Bot Management Gotchas
Common Errors
"Bot Score = 0"
Cause: Bot Management didn't run (internal Cloudflare request, Worker routing to zone (Orange-to-Orange), or request handled before BM (Redirect Rules, etc.))
Solution: Check request flow and ensure Bot Management runs in request lifecycle
"JavaScript Detections Not Working"
Cause: js_detection.passed always false or undefined due to: CSP headers don't allow /cdn-cgi/challenge-platform/, using on first page visit (needs HTML page first), ad blockers or disabled JS, JSD not enabled in dashboard, or using Block action (must use Managed Challenge)
Solution: Add CSP header Content-Security-Policy: script-src 'self' /cdn-cgi/challenge-platform/; and ensure JSD is enabled with Managed Challenge action
"False Positives (Legitimate Users Blocked)"
Cause: Bot detection incorrectly flagging legitimate users
Solution: Check Bot Analytics for affected IPs/paths, identify detection source (ML, Heuristics, etc.), create exception rule like (cf.bot_management.score lt 30 and http.request.uri.path eq "/problematic-path") with Action: Skip (Bot Management), or allowlist by IP/ASN/country
"False Negatives (Bots Not Caught)"
Cause: Bots bypassing detection
Solution: Lower score threshold (30 → 50), enable JavaScript Detections, add JA3/JA4 fingerprinting rules, or use rate limiting as fallback
"Verified Bot Blocked"
Cause: Search engine bot blocked by WAF Managed Rules (not just Bot Management)
Solution: Create WAF exception for specific rule ID and verify bot via reverse DNS
"Yandex Bot Blocked During IP Update"
Cause: Yandex updates bot IPs; new IPs unrecognized for 48h during propagation
Solution:
- Check Security Events for specific WAF rule ID blocking Yandex
- Create WAF exception:txt