cloudhider.Diagnose DNS, TLS and blocked requests
Start with the exact request and its scope. DNS routing, certificate issuance, origin availability and security decisions are different stages and need different checks.
Certificate remains pending
Check the A record against the proxy IPv4, look for a conflicting AAAA record and verify that port 80 reaches the ACME challenge path. Use Check DNS now for a fresh result, then retry TLS. A pending DNS change may remain cached until its TTL expires.
A queued certificate waits for the serial certificate worker; an issuing certificate is being processed. Manual retry does not create concurrent Certbot processes. An active certificate is reused rather than reissued unnecessarily.
Request is blocked or rate-limited
Find the request in Traffic & events using its ID, IP or path. HTTP 403 commonly represents a deny decision or a required challenge that a non-browser request cannot complete. HTTP 429 indicates a rate limit. Use the recorded reason to identify the relevant check.
A verified browser still obeys explicit blocks and the hard rate limit. A webhook exception does not override those checks. Inspect the website's own policy as well as its relationship to the global policy.
Website returns 503 or an origin error
A paused website intentionally returns 503. For an active website, verify the origin IP, protocol and port. Ensure the application listens on that address and its firewall allows the proxy's connection. DNS changes alone cannot repair an unreachable origin.
Cloudhider supports HTTPS connections to origins, but origin-certificate verification is not currently enforced. Country and ASN filtering require their respective local GeoIP databases; the Settings page reports whether those files exist.
Recover after a policy change
Use policy history to review the author, time and changed fields. Inspect the previous snapshot before restoring. The current state is preserved as another version, and concurrent changes are detected instead of silently overwritten.
If counters look different, distinguish sampled historical summaries from exact minute-level metrics collected after the current metrics system was installed. A quiet website can have no recent requests without its log pipeline being broken.