![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
User Agent Blocking
User Agent Blocking allows you to block specific browser or web application User-Agent request headers . User agent rules apply to the entire domain instead of individual subdomains.
User agent rules are applied after zone lockdown rules. If you allow an IP address via Zone Lockdown, it will skip any user agent rules.
Note
Cloudflare recommends that you use custom rules instead of user agent rules to block specific user agents.
For example, a custom rule equivalent to the user agent example rule provided in this page could have the following configuration:
- Expression:
http.user_agent eq "BadBot/1.0.2 (+http://bad.bot)" - Action: (a block or challenge action)
Cloudflare User Agent Blocking is available on all plans. The User agent rules option appears only if you have configured at least one user agent rule.
The number of available user agent rules depends on your Cloudflare plan.
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Availability | Yes | Yes | Yes | Yes |
| Number of rules | 10 | 50 | 250 | 1,000 |
Note
The User agent rules option appears only if you have configured at least one user agent rule. Cloudflare recommends that you use custom rules instead of user agent rules.
-
In the Cloudflare dashboard, go to the Security rules page.
Go to Security rules ↗ -
Select Create rule > User agent rules.
-
Enter a descriptive name for the rule in Name/Description.
-
In Action, select the action to perform: Block, Non-Interactive Challenge, Managed Challenge, or Interactive Challenge.
-
Enter a user agent value in User Agent (wildcards such as
*are not supported). For example, to block the Bad Bot web spider, enterBadBot/1.0.2 (+http://bad.bot). -
Select Save and Deploy blocking rule.
Issue a POST request for the Create a User Agent Blocking rule operation similar to the following:
Required API token permissions
At least one of the following token permissions is required:Firewall Services Write
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/ua_rules" \
--request POST \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"description": "Block Bad Bot web spider",
"mode": "block",
"configuration": {
"target": "ua",
"value": "BadBot/1.0.2 (+http://bad.bot)"
}
}'When a User Agent Blocking rule uses a challenge action such as Managed Challenge, the visitor must pass a challenge page. After passing the challenge, a cf_clearance cookie is set. The duration of this cookie is controlled by the Challenge Passage setting.
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}