diff --git a/src/content/docs/api-shield/index.mdx b/src/content/docs/api-shield/index.mdx index 9f754302e1fefe6..710be1f0347418f 100644 --- a/src/content/docs/api-shield/index.mdx +++ b/src/content/docs/api-shield/index.mdx @@ -21,7 +21,14 @@ Identify and address your API vulnerabilities. ## Why care about API security? - +APIs have become the [backbone of popular web services](https://blog.postman.com/intro-to-apis-history-of-apis/), helping the Internet become more accessible and useful. + +As APIs have become more prevalent, however, so have their problems: + +- Many companies have [thousands of APIs](/api-shield/security/api-discovery/), including ones they do not even know about. +- To support a large base of users, many APIs are protected by a negative security model that makes them vulnerable to credential-stuffing attacks and automated scanning tools. +- With so many endpoints and users, it’s difficult to recognize brute-force attacks against [specific endpoints](/api-shield/security/volumetric-abuse-detection/). +- Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon [usage patterns](/api-shield/security/sequence-analytics/). Refer to the [Get started](/api-shield/get-started/) guide to set up API Shield. diff --git a/src/content/docs/api-shield/management-and-monitoring/api-routing.mdx b/src/content/docs/api-shield/management-and-monitoring/api-routing.mdx index 32b97ffeecbdfea..a2a5856651b7c4e 100644 --- a/src/content/docs/api-shield/management-and-monitoring/api-routing.mdx +++ b/src/content/docs/api-shield/management-and-monitoring/api-routing.mdx @@ -7,7 +7,7 @@ sidebar: --- -import { Render, Steps } from "~/components" +import { Markdown, Render, Steps, Tabs, TabItem } from "~/components" API Shield Routing enables customers to create a unified external-facing API that routes requests to different back-end services that may have different paths and hosts than the existing zone and DNS configuration. @@ -18,15 +18,62 @@ The term **Source Endpoint** refers to the endpoint managed by API Shield in End ## Process - + +You must add Source Endpoints to Endpoint Management through established methods, including [uploading a schema](/api-shield/security/schema-validation/#add-validation-by-uploading-a-schema), via [API Discovery](/api-shield/security/api-discovery/), or by [adding manually](/api-shield/management-and-monitoring/#add-endpoints-manually), before creating a route. + +To create a route, you will need the operation ID of the Source Endpoint. To find the operation ID in the dashboard: + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. + 2. Select **Security** > **API Shield**. + 3. Filter the endpoints to find your **Source Endpoint**. + 4. Expand the row for your Source Endpoint and note the **operation ID** field. + 5. Select the copy icon to copy the operation ID to your clipboard. + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Select **Security** > **Web assets**. + 3. Filter the endpoints to find your **Source Endpoint**. + 4. Expand the row for your Source Endpoint and note the **operation ID** field. + 5. Select the copy icon to copy the operation ID to your clipboard. + + + Once your Source Endpoints are added to Endpoint Management, use the following steps to create and verify routes on any given operation ID: ### Create a route - + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. + 2. Go to **Security** > **API Shield**. + 3. In **Endpoint Management**, select an existing endpoint and expand its details. + 4. Under **Routing**, select **Create route**. + 5. Enter the target URL or IP address to route your endpoint to. + 6. Select **Deploy route**. + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Go to **Security** > **Web assets**. + 3. In **Endpoints**, select an existing endpoint and expand its details. + 4. Under **Routing**, select **Create route**. + 5. Enter the target URL or IP address to route your endpoint to. + 6. Select **Deploy route**. + + + - +:::note +You can reorder path variables if they are present. For example, you can route `/api/{var1}/users/{var2}` to `/{var2}/users/{var1}`. Segments of the path that are not variables may be added or omitted entirely. +::: You can also edit or delete a route by selecting **Edit route** on an existing route. @@ -47,4 +94,8 @@ API Shield Routing is currently in an open beta and is only available for Enterp ## Limitations - +The Target Endpoint cannot be routed to a Worker if the route is to the same zone. + +You cannot change the method of a request. For example, a `GET` Source Endpoint will always send a `GET` request to the Target Endpoint. + +You must use all of the variables in the Target Endpoint that appear in the Source Endpoint. For example, routing `/api/{var1}/users/{var2}` to `/api/users/{var2}` is not allowed and will result in an error since `{var1}` is present in the Source Endpoint but not in the Target Endpoint. \ No newline at end of file diff --git a/src/content/docs/api-shield/management-and-monitoring/endpoint-labels.mdx b/src/content/docs/api-shield/management-and-monitoring/endpoint-labels.mdx index 7fdf94732f1e7a8..21a727fccefa3d3 100644 --- a/src/content/docs/api-shield/management-and-monitoring/endpoint-labels.mdx +++ b/src/content/docs/api-shield/management-and-monitoring/endpoint-labels.mdx @@ -48,7 +48,9 @@ Use managed labels to identify endpoints by use case. Cloudflare may automatical `cf-rss-feed`: Add this label to endpoints that expect traffic from RSS clients. :::note - +[Bot Fight Mode](/bots/get-started/bot-fight-mode/) will not block requests to endpoints labeled as `cf-rss-feed`. + +[Super Bot Fight Mode rules](/bots/get-started/super-bot-fight-mode/#ruleset-engine) will not match or challenge requests labeled as `cf-rss-feed`. ::: ### Risk labels diff --git a/src/content/docs/api-shield/security/api-discovery.mdx b/src/content/docs/api-shield/security/api-discovery.mdx index 946ad96ef13815f..7da2766713915a4 100644 --- a/src/content/docs/api-shield/security/api-discovery.mdx +++ b/src/content/docs/api-shield/security/api-discovery.mdx @@ -43,7 +43,7 @@ jp-api.example.com/api/v1/users/{var1} We will consolidate to `{hostVar1}.example.com/api/v1/users/{var1}`. - +For more technical details, see our [blog post](https://blog.cloudflare.com/ml-api-discovery-and-schema-learning/). ### Inbox view diff --git a/src/content/docs/bots/additional-configurations/ai-labyrinth.mdx b/src/content/docs/bots/additional-configurations/ai-labyrinth.mdx index 1234c585cbc6011..6a918e13670a7f2 100644 --- a/src/content/docs/bots/additional-configurations/ai-labyrinth.mdx +++ b/src/content/docs/bots/additional-configurations/ai-labyrinth.mdx @@ -16,10 +16,10 @@ To enable [AI Labyrinth](/bots/additional-configurations/ai-labyrinth): - + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. + 2. Go to **Security** > **Bots**. + 3. Select **Configure Bot Fight Mode**. + 4. Enable **AI Labyrinth**. diff --git a/src/content/docs/bots/additional-configurations/detection-ids.mdx b/src/content/docs/bots/additional-configurations/detection-ids.mdx index c69d267446208ca..f89ba1bb713e937 100644 --- a/src/content/docs/bots/additional-configurations/detection-ids.mdx +++ b/src/content/docs/bots/additional-configurations/detection-ids.mdx @@ -7,7 +7,7 @@ sidebar: import { Render, Tabs, TabItem, Steps } from "~/components" - +Detection IDs are static rules used to detect predictable bot behavior with no overlap with human traffic. Detection IDs refer to the precise [detection](/bots/concepts/bot-detection-engines/) used to identify a bot, which could be from heuristics, verified bot detections, or anomaly detections. For example, a detection ID can identify if you sent your headers in a different order than what was expected of your browser. If you are having an issue with one of our heuristics, detection IDs allow you to decide which heuristics to enforce on your zones using customer configurable heuristics. You can choose unique actions for different bots, detected through Cloudflare’s heuristics engine. You can block, allow, or serve alternate content to specific bots to meet the unique needs of your site’s traffic. @@ -101,7 +101,13 @@ and not any(cf.bot_management.detection_ids[*] in {3355446 12577893}) ## Account takeover detections - +Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/). + +| Detection ID | Description | +| ------------ | ---------------------------------------- | +| `201326592` | Observes all login failures to the zone. | +| `201326593` | Observes all login traffic to the zone. | +| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.

