How can Super Bot Fight Mode allow verified bots while challenging other traffic?

Definition: Super Bot Fight Mode assigns requests to bot traffic groups and lets you choose an action for each group. Set the verified bots group to Allow, then set the definitely automated and likely automated groups to Managed Challenge where those controls are available.

Key facts

• Cloudflare's Super Bot Fight Mode documentation says the product adds configurable actions per bot category and can challenge or block bots.
• Cloudflare's custom-rules documentation describes Verified bots as a managed category of high-trust bots, including Googlebot and Bingbot.
• The Bot Management API reference documents allow, block, and managed_challenge for definitely automated and likely automated requests.
• The same API reference documents allow and block for verified bot requests.
• Cloudflare says custom rules run before Super Bot Fight Mode managed rules, so a terminating custom-rule action prevents the request from reaching the bot settings.

Which action belongs to each traffic group?

Cloudflare's API names three separate Super Bot Fight Mode settings. A configuration that allows verified bots while challenging the two automated groups is represented by these documented field names and action values:

{
  "sbfm_definitely_automated": "managed_challenge",
  "sbfm_likely_automated": "managed_challenge",
  "sbfm_verified_bots": "allow"
}

The API reference describes the first field as the action for definitely automated requests and the second as the action for likely automated requests. Their documented choices are Allow, Block, and Managed Challenge. The verified-bots field has a narrower choice: Allow or Block. This makes Allow the documented setting for passing the verified group through Super Bot Fight Mode, while Managed Challenge remains available for the other two groups.

The plan table in Cloudflare's custom-rules documentation lists definitely automated and verified bots for Pro, Business, and Enterprise. It lists likely automated for Business and Enterprise. The dashboard therefore shows the group controls according to the plan and product configuration.

What does Cloudflare mean by verified bots?

Cloudflare describes Verified bots as a managed category of high-trust bots and gives Googlebot and Bingbot as examples. The documentation also says bot settings update automatically as Cloudflare identifies new bot signatures and AI crawlers, while custom rules require manual updates. The group is therefore maintained by Cloudflare's bot settings rather than by a static user-authored expression.

Super Bot Fight Mode protects an entire domain without endpoint restrictions. Its built-in group action consequently applies across the domain. If a site needs a different treatment for a path, Cloudflare's custom-rules documentation gives path-specific protection as a reason to use WAF custom rules. It also lists cf.bot_management.verified_bot in an example that blocks likely automated traffic only on /login:

(cf.bot_management.score lt 30 and not cf.bot_management.verified_bot and http.request.uri.path eq "/login")

How do you configure and check the result?

Cloudflare's setup instructions put the control in the dashboard under Security, Settings, Bot traffic, and Super Bot Fight Mode. After enabling the feature, choose how the domain responds to each traffic type with the associated edit icon. Set Verified bots to Allow and select Managed Challenge for the automated groups that your plan exposes.

Cloudflare says custom rules execute before Super Bot Fight Mode. A custom rule with Skip can bypass the Super Bot Fight Mode phase without terminating the request, while a terminating action such as Block or Managed Challenge keeps the request from reaching the bot settings. Chosen actions can be reviewed in Security, Analytics, on the Events tab; requests challenged by the product carry Super Bot Fight Mode in the Service field.

Related terms

• How do AWS WAF Bot Control rules treat verified bots?

FAQ

Can the verified bots group use Managed Challenge?

Cloudflare's API reference gives the verified-bots setting two values: Allow and Block. Managed Challenge is documented for the definitely automated and likely automated settings.

Does the built-in setting apply to one URL?

The bot settings apply across the domain. Use a WAF custom rule when handling needs to vary by path, such as the /login example in Cloudflare's documentation.

Where can you inspect challenged requests?

Open Security, Analytics, and the Events tab. Cloudflare labels requests challenged by Super Bot Fight Mode with Super Bot Fight Mode in the Service field.

Sources

1. Cloudflare, "Get started with Super Bot Fight Mode", 3 August 2026
2. Cloudflare, "Bot Management API", undated
3. Cloudflare, "Custom rules", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer