---
title: Detection IDs · Cloudflare bot solutions docs
description: Detection IDs are static rules used to detect predictable bot
  behavior with no overlap with human traffic. Detection IDs refer to the
  precise detection used to identify a bot, which could be from heuristics,
  verified bot detections, or anomaly detections. For example, a detection ID
  can identify if you sent your headers in a different order than what was
  expected of your browser.
lastUpdated: 2025-09-26T21:09:24.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/bots/additional-configurations/detection-ids/
  md: https://developers.cloudflare.com/bots/additional-configurations/detection-ids/index.md
---

Detection IDs are static rules used to detect predictable bot behavior with no overlap with human traffic. Detection IDs refer to the precise [detection](https://developers.cloudflare.com/bots/concepts/bot-detection-engines/) used to identify a bot, which could be from heuristics, verified bot detections, or anomaly detections. For example, a detection ID can identify if you sent your headers in a different order than what was expected of your browser.

If you are having an issue with one of our heuristics, detection IDs allow you to decide which heuristics to enforce on your zones using customer configurable heuristics. You can choose unique actions for different bots, detected through Cloudflare’s heuristics engine. You can block, allow, or serve alternate content to specific bots to meet the unique needs of your site’s traffic.

Note

A request can trigger multiple detection IDs.

You can use `cf.bot_management.detection_ids` fields in tools such as:

* [Custom rules](https://developers.cloudflare.com/waf/custom-rules/)
* [Advanced Rate Limiting](https://developers.cloudflare.com/waf/rate-limiting-rules/)
* [Transform Rules](https://developers.cloudflare.com/rules/transform/)
* [Workers](https://developers.cloudflare.com/workers/) (as `request.cf.botManagement.detectionIds`)

Bot Detection IDs and tags are also available in [Bot Analytics](https://developers.cloudflare.com/bots/bot-analytics/) and [Security Analytics](https://developers.cloudflare.com/waf/analytics/security-analytics/).

***

## Detection tags

Detection tags refer to the category associated with the detection ID at the time that Cloudflare has fingerprinted a bot. For example, if a detection tag is `go`, this means that Cloudflare has observed traffic from that detection ID from a Go programming language bot.

Note

Detection tags are available in Security Analytics, but not in the Security Events.

***

## Create or edit an expression

* Old dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
  2. Go to **Security** > **Bots**, apply filters and select **Create custom rule** to create a [custom rule](https://developers.cloudflare.com/waf/custom-rules/create-dashboard/) based on those filters. Alternatively, if you already created a custom rule, go to **Security** > **WAF** > **Custom rules** and edit the expression of an existing custom rule.
  3. Use the `cf.bot_management.detection_ids` field in the rule expression.
  4. Select **Save**.

* New dashboard

  1. In the Cloudflare dashboard, go to the **Security Analytics** page.

     [Go to **Analytics**](https://dash.cloudflare.com/?to=/:account/:zone/security/analytics)

  2. Apply filters and select **Create custom security rule** to create a custom rule based on your filters.

     Alternatively, if you have already created a custom rule, you can go to the existing rule in **Security rules** and edit the expression based on your filters.

     [Go to **Security rules**](https://dash.cloudflare.com/?to=/:account/:zone/security/security-rules)

  3. Use the `cf.bot_management.detection_ids` field in the rule expression.

  4. Select **Deploy**.

***

## Use cases

### Block requests that match a specific detection ID

```js
any(cf.bot_management.detection_ids[*] eq 3355446)
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"
```

### Run Bot Management without specific detection IDs

```js
cf.bot_management.score lt 30
and not cf.bot_management.verified_bot
and http.request.uri.path eq "/login"
and http.request.method eq "POST"
and not any(cf.bot_management.detection_ids[*] in {3355446 12577893})
```