When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 2 and [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. | ### Challenges for account takeover detections diff --git a/src/content/docs/bots/additional-configurations/ja3-ja4-fingerprint/index.mdx b/src/content/docs/bots/additional-configurations/ja3-ja4-fingerprint/index.mdx index a92e49b8ce44e6b..d05e5d93773f63e 100644 --- a/src/content/docs/bots/additional-configurations/ja3-ja4-fingerprint/index.mdx +++ b/src/content/docs/bots/additional-configurations/ja3-ja4-fingerprint/index.mdx @@ -8,9 +8,9 @@ sidebar: import { Render } from "~/components" - +[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. - +JA4 fingerprint adds new functionality by sorting ClientHello extensions and reducing the total number of unique fingerprints for modern browsers. :::note diff --git a/src/content/docs/bots/additional-configurations/managed-robots-txt.mdx b/src/content/docs/bots/additional-configurations/managed-robots-txt.mdx index 3cf702d879ea473..2adf03c61773eff 100644 --- a/src/content/docs/bots/additional-configurations/managed-robots-txt.mdx +++ b/src/content/docs/bots/additional-configurations/managed-robots-txt.mdx @@ -50,10 +50,10 @@ To implement a `robots.txt` file on your domain: - + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. + 2. Go to **Security** > **Bots**. + 3. Select **Configure Bot Fight Mode**. + 4. Turn **Manage bot traffic with robots.txt** on. diff --git a/src/content/docs/bots/additional-configurations/static-resources.mdx b/src/content/docs/bots/additional-configurations/static-resources.mdx index 07c542cd11ed347..8d241960bbd24e1 100644 --- a/src/content/docs/bots/additional-configurations/static-resources.mdx +++ b/src/content/docs/bots/additional-configurations/static-resources.mdx @@ -46,10 +46,12 @@ The **Static Resource Protection** setting will only activate if at least one of ## Bot Management for Enterprise -
+Static resources are protected by default when you create [custom rules](/waf/custom-rules/) using `cf.bot_management.score`. To exclude static resources, you would need to include `not (cf.bot_management.static_resource)` as part of your custom rule. ## Which files are protected? - +Static resources are files with the following extensions: + +`ico|jpg|png|jpeg|gif|css|js|tif|tiff|bmp|pict|webp|svg|svgz|class|jar|txt|csv|doc|docx|xls|xlsx|pdf|ps|pls|ppt|pptx|ttf|otf|woff|woff2|eot|eps|ejs|swf|torrent|midi|mid|m3u8|m4a|mp3|ogg|ts` \ No newline at end of file diff --git a/src/content/docs/bots/concepts/bot-score.mdx b/src/content/docs/bots/concepts/bot-score.mdx index 0d10ae22ee6f85b..fc1d15d9e6a29e3 100644 --- a/src/content/docs/bots/concepts/bot-score.mdx +++ b/src/content/docs/bots/concepts/bot-score.mdx @@ -7,7 +7,9 @@ sidebar: import { GlossaryTooltip, Render } from "~/components"; - +A bot score is a score from *1* to *99* that indicates how likely that request came from a bot. + +For example, a score of 1 means Cloudflare is quite certain the request was automated, while a score of 99 means Cloudflare is quite certain the request came from a human. Bot scores are available to be used in rule expressions and with Workers to customize application behavior. For more details, refer to [Bot Management variables](/bots/reference/bot-management-variables/). @@ -20,7 +22,13 @@ Granular bot scores are only available to Enterprise customers who have purchase Customers with a Pro plan or higher can automatically see bot traffic divided into groups by going to **Security** > **Bots**. - +| Category | Range | +| -------------------- | -------------------------------------------------------------------------------------- | +| **Not computed** | Bot scores of 0. | +| **Automated** | Bot scores of 1. | +| **Likely automated** | Bot scores of 2 through 29. | +| **Likely human** | Bot scores of 30 through 99. | +| **Verified bot** | Non-malicious automated traffic (used to power search engines and other applications). | :::note @@ -34,15 +42,35 @@ Bot scores are not computed for requests to paths that are handled by Cloudflare The following detection engines only apply to Enterprise Bot Management. For specific details about the engines included in your plan, refer to [Plans](/bots/plans/). ::: - +### Heuristics + + + +The Heuristics engine immediately gives automated requests a score of 1. + +### Machine learning + + + +The ML engine produces scores 2 through 99. + +### Anomaly detection + + + +### JavaScript detections + + + +JSD is enabled by default but completely optional. To adjust your settings, open the Bot Management Configuration page from **Security** > **Bots**. ### Cloudflare service - +**Cloudflare Service** is a special bot score source for Enterprise Zero Trust to avoid false positives. ### Not computed - +A bot score of 0 means Bot Management did not run on the request. Cloudflare does not run Bot Management on internal service requests that Bot Management has no interest in blocking. ### Notes on detection diff --git a/src/content/docs/bots/concepts/bot-tags.mdx b/src/content/docs/bots/concepts/bot-tags.mdx index 7a318a78d5b907d..090b383ed6780aa 100644 --- a/src/content/docs/bots/concepts/bot-tags.mdx +++ b/src/content/docs/bots/concepts/bot-tags.mdx @@ -7,9 +7,9 @@ sidebar: --- -import { Render } from "~/components" +import { Render, GlossaryTooltip } from "~/components" - +Bot tags provide more detail about *why* Cloudflare assigned a bot score to a request. Use these tags to learn more about your bot traffic and better inform security settings. @@ -22,7 +22,19 @@ Bot tags are only available to Enterprise customers who have purchased Bot Manag Once you [enable bot tags](#enable-bot-tags), you can see more information about bot requests, such as whether a request came from a verified bot (like Bing) or a category of verified bot (like SearchEngine). - +The following values are **examples** of what may be present in the `BotTags` log field, but not an exhaustive list: + +- api +- google +- bing +- googleAds +- googleMedia +- googleImageProxy +- pinterest +- newRelic +- baidu +- apple +- yandex ## Enable bot tags diff --git a/src/content/docs/bots/concepts/bot/index.mdx b/src/content/docs/bots/concepts/bot/index.mdx index 6e428243917c9b1..01c3d938d5a31ed 100644 --- a/src/content/docs/bots/concepts/bot/index.mdx +++ b/src/content/docs/bots/concepts/bot/index.mdx @@ -10,7 +10,7 @@ learning_center: import { Render } from "~/components"; - +A **bot** is a software application programmed to do certain tasks. Bots can be used for good (chatbots, search engine crawlers) or for evil (inventory hoarding, credential stuffing). @@ -36,7 +36,26 @@ You can opt into a managed rule that will block bots that we categorize as artif ### Which bots are blocked - +When you enable this feature, Cloudflare will block the following bots: + +- `Amazonbot` (Amazon) +- `Applebot` (Apple) +- `Bytespider` (ByteDance) +- `ClaudeBot` (Anthropic) +- `DuckAssistBot` (DuckDuckGo) +- `Google-CloudVertexBot` (Google) +- `GoogleOther` (Google) +- `GPTBot` (OpenAI) +- `Meta-ExternalAgent` (Meta) +- `PetalBot` (Huawei) +- `TikTokSpider` (ByteDance) +- `CCBot` (Common Crawl) + +In addition to this list, [verified bots](https://radar.cloudflare.com/bots#verified-bots) that are classified in AI-related categories such as `AI Crawler` or an `Archiver`, as well as a number of unverified bots that behave similarly, are included in the rule. This rule does not include verified bots that fall into the `Search Engine` categories. + +These categories, and the bots classified in these categories, may change from time to time. + +If you are a bot operator and feel your bot may have been incorrectly categorized, [add your bot to the list of verified bots](https://dash.cloudflare.com/?to=/:account/configurations/verified-bots). ### How it works diff --git a/src/content/docs/bots/get-started/bot-fight-mode.mdx b/src/content/docs/bots/get-started/bot-fight-mode.mdx index c675b58f5a74565..bcbde4b40b4db48 100644 --- a/src/content/docs/bots/get-started/bot-fight-mode.mdx +++ b/src/content/docs/bots/get-started/bot-fight-mode.mdx @@ -11,7 +11,11 @@ head: import { Tabs, TabItem, Steps, Render } from '~/components'; - +Bot Fight Mode is a simple, free product that helps detect and mitigate bot traffic on your domain. When enabled, the product: + +- Identifies traffic matching patterns of known bots +- Issues computationally expensive challenges in response to these bots +- Notifies [Bandwidth Alliance](https://cloudflare.com/bandwidth-alliance/) partners (if applicable) to disable bots ## Considerations @@ -19,7 +23,26 @@ import { Tabs, TabItem, Steps, Render } from '~/components'; ## Enable Bot Fight Mode - +To start using Bot Fight Mode: + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Go to **Security** > **Bots**. + 3. For **Bot Fight Mode**, select **On**. + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Go to **Security** > **Settings**. + 3. Filter by **Bot traffic**. + 4. Go to **Bot Fight Mode**. + 5. Turn **Bot Fight Mode** on. + + + diff --git a/src/content/docs/bots/get-started/super-bot-fight-mode.mdx b/src/content/docs/bots/get-started/super-bot-fight-mode.mdx index b89d2e826fb5e32..84f0a2f266ce068 100644 --- a/src/content/docs/bots/get-started/super-bot-fight-mode.mdx +++ b/src/content/docs/bots/get-started/super-bot-fight-mode.mdx @@ -9,7 +9,7 @@ head: --- -import { Render } from "~/components" +import { Render, Tabs, TabItem, Steps } from "~/components" Super Bot Fight Mode is included in your Pro, Business, or Enterprise subscription. When enabled, the product: @@ -28,7 +28,41 @@ Accounts with an Enterprise subscription but not the [Bot Management add-on](/bo - +To start using Super Bot Fight Mode: + + + +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. +2. Go to **Security** > **Bots**. +3. Select **Configure Super Bot Fight Mode**. +4. Choose how your domain should respond to various types of traffic: + + - For more details on verified bots, refer to [Verified Bots](/bots/concepts/bot/#verified-bots). + - For more details on supported file types, refer to [Static resource protection](/bots/additional-configurations/static-resources/). + - For more details on invisible code injection, refer to [JavaScript detections](/bots/additional-configurations/javascript-detections/). + + + + +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. +2. Go to **Security** > **Settings**. +3. Filter by **Bot traffic**. +4. Go to **Super Bot Fight Mode**. +6. Turn **Super Bot Fight Mode** on. +7. Choose how your domain should respond to various types of traffic by selecting the associated edit icon: + + - For more details on verified bots, refer to [Verified Bots](/bots/concepts/bot/#verified-bots). + - For more details on supported file types, refer to [Static resource protection](/bots/additional-configurations/static-resources/). + - For more details on invisible code injection, refer to [JavaScript detections](/bots/additional-configurations/javascript-detections/). + - For more details on WordPress optimization, refer to [Super Bot Fight Mode for WordPress](/bots/troubleshooting/wordpress-loopback-issue/). + + + + +:::caution[Warning] + +If your organization also uses [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/), keep **Definitely Automated** set to **Allow**. Otherwise, tunnels might fail with a `websocket: bad handshake` error. +::: ### Conditions @@ -36,7 +70,32 @@ Accounts with an Enterprise subscription but not the [Bot Management add-on](/bo ## Disable Super Bot Fight Mode - +If you find that **Super Bot Fight Mode** is causing problems with your application traffic, you may want to disable it. + +To disable Super Bot Fight Mode: + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Go to **Security** > **Bots**. + 3. Select **Configure Super Bot Fight Mode**. + 4. For all bot groupings (**Definitely automated**, **Verified bots**, etc.), set the value to **Allow**. + 5. For all other options (**Static resource protection**, **JavaScript Detections**), ensure they are off. + + + + + 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. + 2. Go to **Security** > **Settings**. + 3. Filter by **Bot traffic**. + 4. Go to **Super Bot Fight Mode**. + 5. Turn **Super Bot Fight Mode** off. + 6. For all bot groupings (**Definitely automated traffic**, **Verified bots**), select the edit icon and set the value to **Allow**. + 7. For all other options (**Static resource protection**, **JavaScript detections**, **Optimize for WordPress**), select the edit icon and ensure they are off. + + + @@ -65,6 +124,6 @@ You can see bot-related actions by going to **Security** > **Events**. Any reque ## Ruleset Engine - +Super Bot Fight Mode runs during the `http_request_sbfm` phase of the [Ruleset Engine](/ruleset-engine/about/phases/). diff --git a/src/content/docs/bots/index.mdx b/src/content/docs/bots/index.mdx index b93d25da9c5f7ff..9bb1e6c5bfb946c 100644 --- a/src/content/docs/bots/index.mdx +++ b/src/content/docs/bots/index.mdx @@ -23,7 +23,11 @@ While Cloudflare offers several products that relate to bot traffic, this sectio ## Which bot solution do I need? - +If you have a smaller domain and have identified a bot problem, we recommend Bot Fight Mode or Super Bot Fight Mode, which are included with your plan subscription. You can enable either from your dashboard, but these solutions offer limited configuration options. + +If you have a large domain with a lot of traffic, we recommend Bot Management for Enterprise, especially for customers in ecommerce, banking, and security. To enable Bot Management for Enterprise and write rules to customize your bot protection, contact your account team. + +To see the differences in features and functionality, visit [Plans](/bots/plans/). ## Features diff --git a/src/content/docs/bots/plans/biz-and-ent.mdx b/src/content/docs/bots/plans/biz-and-ent.mdx index a5dfd60f376846c..96fe91d67887255 100644 --- a/src/content/docs/bots/plans/biz-and-ent.mdx +++ b/src/content/docs/bots/plans/biz-and-ent.mdx @@ -19,7 +19,51 @@ import { Render } from "~/components" ## Business features - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Plan nameSuper Bot Fight Mode
AvailabilityAll Business customers and Enterprise customers without Bot Management*
ConfigurationGo to Security > Bots > Configure Super Bot Fight Mode
EnablementToggle in Security > Bots
Type of bots detectedSimple bots, headless browsers, and many sophisticated bots
ActionsCustomer chooses whether to allow, block, or challenge
AnalyticsDedicated Bot Analytics tool, available in Security
Additional controlApplied to all traffic across a domain
+ +\*When users purchase Bot Management for Enterprise, Cloudflare automatically replaces and disables other bot products to prevent overlap. + ## How do I get started? diff --git a/src/content/docs/bots/plans/bm-subscription.mdx b/src/content/docs/bots/plans/bm-subscription.mdx index 4810ddcbda2f4d3..d72a4971f7733b6 100644 --- a/src/content/docs/bots/plans/bm-subscription.mdx +++ b/src/content/docs/bots/plans/bm-subscription.mdx @@ -19,7 +19,49 @@ import { Render } from "~/components" ## Bot Management for Enterprise Features - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Plan nameBot Management for Enterprise
AvailabilityAdded to Enterprise plans by your account team
ConfigurationGo to Security > Bots > Configure Bot Management
EnablementQuick onboarding with help from our Solutions Engineering team
Type of bots detectedSimple and sophisticated bots, headless browsers, and domain-specific anomalies
ActionsCustomer chooses from several options, including block and various challenges
AnalyticsDedicated Bot Analytics tool, available in Security
Additional controlAbility to restrict by path, IP address, and more. Access to bot score, JA3/JA4 fingerprint, bot tags fields, and detection IDs.
:::note diff --git a/src/content/docs/bots/plans/free.mdx b/src/content/docs/bots/plans/free.mdx index aa0faf4ed401bd2..ecfc16648c89537 100644 --- a/src/content/docs/bots/plans/free.mdx +++ b/src/content/docs/bots/plans/free.mdx @@ -19,7 +19,44 @@ import { Render } from "~/components" ## Free features - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Plan nameBot Fight Mode
AvailabilityAll Free customers
ConfigurationGo to Security > Bots
EnablementToggle in Security > Bots
Type of bots detectedSimple bots (from cloud ASNs) and headless browsers
ActionsCloudflare issues a computationally expensive challenge
Additional controlApplied to all traffic across a domain
## How do I get started? diff --git a/src/content/docs/bots/plans/pro.mdx b/src/content/docs/bots/plans/pro.mdx index 7f9d90e937dee16..ddded82aa764656 100644 --- a/src/content/docs/bots/plans/pro.mdx +++ b/src/content/docs/bots/plans/pro.mdx @@ -19,7 +19,48 @@ import { Render } from "~/components" ## Pro features - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Plan nameSuper Bot Fight Mode
AvailabilityAll Pro customers
ConfigurationGo to Security > Bots > Configure Super Bot Fight Mode
EnablementToggle in Security > Bots
Type of bots detectedSimple bots and headless browsers
ActionsCustomer chooses whether to allow, block, or challenge
AnalyticsLimited analytics available in a Bot Report
Additional controlApplied to all traffic across a domain
