Bot Fight Mode in Cloudflare: what it blocks
Bot Fight Mode is Cloudflare's free, one-switch bot filter that challenges traffic matching known bot patterns across your whole domain. It cannot be tuned or skipped with custom rules and may challenge API and app traffic. It suits simple sites. With APIs, webhooks or a need for exceptions, use custom rules or Super Bot Fight Mode.
What Bot Fight Mode does
Bot Fight Mode is the bot protection on Cloudflare's Free plan. Paid plans get Super Bot Fight Mode instead, covered below. When it is on, Cloudflare looks for requests that match known bot patterns and answers them with a computationally expensive challenge instead of your page. A real browser solves it in the background. A simple script usually gives up.
Turning it on also enables JavaScript detections, a small script Cloudflare adds to your pages to tell browsers from bots. You cannot switch that part off while Bot Fight Mode is active. If your site sends a strict Content Security Policy, you need to allow /cdn-cgi/challenge-platform/, and nonces work only when they come from the CSP header, not from a meta tag. Otherwise the detection script and the challenge page break.
You find the switch in the Cloudflare dashboard under Security settings, filtered by bot traffic. Turning it off is the same switch.
The limits that cause trouble
The appeal of Bot Fight Mode is that there is nothing to configure. That is also its main weakness. Cloudflare's documentation lists these limits:
- It covers the whole domain. You cannot exclude a path, a subdomain or a country.
- Custom rules and Page Rules cannot skip it. A Skip rule that works for everything else in the firewall does nothing here.
- It may challenge API and mobile app traffic. Those clients cannot solve a browser challenge, so their requests fail.
- Only IP Access rules get ahead of it. If an IP Access rule matches the request first, Bot Fight Mode does not trigger.
In practice, the problems show up in a few predictable places: payment providers and other services that call your site with webhooks, uptime monitors, your own scripts that pull data from the site, a mobile app that talks to your API, and feed readers. They all look like bots, because they are bots, just useful ones.
Does Bot Fight Mode block Googlebot?
Cloudflare does not describe how Bot Fight Mode treats verified bots, and there is no setting to exclude them. In the traffic reports we have prepared, the damage to search crawlers came from the next step site owners took when Bot Fight Mode was not enough: a hand-written rule that blocks a country, a cloud network or a user agent pattern and catches Google's or Bing's IPs along the way.
Either way, do not assume. After you enable any bot setting, check that crawlers still get normal responses:
- In Cloudflare, open Security Analytics or Security Events and filter by the verified bot category Search Engine Crawler. Any challenge or block there needs a fix.
- Run a few of your URLs through the URL Inspection tool in Search Console and look at the crawl stats report.
- Take a few crawler IPs from your logs and confirm them with Verify Googlebot, so you know the requests you are looking at are real.
When to use Bot Fight Mode and when to skip it
| Your site | Bot Fight Mode? |
|---|---|
| Brochure site or blog, no API, no app, no webhooks | Fine to turn on |
| Online store with payment webhooks | Risky: a challenged webhook can leave orders unpaid in your system |
| Site with a mobile app or public API | Avoid: app and API calls may be challenged |
| You need exceptions for a path, partner or tool | Avoid: no exceptions are possible |
| Under an active bot flood today | A quick stopgap, then replace it with rules |
Super Bot Fight Mode: the version you can control
On Pro, Business and Enterprise plans, Cloudflare offers Super Bot Fight Mode instead. It sorts traffic into three groups, definitely automated, likely automated and verified bots, and lets you choose an action for each. It also has options for static resource protection, JavaScript detections and WordPress.
The key difference: Super Bot Fight Mode runs on the same rules engine as your custom rules, and custom rules run first. A custom rule with the Skip action can exempt your webhook path, your monitoring service or your API from it. If you turn on Super Bot Fight Mode, turn Bot Fight Mode off first.
Granular bot scores, where every request gets a number from 1 to 99, are a different product again: Bot Management, available only on Enterprise. Compare what each plan includes in which Cloudflare plan you need.
Alternatives on the Free plan
On Free you get 5 custom rules and 1 rate limiting rule. That is enough for a targeted setup that does what Bot Fight Mode cannot: allow verified crawlers explicitly and treat everything else by evidence. Start with a rule that lets known good bots through:
(cf.client.bot)Action: Skip the remaining custom rules. Put it first. Then challenge the patterns your traffic report points to, always excluding verified bots. For example, login and search pages hit by scripts:
(http.request.uri.path contains "/wp-login.php" and not cf.client.bot)Or traffic from cloud networks that real shoppers rarely use, such as DigitalOcean (AS14061) and Amazon (AS16509):
(ip.src.asnum in {14061 16509} and not cf.client.bot)Use Managed Challenge rather than Block for anything a real person might trigger. The single Free rate limiting rule counts requests per IP over 10 seconds, which is enough to slow down a scraper hammering one URL.
The right rules depend on what your traffic actually looks like. Guessing usually blocks the wrong thing. A free bot traffic report shows which networks, user agents and hours cause the load before you write a single rule.
What changed in 2026: the Block AI bots switch
Next to Bot Fight Mode, the dashboard used to show a separate "Block AI bots" switch. Cloudflare deprecated it on September 15, 2026 in favor of AI crawler policies by category. From that date, crawlers that collect data both for search and for AI training are blocked by every configuration that blocks AI training, including the old switch. If you ever turned it on, check what it now blocks. Details are in AI crawlers: block or allow?.
FAQ
Can I whitelist an IP or path in Bot Fight Mode?
Not with custom rules or Page Rules. Only an IP Access rule that matches first stops it from triggering, and that works for IPs, not paths. If you need path exceptions, use Super Bot Fight Mode or custom rules instead.
Is Bot Fight Mode enough to stop a DDoS?
No. It targets bot patterns, not volume. Cloudflare's DDoS protection works separately and is on for every plan. For a flood of requests that look like normal traffic, you need rate limiting and rules based on the actual source.
Why did my webhooks stop after I enabled it?
Webhook senders are automated clients and cannot solve a browser challenge. Turn Bot Fight Mode off, or move to Super Bot Fight Mode and add a Skip rule for the webhook path.
Does Bot Fight Mode slow down my site?
For people, usually not. It adds a small detection script to pages and challenges only requests that look automated. Sites with a strict Content Security Policy need the extra settings described above.