Plans — Business and Enterprise
To learn more about features and functionality, select a plan. Business features
| Plan name | Super Bot Fight Mode |
| Availability | All Business customers and Enterprise customers without Bot Management* |
| Enablement | Toggle in Firewall > Bots |
| Type of bots detected | Simple bots, headless browsers, and many sophisticated bots |
| Actions | Customer chooses whether to allow, block, or challenge |
| Analytics | Dedicated Bot Analytics tool, available in the Firewall |
| Additional control | Applied to all traffic across a domain |
*When users purchase Bot Management for Enterprise, Cloudflare automatically replaces and disables other bot products to prevent overlap.
Bot detection engines
Heuristics
The Heuristics engine processes all requests. Cloudflare conducts a number of heuristic checks to identify automated traffic, and requests are matched against a growing database of malicious fingerprints. Account takeover detections
Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using custom rules, rate limiting rules, and Workers.
| Detection ID | Description |
|---|---|
201326592 | Observes all login failures to the zone. |
201326593 | Observes all login traffic to the zone. |
Machine learning
The Machine Learning (ML) engine accounts for the majority of all detections, human and bot.
This approach leverages our global network, which proxies billions of requests daily, to identify both automated and human traffic. We constantly train the ML engine to become more accurate and adapt to new threats. Most importantly, this engine learns from traffic across all Cloudflare domains and uses these insights to score traffic while honoring our strict privacy standards.
The ML engine identifies likely automated traffic.
JavaScript detections
The JavaScript Detections (JSD) engine identifies headless browsers and other malicious fingerprints. This engine performs a lightweight, invisible JavaScript injection on the client side of any request while honoring our strict privacy standards. We do not collect any personally identifiable information during the process. The JSD engine either blocks, challenges, or passes requests to other engines.JSD is completely optional. To adjust your settings, configure Super Bot Fight Mode from Security > Bots.
Notes on detection
Cloudflare uses the __cf_bm cookie to smooth out the bot score and reduce false positives for actual user sessions.
The Bot Management cookie measures a single user’s request pattern and applies it to the machine learning data to generate a reliable bot score for all of that user’s requests.
For more details, refer to Cloudflare Cookies.
You can disable the__cf_bm cookie via the API. However, it cannot be disabled if you have Behavioral Analysis enabled. Considerations
Bot Fight Mode and Super Bot Fight Mode use the same underlying technology that powers our Bot Management product. Specifically, these products:
- Protect entire domains without endpoint restrictions
- Cannot be customized, adjusted, or reconfigured via WAF custom rules
Although these products are designed to fight malicious actors on the Internet, they may challenge API or mobile app traffic. For more granular control, upgrade to Bot Management for Enterprise.