Verified that Rank Math is the single intended sitemap authority. WordPress core sitemap and sitemap.xml redirect to https://aguiarinjurylawyers.com/sitemap_index.xml, and robots.txt advertises only that canonical sitemap index.
Created rollback snapshot at /Users/samaguiar/Documents/Projects/admin/rollback/sitemap-access-20260512-181407. Tested a reversible Cloudflare WAF skip adjustment for the verified-bot allow rule, confirmed it did not resolve the synthetic Bingbot 403, and rolled the rule back to the original products: uaBlock, bic, hot, securityLevel, rateLimit, waf.
Google Search Console UI was accessible and showed the canonical sitemap index as Success, submitted May 9, 2026, last read May 9, 2026, with 607 discovered pages and 110 discovered videos. I did not force a duplicate UI submission after the browser moved to an active Microsoft Purview session.
Bing Webmaster Tools API submission is still blocked because BING_WEBMASTER_API_KEY is missing. Google Search Console API mutation is still blocked because the local GSC service-account keys return invalid_grant: account not found, and the Google Ads OAuth fallback returns deleted_client.
Cloudflare security-event or WAF analytics access is needed to identify the exact rule generating the synthetic Bingbot edge block before another live WAF change. The current evidence proves the block is at Cloudflare, not origin.
Repair Bing WMT API key, repair GSC mutation credentials, and add Cloudflare Security Events access. Also update local WordPress/Cloudflare instructions because live DNS now points through standalone Cloudflare nameservers, contrary to older local guidance.
The live sitemap authority work is verified, Google Search Console is verified successful, and the remaining items require credential or dashboard-access repair. No lasting Cloudflare WAF change remains active from this session.