developers.cloudflare.com Open in urlscan Pro
2606:4700::6810:4dfa  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to content
Cloudflare Docs logomark
Cloudflare Docs

Bots
Navigation menu iconOpen external link

Cloudflare Docs logomark
Cloudflare Docs


Bots
Dropdown iconBots menu
 * Bot Management home

 * Overview
 * Expand: Get started Get started
    * Free
    * Pro
    * Business
    * Enterprise Bot ManagementExternal link icon Open external link

 * Expand: Concepts Concepts
    * Bots
    * Bot scores
    * Challenge Solve Rate (CSR)
    * Bot Tags
    * Bot Feedback Loop
    * Detection IDs
    * JA3 Fingerprint

 * Plans
 * Expand: Bot Analytics Bot Analytics
    * Business
    * Enterprise Bot Management

 * Expand: Reference Reference
    * Bot Management skips
    * Bot Management variables
    * JavaScript detections
    * Machine Learning models
    * Static resource protection
    * Super Bot Fight Mode for WordPress
    * Verified Bots Policy

 * FAQs





SearchK
Give Feedback

GitHub icon
Visit Bots on GitHub

Search icon (depiction of a magnifying glass)
Light theme icon (depiction of a sun)
Dark theme icon (depiction of a moon)
Set theme to dark (⇧+D)
 * ↑ Top
 * Bot groupings
 * How Cloudflare generates bot scores
   * Heuristics
   * Machine learning
   * Anomaly detection
   * JavaScript detections
   * Cloudflare service
   * Not computed
   * Notes on detection
 * Comparison to Threat Score


 1. Products
 2. Bots
 3. Concepts
 4. Bot scores


BOT SCORES

A bot score is a score from 1 to 99 that indicates how likely that request came
from a bot.

For example, a score of 1 means Cloudflare is quite certain the request was
automated, while a score of 99 means Cloudflare is quite certain the request
came from a human.

Bot scores are available to be used in Firewall fields and with Workers to
customize application behavior. For more details, refer to Bot Management
variables.

Note:
Granular bot scores are only available to Enterprise customers who have
purchased Bot Management. All other customers can only access this information
through bot groupings in Bot Analytics.


BOT GROUPINGS

Customers with a Pro plan or higher can automatically see bot traffic divided
into groups by going to Security > Bots.

CategoryRangeNot computedBot scores of 0.AutomatedBot scores of 1.Likely
automatedBot scores of 2 through 29.Likely humanBot scores of 30 through
99.Verified botNon-malicious automated traffic (used to power search engines and
other applications).

Note:
Bot scores are not computed for requests to paths that are handled by Cloudflare
and will never be blocked or forwarded to the origin.


HOW CLOUDFLARE GENERATES BOT SCORES

Note:
The following detection engines only apply to Enterprise Bot Management. For
specific details about the engines included in your plan, refer to Plans.


HEURISTICS

The Heuristics engine processes all requests. Cloudflare conducts a number of
heuristic checks to identify automated traffic, and requests are matched against
a growing database of malicious fingerprints.


The Heuristics engine immediately gives automated requests a score of 1.


MACHINE LEARNING

The Machine Learning (ML) engine accounts for the majority of all detections,
human and bot.

This approach leverages our global network, which proxies billions of requests
daily, to identify both automated and human traffic. We constantly train the ML
engine to become more accurate and adapt to new threats. Most importantly, this
engine learns from traffic across all Cloudflare domains and uses these insights
to score traffic while honoring our strict privacy standardsExternal link icon
Open external link .

The ML engine produces scores 2 through 99.


ANOMALY DETECTION

The Anomaly Detection (AD) engine is an optional detection engine that uses a
form of unsupervised learning. Cloudflare records a baseline of your domain’s
traffic and uses the baseline to intelligently detect outlier requests. This
approach is user agent-agnostic and can be turned on or off by your account
team.

Cloudflare does not recommend AD for domains that use Cloudflare for SaaS or
expect large amounts of API traffic. The AD engine immediately gives automated
requests a score of one.


JAVASCRIPT DETECTIONS

The JavaScript Detections (JSD) engine identifies headless browsers and other
malicious fingerprints. This engine performs a lightweight, invisible JavaScript
injection on the client side of any request while honoring our strict privacy
standardsExternal link icon Open external link . We do not collect any
personally identifiable information during the process. The JSD engine either
blocks, challenges, or passes requests to other engines.

JSD is enabled by default but completely optional. To adjust your settings, open
the Bot Management Configuration page from Security > Bots.


CLOUDFLARE SERVICE

Cloudflare Service is a special Bot Score source for Enterprise Zero Trust to
avoid false positives.



NOT COMPUTED

A bot score of 0 means Bot Management did not run on the request. Cloudflare
does not run Bot Management on internal service requests that Bot Management has
no interest in blocking.

Workers subrequests from one Cloudflare zone to another Cloudflare zone do
compute a bot score as it does not consider a site hosted on Cloudflare as
internal.


NOTES ON DETECTION

Cloudflare uses the __cf_bm cookie to smooth out the Bot Score and reduce false
positives for actual user sessions.

The Bot Management cookie measures a single user’s request pattern and applies
it to the machine learning data to generate a reliable Bot Score for all of that
user’s requests.

For more details, refer to Cloudflare Cookies.


COMPARISON TO THREAT SCORE

Bot Score is different from Threat Score. Bot Score identifies bots and Threat
Score measures IP reputation across our services. Most customers achieve the
best results by relying on bot scores and avoiding IP reputation entirely.

Cloudflare DashboardExternal link icon Open external link   ·  
CommunityExternal link icon Open external link   ·   Learning CenterExternal
link icon Open external link   ·   Support PortalExternal link icon Open
external link   ·   Cookie Preferences
Edit on GitHubExternal link icon Open external link   ·   Updated 3 months ago





YOUR COOKIE OPTIONS

Cloudflare uses four types of cookies as described below. You can decide which
categories of cookies you wish to accept to improve your experience on our
website. To learn more about the cookies we use on our site, please read our
Cookie Policy.
Cloudflare's Cookie Policy
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY COOKIES

Always Active

Strictly Necessary cookies are essential to our website functioning as expected.
You cannot turn off Strictly Necessary cookies because they are required to
deliver security, enable core site functionality, and help you use our site's
features and services as you would expect (including remembering your cookie
consent preferences). Cloudflare does not use these cookies to track individuals
across websites.

Cookies Details‎

FUNCTIONAL COOKIES

Functional Cookies

Functional cookies allow us to remember choices you make about the kind of
experience you want on our site and to provide you with a more personalized
experience. For example, a functional cookie is required to remember which
language you prefer.

Cookies Details‎

PERFORMANCE COOKIES

Performance Cookies

Performance cookies help us learn how you use our website to help improve its
performance and design. These cookies provide us with aggregated statistical
information such as number of page visits, page load speeds, how long a user
spends on a particular page, and the types of browsers or devices used to access
our site.

Cookies Details‎

TARGETING COOKIES

Targeting Cookies

We use Targeting cookies to deliver advertisements relevant to you and your
interests when you visit other websites that host advertisements.

Cookies Details‎
Back Button


PERFORMANCE COOKIES



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

 * 
   
   View Cookies
   
    * Name
      cookie name

Reject All Confirm My Choices