Wise to block or challenge site visitors with empty UA string?

[born2run]

Hi so I have many site visitors with empty UA strings. Typically with bad bots, or just bots, usually a "challenge" attempt via Cloudflare's firewall (captcha) will suffice to block them, or I should set the firewall to block instead of challenge? Please advise. Thanks!

[lucy24]

Well, I certainly block them. At one time I had to make an exemption for Facebook, but mercifully they abandoned empty UAs after a year or two.

[not2easy]

I'm one of those people who block them as well. I've never seen them in any logs doing anything that I want visitors to do.

[born2run]

Thanks and with bad bots do you guys suggest I block or challenge them using Cloudflare?

[lammert]

Why challenge? If you don't want them it's your decision, it is your site. Don't play nice with bad actors, just block them. Traffic I don't want is dropped in the firewall. All those packets are literally sent to a black-hole. It takes the least amount of CPU cycles which I then use to serve the visitors I want.

[born2run]

Well Ok fair enough thanks!