Cloudflare Waiting Room
and CapMonster Cloud

Requirements and preparation

• Cloudflare Plan: Waiting Room is available for Business and Enterprise.
• CDN and Proxying: Your site must be connected to Cloudflare, and the DNS record for the domain or subdomain must be proxied.
• Cookies: Visitors must support cookies, as Cloudflare uses them to track queue position.
• Decide which pages/users will be in the queue and which will bypass the Waiting Room (e.g., administrators, VIPs, specific paths).

1. Register with Cloudflare and connect your site.

2. In the Traffic → Waiting Room section, create a new queue:

3. Click Create Waiting Room.

Specify:

• Hostname / URL where the Waiting Room will be active.
• Waiting Room name (for internal records).
• Maximum number of simultaneously active users (optional, if limited load is required).

4. Customize the waiting page design:

• You can use the Cloudflare template or custom HTML/CSS.
• Add a logo, waiting time information, and instructions for users.

5. Save and activate the Waiting Room.

6. Configuring Rules

Cloudflare allows excluding specific traffic from the queue.

Typical Bypass Rules:

• Admin IP addresses: always allow.
• Paths/URL: exclude static files (.js, .css, .png) or specific pages.
• Geo-targeting: exclude specific countries.
• Query string: exclude specific GET parameters.

Example of a path bypass rule in the Dashboard

1. In Waiting Room → Manage Rules → Create new bypass rule.

2. Configure:

   • Rule Name: Bypass JS Files
   • Expression: ends_with(http.request.uri.path, ".js")
   • Action: Bypass Waiting Room
3. Save and deploy.

All bypass rules allow traffic to be excluded from the active user count so that it does not affect the queue.

Advanced Features:

• Scheduled Event: enabling Waiting Room only at specific times (e.g., for sales).
• Analytics: tracking the number of users in the queue, wait times, and throughput.
• Additional hostnames/paths: a single Waiting Room can operate on multiple subdomains or paths.

Management via API:

The Cloudflare Waiting Room API allows you to:

• Create, modify, and delete bypass rules.
• View the list of rules.
• Manage all Waiting Room settings programmatically.

Example of creating a bypass rule via API

markup

POST zones/{zone_id}/waiting_rooms/{room_id}/rules
Content-Type: application/json
Authorization: Bearer <API_TOKEN>

{
  "description": "Bypass admins",
  "expression": "ip.src in { '1.2.3.4', '5.6.7.8' }",
  "action": "bypass_waiting_room",
  "enabled": true
}

Verifying Operation

1) Open the site from different browsers/devices.

2) Check:

• Does the Waiting Room appear when the limit is exceeded?
• Is the queue position preserved when refreshing the page?
• Do bypass rules work (e.g., admin IP passes without waiting)?