← Bots / bots / reference

Bot Management variables

Bot Management provides access to several new variables within the expression builder of Ruleset Engine-based products such as WAF custom rules.

• Bot Score (cf.bot_management.score): An integer between 1-99 that indicates Cloudflare's level of certainty that a request comes from a bot.

• Verified Bot (cf.bot_management.verified_bot): A boolean value that indicates whether a request originates from a Cloudflare allowed bot.

  Cloudflare maintains a large allowlist of good, automated bots (such as Google Search Engine and Pingdom) that perform beneficial tasks. Cloudflare identifies and verifies these bots primarily through reverse DNS validation, ensuring the source IP matches the requesting service.

  We also use additional validation methods, including checking ASN blocks and public lists. If these methods are unavailable, Cloudflare utilizes internal data and machine learning to identify and verify legitimate IP addresses from good bots. Most customers choose to allow this traffic.

• Serves Static Resource (cf.bot_management.static_resource): An identifier that matches file extensions for many types of static resources. Use this variable if you send emails that retrieve static images.

• ja3Hash (cf.bot_management.ja3_hash) and ja4 (cf.bot_management.ja4): A JA3/JA4 fingerprint helps you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates.

• Bot Detection IDs (cf.bot_management.detection_ids): List of IDs that correlate to the Bot Management heuristic detections made on a request (you can have multiple heuristic detections on the same request).

• Signed Agent (cf.bot_management.signed_agent): A boolean value that indicates whether the request originated from a known agent that self-identifies with Web Bot Auth. Such agents are now classified as verified bots and agents labeled as intermediary.

• Verified Bot Categories (cf.verified_bot_category): A string that allows you to segment your verified bot traffic by its type and purpose.

These variables are also available as part of the request.cf object via Cloudflare Workers:

• request.cf.botManagement.score
• request.cf.botManagement.verifiedBot
• request.cf.botManagement.staticResource
• request.cf.botManagement.ja3Hash
• request.cf.botManagement.ja4
• request.cf.botManagement.jsDetection.passed
• request.cf.botManagement.detectionIds
• request.cf.botManagement.signedAgent
• request.cf.verifiedBotCategory

For Orange-to-Orange (O2O) traffic and any related subrequests where Bot Management is in effect, Bot Management fields (including bot score, verified bot, and JA3/JA4) represent the eyeball (end-user) connection to your platform.

Eyeball signals are preserved through the O2O chain, so the fields must be present regardless of which O2O request path you reach.

The Bot Management Corporate Proxy field contains identified cloud-based corporate proxies and secure web gateways that are Enterprise-only, and provide outbound security services to their clients.

You can access the Corporate Proxy field in WAF custom rules, Rate limiting rules, or Workers to provide different security rules for traffic from these sources. You can also exempt them from rules using Bot Management scores.

not cf.bot_management.verified_bot
and not cf.bot_management.static_resource
and not  cf.bot_management.corporate_proxy
and cf.bot_management.score lt 30

Once you enable Bot Management, Cloudflare also surfaces bot information in its HTTP requests log fields:

• BotDetectionIDs
• BotScore
• BotScoreSrc
• BotTags

Ephemeral IDs are short-lived device identifiers returned in the Turnstile Siteverify API response under metadata.ephemeral_id. They are not Ruleset Engine fields and cannot be used in WAF custom rules or Workers directly.

Refer to Ephemeral IDs for implementation details and the full enablement process.