## How do I get started? diff --git a/src/content/docs/bots/reference/bot-management-variables.mdx b/src/content/docs/bots/reference/bot-management-variables.mdx index 356a3cb7afc3109..79e309f5d5fd85d 100644 --- a/src/content/docs/bots/reference/bot-management-variables.mdx +++ b/src/content/docs/bots/reference/bot-management-variables.mdx @@ -10,16 +10,46 @@ import { Render } from "~/components" ## Ruleset Engine fields - +Bot Management provides access to several [new variables](/ruleset-engine/rules-language/fields/reference/?field-category=Bots) within the expression builder of Ruleset Engine-based products such as [WAF custom rules](/waf/custom-rules/). + +- **Bot Score** (`cf.bot_management.score`): An integer between 1-99 that indicates [Cloudflare's level of certainty](/bots/concepts/bot-score/) that a request comes from a bot. +- **Verified Bot** (`cf.bot_management.verified_bot`): A boolean value that is true if the request comes from a good bot, like Google or Bing. Most customers choose to allow this traffic. For more details, see [Traffic from known bots](/waf/troubleshooting/faq/#how-does-the-waf-handle-traffic-from-known-bots). +- **Serves Static Resource** (`cf.bot_management.static_resource`): An identifier that matches [file extensions](/bots/additional-configurations/static-resources/) for many types of static resources. Use this variable if you send emails that retrieve static images. +- **ja3Hash** (`cf.bot_management.ja3_hash`) and **ja4** (`cf.bot_management.ja4`): A [**JA3/JA4 fingerprint**](/bots/additional-configurations/ja3-ja4-fingerprint/) helps you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. +- **Bot Detection IDs** (`cf.bot_management.detection_ids`): List of IDs that correlate to the Bot Management heuristic detections made on a request (you can have multiple heuristic detections on the same request). +- **Verified Bot Categories** (`cf.verified_bot_category`): A string that allows you to segment your verified bot traffic by its [type and purpose](/bots/concepts/bot/verified-bots/categories/). ## Workers variables - +These variables are also available as part of the [request.cf](/workers/runtime-apis/request/#incomingrequestcfproperties) object via Cloudflare Workers: + +- `request.cf.botManagement.score` +- `request.cf.botManagement.verifiedBot` +- `request.cf.botManagement.staticResource` +- `request.cf.botManagement.ja3Hash` +- `request.cf.botManagement.ja4` +- `request.cf.botManagement.jsDetection.passed` +- `request.cf.botManagement.detectionIds` +- `request.cf.verifiedBotCategory` ## Corporate Proxy - +The Bot Management Corporate Proxy field contains identified cloud-based corporate proxies and secure web gateways that are Enterprise-only, and provide outbound security services to their clients. + +You can access the Corporate Proxy field in [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), or [Workers](/workers/) to provide different security rules for traffic from these sources. You can also exempt them from rules using Bot Management scores. + +```txt title="Example" +not cf.bot_management.verified_bot +and not cf.bot_management.static_resource +and not cf.bot_management.corporate_proxy +and cf.bot_management.score lt 30 +``` ## Log fields - +Once you enable Bot Management, Cloudflare also surfaces bot information in its [HTTP requests log fields](/logs/reference/log-fields/zone/http_requests/): + +- BotDetectionIDs +- BotScore +- BotScoreSrc +- BotTags \ No newline at end of file diff --git a/src/content/docs/bots/troubleshooting/wordpress-loopback-issue.mdx b/src/content/docs/bots/troubleshooting/wordpress-loopback-issue.mdx index 5e02bb1bf20d72e..7589d3cc1d5ca11 100644 --- a/src/content/docs/bots/troubleshooting/wordpress-loopback-issue.mdx +++ b/src/content/docs/bots/troubleshooting/wordpress-loopback-issue.mdx @@ -8,7 +8,7 @@ sidebar: import { Tabs, TabItem, Steps, Render } from '~/components'; -
+When users attempt to run diagnostics in the Site Status page for WordPress installations, loopback issues arise when our bot detection services block them. WordPress relies on making loopback requests to monitor and occasionally administer its websites. Customers can opt-in to optimize Super Bot Fight Mode for WordPress. If this feature is enabled, automated loopback requests made by your WordPress site will be authorized even when Super Bot Fight Mode blocks other bots. diff --git a/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx b/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx index 7c7e6250fca2274..f44df2d52d67f43 100644 --- a/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx +++ b/src/content/docs/cloudflare-challenges/challenge-types/javascript-detections.mdx @@ -7,11 +7,36 @@ sidebar: order: 3 --- -import { Render, Tabs, TabItem } from "~/components" +import { Render, Tabs, TabItem, GlossaryTooltip } from "~/components" - +JavaScript Detections is a type of Challenge separate from Cloudflare’s Challenge Pages or Turnstile. Javascript Detections helps Cloudflare's [bot solutions](/bots/) identify automated requests. - +While Challenge Pages and Turnstile rely on client-side signals to determine the authenticity of a request, Bot Management’s JavaScript Detections relies on network-side signals and run on every single request made to your website. + +## Process + +JavaScript Detections is implemented on your website via a lightweight, invisible JavaScript code snippet that follows Cloudflare's [privacy standards](https://www.cloudflare.com/privacypolicy/). + +JavaScript is injected only in response to requests for HTML pages or page views, excluding AJAX calls. API and mobile application traffic is unaffected. + +JavaScript Detections has a lifespan of 15 minutes. However, the code is injected again before the session expires. After page load, the script is deferred and utilizes a separate thread (where available) to ensure that performance impact is minimal. The snippets of JavaScript will contain a source pointing to the Challenge Platform, with paths that start with `/cdn-cgi/challenge-platform/…` + +Once JavaScript Detections is injected on the HTML page, the visitor's browser will run the JavaScript code snippet and a `cf_clearance` cookie is issued to the visitor. The information in JavaScript Detections is stored in the `cf_clearance` cookie and is used to populate `js_detection.passed`. + +- If the visitor is verified and a `cf_clearance` cookie is issued, it will contain the outcome: `cf.bot_management.js.detection.passed` = `true` +- If the verification fails, the cookie will contain the outcome: `cf.bot_management.js.detection.passed` = `false` + +:::note +The `cf_clearance` cookie cannot exceed the maximum size of 4096 bytes. +::: + +:::caution +Enforcement against bots does **not** occur even if the cookie is flagged false. + +You must enable JavaScript Detections and then create a custom WAF rule using the `cf.bot_management.js.detection.passed` field to block or challenge a failed request. +::: + +When the visitor encounters a WAF custom rule on your website, the rule will check the outcome of the `cf_clearance` cookie. The outcome of the `cf_clearance` cookie determines whether the request passes, or is blocked or challenged. Refer to the steps below to enable and enforce JavaScript Detections. @@ -27,7 +52,38 @@ For more details on how to set up bot protection, refer to the [Bots documentati ## 2. Enforce execution of JavaScript Detections - +Once you enable JavaScript detections, you must use the `cf.bot_management.js_detection.passed` field to create [WAF custom rules](/waf/custom-rules/) (or the `request.cf.botManagement.jsDetection.passed` variable in [Workers](/workers/)). + +When adding this field to WAF custom rules, it is used on endpoints expecting browser traffic (avoiding native mobile applications or websocket endpoints), after a user's first request to your application (Cloudflare needs at least one HTML request before injecting JavaScript detection), and with the Managed Challenge action, because there are legitimate reasons a user might not have passed a JavaScript Detection challenge (network issues, ad blockers, disabled JavaScript in browser, native mobile applications). + +### Prerequisites + +- You must have JavaScript Detections enabled on your zone. +- You must have [updated your Content Security Policy headers](/cloudflare-challenges/challenge-types/javascript-detections/#if-you-have-a-content-security-policy-csp) for JavaScript detections. +- You must not run this field on websocket endpoints. +- You must use the field in a custom rules expression that expects only browser traffic. +- The action should always be a managed challenge in case a legitimate user has not received the challenge for network or browser reasons. +- The path specified in the rule builder should never be the first HTML page a user visits when browsing your site. + +The `cf.bot_management.js_detection.passed` field should never be used in a WAF custom rule that matches a visitor's first request to a site. It is necessary to have at least one HTML request before Cloudflare can inject JavaScript detection. + + + + ```txt wrap + (http.request.uri.path eq "/api/v4/user/create" and http.request.method eq "POST" and not cf.bot_management.verified_bot) + and (cf.bot_management.score lt 30 or !cf.bot_management.js_detection.passed) + ``` + + + ```js + "botManagement": { + "jsDetection": { + "passed": false + } + } + ``` + + Refer to the [WAF documentation](/waf/custom-rules/create-dashboard/) for more information on creating a custom rule. @@ -85,7 +141,14 @@ Subsequent requests can include a `cf_clearance` cookie if JavaScript ran succes ### If you have a Content Security Policy (CSP) - +If you have a Content Security Policy (CSP), you need to take additional steps to implement JavaScript Detections: + +- Ensure that anything under `/cdn-cgi/challenge-platform/` is allowed. Your CSP should allow scripts served from your origin domain (`script-src self`). +- For `nonce` script tags: + + - If your CSP uses a `nonce` for script tags, Cloudflare will add these nonces to the scripts it injects by parsing your CSP response header. + + - If your CSP does not use `nonce` for script tags and **JavaScript Detections** is enabled, you may see a console error such as `Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-b123b8a70+4jEj+d6gWI9U6IilUJIrlnRJbRR/uQl2Jc='), or a nonce ('nonce-...') is required to enable inline execution.