm the fix works, roll it out to every affected property within the same day if you possibly can. Set a calendar reminder if your memory works anything like mine. A half finished fix can cost you just as many impressions as no fix at all.
Cloudflare’s own documentation walks through how to allow traffic from verified crawlers while still blocking everything else. Reading through that guide helped me understand exactly which setting had been working against me the entire time. Ahrefs also publishes a short explainer on what a 403 error inside a site audit actually means. That page confirmed the exact pattern I was seeing across every domain I manage.
What I Would Do Differently Next Time
I would set a recurring reminder to check every site’s Coverage report on the same day each week without exception. My second move would be asking the host directly whether Cloudflare on my plan can be configured beyond a basic toggle. Knowing that answer in advance would have saved me an entire support escalation. I now keep a simple checklist for each of my seven sites, and Cloudflare’s status sits at the top of that list. A five minute check every Monday costs far less than a week of lost impressions.
Frequently Asked Questions
Why would Cloudflare block Googlebot in the first place
Cloudflare blocks Googlebot when a security setting like Under Attack Mode or Bot Fight Mode treats every automated visitor as a threat. These settings cannot always tell the difference between a malicious bot and a legitimate crawler like Googlebot. Hosting providers sometimes enable these settings by default or after a perceived security event without telling the site owner first.
How do I know if Cloudflare is blocking Googlebot on my site
Check the Sitemaps section inside Google Search Console for a “Couldn’t fetch” error next to your submitted file. You can also look at the Pages report for the specific phrase “Blocked due to access forbidden.” That phrase points straight at a 403 response. Running a fresh Ahrefs or Screaming Frog crawl and watching for widespread 403 statuses will confirm the same pattern quickly.
Is it safe to turn off Cloudflare completely
Turning off Cloudflare removes a real layer of protection, so it carries genuine risk rather than being a simple quick fix. Your server becomes directly reachable, including your real IP address and any vulnerabilities Cloudflare had been filtering out for you. I only recommend it as a short term test, or when your hosting plan offers no other way to allow verified bots through.
What is the difference between Bot Fight Mode and Under Attack Mode
Bot Fight Mode quietly challenges traffic that Cloudflare identifies as likely automated, and it usually allows verified bots like Googlebot through anyway. Under Attack Mode is far more aggressive, and it forces every single visitor through a challenge screen regardless of who they are. Because it is meant for active emergencies, it should almost never stay on for a normal site over the long term.
How long does it take for impressions to recover after fixing a bot block
Recovery speed depends heavily on how often Google was already crawling your site before the block began in the first place. Sites that Google crawled frequently before the issue often start showing signs of recovery within a few days of the fix. Resubmitting your sitemap manually inside Search Console can speed up the next crawl instead of waiting for Google’s normal schedule to kick in.
Can I configure Cloudflare on Bluehost without upgrading
The free version of Cloudflare bundled with standard Bluehost plans only offers a basic on or off toggle for most site owners. Bluehost support confirmed that granular rule building, including allowing specific verified bots, requires purchasing Cloudflare separately for each domain you manage. If you manage multiple sites and need that level of control, budget for a per site Cloudflare plan. Do not assume the bundled version will flex to fit your needs.
How to Make your Website Faster
Website Performance for Beginners
Discover Website Jockey
Website Jockey is your go-to beginner’s resource for learning all things related to websites, web design, SEO, eCommerce, and beyond.
Whether you’re just starting or aiming to enhance your skills, our blog provides easy-to-understand tips, practical tutorials, and expert insights to help you build, optimize, and grow your online presence effectively.
Cap Puckhaber hosts Website Jockey, your go-to resource for learning websites, web design, SEO, eCommerce, and more.
Our Blog
We’ve Got You Covered.
Ecommerce management covers all aspects of running an online store, including product listings, inventory, customer service, marketing strategies, and order fulfillment to ensure profitability.
SEO (Search Engine Optimization) enhances website visibility on search engines, driving organic traffic and improving user experience
Development focuses on creating responsive, functional, and high-performance websites through coding and design.
Web Design prioritizes aesthetics and usability, using layout, color, typography, and interactive features to engage visitors.
Web management ensures ongoing website maintenance, including content updates, security, and performance optimization, for smooth operations and business growth.
Follow Cap Puckhaber
Connect with Cap Puckhaber on Facebook. See my latest adventures on Instagram. Read my thoughts on business, finance and more on X. Join the conversation with Cap Puckhaber on Threads.
Follow me on Mastodon for the latest updates. Browse my Pins on Pinterest. See my Marketing Articles on Medium. Check out Cap Puckhaber’s Company Page on LinkedIn
Cap Puckhaber
Backpacker, Marketer, Investor, Blogger, Husband, Dog-Dad, Golfer, Snowboarder
Cap Puckhaber is a marketing strategist, finance writer, and outdoor enthusiast from Reno, Nevada.
He writes across CapPuckhaber.com, TheHikingAdventures.com, SimpleFinanceBlog.com, and BlackDiamondMarketingSolutions.com.
Follow him for honest, real-world advice backed by 20+ years of experience.
Follow Cap Puckhaber Online
- Join the Team on Wellfound
- Connect with Cap Puckhaber on Facebook
- See Real-Time Thoughts on X
- Read In-Depth Articles on Medium
- Subscribe to Cap Puckhaber’s Substack Newsletter
- Follow Cap Puckhaber’s Company Page on LinkedIn
- View Our Agency Profile on DesignRush
- See Cap Puckhaber’s Agency on Agency Spotter
- Explore Technical Projects on GitHub
- See Cap Puckhaber’s Creative Portfolio on Behance
- Learn more about my company on Crunchbase
- Cap Puckhaber’s Quora Profile
- Join Cap Puckhaber’s Conversation on BlueSky
- Follow My Updates on Mastodon