# Native comments section no longer mounts on 6.41.1

**URL:** <https://forum.ghost.org/t/native-comments-section-no-longer-mounts-on-6-41-1/62988>\
**Category:** Developer help\
**Created:** [May 29, 2026, 5:17pm UTC](https://forum.ghost.org/t/native-comments-section-no-longer-mounts-on-6-41-1/62988 "2026-05-29T17:17:05Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![bastien](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/bastien/32/40675_2.png) [@bastien](https://forum.ghost.org/u/bastien)\
**Post date:** [May 30, 2026, 3:45pm UTC](https://forum.ghost.org/t/native-comments-section-no-longer-mounts-on-6-41-1/62988/9 "2026-05-30T15:45:05Z")

</div>

Update — solved on my side, and it had nothing to do with Ghost or `comments-ui` after all. Sharing in case it helps someone else.

The root cause was a Cloudflare anti-bot setup I had put in place months ago following the technique discussed in [this thread](https://forum.ghost.org/t/observations-about-spam-signups/61475/30): combining `hostSettings.siteId` on the Ghost side with a Cloudflare Transform Rule that injects an `x-site-id` request header, plus a WAF Custom Rule that blocks any request to `/members/api/` missing that header. Together they prevent direct hits to the origin from bypassing Cloudflare.

When I tried to disable the protection to test `comments-ui`, I only disabled the Transform Rule (which adds the header) and removed `hostSettings.siteId` from Ghost — but I forgot the second piece, the WAF Custom Rule that _blocks_ `/members/api/` requests without the header. So every `comments-ui` fetch to `/members/api/comments/counts/` was returning a Cloudflare 403 HTML page, which `comments-ui` then tried to parse as JSON and failed with `TypeError: [object Promise] is not iterable`.

Disabling that WAF rule fixed it immediately. Comments now load normally on Ghost 6.42.0, `comments-ui@~1.4`, official Source theme.

So: sorry for the noise, and apologies to @Kevin and @muratcorlu — this wasn’t a Ghost bug. But it might still be worth flagging that `comments-ui` swallowing a non-JSON response with such a cryptic error message makes this kind of misconfiguration very hard to diagnose. A clearer error (e.g. “got HTML instead of JSON from /members/api/…”) would have saved a lot of time.

Thanks all for your patience.

---

_[View the full topic](https://forum.ghost.org/t/native-comments-section-no-longer-mounts-on-6-41-1/62988)._