` We highly discourage the use of `unsafe-inline` and instead recommend the use CSP `nonces` in script tags which we parse and support in our CDN. :::caution[Warning] diff --git a/src/content/partials/api-shield/blog-post.mdx b/src/content/partials/api-shield/blog-post.mdx deleted file mode 100644 index 3fc60d12a56b2b9..000000000000000 --- a/src/content/partials/api-shield/blog-post.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -For more technical details, see our [blog post](https://blog.cloudflare.com/ml-api-discovery-and-schema-learning/). diff --git a/src/content/partials/api-shield/routing-limitations.mdx b/src/content/partials/api-shield/routing-limitations.mdx deleted file mode 100644 index d1603c38782ac4a..000000000000000 --- a/src/content/partials/api-shield/routing-limitations.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -{} - ---- - -The Target Endpoint cannot be routed to a Worker if the route is to the same zone. - -You cannot change the method of a request. For example, a `GET` Source Endpoint will always send a `GET` request to the Target Endpoint. - -You must use all of the variables in the Target Endpoint that appear in the Source Endpoint. For example, routing `/api/{var1}/users/{var2}` to `/api/users/{var2}` is not allowed and will result in an error since `{var1}` is present in the Source Endpoint but not in the Target Endpoint. diff --git a/src/content/partials/api-shield/routing-path-variables.mdx b/src/content/partials/api-shield/routing-path-variables.mdx deleted file mode 100644 index 0937c2041b7569d..000000000000000 --- a/src/content/partials/api-shield/routing-path-variables.mdx +++ /dev/null @@ -1,9 +0,0 @@ ---- -{} - ---- - -:::note - -You can reorder path variables if they are present. For example, you can route `/api/{var1}/users/{var2}` to `/{var2}/users/{var1}`. Segments of the path that are not variables may be added or omitted entirely. -::: diff --git a/src/content/partials/api-shield/routing.mdx b/src/content/partials/api-shield/routing.mdx deleted file mode 100644 index 15b730619728156..000000000000000 --- a/src/content/partials/api-shield/routing.mdx +++ /dev/null @@ -1,29 +0,0 @@ ---- -inputParameters: param1;;param2 - ---- - -import { Markdown, Steps, Tabs, TabItem } from "~/components" - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. - 2. Go to **Security** > **API Shield**. - 3. In **Endpoint Management**, select an existing endpoint and expand its details. - 4. Under **Routing**, select **Create route**. - 5. Enter the target URL or IP address to route your endpoint to. - 6. Select **Deploy route**. - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Go to **Security** > **Web assets**. - 3. In **Endpoints**, select an existing endpoint and expand its details. - 4. Under **Routing**, select **Create route**. - 5. Enter the target URL or IP address to route your endpoint to. - 6. Select **Deploy route**. - - - diff --git a/src/content/partials/api-shield/source-endpoints.mdx b/src/content/partials/api-shield/source-endpoints.mdx deleted file mode 100644 index 4961faa941c92cf..000000000000000 --- a/src/content/partials/api-shield/source-endpoints.mdx +++ /dev/null @@ -1,31 +0,0 @@ ---- -{} - ---- - -import { Steps, Tabs, TabItem } from "~/components" - -You must add Source Endpoints to Endpoint Management through established methods, including [uploading a schema](/api-shield/security/schema-validation/#add-validation-by-uploading-a-schema), via [API Discovery](/api-shield/security/api-discovery/), or by [adding manually](/api-shield/management-and-monitoring/#add-endpoints-manually), before creating a route. - -To create a route, you will need the operation ID of the Source Endpoint. To find the operation ID in the dashboard: - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. - 2. Select **Security** > **API Shield**. - 3. Filter the endpoints to find your **Source Endpoint**. - 4. Expand the row for your Source Endpoint and note the **operation ID** field. - 5. Select the copy icon to copy the operation ID to your clipboard. - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Select **Security** > **Web assets**. - 3. Filter the endpoints to find your **Source Endpoint**. - 4. Expand the row for your Source Endpoint and note the **operation ID** field. - 5. Select the copy icon to copy the operation ID to your clipboard. - - - \ No newline at end of file diff --git a/src/content/partials/api-shield/why-care.mdx b/src/content/partials/api-shield/why-care.mdx deleted file mode 100644 index 0ab39857ed43974..000000000000000 --- a/src/content/partials/api-shield/why-care.mdx +++ /dev/null @@ -1,13 +0,0 @@ ---- -{} - ---- - -APIs have become the [backbone of popular web services](https://blog.postman.com/intro-to-apis-history-of-apis/), helping the Internet become more accessible and useful. - -As APIs have become more prevalent, however, so have their problems: - -* Many companies have [thousands of APIs](/api-shield/security/api-discovery/), including ones they do not even know about. -* To support a large base of users, many APIs are protected by a negative security model that makes them vulnerable to credential-stuffing attacks and automated scanning tools. -* With so many endpoints and users, it’s difficult to recognize brute-force attacks against [specific endpoints](/api-shield/security/volumetric-abuse-detection/). -* Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon [usage patterns](/api-shield/security/sequence-analytics/). diff --git a/src/content/partials/bots/about-plan-biz-and-ent.mdx b/src/content/partials/bots/about-plan-biz-and-ent.mdx deleted file mode 100644 index fdf511a428899a4..000000000000000 --- a/src/content/partials/bots/about-plan-biz-and-ent.mdx +++ /dev/null @@ -1,49 +0,0 @@ ---- -{} - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Plan nameSuper Bot Fight Mode
AvailabilityAll Business customers and Enterprise customers without Bot Management*
ConfigurationGo to Security > Bots > Configure Super Bot Fight Mode
EnablementToggle in Security > Bots
Type of bots detectedSimple bots, headless browsers, and many sophisticated bots
ActionsCustomer chooses whether to allow, block, or challenge
AnalyticsDedicated Bot Analytics tool, available in Security
Additional controlApplied to all traffic across a domain
- -\*When users purchase Bot Management for Enterprise, Cloudflare automatically replaces and disables other bot products to prevent overlap. diff --git a/src/content/partials/bots/about-plan-bm-subscription.mdx b/src/content/partials/bots/about-plan-bm-subscription.mdx deleted file mode 100644 index 9acdbdeb630ef0b..000000000000000 --- a/src/content/partials/bots/about-plan-bm-subscription.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -{} - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Plan nameBot Management for Enterprise
AvailabilityAdded to Enterprise plans by your account team
ConfigurationGo to Security > Bots > Configure Bot Management
EnablementQuick onboarding with help from our Solutions Engineering team
Type of bots detectedSimple and sophisticated bots, headless browsers, and domain-specific anomalies
ActionsCustomer chooses from several options, including block and various challenges
AnalyticsDedicated Bot Analytics tool, available in Security
Additional controlAbility to restrict by path, IP address, and more. Access to bot score, JA3/JA4 fingerprint, bot tags fields, and detection IDs.
diff --git a/src/content/partials/bots/about-plan-free.mdx b/src/content/partials/bots/about-plan-free.mdx deleted file mode 100644 index 1a1f57fbdd87357..000000000000000 --- a/src/content/partials/bots/about-plan-free.mdx +++ /dev/null @@ -1,43 +0,0 @@ ---- -{} - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Plan nameBot Fight Mode
AvailabilityAll Free customers
ConfigurationGo to Security > Bots
EnablementToggle in Security > Bots
Type of bots detectedSimple bots (from cloud ASNs) and headless browsers
ActionsCloudflare issues a computationally expensive challenge
Additional controlApplied to all traffic across a domain
diff --git a/src/content/partials/bots/about-plan-pro.mdx b/src/content/partials/bots/about-plan-pro.mdx deleted file mode 100644 index a13b7c753dbd1be..000000000000000 --- a/src/content/partials/bots/about-plan-pro.mdx +++ /dev/null @@ -1,47 +0,0 @@ ---- -{} - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Plan nameSuper Bot Fight Mode
AvailabilityAll Pro customers
ConfigurationGo to Security > Bots > Configure Super Bot Fight Mode
EnablementToggle in Security > Bots
Type of bots detectedSimple bots and headless browsers
ActionsCustomer chooses whether to allow, block, or challenge
AnalyticsLimited analytics available in a Bot Report
Additional controlApplied to all traffic across a domain
diff --git a/src/content/partials/bots/account-takeover-detections.mdx b/src/content/partials/bots/account-takeover-detections.mdx deleted file mode 100644 index c6a6b119bdcd4bc..000000000000000 --- a/src/content/partials/bots/account-takeover-detections.mdx +++ /dev/null @@ -1,12 +0,0 @@ ---- -{} - ---- - -Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), and [Workers](/workers/). - -| Detection ID | Description | -| ------------ | ---------------------------------------- | -| `201326592` | Observes all login failures to the zone. | -| `201326593` | Observes all login traffic to the zone. | -| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone.

