Allowlist Apex in your firewall

Let Apex previews pass your storefront WAF without weakening other protections.

Allowlist Apex in your firewall

Apex preview proxies identify storefront requests with the per-store secret header X-Apex-Verification: <your token>. Find and copy the token in Settings → Installation → Developer and diagnostics. Treat it like a password and do not place it in storefront code or share it publicly.

Cloudflare WAF

Create a custom rule scoped to your store hostnames with this expression:

text

any(http.request.headers["x-apex-verification"][*] eq "<your token>")

Choose Skip, select the relevant WAF protections, and place the rule first. Keep the hostname scope in the same rule so the token cannot authorize unrelated domains. Cloudflare Super Bot Fight Mode cannot be skipped by a custom rule; if it still challenges previews, adjust that feature separately for the store.

Auxiliary Apex traffic

Operator and QA browser loads send the secret header only to your store's own hostnames. If interception is unavailable or disabled, or if other non-preview scanners also need an exception, restrict a secondary rule to the store hostnames and these distinctive User-Agents:

Apex-Operator/1.0
DripApex/OnboardingScan
Mozilla/5.0 (compatible; ApexBrandBot/1.0)
ApexStorefrontImageBot/1.0
DripApex/StorefrontUnlock
DripApex/DomainPreflight