Allow ViperCapture through your site security

Create an access rule

Hosted ViperCapture currently makes target requests from 193.70.41.100/32. For a durable rule, combine that source IP with an exact hostname, a dedicated capture path, and a random header value that you control. Do not match only on the browser User-Agent; it varies with the selected engine and may change as browsers are updated.

1. Prefer a dedicated preview hostname or path such as www.example.com/capture-preview/.
2. Generate a long random value and require it in a custom header such as X-ViperCapture-Key.
3. Allow only 193.70.41.100/32, the exact host and path, and that header value.
4. Skip only the WAF, bot, or rate-limit checks that are causing the false positive. Keep logging enabled.

Send your site access header

Put the header in the render request's headers object. ViperCapture applies caller-supplied headers only to the exact origin in url. A redirect or asset on another origin does not receive the secret.

curl https://capture.viperisuseful.cc/v1/render \
  -H "Authorization: Bearer vc_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://www.example.com/capture-preview/report",
    "output": "png",
    "headers": {
      "X-ViperCapture-Key": "replace-with-a-long-random-value"
    }
  }' \
  --output report.png

Use a scoped, revocable value and rotate it if it is exposed. For a protected preview environment, the same mechanism can carry a short-lived Authorization token. Avoid copying a person's long-lived session cookie into a render request.

Cloudflare WAF and rate limits

In Cloudflare, open Security → WAF → Custom rules and create a rule above the rule that blocks the capture. Use an expression like this, replacing the host, path, and random value:

(
  ip.src eq 193.70.41.100 and
  http.host eq "www.example.com" and
  starts_with(http.request.uri.path, "/capture-preview/") and
  any(http.request.headers["x-vipercapture-key"][*] eq "replace-with-a-long-random-value")
)

Choose the Skip action, then select only the products that need an exception—for example rate limiting rules, Managed Rules, or Super Bot Fight Mode. Cloudflare cannot skip Free-plan Bot Fight Mode with a custom Skip rule. If that feature is the blocker, prefer a separate capture hostname with appropriately scoped protection. An IP Access Rule set to Allow is a broader last resort because it bypasses multiple security checks and cannot be narrowed by path or secret header.

Cloudflare documents the current behavior in custom rules with Skip, request-header expressions, and IP Access Rules.

Other CDNs, WAFs, and application limits

Apply the same least-privilege shape in your provider: source address 193.70.41.100/32, exact hostname, dedicated path, and your secret header. Exempt matching requests only from the specific bot challenge or rate-limit policy that blocks them. Do not disable the WAF, bot protection, or rate limiting globally.

Check the origin application too. A CDN exception does not change a rate limiter, reverse proxy, authentication gateway, or anti-bot plugin running on your server. If your origin sits behind Cloudflare, make sure it evaluates Cloudflare's restored visitor IP rather than the Cloudflare edge address.

Cross-origin assets

Fonts, images, scripts, or API calls hosted on another origin do not receive your custom header. If a required asset host also blocks the renderer and you administer it, add a separate narrow rule there. Do not forward the same secret to a third-party CDN or service you do not control.

Caller-managed external challenge tools

ViperCapture does not integrate with, call, or endorse external challenge tools, does not accept their credentials, and does not solve or bypass challenges. If you administer the target or have explicit permission to test it, you may independently use an authorized external tool outside ViperCapture. After that work completes, start a new render with only the resulting short-lived, target-scoped state in network.cookies or headers. There is no automatic handoff, provider callback, or exchange of challenge data.

Existing network boundaries still apply. Custom headers are sent only to the exact origin in url; redirects and subresources on a different origin do not receive them. In hosted mode, cookie domains must match the requested hostname or one of its parent domains. Normal SSRF and outbound network checks remain active.

Troubleshoot a blocked capture

• 403 or Cloudflare error 1020: inspect the provider security event and the exact rule ID that matched.
• 429: exclude the narrow match from both CDN and origin rate-limit policies, or raise only its dedicated limit.
• Challenge page or captcha_detected: remove the challenge for the authorized rule. proceed_on_captcha only captures the challenge as shown; it does not solve or bypass it.
• Missing fonts or images: look for a blocked cross-origin asset request and authorize that asset host only if you control it.

Verify and maintain the exception

Run one small capture, confirm the request in both edge and origin logs, and verify that requests missing the secret header are still protected. Monitor the rule, keep its scope narrow, and remove it when the capture integration is no longer used. Contact support before relying on the hosted source IP as a permanent network contract.