Cloudflare said new free zones now get Bot Fight Mode on by default, with clearer toggles for teams that need to allow known good scrapers or partner callbacks.
Cloudflare is done pretending every new free zone arrives as a blank canvas that owners will harden later. New free zones now land with Bot Fight Mode already on. The company framed it as a default seatbelt for sites that would otherwise sit naked for weeks while someone “means to” open the security tab. Existing zones keep whatever they already chose. No mass surprise flip—only new birth certificates get the stamp.
What breaks, and what to do
The first afternoon after you create a zone, watch for 403s from uptime bots, RSS fetchers, and partner webhooks that look automated because they are. Cloudflare says the escape hatches are clearer: allowlist the paths and ASNs you actually trust instead of killing the whole feature in a sulk. That is the right workflow. Defaults should be strict. Exceptions should be named.
If you run a documentation site that wants polite scrapers for search indexes you care about, put those crawlers on an allow path and leave the junk traffic in the penalty box. If you run a login form, leave Bot Fight Mode alone until you have a reason measured in tickets, not vibes.
Why Cloudflare is doing this now
Free tiers absorb a lot of drive-by abuse. Turning protections on by default shifts the cost onto attackers and onto the minority of owners who need open scraping. That trade is how mature edge networks behave. It will generate forum threads titled “Cloudflare broke my monitor.” Some of those threads will be fair. Many will be monitors that should have sent a browser-like user agent years ago.
For Genze-sized sites, the move is mostly good news. Create the zone, confirm the origin, glance at the security events graph, allowlist anything legitimate that yelps, and move on. Defaults that save you from becoming someone else’s botnet foothold are worth a five-minute allowlist ritual.