# URL notifications trigger stopped working?

**URL:** <https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425>\
**Category:** Support\
**Created:** [May 5, 2026, 6:47pm UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425 "2026-05-05T18:47:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![KC4KQE](https://forum.hamalert.org/user_avatar/forum.hamalert.org/kc4kqe/32/127_2.png) [@KC4KQE](https://forum.hamalert.org/u/KC4KQE)\
**Post date:** [May 5, 2026, 6:47pm UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/1 "2026-05-05T18:47:10Z")

</div>

Curious if url notifications (configured under “Destinations” and selected via “URL” on Triggers) have been disabled?

I noticed mine has not been firing in quite a while (I use it to log my notifications to my own database for historical data). I checked to ensure I’m not blocking hamalert’s ip(s), and even completely disabled CloudFlare, but I still can’t get the url notification to fire – I don’t see anything from hamalert hitting my endpoint at all.

---

<div class="post-metadata">

**Author:** ![HB9DQM](https://forum.hamalert.org/user_avatar/forum.hamalert.org/hb9dqm/32/5_2.png) [@HB9DQM](https://forum.hamalert.org/u/HB9DQM)\
**Post date:** [May 6, 2026, 8:29am UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/2 "2026-05-06T08:29:02Z")

</div>

From the server log:

`Notification to URL https://kc4kqe.org/<redacted> failed: AxiosError: Request failed with status code 403`

---

<div class="post-metadata">

**Author:** ![KC4KQE](https://forum.hamalert.org/user_avatar/forum.hamalert.org/kc4kqe/32/127_2.png) [@KC4KQE](https://forum.hamalert.org/u/KC4KQE)\
**Post date:** [May 6, 2026, 4:54pm UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/3 "2026-05-06T16:54:24Z")

</div>

Wow, how odd – that must be coming from CloudFlare for some reason (I disabled it briefly for testing, but it’s back on now). Let me see if I can punch a hole in the CloudFlare rules for that endpoint. Can you confirm the source ip? (You can email me directly vs. here if you prefer - kc4kqe at kc4kqe dot org).

Thanks for checking!

---

<div class="post-metadata">

**Author:** ![HB9DQM](https://forum.hamalert.org/user_avatar/forum.hamalert.org/hb9dqm/32/5_2.png) [@HB9DQM](https://forum.hamalert.org/u/HB9DQM)\
**Post date:** [May 7, 2026, 6:05am UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/4 "2026-05-07T06:05:40Z")

</div>

Source IPs are currently:

65.108.148.220  
2a01:4f9:c013:4a8f::1

---

<div class="post-metadata">

**Author:** ![KC4KQE](https://forum.hamalert.org/user_avatar/forum.hamalert.org/kc4kqe/32/127_2.png) [@KC4KQE](https://forum.hamalert.org/u/KC4KQE)\
**Post date:** [May 9, 2026, 7:31am UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/5 "2026-05-09T07:31:18Z")

</div>

Wow, I spent _entirely_ too much time on this today and tonight 😴 but I got it figured out! 😃

Short version: It turns out CloudFlare thinks you are a bot! 🤖 😃

Long version:

I confirmed I could completely bypass CF and your connections would come in fine - but as soon as I put CF “between” us (even just to serve as a TLS proxy), you could not connect to me.

So, I figured there must have been a rule somewhere that was blocking your ip or network. I combed all my block lists but couldn’t find anything; so I decided to try whitelisting you to bypass other rules I can’t see.

There are a multitude of ways you can whitelist/bypass CF rules, but only _one_ of them can bypass their bot detection – you have to create an “Account IP Access Rule” (formerly called “Account Firewall Access Rule”). The trick is that those rules are only available via some semi-poorly documented API calls.

Buried deep in the CF docs, they confirm – the “normal” way of creating “Custom Rules” to bypass other security measures and whitelist an IP _cannot_ bypass the bot detection. The only way to whitelist an address to bypass bot detection is via the IP Access Rule.

So, I ended up deleting the tons of other rules, application access policies, custom rules, etc. I had created - and just created an IP Access “allow” rule for 2a01:4f9:c013:4a8f::/64 (and another for 65.108.148.220 for good measure), and poof, alerts work again.

🥳🥳🥳

---

<div class="post-metadata">

**Author:** ![HB9DQM](https://forum.hamalert.org/user_avatar/forum.hamalert.org/hb9dqm/32/5_2.png) [@HB9DQM](https://forum.hamalert.org/u/HB9DQM)\
**Post date:** [May 9, 2026, 3:54pm UTC](https://forum.hamalert.org/t/url-notifications-trigger-stopped-working/2425/6 "2026-05-09T15:54:24Z")

</div>

Wow, that sounds like quite a number of hoops you had to jump through! Glad to hear you it figured out 👍

No thanks to the AI scraping bots for breaking the Internet as we knew it… 😐
