Allow traffic from search engine bots

This example custom rule challenges requests from a list of countries, but allows traffic from search engine bots — such as Googlebot and Bingbot — and from other verified bots.

The rule expression uses the cf.client.bot field to determine if the request originated from a known good bot or crawler.

• When incoming requests match:

  Field	Operator	Value	Logic
  Country	is in	Mexico, United States	And
  Known Bots	equals	false

  If you are using the expression editor:
  (ip.src.country in {"US" "MX"} and not cf.client.bot)

• Then take action: Managed Challenge

Other resources

• Use case: Challenge bad bots
• Cloudflare bot solutions
• Troubleshooting: Bing's Site Scan blocked by a WAF managed rule
• Learning Center: What is a web crawler? ↗