Troubleshoot Cloudflare Blocking Easy MCP AI Connections

If your ChatGPT Developer or other remote MCP connector stays stuck on connection, the issue can still be Cloudflare even when the discovery URLs load. Use the checks below to separate an outdated plugin route from a Cloudflare security block.

A working ChatGPT connection does not prove Cloudflare allows Claude: Cloudflare can allow one MCP client while blocking another based on the request identity or User-Agent, the header identifying the software making the request.

In this article

• Update Easy MCP AI before changing firewall rules
• Check whether the Easy MCP endpoints reach WordPress
• Resolve a Cloudflare Bot Fight Mode block
• Reconnect and verify your MCP client

Update Easy MCP AI before changing firewall rules

1. In WordPress, go to Dashboard > Updates.
2. Update Easy MCP AI to the current release.
3. Retry your MCP connection before changing Cloudflare settings.

Current Easy MCP AI releases correct the protected-resource discovery route. If your logs show /.well-known/oauth-protected-resource/wp-json/easy-mcp-ai/v1/mcp returning “not found”, update first, then retest.

Check whether the Easy MCP endpoints reach WordPress

Start with the discovery details returned by your site, rather than assuming discovery uses the site root:

1. Send an unauthenticated POST request to your MCP endpoint, normally /wp-json/easy-mcp-ai/v1/mcp.
2. Inspect the response's WWW-Authenticate header, which tells the client how to find sign-in details. Copy the exact URL named by resource_metadata and send a GET request to it.
3. In the returned JSON document, find the authorization_servers list. Use the issuer URL listed there (the address identifying the authorization server) to discover and fetch that server's OAuth metadata. Do not assume its discovery document is hosted at the site root.

Endpoint	Request	Expected response	What it proves
/wp-json/easy-mcp-ai/v1/mcp	POST without credentials	401 Unauthorized with Easy MCP AI's discovery challenge	The MCP route reached WordPress and is protected as expected.
The exact resource_metadata URL advertised by that response	GET	200 OK with protected-resource JSON	The discovery document this connection is directed to is reachable.
Authorization-server metadata for the issuer in authorization_servers	GET	200 OK with authorization-server JSON	The sign-in details for the advertised authorization server are reachable.
/.well-known/oauth-protected-resource	GET, when the client uses root discovery	200 OK	The root protected-resource URL is reachable; this is not required by every connection.
/.well-known/oauth-authorization-server	GET, when the client uses root discovery	200 OK	The root authorization-server URL is reachable; this is not required by every connection.

A 401 from Easy MCP AI on the MCP endpoint is healthy in this test. It means the route is live and rejecting unauthenticated access correctly, not that the route is broken.

Current Easy MCP AI releases prefer a discovery document below the MCP endpoint when usable, including for Claude.ai on hosts that block root addresses. Root discovery can therefore remain blocked while sign-in works. Permalink, configuration, and fallback rules still affect which URL is selected: test the URL actually advertised, not a hard-coded replacement.

If the discovery route returns “not found” for the protected-resource path that appends /wp-json/easy-mcp-ai/v1/mcp, update Easy MCP AI and test again before continuing with Cloudflare checks.

If the client's resource_metadata URL is a root /.well-known/ address, check that address too. Do not treat root discovery URLs as required when the 401 response directs the client to discovery below the MCP endpoint. If the endpoint checks used by your connection already match the expected statuses, cache or Varnish exclusions alone will not fix a connector request blocked before WordPress.

Resolve a Cloudflare Bot Fight Mode block

Retry the failed connection in Claude or the affected MCP client and note the time. In Cloudflare, open Security > Events and filter for requests at that time that hit:

• The exact discovery URL named by resource_metadata in the MCP endpoint's 401 Unauthorized response
• /wp-json/easy-mcp-ai/v1/mcp
• Discovery requests below /wp-json/easy-mcp-ai/v1/mcp/.well-known/, and the exact resource_metadata URL advertised by the MCP response if a different fallback is in use
• The authorization-server discovery URL found using the advertised issuer

Open the matching event and inspect the action, responsible rule or bot protection, request path, and User-Agent or other request identity shown. If Claude receives 403 Forbidden, times out, or reports a block before WordPress while ChatGPT connects successfully, this points to client-specific bot filtering or a web application firewall (WAF) rule rather than an Easy MCP endpoint outage. A matching blocked event confirms Cloudflare intercepted that request; a timeout alone does not.

Adjust the bot-protection control responsible for that event, or, where supported, create the narrowest exception under Security > WAF > Custom Rules for both the affected request identity and the exact discovery URL named by resource_metadata or MCP endpoint path. Do not assume root discovery is required when the 401 response points below the MCP endpoint. Do not allow all requests just because their User-Agent mentions Claude, or disable site-wide security or Easy MCP AI authentication.

If the event points to Bot Fight Mode, run a temporary causal test:

1. Go to Security > Bots and temporarily disable Bot Fight Mode.
2. Retry the MCP connector immediately.

Basic Bot Fight Mode can run outside ordinary custom WAF skip rules, so a normal skip rule may not bypass it.

If disabling Bot Fight Mode restores the connection, re-enable protection with narrower controls instead of leaving broad protections off. Use Security > WAF > Custom Rules with targeted Cloudflare custom WAF rules and Cloudflare rate limiting rules, or move to a Cloudflare bot-management mode that supports granular exceptions. You can review current Bot Fight Mode behavior in Cloudflare’s official Bot Fight Mode documentation.

Reconnect and verify your MCP client

After each change above, retry the connector in your MCP client and confirm it no longer reports the endpoint as unreachable or hangs during discovery. For client-specific reconnect steps, use OpenAI’s official connector documentation instead of old UI walkthroughs: Connectors in ChatGPT.

For Claude, follow How to Connect Claude.ai to WordPress to reconnect, and confirm OAuth discovery (the lookup of sign-in details) completes and the WordPress authorization page opens. Repeat the unauthenticated POST check above against /wp-json/easy-mcp-ai/v1/mcp: the expected 401 Unauthorized, rather than a Cloudflare block or challenge, shows the request reaches Easy MCP AI while authentication remains required. Check Security > Events again for the retried Claude request to confirm the same rule no longer blocks it; a successful probe from another client alone does not confirm Claude is allowed.

If all endpoint checks used by your connection return the expected statuses, Cloudflare shows no blocked event, and the connector still fails, contact support and include:

• The exact request URL
• Timestamp of the failing attempt
• Observed HTTP status
• Relevant Cloudflare event details (action, rule, and request path)