Bot scores

A bot score is a score from 1 to 99 that indicates how likely that request came from a bot. For example, a score of 1 means Cloudflare is quite certain the request was automated, while a score of 99 means Cloudflare is quite certain the request came from a human.

Bot scores are available to be used in Firewall fields and with Workers to customize application behavior. For more details, refer to Bot Management variables.

​​ Bot groupings

Customers with a Pro plan or higher can automatically see bot traffic divided into groups by going to Security > Bots.

​​ How Cloudflare generates bot scores

​​ Heuristics

The Heuristics engine immediately gives automated requests a score of one.

​​ Machine learning

The Machine Learning (ML) engine accounts for the majority of all detections, human and bot. This approach leverages our global network, which proxies billions of requests daily, to identify both automated and human traffic. We constantly train the ML engine to become more accurate and adapt to new threats. Most importantly, this engine learns from traffic across all Cloudflare domains and uses these insights to score traffic while honoring our strict privacy standards Open external link .

The ML engine produces scores 2 through 99.

​​ Anomaly detection

The Anomaly Detection (AD) engine is an optional detection engine that uses a form of unsupervised learning. Cloudflare records a baseline of your domain’s traffic and uses the baseline to intelligently detect outlier requests. This approach is user agent-agnostic and can be turned on or off by your account team.

Cloudflare does not recommend AD for domains that use SSL for SaaS or expect large amounts of API traffic. The AD engine immediately gives automated requests a score of one.

​​ JavaScript detections

The JavaScript Detections (JSD) engine identifies headless browsers and other malicious fingerprints. This engine performs a lightweight, invisible JavaScript injection on the client side of any request while honoring our strict privacy standards Open external link . We do not collect any personally identifiable information during the process. The JSD engine either blocks, challenges, or passes requests to other engines.

JSD is enabled by default but completely optional. To adjust your settings, open the Bot Management Configuration page from Security > Bots.

​​ Notes on detection

​​ Comparison to Threat Score

Bot Score is different from Threat Score. Bot Score identifies bots and Threat Score measures IP reputation across our services. Most customers achieve the best results by relying on bot scores and avoiding IP reputation entirely.