Cloudflare exposed bot scores to Worker route rules so teams can challenge scrapers in code without rewriting every WAF click-path.
Cloudflare opened bot scores to Worker route handlers. If you already pay for bot management, you can branch in code instead of expressing every edge case as another dashboard rule. That is a gift to teams who outgrew pure click-ops and still do not want to reinvent bot detection from packet scraps.
What you can do with the score
A Worker can read the score and decide to serve, challenge, soft-rate-limit, or log for later. That lets you treat /api/search differently from a marketing landing page without maintaining two disconnected rule sets that drift apart. Cloudflare’s signal is the same family of score the WAF already used. You are not getting a second, secret reputation system. You are getting programmatic access to the one you bought.
Eligibility still depends on bot management being enabled for the zone. Without that product, there is no score to read. Read the docs for your plan before you rewrite a Worker on the assumption the field will always be present.
Do not worship the number
A bot score is a useful prior. It is not proof. Shared office networks, privacy browsers, and odd corporate gateways produce ugly scores for real people. If you hard-block everything under an aggressive threshold, you will file tickets from your own staff. Combine the score with rate limits, caching, and challenge flows that real users can pass.
Start in log-only mode for a week. Chart false positives. Then enforce. Cloudflare gave Workers a sharper input. The judgment about who gets through still sits with you.
Instrumentation before enforcement
Emit the score into your existing request logs with a sampled flag so you can join it to conversion and support tickets. Product will ask whether the challenge page hurt checkout; you will want numbers, not vibes. Keep a kill switch in the Worker that ignores the score entirely. Edge logic that cannot be disabled during an incident becomes the incident. Cloudflare gave you a signal. Operability is still a feature you have to build on top.