Page Health: Scanner fails with 403 for environments behind IP allowlists / WAF

Problem

Content authors and editors at organizations with IP allowlists or WAF-protected environments cannot use the Page Health feature (Accessibility Scanner + GEO Scanner) at all. When they attempt to run a scan, every page returns a 403 error. This is because the Page Health microservice (a11y.api.dotcms.site) needs to fetch the customer's pages from the public internet, but their environments block external traffic by design. The customer cannot remove their security controls, and dotCMS cannot provide static IPs to whitelist because the service runs behind Bunny CDN with a dynamic IP pool. The feature is completely unusable for these customers despite being activated on their instance.

Goal

Users behind IP allowlists, WAF, or VPN-protected environments will be able to run Page Health scans successfully, so that security-conscious organizations (such as financial institutions) can take full advantage of the Accessibility and GEO compliance scanning features without compromising their network security posture.

Target Personas

• Developer teams
• Content teams
• DevOps teams
• System administrators (dotCMS)

Demo Expectations

In the demo, we will show a dotCMS instance whose pages are not publicly accessible from the internet (behind an IP allowlist), and demonstrate a successful Page Health scan completing without a 403 error — returning real accessibility and GEO compliance results for a scanned page.

Acceptance Criteria

Page Health scanner successfully scans pages on environments behind an IP allowlist or WAF without returning a 403

User Stories

No response

Links

https://helpdesk.dotcms.com/a/tickets/37374
https://github.com/dotCMS/core/pull/36163
https://github.com/dotCMS/core/pull/36184
https://github.com/dotCMS/microservice-accessability

Start by reviewing pull requests 36163 and 36184 and the linked microservice-accessability project to understand the existing Page Health scanner flow. Reproduce a scan against an IP-allowlisted or WAF-protected environment, then verify that Accessibility and GEO results complete without a 403.