Bot Management

Advanced bot detection and mitigation for your applications

The Bot Management API allows you to configure bot detection and mitigation settings for your zones. It supports Bot Fight Mode, Super Bot Fight Mode, and Bot Management for Enterprise with advanced ML-based bot detection.

Initialize the Bot Management resource

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env.CLOUDFLARE_API_TOKEN,
});

const botManagement = client.botManagement;

Configuration management

Get configuration

Retrieve the current Bot Management configuration for a zone.

const config = await client.botManagement.get({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

Update configuration

Update Bot Management settings for a zone.

const config = await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  ai_bots_protection: 'block',
  cf_robots_variant: 'policy_only',
  crawler_protection: 'enabled',
  enable_js: true,
  fight_mode: false,
});

zone_id · string · required

Zone identifier

ai_bots_protection · string

Enable rule to block AI Scrapers and Crawlers. Options:

• block - Block AI scrapers and crawlers
• disabled - Allow AI scrapers and crawlers
• only_on_ad_pages - Block only on ad pages (not available for Enterprise)

cf_robots_variant · string

Specifies the Robots Access Control License variant to use. Options:

• off - Disable robots.txt management
• policy_only - Use policy-based robots.txt

crawler_protection · string

Enable rule to punish AI Scrapers and Crawlers via a link maze. Options:

• enabled - Enable crawler protection
• disabled - Disable crawler protection

enable_js · boolean

Use lightweight, invisible JavaScript detections to improve Bot Management. Learn more about JavaScript Detections.

fight_mode · boolean

Whether to enable Bot Fight Mode

is_robots_txt_managed · boolean

Enable cloudflare managed robots.txt. If an existing robots.txt is detected, then managed robots.txt will be prepended to the existing robots.txt.

Bot Fight Mode configuration

Bot Fight Mode is a basic bot protection plan suitable for smaller sites.

const config = await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  fight_mode: true,
  enable_js: true,
  ai_bots_protection: 'block',
});

Super Bot Fight Mode configuration

Super Bot Fight Mode provides enhanced bot protection with more granular control.

Super Bot Fight Mode - Definitely automated

const config = await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  sbfm_definitely_automated: 'managed_challenge',
  sbfm_verified_bots: 'allow',
  sbfm_static_resource_protection: false,
  optimize_wordpress: true,
});

sbfm_definitely_automated · string

Action to take on definitely automated requests. Options:

• allow - Allow the request
• block - Block the request
• managed_challenge - Issue a managed challenge

sbfm_verified_bots · string

Action to take on verified bot requests. Options:

• allow - Allow verified bots
• block - Block verified bots

sbfm_static_resource_protection · boolean

Enable static resource protection. Enable if static resources on your application need bot protection. Note: This can also result in legitimate traffic being blocked.

optimize_wordpress · boolean

Whether to optimize Super Bot Fight Mode protections for WordPress

Super Bot Fight Mode - Likely automated

const config = await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  sbfm_definitely_automated: 'managed_challenge',
  sbfm_likely_automated: 'managed_challenge',
  sbfm_verified_bots: 'allow',
  sbfm_static_resource_protection: false,
});

sbfm_likely_automated · string

Action to take on likely automated requests. Options:

• allow - Allow the request
• block - Block the request
• managed_challenge - Issue a managed challenge

Bot Management for Enterprise configuration

Enterprise Bot Management provides the most advanced bot detection using machine learning.

const config = await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  auto_update_model: true,
  bm_cookie_enabled: true,
  enable_js: true,
  suppress_session_score: false,
  ai_bots_protection: 'block',
});

auto_update_model · boolean

Automatically update to the newest bot detection models created by Cloudflare as they are released. Learn more.

bm_cookie_enabled · boolean

Indicates that the bot management cookie can be placed on end user devices accessing the site. Defaults to true.

suppress_session_score · boolean

Whether to disable tracking the highest bot score for a session in the Bot Management cookie

Cleaning up configuration after plan changes

When upgrading or downgrading your bot management plan, you may need to clean up old configurations.

Clean up for Bot Fight Mode

await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  sbfm_likely_automated: 'allow',
  sbfm_definitely_automated: 'allow',
  sbfm_verified_bots: 'allow',
  sbfm_static_resource_protection: false,
  optimize_wordpress: false,
  suppress_session_score: false,
});

Clean up for Super Bot Fight Mode Pro

await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  sbfm_likely_automated: 'allow',
  fight_mode: false,
});

Clean up for Super Bot Fight Mode Business

await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  fight_mode: false,
});

Clean up for Bot Management Enterprise

Ensure you have custom rules in place to protect your zone before disabling SBFM rules. Without these protections, your zone is vulnerable to attacks.

await client.botManagement.update({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  sbfm_likely_automated: 'allow',
  sbfm_definitely_automated: 'allow',
  sbfm_verified_bots: 'allow',
  sbfm_static_resource_protection: false,
  optimize_wordpress: false,
  fight_mode: false,
});

Response types

BotFightModeConfiguration

Configuration for Bot Fight Mode.

fight_mode · boolean

Whether Bot Fight Mode is enabled

enable_js · boolean

Whether JavaScript detections are enabled

ai_bots_protection · string

AI bots protection setting

cf_robots_variant · string

Robots Access Control License variant

crawler_protection · string

Crawler protection setting

is_robots_txt_managed · boolean

Whether robots.txt is managed by Cloudflare

using_latest_model · boolean

Whether the zone is using the latest ML model

stale_zone_configuration · object

Unauthorized settings currently active on the zone (typically from upgrades/downgrades)

SubscriptionConfiguration

Configuration for Enterprise Bot Management subscription.

auto_update_model · boolean

Whether automatic model updates are enabled

bm_cookie_enabled · boolean

Whether the bot management cookie is enabled

suppress_session_score · boolean

Whether session score tracking is suppressed

enable_js · boolean

Whether JavaScript detections are enabled

ai_bots_protection · string

AI bots protection setting

using_latest_model · boolean

Whether the zone is using the latest ML model

Related resources

• Turnstile
• Security Center
• Bot Plans