User Agent Blocking

import { TabItem, Tabs, Steps, APIRequest, DashButton, } from "~/components";

User Agent Blocking allows you to block specific browser or web application User-Agent request headers. User agent rules apply to the entire domain instead of individual subdomains.

User agent rules are applied after zone lockdown rules. If you allow an IP address via Zone Lockdown, it will skip any user agent rules.

:::note

Cloudflare recommends that you use custom rules instead of user agent rules to block specific user agents.

For example, a custom rule equivalent to the user agent example rule provided in this page could have the following configuration:

• Expression: http.user_agent eq "BadBot/1.0.2 (+http://bad.bot)"
• Action: (a block or challenge action)

:::

Availability

Cloudflare User Agent Blocking is available on all plans. The User agent rules option appears only if you have configured at least one user agent rule.

The number of available user agent rules depends on your Cloudflare plan.

Create a User Agent Blocking rule

:::note The User agent rules option appears only if you have configured at least one user agent rule. Cloudflare recommends that you use custom rules instead of user agent rules. :::

1. In the Cloudflare dashboard, go to the Security rules page.

2. Select Create rule > User agent rules.

3. Enter a descriptive name for the rule in Name/Description.

4. In Action, select the action to perform: Block, Non-Interactive Challenge, Managed Challenge, or Interactive Challenge.

5. Enter a user agent value in User Agent (wildcards such as * are not supported). For example, to block the Bad Bot web spider, enter BadBot/1.0.2 (+http://bad.bot).

6. Select Save and Deploy blocking rule.

Issue a POST request for the Create a User Agent Blocking rule operation similar to the following:

<APIRequest path="/zones/{zone_id}/firewall/ua_rules" method="POST" json={{ description: "Block Bad Bot web spider", mode: "block", configuration: { target: "ua", value: "BadBot/1.0.2 (+http://bad.bot)", }, }} />

Challenge actions

When a User Agent Blocking rule uses a challenge action such as Managed Challenge, the visitor must pass a challenge page. After passing the challenge, a cf_clearance cookie is set. The duration of this cookie is controlled by the Challenge Passage setting.

Related resources

• Secure your application
• Cloudflare Zone Lockdown