导航|地址|刷新
Bot Fight Mode

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/bots/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Bots

/

Overview

Plans

Get started

Bot Fight Mode

Super Bot Fight Mode

Bot Management

Concepts

Bots

Overview

Verified bots

Bot scores

Bot tags

Bot Feedback Loop

Bot detection engines

Additional configurations

JA3/JA4 fingerprint

Overview

Signals Intelligence

Detection IDs

Overview

Account takeover detections

Scraping detections

Additional detections

JavaScript detections ↗

Sequence rules

AI LabyrinthBeta

Block AI Bots

Custom rules

robots.txt setting

Static resource protection

Bot Analytics

BotBase

Attribution Business Insights

Workers templates

Delay action

Account Abuse ProtectionEarly Access

Troubleshooting

Bot Management skips

Super Bot Fight Mode for WordPress

False positives

Reference

Bot verification methods

Web Bot Auth

IP validation

Bot Management variables

Machine Learning models

Bot Detection Alerts

Sample terms

Glossary

Changelog

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Bots llms.txt ↗

Bots llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Bots

/Get started

/Bot Fight Mode

Bot Fight Mode

Last updated Apr 30, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewConsiderationsInteraction with other app security featuresEnable Bot Fight ModeDisable Bot Fight ModeBlock AI botsVisibilityLimitations Rules JavaScript Detections

Bot Fight Mode is a simple, free product that helps detect and mitigate bot traffic on your domain. When enabled, the product:

Identifies traffic matching patterns of known bots

Issues computationally expensive challenges that force the requesting client to perform CPU-intensive calculations, increasing the cost for bots to send automated requests

Notifies Bandwidth Alliance ↗ partners (if applicable) to disable bots

Considerations

Bot Fight Mode and Super Bot Fight Mode use the same underlying technology that powers our Bot Management ↗ product. Specifically, these products:

Protect entire domains without endpoint restrictions

Cannot be customized, adjusted, or reconfigured via WAF custom rules

Although these products are designed to fight malicious actors on the Internet, they may challenge API or mobile app traffic. For more granular control, upgrade to Bot Management for Enterprise.

Interaction with other app security features

If you are using several app security features like custom rules, Managed Rules, and Bot Fight Mode, it is important to understand how these features interact and the order in which they execute. Refer to Security features interoperability for more information.

------

Enable Bot Fight Mode

To start using Bot Fight Mode:

In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗

Filter by Bot traffic.

Go to Bot fight mode.

Turn Bot fight mode on.

Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > Bots.

For Bot Fight Mode, select On.

Note

If you are upgrading from Bot Fight Mode to Super Bot Fight Mode, you must disable Bot Fight Mode in your Bot settings.

Old dashboard: Security > Bots, and select Configure Bot Fight Mode.

New dashboard: Security > Settings. Filter by Bot traffic and turn Bot fight mode off.

------

Disable Bot Fight Mode

If you find that Bot Fight Mode is causing problems with your application traffic, you may want to disable it.

To disable Bot Fight Mode:

In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗

Filter by Bot traffic.

Go to Bot Fight Mode.

Turn Bot Fight Mode off.

Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > Bots.

For Bot Fight Mode, select Off.

------

Block AI bots

Refer to Block AI bots.

Note

You can view blocked AI bot traffic via Security Analytics.

------

Visibility

You can see bot-related actions by going to Security > Events. Any requests challenged by this product will be labeled Bot Fight Mode in the Service field. This allows you to observe, analyze, and follow trends in your bot traffic over time.

------

Limitations

Rules

You cannot bypass or skip Bot Fight Mode using WAF custom rules or Page Rules. This is because Bot Fight Mode does not run on the Ruleset Engine — it operates in a separate evaluation pipeline where Skip, Bypass, and Allow actions have no effect.

If you need to create exceptions for specific traffic (for example, your own API clients or monitoring tools), use Super Bot Fight Mode instead. Super Bot Fight Mode runs on the Ruleset Engine and supports Skip rules.

Bot Fight Mode can still trigger if you have IP Access rules, but it will not trigger if an IP Access rule matches the request first.

JavaScript Detections

For Bot Fight Mode customers, JavaScript Detections is automatically enabled and cannot be disabled.

If you have a An added layer of security that helps detect and mitigate certain types of attacks such as cross-site scripting (XSS) attacks.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>Content Security Policy (CSP) , you need to take additional steps to implement JavaScript Detections:

Ensure that anything under /cdn-cgi/challenge-platform/ is allowed. Your CSP should allow scripts served from your origin domain (script-src self).

For nonce script tags:

If your CSP uses a nonce for script tags, Cloudflare will add these nonces to the scripts it injects by parsing your CSP response header.

If your CSP does not use nonce for script tags and JavaScript Detections is enabled, you may see a console error such as Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-b123b8a70+4jEj+d6gWI9U6IilUJIrlnRJbRR/uQl2Jc='), or a nonce ('nonce-...') is required to enable inline execution. We highly discourage the use of unsafe-inline and instead recommend the use CSP nonces in script tags which we parse and support in our CDN.

Warning

JavaScript Detections is not supported with nonce set via <meta> tags.

PreviousPlans NextSuper Bot Fight Mode

Was this helpful?

YesNo

Edit page Report issue

On this page

Overview

Considerations

Interaction with other app security features

Enable Bot Fight Mode

Disable Bot Fight Mode

Block AI bots

Visibility

Limitations

Rules

JavaScript Detections

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址