Cloudflare fixes BYOIP subrequest context: which 403s does it address?

First, establish whether the request follows the BYOIP path

Cloudflare announced on October 13, 2026 that Worker subrequests to Cloudflare-proxied hostnames using Bring Your Own IP (BYOIP) are now identified as Cloudflare-to-Cloudflare traffic. A subrequest is a request a Worker sends to another address while handling an incoming request.

BYOIP lets an organization use its own IP prefixes with services advertised by Cloudflare, instead of replacing them with Cloudflare-owned addresses. Check whether the destination hostname actually uses BYOIP. Having a proxy IP, configuring a Worker or seeing a Cloudflare 403 does not establish that this change applies.

Previously, some of these subrequests could lose Worker context and original client signals, making them appear to be external Internet traffic. Security rules could behave unexpectedly, Bot Management could evaluate an internal Cloudflare connection, and affected requests could return false 403s. The announcement describes a problem on some paths, rather than resolving every 403.

Preserve Worker provenance and the real client’s signals

The fix preserves the CF-Worker header and cf.worker.upstream_zone field for consistent handling of same-zone and cross-zone subrequests. A zone is a domain configuration area in Cloudflare. A call between two zones should not lose Worker context because its destination uses BYOIP.

Bot Management fields at the destination zone now represent the original end-user connection. The rule-expression fields cf.bot_management.score, cf.bot_management.verified_bot, cf.bot_management.ja3_hash and cf.bot_management.ja4 correspond to bot score, verified-bot status and JA3/JA4 client TLS fingerprints. They no longer describe the internal Cloudflare connection on the affected path.

For an unexecuted example, suppose a legitimate user reaches a Worker, which fetches a BYOIP hostname in another zone. The destination can recognize the Worker while assessing the original user’s Bot signals. Worker provenance and end-user connection signals describe different parts of the same chain. Correcting the inputs does not guarantee a high score or an allowed request.

An automatic fix does not make BYOIP free to activate

Customers already on the affected path need no configuration change for this improvement. The BYOIP overview still says Enterprise-only. Before onboarding, your account team must confirm that the contract includes BYOIP and the required service configuration. The announcement neither introduces a surcharge nor promises free service; check the actual contract for fees.

Eligibility involves more than having an IP address. Cloudflare requires prefix registration, matching IRR route records, accurate RPKI route authorizations and successful ownership validation. Its current getting-started flow uses Cloudflare’s AS13335; using your own ASN or onboarding Magic Transit follows a separate route. Do not advertise a production prefix or change DNS merely to test this fix.

The Bot-field documentation qualifies preservation with Bot Management being in effect, and the plan page lists Bot Management for Enterprise. BYOIP eligibility alone does not establish every Bot feature at the destination zone. The announcement gives no country-by-country availability list, precise rollout time or individual account verification. No account requests were executed for this article.

For remaining 403s, compare the existing request chain

First, have the maintainer inspect existing deployment records: which Worker sends the request, its actual destination hostname and zone, and whether that hostname uses Cloudflare-proxied BYOIP addresses. Retain the time, destination path and known request identifiers to establish that the failure follows the announced path.

Next, compare readable Worker context, Bot signals and matched rules in existing request and security logs. Record actual values and actions. If a field cannot be read, state the evidence gap; an empty view is not a zero score or proof that the fix failed. Fields appear in rule expressions or Workers objects, so include where each value was read.

Then compare the last successful request with the current failure: destination, identity authorization, rule actions and origin result. Preserved context does not prevent Access policies, other WAF rules or the origin from denying a request. If evidence specifically points to a managed-WAF false positive, continue with the existing WAF guide. Do not disable the entire ruleset or switch egress addresses to gamble on a different result.

Give the maintainer a finding they can continue from

State whether the BYOIP destination is confirmed, which Worker and Bot fields are readable, the actual source of the 403, matched rules and remaining evidence gaps. Remove credentials and sensitive business content from logs. If existing evidence is insufficient and reproduction is necessary, an authorized maintainer can arrange read-only calls in an approved test environment. This article has not tested a reader’s account.

Cloudflare has corrected context on this path; the change is not account authorization, an unconditional security exemption or an egress service. If the destination does not use BYOIP, or evidence identifies another source of the 403, follow that cause. Two failures sharing a status code need not share a cause.