Hi team, we are looking into a scanning activity performed against one of our endpoints and see the following response codes: 308, 404, 400, 429, 403. However, if I look into Security->Bots, the bot score is 1 for the entire scanning activity. Should I expect to see just 404 as response code for all of these requests or it is expected to see all the response codes I’ve mentioned above? Thank you!
Bot score of 1 is definitely a bot, but depending on what security level and other Cloudflare features, bot actions, rate limits, WAF rules and so on you have set will determine the response, if any, from Cloudflare or if the request passes to your origin to return instead.
404 can only come from your origin, not Cloudflare. For other codes, check if they are returned by Cloudflare or your origin.