Topic: RSS header image not loading

Hi,
My RSS reader has stopped displaying the header image for all of the news items.
It seems CloudFlare protection has been added to the site and it is blocking access to images from outside sources.
For example, this URL is tied to the most recent news item: https://images.pushsquare.com/ab494a7652510/large.jpg
My RSS reader app is showing the following response for the image retrieval (truncated):
HTTP/2 403
date: Fri, 26 Jun 2026 07:21:32 GMT
cf-mitigated: challenge
server: cloudflare
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9NxmvlPacpBfjbE88lIgpFBx3w%2B%2FFcJHmQIx8AV23Cn1ZspCZNkryNTke8QncMMz3Oa4wzLP%2FDuA8p4PkwZIEql1BjuNiZoWSNXR0hJhitIPBS9VuZN0XkcWzElJDMCF8R%2B4kZqsYw%3D%3D"}]}

If you open this link in incognito mode, you will see it goes through a CF challenge page.
Maybe this domain should be exempt from CF anti-bot protection?
Thanks

@Avalanchee hmm, yeah. We've had to add some bot protection because of lots of bad bots crawling our site(s). Can you tell me what RSS reader you are using?

@antdickens Hey dude, thanks for confirming the issue.
I'm using my own self-hosted RSS reader. So technically what I'm doing is reading your RSS and composing my own HTML which is rendered on my own site. Example for HTML:

[code]
<img src="https://images.pushsquare.com/ab494a7652510/large.jpg" alt="Header"><p><strong>New gameplay shows all.</strong></p><p>As you may already know, <a href="https://www.pushsquare.com/games/ps4/dragons_dogma_dark_arisen">Dragon's Dogma</a> creator and Capcom legend Hideaki Itsuno <a href="https://www.pushsquare.com/news/2024/08/legendary-devil-may-cry-dragons-dogma-director-hideaki-itsuno-leaves-capcom-after-30-years">departed the company</a> back in 2024, leading many fans to believe that <a href="https://www.pushsquare.com/games/ps5/dragons_dogma_2">Dragon's Dogma 2</a> — which he directed — would never receive the post-launch support that it deserved.</p><p>But of course, <a href="https://www.pushsquare.com/games/ps5/dragons_dogma_2_dark_arisen">Dragon's Dogma 2: Dark Arisen</a> was announced earlier this month, finally handing dedicated players the future that they'd be pining for since the RPG's release over two years ago.</p><p>Read the <a href="https://www.pushsquare.com/news/2026/06/dragons-dogma-2-dark-arisen-directed-by-the-man-who-transformed-the-original-game">full article on pushsquare.com</a></p>
[/code]

For the most part what you will see different on your end is an unknown "Referer" header (for example, avalanchee.me rather than feedly.com)

@Avalanchee I guess the question would be, why does the reader need to retrieve the image if you're just going to render it on your side? Does it grab it to do a thumbnail? If so, what User Agent does it send?

I meant retrieval as in rendering inside the browser, not as a download. Sorry if I wasn't clear.
It's basically the HTML from my previous post, hosted on a custom website under a custom domain.
I use Firefox, and with devtools I can see the <img src> rendering failing due to HTTP 403.

I’m having a similar issue since yesterday. The header images, nor the articles themselves, are being retrieved. I’m using Lire RSS reader.

@antdickens Hi, any update on this?

@Avalanchee not yet, we've been working through some other priorities. It seems to be working OK for Feedly, so just need to look into this a bit more and see. If it's hosted on a VPS and not a well known bot that might be why it's getting blocked.

@antdickens There is no bot involved, this is strictly about trying to display an image in a browser.
I don't have access to Feedly so I can't check what you're saying, but I did come up with something similar that demonstrates the problem.
This is your feed, notice no images are displayed: https://rss.app/r/feed/5r17mk1p6EgRt9Qp
This is gameindustry.biz feed, displaying correctly: https://rss.app/r/feed/f7FYgx4tRoJxsB41

@Avalanchee so, weirdly for me the link above does display images from our feed OK, not getting them blocked. Can you send a screenshot of your app to me? [email protected] and ideally include where you see the error code.

This might be because you are browsing from the internal network, and you can reach the image without the CF challenge.
Try opening it from a public WiFi, or on your phone via 5G.

Sure, gladly sending all the evidence over email.