4 min
Multi-Signal Request Fingerprints: Combining TLS, HTTP and Network
How to design a composite request fingerprint from TLS, HTTP and network signals: picking fields, hashing them safely, and keeping implementations in sync.
read →$ ls ./blog
Notes on bots, fingerprints and the edge.
Technical articles on TLS fingerprinting, detecting scrapers and spoofed crawlers, and blocking bots at the edge with Cloudflare Workers.
01 / topic
Request fingerprinting
How TLS, HTTP and network signals identify the client behind a request, and why they beat IP addresses and user-agent strings for blocking bots.
4 min
TLS Fingerprinting Explained: JA3, JA4 and the ClientHello
How the TLS ClientHello reveals which software made a request, how JA3 and JA4 turn it into a fingerprint, and what Chrome's extension shuffling changed.
read →5 min
Why IP Blocking Fails Against Modern Bots (and What to Use Instead)
IP bans hit real users behind CGNAT and proxies while scrapers rotate addresses for pennies. Why IP-based bot blocking fails, and what to key on instead.
read →02 / topic
Bot detection
Spotting scrapers, scanners and spoofed crawlers: the signs to look for, verifying search engines, and controlling AI crawlers.
5 min
AI Crawlers Explained: GPTBot, ClaudeBot and How to Control Them
Which AI crawlers visit your site, what each one does with your content, and how to allow, block or limit them with robots.txt, verification and edge rules.
read →3 min
Is Your Site Being Scraped? Signs to Look For and What to Do
The symptoms of scraping and automated abuse in your analytics, logs and bills, how to confirm what's going on, and the practical steps to take next.
read →4 min
Spoofed Googlebot: How to Verify Search Engine Crawlers
Many requests claiming to be Googlebot aren't. Verify crawlers with reverse and forward DNS or published IP ranges, and learn why user-agent checks aren't enough.
read →03 / topic
Edge security
Protecting your site at the CDN edge: Cloudflare's bot products compared, designing checks that fail safely, and what blocking bots saves your origin.
4 min
What Bot Traffic Really Costs Your Origin (and How to Estimate It)
Bots cost more than bandwidth: compute, database load, cache misses and skewed analytics. A simple model to estimate what bot traffic costs your origin.
read →5 min
Cloudflare Bot Fight Mode vs Super Bot Fight Mode vs Bot Management
What each Cloudflare bot product does, which plan includes it, and where the gaps are, so you can choose the right protection for your plan and your traffic.
read →4 min
Fail-Open vs Fail-Closed: Security Checks That Won't Break Your Site
When a security check errors, should the request go through or be blocked? A framework for choosing fail-open or fail-closed, with patterns that make either safe.
read →