For Cloudflare Enterprise teams
Bots adapt. Your rules should too.
We close the gap between what Bot Management detects and what your rules actually stop, in week one. Then we keep your rules ahead of bots as they rotate fingerprints, networks and user agents.
Read-only access to one zone's traffic analytics, nothing else. We never change your Cloudflare account. What we can see
(http.request.uri.path contains "/login" and http.request.method eq "POST" and cf.bot_management.score lt 30 and not cf.bot_management.verified_bot)
Detected is not stopped.
Bot Management scores traffic well. But most teams keep their bot rules in log mode, because nobody can say which rule is safe to enforce. The bots are seen, recorded and let through.
How it works
Two weeks to close the gap. Then we keep it closed.
- Week 1
Audit
How much automated traffic reaches you, how much your rules stop, which endpoints are exposed, and how your existing rules perform.
- Week 1
Tested rules
Draft rules, each replayed against your last 7–30 days of traffic: what it would have matched, and how much of that looks human.
- Week 2
Staged rollout
You deploy the rules you choose in log mode. We review each one and tell you when to move it to a challenge, to a block, or back.
- Every month after
Adaptation
When rules start to bite, bots change identity. We watch for it, prepare rules before the volume arrives, and retire rules that stop working.
Rollout
No rule goes straight to block.
Each rule climbs one step at a time, and only on evidence from your own traffic. You can switch any rule back to log yourself, at any moment.
Watch
The rule records what it would have stopped. Nobody is affected.
Moves on when few of the matched visitors behave like people.
Ask
Matched visitors get a challenge. People pass it; most bots do not.
Moves on when fewer than 1% solve it. Rolls back above 20%, or if logins or checkouts drop.
Stop
Matched requests are refused. Every block rule expires and is renewed only with fresh evidence.
Rolls back on any breach of the business limits you set.
After week two
Stopping bots once is easy. Staying ahead is the work.
Once a rule bites, operators rotate: a new fingerprint, a new network, a new user agent. We let harmless probes through on purpose, because they show us the next identity before the volume arrives. Probes that do harm on their own, like card testing or credential checks, are challenged on sight.
Reported every month
Escape rate
Of the bot traffic stopped, how much came back under a new identity and got through.
Time to adapt
From a rotation appearing to a rule covering it.
Rule health
Rules that still match, expired on time, or were rolled back.
Collateral
Challenge solve rates, logins and checkouts, kept within the limits you agree with us.
Your data
Read-only, one zone, and it expires.
You create a Cloudflare API token with one permission, Analytics Read, for the one zone we audit, and an end date you choose. You can revoke it at any moment. It cannot change anything, and it cannot read your configuration.
What the token can read
Request metadata, the same data behind your Security and Analytics dashboards:
- Paths, query strings, hostnames, methods and referrers
- IP addresses, countries and networks (ASNs)
- User agents and TLS fingerprints (JA4)
- Bot scores and bot detection IDs
- Response codes and content types
- Which security rule acted on a request, and how
What it cannot read or do
Anything beyond that metadata:
- Request and response bodies, form fields and passwords
- Cookies and other request headers
- Your rule, WAF, DNS, TLS and cache settings
- Other zones, account members and billing
- Any change to your account, rules or DNS
| Data | How we keep it |
|---|---|
| Your API token | In an encrypted credential store. Never written to a file, an email or a chat. |
| IP addresses, user agents, paths, fingerprints, rule IDs | On encrypted storage only we can access. Never shared with anyone, and deleted within 30 days of the pilot ending. |
Ratios, ranges and labels such as path-3fa9c1 | Our analysis notes, and the AI assistant we use for analysis. It never sees your token or any identifier. |
We sign an NDA and a data processing agreement before you send a token, and share the full pilot runbook before you decide.
Start with a two-week pilot.
Built for teams on Cloudflare Enterprise with Bot Management, especially in retail, ticketing, travel, betting and fintech, where logins, checkouts and inventory are under constant pressure.
Two ways to start. We run the audit with a read-only token you create and revoke. Or run it yourself: after we sign an NDA, a small read-only kit runs on your own machine, you keep the full report, and only ratios and labels come back to us.
Either way, we then write and stage the rules that close the gap, and keep them ahead of bots as they rotate. Everything runs by email; we only meet if you want to.