Bot scoring inside a Cloudflare Worker

If you already terminate at Cloudflare, a Worker is the cheapest place to add a per-request verdict — no origin changes, no DNS work.

Start free — no card Start free

How ZeroBot fits Cloudflare Worker

This page is for teams already on Cloudflare who find that their rules are not quite enough. Be clear on what it is: ZeroBot does not replace Cloudflare and does not sit in front of it. What it adds is a per-request verdict you can branch on inside the Worker, plus the signals behind that verdict in a dashboard you own — which is the part Cloudflare’s own scoring does not give you. The practical use is a second opinion on requests that your Cloudflare rules rated ambiguous, rather than a blanket duplicate of what Cloudflare already does.

The integration

worker.js

export default { async fetch(request, env, ctx) { const body = new URLSearchParams({ ip: request.headers.get('CF-Connecting-IP') || '', domain: new URL(request.url).hostname, useragent: request.headers.get('user-agent') || '', }); const v = await fetch('https://api.zerobot.info/v3/openapi', { method: 'POST', headers: { Authorization: `Bearer ${env.ZEROBOT_KEY}`, 'Content-Type': 'application/x-www-form-urlencoded', }, body, }).then((r) => r.json()).catch(() => null); if (v && v.risk_score >= 80) { return new Response('Blocked', { status: 403 }); } return fetch(request); }, };

Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.

What actually attacks Cloudflare Worker sites

Scrapers that pass Cloudflare’s default rules

Realistic headless browsers clear generic challenges. What they usually cannot hide is datacenter ASN origin and inconsistent fingerprint-to-behaviour matching.

Cache-poisoning and parameter probing

High-cardinality query strings and cache-busting parameters used to force origin hits and fill your logs.

Credential stuffing with residential proxies

Distributed low-and-slow attempts where no single IP looks suspicious enough for a rate rule to catch it.

Frequently asked questions

Is this a replacement for Cloudflare Bot Management?

No, and we would not claim it is. It is a per-request scoring layer you can call from inside a Worker. If your rules already do the job, adding this is optional.

Which IP should I send?

CF-Connecting-IP. It is the true client address and it is already resolved by the time your Worker runs, so you avoid the x-forwarded-for chain problem entirely.

Does calling out from a Worker add latency?

It adds one subrequest. If your Worker is on the request path, budget roughly 50ms. You can also score asynchronously and act on the stored verdict for subsequent requests.

Protect your Cloudflare Worker app this week.

Free tier, real verdicts, and documentation with a built-in tester.

Get started free →

How to use ?