Cloudflare Bot Products · BFM vs SBFM vs BM

Three tiers, three problems. Pick the one that matches what the customer is losing sleep over.
Bot Fight Mode · Free
The on/off switch
What it isA single toggle that blocks the loudest, most obvious bots — the ones that don't try to hide, like scripts running from cloud servers or old scraping tools.
Who it's forPersonal sites, side projects, small blogs. You want "not zero" bot protection and won't pay for it.
TradeoffNo settings. You can't tune it. If it accidentally blocks Googlebot, your only fix is to turn it all off.
Any plan — $0
Super Bot Fight Mode · Pro
Same detection + a settings screen
What it isSame detection as Free, but now you decide what happens: block bots, challenge them with a puzzle, or just log them. Plus a basic report.
Who it's forSmall businesses where the website matters to revenue — freelancers, small e-commerce, marketing sites.
TradeoffStill only catches the obvious bots. Anything that fakes being a real browser (which most modern bots do) walks right through.
Pro plan — $20/mo
Super Bot Fight Mode · Biz + Ent
Now with machine learning
What it isSame settings screen as Pro, but the detection is much smarter. ML models catch bots trying to hide as real browsers. You also get a real analytics dashboard.
Who it's forMid-size businesses that have noticed bots costing them something — scraped prices, form spam, credential stuffing on the login page.
TradeoffStill no custom rules. Cloudflare decides what happens based on categories. You can't say "block bots on this page but not that one."
Business $200/mo or Enterprise
Bot Management · Enterprise
A score for every request — you write the rules
What it isEvery request gets a 1–99 score (1 = bot, 99 = human). You build any rule you want against that score. Also unlocks TLS fingerprinting, mobile SDK, and sending the score to your own systems.
Who it's forBusinesses where bots cost real money — airlines fighting seat-hoarders, ticketing fighting scalpers, retailers fighting inventory bots, banks fighting fraud.
TradeoffNot self-serve. Enterprise contract required. You'll spend real time tuning it — but you're getting a real tool.
Enterprise add-on — custom
  Bot Fight Mode
(Free)		 Super Bot Fight Mode
(Pro)		 Super Bot Fight Mode
(Biz + Ent)		 Bot Management
(Enterprise add-on)
Mitigate definite botsScore = 1 · obvious automation ✓ ✓ ✓ ✓
Heuristics & JavaScript DetectionsClient-side signals + known patterns ✓ ✓ ✓ ✓
Choose class of actionBlock vs. challenge vs. allow ✓ ✓ ✓ ✓
Bot ReportVery simple analytics view ✓ ✓ ✓ ✓
Mitigate likely botsScore 2–29 · harder-to-detect automation ✓ ✓ ✓ ✓
Machine LearningML-driven detection of sophisticated bots ✓ ✓ ✓ ✓
Bot AnalyticsDedicated tool in Security Analytics ✓ ✓ ✓ ✓
Firewall Rules & granular bot scores (1–99)Custom rules on per-request score ✓ ✓ ✓ ✓
Logs & WorkersForward score to origin, use in Workers ✓ ✓ ✓ ✓
Behavioral AnalysisSession-level behavioral signals ✓ ✓ ✓ ✓
False positive supportCloudflare team helps tune your rules ✓ ✓ ✓ ✓
Use on specific paths / user agentsPath- and UA-scoped rules ✓ ✓ ✓ ✓
Choose type of actionJS challenge, managed challenge, block, log ✓ ✓ ✓ ✓
AI bot controlsBlock AI bots, AI Labyrinth, managed robots.txt ✓ ✓ ✓ ✓
Verified bots handlingGoogle, Bing, uptime monitors, etc. Risky ✓ ✓ ✓
JA3 / JA4 TLS fingerprintingIdentify clients by TLS handshake signature ✓ ✓ ✓ ✓
Detection IDsTarget individual bot detections by ID ✓ ✓ ✓ ✓
Mobile SDKNative iOS + Android bot detection ✓ ✓ ✓ ✓
Forward bot score to originYour SIEM / logs / origin app sees the score ✓ ✓ ✓ ✓

💬 The Upgrade Conversation

How to figure out which tier a customer needs, live on a call

  1. "Are you on Free, Pro, Business, or Enterprise today?"
    Anchors the starting point. Their answer tells you which tier is even available to them.
  2. "Have you noticed bot traffic causing pain? What kind — scraping, fraud, form spam, credential stuffing, inventory hoarding, API abuse?"
    Their answer tells you which tier they actually need. The specific words they use are diagnostic.
  3. If they can quantify a dollar loss → they need Bot Management. Not SBFM. Don't undersell — you'll lose them at renewal.
  4. If they say "we think there's bots but we're not sure" AND they're on Business/Enterprise → SBFM (Biz+Ent) gives them the Bot Analytics tool to prove it. Then upgrade to BM with data on your side.
  5. If they're on Pro and describe form-spam or scraping → SBFM (Pro) gets them block/challenge/allow controls. If pain gets worse, that's an upgrade conversation to Business or straight to BM.
  6. If they say "we haven't noticed anything but want protection" → BFM is fine. Revisit in 6 months. Don't oversell.

⚠ Three Mistakes SEs Make on This

Anti-patterns that cost deals or damage the account

1. Selling SBFM when BM is the right answer
"It's cheaper and they'll get value." SBFM won't catch the sophisticated bots the customer is losing money to. When they don't see improvement, they blame Cloudflare and churn. If they can quantify a dollar loss, they need BM. Full stop.
2. Selling BM when the customer's real problem is DDoS or WAF gaps
Bots and volumetric attacks are different problems. Always ask "is this bot traffic or is this attack traffic?" first. If they're describing L7 floods, they need better WAF or Advanced Rate Limiting, not BM. If they're describing L3/L4 floods, they need Magic Transit or Spectrum, not BM.
3. Not warning the customer about verified bots on the Free tier
BFM can block Googlebot in some configurations. This is the #1 support ticket source. Always mention it explicitly: "You want to enable this in log-only mode first, or make sure your verified-bots allowance is set correctly, so you don't accidentally break your SEO."
Cloudflare Bots docs