Rules - Bot management fields and ASN support in Cache Rules

<div tabindex="-1" class="heading-wrapper level-h4"><h4 id="bot-management-fields-and-asn-support-in-cache-rules">Bot management fields and ASN support in Cache Rules</h4><a class="anchor-link" href="#bot-management-fields-and-asn-support-in-cache-rules"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Cache Rules now supports bot management fields and the <code>ip.src.asnum</code> field in expression filters. You can now build cache policies that differentiate between automated and human traffic, or segment caching behavior by autonomous system number (ASN).</p> <p>This allows you to apply different caching strategies for verified bots, high-risk traffic, or specific network operators without affecting legitimate user requests. For example, you can set shorter cache TTLs for suspected bot traffic or bypass cache entirely for requests from specific ASNs.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="new-fields">New fields</h4><a class="anchor-link" href="#new-fields"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The following fields are now available in Cache Rules expressions:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Field</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>cf.bot_management.score</code></td> <td>Number</td> <td>Bot score from <code>1</code> to <code>99</code>, where a lower value indicates a higher likelihood that the request originates from a bot.</td> </tr> <tr> <td><code>cf.bot_management.ja3_hash</code></td> <td>String</td> <td>JA3 fingerprint of the request, which helps identify the client making the connection.</td> </tr> <tr> <td><code>cf.bot_management.ja4</code></td> <td>String</td> <td>JA4 fingerprint of the request, which provides a more detailed client identification than JA3.</td> </tr> <tr> <td><code>cf.bot_management.verified_bot</code></td> <td>Boolean</td> <td>Whether the request originates from a verified bot, such as a search engine crawler.</td> </tr> <tr> <td><code>cf.bot_management.static_resource</code></td> <td>Boolean</td> <td>Whether the request is for a static resource and therefore exempt from bot detection.</td> </tr> <tr> <td><code>cf.bot_management.js_detection.passed</code></td> <td>Boolean</td> <td>Whether the browser passed JavaScript detection when the feature is enabled.</td> </tr> <tr> <td><code>cf.bot_management.detection_ids</code></td> <td>Array&lt;Number&gt;</td> <td>List of IDs that correspond to Bot Management heuristic detections made on the request.</td> </tr> <tr> <td><code>cf.bot_management.tags</code></td> <td>Array&lt;String&gt;</td> <td>List of tags associated with the bot traffic, such as <code>API</code>, <code>GOOGLE</code>, or <code>BING</code>. Match a tag with an expression such as <code>any(cf.bot_management.tags[*] eq "API")</code>.</td> </tr> <tr> <td><code>cf.bot_management.signed_agent</code></td> <td>Boolean</td> <td>Whether the request originates from a known agent that identifies itself with Web Bot Auth.</td> </tr> <tr> <td><code>cf.bot_management.corporate_proxy</code></td> <td>Boolean</td> <td>Whether the request originates from a known corporate proxy.</td> </tr> <tr> <td><code>ip.src.asnum</code></td> <td>Number</td> <td>The autonomous system number (ASN) of the incoming request's IP address.</td> </tr> </tbody> </table></div> <aside role="note" aria-label="Note" class="aside-card flex items-start gap-3 rounded-lg px-4 py-3 my-4" style="--_c: var(--nb-info); --_t: var(--nb-info-muted);" data-astro-cid-znle5jil><span class="flex h-[1.375em] shrink-0 items-center" aria-hidden="true" data-astro-cid-znle5jil><svg width="1em" height="1em" viewBox="0 0 256 256" class="h-[1em] w-[1em]" data-astro-cid-znle5jil="true" data-icon="ph:info"><path fill="currentColor" d="M128 24a104 104 0 1 0 104 104A104.11 104.11 0 0 0 128 24m0 192a88 88 0 1 1 88-88a88.1 88.1 0 0 1-88 88m16-40a8 8 0 0 1-8 8a16 16 0 0 1-16-16v-40a8 8 0 0 1 0-16a16 16 0 0 1 16 16v40a8 8 0 0 1 8 8m-32-92a12 12 0 1 1 12 12a12 12 0 0 1-12-12"/></svg></span><div class="flex min-w-0 flex-1 flex-col gap-0.5" data-astro-cid-znle5jil><p class="m-0 text-base leading-snug font-semibold" data-astro-cid-znle5jil>Note</p><div class="aside-card-body text-sm leading-normal" data-astro-cid-znle5jil><p>Bot management fields require a Bot Management subscription. <code>ip.src.asnum</code> is available on all plans.</p></div></div></aside> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="example">Example</h4><a class="anchor-link" href="#example"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Cache Rules expressions support combining these fields with other criteria. The following example sets a shorter cache TTL for API requests that originate from a high-risk bot or an unexpected ASN:</p> <figure class="nb-code-figure" data-nb-lang="txt"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="txt" data-nb-lang="txt"><code><span class="line"><span class="nb-shiki-wvjl67">(http.request.uri.path contains "/api/" and cf.bot_management.score lt 30)</span></span> <span class="line"><span class="nb-shiki-wvjl67">or</span></span> <span class="line"><span class="nb-shiki-wvjl67">(http.request.uri.path contains "/api/" and not ip.src.asnum in {12345 67890})</span></span></code></pre></figure> <p>To learn more, refer to the <a href="https://developers.cloudflare.com/cache/how-to/cache-rules/">Cache Rules documentation</a> and the <a href="https://developers.cloudflare.com/ruleset-engine/rules-language/fields/">Fields reference</a>.</p>