Business

Super Bot Fight Mode is included in your Business or Enterprise subscription. When enabled, the product:

• Identifies traffic matching patterns of known bots and likely bots
• Can challenge or block bots
• Offers protection for static resources
• Provides robust analytics to help you understand bot traffic

Note

If you have an Enterprise subscription without Bot Management, your application will also have Super Bot Fight Mode for Business.

Enable Super Bot Fight Mode

To start using Super Bot Fight Mode:

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.

2. Go to Security > Bots.

3. Select Configure Super Bot Fight Mode.

4. Choose how your domain should respond to various types of traffic:

   • For more details on verified bots, refer to Verified Bots.
   • For more details on supported file types, refer to Static resource protection.
   • For more details on invisible code injection, refer to JavaScript detections.

Warning

If your organization also uses Cloudflare Tunnel, keep Definitely Automated set to Allow. Otherwise, tunnels might fail with a websocket: bad handshake error.

In parts of your site where you want bot traffic, you can use the Skip action in WAF custom rules to specify where Super Bot Fight Mode should not run.

You can use the Rules language and its operators and fields in custom rules to configure a scoped rule for approved automated traffic in Super Bot Fight Mode.

Note

If you are upgrading from Bot Fight Mode to Super Bot Fight Mode, you must disable Bot Fight Mode in your Bot settings.

To turn off Bot Fight Mode, go to Security > Bots and select Configure Super Bot Fight Mode.

Disable Super Bot Fight Mode

If you find that Super Bot Fight Mode is causing problems with your application traffic, you may want to disable it.

To disable Super Bot Fight Mode:

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Security > Bots.
3. Click Configure Super Bot Fight Mode.
4. For all bot groupings (Definitely automated, Verified bots, etc.), set the value to Allow.
5. For all other options (Static resource protection, JavaScript Detections), make sure the toggles are Off.

In parts of your site where you want bot traffic, you can use the Skip action in WAF custom rules to specify where Super Bot Fight Mode should not run.

You can use the Rules language and its operators and fields in custom rules to configure a scoped rule for approved automated traffic in Super Bot Fight Mode.

Block AI bots

To block AI bots:

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Security > Bots.
3. Select Configure Super Bot Fight Mode.
4. Enable Block AI bots.

Note

You can view blocked AI bot traffic via Security Analytics.

Enable AI Labyrinth

The AI Labyrinth adds invisible links on your webpage with specific Nofollow tags to block AI crawlers that do not adhere to the recommended guidelines and crawl without permission. AI crawlers that scrape your website content without permission will be stuck in a maze of never-ending links, and their details are recorded and used by all Cloudflare customers who choose to block AI bots.

These links do not impact your search engine optimization (SEO) or your website's appearance, and are only seen by bots. AI bots that respect no-crawl instructions will safely ignore this honeypot.

To enable AI Labyrinth:

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Security > Bots.
3. Select Configure Super Bot Fight Mode.
4. Enable AI Labyrinth.

Analytics

For more on analytics, see Bot Analytics.

Ruleset Engine

Super Bot Fight Mode runs during the http_request_sbfm phase of the Ruleset Engine.

Change notice for Super Bot Fight Mode rulesets

Updating Super Bot Fight Mode rules via the Rulesets API is no longer supported and may cause unexpected behavior if you do so.