Home

/

Glossary

/

Browser

/

Cloudflare Bot Management

Browser

6 min read

Also: Cloudflare challenge, Just a moment..., Verify you are human, Cloudflare managed challenge, Bot Fight Mode, Super Bot Fight Mode, cf_clearance, Cloudflare error 1020, Cloudflare bot score

Cloudflare Bot Management

Quick answer

Cloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Enterprise bot score) that decide whether a request is automated and answer with a "Just a moment..." challenge or an error such as 1020. If you are stuck on that page in a normal browser, see "Verify you are human" loops.

Cloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Enterprise bot score) that decide whether a request is automated, and answer with a 'Just a moment...' challenge or an error such as 1020.

Anti-bot system
Official site ↗

Last verified

What people do with Cloudflare Bot Management

Key facts

Made byCloudflare
TiersBot Fight Mode (Free), Super Bot Fight Mode (Pro, Business, Enterprise), Bot Management (Enterprise add-on)
Bot score1 to 99; 1 = certainly automated, near 99 = likely human (Bot Management)
Clearance cookiecf_clearance, default lifetime 30 minutes
Common error codes1020 (blocked by a WAF/firewall rule), 1010 (browser signature banned), 1015 (rate limited)
Recommended challengeManaged Challenge, which picks the least intrusive check per visitor

What is Cloudflare bot management?

Cloudflare sits in front of a very large share of the world's websites as a reverse proxy and CDN, so every request to those sites passes through Cloudflare first. That puts Cloudflare in a position to decide, before the request ever reaches the site, whether it looks like a person in a browser or an automated client. "Cloudflare bot management" is the umbrella for the features that make that decision, and the screens you see when it says no:

  • The "Just a moment..." page (a challenge page) that checks your browser for a few seconds before showing the site.
  • Error pages such as 1020 Access denied, 1010 (browser signature banned) and 1015 (rate limited).
  • [Cloudflare Turnstile](/glossary/cloudflare-turnstile), the widget a site embeds in its own forms, which uses the same challenge technology.

    • The products, by plan

    Cloudflare offers three levels, and which one a site uses changes what an automated client experiences:

  • Bot Fight Mode is included on the Free plan. It is a simple on/off switch that challenges requests matching known bot patterns.
  • Super Bot Fight Mode is available on Pro, Business and Enterprise plans. It adds per-category actions (allow, block or managed challenge for "definitely automated" and "likely automated" traffic), allowing of verified bots, protection for static resources and JavaScript detections. A site has to turn off Bot Fight Mode before enabling it.
  • Bot Management is the Enterprise add-on. It gives every request a bot score from 1 to 99 (1 means Cloudflare is certain the request is automated; scores near 99 look human), exposes fields such as JA3/JA4 TLS fingerprints and a verified-bot flag to the site's WAF rules, and lets the site write its own policy, for example "block score 1, challenge scores below 30, always allow verified bots".

    • Cloudflare also offers a one-click Block AI Bots setting, launched in July 2024, for sites that want to keep AI crawlers out.

    How the challenge works

    When a rule or bot setting decides a request needs checking, Cloudflare answers with a challenge page instead of the site. Cloudflare recommends Managed Challenge for most rules: Cloudflare picks the least intrusive check for the visitor, usually a non-interactive JavaScript challenge that runs for a moment and passes on its own, occasionally a checkbox. The page title is typically "Just a moment...", and the response carries a cf-mitigated: challenge header.

    Passing the challenge sets a `cf_clearance` cookie that tells Cloudflare the browser has been verified. By default it lasts 30 minutes (site owners can change it), and clearance earned at a lower challenge level does not satisfy a higher one. That cookie is tied to the browser session that earned it.

    The error pages are different: they are decisions, not checks.

  • Error 1020 means a request matched a WAF or firewall rule the site owner created (for example blocking a country, an IP range, a user agent or a path). Waiting usually does not help; only the owner can change the rule. The page shows a Ray ID the owner can look up.
  • Error 1010 means the owner blocked requests based on the browser's signature, usually through Browser Integrity Check. Automation tools and unusual HTTP clients trigger it.
  • Error 1015 means the visitor exceeded a rate-limiting rule; it clears after the configured period. See rate limiting.

    • Why it appears in automation

  • HTTP-only tools fail outright. Python requests, curl, a no-code HTTP step or Google Sheets IMPORTXML receive the challenge HTML instead of the page, because they cannot run the JavaScript. A scraper that suddenly returns "Just a moment..." as data has hit this.
  • Automated browsers get stuck in challenge loops. Headless Chrome, Selenium WebDriver and Puppeteer sessions expose traits the JavaScript detections look for, and datacenter IP addresses start with a poor reputation.
  • A copied `cf_clearance` cookie stops working. It belongs to one browser session and expires.
  • Monitoring tools report false outages. An uptime check that receives a 403 challenge page records the site as down.

