Automated Traffic, Visualized
Roughly 40% of all Internet traffic is automated, according to Cloudflare's own radar data. That automation isn't inherently malicious — search engine crawlers, uptime monitors, and payment processors all rely on scripts. But a significant portion of that traffic is designed to exploit websites: scrubbing prices, hoarding limited inventory, or stuffing credentials. Cloudflare's Bot Management product has long been the gatekeeper for that traffic, classifying requests and letting site owners decide what to allow and what to block. Today, the company is adding a new layer of visibility with Bot Analytics, a tool that lets customers explore exactly what kind of automated traffic is hitting their origin.
Why Bot Visibility Matters
The problem with automated abuse is that it doesn't look like a traditional attack. A bot that scrapes competitor prices or buys up limited-edition sneakers isn't sending malformed requests or exploiting a vulnerability — it's simply doing the same thing a human would do, but at a scale and speed no human could match. These bots are often built to mimic human behavior, which makes them hard to distinguish from genuine visitors without dedicated detection systems.
Not all bots are bad actors. Cloudflare maintains a verified list of well-known, transparent bots — DuckDuckGo's crawler, for example, publicly lists its IP ranges and behaves respectfully toward site owners. For these, Cloudflare assigns a verified status. Everything else gets scored on a spectrum from clearly automated to clearly human.
Inside Bot Analytics
Bot Analytics is a new dashboard section under Firewall → Overview. It's powered by GraphQL and Cloudflare's adaptive bitrate (ABR) technology, which allows it to query up to a month of historical data with little noticeable latency. For customers with Bot Management enabled, it's included in the service. Enterprise customers without Bot Management can still see a real-time snapshot of their bot traffic, a useful gauge for determining whether a bot problem exists. A double-digit percentage of automated traffic is a common warning sign that origin costs are higher than necessary, or that data is leaving the site in ways it shouldn't.
The dashboard is organized into four main sections, each meant to answer a different question about your traffic.
Requests by Bot Score
This top section plots traffic over time, split vertically by traffic category. Verified bots appear in green, while shades of purple and blue represent the full spectrum of bot likelihood. It's the quickest way to see whether a spike in automated traffic correlates with a specific event or time window.
Bot Score Distribution
Next is a horizontal distribution of scores across all traffic, with no time dimension. A slider lets you filter to a specific score range, and the rest of the page adapts in response. This tool is central to setting a useful bot threshold. Cloudflare generally considers traffic scoring below 30 to be automated, but site owners might decide to challenge anything under 40 or block anything below 10 — or both.
The distribution often shows natural "drop off" points — ranges where request density drops sharply. Setting a threshold at one of those points (say, 3 or 14) can be more effective than picking a round number. Requests clustered at similar scores tend to share characteristics, so the score immediately above the cluster often represents a meaningful difference in behavior.
Bot Score Source
This section breaks down which detection engine contributed to the score for each request. Hovering over a source shows a tooltip with a brief description. Some requests may show "not computed" — this usually happens when Cloudflare responded with an error page (like a 504 gateway timeout) on the site's behalf. In those cases, no bot score was calculated because no challenge or block was warranted. The most common sources include machine learning models and heuristics-based detections.
Top Requests by Source
The final section grounds all that visual data in specifics. It lists top requests by IP address, user agent, ASN, and other attributes, with options to filter or exclude each one. This is where an anomaly in the charts becomes something you can act on.
Spotting an Attack in Practice
Consider the process of identifying an aggressive content scraper. Starting from the bot score source section, you might select the requests flagged by the heuristics engine as the most obviously automated. The resulting table can reveal patterns that are hard to see in aggregate: a handful of IP addresses each generating roughly 22,000 requests, all with nearly identical user agents and concentrating in the same ASN and country. No human browses that way, and uniform behavior across multiple IPs is a tell.
Filtering on those attributes narrows the view further. Expanding the table might reveal nine separate IP addresses sharing the same behavior — a strong indicator of a scraper. Since the traffic isn't marked as verified, Bot Management assigns the lowest possible score and flags it as "automated." Reviewing the time series shows sustained activity over 24 hours; this isn't a burst attack that comes and goes, but persistent scraping. That's actionable information: a firewall rule could target the traffic based on bot score, IP, or any of the other filters used to isolate it.
Available Now
Bot Analytics is live now. For Bot Management customers, full access is included. Enterprise customers without the add-on can use the real-time snapshot to evaluate their exposure. Cloudflare has indicated that additional analytics features are planned for the coming months.
