`http.request.uri.query != ""` maybe?

BFM and SBFM are high security features intended to quickly help customers under active attack stop as many bots as possible. Due to the high security threshold, false positives do sometimes happen.

BFM has limited control. You cannot bypass or skip BFM using the Skip action in WAF custom rules or using Page Rules. BFM will be disabled if there are any IP Access rules present.

Thank you for contacting Cloudflare Support, I’ve brought your inquiry to the attention of the Community team. Customer Support is currently experiencing an extremely high demand for free services and email support is prioritized for paying customers.

As a Free customer, you can still get great support for general questions and basic troubleshooting in our Community. And, you have full access to our detailed troubleshooting guides in the Help Center and our Developer Center documentation.

Follow these steps to ask this question to the Community:

First, login to the Community.
Next, to post your inquiry, click here (don't forget to include "Remove "email removed due to privacy Account" from my Account" to the details).
Finally, to search the Community before you post, click here.

If your question is related to billing or two-factor authentication, please reply to this email and let me know. If not, your question should be asked in the Community so that other Customers will also benefit from the answer.