Bot management · Cloudflare
Cloudflare Bot Management
Difficulty 4/5
The most widely deployed protection on the web. Scores every request from TLS fingerprint, HTTP/2 frame order, IP reputation and a JS challenge.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
JA3/JA4 TLS fingerprinting on the handshake, before a single byte of HTTP is parsed — this is why curl and python-requests are identified as non-browsers instantly.
-
HTTP/2 fingerprinting: SETTINGS frame order, window sizes and header order are compared against known browser builds.
-
IP reputation from Cloudflare’s own network telemetry. Datacenter ASNs carry a standing penalty; the same request from a residential address scores materially better.
-
A managed challenge (Turnstile) that runs JS, collects a device signal and mints a `cf_clearance` cookie on success.
-
`__cf_bm` — a short-lived bot-management cookie tying subsequent requests to the scored session.
What you see when it stops you
- HTTP 403 with “Sorry, you have been blocked” and a Ray ID in the footer
- An interstitial reading “Checking your browser before accessing…”
- Cloudflare error codes 1015 (rate limited), 1020 (firewall rule) or 1010 (browser signature banned)
- `cf-mitigated: challenge` on the response
Signatures the detector matches
Publicly observable artefacts Cloudflare Bot Management sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | cf-ray response header | 45 |
| Header | server: cloudflare | 25 |
| Header | cf-cache-status header | 15 |
| Header | cf-mitigated header — the request was actively challenged | 70 |
| Cookie | __cf_bm bot-management cookie | 70 |
| Cookie | cf_clearance challenge-pass cookie | 70 |
| Cookie | __cfduid cookie (legacy) | 30 |
| Page markup | /cdn-cgi/challenge-platform/ challenge script | 75 |
| Page markup | Turnstile widget embedded | 70 |
| Page markup | Cloudflare block page markup | 70 |
| Page markup | Interstitial JS challenge page | 60 |
| Page markup | Cloudflare 10xx error code | 45 |
| Status | 403 on a Cloudflare-fronted origin | 10 |
| Status | 503 — typical of an unsolved challenge | 10 |
What actually gets through
-
Use a real browser engine. Header-spoofing an HTTP client does not survive TLS fingerprinting.
-
Residential exits. IP reputation is the largest single term in the score, and datacenter ranges start deep in the hole.
-
Keep `cf_clearance` pinned to the exact IP and TLS fingerprint that earned it — the cookie is bound to both and is worthless if you rotate mid-session.
-
Respect per-origin concurrency. Rate rules fire long before bot scoring does on most deployments.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.