Firewall managed challenge vs Facebook Scraper bot

[dcheng]

Hello, I have a rule that blocks the scraper bot in facebook sharing debugger

I tried with a rule (cf.client.bot) with action Managed Challenge (Recommended) but it returns 403. Thus I need to use Allow to make it works.

So I have a question that, is it fine in terms of security? Will it also allow some malicious bots?

[KianNH]

cf.client.bot indicates a ‘known good’ bot. For future reference, Fields reference · Cloudflare Ruleset Engine docs

You should make a rule where if cf.client.bot is true, use the Allow action.