What is the __cf_bm cookie?
The __cf_bm cookie is a strictly necessary cookie used by Cloudflare to support its Bot Management services by identifying and mitigating automated traffic.
Table of Contents
About __cf_bm
| Vendor | Cloudflare |
|---|---|
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Advertising & Paid Media |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 50.9% of scanned pages |
| Expiration Type | Timestamp |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | Mixed |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Low |
| Vendor Privacy Policy | https://www.cloudflare.com/privacypolicy/ |
| Vendor Website | https://www.cloudflare.com |
What is the purpose of __cf_bm?
This cookie is set by Cloudflare's bot mitigation products, such as Bot Management, Bot Fight Mode, or Super Bot Fight Mode, to protect websites from malicious automated traffic. It contains information related to the calculation of Cloudflare's proprietary bot score and, when Anomaly Detection is enabled, a session identifier. By measuring a single user's request patterns and applying them to machine learning models, the cookie smooths out the bot score and reduces false positives for legitimate users. A separate __cf_bm cookie is independently generated for each site a user visits, ensuring that users are not tracked across different sites or sessions. All information within the cookie, aside from time-related data, is one-way encrypted and can only be decrypted by Cloudflare.
What are the Privacy Risks of __cf_bm?
Risk Level: Low
The __cf_bm cookie is categorized as Low risk because it is strictly necessary for site security and bot mitigation. It does not collect or share personal information for tracking or advertising purposes, nor does it track users from site to site. The data it carries is primarily related to a proprietary bot score calculation and is securely encrypted so that it can only be decrypted by Cloudflare.
How to Remove __cf_bm from a Website
To remove this cookie, the website administrator must disable Cloudflare's Bot Management, Bot Fight Mode, or Super Bot Fight Mode features. This can be done via the Cloudflare dashboard under the Security > Bots section by disabling the corresponding bot protection toggles. Alternatively, administrators using the Cloudflare API can specifically disable the cookie by setting the bm_cookie_enabled field to false. Note that disabling these features will remove the automated bot detection and mitigation capabilities from the site, potentially exposing it to malicious traffic.