We are currently dealing with a massive wave of AI bot and scraper traffic (GPTBot, ClaudeBot, Bytespider, curl, etc.) hitting our standard CloudPages—experiencing around 20 million hits recently. Because these requests load successfully and return a standard 200 OK, they are rapidly consuming our Super Message budget. We are actively working on mitigation strategies, but our infrastructure has a mixed setup, which brings up a few challenges:
Self-Hosted DomainsFor our self-hosted domains, we know the best practice is to handle this at the edge. We are looking to configure WAF rules via Cloudflare to drop or challenge these malicious IPs and User-Agents before they even reach ExactTarget servers.
Delegated DomainsFor domains fully delegated to Salesforce, SF controls the DNS and the edge routing. This means we cannot simply put our own Cloudflare/WAF in front of it to drop the traffic.
Our Current Internal Workaround using SSJSWhile we figure out the network-level blocks, we’ve implemented a pure SSJS script on Line 1 of our CloudPages. It reads the User-Agent and, if it matches our bot blacklist, we immediately trigger Platform.Function.RaiseError to abort the page and throw a 500 Internal Server Error. According to official documentation, since it doesn't return a 200 OK, it shouldn't count as a billable CloudPage impression (we are waiting for SF Support to definitively confirm this).
My questions for the community:
Delegated Domains Protection: Has anyone successfully requested Salesforce Support to implement custom WAF rules (IP or User-Agent blocking) for a specific tenant on delegated domains?Billing: Can anyone confirm from their own billing reports if the RaiseError (500 status) workaround successfully prevents the Super Message consumption in practice?Are there any other native SFMC settings or alternative architectures we should consider to protect delegated domains from this aggressive scraping?
Thanks in advance for any insights!
