Essential cookie · Cloudflare
__cf_bm Cookie: What It Is, Who Sets It, and Consent Rules
Last verified 2026-10-16 · Updated 2026-10-16
On this page
What the __cf_bm Cookie Does on Your Site
The __cf_bm cookie is a strictly necessary security cookie that Cloudflare sets to tell human visitors apart from bots. Cloudflare bot products score each request, and "the __cf_bm cookie is necessary for these bot solutions to function properly", according to the Cloudflare cookie documentation. The __cf_bm cookie keeps the score of the visitor, so Cloudflare blocks or challenges automated traffic without asking every human visitor to solve a challenge.
Cloudflare encrypts the content: "the information in the cookie (other than time-related information) is encrypted and can only be decrypted by Cloudflare." Cloudflare creates a separate __cf_bm cookie for each site a visitor opens, so the cookie never follows the visitor from one site to another, according to the Cloudflare cookie documentation.
| Cookie name | __cf_bm |
|---|---|
| Vendor | Cloudflare |
| Company | Cloudflare, Inc. |
| Category | Essential |
| Party | First-party |
| Domain | Your own domain when your site runs on Cloudflare, or the domain of a vendor that runs on Cloudflare |
| Set by | The Cloudflare edge network, in a Set-Cookie HTTP response header |
| Retention | 30 minutes (1800 seconds), renewed at every page view |
| HttpOnly | Yes |
| Secure | Yes |
| SameSite | None, measured by the TermsFeed website auditor on 9 October 2026 |
| Cookie Consent category | strictly-necessary |
| Privacy Consent vendor category | Essential (essential) |
Who Sets the __cf_bm Cookie
Cloudflare sets the __cf_bm cookie when your site runs a Cloudflare bot product, such as Bot Fight Mode, Super Bot Fight Mode, or Bot Management. The cookie arrives in the HTTP response from the Cloudflare edge network, so no script on your page sets the __cf_bm cookie.
Expect __cf_bm cookies on domains you do not own as well. Scans by the TermsFeed website auditor on 9 October 2026 found 3 __cf_bm cookies on .hubspot.com, .hs-analytics.net, and .hsforms.net. Those cookies came from HubSpot running on Cloudflare, not from the Cloudflare account of the scanned site.
Read how Cloudflare, Inc. handles the data in the Cloudflare privacy policy, and sign the Cloudflare Customer Data Processing Addendum before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.
Does the __cf_bm Cookie Need Consent?
No, the __cf_bm cookie needs no consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.
| Law | Consent before the cookie is set | Opt-out right | Source |
|---|---|---|---|
| EU ePrivacy Directive + GDPR | Not required | None | Article 5(3), ePrivacy Directive |
| UK PECR | Not required | None | Regulation 6 and Schedule A1, PECR |
| California CCPA | No general opt-in | None while the vendor acts as a service provider | Cal. Civ. Code 1798.120 |
The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Cloudflare, such as the Cloudflare bot products.
The ePrivacy Directive exempts the __cf_bm cookie from consent when the cookie is strictly necessary for a service the visitor requests, here to tell human visitors apart from bots on a site that runs Cloudflare bot protection.
The UK Privacy and Electronic Communications Regulations (PECR) exempt the __cf_bm cookie from consent when the cookie is strictly necessary for a service the visitor requests, here to tell human visitors apart from bots on a site that runs Cloudflare bot protection.
The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the __cf_bm cookie. Visitors get no right to opt out of the __cf_bm cookie while Cloudflare acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site.
Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.
How to Handle the __cf_bm Cookie in Your Consent Banner
Let the __cf_bm cookie load for every visitor when your site needs Cloudflare to tell human visitors apart from bots on a site that runs Cloudflare bot protection. Cloudflare sets the __cf_bm cookie at the server, before any consent banner runs, so your consent banner only needs to name the cookie.
Handle the __cf_bm Cookie With TermsFeed Free Cookie Consent
Cloudflare sets the __cf_bm cookie in an HTTP response header, so no script on your page sets the __cf_bm cookie and TermsFeed Free Cookie Consent has no code to hold back. List the __cf_bm cookie in your Cookies Policy as a strictly necessary cookie, so visitors know what Cloudflare stores.
The illustration shows the consent banner and the __cf_bm cookie that arrives before any answer.
__cf_bm cookie in the HTTP response anyway, as a strictly necessary cookie. Illustration of the consent banner.Cookie Consent is free and needs no account. Build your free consent banner for the scripts that do need consent with TermsFeed Free Cookie Consent.
