Bot Fight Mode is Cloudflare’s one-click bot protection on the Free plan. It issues challenges to traffic that Cloudflare scores as automated. Verified search crawlers like Googlebot and Bingbot are normally let through — so in most cases it does not hurt Google rankings directly. The trouble is everything around it.
What it can break
- Crawlers outside the verified list: smaller search engines, SEO tools, some AI crawlers.
- Your own integrations: uptime monitors, payment and form webhooks, headless CMS fetches, feeds.
- Data-center visitors: corporate VPNs and cloud-based browsers can get challenged.
Why it is hard to whitelist
Bot Fight Mode cannot be bypassed with the Skip action in WAF custom rules. If something important gets challenged, the options are to turn Bot Fight Mode off or to move to a plan with Super Bot Fight Mode, which supports more granular control.
Bot Fight Mode vs Super Bot Fight Mode
Super Bot Fight Mode (Pro and Business plans) lets you choose actions separately for definitely automated and likely automated traffic, allow verified bots explicitly and protect static resources optionally. See the full comparison.
How to tell if it is affecting crawlers
- Security → Events: filter by Service “Bot fight mode”. Look at the user-agents.
- Challenges are logged as managed challenges, not blocks — search for both.
- Run the Cloudflare SEO checker: it detects challenge pages served to crawlers even when the status code is 200 or 403.