Bots

Granular access controls for the top Personal Agents

The Configure AI bot policies setting is now named AI Crawler and Agent access policies. Personal agents act on a person's behalf, fetching information or browsing in response to a request. The updated policies let you set actions for the top Personal Agents individually. This gives you control over agent access while allowing visitors to use agents to find answers or compare products using your…

Workers subrequests now preserve context for BYOIP destinations

Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using Bring Your Own IP (BYOIP). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic. Previously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to…

China-native Challenge Pages for the China Network

Challenge Pages served through the Cloudflare China Network now use Turnstile widgets hosted in Mainland China. This means that visitors in Mainland China can complete challenges faster and more reliably because widgets no longer need to make cross-border requests. You do not need to take any action: this change applies automatically when a China Network zone presents a Challenge Page. Visitors s…

Precursor adds Monitor mode

We released Monitor mode at customers' request so they can test Precursor and the Precursor Interstitial without updating bot score. In Security > Settings, the Precursor Status dropdown now offers Off, Monitor, and Arm. Selecting Arm means Precursor detections can affect bot score and Challenge clearance. Selecting Monitor means Precursor detections do not affect bot score or Challenge clearance…

Continuous accountability for Verified bots Blog

Identity alone doesn't guarantee a bot will behave responsibly. We are introducing a system to continuously evaluate whether Verified bots honor site preferences, like robots.txt and HTTP 429s, ensuring they remain accountable over time.

Cloudflare and OpenAI: Making AI discovery better for everyone Blog

How Cloudflare and OpenAI are working together to help AI find useful content, keep up with changes, and make fewer wasted requests — making the experience better for users and website owners alike.

Control JavaScript Detections API results

Enterprise Bot Management customers can control whether Cloudflare uses results created through the JavaScript Detections API for bot scoring and detections. Turn JavaScript Detections for API traffic on or off in Security > Settings. You can also configure the zone through the Bot Management API by setting jsd_api_results_enabled: { "jsd_api_results_enabled": true } This setting is separate from…

Bot Management's machine learning model now retrains more frequently instead of shipping fixed versions

We have launched Adaptive Intelligence, a new bot detection engine built to close the gap between when an attack pattern first appears and when protection against it reaches every customer. You can read the announcement blog ↗︎ for the full story behind why we built it. Adaptive Intelligence, the machine learning model behind your bot score, now retrains more frequently instead of shipping as a f…

Precursor introduces session-based bot detection

Precursor is rolling out to all customers starting today. Precursor is client-side JavaScript that enables session-based bot detection. You can read the announcement blog ↗︎ for background on why we built Precursor and how session-level behavioral detection works. With Precursor enabled, Cloudflare can: Continuously evaluate behavioral signals across a session Re-validate challenge clearance as b…

New options to manage AI traffic

Not all AI traffic is the same. Now, all customers — including those on the Free plan — can manage AI crawlers based on what they actually do on your site. Cloudflare groups AI traffic into three behaviors you can control independently: Search, Agent, and Training. This lets you keep the automated traffic that sends readers and revenue back to you, while blocking the traffic that only takes from…

More visibility into bot traffic with BotBase and Business Insights

With Content Independence Day 2026, Enterprise Bot Management customers get two new tools that make bot traffic far easier to see and reason about: BotBase, a searchable directory of every bot Cloudflare tracks, and Business Insights, a dashboard that shows how much value each crawler sends back to your business. BotBase is Cloudflare's directory of all known bots and agents, available directly i…