---
title: FAQ · Cloudflare bot solutions docs
description: Cloudflare uses multiple methods to detect bots, but these vary by plan. For more details, refer to Plans.
source_url:
  html: https://bd468052.preview.developers.cloudflare.com/bots/troubleshooting/frequently-asked-questions/index.md
  md: https://bd468052.preview.developers.cloudflare.com/bots/troubleshooting/frequently-asked-questions/
---

## Bots

## How does Cloudflare detect bots?

Cloudflare uses multiple methods to detect bots, but these vary by plan. For more details, refer to [Plans](https://developers.cloudflare.com/bots/plans).

***

## How do I know what's included in my plan?

To know what's included in your plan, refer to our [Plans](https://developers.cloudflare.com/bots/plans).

***

## How do I set up my bot product?

To learn how to set up your bot product, refer to [Get started](https://developers.cloudflare.com/bots/get-started).

***

## Yandex bot unexpectedly blocked by the WAF managed rule with ID `...f6cbb163`

Yandex updates their bots very frequently, you may see more false positives while these changes are propagated. New and recently updated bots will occasionally be blocked by a Cloudflare WAF managed rule, as the IP list of Yandex bots has not yet synced with Yandex's most recent changes.

**Workarounds:**

* Create an [exception](https://developers.cloudflare.com/waf/managed-rules/waf-exceptions/) to temporarily skip the managed rule with ID 2854e3f18ad946049e6d90ccf6cbb163 when a request is coming from the **Yandex IP** and the user-agent contains **Yandex.**
* Create a [WAF custom rule with the *Skip* action](https://developers.cloudflare.com/waf/custom-rules/skip/) to temporarily bypass WAF Managed Rules when a request is coming from the **Yandex IP** and the user-agent contains **Yandex.**

If you are using the legacy WAF managed rules ([now deprecated](https://developers.cloudflare.com/waf/reference/migration-guides/waf-managed-rules-migration/)), disable the WAF managed rule with ID `100203` temporarily.

**Solution:**

Once the new Yandex IP is propagated to our system, the requests will not be blocked anymore and you can remove any workaround you configured. This can take up to 48 hours. If you see any Yandex bots still being blocked after 48 hours with no change to the bot, contact [Cloudflare Support](https://developers.cloudflare.com/support/contacting-cloudflare-support/).

***

## How does machine learning work?

Supervised machine learning takes certain variables (X) like gender and age and predicts another variable (Y) like income.

In Bot Management and Super Bot Fight Mode, the X variables are request features, while the Y variable represents the probability of solving a challenge based on X values.

Cloudflare uses data from millions of requests and re-train the system on a periodic basis. You can learn about this data from your own request logs such as Cloudflare Logpull and Logpush as well as the Firewall API.

***

## Why am I seeing a Managed Challenge action for WAF rules?

When you choose to challenge different bot categories with Bot Fight Mode or Super Bot Fight Mode, you will see Security Events with an **Action Taken** of **Managed Challenge**.

You may also see Managed Challenge due to a triggered [WAF custom rule](https://developers.cloudflare.com/fundamentals/security/cloudflare-challenges/#managed-challenge-recommended).

This does not mean that your traffic was blocked. It is the challenge sent to your user to determine whether they are likely human or likely bot.

To understand if the result of the challenge was a success or a failure, you can verify using [Logpush](https://developers.cloudflare.com/logs/about/).

## Does the WAF run before Super Bot Fight Mode?

Yes. WAF rules are executed before Super Bot Fight Mode. If a WAF custom rule performs a [terminating action](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/) such as *Block*, your Super Bot Fight Mode configuration will not be evaluated.

***

## What is cf.bot\_management.verified\_bot?

A request's *cf.bot\_management.verified\_bot* value is a boolean indicating whether such request comes from a Cloudflare allowed bot.

Cloudflare has built an allowlist of good, automated bots, e.g. Google Search Engine, Pingdom, and more.

This allowlist is large based on reverse DNS verification, meaning that the IPs we allow really match the requesting service. In addition to this, Cloudflare uses multiple validation methods including ASN blocks and public lists. If none of these validation types are available for a customer, we use internal Cloudflare data and machine learning to identify legitimate IP addresses from good bots.

To allow traffic from good bots, use the [Verified Bot](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.verified_bot/) field in your WAF custom rule.

***

## Why might the ja3hash or JA4 be empty in HTTP logs?

The [JA3/JA4 fingerprint](https://developers.cloudflare.com/bots/additional-configurations/ja3-ja4-fingerprint/) can be null or empty in some cases. The most common case is for HTTP requests because JA3 and JA4 are calculated in TLS. It can also be empty due to the Worker sending requests within the same zone or to a zone that is not proxied (or a third party).

[Orange to Orange (O2O)](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/) should not cause null or empty JA3 or JA4 fingerprints, unless the eyeball zone is routing traffic to the target zone using a Worker.

***

## I run a good bot and want for it to be added to the allowlist (cf.bot\_management.verified\_bot). What should I do?

Cloudflare maintains a sample list of verified bots in [Cloudflare Radar](https://radar.cloudflare.com/verified-bots).

