Is Cloudflare treating your visitors differently per colo — or per bot?
Cloudflare's edge is not one computer. Your visitors land on hundreds of points of presence, each applying Bot Fight Mode, WAF rules, and bot scores with local context. A page that loads in Ashburn can challenge in London. A rule that passes your browser can block GPTBot. These differences are invisible from a single vantage point — which is why single-point uptime checks keep saying "all green" while your logs disagree.
Bot Fight Mode: the quiet traffic killer
Bot Fight Mode and Super Bot Fight Mode challenge requests Cloudflare scores as automated. The score blends user-agent, TLS fingerprint, IP reputation, and behavior — so a legitimate crawler with a datacenter IP can score like a scraper. The damage shows up as SEO decay (crawlers stop coming), AI invisibility (GPTBot never gets the page), and support tickets you cannot reproduce from your own browser.
What WebMTR actually checks
- Per-colo Flaregun pool: scans execute from three origins (Ashburn, London, Karachi) with twelve rotating workers, so per-colo and per-region variance surfaces instead of averaging away.
- Challenge attribution: managed challenges, interactive checkboxes, and silent blocks are each classified with the headers and page markers that prove them.
- Bot-score differential: the twelve-plus bot matrix shows exactly which identities clear the edge and which do not — the allowlist conversation starts from evidence, not guesses.
- Honest limits: interactive challenges cannot be auto-solved from datacenter IPs by design; the report says when a verdict is inconclusive instead of inventing certainty.
What you get
A per-origin, per-identity verdict table with the Cloudflare-specific evidence, plus the fix path: rule adjustments, verified-bot allowlisting, and configuration snippets. Pair it with the sample report to see the format before you scan.