__cf_bm — Cloudflare
By the OpenCookies team · published 2026-10-22 · updated 2026-10-22
- Service
- Cloudflare
- Category
- Strictly necessary
- Default duration
- 30 minutes
- Type
- First-party cookie (set by your own site)
- Consent required?
- No: a cookie strictly necessary for the requested service does not require consent.
What is it for?
Cloudflare cookie that helps tell bots from human visitors (bot management). It protects the site against abusive traffic.
What does it look like?
The value is a long encrypted string.
How to see it in your browser
Open your site, press F12, then choose the “Application” tab (Chrome, Edge) or “Storage” (Firefox). Under “Cookies”, select your site’s address: the __cf_bm cookie appears in the list if present, with its value and expiry date.
What does the rule say?
A cookie strictly necessary for the requested service does not require consent. It should still be listed in your cookie policy.
How to prevent it before the choice
Nothing to block: it is set by the site’s own protection.
How OpenCookies handles it
OpenCookies does not block this cookie: it is needed for operation. The test still lets you see which cookies are set before any choice.
Check it on my site
Does this cookie appear on your site before the visitor chooses? The OpenCookies test shows it in two minutes.
Related cookies
PHPSESSID— PHP (votre site)__stripe_sid— Stripe
Frequently asked questions
Is consent needed?
It serves site security and is generally considered necessary.
Why does it last only 30 minutes?
It is renewed during browsing to track a human session.
Durations are defaults and may change with configuration. This page describes a cookie; it is not legal advice.