How to tell bots from real visitors
The network worker relies on the Cloudflare score, but every webmaster should understand the signals.
1. Bot Score
request.cf.botManagement.score — from 1 (definitely a bot) to 99 (definitely human). The SML network threshold: inverted threat above 10 counts as a bot. The legacy threatScore field is deprecated but kept as a fallback.
2. Quick bot signs
| Signal | Bot | Human |
|---|---|---|
| JavaScript / cookies | often missing | present |
| ASN | datacenter | home ISP |
| User-Agent | empty, curl, python | browser-like |
| Request rhythm | steady, dozens per second | uneven |
| TLS fingerprint (JA3) | library-like | browser-like |
3. Why not ban manually
Manual bans on a single signal hit real users (mobile networks, corporate proxies). The SML worker blocks nobody — it only logs IPs. Blocking stays conscious, via the blocklist.
Read next: 10-minute setup · False positives