cloudflare unique visitors is 5x what ga4 shows, which one is right?

Cloudflare also has a separate Web Analytics product that runs a small script in the browser, like GA4 does. If you turn that on, its numbers are much closer to GA4's than the dashboard's edge traffic figures, which pretty much confirms the gap is bots and non-browser hits. Handy if a client keeps asking why the numbers don't match.

Neither is "right", they count different things. Cloudflare counts unique IPs hitting the edge: bots, uptime monitors, scrapers, people who bounce before any script runs. GA4 only counts browsers that load the tag and, if you use a consent banner, people who accept. Ad blockers knock a chunk off too. So real humans sit somewhere between the two, closer to GA4. I report GA4 for anything about users and behaviour, because it's the number you can actually segment, and add a line explaining it undercounts. Five to one isn't unusual on a small site with a lot of bot traffic.