When the ID matches a login failure, Bot Management sets the [bot score](/bots/concepts/bot-score/) to 2 and [anomaly detection](/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. | \ No newline at end of file diff --git a/src/content/partials/bots/ai-labyrinth-enable.mdx b/src/content/partials/bots/ai-labyrinth-enable.mdx deleted file mode 100644 index 8d293f163712fa4..000000000000000 --- a/src/content/partials/bots/ai-labyrinth-enable.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -inputParameters: param1 - ---- - -import { Markdown } from "~/components" - -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Bots**. -3. Select **Configure {props.one}**. -4. Enable **AI Labyrinth**. \ No newline at end of file diff --git a/src/content/partials/bots/bfm-ruleset-engine.mdx b/src/content/partials/bots/bfm-ruleset-engine.mdx deleted file mode 100644 index 92947a49fdd3081..000000000000000 --- a/src/content/partials/bots/bfm-ruleset-engine.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -Super Bot Fight Mode runs during the `http_request_sbfm` phase of the [Ruleset Engine](/ruleset-engine/about/phases/). diff --git a/src/content/partials/bots/bm-bot-detection-engines.mdx b/src/content/partials/bots/bm-bot-detection-engines.mdx deleted file mode 100644 index 299e58c4b3b2446..000000000000000 --- a/src/content/partials/bots/bm-bot-detection-engines.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -{} - ---- - -import { Render } from "~/components" - -### Heuristics - - - -The Heuristics engine immediately gives automated requests a score of 1. - -### Machine learning - - - -The ML engine produces scores 2 through 99. - -### Anomaly detection - - - -### JavaScript detections - - - -JSD is enabled by default but completely optional. To adjust your settings, open the Bot Management Configuration page from **Security** > **Bots**. diff --git a/src/content/partials/bots/bot-analytics-traffic-characteristics.mdx b/src/content/partials/bots/bot-analytics-traffic-characteristics.mdx deleted file mode 100644 index ea1d94ecfe5ab65..000000000000000 --- a/src/content/partials/bots/bot-analytics-traffic-characteristics.mdx +++ /dev/null @@ -1,13 +0,0 @@ ---- -{} - ---- - -Pay specific attention to: - -* Which endpoints are being targeted. -* The top non-Mozilla user agents. -* Traffic from Outlook or Office user-agents. -* Traffic from cloud-based Secure Web Gateways (ASNs labeled with the proxy provider). -* Traffic from on-premises forward proxies. -* Whether requests come from a predictable IP address and ASN, or have a similar [JA3 fingerprint](/bots/additional-configurations/ja3-ja4-fingerprint/). diff --git a/src/content/partials/bots/bot-fight-mode-definition.mdx b/src/content/partials/bots/bot-fight-mode-definition.mdx deleted file mode 100644 index d2a2de942bae78c..000000000000000 --- a/src/content/partials/bots/bot-fight-mode-definition.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -{} - ---- - -Bot Fight Mode is a simple, free product that helps detect and mitigate bot traffic on your domain. When enabled, the product: - -* Identifies traffic matching patterns of known bots -* Issues computationally expensive challenges in response to these bots -* Notifies [Bandwidth Alliance](https://cloudflare.com/bandwidth-alliance/) partners (if applicable) to disable bots diff --git a/src/content/partials/bots/bot-fight-mode-enable.mdx b/src/content/partials/bots/bot-fight-mode-enable.mdx deleted file mode 100644 index 1ee157a5820947b..000000000000000 --- a/src/content/partials/bots/bot-fight-mode-enable.mdx +++ /dev/null @@ -1,26 +0,0 @@ ---- -{} - ---- -import { Tabs, TabItem, Steps } from '~/components'; - -To start using Bot Fight Mode: - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Go to **Security** > **Bots**. - 3. For **Bot Fight Mode**, select **On**. - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Go to **Security** > **Settings**. - 3. Filter by **Bot traffic**. - 4. Go to **Bot Fight Mode**. - 5. Turn **Bot Fight Mode** on. - - - \ No newline at end of file diff --git a/src/content/partials/bots/bot-groupings.mdx b/src/content/partials/bots/bot-groupings.mdx deleted file mode 100644 index 65d731f18bab4c0..000000000000000 --- a/src/content/partials/bots/bot-groupings.mdx +++ /dev/null @@ -1,12 +0,0 @@ ---- -{} - ---- - -| Category | Range | -| -------------------- | -------------------------------------------------------------------------------------- | -| **Not computed** | Bot scores of 0. | -| **Automated** | Bot scores of 1. | -| **Likely automated** | Bot scores of 2 through 29. | -| **Likely human** | Bot scores of 30 through 99. | -| **Verified bot** | Non-malicious automated traffic (used to power search engines and other applications). | diff --git a/src/content/partials/bots/bot-log-fields.mdx b/src/content/partials/bots/bot-log-fields.mdx deleted file mode 100644 index 6f818351a368821..000000000000000 --- a/src/content/partials/bots/bot-log-fields.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -{} - ---- - -Once you enable Bot Management, Cloudflare also surfaces bot information in its [HTTP requests log fields](/logs/reference/log-fields/zone/http_requests/): - -* BotDetectionIDs -* BotScore -* BotScoreSrc -* BotTags diff --git a/src/content/partials/bots/bot-score-definition.mdx b/src/content/partials/bots/bot-score-definition.mdx deleted file mode 100644 index b057ed2dd761392..000000000000000 --- a/src/content/partials/bots/bot-score-definition.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -{} - ---- - -A bot score is a score from *1* to *99* that indicates how likely that request came from a bot. - -For example, a score of 1 means Cloudflare is quite certain the request was automated, while a score of 99 means Cloudflare is quite certain the request came from a human. diff --git a/src/content/partials/bots/bot-tags-values.mdx b/src/content/partials/bots/bot-tags-values.mdx deleted file mode 100644 index f5838a0b60bf285..000000000000000 --- a/src/content/partials/bots/bot-tags-values.mdx +++ /dev/null @@ -1,18 +0,0 @@ ---- -{} - ---- - -The following values are **examples** of what may be present in the `BotTags` log field, but not an exhaustive list: - -* api -* google -* bing -* googleAds -* googleMedia -* googleImageProxy -* pinterest -* newRelic -* baidu -* apple -* yandex diff --git a/src/content/partials/bots/bot-tags.mdx b/src/content/partials/bots/bot-tags.mdx deleted file mode 100644 index 0f56f5e49163c81..000000000000000 --- a/src/content/partials/bots/bot-tags.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -{} - ---- - -import { GlossaryTooltip } from "~/components" - -Bot tags provide more detail about *why* Cloudflare assigned a bot score to a request. diff --git a/src/content/partials/bots/bots-cs.mdx b/src/content/partials/bots/bots-cs.mdx deleted file mode 100644 index 7e65e59c38e0ada..000000000000000 --- a/src/content/partials/bots/bots-cs.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -{} - ---- - -import { GlossaryTooltip } from "~/components" - -**Cloudflare Service** is a special bot score source for Enterprise Zero Trust to avoid false positives. diff --git a/src/content/partials/bots/bots-nc.mdx b/src/content/partials/bots/bots-nc.mdx deleted file mode 100644 index a05af9c4616347c..000000000000000 --- a/src/content/partials/bots/bots-nc.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -A bot score of 0 means Bot Management did not run on the request. Cloudflare does not run Bot Management on internal service requests that Bot Management has no interest in blocking. diff --git a/src/content/partials/bots/corporate_proxy.mdx b/src/content/partials/bots/corporate_proxy.mdx deleted file mode 100644 index 5cd2e6bb8faa984..000000000000000 --- a/src/content/partials/bots/corporate_proxy.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -{} - ---- - -The Bot Management Corporate Proxy field contains identified cloud-based corporate proxies and secure web gateways that are Enterprise-only, and provide outbound security services to their clients. - -You can access the Corporate Proxy field in [custom rules](/waf/custom-rules/), [rate limiting rules](/waf/rate-limiting-rules/), or [Workers](/workers/) to provide different security rules for traffic from these sources. You can also exempt them from rules using Bot Management scores. - -```txt title="Example" -not cf.bot_management.verified_bot -and not cf.bot_management.static_resource -and not cf.bot_management.corporate_proxy -and cf.bot_management.score lt 30 -``` diff --git a/src/content/partials/bots/detection-ids.mdx b/src/content/partials/bots/detection-ids.mdx deleted file mode 100644 index ef865115b1a75e7..000000000000000 --- a/src/content/partials/bots/detection-ids.