For sites on Cloudflare, the site’s Security tab gathers the protections you control yourself: I’m Under Attack mode, your own firewall rules, and bot protection.
💡 Being hammered right now?
Turn on I’m Under Attack and choose to switch it off automatically after 1, 6 or 24 hours, so you do not have to remember.
What’s in this guide
I’m Under Attack mode
Every visitor is checked by the CDN before reaching your site, which stops most floods of bad traffic. While it is on it also affects blueprint screenshots of the site, uptime monitors, SEO and marketing tools, API and webhook integrations and some bots and RSS readers – so switch it on when you need it and let it turn itself off. When it goes off, the previous security level comes back.
Your own firewall rules
Block, challenge or allow traffic by IP address or range, network (AS number), country, path or request method, and switch each rule on or off. There are two kinds: custom rules and rate-limiting rules (a limit on requests per period). The number of each is limited by the CDN’s plan, and the tab shows how many you have used. Rules made directly in a Cloudflare account show here read-only.
Bot protection
- Block AI crawlers (on by default): blocks crawlers that harvest content to train AI models. Google, Bing and other verified search engines are not affected.
- Bot Fight Mode (off by default): challenges every visitor the CDN believes is automated. It also breaks blueprint screenshots, uptime monitors, SEO tools and integrations, so turn it on only while bots are a problem.