If calendar and pricing changes from your PMS stopped reaching your website after a firewall or Cloudflare security change, the security change is turning away HomeRunner’s update notifications.
Why this happens. HomeRunner keeps your website current by sending update notifications to your site’s own address under /wp-json/homelocal/. Security features that challenge or block automated requests turn those notifications away. Examples include Cloudflare Bot Fight Mode, a managed challenge, or a WAF rule. When that happens, your website’s calendar only refreshes when a manual sync is run from WordPress admin.
How to fix it. Ask whoever manages your site’s Cloudflare or firewall to add an exception that skips bot protection and managed challenges for requests whose path starts with /wp-json/homelocal/. If plain Bot Fight Mode on Cloudflare’s Free plan is the cause, it cannot be exempted by a rule and needs to be switched off entirely.
While you wait. Turn on Auto Sync under HomeRunner, Settings, Sync tab. This makes your site re-pull everything from HomeRunner on a schedule, so the calendar stays reasonably current until the exception is in place.
Once the exception is live, changes made in your PMS appear on your site shortly after, as before.