How it works
You keep control of your Cloudflare account. We only read analytics through a token you create, limit and can delete at any time.
- Request. Send your email and domain through the free bot traffic check form.
- Token. We reply with the steps below and the IP address to put in the token's filter.
- Report. We break down your traffic and email the results.
Create a read-only API token
- In the Cloudflare dashboard, open My Profile → API Tokens and click Create Token, then Create Custom Token.
- Name it, for example "Bot report read-only".
- Under Permissions, add these, all with Zone → Read: Zone, Analytics, Firewall Services, Zone WAF, Zone Settings.
- Under Zone Resources, choose Include → Specific zone and pick only the site you want checked.
- Under Client IP Address Filtering, add the IP address from our email. The token will not work from anywhere else.
- Under TTL, set an end date 2 to 4 weeks ahead.
- Create the token and send it to us by email. Cloudflare shows it only once.
Without Zone WAF read access we cannot see the text of your custom rules, only their names in firewall events. The report still works, with less detail on which rule caught what.
What we can and cannot see
| We can see | We cannot see or do |
|---|---|
| Request counts by path, country, network, user agent and hour | Change any setting or rule |
| Firewall events and which rule acted | Your page content, orders or customer data |
| Your security settings and rules | Form submissions, passwords or payment details |
Sample report
The report opens with a short summary: what happened, what is happening now, what is still open and what to do. Then come the details: traffic by day and hour, each bot episode with its source and network, and how each of your rules performed.
Not on Cloudflare?
Send a server access log from nginx or Apache instead. We need the real visitor IP, the time, the requested URL, the status code and the user agent for each request. A self-service log file analyzer is coming.
FAQ
How do I revoke access?
Delete the token in My Profile → API Tokens. Access ends immediately, even before the expiry date.
Is the token stored?
Only until the report is done or the token expires, whichever comes first. See the privacy policy.
Why is the token limited to your IP?
So that it is useless to anyone else, even if the email with the token were ever exposed.