demo: bot score reflection

every request that hits cloudflare gets annotated with bot management signals in request.cf.botManagement. this page fetches those fields from a pages function and renders them. compare a real browser (score ≈ 99, likely human) vs curl or postman (much lower).

click the button…

# try from your terminal

# curl with default user-agent (usually scored low)
curl -s "https://rhocfsandbox.com/api/bot-score" | jq

# spoofing a real browser UA still fails behind the scenes — bot management
# uses fingerprinting signals well beyond user-agent
curl -s -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" "https://rhocfsandbox.com/api/bot-score" | jq

# what the fields mean

`score`	1-99. lower = more bot-like. 99 = confident human.
`verifiedBot`	true if the request came from a known good bot (googlebot, bingbot, etc)
`staticResource`	true if the requested asset is a static file (bot scoring usually skipped)
`ja3Hash`	tls client fingerprint
`detectionIds`	ids of the bot detections that fired for this request

some fields require the bot management enterprise sku. free / pro / biz zones see a subset. if you see null for a field, that signal isn't enabled on this zone.