Whack a rodent bot: How to setup cloudflare to avoid bot spam traffic

Three years of harassment, high volume spamming of this blog with spurious traffic! 
I wrote about it here.
Now the bot traffic is gone. 👍!
And it cost me just a few hours to clamp this spamming down!

Below are the bot blocking steps I took. First a quick summary:

  1. This blog is hosted by Google's blogger.com. Skip / change below blogger instructions if you have a different blog hosting provider.
  2. The approach needed a new domain name, as I was previously using blogger's domain name space (https://equational.blogger.com). Therefore this solution is not only filtering traffic, it also "moving" my blog from its blogger address to https://blog.coadjoint.com as already many years ago I realized that I was outgrowing a pure equational approach to software.
    • Hindsight is gold, one thought might be, and without malice, that the "co" was missing in the adjoint approach.
  3. Cloudflare's service immediately blocked the bot. Therefore to fully enjoy participating in the whack the bot rodent game, and even though not strictly necessary, I too added manual blocking rules for the incriminating bot activity. 

My blogger bot blocking migration

  1. I have a domain D (for me: coadjoint.com) name hosted by R. My new blog address with be blog.D (my target blog path is: blog.coadjoint.com). You can choose differently than "blog".
  2. Add D to cloudflare. 
    1. Add D under the Domains section of Cloudflare.
    2. Choose your plan.
    3. Let Cloudflare infer your domain's details.
    4. Switch off all Cloudflare's bot access exceptions (e.g. "Allow bots to scan your site..." -> off).
    5. Switch on "Bot Fight Mode"
    6. Note: no extended path "blog.adjoint.com" in the above!
  3. Redirect your domain's traffic to Cloudflare
    1. Copy Cloudflare's nameservers (e.g. my.ns.cloudflare.com and bob.ns.cloudflare.com)
    2. Replace R's old nameservers with the ones from Cloudflare.
  4. Try to redirect blogger to use a custom domain
    1. In blog's blogger setup set "Custom domain" to be blog.D (blog.coadjoint.com).
    2. You get an error, copy the two CNAME fields from the blogger error boxes.
  5. In Cloudflare setup both CNAMEs copied from above. 
    1. Under domain D, DNS > Record
    2. Click Add.
    3. Change type to CNAME
    4. Past name and target
    5. Make sure to have 'DNS Only' set (no proxy).
    6. Do it twice as you have two CNAMEs to add.
  6. Wait, wait, then again redirect blogger to use a custom domain
    1. In blog's blogger setup set "Custom domain" to be blog.D (blog.coadjoint.com).
    2. At some point this succeeds, as routing information will have be updated.
    3. Ensure that HTTPS availability is switched on.
    4. Browse blog.D (should work).
    5. Now set blogger's setting to have HTTPS redirect activated.
    6. Wait a bit.
    7. Check that you old blog (equational.blogger.com) is redirected to blog.D .
    8. Go back to Cloudflare and change CNAME records to Proxy (we had set them to DNS only before).
  7. Change blog name if needed. Write a blog post about the changes.
    1. Change existing blog links to reflect the new domain (at least in the widget part of your blog)..
  8. For extra enjoyment add explicit bot blocking rules.
    1. Look at Cloudflare's security analysis under "domain" D / Security / Analytics
    2. Select an bot event (in the Events Sampled Log)
    3. Find the event's ASN (AS number)
    4. Add a Security rules: 
      1. "AS Num" "is in" "copied ASN" And "Known Bots" equals "unselected".
      2. (later extend that ASN entry list).
      3. Give the rule a good name (e.g. "Block Bots by ASN")
    5. The raw rule expression should look like this:: (ip.src.asnum in {...} and not cf.client.bot)

FYI

  • Spam traffic hurts a blog's indexability. I again want to thank the heads up from my former colleague on this subject! 🙏 
  • Harassment: Any unwanted and repeated behavior, action, or speech that makes a person feel distressed, humiliated, or threatened. It creates an unsafe, hostile, or offensive place for an individual or group.


All original content copyright James Litsios, 2026.