{"product_id":"n8n-workflow-score-cloudflare-bot-threats-manual-block-advice","title":"n8n Workflow: Score Cloudflare Bot Threats \u0026 Manual Block Advice","description":"\u003ch3\u003eStop suspicious Cloudflare traffic with evidence-based bot threat scoring (and clear block advice)\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow automatically reviews Cloudflare \u003cstrong\u003efirewall events\u003c\/strong\u003e, scores likely bot behavior per client IP using a \u003cstrong\u003edeterministic ruleset\u003c\/strong\u003e, and outputs \u003cstrong\u003emanual block \/ managed-challenge recommendations\u003c\/strong\u003e—plus a review queue for medium risk.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns every 15 minutes\u003c\/strong\u003e (or can be started manually) to pull fresh data using a configurable \u003cem\u003elook-back window\u003c\/em\u003e and risk thresholds.\u003c\/li\u003e\n  \u003cli\u003eUses the \u003cstrong\u003eCloudflare REST API\u003c\/strong\u003e to discover available zones, then selects the final zones to assess.\u003c\/li\u003e\n  \u003cli\u003eBuilds and executes \u003cstrong\u003eCloudflare GraphQL\u003c\/strong\u003e queries per zone to retrieve recent \u003ccode\u003efirewallEventsAdaptive\u003c\/code\u003e events.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eAggregates events by zone and client IP\u003c\/strong\u003e, calculating signals such as:\n    \u003cul\u003e\n      \u003cli\u003eprobe-path hits\u003c\/li\u003e\n      \u003cli\u003e404 rate patterns\u003c\/li\u003e\n      \u003cli\u003edistinct paths behavior\u003c\/li\u003e\n      \u003cli\u003echallenge outcome indicators\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003eAssigns each IP to an explainable recommendation band:\n    \u003cul\u003e\n      \u003cli\u003e\n\u003cstrong\u003emonitor\u003c\/strong\u003e (low risk)\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003erecommend_review\u003c\/strong\u003e (medium risk)\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003erecommend_block\u003c\/strong\u003e (high risk)\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003eFormats \u003cstrong\u003ehigh-risk offenders\u003c\/strong\u003e into copy\/paste \u003cstrong\u003eblock or managed-challenge\u003c\/strong\u003e guidance (including a suggested \u003cstrong\u003eCloudflare IP List\u003c\/strong\u003e payload), while \u003cstrong\u003emedium-risk\u003c\/strong\u003e results are sent to a review message; \u003cstrong\u003elow-risk\u003c\/strong\u003e traffic is logged.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSaaS operators who want periodic \u003cstrong\u003eCloudflare bot threat triage\u003c\/strong\u003e without manual log digging\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers needing an n8n workflow that turns \u003cstrong\u003efirewall events\u003c\/strong\u003e into \u003cstrong\u003eactionable IP block advice\u003c\/strong\u003e\n\u003c\/li\u003e\n  \u003cli\u003eTeams that prefer transparent, \u003cstrong\u003enon-AI\u003c\/strong\u003e risk scoring for deterministic auditing\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eAuthentication:\u003c\/strong\u003e Cloudflare API token with \u003cstrong\u003eZone: Read\u003c\/strong\u003e and \u003cstrong\u003eAnalytics: Read\u003c\/strong\u003e used in an n8n HTTP Header as \u003ccode\u003eAuthorization: Bearer \u0026lt;token\u0026gt;\u003c\/code\u003e\n\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n nodes \/ components:\u003c\/strong\u003e code, no op, switch, sticky note, http request, manual trigger\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCore integrations:\u003c\/strong\u003e Cloudflare REST API (zone discovery) + Cloudflare GraphQL API (firewallEventsAdaptive ingestion)\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45742775402675,"sku":"N8N-17629","price":39.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/tUYXpuiU1VmztWlTjsfgA_z0PwlqNj.png?v=1785402470","url":"https:\/\/buyflowscripts.com\/products\/n8n-workflow-score-cloudflare-bot-threats-manual-block-advice","provider":"N8N Commerce","version":"1.0","type":"link"}