List the __cf_bm Cookie With TermsFeed Privacy Consent
Add Cloudflare to the Essential vendor category of TermsFeed Privacy Consent only to name the cookie in the Preferences Center. Essential vendors run for every visitor without consent, and visitors get no switch to turn them off.
Add Cloudflare as a custom vendor. Pick the "Custom vendor" card, fill in "Vendor name" and "Link to their Privacy Policy", set "What are they used for?" to Essential, leave the vendor tags empty because Cloudflare sets the __cf_bm cookie at the server, and click "Add vendor". The illustration shows the custom vendor form in the TermsFeed app.
Privacy Consent detects the location of each visitor and records every answer in a consent log. Set up Cloudflare as a custom vendor with TermsFeed Privacy Consent.
How to Check the __cf_bm Cookie on Your Site
Check the cookie in a private window. Open Chrome DevTools, select the Application tab, open Cookies, and reload the page. The __cf_bm cookie appears before any answer to the consent banner, which is the expected behaviour for a strictly necessary cookie.
How Long the __cf_bm Cookie Lasts
The __cf_bm cookie lasts 30 minutes (1800 seconds), and the lifetime restarts at every page view.
The __cf_bm cookie "expires after 30 minutes of continuous inactivity by the end user", according to Cloudflare. Every request from the visitor extends the 30 minutes, so an active visitor keeps the same __cf_bm cookie for the whole visit.
Scripts and Requests of Cloudflare That Come With the __cf_bm Cookie
The catalog lists 3 scripts, pixels, and data endpoints of Cloudflare, which a cookie scanner or the Network tab of Chrome DevTools shows next to the __cf_bm cookie. Block the main script, and the requests in the table stop with the main script.
| Type | Resource | Host | What it does |
|---|---|---|---|
| Script | Cloudflare Turnstile (api.js) | challenges.cloudflare.com | The Turnstile script shows the Cloudflare challenge widget that protects a form from bots. |
| Script | Cloudflare Web Analytics beacon (beacon.min.js) | static.cloudflareinsights.com | The Web Analytics beacon measures page views and page speed for the Cloudflare Web Analytics dashboard. |
| Data endpoint | Cloudflare Web Analytics endpoint (cdn-cgi/rum) | cloudflareinsights.com | The Web Analytics endpoint receives the page view and timing data from the beacon. |
__cf_bm Cookie FAQs
Is __cf_bm a necessary cookie?
Yes, the __cf_bm cookie is a strictly necessary cookie. Firstly, Cloudflare describes the cookie as necessary for its bot solutions to work. Secondly, Cloudflare creates a separate cookie for each site, so the cookie tracks nobody across websites. Thirdly, the cookie expires after 30 minutes without activity and holds encrypted data that only Cloudflare reads.
Why do I see __cf_bm on a domain I don't own?
The __cf_bm cookie on another domain comes from a vendor that runs its own service on Cloudflare, such as a form, chat, or analytics tool. Check the Domain column in Chrome DevTools. A __cf_bm cookie on your own domain comes from your Cloudflare account, and a __cf_bm cookie on a vendor domain comes from that vendor.
Can I turn off the __cf_bm cookie?
Yes, the __cf_bm cookie stops with the right Cloudflare setting, and the setting depends on the Cloudflare product. Firstly, Cloudflare Bot Management, an add-on for Enterprise customers, turns off the __cf_bm cookie alone with the bm_cookie_enabled field of its API. Secondly, Cloudflare documents that setting for Bot Management only, so a site on Bot Fight Mode or Super Bot Fight Mode stops the cookie by turning off the bot product. Thirdly, Cloudflare calls the __cf_bm cookie necessary for its bot solutions to function properly. Keep the __cf_bm cookie and list it as strictly necessary unless your site has no need for bot protection.
Does the __cf_bm cookie need a consent banner?
No, the __cf_bm cookie needs no consent, so your consent banner leaves the cookie alone. Firstly, Cloudflare sets the cookie in an HTTP response header, before any consent banner script runs. Secondly, Cloudflare describes the cookie as necessary for its bot solutions to function properly. Thirdly, the cookie expires after 30 minutes of continuous inactivity, according to Cloudflare. List the __cf_bm cookie in your Cookies Policy as a strictly necessary cookie, so visitors know what Cloudflare stores.
Sources for the __cf_bm Cookie
The facts on this page come from the documentation Cloudflare publishes, checked on 2026-10-16. The catalog lists every source so you check each fact yourself.
- Cloudflare Docs, Cloudflare cookies
- HubSpot Knowledge Base, Cookies set in a visitor's browser by HubSpot
- TermsFeed website auditor scan, 9 October 2026 (internal)
- Cloudflare privacy policy
- Cloudflare Customer Data Processing Addendum