Cloudflare Bot Products · BFM vs SBFM vs BM

Before the tier comparison, here's the question that actually justifies this whole product. Most customers already have a WAF and assume it's handling bots too. It isn't, and it was never built to.

The WAF's whole job is looking at what a request is actually trying to do. Is there something dangerous hiding inside it, a SQL injection string in a form field, a script tag sitting where plain text belongs, a path trying to climb outside the web root. This is the OWASP Top 10 world, injection, broken access control, security misconfiguration, anything where the attack lives inside the payload itself. If a request is carrying something harmful, the WAF is built to catch it, and it's genuinely good at that job.

Here's where it stops. A huge share of unwanted traffic never carries an attack payload at all. A scraper copying your prices every few minutes sends a perfectly well formed request, nothing broken, nothing injected, nothing for a WAF to flag. A credential stuffing attempt looks like a completely ordinary login, real looking username and password fields, just automated and repeated thousands of times a minute. A bot hoarding checkout inventory looks exactly like a fast shopper clicking buy. None of it trips a single WAF rule, because none of it is attacking anything. It's just automated.

That's exactly where Bot Management saves the day. It isn't trying to answer the WAF's question again, it's answering one the WAF was never built to ask. It doesn't care whether a request looks dangerous, it cares whether a real person is actually behind it. That's why so much of the traffic quietly costing businesses money sails straight past a fully configured WAF untouched, none of it was ever trying to look malicious, it just isn't human, and Bot Management is the one actually checking for that.