Every ShieldCache error page shows an error code and a reference. The error code reveals the cause, and with the reference you can find the request in the customer area via Check reference.
The error codes
| Error code | Meaning |
|---|---|
SC-403-WAF | The firewall blocked the request. |
SC-403-IP, SC-403-GEO, SC-403-ASN | Blocked by an IP rule, the country filter or the network operator filter. |
SC-403-DATEI | File protection blocked access to a sensitive file. |
SC-403-SCHUTZ, SC-401-LOGIN, SC-429-SCHUTZ | Access protection: address not allowed, login missing or incorrect, too many failed attempts. |
SC-403-PRUEFUNG | The proof of the captcha check is invalid or has expired. |
SC-413-GROESSE | The request is larger than allowed. |
SC-429-RATE | A rate limit took effect. |
SC-502-URSPRUNG | Your server cannot be reached. |
SC-503-URSPRUNG | No origin available, for example because all of them are down according to the health check. |
SC-503-WARTUNG | The site is set to “Maintenance page”. |
SC-503-AUS | The site is suspended, for example due to payment arrears. |
SC-504-ZEIT | Your server did not respond within the timeout. |
A visitor reports a 403 error with a reference. What should I do?
Open the site in the customer area, click Check reference and enter the reference. You will see which rule took effect. If it was a firewall false positive, create an exception for the affected path directly, ideally as “Release & log” first. If the address belongs to you, you can also allow it there. If “Check reference” finds nothing, the reference is older than the retention period or belongs to another site. See Firewall (WAF).
Visitors see 502 or 504 - what is going on?
SC-502-URSPRUNG means that ShieldCache cannot reach your server; SC-504-ZEIT means that it does not respond in time. Under Origin, use Test origin to check whether the address, port and TLS are correct and whether your server is running. If a firewall at your host blocks requests from ShieldCache, allow them there. Slow pages, such as exports, need a higher timeout (up to 300 seconds). ShieldCache continues to deliver content that is already cached during an outage, as long as “Serve stale content” is switched on.
The origin test reports a certificate error.
Once your domain points to ShieldCache, your web space often can no longer obtain a new Let's Encrypt certificate. Under Origin, switch off “Verify the origin certificate” or connect via port 80. The same applies if your server uses a self-signed certificate.
My domain points to ShieldCache, but there is no certificate yet.
After applying, certificates are issued for every verified domain as soon as it points to ShieldCache - usually in under a minute. Under Domains & DNS, check whether the domain is verified and shows “Points to ShieldCache”. You can see the status under Settings > Certificate. If a custom certificate is selected but none has been stored, applying is blocked.
The TXT record is not found.
Check the name: _shieldcache. followed by exactly the domain you want to verify - for www.muster.de that is _shieldcache.www.muster.de. Some DNS management tools append the domain themselves; in that case, only enter _shieldcache.www. Copy the verification value without spaces. Depending on the provider, DNS changes take a few minutes to a few hours; ShieldCache checks automatically at regular intervals, and immediately with “Check”.
The captcha check keeps appearing.
After a passed check, the browser stores a ShieldCache proof as a cookie for exactly this domain. It is valid for the configured validity and for the network of the IP address with which the check was solved. If the check keeps appearing, the browser is often blocking cookies, or the network changes - for example between Wi-Fi and mobile data. When the validity expires, the check appears again at the next soft block. Also check whether a rate limit is set too tightly.
Since switching, I keep getting logged out of my website.
This is almost always due to the cookies that bypass the cache: if there are entries there, ShieldCache removes all other cookies on page views. Add the login or session cookie of your application; for Joomla, the cookie with the 32-character name. See Configuring the cache.
My application only shows one IP address for all visitors.
Your server sees the ShieldCache address. The real visitor IP is in X-Forwarded-For and X-Real-IP or in a custom header that you set up under Origin > Advanced. Your application must trust the proxy for this - see Setting up the origin server.
Applying is blocked.
The notice above the tabs states the reason: a verified domain, the origin server, a stored custom certificate or a login for an access protection with login is missing. “There are no changes to apply” means that the draft already matches the active version.
How do I rule out ShieldCache as the cause?
Under Settings > General, briefly set the operating mode to Pass through. Requests then go to your server without firewall, rules and cache - this takes effect immediately. If the error still occurs, it is not caused by ShieldCache. Afterwards, switch back to Active.
Uploading large files fails.
With the firewall, a limit of 50 MB applies, and the firewall checks forms and JSON without files up to 512 KB. Larger requests receive SC-413-GROESSE. Under Origin > Advanced you can set your own limit of up to 1024 MB.
Still have questions?
Our support team will be happy to help you via a ticket. Please state the site and, if available, the error code and reference.