What the bot score means, which plan gives you which capability, and — the part most guides skip — the cases where it is the wrong tool for the job.
Cloudflare Bot Management is an Enterprise add-on that scores every request that reaches Cloudflare and lets you write rules against that score. Underneath it there are actually three different products sharing one engine, and most of the confusion around "Cloudflare bot management" comes from people describing one of them while looking at another.
The score runs from 1 to 99, and it reads as confidence that the request came from a human — not as a "bot percentage". Lower is more automated.
| Score | Cloudflare's category | What it means in practice |
|---|---|---|
| 0 | Not computed | Bot Management never evaluated the request — another Cloudflare feature handled or redirected it first, or it is an internal service request. A 0 is not a clean bill of health. |
| 1 | Automated | High-confidence automation. This is also what any request with a missing or empty User-Agent receives. |
| 2–29 | Likely automated | Probable automation, less certain. Most people who challenge rather than block target this band. |
| 30–99 | Likely human | A real browser with plausible behaviour. 99 is near-certain. |
| — | Verified bot | A separately categorised non-malicious automated request, such as a search engine crawler that passed verification. |
The band people quote most is 30. Blocking everything below it is the usual starting point, and it is also where most of the false positives come from — mobile traffic and privacy-focused browsers both score lower than desktop traffic on the same behaviour. Cloudflare's own guidance is to challenge the 2–29 band rather than block it, and to tune against your own traffic.
All three use the same underlying detection engines. What changes is how much of the result you are allowed to see and act on.
| Feature | Bot Fight Mode (Free) | Super Bot Fight Mode (Pro, Business) | Bot Management (Enterprise add-on) |
|---|---|---|---|
| Bot score | None | Categories only | 1–99, per request |
| Control | One on/off toggle | Per category: allow, block or managed challenge | WAF and rate-limiting rules against score, path, IP, method, headers, ASN |
| Scope | Whole domain | Whole domain | Per path, per request |
| Custom score rules | No | No | Yes |
| Analytics | None | Bot Analytics | Score histograms, bot tags, Logpush |
| Fingerprinting | — | JS Detections | JA3/JA4 plus JS Detections |
| Positioning | Set and forget | Category-level control | Programmable |
One detail worth knowing before you plan a migration: Super Bot Fight Mode does not support custom rules based on bot score, and on the Pro plan the "likely automated" category is not available at all. If your plan depends on writing score-based rules, that is an Enterprise capability.
Cloudflare runs three engines over the request and combines them. A heuristics engine catches known automation and assigns a flat 1 to high-confidence detections — which is why so much obviously-automated traffic lands on exactly 1 rather than a range. A machine learning engine produces most of the middle of the range, mapping a probability-human prediction onto 2–99. An anomaly detection engine flags requests that deviate from what that particular site normally sees, which is the part that improves the longer Cloudflare has your traffic. A __cf_bm cookie ties requests to a session so a single odd request does not move the score for that visitor.
The practical consequence: the score is highest-confidence at the extremes and least reliable in the middle, and everything in the 20–40 range is where your traffic decides whether the product is tuned well or not.
Cloudflare assigns a score of 1 to any request with a missing or empty User-Agent header. That is a reasonable heuristic and it is also a real false-positive source: on our own site we have measured over six thousand genuine human visitors arriving with an empty User-Agent, because a Cloudflare Worker in the path was dropping the header. If you block on score 1, you need to know whether anything in your own stack strips that header.
Requests that never reached the scoring engines report 0. Treating 0 as human — which is easy to do when you write a rule like score gt 30 and forget the boundary — silently allows exactly the requests nothing looked at.
The same behaviour from a mobile device or a hardened browser can score lower than from a desktop. Blocking the 2–29 band outright is how sites end up with a support queue full of real customers. Challenge it instead, and check what you blocked before you tighten it.
The free and Pro tiers give you a toggle or a category, not the number. If your plan is "block when the score drops below 30", you are describing the Enterprise add-on.
If you are already on Cloudflare Enterprise, moving your traffic is free and the ML scoring is genuinely strong on sites with a lot of traffic to learn from. That is the case it was built for, and re-platforming away from it is rarely the right call.
It is a worse fit when you are not on Enterprise and the score is the part you actually need, when you cannot move your DNS, when whole-domain scope is too blunt — you want the checkout protected differently from the blog — or when you want the individual signals behind a verdict visible in your own system rather than inside a third-party dashboard. Those are the cases ZeroBot is built for: an HTTP call from your own code, $50/month flat, no DNS change, and the score plus the reasons behind it returned to you.
The request was almost certainly automated. Cloudflare assigns a score of 1 for the highest-confidence automated detections, including any request with a missing or empty User-Agent header.
The score runs from 1 to 99 and is read as confidence that the request is human: 1 is almost certainly automated and 99 is almost certainly a real person. A separate value, 0, means the request was never scored at all.
No. The 1-99 score is part of Bot Management, the Enterprise add-on. Free plans get Bot Fight Mode, which is a single on/off toggle with no scoring, and Pro and Business get Super Bot Fight Mode, which exposes categories rather than the numeric score.
Only on Enterprise Bot Management. Super Bot Fight Mode does not let you write custom rules based on bot score, and it applies to the whole domain rather than per path.
No. Score 0 means the request was not evaluated, which happens when another Cloudflare feature handles or redirects the request before it reaches the scoring engines, or for some internal service requests. A score of 0 is not a statement that the request is safe.
Behaviour and score semantics described above are from Cloudflare's documentation: Bot score, Bot Management and challenge bad bots. Cloudflare changes packaging and thresholds over time — check the current docs before you rely on a number here.
One HTTP call, the verdict and the signals behind it, $50/mo flat.
Get started free →