I85PREP
⌘ K
Cloudflare Application Security study materials
Cloudflare Application Security study resources

Cloudflare Application Security: Bot Management

Cloudflare Application Security · Work through your exam, one topic at a time.

All guide sections

Bot Management

Bot Management tests your ability to separate good automation from bad, and to enforce without collateral damage to search crawlers, monitoring, and payment providers.

The score

Every request receives a bot score from 1 to 99: 1 is definitely automated, 99 is definitely human. Cloudflare bands it roughly as 1–29 likely automated and 30–99 likely human, but the score is continuous and the threshold is your choice. It is derived from several engines: heuristics (headers, TLS fingerprints, ASN reputation), machine learning on request patterns, anomaly detection against learned baselines, and JS detections, which run a small script in the browser and report back - strong against headless browsers, useless against a plain HTTP client that never executes JavaScript.

Verified bots are a maintained directory of known good crawlers (search engines, monitoring, ad verification). cf.bot_management.verified_bot is true when the request's claimed identity matches the operator's published IP ranges; impersonation fails the check.

Product tiers

  • Bot Fight Mode – free, toggled on; challenges obvious automated traffic. It cannot be skipped or scoped with WAF custom rules.
  • Super Bot Fight Mode – Pro and Business; set actions for definitely automated, likely automated, and verified bots, and protect static resources.
  • Bot Management – Enterprise; full score, TLS fingerprints, per-rule control, and use of the score inside WAF custom rules.
  • Turnstile – a standalone CAPTCHA replacement you embed on your own forms.

Worked example

A scraper hits /api/products with a spoofed Googlebot user agent. A rule that allows http.user_agent contains "Googlebot" hands the attacker the keys. Correct logic: allow only when the claim is verified, then fall back to a challenge - allow where cf.bot_management.verified_bot is true and the user agent contains Googlebot; otherwise, where cf.bot_management.score lt 30 on /api/products, apply Managed Challenge. Blocking verified bots outright eventually costs you indexing and uptime monitoring.

Traps

  • Trusting the User-Agent header as an identity signal.
  • Blocking all verified bots to 'stop bots', then watching organic traffic collapse.
  • Expecting JS detections to score API and mobile clients that never run JavaScript.
  • Assuming Bot Fight Mode can be bypassed for a known integration via a WAF Skip rule - on the free tier it cannot.
  • Picking a score threshold casually; the 29/30 boundary is a deliberate risk decision.