***

## Account takeover detections

Using the detection IDs below, you can detect and mitigate account takeover attacks. You can monitor the number of login requests for a given software and network combination, as well as the percentage of login errors. When it reaches a suspicious level, you can prevent these attacks by using [custom rules](https://developers.cloudflare.com/waf/custom-rules/), [rate limiting rules](https://developers.cloudflare.com/waf/rate-limiting-rules/), and [Workers](https://developers.cloudflare.com/workers/).

| Detection ID | Description |
| - | - |
| `201326592` | Observes all login failures to the zone. |
| `201326593` | Observes all login traffic to the zone. |
| `201326598` | Sets a dynamic threshold based on the normal traffic that is unique to the zone. When the ID matches a login failure, Bot Management sets the [bot score](https://developers.cloudflare.com/bots/concepts/bot-score/) to 29 and uses [anomaly detection](https://developers.cloudflare.com/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |

### Challenges for account takeover detections

Cloudflare's [Managed Challenge](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) can limit brute-force attacks on your login endpoints.

To access account takeover detections:

* Old dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
  2. Go to **Security** > **WAF**.
  3. Under **Custom Rules**, select **Create rule**.
  4. Fill out the form using **Bot Detection IDs** along with other necessary information.
  5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.

* New dashboard

  1. In the Cloudflare dashboard, go to the **Security rules** page.

     [Go to **Security rules**](https://dash.cloudflare.com/?to=/:account/:zone/security/security-rules)

  2. Select **Create rule** and choose **Custom rule**.

  3. Fill out the form using **Bot Detection IDs** along with other necessary information.

  4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.

```js
(any(cf.bot_management.detection_ids[*] eq 201326593))
```

### Limit logins with account takeover detections

Rate limiting rules can limit the number of logins from a particular IP, JA4 Fingerprint, or country.

To use rate limiting rules with account takeover detections:

* Old dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
  2. Go to **Security** > **WAF**.
  3. Under **Rate limiting rules**, select **Create rule**.
  4. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.
  5. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.

* New dashboard

  1. In the Cloudflare dashboard, go to the **Security rules** page.

     [Go to **Security rules**](https://dash.cloudflare.com/?to=/:account/:zone/security/security-rules)

  2. Select **Create rule** and choose **Rate limiting rule**.

  3. Fill out the form using the **Custom expression builder** and `cf.bot_management_detection_ids` along with other necessary information.

  4. Select **Save as draft** to return to it later, or **Deploy** to deploy the rule.

Note

The rule can be enhanced with Leaked Credential Checks. Refer to the [WAF documentation](https://developers.cloudflare.com/waf/detections/leaked-credentials/) for more information on how to include leaked credentials and account takeover detections in a rate limiting rule.

## Additional detections

| Detection ID | Description |
| - | - |
| `50331651` | Observes traffic from residential proxy networks and similar commercial proxies. When the ID matches a request, Bot Management sets the bot score to 29 and uses [anomaly detection](https://developers.cloudflare.com/bots/concepts/bot-detection-engines/#anomaly-detection-enterprise) as its score source. |

***

## Bot Detection IDs via Logpush

You can create or edit existing Logpush jobs to include the new Bot Detection IDs field which will provide an array of IDs for each request that has heuristics match on it. The `BotDetectionIDs` field is available as part of the HTTP Requests dataset and you can add it to new or existing jobs via the Logpush API or on the Cloudflare dashboard. This is the primary method to discover Detection IDs.

* Dashboard

  1. In the Cloudflare dashboard, go to the **Logpush** page.

     [Go to **Logpush**](https://dash.cloudflare.com/?to=/:account/logs)

  2. Select **Create a Logpush Job**.

  3. Select and enter the destination information.

  4. Select **HTTP Requests** as the dataset.

  5. Select **BotDetectionIDs** under the General data field category.

  6. Prove the ownership.

  7. Select **Save**.

* API

  [Update your logpush job](https://developers.cloudflare.com/logs/logpush/logpush-job/log-output-options/) by adding `BotDetectionIDs` to the `output_options:` parameters.

***

## Availability

Detection IDs are available for Enterprise Bot Management customers.
