Using Cloudflare on your website could be blocking RSS users

I dislike advice of whitelisting specific readers by user-agent. Not only is this endless manual work that will only solve the problem for a subset of users but it also is easy to bypass by malicious actors. My recommendation would be to create a page rule that disables bot blocking for your feeds. This will fix the problem for all readers with no ongoing maintenance.

If you are worried about DoS attacks that may hammer on your feeds then you can use the same configuration rule to ignore the query string for cache keys (if your feed doesn't use query strings) and overriding the caching settings if your server doesn't set the proper headers. This way Cloudflare will cache your feed and you can serve any number of visitors without putting load onto your origin.

As for Cloudflare fixing the defaults, it seems unlikely to happen. It has been broken for years, Cloudflare's own blog is affected. They have been "actively working" on fixing it for at least 2 years according to their VP of product: https://news.ycombinator.com/item?id=33675847

I don't know if cloudflare offers it, but whitelisting the URL of the RSS feed would be much more effective than filtering user agents.

Yes it supports it, and I think that's what the parent comment was all about

Specifically, whitelisting the URL for the bot protection, but not the cache, so that you are still somewhat protected against adversarial use.

An adversary can easily send no-cache headers to bust the cache.

The CDN can choose whether to honor those. That hasn’t been an effective adversarial technique since the turn of the century.