Bot Fight Mode: Smarter Detection, Shorter Attacks
Cloudflare's annual data pull for its tree donation program with One Tree Planted has revealed a notable shift in how malicious bot operators are behaving. While the volume of bot detections continues to climb, the amount of time those bots spend completing Cloudflare's CPU-intensive challenge pages has dropped dramatically. According to the company, bot operators are now abandoning these challenges almost immediately, suggesting the cost of these computational tasks has become a significant enough deterrent that they are moving on to easier targets.
This trend indicates that the detection mechanisms are becoming both more effective at identifying threats and better at discouraging repeat attacks. For Cloudflare, this is a dual win: it cleans up bot traffic more efficiently while simultaneously supporting reforestation efforts funded by the failed challenge attempts.
The New Rules Engine Behind the Shift
When Bot Fight Mode was first introduced, it relied heavily on a set of simple, handwritten rules designed to catch basic bots. While these rules remain in place and are still updated as new software libraries emerge, the system had reached a critical limit. The challenge was that many sophisticated bots shared enough characteristics with legitimate browser traffic that adding new blocking rules posed too high a risk of affecting real users.
To address this limitation, Cloudflare has rebuilt its detection framework. The new system is written on the same high-performance Ruleset Engine that powers the company's new WAF,
The results are measurable. Cloudflare is now issuing six times more CPU-intensive challenges per day than it was a year ago, all while the average session time on those challenge pages has fallen. Attackers are recognizing the financial burden of these challenges and disconnecting quickly.
Flexibility and Custom Rules on the Horizon
While the current system is effective, Cloudflare acknowledges that website operators have specific needs. Many customers have a significant portion of legitimate traffic coming from automated sources, such as service-to-service APIs. This has made them hesitant to enable Bot Fight Mode for fear of disrupting their own valid use cases. To solve this, the company plans to introduce a new feature in 2023 that will allow customers to write their own flexible Bot Fight Mode rules. This will enable them to specify exactly which parts of their websites the protection should run on.
Second Planting Project Completed: Mangroves in India
On the environmental side, Cloudflare has announced the completion of its second tree-planting project funded by bot activity from 2021. After contributing 25,000 trees to a restoration effort in Nova Scotia earlier this year, the company has now donated 10,000 trees to a larger project on the eastern shoreline of Kumirmari island in the Sundarbans of West Bengal, India.
The Sundarbans, a UNESCO World Heritage site, host one of the world's largest mangrove forests and serve as a critical habitat for threatened species, including the Bengal tiger and estuarine crocodile. According to One Tree Planted, this region is increasingly vulnerable to rising sea levels, heightened salinity, and cyclonic storms. The broader restoration initiative involved planting over 415,000 trees—including species like Bain and Avicennia officianalis—across 7.74 hectares of degraded land. These mangroves serve as one of the globe's largest carbon sinks, with research indicating that such coastal forests can sequester carbon at rates two to four times higher than mature tropical forests.
Beyond the ecological impact, the project also focused on local economic development. 75 percent of the project's workforce were women, with 85 women employed over a five-month period to monitor the planting site. Participants received training in seed collection techniques, aiming to equip local residents with the skills needed to lead future mangrove planting initiatives independently.
