Bot signals
2 min read
As discussed previously, all requests to Cloudflare’s network pass through our bot detection engines.
Cloudflare uses this information to surface different signals to help you identify the true origin of a request.
Bot score
A bot score is a score from 1 to 99 that indicates how likely that request came from a bot.
For example, a score of 1 means Cloudflare is quite certain the request was automated, while a score of 99 means Cloudflare is quite certain the request came from a human.
The following table groups these scores into general buckets.
| Category | Range |
|---|---|
| Not computed | Bot scores of 0. |
| Automated | Bot scores of 1. |
| Likely automated | Bot scores of 2 through 29. |
| Likely human | Bot scores of 30 through 99. |
| Verified bot | Non-malicious automated traffic (used to power search engines and other applications). |
Bot tags
Bot Tags provide more detail about why Cloudflare assigned a bot score to a request.
The following values are examples of what may be present in the BotTags log field, but not an exhaustive list:
- api
- bing
- googleAds
- googleMedia
- googleImageProxy
- newRelic
- baidu
- apple
- yandex
Detection IDs
Detection IDs are static rules used to detect predictable bot behavior with no overlap with human traffic. Detection IDs cause a bot to receive a score source of heuristics with a score of 1. For example, a detection ID can identify if you sent your headers in a different order than what was expected of your browser.
JA3 Fingerprint
A JA3 Fingerprint helps you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates.
Verified bots
Cloudflare maintains an internal list of Verified Bots that are associated with search engine optimization (SEO), website monitoring, and more.
You can use this list to prevent any bot protection measures from impacting otherwise helpful bots, such as search crawlers.
For a partial list of verified bots, refer to Cloudflare Radar.