Google Search Console says my Shopify store is getting blocked, and I think it's Cloudflare
If Search Console shows crawl errors on a store that also runs Cloudflare in front of its domain, the proxy layer, not Shopify, is usually why Googlebot is getting turned away.
What's going on
A merchant running a large Shopify catalog puts Cloudflare in front of their custom domain, often for extra DDoS protection, firewall rules, or rate limiting on top of what Shopify already provides, and then starts seeing Google Search Console report crawl errors: pages timing out, returning a 403, or simply not getting indexed. The store loads fine in a browser and checkout works normally, but Googlebot's crawl requests are quietly getting challenged, throttled, or dropped somewhere between Google and the storefront.
This tends to show up specifically on larger stores, because a bigger catalog means Google crawls more URLs, faster, from a small number of IP addresses, a pattern that can look like scraping or an attack to an automated bot-detection system. Smaller stores with light traffic rarely trip these rules, which is part of why the problem is easy to miss until the catalog grows.
The confusing part is that nothing about the theme, robots.txt, or Shopify's own settings has changed. The blocking is happening in a layer the merchant added themselves, which makes it easy to spend hours checking Shopify-side SEO settings before realizing the real cause sits outside Shopify entirely.
Why it happens
Shopify's storefronts already sit behind Shopify's own infrastructure, which handles TLS, caching, and a layer of bot protection. When a merchant also proxies their domain through Cloudflare, using the orange-cloud proxied setting rather than grey-cloud DNS-only, every request, including Googlebot's, now passes through a second, independent security layer before it reaches Shopify. Layering two separate CDNs or security systems means each one can independently decide a request looks suspicious, even when neither would flag it alone.
Cloudflare's bot-management and rate-limiting features are tuned to catch scraping and volumetric attacks, and a crawl burst across thousands of product and collection URLs on a large store can resemble that pattern, especially if per-IP or per-minute thresholds are set conservatively. Unless the merchant has explicitly allowed Cloudflare's verified-bots category or Google's published crawler IP ranges, these protections can end up throttling or challenging Googlebot along with the traffic they're meant to stop.
Because Shopify and Cloudflare don't share bot-reputation signals, a request that Shopify would recognize as legitimate crawl traffic can still get flagged the moment it passes through Cloudflare first.
4 ways to fix it
Switch the domain to DNS-only in Cloudflare
In Cloudflare's DNS tab, find the record pointing at Shopify and click the orange cloud icon to turn it grey, which sets it to DNS-only instead of proxied. Shopify's own infrastructure already handles TLS, caching, and a layer of bot protection for your storefront, so running a second proxy in front of it is rarely necessary and is often what introduces conflicts like this. After switching, check Shopify Admin under Settings > Domains to confirm your DNS records still match what Shopify expects, then use Search Console's URL Inspection tool to re-test a few affected product and collection URLs.
Confirm the cause before changing anything
Pull the exact failure signature first: in Search Console, check the Crawl Stats report for a spike in 4xx or 5xx responses or timeouts, and run URL Inspection on a few affected pages to see the exact status Googlebot received. Then look at the same timestamps in Cloudflare's security or firewall event log to see which rule, whether a WAF rule, rate limit, or bot-challenge, fired against those requests. This tells you whether Cloudflare is really the cause and which setting to change, rather than guessing.
If you need Cloudflare proxied, allow verified crawlers
Some merchants keep Cloudflare in proxy mode for reasons unrelated to Shopify, such as shared email routing or a broader firewall policy. If that's you, check Cloudflare's bot-management settings (Bot Fight Mode or a Super Bot Fight Mode plan) and make sure the verified bots category isn't set to challenge or block, since Googlebot is generally recognized under that category. Add an explicit allow rule for verified bots if your current configuration doesn't already exempt them.
Loosen rate limiting for crawler traffic
A large catalog gets crawled in bursts, and Googlebot can request many URLs in a short window from a small number of IPs, which can look like scraping to an automated system. Check any rate limiting rules in Cloudflare for low per-IP thresholds and add an exception for verified crawler traffic, or reference Google's published Googlebot IP ranges, so a normal crawl spike doesn't get treated as an attack.
Bottom line
This is a DNS and network-configuration issue rather than anything inside Shopify itself, so it's best resolved by whoever manages the Cloudflare account rather than by installing an app; no Shopify app can reach into a third-party proxy's bot rules. Start by confirming the cause and, if possible, removing the second proxy layer, since that is free, reversible, and closest to how Shopify expects a custom domain to be connected. Only keep Cloudflare proxied with bot and rate-limit exceptions if you have a specific reason to run it that way.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.