Bot Management provides access to several fields within the expression builder of Ruleset Engine-based products such as WAF custom rules and Cache Rules.
-
Bot Score (
cf.bot_management.score): An integer between 1-99 that indicates Cloudflare's level of certainty that a request comes from a bot. -
Verified Bot (
cf.bot_management.verified_bot): A boolean value that indicates whether a request originates from a Cloudflare allowed bot.Cloudflare maintains a large allowlist of good, automated bots (such as Google Search Engine and Pingdom) that perform beneficial tasks. Cloudflare identifies and verifies these bots primarily through reverse DNS validation, ensuring the source IP matches the requesting service.
We also use additional validation methods, including checking ASN blocks and public lists. If these methods are unavailable, Cloudflare utilizes internal data and machine learning to identify and verify legitimate IP addresses from good bots. Most customers choose to allow this traffic.
-
Serves Static Resource (
cf.bot_management.static_resource): An identifier that matches file extensions for many types of static resources. Use this variable if you send emails that retrieve static images. -
ja3Hash (
cf.bot_management.ja3_hash) and ja4 (cf.bot_management.ja4): A JA3/JA4 fingerprint helps you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. -
Bot Detection IDs (
cf.bot_management.detection_ids): List of IDs that correlate to the Bot Management heuristic detections made on a request (you can have multiple heuristic detections on the same request).