Skip to main content

WAF Configuration

If you’re using a Web Application Firewall (WAF) to protect your site, you may need to explicitly allow Perplexity’s bots to ensure they can access your content. Below are configuration guidelines for popular WAF providers.

Cloudflare WAF

To configure Cloudflare WAF to allow Perplexity bots:
1

Navigate to security rules

In your Cloudflare dashboard, go to Security → Security rules.
2

Create a new rule

Select Create rule → Custom rules.
3

Configure rule conditions

Each bot has its own IP ranges, so match each User-Agent against its own IP ranges. Select Edit expression and enter:
Replace each placeholder with the current ranges from the official endpoints listed below, separated by spaces, for example {192.0.2.0/24 198.51.100.7/32}. When the published ranges change, update them in this rule.On paid plans, you can instead store each bot’s ranges in an IP list and reference it, for example ip.src in $perplexitybot. You then update the lists rather than the rule. Free plans allow only one custom list, which isn’t enough for both bots.
4

Set rule action

Set the action to Skip and select the security features these requests should bypass, such as All remaining custom rules, All managed rules, All rate limiting rules, or All Super Bot Fight Mode rules.
5

Order the rule

Place this rule above any custom rules that block or challenge requests. A Skip rule only bypasses rules that run after it.
Cloudflare’s Bot Fight Mode can’t be skipped with WAF custom rules. If Bot Fight Mode is enabled, it can still challenge Perplexity bots that match this rule.

AWS WAF

For AWS WAF configuration, create IP sets and rules that match them together with the User-Agent header:
1

Create IP sets

In the AWS WAF console, create an IP set for PerplexityBot and one for Perplexity-User using the IP addresses from the official endpoints listed below.
2

Create allow rules

For each bot, create a rule with an AND statement that combines:
  • An IP set match statement that uses the bot’s IP set
  • A string match statement on the User-Agent header that contains PerplexityBot or Perplexity-User
Set the rule action to Allow.
3

Add the rules to your web ACL

Add these rules to your web ACL and give them lower priority numbers than your blocking rules, so AWS WAF evaluates them first.

IP Address Sources

Always use the most current IP ranges from the official JSON endpoints. These addresses are updated regularly and should be the source of truth for your WAF configurations.
Set up automated processes to periodically fetch and update your WAF rules with the latest IP ranges from these endpoints to ensure continuous access for Perplexity bots.

Best Practices

When configuring WAF rules for Perplexity bots, combine both User-Agent string matching and IP address verification for enhanced security while ensuring legitimate bot traffic can access your content.
Changes to WAF configurations may take some time to propagate. Monitor your logs to ensure the rules are working as expected and that legitimate Perplexity bot traffic is being allowed through.