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -Detection IDs are static rules used to detect predictable bot behavior with no overlap with human traffic. Detection IDs refer to the precise [detection](/bots/concepts/bot-detection-engines/) used to identify a bot, which could be from heuristics, verified bot detections, or anomaly detections. For example, a detection ID can identify if you sent your headers in a different order than what was expected of your browser. diff --git a/src/content/partials/bots/disable-sbfm.mdx b/src/content/partials/bots/disable-sbfm.mdx deleted file mode 100644 index 3cb268a6d3094e5..000000000000000 --- a/src/content/partials/bots/disable-sbfm.mdx +++ /dev/null @@ -1,32 +0,0 @@ ---- -{} - ---- -import { Tabs, TabItem, Steps } from '~/components'; - -If you find that **Super Bot Fight Mode** is causing problems with your application traffic, you may want to disable it. - -To disable Super Bot Fight Mode: - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Go to **Security** > **Bots**. - 3. Select **Configure Super Bot Fight Mode**. - 4. For all bot groupings (**Definitely automated**, **Verified bots**, etc.), set the value to **Allow**. - 5. For all other options (**Static resource protection**, **JavaScript Detections**), ensure they are off. - - - - - 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. - 2. Go to **Security** > **Settings**. - 3. Filter by **Bot traffic**. - 4. Go to **Super Bot Fight Mode**. - 5. Turn **Super Bot Fight Mode** off. - 6. For all bot groupings (**Definitely automated traffic**, **Verified bots**), select the edit icon and set the value to **Allow**. - 7. For all other options (**Static resource protection**, **JavaScript detections**, **Optimize for WordPress**), select the edit icon and ensure they are off. - - - \ No newline at end of file diff --git a/src/content/partials/bots/enable-managed-robots-txt.mdx b/src/content/partials/bots/enable-managed-robots-txt.mdx deleted file mode 100644 index aedcfc38612b258..000000000000000 --- a/src/content/partials/bots/enable-managed-robots-txt.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -inputParameters: params1 - ---- - -import { Markdown } from "~/components" - -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Bots**. -3. Select **Configure {props.one}**. -4. Turn **Manage bot traffic with robots.txt** on. \ No newline at end of file diff --git a/src/content/partials/bots/firewall-variables.mdx b/src/content/partials/bots/firewall-variables.mdx deleted file mode 100644 index b7a1c0ac1928498..000000000000000 --- a/src/content/partials/bots/firewall-variables.mdx +++ /dev/null @@ -1,12 +0,0 @@ ---- -{} ---- - -Bot Management provides access to several [new variables](/ruleset-engine/rules-language/fields/reference/?field-category=Bots) within the expression builder of Ruleset Engine-based products such as [WAF custom rules](/waf/custom-rules/). - -- **Bot Score** (`cf.bot_management.score`): An integer between 1-99 that indicates [Cloudflare's level of certainty](/bots/concepts/bot-score/) that a request comes from a bot. -- **Verified Bot** (`cf.bot_management.verified_bot`): A boolean value that is true if the request comes from a good bot, like Google or Bing. Most customers choose to allow this traffic. For more details, see [Traffic from known bots](/waf/troubleshooting/faq/#how-does-the-waf-handle-traffic-from-known-bots). -- **Serves Static Resource** (`cf.bot_management.static_resource`): An identifier that matches [file extensions](/bots/additional-configurations/static-resources/) for many types of static resources. Use this variable if you send emails that retrieve static images. -- **ja3Hash** (`cf.bot_management.ja3_hash`) and **ja4** (`cf.bot_management.ja4`): A [**JA3/JA4 fingerprint**](/bots/additional-configurations/ja3-ja4-fingerprint/) helps you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. -- **Bot Detection IDs** (`cf.bot_management.detection_ids`): List of IDs that correlate to the Bot Management heuristic detections made on a request (you can have multiple heuristic detections on the same request). -- **Verified Bot Categories** (`cf.verified_bot_category`): A string that allows you to segment your verified bot traffic by its [type and purpose](/bots/concepts/bot/verified-bots/categories/). diff --git a/src/content/partials/bots/get-started-pro-biz-steps.mdx b/src/content/partials/bots/get-started-pro-biz-steps.mdx deleted file mode 100644 index 9124ecdb0f3d5dd..000000000000000 --- a/src/content/partials/bots/get-started-pro-biz-steps.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -{} ---- - -import { Tabs, TabItem, Steps } from '~/components'; - -To start using Super Bot Fight Mode: - - - -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. -2. Go to **Security** > **Bots**. -3. Select **Configure Super Bot Fight Mode**. -4. - Choose how your domain should respond to various types of traffic: - - - For more details on verified bots, refer to [Verified Bots](/bots/concepts/bot/#verified-bots). - - For more details on supported file types, refer to [Static resource protection](/bots/additional-configurations/static-resources/). - - For more details on invisible code injection, refer to [JavaScript detections](/bots/additional-configurations/javascript-detections/). - - - - -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain. -2. Go to **Security** > **Settings**. -3. Filter by **Bot traffic**. -4. Go to **Super Bot Fight Mode**. -6. Turn **Super Bot Fight Mode** on. -7. Choose how your domain should respond to various types of traffic by selecting the associated edit icon: - - - For more details on verified bots, refer to [Verified Bots](/bots/concepts/bot/#verified-bots). - - For more details on supported file types, refer to [Static resource protection](/bots/additional-configurations/static-resources/). - - For more details on invisible code injection, refer to [JavaScript detections](/bots/additional-configurations/javascript-detections/). - - For more details on WordPress optimization, refer to [Super Bot Fight Mode for WordPress](/bots/troubleshooting/wordpress-loopback-issue/). - - - - -:::caution[Warning] - -If your organization also uses [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/), keep **Definitely Automated** set to **Allow**. Otherwise, tunnels might fail with a `websocket: bad handshake` error. -::: diff --git a/src/content/partials/bots/ja3-fingerprint.mdx b/src/content/partials/bots/ja3-fingerprint.mdx deleted file mode 100644 index 66c7dd27fcce57a..000000000000000 --- a/src/content/partials/bots/ja3-fingerprint.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. diff --git a/src/content/partials/bots/ja4-fingerprint.mdx b/src/content/partials/bots/ja4-fingerprint.mdx deleted file mode 100644 index 9152b40af3c6179..000000000000000 --- a/src/content/partials/bots/ja4-fingerprint.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -JA4 fingerprint adds new functionality by sorting ClientHello extensions and reducing the total number of unique fingerprints for modern browsers. diff --git a/src/content/partials/bots/list-ai-bots.mdx b/src/content/partials/bots/list-ai-bots.mdx deleted file mode 100644 index d821fbd5e99211e..000000000000000 --- a/src/content/partials/bots/list-ai-bots.mdx +++ /dev/null @@ -1,24 +0,0 @@ ---- -{} ---- - -When you enable this feature, Cloudflare will block the following bots: - -- `Amazonbot` (Amazon) -- `Applebot` (Apple) -- `Bytespider` (ByteDance) -- `ClaudeBot` (Anthropic) -- `DuckAssistBot` (DuckDuckGo) -- `Google-CloudVertexBot` (Google) -- `GoogleOther` (Google) -- `GPTBot` (OpenAI) -- `Meta-ExternalAgent` (Meta) -- `PetalBot` (Huawei) -- `TikTokSpider` (ByteDance) -- `CCBot` (Common Crawl) - -In addition to this list, [verified bots](https://radar.cloudflare.com/bots#verified-bots) that are classified in AI-related categories such as `AI Crawler` or an `Archiver`, as well as a number of unverified bots that behave similarly, are included in the rule. This rule does not include verified bots that fall into the `Search Engine` categories. - -These categories, and the bots classified in these categories, may change from time to time. - -If you are a bot operator and feel your bot may have been incorrectly categorized, [add your bot to the list of verified bots](https://dash.cloudflare.com/?to=/:account/configurations/verified-bots). diff --git a/src/content/partials/bots/rss-labels.mdx b/src/content/partials/bots/rss-labels.mdx deleted file mode 100644 index d22a3e39d0192af..000000000000000 --- a/src/content/partials/bots/rss-labels.mdx +++ /dev/null @@ -1,7 +0,0 @@ ---- -{} ---- - -[Bot Fight Mode](/bots/get-started/bot-fight-mode/) will not block requests to endpoints labeled as `cf-rss-feed`. - -[Super Bot Fight Mode rules](/bots/get-started/super-bot-fight-mode/#ruleset-engine) will not match or challenge requests labeled as `cf-rss-feed`. \ No newline at end of file diff --git a/src/content/partials/bots/static-resources-bm.mdx b/src/content/partials/bots/static-resources-bm.mdx deleted file mode 100644 index dd7d6fc8427b85d..000000000000000 --- a/src/content/partials/bots/static-resources-bm.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -Static resources are protected by default when you create [custom rules](/waf/custom-rules/) using `cf.bot_management.score`. diff --git a/src/content/partials/bots/static-resources-list.mdx b/src/content/partials/bots/static-resources-list.mdx deleted file mode 100644 index b08c7c2ffcc080a..000000000000000 --- a/src/content/partials/bots/static-resources-list.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -{} - ---- - -Static resources are files with the following extensions: - -`ico|jpg|png|jpeg|gif|css|js|tif|tiff|bmp|pict|webp|svg|svgz|class|jar|txt|csv|doc|docx|xls|xlsx|pdf|ps|pls|ppt|pptx|ttf|otf|woff|woff2|eot|eps|ejs|swf|torrent|midi|mid|m3u8|m4a|mp3|ogg|ts` \ No newline at end of file diff --git a/src/content/partials/bots/what-is-a-bot.mdx b/src/content/partials/bots/what-is-a-bot.mdx deleted file mode 100644 index bffea1590f3776a..000000000000000 --- a/src/content/partials/bots/what-is-a-bot.