Heyo!!
For my Plasmic website, https://www.msmpokegamer.com, I recently needed to place the domain behind Cloudflare so that I could provide a server-side redirect for /ads.txt, which Plasmic Hosting does not currently support directly.
Since enabling the Cloudflare proxy, first-time visitors are presented with a “Vercel Security Checkpoint.” It adds approximately 4–5 seconds before they can access the website, and the checkpoint appears again after the visitor’s session expires.
Technical testing shows that the homepage returns:
Testing the underlying Vercel origin produces the same challenge response, while Cloudflare forwards it to visitors. Vercel’s documentation also explains that its protection can incorrectly challenge legitimate visitors when a reverse proxy such as Cloudflare is used.
Because this is a Plasmic-hosted website, I do not have access to the underlying Vercel project or its security settings.
Could the Plasmic team please resolve the Vercel checkpoint affecting my visitors? Alternatively, if there is a way for me to resolve it myself while continuing to use Plasmic Hosting and Cloudflare, could you please provide clear instructions?
I have spent considerable time optimising the website’s loading performance, so requiring every new visitor to wait at a security checkpoint significantly affects their experience. Continuing to use Cloudflare is currently necessary for my /ads.txt server-side redirect.
I would be very grateful for your help, thank you!! Ben
We’ll look into this!
We may also consider revisiting the ability to control root level text files in Plasmic hosting, but it probably won’t happen soon enough to help you in this case.
Thank you! Can I ask what you advise me to do for now? I bought a year plan to host with Plasmic but this is a considerable delay for viewers of my site I wasn’t expecting and there’s no way for me to fix it while hosting my site here. Is there anything you could do for my site in the meantime to stop it?
Unfortunately there’s no way to turn off bot protection per-site, and we can’t turn it off globally because real abuse does occur.
I’m looking into some options to see if there’s a way to get Cloudflare+Vercel to play nicely.
We are testing a solution for allowing root level static files in Plasmic hosting, I believe it will be ready next week but don’t have a guaranteed timeline.
If you could allow root level static files that would resolve all my problems. Please do let me know when the update to Plasmic becomes available if you could? It’s amazing it could be done so soon, Plasmic has been the best tool to work with since starting to use it, I really appreciate it thank you!
There’s no UI yet, but it can be done from the browser dev console in your project. Run this, using your ads.txt content:
const projectId = location.pathname.split("/")[2];
await gAppCtx.api.setPlasmicHostingTextFile(
projectId,
"/ads.txt",
"google.com, pub-..., DIRECT, ...\n"
);
Pass null instead of the content to delete the file. Publish isn’t needed, the file will be live immediately.
To see current files, do await gAppCtx.api.getPlasmicHostingSettings(projectId). If you’re not comfortable doing this, you can paste your ads.txt here and I’ll help.
Thank you! The ads.txt now serves directly from my site (www.msmpokegamer.com), this helps me so much! I have some questions if you could answer them please
- My advertising provider, Raptive, hosts an ads.txt file that they update. Can I make
/ads.txt return a server-side redirect to their hosted URL, so updates appear automatically without me copying the contents into Plasmic?
- How do i add a permanent HTTP 301 redirect from old URLs to their new URL replacements so google and visitors can reach the correct pages? Is there an API for maintaing these? I have a redirect table setup that my site uses.
3.I originally enabled Cloudflare to accommodate the missing functionality, but have now disabled its proxy and pointed the website directly to Plasmic. However, visitors are still seeing the Vercel Security Checkpoint, which adds a considerable delay. How should I go about fixing this? I know you said its for security but it only started happenign when i enabled and disabled cloud flare and it is a considerable delay
Thank you again so much!! Adding static file support so fast really really helps me out
Right, a redirect is the ideal way to do this, but we don’t have an easy way to expose that functionality at the moment.
The only solutions I can think of are scripting the file update, or switching from Plasmic hosting to using Vercel directly. That would also solve your third (and maybe second) problem.
I’m not sure exactly what you mean in your second question, do you have old pages, like /page1, that you want to redirect to e.g. /page1-new? Since we don’t support redirects in Plasmic hosting, I think your only options are client side (JS) redirects or just serving both pages.
I don’t think your Cloudflare switch caused the bot detection delay, it was likely a coincidence since we turned it on at the same time. Lately we’ve started to get hit pretty hard by bots and scrapers, so I don’t think much can be done about this.
Okay thank you for your response! I did mean to redirect to old pages like that, yes. I’ll leave redirects for now as I wanna stay with Plasmic Studio. When you mention scripting the file to update, is there a supported way I could automatically update the Plasmic ads.txt static file in a hourly script on my computer? so it automatically keeps updated the static file to the site that was provided.
Hi again sam. I am now receiving reports from genuine visitors that they cannot access the website properly due to the Vercel Checkpoint, with reports that some users can only access the homepage.
Direct requests return: HTTP 429 Too Many Requests, server: Vercel, x-vercel-mitigated: challenge
This means the issue appears to come from the protection applied to Plasmic-hosted websites. My own browser successfully completes the challenge, but some legitimate visitors’ browsers evidently cannot as my visitors keep reporting to me.
I understand from your previous response that the bot protection cannot currently be disabled for an individual Plasmic-hosted site. However, this has now progressed from a temporary delay to genuine visitors being unable to access my website content. If Plasmic cannot provide another solution, could I please request a refund for the unused portion of my annual subscription, due to genuine visitors being unable to access my Plasmic-hosted website? I may need to move the website to Vercel as you’ve suggested so that my visitors can access my site reliably.
Thank you for looking into it!