Bot Management for Enterprise is a paid add-on that provides sophisticated bot protection for your domain. Customers can identify automated traffic, take appropriate action, and view detailed analytics within the dashboard.
This Enterprise product provides the most flexibility to customers by:
- Generating a bot score of 1-99 for every request. Scores below 30 are commonly associated with bot traffic. This lets you write targeted rules instead of applying blanket actions to all detected bots.
- Allowing customers to take action on this score with WAF custom rules or
Workers. For example, you can challenge low-scoring requests on your login page while allowing them on your public blog. - Allowing customers to view this score in Bot Analytics or Logs, so you can analyze bot traffic patterns and tune your rules over time.
Bot Management is automatically enabled and always active for Enterprise zones entitled with the add-on.
To review the Bot Management configuration:
-
In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗ -
Filter by Bot traffic.
-
Go to Bot management and select the edit icon to review the following configurations:
- JavaScript Detections: For more details, refer to JavaScript detections.
- JavaScript Detections for API traffic
- Auto-update machine learning model: For more details, refer to Enable the latest Machine Learning version.
Bot Management does not block or challenge traffic on its own. To act on bot traffic, create WAF custom rules based on bot score, as described in Deploy custom rule templates.
Cloudflare recommends that you deploy the following basic settings and customize them according to the traffic in your zone.
Enterprise customers with auto-updates to the machine learning model turned on get Adaptive Intelligence. To check or change the setting:
-
In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗ -
Filter by Bot traffic.
-
Go to Bot Management.
-
Under Configurations, select the edit icon for Auto-update machine learning and turn it on.
Refer to Block AI bots.
Bot Management assigns a bot score to every request, but you must create custom rules to block or challenge automated traffic. Cloudflare provides rule templates ↗︎ to get started. You can also reach these templates from the Bot management setting in Security Settings by selecting View bot traffic templates.
Customize the templates as needed, for example to add path-specific protection, adjust score thresholds, or combine bot score with other fields.
These templates use wirefilter expression syntax. In these expressions, eq means equals, le means less than or equal to, ge means greater than or equal to, and not excludes matching traffic.
-
Definite Bots template ↗︎: Targets malicious bot traffic while ignoring verified bots and routes delivering static content.
(cf.bot_management.score eq 1 and not cf.bot_management.verified_bot and not cf.bot_management.static_resource) -
Likely Bots template ↗︎: Targets traffic likely to be malicious bots while ignoring verified bots and routes with static content. It may contain a small amount of non-bot traffic.
(cf.bot_management.score ge 2 and cf.bot_management.score le 29 and not cf.bot_management.verified_bot and not cf.bot_management.static_resource) -
(Optional) JavaScript detections template ↗︎: You must first enable JavaScript Detections from Security Settings, then set up a managed challenge. Make sure to add a method and URI path. JavaScript detections improves security for URLs that should only expect JavaScript-enabled clients.
(not cf.bot_management.js_detection.passed and http.request.method eq "" and http.request.uri.path in {""})