    • Working with Cloudflare-protected sites responsibly

    Cloudflare's bot features are configured by the site owner, so the block reflects their policy. Good-faith options:

  • Use the site's API or feeds. Many sites behind Cloudflare publish one.
  • Ask to be allow-listed. Owners can exempt a partner's IP, token or user agent in a WAF rule, and well-behaved crawlers can apply to Cloudflare's verified bots program.
  • Respect [robots.txt](/glossary/robots-txt), keep request rates low, and identify your client honestly.
  • For low-volume tasks on your own accounts, let a person complete the occasional challenge.

    • This page does not explain how to evade Cloudflare's protections. Our is web scraping legal? guide covers the wider question.

    Cloudflare and Autonoly

    Autonoly's agent uses a real, headed Chromium browser, so a site behind Cloudflare renders and runs its JavaScript as it would for you, and many sites with lighter settings simply load. Autonoly does not bypass Cloudflare challenges, does not solve Turnstile, and has no proxies or IP rotation. When the agent lands on a challenge or an error page it cannot pass, it stops and hands you the browser through live browser control. For the built-in website monitoring triggers, which use a plain HTTP fetch, a Cloudflare challenge looks like a failed check; see website monitoring.

    Why It Matters

    Because so many sites sit behind Cloudflare, its challenge pages and 1xxx errors are the most common reason a scraper or automated browser suddenly returns nothing useful. Knowing whether you hit a challenge, a firewall rule or a rate limit tells you whether to wait, slow down, ask the owner, or switch to an official API.

    How Autonoly Solves It

    Autonoly's agent runs a real headed Chromium browser, so sites with lighter Cloudflare settings load normally. It does not bypass Cloudflare challenges or use proxies. When it hits a challenge or block page it cannot pass, it hands you the live browser to complete or decide.

    Learn more

    Examples

    • A Python scraper's output is suddenly full of 'Just a moment...' HTML because the site enabled Bot Fight Mode

    • A user sees 'Error 1020 Access denied' with a Ray ID and sends it to the site owner, who finds the country-block rule that matched

    • An agent visiting a supplier site meets a managed challenge it cannot pass, pauses, and the user completes it in the live view

    Frequently Asked Questions

    It is a Cloudflare challenge page. A security rule or bot setting decided your request needed checking, so Cloudflare runs a short browser check before showing the site. Passing it sets a cf_clearance cookie, valid for 30 minutes by default, so you are not checked on every page.

    Your request matched a WAF or firewall rule the site owner created, for example a block on a country, IP range, user agent or path. Waiting rarely helps. Send the Ray ID shown on the page to the site owner, who can find the matching rule and change it.

    Bot Fight Mode is the free, on/off setting that challenges known bot patterns. Super Bot Fight Mode, on Pro, Business and Enterprise plans, lets the owner choose actions per category, allow verified bots, protect static resources and use JavaScript detections.

    With the Enterprise Bot Management add-on, Cloudflare scores each request from 1 to 99. A score of 1 means Cloudflare is certain the request is automated; scores near 99 look human. Site owners use the score in WAF rules, for example challenging everything below 30.

    HTTP clients cannot run the JavaScript the challenge needs, and automated browsers expose traits that Cloudflare's detections recognize. Datacenter IP addresses and fast request rates also lower trust. Use the site's API or ask to be allow-listed.

    Autonoly does not bypass them. Its agent uses a real headed Chromium browser, so many Cloudflare-protected sites load normally. When a challenge cannot be passed, the agent hands you the live browser to complete it yourself.

    Further reading

    Templates
    Blog Posts
    ← ChromeDriverCloudflare Turnstile →

    Related terms, automations and guides

    Where this concept shows up in practice.

    DefinitionCloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, issues a single-use token, and lets the site verify that token server-side through the Siteverify API.DefinitionCAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response mechanism designed to distinguish human users from automated bots on websites.DefinitionRate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given time window, preventing abuse and ensuring fair resource distribution.DefinitionUser AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and operating system, used by websites to serve appropriate content and detect automated traffic.DefinitionHeadless ChromeHeadless Chrome is Google Chrome running without a visible window. It renders pages and runs JavaScript like normal Chrome and is controlled by code, which makes it the standard engine for automated testing, scraping, screenshots and PDF generation.GuideBrowser Use Alternatives: Best No-Code Options for Non-DevelopersBrowser Use is a powerful open-source Python library for AI browser automation, but it requires coding skills. This guide covers the best no-code alternatives for non-developers who want the same AI-powered browser automation capabilities without writing a single line of Python.GuideAutonoly vs Bardeen: AI Browser Automation Compared (2026)An honest, in-depth comparison of Autonoly and Bardeen for AI browser automation. We compare architecture, features, pricing, and use cases to help you choose the right tool for your automation needs.DefinitionhCaptchahCaptcha is a privacy-focused CAPTCHA and bot-detection service by Intuition Machines. It shows image challenges or runs passively, issues a token, and lets the site verify it server-side through its siteverify API.

    Stop reading about automation.

    Start automating.

    Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.

    See Features