I agree 100%. While I wouldn't go so far as turning off all of the DDoS settings and managed rulesets (why pay for it then?), you can certainly set the "secure/strict" level to medium or low and still retain benefits.
I'm wondering if it's related to Cloudflare's new/updated Bots features, especially the "Super Bot Fight Mode" feature -- which I believe gets a default setting that is super strict.
As others have mentioned, saner defaults might help, but I guess they want to error on the side of "more secure" vs a less secure default.
By end users, you mean people browsing the internet? I think you're conflating Cloudflare DNS with site owners leveraging Cloudflare CDN and WAF/Security.
especially since the author had to change the privacy.resistFingerprinting in Firefox to true to get it to work (meaning that it was able to bypass Cloudflare's loop by being MORE secure). But that appeared to break other non-Cloudflare sites.
I think the fingerprinting is a red herring. Yes, Chrome is less secure. But Chrome worked.
It's quite possible someone at the author's workplace updated their Cloudflare WAF settings and made things more strict, causing more checks. I'd even offer that a Firefox extension might be contributing.
But the argument that Chrome worked because it offered Cloudflare personal information is pretty out there ;)
To my knowledge, only Strapi CMS is comparatively free/open source headless CMS, in that it can be self-hosted and is not strictly SaaS. There's also a community of plugins, which also seem to be free/open source.
Curious to hear of any others, as like you said, most are "freemium" SaaS products.
I'm wondering if it's related to Cloudflare's new/updated Bots features, especially the "Super Bot Fight Mode" feature -- which I believe gets a default setting that is super strict.
As others have mentioned, saner defaults might help, but I guess they want to error on the side of "more secure" vs a less secure default.