Plans — FreeTo learn more about features and functionality, select a plan.
|Plan name||Bot Fight Mode|
|Availability||All Free customers|
|Enablement||Toggle in Firewall > Bots|
|Type of bots detected||Simple bots (from cloud ASNs) and headless browsers|
|Actions||Cloudflare issues a computationally expensive challenge|
|Additional control||Applied to all traffic across a domain|
Bot detection engines
HeuristicsThe Heuristics engine processes all requests. Cloudflare conducts a number of heuristic checks to identify automated traffic, and requests are matched against a growing database of malicious fingerprints.
JSD is automatically enabled with Bot Fight Mode.
Notes on detection
Cloudflare uses the
__cf_bm cookie to smooth out the Bot Score and reduce false positives for actual user sessions.
The Bot Management cookie measures a single user’s request pattern and applies it to the machine learning data to generate a reliable Bot Score for all of that user’s requests.
- Protect entire domains without endpoint restrictions
- Cannot be customized, adjusted, or reconfigured via WAF custom rules