Back to Checks
cloudflare

Bot Fight Mode is enabled

zone_bot_fight_mode_enabled
Service: zoneSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Bot Fight Mode configuration by checking if it is enabled to detect and mitigate automated bot traffic targeting the zone through browser integrity checks.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Bot Fight Mode, zones are vulnerable to automated attacks.

  • Confidentiality: web scraping bots can harvest sensitive data from your site
  • Integrity: credential stuffing attacks can compromise user accounts
  • Availability: bot traffic can overwhelm resources causing service degradation

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_bot_fight_mode_enabled

Recommendation

Enable Bot Fight Mode as part of a layered bot management strategy.

  • Detects and challenges automated bot traffic
  • Protects against web scraping and credential stuffing
  • Combine with rate limiting and WAF rules for comprehensive protection
  • Monitor bot analytics to understand traffic patterns

Remediation

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > Bots
3Enable Bot Fight Mode
4Monitor bot analytics to fine-tune protection
5Consider combining with rate limiting for comprehensive protection

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_bot_fight_mode_enabled(Check):
    """Ensure that Bot Fight Mode is enabled for Cloudflare zones.

    Bot Fight Mode is a free Cloudflare feature that detects and mitigates automated
    bot traffic. It uses JavaScript challenges and behavioral analysis to identify
    bots and block malicious automated traffic, protecting against scraping, spam,
    credential stuffing, and other automated attacks.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Bot Fight Mode enabled check.

        Iterates through all Cloudflare zones and verifies that Bot Fight Mode
        is enabled via the Bot Management API. This feature helps identify and
        block malicious bot traffic.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Bot Fight
            Mode is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            if zone.settings.bot_fight_mode_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Bot Fight Mode is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bot Fight Mode is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References