Bot Protection for the Next Tier of Cloudflare Plans

Bots have long been a persistent problem across the Internet, responsible for everything from credential stuffing attacks on bank accounts to ticket scalping and aggressive web scraping. Cloudflare first addressed this issue in 2019 with the launch of Bot Fight Mode, a tool adopted by more than 150,000 individuals and small businesses. Now, the company is expanding that protection with Super Bot Fight Mode, bringing more advanced detection and mitigation features to Pro and Business plan customers while keeping the existing free tier intact.

The announcement introduces a dedicated Bots hub within the Cloudflare dashboard's Firewall app. This new central location houses all bot-related tools and is available to all users, including those on the Enterprise Bot Management plan.

Expanded Visibility for Pro Plans

Pro plan users now have access to the Bot Report, a real-time analytics view that breaks down a site's traffic into three categories:

  • Likely automated requests are flagged by Cloudflare's heuristics and machine learning systems as potentially malicious or non-productive traffic.
  • Likely human traffic represents legitimate visitors and should ideally account for the majority of a site's requests.
  • Verified bot traffic comes from known good actors such as Google's search crawlers and PayPal's payment notification services.

The same dataset is also available through the GraphQL API, allowing Pro users to integrate bot traffic monitoring into their own workflows.

Beyond visibility, Pro users can configure Super Bot Fight Mode with new mitigation options. These include the ability to challenge or block requests identified as "definitely automated," which is Cloudflare's highest-confidence bot classification. Users can also enable JavaScript Detections to identify headless browsers and other non-human actors, and can choose to include or exclude verified bots from protection rules. This last option is particularly useful for sites that rely on services like Slack, where verified bot traffic needs to pass through unhindered.

Granular Analytics and Controls for Business Plans

The Business plan tier now includes Bot Analytics, a feature previously reserved for Enterprise customers. The tool provides a new version of the analytics interface that works alongside the mitigation features. Users can filter traffic by type, time frame, and attributes such as IP address or user agent. A "requests by detection source" view also shows which detection engine flagged a given request, offering transparency into Cloudflare's classification methodology.

Business users gain an additional mitigation tier: the ability to challenge or block "likely automated" traffic. This classification includes requests scored by Cloudflare's machine learning engine, which is designed to catch sophisticated bots that rotate IP addresses or mimic human behavior. The toolset gives site owners flexibility in responding to threats, with options to challenge, block, or take no action depending on their tolerance for bot traffic. Once mitigation rules are active, the Firewall Events log provides a live view of blocked or challenged requests.

What Remains for Enterprise

Enterprise Bot Management continues to offer the most advanced capabilities. Unlike the other tiers, Bot Management is integrated directly into the Firewall, allowing protection to be scoped to specific paths such as a /login endpoint. It includes granular bot scores that can be combined with other firewall attributes, plus Anomaly Detection for identifying outlier behavior patterns.

Cloudflare is also shipping new innovations for Enterprise customers, including early access to API Abuse Detection. This feature uses unsupervised learning to map out API structures, identify legitimate user flows, and block bad actors without requiring an SDK or a provided schema, offering protection for mobile apps and API endpoints.

Super Bot Fight Mode is now available for Pro and Business customers, and the core Bot Fight Mode remains active for free plan users. Cloudflare's stated goal is to extend bot protection across every plan tier, with all users encouraged to enable the new features.