Bot Management: Live Impact Simulation
Toggle Bot Management ON/OFF to see the real-time difference in automated traffic reaching your origin. This simulates actual request flow through Cloudflare's network.
Incoming Traffic
Bot Management
Bot Management Disabled
All traffic passes through unfiltered
Humans & verified bots pass through
Suspicious traffic gets JS challenge
Definite bots blocked at edge
AI crawlers throttled per rule
Origin Server
Credential stuffing attacks consuming origin resources
2,100 bad bots blocked at Cloudflare edge
AI Crawl Control
Fine-grained control over AI training crawlers. Available on Enterprise plans — control which AI bots can access your content for training purposes.
# Block specific AI crawlers from training access
(http.user_agent contains "ClaudeBot" or
http.user_agent contains "Bytespider") and
cf.bot_management.ai_crawler eq "true"AI Crawl Control provides granular control over which AI training crawlers can access your content.
- Per-bot action selection
- Rate limiting by bot type
- Automatic verification
Actions Available
Why This Matters
AI crawlers can consume significant bandwidth without providing SEO value. Enterprise allows selective blocking — stop ByteDance while allowing OpenAI, or rate limit all training crawlers to preserve origin resources.
Bot Score Rules
Enterprise provides granular 1-100 bot scoring with custom rule thresholds. Catch automated traffic that doesn't present as known bots — scrapers, credential stuffers, inventory bots.
Bot Score Distribution (24h)
cf.bot_management.score lt 30 and
http.request.uri.path contains "/login"Enterprise Advantage
PayGo plans get binary bot detection. Enterprise gives you the 1-100 score with full expression builder access.
cf.bot_management.score lt 10cf.bot_management.score lt 30 and
http.request.uri.path contains "checkout"cf.bot_management.score lt 50 and
http.request.uri.path contains "/api/"Enterprise vs PayGo Bot Management
Side-by-side comparison of bot management capabilities across Cloudflare plans.
PayGo Limitation
Super Bot Fight Mode gives you three modes: Off, Automatic, or Block AI. No granular control. You can't selectively allow Googlebot while blocking scrapers, or set different thresholds for login pages vs product pages.
Enterprise Value
Full expression builder with cf.bot_management.score, cf.bot_management.verified_bot, and cf.bot_management.ja3_hash. Build rules like "Block if score < 20 and path contains checkout" or "Rate limit AI crawlers to 1 req/min".
Custom Bot Management Rules
Enterprise provides full access to Bot Management fields in the Ruleset Engine. Build sophisticated detection logic beyond basic bot vs human.
cf.bot_management.score
Number (1-100)
cf.bot_management.verified_bot
Boolean
cf.bot_management.ja3_hash
String (fingerprint)
cf.bot_management.ai_crawler
Boolean
cf.bot_management.detection_ids
Array of IDs
cf.bot_management.static_resource
Boolean
Common Patterns
cf.bot_management.score lt 30 and http.request.uri.path contains "/api/v"
not cf.bot_management.verified_bot and cf.bot_management.score lt 50
cf.bot_management.verified_bot eq true and http.user_agent contains "Googlebot"
# Protect checkout from sophisticated bots
# Allows good bots, challenges borderline,
# blocks obvious automation
(
http.request.uri.path contains "/checkout"
or
http.request.uri.path contains "/payment"
) and (
(
cf.bot_management.score lt 30
and not cf.bot_management.verified_bot
)
or (
cf.bot_management.ja3_hash in $known_bad_ja3
)
)JA3 Fingerprinting
Enterprise exposes JA3 TLS fingerprints — a way to identify clients based on their TLS handshake characteristics. Useful for catching bot operators who rotate IPs but use the same tooling.
769,47-53-5-10-49161-49162-49171-49172-50-56-19-4,0-10-11,23-24-25,0
Bot Management Analytics
Enterprise provides detailed visibility into bot traffic patterns, top detected bots, and rule effectiveness.
Top Detected Bots
Rule Match Rate
Traffic Actions (24h)
Query bot management analytics programmatically via the GraphQL API.
query BotManagementAnalytics {
viewer {
zones(filter: { zoneTag: "your-zone-id" }) {
botManagementAdaptiveGroups(
limit: 100
filter: { date_geq: "2024-01-01" }
) {
dimensions {
botScore
botScoreSrc
verifiedBot
}
sum {
requests
pageViews
}
}
}
}
}