Allow PostShip in your firewall
When your host puts an anti-bot challenge in front of PostShip — Vercel Security Checkpoint, Cloudflare — what to allow, and where.
Updated on 25 September 2026
On this page
Some hosts protect sites behind an anti-bot challenge: an intermediate page that a browser clears on its own, by running a script, and that a monitoring tool does not. Vercel calls it Security Checkpoint, Cloudflare Just a moment…. When it answers instead of your page, PostShip cannot tell whether the page is fine: it says so, keeps the last verdict as it is and opens no incident.
PostShip does not get around this challenge. Posing as a browser would mean breaking your site's protection, and the host would end up blocking PostShip for everyone. The clean way is for you to allow it.
What PostShip checks
Every page check leaves from a single machine, with a fixed IP address:
| Value | |
|---|---|
| IP address (IPv4) | 141.253.121.153 |
| User-Agent | PostShipBot/0.1 (+https://postship.fr) |
The IP address is the most reliable way: anyone can copy a User-Agent, not an address. The probes on 5 continents leave from elsewhere and are not affected.
A challenge is recognised by its signature — the x-vercel-mitigated or cf-mitigated header, or a 403 page that presents itself as a checkpoint — and never mistaken for a real 403 page.
Set it up
Vercel
Firewall → System Bypass Rules → Add Rule: the address 141.253.121.153, for your domain. Vercel keeps this exemption for its paid tiers, Pro and Enterprise.
On its free Hobby tier, no exemption is possible. The challenge triggers when one address sends many requests to the site, and lifts by itself when traffic drops: monitoring fewer URLs on that domain makes it rarer.
Cloudflare
Security → WAF → Tools → IP Access Rules: add 141.253.121.153 with the Allow action, for this site or the whole account. On a paid plan, a custom rule (Security → WAF → Custom rules) whose condition is IP Source Address equals 141.253.121.153 and whose action is Skip does the same, choosing exactly which protections to skip.
Other host or firewall
Allow the IP address; failing that, the User-Agent. For a private page — a staging site, a back office —, a secret header specific to each URL is set when adding the URL, “What we expect from the page” screen, Private page: access header field.
What triggers an alert
A challenge is not an outage: no alert goes out on the first blocked run. If the challenge lasts more than an hour, a single alert tells you, so that you allow PostShip. On the URL's page, a banner shows since when the firewall has been blocking PostShip, with the address and User-Agent to allow. The same information is in Project → Settings → Advanced.
Limits and plans
The allowance is set at your host; it does not depend on your PostShip plan. See the plans.
Troubleshooting
I added the address, and the challenge comes back
Check that the rule targets the monitored domain (and its subdomains, such as www.), and that it is active. At Cloudflare, an Allow rule placed after a blocking rule may never apply: check the order.
Why does the SSL check pass, and not the page check?
The certificate is read at connection time, before any page: the challenge only applies to the HTTP response. That is why a URL can be blocked while its "Certificate" card stays green.