How to reduce bot traffic before it reaches Lucky Orange

If you're seeing a large number of automated or bot sessions in Lucky Orange, one option is to use a service such as Cloudflare to identify and challenge bot traffic before it reaches your website.

When Cloudflare is configured as a proxy for your website, incoming requests pass through Cloudflare before your website is served. If Cloudflare challenges or blocks an automated request, your website — including the Lucky Orange tracking code — may never load for that visitor. This can reduce the number of bot sessions that appear in Lucky Orange.

Note: Cloudflare is a third-party service. Cloudflare product availability, pricing and functionality may change. Lucky Orange cannot configure Cloudflare on your behalf or guarantee that Cloudflare will identify all automated traffic.

Before you get started

Cloudflare is a third-party service and is not managed by Lucky Orange. Bot detection is not perfect, and some automated traffic may still reach your website.

Cloudflare also has the potential to challenge legitimate traffic, integrations, monitoring tools or API requests. We recommend reviewing Cloudflare's documentation and monitoring its Security Analytics after enabling bot protection.

If you already use Cloudflare

Make sure the DNS records serving your website are set to Proxied in Cloudflare. Proxied records display an orange cloud in the Cloudflare dashboard.

If the record is set to DNS only, website traffic bypasses Cloudflare's reverse proxy and Cloudflare's bot protection will not be applied to that traffic.

If you don't currently use Cloudflare

You'll first need to add your domain to Cloudflare.

In the most common setup, this requires:

  1. Creating a Cloudflare account and adding your domain.
  2. Reviewing the DNS records Cloudflare imports for your domain.
  3. Updating your domain's nameservers to the nameservers provided by Cloudflare.
  4. Confirming your website's web-serving DNS records are proxied through Cloudflare.

Be especially careful to verify your DNS records before changing nameservers. Incorrect DNS configuration can make your website or other services unavailable.

Option 1: Cloudflare Bot Fight Mode

Cloudflare includes Bot Fight Mode on its Free plan.

Bot Fight Mode identifies traffic matching known bot patterns and issues a computational challenge intended to make automated requests more difficult. It applies across the domain once enabled.

To enable it:

  1. Log in to your Cloudflare dashboard.
  2. Select your website.
  3. Go to Security > Settings.
  4. Filter the settings by Bot traffic.
  5. Find Bot Fight Mode.
  6. Turn Bot Fight Mode on.

Important limitation

Bot Fight Mode provides basic protection and has limited customization. You cannot create exceptions for specific traffic using Cloudflare WAF rules.

If you have legitimate automated traffic — such as monitoring services, APIs or other integrations — consider Cloudflare's Super Bot Fight Mode instead.

Option 2: Cloudflare Super Bot Fight Mode

Customers on Cloudflare Pro, Business or Enterprise plans can use Super Bot Fight Mode.

Compared with Bot Fight Mode, Super Bot Fight Mode provides more control over how Cloudflare handles different categories of automated traffic and provides additional bot analytics.

To enable it:

  1. Log in to Cloudflare and select your website.
  2. Go to Security > Settings.
  3. Filter by Bot traffic.
  4. Turn Bot Fight Mode off if it is currently enabled.
  5. Turn Super Bot Fight Mode on.
  6. Configure how Cloudflare should handle the available bot categories.

For Cloudflare Pro customers, Cloudflare can identify Definitely Automated traffic and allows you to choose whether to allow, challenge or block it. Cloudflare Pro does not currently include the Likely Automated category available with more advanced bot protection.

We recommend starting cautiously with a challenge action and reviewing the results before moving to more aggressive blocking.

Don't automatically block all legitimate bots

Some automated traffic serves a legitimate purpose, including search-engine crawlers and other verified services.

Cloudflare provides a Verified Bots category for recognized legitimate bots. In most cases, you'll want to allow verified bots unless you have a specific reason to block them.

Monitor the results

After enabling Cloudflare bot protection, monitor both Cloudflare and Lucky Orange.

In Cloudflare, go to:

Security > Analytics > Events

Cloudflare identifies requests acted on by Bot Fight Mode so you can review which traffic is being challenged.

In Lucky Orange, look for changes such as:

  • Fewer sudden spikes in Session Recordings
  • Fewer repetitive one-page sessions
  • Fewer sessions from unusual automated traffic patterns
  • Slower consumption of your monthly Lucky Orange session allowance

Give the change enough time to compare traffic before and after enabling Cloudflare protection.

What if legitimate visitors are being challenged?

If you are using the Free Bot Fight Mode, customization is limited. If it interferes with traffic you need to allow, you may need to turn Bot Fight Mode off or consider Super Bot Fight Mode.

Super Bot Fight Mode supports exceptions through Cloudflare WAF custom rules, which can be useful for approved automated traffic, APIs or monitoring services.

Will Cloudflare remove all bot sessions from Lucky Orange?

No.

Cloudflare can reduce automated traffic before it reaches your website, but no bot-detection system will identify every automated visitor. More sophisticated bots may imitate normal browsers and human behavior.

You may therefore continue to see some suspected bot traffic in Lucky Orange even after enabling Cloudflare protection.

Which Cloudflare option should I start with?

If you're looking for a simple first step, Cloudflare's Free Bot Fight Mode can provide baseline bot protection.

If you need more control over how automated traffic is handled, analytics into bot activity, or the ability to create exceptions for legitimate automated traffic, consider Super Bot Fight Mode on Cloudflare Pro or above.

For more advanced protection against sophisticated automation, Cloudflare offers additional bot-detection capabilities on higher-tier plans.

Compare Cloudflare bot protection options

Cloudflare offers different levels of bot protection depending on your plan:

  • Free: Includes Bot Fight Mode for baseline protection against simple bots and headless browsers.
  • Pro: Includes Super Bot Fight Mode, which adds more control over definitely automated traffic and additional bot-related analytics.
  • Business: Adds detection and handling for more sophisticated and likely automated traffic.
  • Enterprise: Offers Bot Management with granular bot scoring, advanced analytics and more flexible rules.

You can review Cloudflare's current plans and bot-protection features here:

Still need help? Contact Us Contact Us