Cloudflare updated list as of 2021 "User Agent Blocking" Web Firewall Protection

I’ve decide to update the list here ready for free users and paid

Free users

(http.user_agent contains “360Spider”) or (http.user_agent contains “acapbot”) or (http.user_agent contains “acoonbot”) or (http.user_agent contains “ahrefs”) or (http.user_agent contains “alexibot”) or (http.user_agent contains “attackbot”) or (http.user_agent contains “backdorbot”) or (http.user_agent contains “becomebot”) or (http.user_agent contains “blackwidow”) or (http.user_agent contains “blekkobot”) or (http.user_agent contains “blowfish”) or (http.user_agent contains “bullseye”) or (http.user_agent contains “bunnys”) or (http.user_agent contains “butterfly”) or (http.user_agent contains “careerbot”) or (http.user_agent contains “casper”) or (http.user_agent contains “checkpriv”) or (http.user_agent contains “cheesebot”) or (http.user_agent contains “chinaclaw”) or (http.user_agent contains “choppy”) or (http.user_agent contains “cmsworld”) or (http.user_agent contains “copyrightcheck”) or (http.user_agent contains “datacha”) or (http.user_agent contains “demon”) or (http.user_agent contains “discobot”) or (http.user_agent contains “dotbot”) or (http.user_agent contains “dotnetdotcom”) or (http.user_agent contains “dumbot”) or (http.user_agent contains “emailcollector”) or (http.user_agent contains “emailsiphon”) or (http.user_agent contains “emailwolf”) or (http.user_agent contains “exabot”) or (http.user_agent contains “extract”) or (http.user_agent contains “eyenetie”) or (http.user_agent contains “feedfinder”) or (http.user_agent contains “flaming”) or (http.user_agent contains “foobot”) or (http.user_agent contains “g00g1e”) or (http.user_agent contains “gigabot”) or (http.user_agent contains “go-ahead-got”) or (http.user_agent contains “gozilla”) or (http.user_agent contains “grabnet”) or (http.user_agent contains “harvest”) or (http.user_agent contains “httrack”) or (http.user_agent contains “jetbot”) or (http.user_agent contains “jikespider”) or (http.user_agent contains “kmccrew”) or (http.user_agent eq “leechftp”) or (http.user_agent contains “linkextractor”) or (http.user_agent contains “linkscan”) or (http.user_agent contains “linkwalker”) or (http.user_agent contains “loader”) or (http.user_agent contains “masscan”) or (http.user_agent contains “miner”) or (http.user_agent contains “majestic”) or (http.user_agent contains “mechanize”) or (http.user_agent contains “netmechanic”) or (http.user_agent contains “netspider”) or (http.user_agent contains “ninja”) or (http.user_agent contains “octopus”) or (http.user_agent contains “pagegrabber”) or (http.user_agent contains “planetwork”) or (http.user_agent contains “postrank”) or (http.user_agent contains “proximic”) or (http.user_agent contains “purebot”) or (http.user_agent contains “pycurl”) or (http.user_agent contains “python”) or (http.user_agent contains “queryn”) or (http.user_agent contains “queryseeker”) or (http.user_agent contains “radiation”) or (http.user_agent contains “realdownload”) or (http.user_agent contains “rogerbot”) or (http.user_agent contains “scooter”) or (http.user_agent contains “seekerspider”) or (http.user_agent contains “siclab”) or (http.user_agent contains “sindice”) or (http.user_agent contains “sitebot”) or (http.user_agent contains “siteexplorer”) or (http.user_agent contains “sitesnagger”) or (http.user_agent contains “smartdownload”) or (http.user_agent contains “sosospider”) or (http.user_agent contains “spankbot”) or (http.user_agent contains “spbot”) or (http.user_agent contains “sqlmap”) or (http.user_agent contains “stackrambler”) or (http.user_agent contains “stripper”) or (http.user_agent contains “sucker”) or (http.user_agent contains “suzukacz”) or (http.user_agent contains “suzuran”) or (http.user_agent contains “teleport”) or (http.user_agent contains “telesoft”) or (http.user_agent contains “true_robots”) or (http.user_agent contains “turingos”) or (http.user_agent contains “vampire”) or (http.user_agent contains “webwhacker”) or (http.user_agent contains “woxbot”) or (http.user_agent contains “xaldon”) or (http.user_agent contains “yamanalab”) or (http.user_agent contains “zmeu”)

