Block scrapers posing as browsers in your Cloudflare

Sumly finds bots that pretend to be people by their network and how they move, and keeps them out of your numbers. With a token you make, it adds the Cloudflare rule that blocks them: in one click, through your assistant, or by itself.

Open the live demo Start free trial

MRR · all 5 projects

€4,062

from

+16

+13.9% · 30d

Last 30 days €5,750 net

In apps 18%On sites 82%

Just came in

AstroChart Google Play · in the app 🇪🇸 +€9.99
Humanize Stripe · on the site · from Facebook 🇿🇦 +€11.04
TimeLoop App Store · in the app · via RevenueCat 🇺🇸 +€29.99
ASO.best Stripe · on the site 🇺🇸 +€29.00

The live demo: our own apps, with example numbers.

Cloudflare

+ New subscription + Renewal − Refund

MRR, revenue and customers, after fees
Refunds and cancellations taken off
Where each buyer came from

Blocking in three steps

A token for one zone's custom rules, pasted once.

1
In Cloudflare, open My Profile › API Tokens › Create Token › Create Custom Token. Permissions: Zone · Zone WAF · Edit, and Zone · Zone · Read if Sumly should find the zone by your site. Zone Resources: that one zone.
2
In Sumly, open Projects and payments, the project, Bots & blocking, choose Cloudflare and paste the token. Sumly checks it may read the zone's custom rules before it keeps it.
3
Under Insights › Bots › Disguised scrapers, press Block in Cloudflare on a scraper network, or turn on the autopilot to let Sumly block clear ones by itself.

What you see

Cloudflare next to every other project and provider, on the same pages.

Bots

Disguised scrapers, each network or path with its hits, pace, countries and pages, and Block in Cloudflare or Undo.

Overview

One card while a project is being scraped, with the button.

Alerts

One Bot attack notice per attack, in the bell and the app, by e-mail only if you ask.

Visitors and Live

How many page views the Smart bot filter kept out.

Counts toward your plan

Nothing: the Smart bot filter and blocking are on every plan, and bots never count toward your visits. Plans →

What you don't get

Nothing else in Cloudflare is read or changed: DNS, caching and your own rules stay as they are.

The details

What Sumly adds to Cloudflare

For a scraper network, one custom rule: (ip.src.asnum eq <ASN> and not cf.client.bot), action Block.
For scrapers on people's own home connections crowding one part of the site: a Managed Challenge on that path, which people pass and most scripts do not.
Each rule is named sumly_… and added next to yours through the ruleset's rules endpoint. The zone's custom rules are made only when it has none.

When Sumly adds a rule

When you press Block or Challenge, or your assistant calls block_bot and you confirm.
By itself only with the autopilot on (off by default): a cloud network the cluster or quiet rule caught, with 100 or more page views in a stretch. Never a bot that names itself, a search engine or an AI agent. The alert says what it blocked.
Undo deletes Sumly's rule alone. A network you took back is never blocked by the autopilot again.

Good to know

Bots Cloudflare vouches for, such as Googlebot, still get through: that is the not cf.client.bot part.
A network that also carries people at home or on their phones is never blocked whole.
Scrapers on residential proxies that do not crowd one part of the site are not caught.
Disconnecting deletes the token. Rules already added stay in Cloudflare until you take them back.