As a bot operator, in order to be listed by Cloudflare as a Verified Bot, your bot must conform with our [verified bot public policy](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/policy/). If your bot meets this criteria, submit this [online application](https://docs.google.com/forms/d/e/1FAIpQLSdqYNuULEypMnp4i5pROSc-uP6x65Xub9svD27mb8JChA_-XA/viewform?usp=sf_link).

***

## What information do I need to troubleshoot my bot issues?

If you are experiencing errors with your bot solution and need to submit a Support request, include the following information:

Warning

The following information gathering are required when you are experiencing issues (e.g. false positives) with Enterprise Bot Management only (Enterprise plan).

Because Bot Fight Mode (BFM) and Super Bot Fight Mode (SBFM) are set at a domain level, we often find that disabling these features is the best solution to false positives.

Please follow instructions in the following questions on how to disable BFM and SBFM features. We conduct more thorough investigations for Enterprise Bot Management.

* RayIDs

* IP addresses

* WAF custom rule IDs, rule expression, Challenge solve rates

* Common user-agents among false positives

* Common ASNs among false positives

* Screenshots of strange activity from the WAF, such as a huge spike in challenged traffic on the graph

* Problematic URIs or paths

* Rough description of how your domain is configured.

  * Is one zone Cloudflare for SaaS while the others are not?
  * Is most API traffic sent to a particular URI?
  * How much mobile traffic do you expect?

***

## What should I do if I am getting False positives caused by Bot Fight Mode (BFM) or Super Bot Fight Mode (SBFM)?

Important considerations you need to be aware of before turning on BFM or SBFM

* BFM and SBFM are high security features intended to quickly help customers under active attack stop as many bots as possible. Due to the high security threshold, false positives do sometimes happen.
* BFM has limited control. You cannot bypass or skip BFM using the *Skip* action in WAF custom rules or using Page Rules. BFM will be disabled if there are any IP Access rules present. If you turned on BFM during an attack, and the attack has subsided, we recommend either disabling the feature using IP Access rules to bypass BFM, or looking at [Bot Management for Enterprise](https://developers.cloudflare.com/bots/plans/bm-subscription/), which gives you the ability to precisely customize your security threshold and create exception rules as needed.
* SBFM can be bypassed with IP Access *Allow* action rules. You can use the *Skip* action in [WAF custom rules](https://developers.cloudflare.com/waf/custom-rules/skip/) to specify where Super Bot Fight Mode should not run.

**How to disable BFM/SBFM feature?**

If you encounter any issues with BFM/SBFM feature (e.g. false positive), you can disable it under **Security** > **Bots**.

* For **Free** plans, toggle the **Bot Fight Mode** option to **Off**
* For **Pro** plans, click the **Configure Super Bot Fight Mode** link and set each of **Definitely automated** and **Verified bots** features to **Allow**, and toggle the **Static resource protection** and **JavaScript Detections** options to **Off**
* For **Business** and **Enterprise** (with no Bot Management add-on) plans, click the **Configure Super Bot Fight Mode** link and set each of **Definitely automated**, **Likely automated** and **Verified bots** features to **Allow**, and toggle the **Static resource protection** and **JavaScript Detections** options to **Off**

In parts of your site where you want bot traffic, you can use the [*Skip* action](https://developers.cloudflare.com/waf/custom-rules/skip/) in [WAF custom rules](https://developers.cloudflare.com/waf/custom-rules/) to specify where Super Bot Fight Mode should not run.

You can use the [Rules language](https://developers.cloudflare.com/ruleset-engine/rules-language/) and its [operators](https://developers.cloudflare.com/ruleset-engine/rules-language/operators/) and [fields](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/) in custom rules to configure a scoped rule for approved automated traffic in Super Bot Fight Mode.

You cannot bypass or skip Bot Fight Mode using the *Skip* action in WAF custom rules or using Page Rules. *Skip*, *Bypass*, and *Allow* actions apply to rules or rulesets running on the [Ruleset Engine](https://developers.cloudflare.com/ruleset-engine/). While Super Bot Fight Mode rules are implemented in the Ruleset Engine, Bot Fight Mode checks are not. This is why you can skip Super Bot Fight Mode, but not Bot Fight Mode. If you need to skip Bot Fight Mode, consider using [Super Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/).

Bot Fight Mode can still trigger if you have IP Access rules, but it cannot trigger if an IP Access rule matches the request. For example, the IP Access rule matches the connecting IP.

***

## Super Bot Fight Mode feature (SBFM) is still blocking requests even though the feature is turned off, why?

This is a known issue the Bots team is working to resolve in the near future. In the meantime, there is a workaround to resolve such issue. You will need to run the following API command to check and remove the SBFM ruleset:

1. List the existing Rulesets at the zone level.

   ```bash
   curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
   --header "Authorization: Bearer <API_TOKEN>"
   ```

2. From the output in step 1, find the ruleset ID that is associated with the zone's SBFM configuration. You should be able to see `"kind": "zone"` and `"phase": "http_request_sbfm"` for that ruleset.

3. Use the ruleset ID you found to delete the SBFM ruleset.

   ```bash
   curl --request DELETE "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}" \
   --header "Authorization: Bearer <API_TOKEN>"
   ```

Note that you need to replace `<API_TOKEN>` with your own [API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/).