Paid Users

(360Spider|acapbot|acoonbot|ahrefs|alexibot|asterias|attackbot|backdorbot|becomebot|binlar|blackwidow|blekkobot|blexbot|blowfish|bullseye|bunnys|butterfly|careerbot|casper|checkpriv|cheesebot|cherrypick|chinaclaw|choppy|clshttp|cmsworld|copernic|copyrightcheck|cosmos|crescent|cy_cho|datacha|demon|diavol|discobot|dittospyder|dotbot|dotnetdotcom|dumbot|emailcollector|emailsiphon|emailwolf|exabot|extract|eyenetie|feedfinder|flaming|flashget|flicky|foobot|g00g1e|getright|gigabot|go-ahead-got|gozilla|grabnet|grafula|harvest|heritrix|httrack|icarus6j|jetbot|jetcar|jikespider|kmccrew|leechftp|libweb|linkextractor|linkscan|linkwalker|loader|masscan|miner|majestic|mechanize|mj12bot|morfeus|moveoverbot|netmechanic|netspider|nicerspro|nikto|ninja|nutch|octopus|pagegrabber|planetwork|postrank|proximic|purebot|pycurl|python|queryn|queryseeker|radian6|radiation|realdownload|rogerbot|scooter|seekerspider|semalt|siclab|sindice|sistrix|sitebot|siteexplorer|sitesnagger|skygrid|smartdownload|snoopy|sosospider|spankbot|spbot|sqlmap|stackrambler|stripper|sucker|surftbot|sux0r|suzukacz|suzuran|takeout|teleport|telesoft|true_robots|turingos|turnit|vampire|vikspider|voideye|webleacher|webreaper|webstripper|webvac|webviewer|webwhacker|winhttp|wwwoffle|woxbot|xaldon|xxxyy|yamanalab|yioopbot|youda|zeus|zmeu|zune|zyborg)

Business & Enterprise

(http.user_agent matches "360Spider|acapbot|acoonbot|ahrefs|alexibot|asterias|attackbot|backdorbot|becomebot|binlar|blackwidow|blekkobot|blexbot|blowfish|bullseye|bunnys|butterfly|careerbot|casper|checkpriv|cheesebot|cherrypick|chinaclaw|choppy|clshttp|cmsworld|copernic|copyrightcheck|cosmos|crescent|cy_cho|datacha|demon|diavol|discobot|dittospyder|dotbot|dotnetdotcom|dumbot|emailcollector|emailsiphon|emailwolf|exabot|extract|eyenetie|feedfinder|flaming|flashget|flicky|foobot|g00g1e|getright|gigabot|go-ahead-got|gozilla|grabnet|grafula|harvest|heritrix|httrack|icarus6j|jetbot|jetcar|jikespider|kmccrew|leechftp|libweb|linkextractor|linkscan|linkwalker|loader|masscan|miner|majestic|mechanize|mj12bot|morfeus|moveoverbot|netmechanic|netspider|nicerspro|nikto|ninja|nutch|octopus|pagegrabber|planetwork|postrank|proximic|purebot|pycurl|python|queryn|queryseeker|radian6|radiation|realdownload|rogerbot|scooter|seekerspider|semalt|siclab|sindice|sistrix|sitebot|siteexplorer|sitesnagger|skygrid|smartdownload|snoopy|sosospider|spankbot|spbot|sqlmap|stackrambler|stripper|sucker|surftbot|sux0r|suzukacz|suzuran|takeout|teleport|telesoft|true_robots|turingos|turnit|vampire|vikspider|voideye|webleacher|webreaper|webstripper|webvac|webviewer|webwhacker|winhttp|wwwoffle|woxbot|xaldon|xxxyy|yamanalab|yioopbot|youda|zeus|zmeu|zune|zyborg")

