In short. JavaScript Detections cannot be turned off while Cloudflare Bot Fight Mode is enabled.
Definition: Cloudflare automatically enables JavaScript Detections for Bot Fight Mode customers, and the setting cannot be disabled while Bot Fight Mode is enabled. The feature adds an invisible client-side script to HTML page responses and records its result in the
cf_clearancecookie.
Key facts
- Cloudflare describes Bot Fight Mode as a free product that detects and mitigates bot traffic on a domain in its Bot Fight Mode documentation.
- The same documentation states that JavaScript Detections is automatically enabled for Bot Fight Mode customers.
- Cloudflare's JavaScript Detections reference says the script is injected for HTML pages or page views, while AJAX calls, API traffic and mobile application traffic are unaffected.
- The reference says the detection has a lifespan of 15 minutes and uses paths beginning with
/cdn-cgi/challenge-platform/.
What happens when Bot Fight Mode is enabled?
Bot Fight Mode and Super Bot Fight Mode use the technology that powers Cloudflare's Bot Management. Cloudflare documents both products as protecting entire domains without endpoint restrictions, with WAF custom rules offering no customization, adjustment or reconfiguration control. The Bot Fight Mode page also places the product outside the Ruleset Engine, so WAF custom rules and Page Rules have no bypass or skip action.
JavaScript Detections is a separate challenge type from Challenge Pages and Turnstile. Cloudflare describes it as a lightweight, invisible JavaScript snippet. It is injected only in response to HTML page or page-view requests, excluding AJAX calls. After injection, the browser runs the snippet and Cloudflare issues a cf_clearance cookie. The result populates cf.bot_management.js_detection.passed with true or false.
The automatic setting is different from the JavaScript Detections API. Cloudflare documents the API as a way to choose specific HTML pages and call window.cloudflare.jsd.executeOnce. Its reference recommends against combining the zone-wide toggle with manual injection. That selective API workflow belongs to the JavaScript Detections documentation and provides page-level control for supported plans.
What must a CSP allow?
Content Security Policy, or CSP, is an HTTP policy that controls which sources a browser may use for scripts and other resources. Cloudflare's Bot Fight Mode documentation requires pages with a CSP to allow the Challenge Platform path and scripts served from the origin domain.
/cdn-cgi/challenge-platform/
script-src self
When a CSP uses nonces on script tags, Cloudflare says it reads the nonce from the CSP response header and adds matching nonces to injected scripts. Without a nonce in the policy, Cloudflare documents a console error for blocked inline execution when JavaScript Detections is enabled. The same reference discourages unsafe-inline and recommends CSP nonces. JavaScript Detections is unsupported when the nonce is set through a <meta> tag.
What should you check after enabling it?
Inspect an HTML response's CSP header and confirm that the Challenge Platform path is allowed. Then load a page in a browser and inspect the response or page source for a script path beginning with /cdn-cgi/challenge-platform/. Cloudflare says that the script is deferred after page load and uses a separate thread where available.
The detection result alone leaves bot enforcement to a custom WAF rule. Cloudflare's JavaScript Detections reference says that a custom WAF rule using cf.bot_management.js_detection.passed is required to block or challenge a failed request. Its guidance places that rule after a user's first request and recommends the Managed Challenge action because network issues, ad blockers, disabled JavaScript and native mobile applications can affect the result.
Related terms
FAQ
Can I switch off only JavaScript Detections?
No. With Bot Fight Mode enabled, Cloudflare documents JavaScript Detections as automatic and non-disableable. The separate API can limit injection to selected pages, while Cloudflare documents that workflow for customers who can disable the dashboard setting.
Does a failed JavaScript Detection automatically block a request?
No. Cloudflare says a failed result requires a custom WAF rule before a request is blocked or challenged. The documented field is cf.bot_management.js_detection.passed.
What if my site uses a CSP nonce in a meta tag?
Cloudflare documents a nonce set through a <meta> tag as unsupported for JavaScript Detections. A nonce in the CSP response header is the supported pattern described in the reference.
Sources
Check how a page reads to answer engines. Open the GEO score analyzer