Bot Fight Mode is enabled

​

What this check verifies

Cloudflare zones are assessed for Bot Fight Mode configuration by checking if it is enabled to detect and mitigate automated bot traffic targeting the zone through browser integrity checks.

​

Risk

Without Bot Fight Mode, zones are vulnerable to automated attacks.

• Confidentiality: web scraping bots can harvest sensitive data from your site
• Integrity: credential stuffing attacks can compromise user accounts
• Availability: bot traffic can overwhelm resources causing service degradation

​

Recommendation

Enable Bot Fight Mode as part of a layered bot management strategy.

• Detects and challenges automated bot traffic
• Protects against web scraping and credential stuffing
• Combine with rate limiting and WAF rules for comprehensive protection
• Monitor bot analytics to understand traffic patterns

​

Remediation

Dashboard steps

1. Log in to the Cloudflare dashboard and select your account and domain
2. Go to Security > Bots
3. Enable Bot Fight Mode
4. Monitor bot analytics to fine-tune protection
5. Consider combining with rate limiting for comprehensive protection

​

References

• https://developers.cloudflare.com/bots/get-started/free/

​

Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_bot_fight_mode_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Cloudflare checks