n8n Workflow: Score Cloudflare Bot Threats & Manual Block Advice

Stop suspicious Cloudflare traffic with evidence-based bot threat scoring (and clear block advice)

This n8n workflow automatically reviews Cloudflare firewall events, scores likely bot behavior per client IP using a deterministic ruleset, and outputs manual block / managed-challenge recommendations—plus a review queue for medium risk.

What this workflow does

• Runs every 15 minutes (or can be started manually) to pull fresh data using a configurable look-back window and risk thresholds.
• Uses the Cloudflare REST API to discover available zones, then selects the final zones to assess.
• Builds and executes Cloudflare GraphQL queries per zone to retrieve recent firewallEventsAdaptive events.
• Aggregates events by zone and client IP, calculating signals such as:
  • probe-path hits
  • 404 rate patterns
  • distinct paths behavior
  • challenge outcome indicators
• Assigns each IP to an explainable recommendation band:
  • monitor (low risk)
  • recommend_review (medium risk)
  • recommend_block (high risk)
• Formats high-risk offenders into copy/paste block or managed-challenge guidance (including a suggested Cloudflare IP List payload), while medium-risk results are sent to a review message; low-risk traffic is logged.

Use cases

• SaaS operators who want periodic Cloudflare bot threat triage without manual log digging
• Automation engineers needing an n8n workflow that turns firewall events into actionable IP block advice
• Teams that prefer transparent, non-AI risk scoring for deterministic auditing

Technical details

• Authentication: Cloudflare API token with Zone: Read and Analytics: Read used in an n8n HTTP Header as Authorization: Bearer <token>
• n8n nodes / components: code, no op, switch, sticky note, http request, manual trigger
• Core integrations: Cloudflare REST API (zone discovery) + Cloudflare GraphQL API (firewallEventsAdaptive ingestion)