What Is Cloudflare Bot Management? – Definition and How It Works
Learn how Cloudflare's bot score, managed challenges, and verified-bot list work, and what each response code means.
Cloudflare Bot Management classifies traffic passing through Cloudflare's network and lets a site act on that classification. It is a scoring system first and a challenge system second.
1. The Bot Score
Every request gets a score, roughly 1 to 99, where low means likely automated and high means likely human. The score comes from:
- Machine-learning classification over request characteristics.
- Heuristics matching known automation signatures.
- JavaScript-collected browser signals, where the challenge script has run.
- Behavioural analysis across the session.
- Cloudflare's network-wide view of the source address.
That network-wide view is the structural advantage: a source's behaviour on other sites informs its score on yours.
2. What Sites Do With It
The score is exposed to the site's own rules, so the action is the site's choice, not Cloudflare's:
| Action | Effect |
|---|---|
| Allow | Nothing happens |
| Log | Recorded, not acted on |
| Managed Challenge | Cloudflare picks a proportionate challenge |
| JS Challenge | Non-interactive script challenge |
| Interactive Challenge | Requires user interaction |
| Block | 403 |
Managed Challenge is now the common default, and it is adaptive — often a silent computational check rather than a visible puzzle. A session may pass it without any visible sign.
3. Verified Bots Are Allowlisted
Cloudflare maintains a list of known-good crawlers — search engines, monitoring services, and similar — verified by reverse DNS and published address ranges rather than by user-agent string.
Two implications:
- Claiming to be Googlebot fails, because verification is by forward-confirmed reverse DNS, not by the header. It also converts an ordinary request into an obvious impersonation attempt.
- Legitimate crawlers can apply to be verified, which is the sanctioned route for a public-benefit crawler.
4. Identifying It
| Class | Signal |
|---|---|
| Cookie | __cf_bm — bot management cookie |
| Cookie | cf_clearance — challenge passed |
| Header | cf-ray |
| Header | server: cloudflare |
| Content | __CF$cv$params, /cdn-cgi/challenge-platform/ |
| Window | _cf_chl_opt during a challenge |
__cf_bm indicates bot management is active, not merely that Cloudflare is in front. cf_clearance indicates a challenge has been completed — its presence is what keeps subsequent requests from being re-challenged.
5. Reading the Status Codes
- 403 — blocked by a rule, or a failed challenge.
- 503 with a challenge page — older interstitial pattern.
- 429 — rate limited, a separate feature from bot management.
- 1020 — a firewall rule matched; the site's own rule, not a generic bot block.
- 1015 — rate limited by Cloudflare.
- 200 with a challenge body — the case to guard against, since it looks like success.
Distinguishing a 1020 from a bot-management challenge matters: 1020 means a specific rule matched something about the request, which is often fixable, whereas a low bot score is not fixable by tweaking one header.
6. Turnstile Is Adjacent, Not the Same
Turnstile is Cloudflare's CAPTCHA-replacement widget that a site can embed on its own forms. Bot Management is the network-level classification of all traffic.
They are related products and frequently confused: seeing Turnstile on a login form says nothing about whether Bot Management is scoring your page requests, and vice versa.
7. What Actually Changes Outcomes
In rough order of impact:
- Address reputation — datacenter versus residential, and the address's history.
- TLS and HTTP/2 fingerprint consistency with the claimed browser.
- Whether the challenge script can execute — a real browser or nothing.
- Cookie persistence, so a passed challenge is not repeated.
- Request rate and pattern.
- Header set, order, and coherence.
Header tuning is last, not first, which is the reverse of how it is usually attempted.
8. Summary
Cloudflare Bot Management scores every request from network-wide signals and lets the site choose whether to allow, log, challenge, or block, with Managed Challenge as the adaptive default.
Identify it from __cf_bm rather than from Cloudflare's presence generally, treat cf_clearance as the cookie that must persist once a challenge passes, distinguish a 1020 rule match from a low bot score because only the former is usually fixable, and never claim to be a verified crawler — that is checked by reverse DNS, not by the header.