Can a Cloudflare WAF skip rule bypass Bot Fight Mode?

Definition: A Cloudflare WAF skip rule leaves Bot Fight Mode active. Bot Fight Mode runs outside Cloudflare's Ruleset Engine, so the Skip, Bypass, and Allow actions in WAF custom rules have no effect on it.

Key facts

• Cloudflare describes Bot Fight Mode as a simple, free product that detects and mitigates bot traffic on a domain. Bot Fight Mode documentation
• A WAF skip rule is a custom rule that uses the Skip action to bypass selected security features for matching requests. Cloudflare's Skip action guide
• Cloudflare's documented Skip targets include rate limiting rules, Managed Rules, and Super Bot Fight Mode. Bot Fight Mode is excluded. Available Skip options

Why does the skip rule fail?

Cloudflare's Bot Fight Mode documentation places the product outside WAF custom-rule configuration. Its rules limitation says that WAF custom rules and Page Rules leave Bot Fight Mode active. The reason is architectural: Bot Fight Mode is evaluated in a separate pipeline from the Ruleset Engine, where Skip, Bypass, and Allow actions have no effect.

The same documentation describes Bot Fight Mode as protecting entire domains without endpoint restrictions. A path expression in a custom rule can identify requests for a WAF action, while Bot Fight Mode still evaluates the request through its own pipeline.

What can a WAF Skip action bypass?

Cloudflare's Skip action guide defines a skip rule as a custom rule configured with the Skip action. It says that Skip can cover rate limiting rules, Managed Rules, Super Bot Fight Mode rules, and several other security products. The guide excludes Bot Fight Mode from the Free plan's skip targets.

The supported product names can be represented as the selection relevant to this question:

Skip
  Rate limiting rules
  Managed Rules
  Super Bot Fight Mode

Selecting Super Bot Fight Mode in this list applies to that product's Ruleset Engine phase. The selection targets Super Bot Fight Mode, and adding a second rule with the same matching traffic leaves the product boundary unchanged.

How do Cloudflare's evaluation pipelines differ?

Cloudflare's security features interoperability documentation says that features powered by the Ruleset Engine run in a fixed sequence of phases. Its sequence places custom rules in http_request_firewall_custom, followed by rate limiting rules, Managed Rules, and Super Bot Fight Mode. A terminating action such as Block or Managed Challenge stops a request before later phases, while a Skip action can bypass later phases that it supports.

The same documentation places Bot Fight Mode outside this phase system. It states that Bot Fight Mode runs outside the Ruleset Engine and custom rules cannot skip it. This is why a Skip action can affect Super Bot Fight Mode while the same action has no effect on Bot Fight Mode.

What are the available exceptions?

Cloudflare's Bot Fight Mode documentation directs operators who need exceptions for specific traffic, such as their own API clients or monitoring tools, to Super Bot Fight Mode. Cloudflare documents Super Bot Fight Mode as running on the Ruleset Engine and supporting Skip rules. Cloudflare documents this as a plan-level alternative to a WAF exception.

The same Bot Fight Mode documentation records a separate interaction with IP Access rules: Bot Fight Mode can still trigger when IP Access rules exist, while it remains inactive when an IP Access rule matches the request first. For a request that has already been challenged, Cloudflare labels the product as Bot Fight Mode in the Service field under Security > Analytics > Events.

Related terms

• How do I create a skip rule in Cloudflare's WAF?
• How does Cloudflare evaluate the order of custom WAF rules?
• Can JavaScript Detections be turned off while Cloudflare Bot Fight Mode is enabled?

FAQ

Can a skip rule apply to one URL path?

A custom rule can match request properties such as a path, and its Skip action can bypass supported Ruleset Engine phases. Bot Fight Mode remains outside those supported targets.

Does skipping Super Bot Fight Mode also skip Bot Fight Mode?

Cloudflare documents these as separate products. A Skip action can bypass Super Bot Fight Mode, while Bot Fight Mode has its own evaluation pipeline and custom rules leave it active.

Where can I check which product acted on a request?

Open Security > Analytics, select Events, and inspect the Service field. Cloudflare says requests challenged by Bot Fight Mode carry that product label.

Sources

1. Cloudflare, "Bot Fight Mode", 3 August 2026
2. Cloudflare, "Configure a rule with the Skip action", 3 August 2026
3. Cloudflare, "Security features interoperability", 16 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer