# Ensure Bot Fight Mode is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787217129224-ensure-bot-fight-mode-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Bot Fight Mode is turned on for the zone, so that Cloudflare identifies traffic matching known bot patterns and challenges it before it reaches your origin. On Pro plans and above, Super Bot Fight Mode can be used instead for more control.

**Rationale**

Automated bots scrape content, stuff credentials, spam forms, and waste server resources. Bot Fight Mode uses Cloudflare's bot detection to challenge this traffic automatically, protecting the site with no custom rules. It is free and provides a baseline of bot protection.

**Impact**

-   Challenges traffic from known bad bots
    
-   Reduces scraping, spam, and credential stuffing
    
-   Bot Fight Mode cannot be bypassed with custom rules, so some automated tools may be challenged
    

**Default Value**

By default, Bot Fight Mode is turned off.

**Pre-Requisites**

-   Cloudflare account with Administrator or Firewall permissions for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Verify that Bot fight mode (or Super Bot fight mode) is turned on.
    
5.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Go to Bot fight mode and turn it on.
    
5.  On Pro plans and above, you can turn on Super Bot fight mode instead.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Bot traffic. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Go to Bot fight mode and turn it off.
    

**Reference**

-   [https://developers.cloudflare.com/bots/get-started/bot-fight-mode/](https://developers.cloudflare.com/bots/get-started/bot-fight-mode/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.