← Use Cases / use-cases / application-security

Stop malicious bots

Malicious bots perform credential stuffing, content scraping, and inventory hoarding. Cloudflare provides multiple tools to detect and block automated threats while allowing legitimate bots like search engine crawlers.

For a step-by-step workflow that combines these tools into a layered defense, refer to Stop malicious bots while allowing legitimate traffic.

Baseline bot protection available on all plans, including Free. Challenges requests that match known bot patterns. Learn more about Bot Fight Mode.

Granular bot controls for Pro plans and above. Allows verified bots, configures per-category actions, and extends protection to static resources. Learn more about Super Bot Fight Mode.

Machine learning-powered bot detection for Enterprise with granular signal detections. Assigns a bot score from 1 (bot) to 99 (human) to every request, along with additional signals for more precise and customizable security rules. Learn more about Bot Management.

Privacy-preserving challenge for forms and user interactions. Available on all plans at no cost. Learn more about Turnstile.

Targeted rules that act on traffic signals including headers, request patterns, and bot management variables. Available on all plans. Learn more about custom rules.

1. Stop malicious bots while allowing legitimate traffic — layered defense guide covering all products above
2. Enable Bot Fight Mode — quickest single step (Free plan)
3. Add Turnstile to forms — protect login and signup forms