Description

Ensure Bot Fight Mode is turned on for the zone, so that Cloudflare identifies traffic matching known bot patterns and challenges it before it reaches your origin. On Pro plans and above, Super Bot Fight Mode can be used instead for more control.

Rationale

Automated bots scrape content, stuff credentials, spam forms, and waste server resources. Bot Fight Mode uses Cloudflare's bot detection to challenge this traffic automatically, protecting the site with no custom rules. It is free and provides a baseline of bot protection.

Impact

  • Challenges traffic from known bad bots

  • Reduces scraping, spam, and credential stuffing

  • Bot Fight Mode cannot be bypassed with custom rules, so some automated tools may be challenged

Default Value

By default, Bot Fight Mode is turned off.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Verify that Bot fight mode (or Super Bot fight mode) is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Go to Bot fight mode and turn it on.

  5. On Pro plans and above, you can turn on Super Bot fight mode instead.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Go to Bot fight mode and turn it off.

Reference