Any help with this guide that would be much appreciated
https://community.cloudflare.com/t/security-wordpress-protection-like-eset-smart-security-firewall/325511?u=pc_repair

1 Like

If you are referring to the “User Agent Blocking” feature in Cloudflare, regex is not supported, so you can’t just insert the entire string into UA Blocking rule.

You can use Firewall Rules instead, but if you are Free or Pro plan customer, you may only use the “contains” operator to check if the user agent string contains the specific word, but no regex support. Regex support is available for Business or Enterprise customers, so the string that you shared will work for them.

2 Likes

so how does the sring for free users work?

It will become very complicated.

(http.user_agent contains "360Spider") or (http.user_agent contains "acapbot") or (http.user_agent contains "acoonbot") or (http.user_agent contains "ahrefs") or (http.user_agent contains "alexibot") or (http.user_agent contains "asterias") or (http.user_agent contains "etc. etc. etc. etc. for the rest of the user agent keywords")

A bunch of “Or” comparison is needed.

1 Like

I’ll get the list sorted for FREE users exciting :joy: thanks

1 Like

I have hit my limit of 4096

expression size 6039 exceeded a maximum of 4096

can anyone give us the top list …as free users are limited to 4096…
what are the main bots…

I have updated the list…

1 Like

And then, Business & Enterprise users firewall expressions can be as simple as

(http.user_agent matches "360Spider|acapbot|acoonbot|ahrefs|alexibot|asterias|attackbot|backdorbot|becomebot|binlar|blackwidow|blekkobot|blexbot|blowfish|bullseye|bunnys|butterfly|careerbot|casper|checkpriv|cheesebot|cherrypick|chinaclaw|choppy|clshttp|cmsworld|copernic|copyrightcheck|cosmos|crescent|cy_cho|datacha|demon|diavol|discobot|dittospyder|dotbot|dotnetdotcom|dumbot|emailcollector|emailsiphon|emailwolf|exabot|extract|eyenetie|feedfinder|flaming|flashget|flicky|foobot|g00g1e|getright|gigabot|go-ahead-got|gozilla|grabnet|grafula|harvest|heritrix|httrack|icarus6j|jetbot|jetcar|jikespider|kmccrew|leechftp|libweb|linkextractor|linkscan|linkwalker|loader|masscan|miner|majestic|mechanize|mj12bot|morfeus|moveoverbot|netmechanic|netspider|nicerspro|nikto|ninja|nutch|octopus|pagegrabber|planetwork|postrank|proximic|purebot|pycurl|python|queryn|queryseeker|radian6|radiation|realdownload|rogerbot|scooter|seekerspider|semalt|siclab|sindice|sistrix|sitebot|siteexplorer|sitesnagger|skygrid|smartdownload|snoopy|sosospider|spankbot|spbot|sqlmap|stackrambler|stripper|sucker|surftbot|sux0r|suzukacz|suzuran|takeout|teleport|telesoft|true_robots|turingos|turnit|vampire|vikspider|voideye|webleacher|webreaper|webstripper|webvac|webviewer|webwhacker|winhttp|wwwoffle|woxbot|xaldon|xxxyy|yamanalab|yioopbot|youda|zeus|zmeu|zune|zyborg")

2 Likes

thanks for the update :ok_hand:

There is also a firewall option to just block known bots as well if you haven’t enabled that option yet I would recommend it.

Known bots are good bots, like Google, Bing, Yandex. You probably don’t want to block those.

Ah yeah. The list is quite short, my bad

Yeah I’m well aware of this but seem like its blocking knows bots such as Google, Bing, Yandex
if we can have the mod input in this that would be great.

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.