Description
Ensure Browser Integrity Check is turned on, so that Cloudflare looks at the HTTP headers of each request and challenges or blocks requests with headers commonly used by spammers and abusive bots, such as a missing or non-standard user agent.
Rationale
Many simple bots and attack tools send requests with missing or suspicious headers. Browser Integrity Check blocks this low-quality automated traffic before it reaches your origin, reducing spam, scraping, and attack attempts with no custom rules needed.
Impact
Blocks requests with suspicious or missing headers
Reduces spam and simple bot traffic
Some legitimate API clients without a user agent may need an exception
Default Value
By default, Browser Integrity Check is enabled.
Pre-Requisites
Cloudflare account with Administrator or Super Administrator role for the zone
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Check the Browser integrity check setting and verify that it is On.
If it is not On, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Set Browser integrity check to On.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
Set Browser integrity check back to its previous value.
Reference