Allow Chat4U through AWS WAF

Find the request and responsible rule

1. Select the protection for this websiteUse the correct protected resource and scope.

   In the AWS WAF console, find the site's protection pack (web ACL). The new console uses Resources & protection packs (web ACLs); the standard console uses Web ACLs. Have the administrator confirm it protects the affected CloudFront distribution or regional resource. AWS's current console navigation.

2. Inspect the matching requestRecord its rule and action before changing protection.

   Open its request logs or Sampled requests. Find the affected URI and time, then inspect the action and Rule inside rule group where present. Sampled requests are incomplete; if the attempt is absent, check available logs or run one fresh Chat4U check. No sample is not evidence of permission. AWS's request-inspection procedure.

Bot Control with a private header token

1. In the affected Chat4U source choose Website access token → Custom header rule. Arrange a dedicated secret privately with the administrator and configure the same value in Chat4U and AWS.
2. Have the administrator edit the Bot Control managed rule group, retaining existing conditions. Its inspection scope should include existing intended traffic except approved requests matching the private header, hostname, content paths and intended methods. In logical terms: existing scope AND NOT (approved Chat4U request). This excludes only matching requests from Bot Control inspection.
3. Use an exact match for the configured header/value; check that nonmatching traffic remains inspected. Save the change. Other WAF rules continue to apply. Follow AWS's shared-secret scope-down example when configuring the managed group.

User-Agent: Chat4UBot/1.0
X-Chat4U-Import-Token: YOUR_PRIVATE_CONFIGURED_TOKEN

When the observed rule blocks the User-Agent

If the matching Bot Control rule is SignalNonBrowserUserAgent, follow AWS's targeted override and label-based exception. Have the administrator override that signal to Count, then retain blocking of its labelled requests except the approved, scoped Chat4U identifier. A public Chat4UBot/ prefix is copyable; this procedure does not exempt other bot signals. For a different/custom rule, modify only the identified rule's exception with the administrator rather than applying this example to every denial.

Verified-IP matching is another method only when the source displays a verified stable list. Open Website access settings → Access method → Allow verified importer IP addresses on the affected source and select Copy IP addresses. Do not use a changing worker address or broad cloud range.

Open Chat4U

Verify and troubleshoot

After saving, allow the provider's configuration update to propagate, then return to the same source and select Test access and retry import. If it is still refused, inspect the newest request: it may match a different rule, wrong hostname/path, absent/mismatched header or another security layer. If readable content is confirmed, wait for processing and inspect imported pages and remaining warnings. Complete verification.

If you cannot change AWS settings

Open Request details → Copy instructions for my administrator, then share the safe report and this guide with the person who manages AWS. If they cannot provide the required exception, use an authorized file or text source.

Remove the exception later

Remove only the exception/override you created or revoke its dedicated secret, then remove the token from Chat4U. Keep other pre-existing scope conditions intact. Previously imported knowledge requires a separate content-removal action.

Last updated on