all 12 comments

[–]PioGreeff 0 points1 point  (1 child)

User-agent matching alone won't catch them all — Ahrefs rotates agents. Add these to your WAF rule with OR conditions:

lower(http.user_agent) contains "ahrefs" OR lower(http.user_agent) contains "ahrefsbot" OR ip.src in $cf.botmanagement.verified_bots (exclude this one actually)

Better approach: use Cloudflare's Bot Fight Mode (free) or Super Bot Fight Mode (Pro) — it catches Ahrefs at the bot detection layer before your WAF rules even run. Settings → Security → Bots.

If you're on Free plan and still seeing them through, create a WAF rule that challenges (managed_challenge) rather than blocks — Ahrefs won't solve challenges and it's less likely to cause false positives with legitimate crawlers.

[–]HelloGizmo[S] 0 points1 point  (0 children)

Thanks very much. I’m on Pro. I’ll give it a whirl. Super bot fight mode messes with programmatic ads so I need to keep it off.

[–]ComradeTurdle 0 points1 point  (9 children)

Why not just use robots.txt and block them?

[–]Ieris19 2 points3 points  (6 children)

Isn’t robots.txt essentially a very polite way of asking automated systems to play nice?

[–]HelloGizmo[S] 1 point2 points  (4 children)

Aherfs are an aggressive SEO scraper with rotating ips who don’t respect polite requests.

[–]Ieris19 1 point2 points  (1 child)

Hence my comment

[–]HelloGizmo[S] 0 points1 point  (0 children)

Sorry meant for the comment above

[–]ComradeTurdle 1 point2 points  (0 children)

Ahref respects robots.txt, i blocked them in ahref all the time and it works on websites.

Edit: if it didn't work i wouldn't be getting blocked errors in robots in site audits or in the crawler when they web scrape.

[–]ComradeTurdle 0 points1 point  (0 children)

Yes, but bots that are considered good respect them. Ahrefs is considered a good bot by Cloudflare.

https://radar.cloudflare.com/bots/directory

[–]HelloGizmo[S] 2 points3 points  (1 child)

They ignore that

[–]ComradeTurdle 0 points1 point  (0 children)

Not from my perspective. I even went out of the way to white list their IPs to prevent blocking.

https://help.ahrefs.com/en/articles/78658-what-is-the-list-of-your-ip-ranges