Cloudflare bot protection checker
You switched on Bot Fight Mode in Cloudflare and nothing changed — of course it did not: you browse with a browser, and Bot Fight Mode does not challenge you. This tool asks the question the way a bot would. One plain request, no JavaScript, no cookies, from a server, and we show you exactly what Cloudflare answered.
Enter a site name to begin.
2 checks a day without signing in, 10 a day when signed in — and only the signed-in ones are saved for you.
Want more than 2 a day? Sign in with Google — the same sign-in the API page uses — for 10 checks a day and a saved record of what you checked. Nothing is put in a cookie: the sign-in lives in this tab.
Signing in happens
between your browser and Google; we never see your password. If no button
appears above, an extension or an offline browser is blocking
accounts.google.com — the API page uses
the same sign-in.
What other people are checking
Nothing yet. Checks appear here as soon
as the first person runs one — including the ones made without signing in. A host
that never answered, a private address or a name that does not resolve is never
listed, and nothing after the / that looks like a secret is kept.
Only hosts that really answered are listed. The same host is listed at most once an hour, and the query string of a check is stripped before it is shown or stored.
How to read the answer
- Challenged — Cloudflare answered our plain request with a "verify you are human" interstitial. That is Bot Fight Mode doing its job, or a WAF challenge rule, or an under-attack rule: all three look identical from the outside.
- Blocked — Cloudflare refused the request outright instead of challenging it. That is usually a WAF rule or a rate limit rather than Bot Fight Mode, which prefers to challenge.
- Allowed through — Cloudflare is in front of the host and let this no-JavaScript request through. Either Bot Fight Mode is off, or it did not read this request as a bot.
- No Cloudflare seen — nothing in the response names Cloudflare. Either the host is not proxied through Cloudflare, or it hides the header. There is no Bot Fight Mode verdict to give.
What this tool cannot tell you
It is not a browser. We never run JavaScript, so we cannot solve a challenge and cannot promise what a real visitor sees. A challenge shown to us is exactly what Bot Fight Mode does to a client like us; it is not proof that people are locked out, and its absence is not proof that they are not.
Verified bots, IP allowlists and "super bot fight mode" rules are invisible here. Cloudflare has separate settings for verified bots, for specific countries and for particular paths, and this check sees exactly one URL from one place. If you want to know what your own visitors get, watch the firewall events in the Cloudflare dashboard.
The screenshot is a third party's. The little image beside a result is fetched by your own browser from thum.io, and the site name goes to them. It is not part of the verdict and it is not stored here.
Limits
2 checks a day without signing in, 10 a day signed in, counting from 00:00 UTC. A site already tested in the last ten minutes is answered from memory and does not use up a check. The signed-in checks are saved in a database so you can find them again; the anonymous ones are kept in memory only, so the public list above forgets them when the service restarts — and nobody, us included, keeps a per-address history of who checked what.
More
Other angles on the same fetch: HTTP status and security headers, the AdSense and analytics checker, and the whole tool suite.