--- title: How to Block Bots from Visiting Your Website | daily.dev description: Bots were scoring as 'people' on Cloudflare's bot score, so Bot Fight Mode never blocked them on one blog post. The fix was a custom WAF rule that forces an... canonical: https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Block Bots from Visiting Your Website | daily.dev og:description: Bots were scoring as 'people' on Cloudflare's bot score, so Bot Fight Mode never blocked them on one blog post. The fix was a custom WAF rule that forces an... og:url: https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet og:image: https://api.daily.dev/og/posts/P1XWaRvET.png og:image:alt: How to Block Bots from Visiting Your Website og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Block Bots from Visiting Your Website **[Pragmatic Pineapple](https://daily.dev/sources/pragmaticpineapple)** · [@nikolalsvk](https://daily.dev/nikolalsvk) · 6 min read · 0 upvotes · 0 comments ## Summary Bots were scoring as 'people' on Cloudflare's bot score, so Bot Fight Mode never blocked them on one blog post. The fix was a custom WAF rule that forces an interactive challenge on that single URL path. The rule matched the URI path with a wildcard and set the action to Interactive Challenge rather than Managed Challenge, since Cloudflare had already judged these clients as people. The day after enabling it, the rule had fired 5,690 times, about 0.02% of zone traffic, all on one old tutorial post. Honeypots, a timer, Turnstile, and double opt-in had not stopped every signup before this. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I block bots that Cloudflare's bot score rates as human visitors? Create a Cloudflare WAF custom rule matching the specific URI path with the wildcard operator, and set the action to Interactive Challenge instead of Managed Challenge. This bypasses the automatic bot score entirely, since Managed Challenge only triggers when Cloudflare is unsure, and these bots scored as nearly certain humans. The challenge forces every visitor on that path to solve it, with no exceptions for high scores. _Developers fighting bots that outscore their own detection tools can track WAF approaches like this on daily.dev._ ### What is the Cloudflare bot score range and what do the values mean? The Cloudflare bot score runs from 1 to 99, where a score of 1 means the client is almost certainly automated and a score of 99 means it is almost certainly a human. Automatic tools like Bot Fight Mode only act on traffic Cloudflare has already classified as a bot, so a high score leaves that tooling idle even if the traffic is actually automated. _Anyone tuning bot detection thresholds can keep up with scoring quirks like this via daily.dev._ ### Why didn't Turnstile and double opt-in stop ConvertKit form spam? Turnstile issues its managed-mode checkbox only when Cloudflare is unsure about a client, and in this case Cloudflare was not unsure, so the same high bot score that left Bot Fight Mode idle also handed the bots a Turnstile token. Double opt-in failed too because some of the bot-controlled email addresses were able to open the inbox and confirm the subscription. _Developers hardening signup forms against spam can follow real-world failures like this on daily.dev._ ## Similar posts on daily.dev - [How Cloudflare Bot Fight Mode Quietly Killed Our Google Rankings](https://daily.dev/posts/how-cloudflare-bot-fight-mode-quietly-killed-our-google-rankings-lbdhmurms) · The Infinity · 8 upvotes · 2 comments - [Dead internet theory becomes measurable fact as AI agents flood the web](https://daily.dev/posts/dead-internet-theory-becomes-measurable-fact-as-ai-agents-flood-the-web-4uwxc0w1l) · The Next Web · 1 upvotes · 0 comments - [Your site, your rules: new AI traffic options for all customers](https://daily.dev/posts/your-site-your-rules-new-ai-traffic-options-for-all-customers-zrn0fx6z7) · Cloudflare · 0 upvotes · 0 comments - [Cloudflare Turnstile: stop bots without annoying CAPTCHAs](https://daily.dev/posts/cloudflare-turnstile-stop-bots-without-annoying-captchas-zq5kopzs4) · Flavio Copes · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloudflare](https://daily.dev/tags/cloudflare), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Block Bots from Visiting Your Website","url":"https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet"},"datePublished":"2026-10-28T13:46:47.566Z","dateModified":"2026-10-29T10:00:18.504Z","description":"Bots were scoring as 'people' on Cloudflare's bot score, so Bot Fight Mode never blocked them on one blog post. The fix was a custom WAF rule that forces an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25ae75a5061c8b60b2b0237f6fb03ac9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25ae75a5061c8b60b2b0237f6fb03ac9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Pragmatic Pineapple","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Person","name":"Nikola Đuza","url":"https://daily.dev/nikolalsvk","image":"https://lh3.googleusercontent.com/a-/AOh14Gghsm_GS0pjA11tIS3xv6TJvmw2TfsMY41a7f2_52o=s100","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":210}},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloudflare,web-security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Pragmatic Pineapple","item":"https://daily.dev/sources/pragmaticpineapple"},{"@type":"ListItem","position":3,"name":"How to Block Bots from Visiting Your Website"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-block-bots-from-visiting-your-website-p1xwarvet#faq","mainEntity":[{"@type":"Question","name":"How do I block bots that Cloudflare's bot score rates as human visitors?","acceptedAnswer":{"@type":"Answer","text":"Create a Cloudflare WAF custom rule matching the specific URI path with the wildcard operator, and set the action to Interactive Challenge instead of Managed Challenge. This bypasses the automatic bot score entirely, since Managed Challenge only triggers when Cloudflare is unsure, and these bots scored as nearly certain humans. The challenge forces every visitor on that path to solve it, with no exceptions for high scores. Developers fighting bots that outscore their own detection tools can track WAF approaches like this on daily.dev."}},{"@type":"Question","name":"What is the Cloudflare bot score range and what do the values mean?","acceptedAnswer":{"@type":"Answer","text":"The Cloudflare bot score runs from 1 to 99, where a score of 1 means the client is almost certainly automated and a score of 99 means it is almost certainly a human. Automatic tools like Bot Fight Mode only act on traffic Cloudflare has already classified as a bot, so a high score leaves that tooling idle even if the traffic is actually automated. Anyone tuning bot detection thresholds can keep up with scoring quirks like this via daily.dev."}},{"@type":"Question","name":"Why didn't Turnstile and double opt-in stop ConvertKit form spam?","acceptedAnswer":{"@type":"Answer","text":"Turnstile issues its managed-mode checkbox only when Cloudflare is unsure about a client, and in this case Cloudflare was not unsure, so the same high bot score that left Bot Fight Mode idle also handed the bots a Turnstile token. Double opt-in failed too because some of the bot-controlled email addresses were able to open the inbox and confirm the subscription. Developers hardening signup forms against spam can follow real-world failures like this on daily.dev."}}]} ```