Troubleshoot Cloudflare Blocking Easy MCP AI Connections
If your ChatGPT Developer or other remote MCP connector stays stuck on connection, the issue can still be Cloudflare even when the discovery URLs load. Use the checks below to separate an outdated plugin route from a Cloudflare security block.
In this article
Update Easy MCP AI before changing firewall rules
- In WordPress, go to Dashboard > Updates.
- Update Easy MCP AI to the current release.
- Retry your MCP connection before changing Cloudflare settings.
Current Easy MCP AI releases correct the protected-resource discovery route. If your logs show /.well-known/oauth-protected-resource/wp-json/easy-mcp-ai/v1/mcp returning “not found”, update first, then retest.
Check whether the Easy MCP endpoints reach WordPress
Run these unauthenticated checks directly against your site URL:
| Endpoint | Request | Expected response | What it proves |
|---|---|---|---|
/.well-known/oauth-protected-resource | GET | 200 OK | The protected-resource discovery URL is reachable. |
/.well-known/oauth-authorization-server | GET | 200 OK | The authorization-server discovery URL is reachable. |
/wp-json/easy-mcp-ai/v1/mcp | POST without credentials | 401 Unauthorized | The MCP route reached WordPress and is protected as expected. |
A 401 on the MCP endpoint is healthy in this test. It means the route is live and rejecting unauthenticated access correctly, not that the route is broken.
If the discovery route returns “not found” for the protected-resource path that appends /wp-json/easy-mcp-ai/v1/mcp, update Easy MCP AI and test again before continuing with Cloudflare checks.
If these endpoint checks already match the expected statuses, cache or Varnish exclusions alone will not fix a connector request blocked before WordPress.
Resolve a Cloudflare Bot Fight Mode block
In Cloudflare, open Security > Events and filter for requests that hit:
/.well-known/oauth-protected-resource/.well-known/oauth-authorization-server/wp-json/easy-mcp-ai/v1/mcp
Then run a causal test:
- Go to Security > Bots and temporarily disable Bot Fight Mode.
- Retry the MCP connector immediately.
Basic Bot Fight Mode can run outside ordinary custom WAF skip rules, so a normal skip rule may not bypass it.
If disabling Bot Fight Mode restores the connection, re-enable protection with narrower controls instead of leaving broad protections off. Use Security > WAF > Custom Rules with targeted Cloudflare custom WAF rules and Cloudflare rate limiting rules, or move to a Cloudflare bot-management mode that supports granular exceptions. You can review current Bot Fight Mode behavior in Cloudflare’s official Bot Fight Mode documentation.
Reconnect and verify your MCP client
After each change above, retry the connector in your MCP client and confirm it no longer reports the endpoint as unreachable or hangs during discovery. For client-specific reconnect steps, use OpenAI’s official connector documentation instead of old UI walkthroughs: Connectors in ChatGPT.
If all endpoint checks return the expected statuses, Cloudflare shows no blocked event, and the connector still fails, contact support and include:
- The exact request URL
- Timestamp of the failing attempt
- Observed HTTP status
- Relevant Cloudflare event details (action, rule, and request path)