Cloudflare Bot Management
cdn-bot-manager · Cloudflare · public (NET)
Marketing claims
No claim captured yet.
Sanctioned test surfaces
| Surface | Type | Tier | Basis |
|---|---|---|---|
| Own CF-proxied site (Turnstile free + Bot Management) | self-deploy-free | B | We own the site + CF account |
A — vendor invites testing · B — our own deployment · C — passive observation
Our test results
No sanctioned runs recorded yet.
Real-world challenge rate (passive, anonymized)
Across 42 sites detected running Cloudflare Bot Management, this is what a default automated client met:
ServedChallengedBlocked
Site identities are not published. This measures whether a vanilla client is challenged — no bypass performed.
Detection is by CDN fingerprint, so “served” means the site sits behind Cloudflare Bot Management but a default bot was not actively challenged — CDN presence is not proof the paid bot-management product is engaged. The challenged + blocked share is where protection actively fired.
Cited external benchmarks
- Scrapfly — Cloudflare bypass — reported bypass 98%Self-reported by Scrapfly (commercial bypass API) — vendor marketing figure, not independently verified (captured 2026-08-14).
- techinz/browsers-benchmarkIndependent open-source browser-automation benchmark; per-engine bypass rates vary.
We cite these rather than generating real-world bypass numbers against non-consenting production systems. Commercial-vendor figures are self-reported marketing claims, flagged as such above — treat them as the ceiling a paying bypass service advertises.