What it is
Cloudflare scores every request from 1 (definitely a bot) to 99 (definitely human) using machine learning trained on trillions of requests per day. Bot Management lets you challenge or block automated trafficbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious. — credential stuffingcredential stuffingUsing stolen username/password lists to try to break into many accounts at once., scraping, inventory hoarding — while letting real users and verified good bots through untouched.
Why it helps the client
- Stops credential stuffing, content scraping, and checkout/inventory bots.
- Protects conversion and data without adding friction for real users.
- Precise control — act on the 1–99 score and auto-allow verified bots like search engines.
- Network-wide ML — new attack patterns learned across all of Cloudflare benefit everyone.
Why they'd want it
- Reduce fraud, API abuse, and infrastructure cost from junk traffic.
- Protect logins and inventory without annoying customers with CAPTCHAs.
- Board-ready bot analytics that show the threat is handled.
🔬 How it actually works
- Every request gets a bot scorebot scoreCloudflare's 1–99 rating of how likely a request came from a bot (1) versus a real human (99). from 1 (bot) to 99 (human), produced by machine learning trained on trillions of requests per day plus heuristics, behavioral analysis, and fingerprinting. Verified good botsbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious. (Googlebot and friends) are identified via a maintained allowlist so you don't block useful crawlers.
- You act on the score with rules — challenge or block below a threshold, or only on sensitive paths (login, checkout, gift-card, APIAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server.). JA3/JA4 TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser. fingerprints and 'likely automated' signals catch tools that spoof a browser user-agent.
- Enterprise BotbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious. Management exposes the full 1–99 score and analytics; lower tiers get Bot Fight Mode / Super Bot Fight Mode, which are simpler on/off challenges.
- Because the model learns across all of Cloudflare, an attack pattern seen on one customer improves detection for everyone — and Managed Challenge stops botsbotAutomated software making requests instead of a human. Some bots are good (search engines); many are malicious. without CAPTCHAs for real users.
📖 Key terms on this page hover any underlined term anywhere on the site for its definition
- bot
- Automated software making requests instead of a human. Some bots are good (search engines); many are malicious.
- credential stuffing
- Using stolen username/password lists to try to break into many accounts at once.
- API
- Application Programming Interface — how software talks to other software, e.g. a mobile app calling a server.
- bot score
- Cloudflare's 1–99 rating of how likely a request came from a bot (1) versus a real human (99).
- TLS
- Transport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser.
- WAF
- Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
Live demo walkthrough
5 stepsScreens below are annotated recreations of the Cloudflare dashboard. The numbered orange pin marks exactly where to click.
Select the website
Websites
Select a website to manage its configuration.
👉 Do this
Open the site you want to protect from automation.
💬 Say this
“Let's look at how Cloudflare separates real users from bots on this site.”
Open Security → Bots
Security
Bots
👉 Do this
Expand Security and click Bots.
💬 Say this
“This is the Bots surface. Every request through Cloudflare gets a bot score, and this is where we decide what to do with it.”
Turn on Bot Fight Mode
Security
Bots
👉 Do this
Toggle Bot Fight Mode on (Super Bot Fight Mode / scoring on higher plans).
💬 Say this
“On lower tiers, Bot Fight Mode challenges obviously-automated traffic with one switch. On Enterprise Bot Management, every request gets a precise 1–99 score instead.”
Read analytics & act on the score
Security
Bots
👉 Do this
Point to the score distribution, then open Manage rules to act on the score.
💬 Say this
“This distribution shows how much traffic is automated. From here we write a surgical rule — 'if bot score is under 30, block' — which stops the bad bots while real users sail through with no CAPTCHA at all.”
Prove it in Security Analytics
Security
Analytics
👉 Do this
Open Security → Analytics and point to the bot-driven challenge/block events.
💬 Say this
“In Security Analytics you can see the automated traffic we challenged and blocked in aggregate — hundreds of thousands of events — while conversion-critical human traffic was never touched. That's the difference between a blunt CAPTCHA wall and a precise score.”