Bot detection engines

Cloudflare uses multiple detection engines because different bot types require different detection strategies. Simple bots can be caught by pattern matching against known signatures, while sophisticated bots require machine learning and behavioral analysis.

The engines available to your domain depend on your plan.

The Heuristics engine processes all requests. Cloudflare conducts a number of heuristic checks to identify automated traffic, and requests are matched against a growing database of malicious fingerprints.

The JavaScript Detections (JSD) engine identifies headless browsers and other malicious fingerprints. This engine performs a lightweight, invisible JavaScript injection on the client side of any request while honoring our strict privacy standards ↗︎. We do not collect any personally identifiable information during the process. The JSD engine either blocks, challenges, or passes requests to other engines.

JSD is completely optional. To adjust your settings, configure Super Bot Fight Mode from Security > Bots.

Adaptive Intelligence is Cloudflare's machine learning engine, and it accounts for the majority of all bot detections. It distinguishes between human and automated traffic using large volumes of anonymized data from across Cloudflare's global network, which proxies billions of requests daily.

The engine uses supervised machine learning to determine the final bot score (1–99):

• Input variables (X): Request features, including headers, session characteristics, and browser signals, collected from traffic across the Cloudflare network.
• Output variable (Y): The predicted probability that a client is human, mapped to the final 1–99 bot score.

You can analyze the request features this model uses in your own logs, through Logpull or Logpush.

Earlier models shipped as fixed versions, months or years apart. Adaptive Intelligence retrains more frequently, so it responds to new attack patterns as they emerge instead of on a fixed schedule.

Model updates do not change your WAF rules, challenge flows, or Bot Management configuration. However, bot scores can shift as the model learns, so periodically review rules that use bot score to confirm they still work as intended.

Enterprise customers with auto-updates to the machine learning model turned on get Adaptive Intelligence. To check or change the setting:

If you do not enable auto-updates, a fixed model version continues to score your traffic. To learn what changes when you enable auto-updates, refer to Machine Learning models.

The Anomaly Detection (AD) engine is an optional detection engine that uses a form of unsupervised learning. Cloudflare records a baseline of your domain's traffic and uses the baseline to intelligently detect outlier requests. This approach is user agent-agnostic and can be turned on or off by your account team.

Cloudflare does not recommend AD for domains that use Cloudflare for SaaS or expect large amounts of API traffic. The AD engine immediately gives automated requests a score of one.

Cloudflare uses the __cf_bm cookie to smooth out the bot score and reduce false positives for actual user sessions.

The Bot Management cookie measures a single user's request pattern and applies it to the machine learning data to generate a reliable bot score for all of that user's requests.

For more details, refer to Cloudflare Cookies.

You can disable the __cf_bm cookie using the bm_cookie_enabled field via the API.