waf / reference record

Cloudflare

Web application firewall and DDoS protection

Cloudflarecloudflare

Operational profile

What it changes

Cloudflare is a content delivery network (CDN) and web application firewall (WAF) that provides DDoS mitigation, bot management, and security. The platform includes multiple layers of protection including Bot Management, DDoS protection, and the Cloudflare Challenge system. Cloudflare uses behavioral analysis, JavaScript challenges, and rate limiting to distinguish legitimate traffic from bot activity.

Observable evidence

Signal vocabulary

Headers

cf-ray
cf-cache-status
cf-request-id
server

Cookies

__cf_bm
__cfruid

Scripts

/cdn-cgi/challenge-platform/
/cdn-cgi/scripts/

Challenges

JavaScript Challenge
CAPTCHA Challenge