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -A **bot** is a software application programmed to do certain tasks. diff --git a/src/content/partials/bots/which-solution-do-i-need.mdx b/src/content/partials/bots/which-solution-do-i-need.mdx deleted file mode 100644 index c32fa81e66df26e..000000000000000 --- a/src/content/partials/bots/which-solution-do-i-need.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -{} - ---- - -If you have a smaller domain and have identified a bot problem, we recommend Bot Fight Mode or Super Bot Fight Mode, which are included with your plan subscription. You can enable either from your dashboard, but these solutions offer limited configuration options. - -If you have a large domain with a lot of traffic, we recommend Bot Management for Enterprise, especially for customers in ecommerce, banking, and security. To enable Bot Management for Enterprise and write rules to customize your bot protection, contact your account team. - -To see the differences in features and functionality, visit [Plans](/bots/plans/). diff --git a/src/content/partials/bots/wordpress-loopback-definition.mdx b/src/content/partials/bots/wordpress-loopback-definition.mdx deleted file mode 100644 index b57de50017705a3..000000000000000 --- a/src/content/partials/bots/wordpress-loopback-definition.mdx +++ /dev/null @@ -1,6 +0,0 @@ ---- -{} - ---- - -When users attempt to run diagnostics in the Site Status page for WordPress installations, loopback issues arise when our bot detection services block them. diff --git a/src/content/partials/bots/workers-cf-request.mdx b/src/content/partials/bots/workers-cf-request.mdx deleted file mode 100644 index 5daae2ecd36915c..000000000000000 --- a/src/content/partials/bots/workers-cf-request.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -{} - ---- - -These variables are also available as part of the [request.cf](/workers/runtime-apis/request/#incomingrequestcfproperties) object via Cloudflare Workers: - -- `request.cf.botManagement.score` -- `request.cf.botManagement.verifiedBot` -- `request.cf.botManagement.staticResource` -- `request.cf.botManagement.ja3Hash` -- `request.cf.botManagement.ja4` -- `request.cf.botManagement.jsDetection.passed` -- `request.cf.botManagement.detectionIds` -- `request.cf.verifiedBotCategory` diff --git a/src/content/partials/cloudflare-challenges/javascript-detections-csp.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-csp.mdx deleted file mode 100644 index 4ff6035224cd674..000000000000000 --- a/src/content/partials/cloudflare-challenges/javascript-detections-csp.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -{} - ---- - -import { GlossaryTooltip } from "~/components" - -If you have a Content Security Policy (CSP), you need to take additional steps to implement JavaScript Detections: - -- Ensure that anything under `/cdn-cgi/challenge-platform/` is allowed. Your CSP should allow scripts served from your origin domain (`script-src self`). -- For `nonce` script tags: - - - If your CSP uses a `nonce` for script tags, Cloudflare will add these nonces to the scripts it injects by parsing your CSP response header. - - - If your CSP does not use `nonce` for script tags and **JavaScript Detections** is enabled, you may see a console error such as `Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-b123b8a70+4jEj+d6gWI9U6IilUJIrlnRJbRR/uQl2Jc='), or a nonce ('nonce-...') is required to enable inline execution.` We highly discourage the use of `unsafe-inline` and instead recommend the use CSP `nonces` in script tags which we parse and support in our CDN. diff --git a/src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx deleted file mode 100644 index 52feb34f4eb3f68..000000000000000 --- a/src/content/partials/cloudflare-challenges/javascript-detections-definition.mdx +++ /dev/null @@ -1,9 +0,0 @@ ---- -{} ---- - -import { Markdown } from "~/components" - -JavaScript Detections is a type of Challenge separate from Cloudflare’s Challenge Pages or Turnstile. Javascript Detections helps Cloudflare's [bot solutions](/bots/) identify automated requests. - -While Challenge Pages and Turnstile rely on client-side signals to determine the authenticity of a request, Bot Management’s JavaScript Detections relies on network-side signals and run on every single request made to your website. \ No newline at end of file diff --git a/src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx deleted file mode 100644 index aba69cb8c708697..000000000000000 --- a/src/content/partials/cloudflare-challenges/javascript-detections-implementation.mdx +++ /dev/null @@ -1,39 +0,0 @@ ---- -{} - ---- - -import { Tabs, TabItem } from "~/components"; - -Once you enable JavaScript detections, you must use the `cf.bot_management.js_detection.passed` field to create [WAF custom rules](/waf/custom-rules/) (or the `request.cf.botManagement.jsDetection.passed` variable in [Workers](/workers/)). - -When adding this field to WAF custom rules, it is used on endpoints expecting browser traffic (avoiding native mobile applications or websocket endpoints), after a user's first request to your application (Cloudflare needs at least one HTML request before injecting JavaScript detection), and with the Managed Challenge action, because there are legitimate reasons a user might not have passed a JavaScript Detection challenge (network issues, ad blockers, disabled JavaScript in browser, native mobile applications). - -### Prerequisites - -- You must have JavaScript Detections enabled on your zone. -- You must have [updated your Content Security Policy headers](/cloudflare-challenges/challenge-types/javascript-detections/#if-you-have-a-content-security-policy-csp) for JavaScript detections. -- You must not run this field on websocket endpoints. -- You must use the field in a custom rules expression that expects only browser traffic. -- The action should always be a managed challenge in case a legitimate user has not received the challenge for network or browser reasons. -- The path specified in the rule builder should never be the first HTML page a user visits when browsing your site. - -The `cf.bot_management.js_detection.passed` field should never be used in a WAF custom rule that matches a visitor's first request to a site. It is necessary to have at least one HTML request before Cloudflare can inject JavaScript detection. - - - - ```txt wrap - (http.request.uri.path eq "/api/v4/user/create" and http.request.method eq "POST" and not cf.bot_management.verified_bot) - and (cf.bot_management.score lt 30 or !cf.bot_management.js_detection.passed) - ``` - - - ```js - "botManagement": { - "jsDetection": { - "passed": false - } - } - ``` - - \ No newline at end of file diff --git a/src/content/partials/cloudflare-challenges/javascript-detections-process.mdx b/src/content/partials/cloudflare-challenges/javascript-detections-process.mdx deleted file mode 100644 index 0c9df0319667635..000000000000000 --- a/src/content/partials/cloudflare-challenges/javascript-detections-process.mdx +++ /dev/null @@ -1,30 +0,0 @@ ---- -{} ---- - -import { Markdown } from "~/components"; - -## Process - -JavaScript Detections is implemented on your website via a lightweight, invisible JavaScript code snippet that follows Cloudflare's [privacy standards](https://www.cloudflare.com/privacypolicy/). - -JavaScript is injected only in response to requests for HTML pages or page views, excluding AJAX calls. API and mobile application traffic is unaffected. - -JavaScript Detections has a lifespan of 15 minutes. However, the code is injected again before the session expires. After page load, the script is deferred and utilizes a separate thread (where available) to ensure that performance impact is minimal. The snippets of JavaScript will contain a source pointing to the Challenge Platform, with paths that start with `/cdn-cgi/challenge-platform/…` - -Once JavaScript Detections is injected on the HTML page, the visitor's browser will run the JavaScript code snippet and a `cf_clearance` cookie is issued to the visitor. The information in JavaScript Detections is stored in the `cf_clearance` cookie and is used to populate `js_detection.passed`. - -- If the visitor is verified and a `cf_clearance` cookie is issued, it will contain the outcome: `cf.bot_management.js.detection.passed` = `true` -- If the verification fails, the cookie will contain the outcome: `cf.bot_management.js.detection.passed` = `false` - -:::note -The `cf_clearance` cookie cannot exceed the maximum size of 4096 bytes. -::: - -:::caution -Enforcement against bots does **not** occur even if the cookie is flagged false. - -You must enable JavaScript Detections and then create a custom WAF rule using the `cf.bot_management.js.detection.passed` field to block or challenge a failed request. -::: - -When the visitor encounters a WAF custom rule on your website, the rule will check the outcome of the `cf_clearance` cookie. The outcome of the `cf_clearance` cookie determines whether the request passes, or is blocked or challenged. \ No newline at end of file