Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settings
Security
Security overview and big screenAttack logCC protectionWAFLists and access controlBots and scannersPaid protection add-ons
Analytics and alerts
StatisticsAccess logsAlerts and notifications
Accounts and licensing
Users and plansLicenses and add-ons

Bots and scanners

About 5 minUpdated 2026-10-28

Automated traffic includes legitimate search engines and ordinary crawlers, but also vulnerability scanners. Configure it in Security Center › Protection settings › Bot.

Bot detection

Nodes tell normal browsers, crawlers and automation tools apart by request features, and you can adjust the handling strength in the Bot settings. JA4 is a fingerprint computed from the client's TLS handshake: the same tool keeps its fingerprint even after changing IP or UA, which helps especially against tools hiding their identity.

Tip Look in the attack log for a day or two to see which bots visit before deciding which to block. Search engine crawlers should usually be allowed, otherwise indexing suffers.

Scanner protection

Recognizes the signatures of vulnerability scanners such as nuclei and LeakIX and handles them. Probes with invalid hostnames, such as hitting the IP directly or forging a domain, match no site and never reach your origin.

Automatic bans

IPs that keep hitting protection rules are banned automatically for a while and unlock when it expires. Banned IPs appear in "Lists" and can be unbanned manually.

Caution Bot, upload scan, tamper protection and leak protection events cannot be allowlisted yet. For false blocks, adjust the policy itself rather than expecting an allowlist entry.

Upload scanning, tamper protection and leak protection are also available depending on the plan; see Paid protection add-ons.